openclaw - 💡(How to fix) Fix Allow operators to disable the config-file watcher / auto-clobber [2 comments, 2 participants]

Summary

OpenClaw 5.2 ships an always-on chokidar watcher on openclaw.json that validates every save and silently reverts invalid edits to last-known-good (.clobbered.<timestamp> + restore). There is no supported way to disable this — gateway.reload.mode = "off" only suppresses hot-apply and auto-restart actions, not the validation-and-clobber path.

For operators who want full control over their config (intentional intermediate-state edits, staged migrations, deliberately invalid test states), this auto-revert is destructive. Edits are silently reverted with no in-band notification — the operator only finds out by checking config-audit.jsonl or noticing their changes are gone.

Request

Please add a supported way to disable the file watcher and validation-clobber:

• Preferred: new config field, e.g. gateway.fileWatch.enabled: false, with a parallel env var override OPENCLAW_DISABLE_CONFIG_WATCHER=1.
• Acceptable alternative: extend gateway.reload.mode with a new value like "manual" or "none-no-clobber" that disables the watcher entirely (not just the hot-apply/restart actions).

The startup validator (openclaw gateway boot path) should remain unchanged — it's correct to refuse to start on a bad config. The change should only affect the runtime watcher.

Reproduction

1. Set gateway.reload.mode: "off" in openclaw.json.
2. Run the gateway.
3. Save an intentionally invalid edit to openclaw.json (e.g. typo a required field name).
4. Observed: within ~300ms, file is renamed to openclaw.json.clobbered.<ISO-timestamp> and openclaw.json.last-good is restored. Edit is lost. config-audit.jsonl logs phase: "read", suspicious: ["reload-invalid-config"], clobberedPath, restoredFromBackup: true.
5. Expected (with feature): when watcher is disabled, the file stays as the operator wrote it. The operator runs openclaw config validate themselves on demand to check.

Source reference

• Watcher startup: startGatewayConfigReloader in src/gateway/config-reload.ts (compiled to /app/dist/config-reload-*.js in the docker image).
• Validation/clobber happens in the chokidar change callback before the gateway.reload.mode === "off" check.
• The mode check at if (settings.mode === "off") { ...; return; } only short-circuits the action, not the preceding clobber-and-restore.

Use case

Operator workflows where the operator owns the config and wants:

• Manual validation cadence (openclaw config validate on demand)
• Ability to save intermediate invalid states during multi-step edits
• Predictable "what I save is what's on disk" semantics
• No silent file mutations by the runtime

The current behavior is also surprising for operators who set gateway.reload.mode: "off" expecting "no automatic config processing" — the documentation and field name imply this disables all reload-related behavior, but in practice the validator runs anyway with logs labeled reload-invalid-config.

Related issues

• #64419 — Gateway startup clobbers openclaw.json (config truncated on boot)
• #56450 — doctor --fix generates thousands of clobbered backup files
• #31251 — plugins install/uninstall can clobber unrelated openclaw.json keys

These all touch the broader theme of operators losing control of their config to runtime safety mechanisms. A clean opt-out would help all of them.

OpenClaw version

2026.5.2 (Docker, custom-built image)