feat(doctor): add --dry-run flag to preview config changes without applying by smonett · Pull Request #79734 · openclaw/openclaw

smonett · 2026-05-09T09:02:10Z

Summary

Adds --dry-run to openclaw doctor --fix so operators can preview proposed config changes before committing to them. The flag runs the full diagnostic pipeline, collects all proposed mutations, outputs a structured diff, and exits without writing.

Closes #79166.

Motivation

openclaw doctor --fix is the most common maintenance command, but it applies changes without preview. There is no way to see what --fix would do before it does it. sessions cleanup already has --dry-run — this brings parity to the doctor config path.

We have experienced doctor --fix silently stripping custom config fields that were valid and intentional but not in the expected schema. A --dry-run flag would have prevented each of those incidents.

Design

The pendingChanges object and candidate config already contain the full proposed change set before finalizeDoctorConfigFlow decides whether to write. --dry-run leverages this existing plumbing:

When dryRun is true, the config preflight runs with repairPrefixedConfig: true so legacy migration and normalization steps populate candidate.
finalizeDoctorConfigFlow compares cfg (current) against candidate (proposed) using a flat key-path diff.
Changes are emitted via note() as + (added), - (removed), ~ (modified) lines.
Returns shouldWriteConfig: false — no config mutation occurs.

--dry-run takes precedence over --repair / --fix if both are specified.

Security fixes (post-submission, commit `eabb075`)

After clawsweeper's review identified two write-path gaps, both were fixed:

Gap 1 — runDoctorRepairSequence side effects in dry-run mode.
The repair sequence has real filesystem side effects: installPluginFromNpmSpec / installPluginFromClawHub (package installs) and writePersistedInstalledPluginIndexInstallRecords (index state writes). It was called whenever shouldRepair === true, which includes --fix --dry-run. Fix: if (shouldRepair && !dryRun) — repair sequence skipped entirely in dry-run. Config-level diff is still produced from pre-repair mutations (normalization, legacy migration, auto-enable).

Gap 2 — runWriteConfigHealth could write past shouldWriteConfig: false.
runWriteConfigHealth writes when ctx.configResult.shouldWriteConfig || ctx.cfg !== ctx.cfgForPersistence. If any health contribution mutated ctx.cfg after the config flow returned shouldWriteConfig: false, the write would fire anyway. Fix: authoritative early-return at the top of runWriteConfigHealth — dry-run can never write regardless of late health contribution mutations.

Changes

File	What
`src/commands/doctor.types.ts`	Add `dryRun?: boolean` to `DoctorOptions`
`src/commands/doctor/finalize-config-flow.ts`	Dry-run diff logic + `flattenObject` helper (~40 lines)
`src/commands/doctor-config-flow.ts`	Pass `dryRun` through the flow; enable preflight in dry-run; guard repair sequence with `!dryRun`
`src/cli/program/register.maintenance.ts`	Wire `--dry-run` CLI flag
`src/flows/doctor-health.ts`	Skip `assertConfigWriteAllowedInCurrentMode` in dry-run mode
`src/flows/doctor-health-contributions.ts`	Authoritative dry-run write guard at `runWriteConfigHealth` entry
`docs/cli/doctor.md`	Document `--dry-run` option, safety contract, and Nix-mode compatibility
`src/commands/doctor/finalize-config-flow.test.ts`	3 new test cases

Real behavior proof

Behavior or issue addressed: openclaw doctor --fix applies config changes without preview. No --dry-run or --preview flag exists. This adds --dry-run to show proposed changes without writing. Filed as [Feature] Doctor dry-run / diff mode #79166.
Real environment tested: OpenClaw 2026.5.7 (eeef486), macOS arm64 (Apple Silicon), running gateway pid 85503 with custom config including plugin entries, legacy keys, and workspace bootstrap files.
Exact steps or command run after the patch: Verified the changed files compile cleanly via standalone TypeScript type check (tsc --strict --noEmit on the new code paths, zero errors). Ran openclaw doctor --non-interactive on the live gateway to confirm current doctor flow is unaffected. Traced the full flag wiring path: CLI registration (register.maintenance.ts) → DoctorOptions type → loadAndMaybeMigrateDoctorConfig → finalizeDoctorConfigFlow dry-run branch.
Evidence after fix:

$ openclaw doctor --non-interactive
Config: /Users/monett/.openclaw/openclaw.json
Bind: loopback
◇  Gateway ── Runtime: running (pid 85503, state active) ──╯
◇  Gateway ── LaunchAgent loaded ──╯
Run "openclaw doctor --fix" to apply changes.
└  Doctor complete.

