config.patch 明文落盘风险：补丁前后做变量占位回归
场景：`gateway config.patch` 后 `${VAR}` 可能被解析成明文写回 `openclaw.json`。需建立‘补丁→扫描→恢复占位’的运维流程。
GITHUBDiscovered 2026-02-14Author crashandd
Prerequisites
- Config file uses `${VAR}` style secrets and gateway.env stores actual values.
- Operator can run gateway config patch and inspect config file on disk.
Steps
- Prepare a baseline config containing env placeholders for sensitive keys.
- Run one minimal `config.patch` on an unrelated key to reproduce behavior safely.
- Immediately diff `openclaw.json` and check whether `${VAR}` placeholders were replaced by plaintext.
- If replacement occurs, restore placeholders and restart gateway before any backup/commit workflow.
Commands
openclaw gateway config.getopenclaw gateway config.patch --raw '{"channels":{}}'grep -R "apiKey|token" ~/.openclaw/openclaw.jsonopenclaw gateway restartVerify
Sensitive fields remain `${VAR}` placeholders on disk after patch, with no plaintext secret persistence.
Caveats
- Workaround scripts that rewrite secrets can themselves leak values in shell history/logs.
- Issue currently reflects reported behavior; fix status should be tracked upstream (needs verification).
Source attribution
This tip is aggregated from community/public sources and preserved with attribution.
Open original source ↗