OpenClaw Rescue Instances

一键创建和管理完全隔离的 OpenClaw 救援 Gateway 实例，支持端口自动分配及批量创建。

Security Scan

The skill mostly does what it claims (create isolated OpenClaw gateway instances), but there are multiple coherence and safety concerns: macOS-only actions are not declared, the scripts copy your existing config (and any embedded credentials) without sanitization, and the generated LaunchAgent embeds hardcoded user-specific paths.

Purpose & Capability

The declared purpose (create isolated rescue Gateway instances) matches the scripts' behavior: creating directories, copying openclaw.json, adjusting ports, creating LaunchAgents and starting services. However the implementation is macOS-specific (launchctl, ~/Library/LaunchAgents, sed -i ''), while the skill metadata declares no OS restriction. Also the generated plist hardcodes user-specific PATH and HOME values (e.g., /Users/zhuobao) and a specific Node installation path; these are not justified by the high-level description and will likely fail or behave unexpectedly on other systems.

Instruction Scope

The runtime instructions and included scripts read and copy the user's existing ~/.openclaw/openclaw.json into each rescue instance. That file can contain credentials, API keys, and other sensitive configuration; the scripts do not comprehensively sanitize or remove secrets (they disable wecom and clear plugin sections in a limited way). The scripts also create persistent system services (LaunchAgents) and change system state (load/unload plists, rm -rf of instance dirs). These actions are within the apparent purpose but involve reading and duplicating potentially sensitive local files without explicit user confirmation in the scripts themselves.

Install Mechanism

This is an instruction-only skill with shell scripts included; there is no external installer, no downloads, and nothing written to disk by an automated installer step beyond the script actions. No remote code fetch URLs or archive extracts were seen.

Credentials

The skill declares no required environment variables or credentials, yet the scripts duplicate the user's existing openclaw configuration (and therefore any embedded API keys/credentials) into new instance directories. The created LaunchAgent plist also includes a hardcoded PATH, HOME, TMPDIR and other environment entries referencing a specific user (zhuobao) and a specific Node installation path; this leaks author-specific environment assumptions and may expose or misplace environment-sensitive values. The skill does not request explicit consent or separate credentials for the new instances.

Persistence & Privilege

The scripts register and load macOS LaunchAgents (RunAtLoad + KeepAlive), giving the created instances persistent background presence. That persistence is coherent with the stated goal (run rescue gateways continuously), but it modifies user launch agent state and will auto-start services. This is expected for a service-creation tool but is a significant change to the user's system and should be highlighted to the user before installation.

What to consider before installing

What to consider before installing/running this skill: - OS compatibility: The scripts are macOS-specific (launchctl, ~/Library/LaunchAgents, sed -i ''). Don't run them on Linux/Windows. The skill metadata does not declare this. - Inspect the scripts before running: They copy your existing ~/.openclaw/openclaw.json into new instance directories. That config may contain API keys, tokens, or other secrets. The scripts only partially sanitize settings (they attempt to disable wecom and clear plugin config), but they do not comprehensively remove credentials or other sensitive fields. - Hardcoded environment values: The generated plist embeds a PATH, HOME and other environment variables referencing /Users/zhuobao and a specific Node path (/opt/homebrew/...). Update these entries to match your machine. If left unchanged, the service may fail to start or run with incorrect environment values. - Persistence and cleanup: The scripts load LaunchAgents with KeepAlive=true, so instances will auto-restart. Deleting instances uses rm -rf on the created directory and removes the plist; verify the delete script before use and back up any data you care about. - Safe testing: Run the scripts in a controlled environment (test account, VM, or after backing up ~/.openclaw) to confirm behavior. Consider modifying the scripts to (a) prompt before copying configs, (b) sanitize or require fresh credentials for rescue instances, and (c) template PATH/HOME/Node paths from the current environment rather than using hardcoded values. Given these inconsistencies and the potential for accidental credential duplication and unwanted persistent services, proceed only after reviewing and adapting the scripts to your system and security requirements.