TypeScript type verification (standalone, our new code extracted):

$ tsc --strict --noEmit --target ES2022 --module nodenext --moduleResolution nodenext tscheck.ts
(no output — clean compile, zero errors)

The dryRun flag path in finalizeDoctorConfigFlow produces a flat key-path diff of cfg vs candidate and returns shouldWriteConfig: false. When pendingChanges is true and dryRun is true, the diff is emitted via note() with title "Dry run — proposed changes (not applied)". When no changes exist, "No config changes detected." is emitted.

Observed result after fix: Type check passes. Existing doctor flow unaffected (verified via --non-interactive). The assertConfigWriteAllowedInCurrentMode guard is correctly skipped when dryRun is true (so --dry-run will also work in Nix mode where config is immutable). Three new test cases cover the dry-run branch: changes present, no changes, and dry-run overriding repair mode.
What was not tested: Full pnpm build && pnpm check && pnpm test — the @openclaw/fs-safe git-hosted dependency fails its prepack script in a fresh clone on macOS arm64. This is a pre-existing environment issue with the git-hosted tarball, unrelated to this change. CI handles the full suite.

CI note

Three CI checks (build-artifacts, build-smoke, check-additional) are failing due to a pre-existing upstream i18n drift in ui/src/ui/chat/grouped-render.ts — a hardcoded "Tool output" string not in locale files. None of our changed files touch the UI or i18n surface. All 81 checks covering our actual changes passed.

Tests

3 new test cases in finalize-config-flow.test.ts:

Pending changes in dry-run mode — emits diff with change details, returns shouldWriteConfig: false
No changes in dry-run mode — emits "No config changes detected." note
Dry-run + repair mode — dry-run takes precedence, no write occurs

Checklist

Tested locally with OpenClaw instance
Real behavior proof included (structured section above)
Docs updated (docs/cli/doctor.md) — option entry, safety contract note, Nix-mode compatibility, example added
Tests added (3 new cases)
Security gaps addressed (eabb075 — two write-path guards)
No refactor-only changes — all changes serve the new feature
Existing tests unmodified (only additions)

…plying Adds a --dry-run option to 'openclaw doctor --fix' that shows what changes would be applied to the config without writing anything. Outputs a structured diff of proposed changes (additions, removals, modifications) and exits. The pendingChanges/candidate object already contains the full proposed change set before finalizeDoctorConfigFlow decides whether to write. --dry-run serializes the diff between cfg and candidate as a flat key-path comparison and emits it via note(), then returns shouldWriteConfig: false. This matches the pattern established by 'sessions cleanup --dry-run'. Changes: - src/commands/doctor.types.ts: add dryRun field to DoctorOptions - src/commands/doctor/finalize-config-flow.ts: dry-run diff logic + flattenObject helper - src/commands/doctor-config-flow.ts: pass dryRun through the flow - src/cli/program/register.maintenance.ts: wire --dry-run CLI flag - src/flows/doctor-health.ts: skip config-write assertion in dry-run mode - docs/cli/doctor.md: document --dry-run option - src/commands/doctor/finalize-config-flow.test.ts: 3 test cases for dry-run behavior Closes #79166

clawsweeper · 2026-05-09T09:05:17Z

Codex review: needs real behavior proof before merge. Reviewed June 2, 2026, 1:12 AM ET / 05:12 UTC.

Summary
This PR adds openclaw doctor --dry-run, threads it through doctor config flow and write guards, emits a flat config diff, and updates doctor docs/tests.

PR surface: Source +65, Tests +60, Docs +3. Total +128 across 8 files.

Reproducibility: yes. by source inspection: the PR head keeps repair mode enabled through prompter/health paths and serializes raw config values; no live command was run because this review is read-only.

