Description
When a plugin config key is invalid (e.g. after a schema migration), the gateway throws a hard config validation error and exits with code 1 instead of disabling only the affected plugin and continuing to start.
Real-World Incident
After upgrading from 2026.3.28 → 2026.4.1, the tools.web.search config schema changed. The old brave key path was now an unrecognized key. Instead of degrading gracefully (disabling Brave search, starting without it), the gateway rejected the entire config and refused to start.
Actual Log
Apr 02 20:20:46 node[2645786]: Config invalid
Apr 02 20:20:46 node[2645786]: - tools.web.search: Unrecognized key: "brave"
Apr 02 20:20:46 systemd[332]: openclaw-gateway.service: Main process exited, code=exited, status=1/FAILURE
Apr 02 20:20:46 systemd[332]: openclaw-gateway.service: Failed with result 'exit-code'.
Apr 02 20:20:52 systemd[332]: openclaw-gateway.service: Scheduled restart job, restart counter is at 1.
This single config key error (the Brave search API key was at the old path) caused the entire gateway to be unavailable for 12.5 hours and 6,198 restart attempts (see related issue #60142).
Expected Behavior
Config validation errors on non-critical plugin keys should:
- Log a clear warning:
[brave] plugin config invalid: unrecognized key "tools.web.search.brave" (moved to plugins.entries.brave.config.webSearch in 2026.4.1) — plugin disabled
- Disable the affected plugin for this session
- Allow the gateway to start and serve all other functionality
Hard exits should be reserved for truly unrecoverable errors (corrupted core config, missing required fields for critical subsystems).
Suggested Fix
In the config validation layer (src/config/ or plugin loader):
- Distinguish between fatal config errors (core agent config corrupt) and plugin config errors (individual plugin key issues)
- Plugin config errors → warn + disable plugin, do NOT exit
- Add a startup summary showing which plugins were disabled due to config issues
Related
Environment
- OpenClaw: 2026.4.1
- OS: Linux (WSL2, systemd user session)
Description
When a plugin config key is invalid (e.g. after a schema migration), the gateway throws a hard config validation error and exits with code 1 instead of disabling only the affected plugin and continuing to start.
Real-World Incident
After upgrading from 2026.3.28 → 2026.4.1, the
tools.web.searchconfig schema changed. The oldbravekey path was now an unrecognized key. Instead of degrading gracefully (disabling Brave search, starting without it), the gateway rejected the entire config and refused to start.Actual Log
This single config key error (the Brave search API key was at the old path) caused the entire gateway to be unavailable for 12.5 hours and 6,198 restart attempts (see related issue #60142).
Expected Behavior
Config validation errors on non-critical plugin keys should:
[brave] plugin config invalid: unrecognized key "tools.web.search.brave" (moved to plugins.entries.brave.config.webSearch in 2026.4.1) — plugin disabledHard exits should be reserved for truly unrecoverable errors (corrupted core config, missing required fields for critical subsystems).
Suggested Fix
In the config validation layer (
src/config/or plugin loader):Related
tools.web.search.brave→plugins.entries.brave.config.webSearchEnvironment