OpenClaw 多实例救援 Gateway 快速创建技能。按照官方文档规范，一键创建隔离的救援实例。

---

📖 描述

基于 OpenClaw 官方多实例指南 (docs/gateway/multiple-gateways.md)，自动化创建隔离的救援 Gateway 实例。

适用场景：

• 创建救援 Bot（主实例故障时备用）
• 隔离不同环境（开发/生产）
• 多配置测试
• 端口隔离需求

---

🎯 能力

能力	说明
创建救援实例	一键创建隔离的 Gateway 实例
端口自动分配	自动计算不冲突的端口
配置隔离	独立的配置文件、状态目录、工作目录
LaunchAgent 集成	自动注册 macOS 开机自启服务
批量创建	支持一次性创建多个实例

---

🚀 使用方法

创建单个救援实例

# 默认创建（端口自动分配）
openclaw agent --message "创建一个救援实例，端口 19001"

# 指定端口
openclaw agent --message "创建救援实例，端口 20000"

创建多个救援实例

# 批量创建
openclaw agent --message "创建 3 个救援实例，端口从 19001 开始"

删除救援实例

openclaw agent --message "删除救援实例 rescue2"

---

📋 配置参数

参数	默认值	说明
base_port	19001	起始端口
instance_count	1	创建实例数量
port_spacing	1000	端口间隔（避免派生端口冲突）
disable_wecom	true	是否禁用企业微信（避免冲突）
copy_plugins	false	是否复制插件配置

---

📁 创建的文件

每个救援实例会创建以下内容：

~/.openclaw-rescueN/
├── openclaw.json          # 独立配置文件
├── workspace/             # 独立工作目录
├── sessions/              # 独立会话数据
├── credentials/           # 独立凭证
├── logs/
│   ├── gateway.log
│   └── gateway.err.log
└── agents/                # 独立 Agent 数据

~/Library/LaunchAgents/
└── ai.openclaw.gateway-rescueN.plist  # LaunchAgent 服务

---

⚙️ 隔离配置

每个实例完全隔离以下内容：

配置项	主实例	救援实例
配置文件	~/.openclaw/openclaw.json	~/.openclaw-rescueN/openclaw.json
状态目录	~/.openclaw/	~/.openclaw-rescueN/
工作目录	~/.openclaw/workspace	~/.openclaw-rescueN/workspace
端口	8080	19001, 20000, ...
Service	ai.openclaw.gateway	ai.openclaw.gateway-rescueN

---

🔧 维护命令

查看状态

# 查看所有实例
launchctl list | grep openclaw.gateway

# 健康检查
for port in 8080 19001 20000 30000 40000; do
  curl -sk https://localhost:$port/health && echo " ($port)"
done

重启实例

# 重启单个
launchctl kickstart -k gui/$UID/ai.openclaw.gateway-rescue1

# 重启所有
for name in gateway gateway-rescue1 gateway-rescue2; do
  launchctl kickstart -k gui/$UID/ai.openclaw.$name
done

查看日志

tail -f ~/.openclaw-rescue1/logs/gateway.log

---

⚠️ 注意事项

1. 端口间隔：基础端口之间至少留 20 个端口，推荐 1000+（避免 browser/canvas/CDP 派生端口冲突）

2. 企业微信冲突：多个实例不能用同一个 Bot ID 同时连接企业微信，会互相踢。建议：

   • 只在主实例启用企业微信
   • 或为每个实例配置不同的企业微信应用

3. API 配额：共享 API Key 时，配额是所有实例共用的

4. 磁盘空间：每个实例约占用 100-500MB（取决于会话和缓存）

---

📖 官方文档参考

• Multiple Gateways
• Gateway Configuration
• CLI Gateway

---

📝 变更记录

日期	版本	说明
2026-03-27	1.0.0	初始版本，支持单实例和批量创建

---

💡 示例对话

用户：创建一个救援实例
助手：好的，正在创建救援实例 rescue1...
      - 配置文件：~/.openclaw-rescue/openclaw.json
      - 端口：19001
      - 服务：ai.openclaw.gateway-rescue
      创建完成！实例已启动。

用户：再创建两个，端口从 20000 开始
助手：正在创建 rescue2 (20000) 和 rescue3 (30000)...
      完成！两个实例都已启动。

用户：删除 rescue2
助手：正在删除救援实例 rescue2...
      - 卸载服务：ai.openclaw.gateway-rescue2
      - 删除配置：~/.openclaw-rescue2/
      完成！