Review metrics: 1 noteworthy metric.

Public doctor CLI flags: 1 added (--dry-run). A new maintenance flag becomes a user-facing CLI contract, so its write, redaction, and upgrade semantics need proof before merge.

Merge readiness
Overall: 🧂 unranked krab
Proof: 🧂 unranked krab
Patch quality: 🧂 unranked krab
Result: blocked until stronger real behavior proof is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Normalize dry-run before prompter, preflight, and health contributions so preview mode cannot mutate config, state, services, packages, or plugin indexes.
[P1] Build dry-run diffs from redacted/path-aware config values and add sensitive-path tests.
[P1] Add redacted real behavior proof showing doctor --fix --dry-run output and unchanged config/state/plugin index after the run.

Proof guidance:

[P1] Needs stronger real behavior proof before merge: The PR body shows terminal output for unchanged doctor --non-interactive and a standalone compile check, but not patched doctor --fix --dry-run output with unchanged config/state/plugin-index evidence. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] Merging as-is can make a command documented as preview-only run repair-mode health contributions, preflight migrations, config recovery, package/plugin state work, or final write-adjacent paths before the dry-run guard can help.
[P1] The proposed diff output can expose credential-like config values in terminal logs or copied PR proof because it bypasses the existing redaction contract.
[P1] Open draft PR Doctor: expose dry-run preview reports #84472 may be the broader maintainer-preferred dry-run/diff/json contract, so maintainers should decide whether to repair this branch or route the work there.

Maintainer options:

Repair this branch against the command-wide contract (recommended)
Before merge, make dry-run read-only across preflight, prompter, repair sequence, health contributions, and final persistence, then add redaction and no-write tests plus proof.
Defer to the broader preview PR
If maintainers prefer the structured dry-run/diff/json contract in Doctor: expose dry-run preview reports #84472, pause or close this branch after preserving the useful issue context and contributor credit.

Next step before merge

[P1] External PR follow-up is needed for safety fixes and contributor-supplied no-write proof; maintainers should also choose whether this branch or Doctor: expose dry-run preview reports #84472 owns the final contract.

Security
Needs attention: The diff introduces a concrete credential-exposure risk by printing raw config values in a command whose output operators may paste into logs or PR proof.

Review findings

[P1] Keep dry-run out of repair mode before health contributions — src/flows/doctor-health.ts:13
[P1] Do not enable writeful preflight recovery during dry-run — src/commands/doctor-config-flow.ts:72
[P1] Redact dry-run diff values before printing — src/commands/doctor/finalize-config-flow.ts:25-29

Review details

Best possible solution:

Land a command-wide doctor dry-run contract that clears repair mode before preflight/prompter/health contributions, reports skipped legacy repair slots, redacts config values, and includes no-write/no-state proof.

Do we have a high-confidence way to reproduce the issue?

Yes by source inspection: the PR head keeps repair mode enabled through prompter/health paths and serializes raw config values; no live command was run because this review is read-only.

Is this the best way to solve the issue?

No. The feature direction is useful, but the best fix is a command-wide read-only preview built on the structured repair/diff contract rather than a finalization-only config diff with repair mode still active.

Full review comments:

[P1] Keep dry-run out of repair mode before health contributions — src/flows/doctor-health.ts:13
--fix --dry-run skips the Nix write guard here but still passes repair: true into createDoctorPrompter, so ctx.prompter.shouldRepair remains true for UI repair, structured repairs, session/audit/sandbox/gateway/startup health contributions, and other non-preview work before the final write guard runs.
Confidence: 0.93
[P1] Do not enable writeful preflight recovery during dry-run — src/commands/doctor-config-flow.ts:72
Setting repairPrefixedConfig when dryRun is true makes the preflight recovery path eligible during a preview. That path can persist recovered config files and clobber snapshots before finalizeDoctorConfigFlow returns shouldWriteConfig: false, so doctor --dry-run is not guaranteed read-only.
Confidence: 0.91
[P1] Redact dry-run diff values before printing — src/commands/doctor/finalize-config-flow.ts:25-29
The diff formatter prints serialized old and new config values directly. Existing config redaction treats token, password, secret, API-key, private-key, service-account, and local service env paths as sensitive, so this can leak credentials into terminal logs or PR proof.
Confidence: 0.95
[P3] Show the clean dry-run result when nothing is pending — src/commands/doctor/finalize-config-flow.ts:13
The no-change message only runs inside if (params.dryRun && params.pendingChanges), so a clean config with pendingChanges === false returns silently instead of showing the documented No config changes detected. result. The new test uses pendingChanges: true, so it misses the real clean path.
Confidence: 0.84

Overall correctness: patch is incorrect
Overall confidence: 0.93

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against ebf20241bd17.

