Config Guardian

Config Guardian

Overview

Use this workflow whenever editing ~/.openclaw/openclaw.json or running openclaw config set/apply. Prevents invalid config, creates backups, validates against schema, and enables rollback.

Workflow (use every time)

1. Preflight

   • Confirm the requested change and scope
   • Check for sensitive keys (tokens, credentials)

2. Backup

   bash {baseDir}/scripts/backup.sh
   

3. Validate (before change)

   bash {baseDir}/scripts/validate.sh
   

   If validation fails, stop and report.

4. Apply change

   • Prefer openclaw config set <path> <value> for small changes
   • For complex edits, edit the file directly and keep diffs minimal

5. Validate (after change)

   bash {baseDir}/scripts/validate.sh
   

   If it fails, restore from backup:

   bash {baseDir}/scripts/restore.sh
   

6. Diff review

   bash {baseDir}/scripts/diff.sh
   

7. Restart (only with explicit approval)

   • If change requires restart, ASK for approval first
   • Use openclaw gateway restart

Guardrails

• Never restart or apply config without explicit user approval
• Never remove keys or reorder blocks unless requested
• Always keep a backup before edits
• If unsure about schema: run openclaw doctor --non-interactive and stop on errors

Multi-environment Support

For environments with multiple OpenClaw instances, pass OPENCLAW_CONFIG environment variable:

OPENCLAW_CONFIG=/path/to/alternate/openclaw.json bash {baseDir}/scripts/backup.sh