Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: execution "direct" config silently reverted when gateway.bind="lan" [2 pull requests, 2 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#75060•Fetched 2026-05-01 05:38:33
View on GitHub
Comments
2
Participants
3
Timeline
8
Reactions
2
Author
onridgesonridges
Participants
clawsweeper[bot]clawsweeper[bot]onridgesonridgessamrusanisamrusani
Timeline (top)
cross-referenced ×3commented ×2labeled ×2closed ×1

Error Message

No error is shown to the user. The gateway logs only:

  • OR fail fast with a clear error message explaining why it's not allowed No error is shown to the user. The gateway logs only:

Fix Action

Fixed

PR fix notes

PR #75080: fix(config): include validation details in recovery notices

Description (problem / solution / changelog)

Fixes #75060.

Summary

  • Include the rejected config validation paths/messages in startup last-known-good recovery logs.
  • Include the same validation details in reload recovery logs and the main-agent recovery notice.
  • Keep the existing fail-closed recovery behavior unchanged: this does not add agents.defaults.execution, relax SecretRef validation, or change LAN/direct execution policy.

Validation

  • pnpm test src/gateway/server-startup-config.recovery.test.ts src/gateway/config-recovery-notice.test.ts src/config/io.observe-recovery.test.ts src/gateway/config-reload.test.ts src/gateway/server-reload-handlers.test.ts src/config/config.secrets-schema.test.ts src/config/zod-schema.agent-defaults.test.ts -- --reporter=verbose
  • pnpm exec oxfmt --check --threads=1 src/gateway/config-recovery-notice.ts src/gateway/server-startup-config.ts src/gateway/config-reload.ts src/gateway/server-reload-handlers.ts src/gateway/config-recovery-notice.test.ts src/gateway/server-startup-config.recovery.test.ts src/gateway/config-reload.test.ts
  • pnpm check:changed
  • git diff --check

AI-assisted disclosure

AI-assisted PR prepared with Codex. I reviewed the touched recovery paths and kept the change scoped to diagnostics only.

Changed files

  • src/gateway/config-recovery-notice.test.ts (modified, +27/-1)
  • src/gateway/config-recovery-notice.ts (modified, +25/-1)
  • src/gateway/config-reload.test.ts (modified, +1/-1)
  • src/gateway/config-reload.ts (modified, +12/-1)
  • src/gateway/server-reload-handlers.ts (modified, +1/-0)
  • src/gateway/server-startup-config.recovery.test.ts (modified, +2/-1)
  • src/gateway/server-startup-config.ts (modified, +8/-1)

PR #75081: fix(gateway): show config recovery validation details

Description (problem / solution / changelog)

Summary

  • include concise rejected validation paths/messages in foreground/service last-known-good recovery logs and main-agent notices
  • pass original invalid snapshot issues through startup/reload recovery paths
  • let foreground gateway run use best-effort config for proxy bootstrap so config recovery runs before invalid direct edits can abort the CLI
  • document the new Rejected validation details: troubleshooting signature

Fixes #75060.

Tests

  • pnpm test src/cli/run-main.exit.test.ts src/cli/gateway-cli/run.option-collisions.test.ts src/config/issue-format.test.ts src/gateway/server-startup-config.recovery.test.ts src/gateway/config-recovery-notice.test.ts src/config/io.observe-recovery.test.ts src/gateway/config-reload.test.ts src/gateway/server-reload-handlers.test.ts src/config/config.secrets-schema.test.ts src/config/zod-schema.agent-defaults.test.ts
  • pnpm build
  • pnpm exec oxfmt --check --threads=1 src/cli/run-main.ts src/cli/run-main.exit.test.ts src/cli/gateway-cli/run.ts src/cli/gateway-cli/run.option-collisions.test.ts src/config/issue-format.ts src/config/issue-format.test.ts src/config/io.observe-recovery.ts src/config/io.observe-recovery.test.ts src/gateway/config-recovery-notice.ts src/gateway/config-recovery-notice.test.ts src/gateway/config-reload.ts src/gateway/config-reload.test.ts src/gateway/server-reload-handlers.ts src/gateway/server-startup-config.ts src/gateway/server-startup-config.recovery.test.ts docs/gateway/troubleshooting.md CHANGELOG.md
  • git diff --check
  • Pre-fix negative E2E: repeated the same built Gateway scenario from clean base ad7fa6c387 (pre-PR). The invalid direct edit restart failed before recovery with Invalid config at ... agents.defaults: Unrecognized key: "execution"; gateway.auth.password: Invalid input from strict CLI getRuntimeConfig() during startup, proving the scenario was red before the CLI recovery fix.
  • Manual E2E: with an isolated HOME, OPENCLAW_CONFIG_PATH, and OPENCLAW_STATE_DIR, started a real built node dist/entry.js gateway run, verified health, seeded openclaw.json.last-good, overwrote config with reported invalid direct edits (agents.defaults.execution="direct" and gateway.auth.password={provider,name}), restarted the real gateway, verified health succeeds after recovery, verified active config is restored without execution, verified .clobbered.* preserves the rejected payload, and verified logs contain Rejected validation details: agents.defaults: Unrecognized key: "execution"; gateway.auth.password: Invalid input.