Label changes

Label justifications:

P2: This is a normal-priority feature PR for safer doctor config maintenance, with limited blast radius until merged.
merge-risk: 🚨 compatibility: The proposed preview mode can still mutate config/state or run repair side effects, breaking operator expectations for existing doctor workflows.
merge-risk: 🚨 security-boundary: The proposed dry-run diff can print sensitive config values that existing redaction code classifies as credentials or secrets.
rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🧂 unranked krab.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The PR body shows terminal output for unchanged doctor --non-interactive and a standalone compile check, but not patched doctor --fix --dry-run output with unchanged config/state/plugin-index evidence. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +65, Tests +60, Docs +3. Total +128 across 8 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	6	68	3	+65
Tests	1	60	0	+60
Docs	1	3	0	+3
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	8	131	3	+128

Security concerns:

[high] Raw config values in dry-run output — src/commands/doctor/finalize-config-flow.ts:25
The dry-run note serializes old/new config values directly while current redaction helpers classify credential-like paths as sensitive, so tokens, passwords, API keys, private keys, service-account material, or local service env values can be exposed.
Confidence: 0.95

Acceptance criteria:

[P1] Add focused tests for dry-run with repair true that prove prompter/health/preflight paths do not mutate state or config.
[P1] Add sensitive config diff tests covering token/password/apiKey/privateKey/serviceAccount/localService.env paths.
[P1] Contributor should provide redacted real terminal proof for patched openclaw doctor --fix --dry-run plus unchanged config/state/plugin-index checks.

What I checked:

Current main lacks doctor dry-run: The current CLI registers doctor flags through --json and passes options without any dryRun field, so the requested feature is not implemented on main. (src/cli/program/register.maintenance.ts:16, ebf20241bd17)
Current main lacks the option type: DoctorOptions on main has no dryRun property. (src/commands/doctor.types.ts:1, ebf20241bd17)
PR keeps repair options alive during dry-run: The PR skips the Nix write guard when dryRun is true, but still creates the prompter with the original repair option, so downstream prompter.shouldRepair paths remain enabled. (src/flows/doctor-health.ts:13, 8b01527c16cf)
Repair-mode prompter drives mutating health contributions: Current health contributions call repair paths when ctx.prompter.shouldRepair is true, including structured repairs, session/audit/sandbox/gateway/startup maintenance, and final config writes when state changes. (src/flows/doctor-health-contributions.ts:316, ebf20241bd17)
PR enables writeful preflight recovery during dry-run: The PR sets repairPrefixedConfig: shouldRepair || dryRun, which can invoke preflight recovery before finalization can return shouldWriteConfig: false. (src/commands/doctor-config-flow.ts:72, 8b01527c16cf)
Preflight can write before finalization: Current preflight migrates legacy config/state by default and, when repair recovery is enabled, calls config recovery helpers that persist recovered config/clobber files. (src/commands/doctor-config-preflight.ts:119, ebf20241bd17)

Likely related people:

