fix(cli): prevent config set/unset from leaking runtime defaults by mcaxtr · Pull Request #11949 · openclaw/openclaw

mcaxtr · 2026-02-08T16:04:55Z

Summary

config set and config unset now use the resolved config (after $include and ${ENV} substitution) instead of the runtime-merged config with defaults
Adds a new resolved field to ConfigFileSnapshot containing the config before runtime defaults are applied
Removes applyModelDefaults from writeConfigFile since runtime defaults should only be applied at load time
Adds proper redaction for the new resolved field to prevent credential leaks

The bug caused runtime defaults (like agents.defaults.maxConcurrent) to leak into the user's config file whenever config set or config unset was used.

Test plan

All 3 new tests in config-cli.test.ts fail before fix, pass after
New test for resolved redaction in redact-snapshot.test.ts passes
Full test suite passes (5426 tests)
pnpm build && pnpm check passes
Codex review addressed (security issue with unredacted resolved field)

Changes

src/config/types.openclaw.ts: Added resolved field to ConfigFileSnapshot
src/config/io.ts: Populate resolved field with pre-defaults config; removed applyModelDefaults from writeConfigFile
src/config/validation.ts: Added validateConfigObjectRaw for validation without defaults
src/cli/config-cli.ts: Use snapshot.resolved instead of snapshot.config
src/config/redact-snapshot.ts: Redact the new resolved field
src/config/config.ts: Export validateConfigObjectRaw

Greptile Overview

Greptile Summary

This PR fixes openclaw config set/unset writing back runtime-merged config (including defaults) by introducing a resolved snapshot (post $include + ${ENV} substitution, pre-runtime-defaults) and using that for mutations before persisting. It also removes applying runtime defaults at write time, adds a raw validation entrypoint (validateConfigObjectRaw) to validate without defaults, and updates snapshot redaction to cover resolved so secrets substituted from env don’t leak into logs/snapshots.

These changes fit the existing config pipeline by separating: (1) raw/parsed/resolved config used for persistence and user-facing edits vs (2) runtime config used for execution with defaults and path normalization applied only on load.

Confidence Score: 5/5

This PR is safe to merge with minimal risk.
Changes are narrowly scoped to config snapshot representation and CLI writeback behavior, with accompanying unit tests for the regression and for redaction of the new snapshot field. The updated validation API preserves existing behavior via validateConfigObject while enabling pre-default validation where needed.
No files require special attention

Context used:

Context from dashboard - CLAUDE.md (source)
Context from dashboard - AGENTS.md (source)

greptile-apps

_{1 file reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

greptile-apps · 2026-02-08T16:06:44Z

Additional Comments (1)

src/config/io.ts
Defaults still written

writeConfigFile currently validates with validateConfigObjectWithPlugins(cfg) and then serializes stampConfigVersion(cfg) (the original input), not validated.config. If the caller passes a runtime-merged object (with defaults already applied), those defaults will still be persisted even though applyModelDefaults was removed here. Consider serializing validated.config (or explicitly stripping defaults) to ensure the invariant “user config should only contain explicitly set values” actually holds.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/config/io.ts
Line: 489:496

Comment:
**Defaults still written**

`writeConfigFile` currently validates with `validateConfigObjectWithPlugins(cfg)` and then serializes `stampConfigVersion(cfg)` (the original input), not `validated.config`. If the caller passes a runtime-merged object (with defaults already applied), those defaults will still be persisted even though `applyModelDefaults` was removed here. Consider serializing `validated.config` (or explicitly stripping defaults) to ensure the invariant “user config should only contain explicitly set values” actually holds.


How can I resolve this? If you propose a fix, please make it concise.

mcaxtr · 2026-02-08T16:13:59Z

Thanks for the review! You raise a valid concern about writeConfigFile not stripping defaults from the input.

However, the scope of this PR is specifically issue #6070, which reports that openclaw config set and openclaw config unset corrupt the config file. My fix addresses this by:

Introducing snapshot.resolved - the config after $include and ${ENV} resolution but before runtime defaults
Updating config set and config unset to use snapshot.resolved instead of snapshot.config

This ensures the CLI commands pass the correct pre-defaults config to writeConfigFile.

