openclaw - 💡(How to fix) Fix [Bug]: config_guard falsely flags models.providers.zai.models token refresh as breaking change every hour [1 comments, 2 participants]

openclaw2026-03-21 06:06:24

ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

GitHub issue URL

Helpful · Quick feedback

GitHub stats

openclaw/openclaw#51453•Fetched 2026-04-08 01:11:04

View on GitHub

Comments

Participants

Timeline

Reactions

Author

HenryFredrich

Participants

HenryFredrich

Hollychou924

Timeline (top)

labeled ×2commented ×1

config_guard detects hourly JWT token refresh in models.providers.zai.models as a breaking config change (isBreaking: true), triggering a warning dialog and preventing Gateway from starting. The only difference between .bak and .known-good files is the JWT exp/iat claims.

Root Cause

The internal token refresh mechanism writes the new JWT to openclaw.json via config-io, but does NOT set meta before writing (hasMetaBefore: false). This triggers:

config-audit flags "missing-meta-before-write" → suspicious
config_guard detects file change on models.providers.zai.models → isBreaking: true
Desktop shows warning dialog about external program modifying config
Gateway may fail to start (health timeout)

RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Summary

Steps to reproduce

Launch AutoClaw 0.2.21 on Windows 11 with zai provider configured (AutoGLM proxy).
Wait for the JWT token in models.providers.zai.models[].headers.X-Authorization to refresh (~1 hour).
Observe autoclaw-dev.log: config_guard.change_detected with isBreaking: true and affectedPaths: ["models.providers.zai.models"].
Gateway may fail to start with "Timed out waiting for gateway health".
Compare openclaw.json.bak vs openclaw.json.known-good — only diff is JWT exp/iat claims.

Expected behavior

Token refresh should not trigger config_guard breaking-change detection. Either the models.providers.zai.models field should be excluded from config_guard diff checks, or token refresh should update meta before writing to avoid the "missing-meta-before-write" suspicion flag.

Actual behavior

config_guard flags the change as isBreaking: true every ~1 hour. config-audit.jsonl marks the write as suspicious due to "missing-meta-before-write". This triggers a desktop warning about "a program trying to modify a JSON file" and can prevent Gateway from starting, requiring: close AutoClaw → reopen → run diagnostics → reset connection.

OpenClaw version

0.2.21

Operating system

Windows 11 (NT 10.0.26200.0, x64)

Install method

Windows desktop installer (AutoClaw.exe)

Model

zai/zai_pony-alpha-2 (GLM-5-Turbo via AutoGLM proxy)

Provider / routing chain

openclaw desktop → autoglm-api.zhipuai.cn/autoclaw-proxy (zai provider)

Additional provider/model setup details

Provider: zai (AutoGLM proxy) Base URL: https://autoglm-api.zhipuai.cn/autoclaw-proxy/proxy/autoclaw API: openai-completions The JWT token in X-Authorization header contains exp/iat claims that refresh hourly. Relevant config path: models.providers.zai.models[0].headers.X-Authorization

Logs, screenshots, and evidence

Impact and severity

Affected: All AutoClaw desktop users with zai (AutoGLM proxy) provider configured. Severity: High — blocks Gateway startup, requiring manual intervention. Frequency: Every ~1 hour (every token refresh cycle), 30+ occurrences observed over 48h. Consequence: User must close AutoClaw → reopen → run diagnostics → reset connection to recover.

Additional information

Root Cause

The internal token refresh mechanism writes the new JWT to openclaw.json via config-io, but does NOT set meta before writing (hasMetaBefore: false). This triggers:

config-audit flags "missing-meta-before-write" → suspicious
config_guard detects file change on models.providers.zai.models → isBreaking: true
Desktop shows warning dialog about external program modifying config
Gateway may fail to start (health timeout)

Suggested Fixes

Token refresh should call the config API with proper meta before writing (fix hasMetaBefore: false)
OR: config_guard should exclude models.providers.*.models[].headers from breaking-change detection
OR: token should be stored in request-headers.json (already exists separately) rather than in openclaw.json

extent analysis

Fix Plan

To resolve the issue, we can implement one of the suggested fixes. Here, we'll focus on the first suggestion: updating the token refresh mechanism to call the config API with proper meta before writing.

Step 1: Update Token Refresh Mechanism

Modify the token refresh function to set the meta before writing the new JWT to openclaw.json. This can be achieved by calling the config API with the meta parameter set to true.

// Assuming the token refresh function is named 'refreshToken'
async function refreshToken() {
  // ... existing code to obtain the new JWT token ...
  
  // Set meta before writing the new JWT to openclaw.json
  const configApi = getConfigApi();
  await configApi.setMeta('models.providers.zai.models', true);
  
  // Write the new JWT to openclaw.json
  await configApi.write('models.providers.zai.models', newJwtToken);
}

Step 2: Verify Config API Implementation

Ensure that the getConfigApi() function returns a valid config API instance that supports the setMeta() and write() methods.

// Example implementation of getConfigApi()
function getConfigApi() {
  // Return a config API instance that supports setMeta() and write() methods
  return {
    setMeta: async (path, meta) => {
      // Implement setMeta logic here
    },
    write: async (path, data) => {
      // Implement write logic here
    },
  };
}

Verification

To verify that the fix worked, follow these steps:

Launch AutoClaw with the zai provider configured.
Wait for the JWT token to refresh (~1 hour).
Check the autoclaw-dev.log for any config_guard.change_detected entries with isBreaking: true.
If no such entries are found, the fix is successful.

Extra Tips

To prevent similar issues in the future, consider implementing a more robust token storage mechanism, such as storing the token in a separate file (e.g., request-headers.json) rather than in openclaw.json. Additionally, review the config API implementation to ensure it properly handles meta data and write operations.

Vote matrix · Quick signals

Works

Did the solution work? Tap to confirm.

Easy Fix

Was it a quick fix?

Time Saver

Did it save you time?

Blocking

Was it severely blocking?

Common Issue

Are others likely hitting this too?

Flaky / Intermittent

Is it intermittent?

Verified / Reproducible

Can you reproduce it reliably?

FAQ

Expected behavior

#api #ssr #installation #tensor shape #autograd error #prompt issue #agent setup #task chaining #parallel task

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

openclaw - 💡(How to fix) Fix [Bug]: config_guard falsely flags models.providers.zai.models token refresh as breaking change every hour [1 comments, 2 participants]

Recommended Tools

GitHub issue graph ai analysis

Root Cause

Bug type

Summary

Steps to reproduce

Expected behavior

Actual behavior

OpenClaw version

Operating system

Install method

Model

Provider / routing chain

Additional provider/model setup details

Logs, screenshots, and evidence

Impact and severity

Additional information

Root Cause

Suggested Fixes

extent analysis

Fix Plan

Step 1: Update Token Refresh Mechanism

Step 2: Verify Config API Implementation

Verification

Extra Tips

FAQ

Expected behavior

Still need to ship something?

RELATED_DISCOVERY

TRENDING