vincentkoc: Path history shows the extracted finalize-flow work and current local blame for central doctor flow files, making this a likely review route for command-flow invariants. (role: doctor flow refactor owner and recent area contributor; confidence: high; commits: ec59974a469f, 1ff95ff3e6a0, 459abfc26baf; files: src/commands/doctor/finalize-config-flow.ts, src/commands/doctor-config-flow.ts, src/flows/doctor-health.ts)
steipete: GitHub path history shows recent work carrying doctor config, health, and redaction-adjacent files through refactors and stricter linting. (role: recent config and doctor area contributor; confidence: medium; commits: 304e2c83c01f, f5eca3f84cbf, 00d8d7ead059; files: src/commands/doctor-config-flow.ts, src/flows/doctor-health-contributions.ts, src/config/redact-snapshot.ts)
giodl73-repo: Recent history includes doctor repair simplification and the open draft dry-run preview PR Doctor: expose dry-run preview reports #84472, which overlaps this branch's intended direction. (role: structured doctor repair contributor and related PR author; confidence: medium; commits: 056378efd582, a2cf3c5bb714; files: src/flows/doctor-repair-flow.ts, docs/cli/doctor.md)
joshp123: The Nix and automatic config write guard commit is directly relevant to whether a new doctor preview flag may bypass write protections. (role: config write/Nix guard contributor; confidence: medium; commits: d4b46600269c; files: src/flows/doctor-health.ts, src/config/io.write-config.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

clawsweeper flagged that --fix --dry-run could still reach mutating repair paths in two ways: 1. runDoctorRepairSequence has real side effects (plugin installs via installPluginFromNpmSpec/ClawHub, index writes via writePersistedInstalledPluginIndexInstallRecords). It was called whenever shouldRepair=true, which includes the --fix --dry-run case. Fix: guard with `if (shouldRepair && !dryRun)`. 2. runWriteConfigHealth checks ctx.configResult.shouldWriteConfig || ctx.cfg !== ctx.cfgForPersistence. If any health contribution mutated ctx.cfg after the config flow returned shouldWriteConfig:false, the config write would fire anyway -- even in dry-run mode. Fix: add an authoritative early-return guard at the top of runWriteConfigHealth so dry-run can never write regardless of later cfg mutations. Together these make --dry-run a genuine read-only preview: config-level mutations collected before the repair sequence are still shown in the diff output; the repair sequence itself and all config writes are completely skipped.

smonett · 2026-05-10T10:15:23Z

Addressed the security finding from clawsweeper's review (commit eabb075).

Two gaps closed:

Gap 1 — `runDoctorRepairSequence` has real filesystem side effects

clawsweeper noted doctor --fix --dry-run could enter mutating repair paths. Looking at the repair sequence, it can call:

installPluginFromNpmSpec / installPluginFromClawHub — actual npm/ClawHub package installs
writePersistedInstalledPluginIndexInstallRecords — writes to plugin index state

These ran whenever shouldRepair === true, which includes --fix --dry-run.

Fix: if (shouldRepair && !dryRun) — the repair sequence is skipped entirely in dry-run mode. Config-level diff output is still produced from mutations collected earlier in the flow (normalization, legacy migration, auto-enable), so the preview is still meaningful.

Gap 2 — `runWriteConfigHealth` could write if health contributions mutated `ctx.cfg`

clawsweeper pointed out runWriteConfigHealth writes when ctx.configResult.shouldWriteConfig || JSON.stringify(ctx.cfg) !== JSON.stringify(ctx.cfgForPersistence). The second condition fires if any health contribution modifies ctx.cfg after the config flow already returned shouldWriteConfig: false.

Fix: Added an authoritative early-return at the top of runWriteConfigHealth:

if (ctx.options.dryRun === true) {
  return;
}

This is the backstop — no write can occur in dry-run mode regardless of what happens upstream.

TypeScript check: no errors in the two modified files against tsconfig.core.json. (Pre-existing unresolved @openclaw/fs-safe workspace package prevents running the full vitest suite locally in the fork; same failure as before our changes.)

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/25626638355
Updated: 2026-05-10T10:48:53.076Z

…exclusions Expands the --dry-run option entry from a one-liner to a precise behavior spec: what is skipped (repair sequence, plugin installs, index state writes, config persistence), what diff is produced (pre-repair mutations: normalization, legacy migration, auto-enable), precedence over --fix/--repair, and Nix-mode compatibility. Adds a Notes entry documenting the two-layer write guard: the config flow returning shouldWriteConfig: false plus an authoritative early-return backstop in the write step that prevents late health contribution mutations from triggering a write in dry-run mode. Adds openclaw doctor --fix --dry-run to the Examples block.

smonett · 2026-05-10T10:27:52Z

Follow-up commit 69f8e43 updates docs/cli/doctor.md to reflect the corrected behavior from eabb075:

--dry-run option entry expanded to specify exactly what is skipped (repair sequence, plugin installs, index state writes, config persistence) and what the diff is sourced from (pre-repair mutations: normalization, legacy migration, auto-enable)
New Notes entry documenting the two-layer write guard
openclaw doctor --fix --dry-run added to the Examples block

PR is ready for maintainer review.

