Description

The openclaw config set CLI command can silently overwrite the entire config file with minimal content when the config snapshot fails to load properly.

Root Cause Analysis

In src/cli/config-cli.ts:308-311:

const snapshot = await loadValidConfig();
const next = snapshot.config as Record<string, unknown>;  // Problem!
setAtPath(next, parsedPath, parsedValue);
await writeConfigFile(next);

When readConfigFileSnapshot() fails or returns an empty config (e.g., file temporarily unreadable, validation failure), snapshot.config becomes {}. The command then writes this minimal config to disk, losing all existing settings.

Steps to Reproduce

1. Have a working config with multiple settings:

   • agents list
   • channels (telegram, whatsapp)
   • gateway auth
   • plugins
   • skills
   • hooks

2. Run any config set command (observed with):

   openclaw config set tools.alsoAllow '["agents_list"]'

3. If the config read fails for any transient reason, the entire config is replaced with just:

   {
     "tools": {
       "alsoAllow": ["agents_list"]
     }
   }

Evidence from logs

Timeline reconstruction:

Something between 15:51 and 15:59 caused the config to be overwritten with minimal content.

Lost Configuration

• auth.profiles
• agents.list (main, oracle, opus, np1)
• tools.agentToAgent
• hooks.internal
• channels.whatsapp, channels.telegram
• gateway.auth.token
• skills.load.extraDirs
• plugins.entries

Suggested Fix

Use snapshot.parsed (raw config from file) instead of snapshot.config (runtime-merged with defaults):

const snapshot = await loadValidConfig();
const next = structuredClone(snapshot.parsed) as Record<string, unknown>;  // Use parsed, not config
setAtPath(next, parsedPath, parsedValue);
await writeConfigFile(next);

Or add a guard:

if (!snapshot.exists || Object.keys(snapshot.parsed).length === 0) {
  throw new Error("Config file missing or empty; refusing to overwrite");
}

Related Issues

• [Bug]: macOS app wipes gateway.auth config when saving - should use config.patch instead of config.set #4286 - macOS app wipes gateway.auth config (similar root cause: full replace vs patch)
• [Critical] Config Self-Mutation Bug + Safe Network Change Process #4311 - Config self-mutation bug

Environment

• OpenClaw version: 2026.1.30
• Platform: Linux (WSL2)