Rescue Gateway 2.0

---

name: rescue-gateway

description: 为 OpenClaw 配置稳定可维护的 Rescue Gateway。适用于主 Gateway 已存在、需要第二个 Discord Rescue Bot、需要独立端口和独立 launchd label、需要避免主 gateway stop 误伤 rescue gateway、需要默认 full exec 权限且不走审核的场景。

---

# Rescue Gateway 2.0

当主 Gateway 故障时，Rescue Gateway 提供独立入口。此版本的目标不是“能跑起来”，而是“能长期维护，不和主 Gateway 互相干扰”。

适用场景

结论先行

Rescue Gateway 的推荐落地方式是：

原因：

目录和端口

| 项目 | 主 Gateway | Rescue Gateway |

|------|-----------|----------------|

| Config | `~/.openclaw/openclaw.json` | `~/.openclaw-rescue/openclaw.json` |

| State | `~/.openclaw` | `~/.openclaw-rescue` |

| Workspace | `~/.openclaw/workspace` | `~/.openclaw-rescue/workspace` |

| Port | `18789` | `19001` |

| launchd label | `ai.openclaw.gateway` | `ai.openclaw.gateway.rescue` |

端口必须至少错开 20。OpenClaw 会派生浏览器和调试端口，不能重叠。

Rescue Config

优先做法：以主配置为模板，写入 `~/.openclaw-rescue/openclaw.json`。

关键要求：

最小关键片段：

{
  "agents": {
    "defaults": {
      "elevatedDefault": "full",
      "workspace": "/Users/YOUR_NAME/.openclaw-rescue/workspace"
    },
    "list": [
      {
        "id": "rescue",
        "workspace": "/Users/YOUR_NAME/.openclaw-rescue/workspace",
        "agentDir": "/Users/YOUR_NAME/.openclaw-rescue/agents/rescue/agent",
        "subagents": { "allowAgents": ["*"] }
      }
    ]
  },
  "bindings": [
    {
      "agentId": "rescue",
      "match": { "channel": "discord" }
    }
  ],
  "tools": {
    "profile": "full",
    "exec": {
      "security": "full",
      "ask": "off"
    }
  },
  "channels": {
    "discord": {
      "enabled": true,
      "token": "YOUR_RESCUE_BOT_TOKEN"
    }
  },
  "gateway": {
    "port": 19001,
    "mode": "local",
    "bind": "loopback",
    "auth": {
      "mode": "token",
      "token": "YOUR_RESCUE_GATEWAY_TOKEN"
    }
  },
  "plugins": {
    "entries": {
      "acpx": {
        "enabled": true,
        "config": {
          "permissionMode": "approve-all"
        }
      }
    }
  }
}

Rescue Agent Auth

Rescue agent 使用独立 `agentDir`，不会自动继承主 agent 的认证。

如果 rescue bot 能登录 Discord，但回复时报：

就把主 agent 的认证复制过去：

cp ~/.openclaw/agents/main/agent/auth-profiles.json \
  ~/.openclaw-rescue/agents/rescue/agent/auth-profiles.json

chmod 600 ~/.openclaw-rescue/agents/rescue/agent/auth-profiles.json

Rescue LaunchAgent

不要用官方默认 profile service label。

使用自定义 plist：

- `OPENCLAW_PROFILE=rescue`

- `OPENCLAW_STATE_DIR=~/.openclaw-rescue`

- `OPENCLAW_CONFIG_PATH=~/.openclaw-rescue/openclaw.json`

- `OPENCLAW_LAUNCHD_LABEL=ai.openclaw.gateway.rescue`

关键原因：

启动与验证

加载 rescue：

launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/ai.openclaw.gateway.rescue.plist
launchctl enable gui/$(id -u)/ai.openclaw.gateway.rescue
launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway.rescue

验证：

OPENCLAW_LAUNCHD_LABEL=ai.openclaw.gateway.rescue \
openclaw --profile rescue gateway status

tail -f ~/.openclaw-rescue/logs/gateway.log

成功标志：

[discord] logged in to discord as XXXXX (OpenClaw Rescue Bot)

日常命令

主 gateway：

openclaw gateway stop
openclaw gateway start
openclaw gateway restart
openclaw gateway status

rescue gateway：

OPENCLAW_LAUNCHD_LABEL=ai.openclaw.gateway.rescue \
openclaw --profile rescue gateway stop

OPENCLAW_LAUNCHD_LABEL=ai.openclaw.gateway.rescue \
openclaw --profile rescue gateway start

OPENCLAW_LAUNCHD_LABEL=ai.openclaw.gateway.rescue \
openclaw --profile rescue gateway restart

OPENCLAW_LAUNCHD_LABEL=ai.openclaw.gateway.rescue \
openclaw --profile rescue gateway status

如果只是 emergency 操作，直接用 `launchctl` 也可以：

launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/ai.openclaw.gateway.rescue.plist
launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/ai.openclaw.gateway.rescue.plist

诊断顺序

1. 先看配置是否有效

openclaw --profile rescue config validate

2. 再看 service

OPENCLAW_LAUNCHD_LABEL=ai.openclaw.gateway.rescue \
openclaw --profile rescue gateway status

3. 再看日志

tail -f ~/.openclaw-rescue/logs/gateway.log
tail -f ~/.openclaw-rescue/logs/gateway.err.log

Changelog

2.0.0

- `tools.exec.security = "full"`

- `tools.exec.ask = "off"`

- `agents.defaults.elevatedDefault = "full"`

- `plugins.entries.acpx.config.permissionMode = "approve-all"`

1.0.0 的缺陷

已知现实约束