Changed files

  • CHANGELOG.md (modified, +1/-0)
  • docs/gateway/troubleshooting.md (modified, +1/-0)
  • src/cli/gateway-cli/run.option-collisions.test.ts (modified, +1/-1)
  • src/cli/gateway-cli/run.ts (modified, +6/-1)
  • src/cli/run-main.exit.test.ts (modified, +1/-1)
  • src/cli/run-main.ts (modified, +2/-2)
  • src/config/io.observe-recovery.test.ts (modified, +3/-0)
  • src/config/io.observe-recovery.ts (modified, +3/-1)
  • src/config/issue-format.test.ts (modified, +15/-0)
  • src/config/issue-format.ts (modified, +25/-1)
  • src/gateway/config-recovery-notice.test.ts (modified, +20/-1)
  • src/gateway/config-recovery-notice.ts (modified, +14/-1)
  • src/gateway/config-reload.test.ts (modified, +1/-1)
  • src/gateway/config-reload.ts (modified, +5/-2)
  • src/gateway/server-reload-handlers.ts (modified, +1/-0)
  • src/gateway/server-startup-config.recovery.test.ts (modified, +2/-1)
  • src/gateway/server-startup-config.ts (modified, +14/-2)
RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

Environment

  • OpenClaw version: 2026.4.27
  • Platform: Linux (ESXi 8.0, Debian 12)
  • Gateway bind: "lan"
  • Config file: ~/.openclaw/openclaw.json

Problem

When setting execution: "direct" in agents.defaults (or using password: {"provider": "env", "name": "..."} in gateway.auth), the config file is silently reverted to the last-known-good state after gateway restart.

No error is shown to the user. The gateway logs only:

Steps to reproduce

  1. Set agents.defaults.execution = "direct" in openclaw.json (with gateway.bind = "lan")
  2. Restart gateway: systemctl --user restart openclaw-gateway
  3. Read config — execution field is gone, reverts to default ("docker/all")
  4. Same issue with gateway.auth.password = {"provider": "env", "name": "OPENCLAW_GATEWAY_PASSWORD"} → reverts to plain text password

Expected behavior

Config should either:

  • Accept execution: "direct" + bind: "lan" combination (accept the security tradeoff)
  • OR fail fast with a clear error message explaining why it's not allowed
  • NOT silently revert without user notification

Actual behavior

When setting execution: "direct" in agents.defaults (or using password: {"provider": "env", "name": "..."} in gateway.auth), the config file is silently reverted to the last-known-good state after gateway restart.

No error is shown to the user. The gateway logs only:

OpenClaw version

2026.4.27

Operating system

linux Ubuntu 24.04 LTS

Install method

npm global

Model

minimax

Provider / routing chain

openclaw -> minimax api

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response

extent analysis

TL;DR

The issue can be mitigated by setting a valid execution mode in agents.defaults that is compatible with the gateway.bind setting, or by using a different authentication method in gateway.auth that does not trigger the config reversion.

Guidance

  • Verify the compatibility of execution modes with the gateway.bind setting in the OpenClaw documentation to ensure the chosen combination is supported.
  • Test using a different execution mode, such as the default "docker/all", to see if the config reversion issue persists.
  • Consider using a different authentication method in gateway.auth that does not rely on environment variables, to avoid triggering the config reversion.
  • Check the OpenClaw version changelog for any known issues or updates related to config file handling and gateway restarts.

Example

No code example is provided as the issue is related to configuration settings and not code implementation.

Notes

The root cause of the issue seems to be related to the interaction between the execution mode, gateway.bind setting, and the authentication method used. However, without further information or logs, it's difficult to provide a more specific solution.

Recommendation

Apply workaround: Use a compatible execution mode and authentication method to avoid triggering the config reversion, until a more permanent fix is available.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

Config should either:

  • Accept execution: "direct" + bind: "lan" combination (accept the security tradeoff)
  • OR fail fast with a clear error message explaining why it's not allowed
  • NOT silently revert without user notification
#api#retriever error#indexing error#inference speed#output truncation

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING