Description

The gateway config.get tool action returns the full config with all ${ENV_VAR} references resolved to their plaintext secret values. Since tool call results are stored in the conversation session transcript, this means every API key, bot token, and secret ends up persisted in the session JSONL files.

Impact

• Session transcripts contain plaintext secrets — stored in ~/.openclaw/agents/main/sessions/*.jsonl
• Agent context is polluted with secrets — the LLM sees all API keys in its conversation history
• Memory search could surface secrets — if session transcripts are indexed for semantic search
• Compaction summaries could leak secrets — if the model summarizes tool output containing keys
• Any session export, backup, or log review exposes credentials

Reproduction

1. Have a config with ${ENV_VAR} references for secrets (API keys, bot tokens, etc.)
2. Agent calls gateway config.get (or user asks about config)
3. The full resolved config including all plaintext secrets is returned as the tool result
4. This is now permanently in the session transcript

Expected Behavior

• config.get should redact or mask sensitive fields (anything matching common secret patterns: apiKey, token, secret, password)
• Or: return the raw ${ENV_VAR} references without resolving them
• Or: omit sensitive fields entirely from the tool response, with a note that they're configured but redacted

Environment

• OpenClaw version: 2026.2.6-3
• OS: macOS (arm64)