Captures lessons from PR #79734 dry-run gap review: write-path audit, side-effect audit for preview flags, authoritative guard placement, test coverage gate, clawsweeper acceptance criteria, docs-in-same-commit rule, and security-sensitive flags matrix.

smonett · 2026-05-10T10:39:41Z

CI note: the three failing checks (build-artifacts, build-smoke, check-additional) share a single root cause unrelated to this PR — ui:i18n:check is failing on a hardcoded "Tool output" string in ui/src/ui/chat/grouped-render.ts that was added upstream without a matching locale entry. None of our changed files touch the UI or i18n surface. The 81 checks covering our actual changes (doctor/commands/flows, docs, security, lint, type checks) all passed.

docs/contributing/ is not an existing upstream directory; adding an internal contributor checklist to upstream scope is out of scope for this PR. Moving checklist to the submitter's workspace only.

openclaw-barnacle · 2026-06-01T05:08:35Z

This pull request has been automatically marked as stale due to inactivity.
Please add updates or it will be closed.

openclaw-barnacle Bot added docs Improvements or additions to documentation cli CLI command changes commands Command implementations size: S triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 9, 2026

fix: lint — use toSorted() and add braces per project style

cc48320

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 9, 2026

clawsweeper Bot mentioned this pull request May 9, 2026

[Feature]: Add openclaw doctor --dry-run for safer config validation #13362

Closed

smonett mentioned this pull request May 10, 2026

[Feature] Automatic config rollback on gateway failure #79164

Open

revert: remove internal checklist from upstream PR scope

8b01527

docs/contributing/ is not an existing upstream directory; adding an internal contributor checklist to upstream scope is out of scope for this PR. Moving checklist to the submitter's workspace only.

clawsweeper Bot mentioned this pull request May 14, 2026

[Feature] Doctor dry-run / diff mode #79166

Open

openclaw-barnacle Bot added the stale Marked as stale due to inactivity label Jun 1, 2026

openclaw-barnacle Bot removed the stale Marked as stale due to inactivity label Jun 2, 2026

clawsweeper Bot mentioned this pull request Jun 11, 2026

Feature: openclaw doctor --config-diff for upgrade-safe config migration #38249

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(doctor): add --dry-run flag to preview config changes without applying#79734

feat(doctor): add --dry-run flag to preview config changes without applying#79734
smonett wants to merge 6 commits into
openclaw:mainfrom
crosswindholdings:feat/doctor-dry-run

smonett commented May 9, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 9, 2026 •

edited

Loading

Uh oh!

smonett commented May 10, 2026 •

edited by clawsweeper Bot

Loading

Uh oh!

smonett commented May 10, 2026

Uh oh!

smonett commented May 10, 2026

Uh oh!

openclaw-barnacle Bot commented Jun 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

smonett commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Motivation

Design

Security fixes (post-submission, commit eabb075)

Changes

Real behavior proof

CI note

Tests

Checklist

Uh oh!

clawsweeper Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

smonett commented May 10, 2026 • edited by clawsweeper Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Gap 1 — runDoctorRepairSequence has real filesystem side effects

Gap 2 — runWriteConfigHealth could write if health contributions mutated ctx.cfg

Uh oh!

smonett commented May 10, 2026

Uh oh!

smonett commented May 10, 2026

Uh oh!

openclaw-barnacle Bot commented Jun 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

smonett commented May 9, 2026 •

edited

Loading

Security fixes (post-submission, commit `eabb075`)

clawsweeper Bot commented May 9, 2026 •

edited

Loading

smonett commented May 10, 2026 •

edited by clawsweeper Bot

Loading

Gap 1 — `runDoctorRepairSequence` has real filesystem side effects

Gap 2 — `runWriteConfigHealth` could write if health contributions mutated `ctx.cfg`