You're correct that other call sites (like gmail-ops.ts passing validated.config) may have the same bug pattern. That's a broader issue affecting multiple code paths, and I'd argue it deserves a separate issue/PR to audit all writeConfigFile callers.

Making writeConfigFile itself strip defaults is tricky because:

validateConfigObjectWithPlugins returns validated.config with defaults, but we'd need the pre-default version
We'd need to either diff against defaults or track what was explicitly set vs inherited
This is a bigger architectural change that could have unintended side effects

Happy to discuss if you think the broader fix should be in this PR!

mcaxtr · 2026-02-08T16:16:26Z

@greptile review

…et/unset Fixes openclaw#6070 The config set/unset commands were using snapshot.config (which contains runtime-merged defaults) instead of snapshot.parsed (the raw user config). This caused runtime defaults like agents.defaults to leak into the written config file when any value was set or unset. Changed both set and unset commands to use structuredClone(snapshot.parsed) to preserve only user-specified config values.

…s config The initial fix using snapshot.parsed broke configs with $include directives. This commit adds a new 'resolved' field to ConfigFileSnapshot that contains the config after $include and ${ENV} substitution but BEFORE runtime defaults are applied. This is now used by config set/unset to avoid: 1. Breaking configs with $include directives 2. Leaking runtime defaults into the written config file Also removes applyModelDefaults from writeConfigFile since runtime defaults should only be applied when loading, not when writing.

The newly added 'resolved' field contains secrets after ${ENV} substitution. This commit ensures redactConfigSnapshot also redacts the resolved field to prevent credential leaks in config.get responses.

steipete · 2026-02-13T03:41:19Z

Landed via temp rebase onto main.

Gate: pnpm check && pnpm test
Land commit: d933ae0
Merge commit: 7c25696

Thanks @mcaxtr!

openclaw-barnacle Bot added the cli CLI command changes label Feb 8, 2026

greptile-apps Bot reviewed Feb 8, 2026

View reviewed changes

mcaxtr force-pushed the fix-6070-config-set-overwrite branch from 1cefb2b to d209559 Compare February 12, 2026 04:17

openclaw-barnacle Bot added the size: M label Feb 12, 2026

mcaxtr added 3 commits February 12, 2026 23:29

fix(config): redact resolved field in config snapshots

a58c767

The newly added 'resolved' field contains secrets after ${ENV} substitution. This commit ensures redactConfigSnapshot also redacts the resolved field to prevent credential leaks in config.get responses.

mcaxtr force-pushed the fix-6070-config-set-overwrite branch from d209559 to a58c767 Compare February 13, 2026 02:29

openclaw-barnacle Bot added the trusted-contributor label Feb 13, 2026

fix(config): enforce default-free persistence in write path

d933ae0

steipete merged commit 7c25696 into openclaw:main Feb 13, 2026
23 of 24 checks passed

mcaxtr deleted the fix-6070-config-set-overwrite branch February 13, 2026 12:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(cli): prevent config set/unset from leaking runtime defaults#11949

fix(cli): prevent config set/unset from leaking runtime defaults#11949
steipete merged 4 commits into
openclaw:mainfrom
mcaxtr:fix-6070-config-set-overwrite

mcaxtr commented Feb 8, 2026 •

edited by greptile-apps Bot

Loading

Uh oh!

greptile-apps Bot left a comment

Uh oh!

greptile-apps Bot commented Feb 8, 2026

Uh oh!

mcaxtr commented Feb 8, 2026

Uh oh!

mcaxtr commented Feb 8, 2026

Uh oh!

Uh oh!

steipete commented Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mcaxtr commented Feb 8, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Changes

Greptile Overview

Greptile Summary

Confidence Score: 5/5

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Feb 8, 2026

Uh oh!

mcaxtr commented Feb 8, 2026

Uh oh!

mcaxtr commented Feb 8, 2026

Uh oh!

Uh oh!

steipete commented Feb 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mcaxtr commented Feb 8, 2026 •

edited by greptile-apps Bot

Loading