[Bug]: __OPENCLAW_REDACTED__ written to config.json when saving provider config via Control UI

Severity: High
OpenClaw version: 2026.4.1 (also present in 2026.4.2)
Environment: macOS, gateway running locally

Summary

When modifying any provider configuration (e.g., models.providers.minimax) through the Control UI (config workspace), the on-disk config.json file is corrupted: the apiKey and headers field values are replaced with the literal string __OPENCLAW_REDACTED__. After a gateway restart, all provider credentials are invalid.

Steps to reproduce

1. Install OpenClaw 2026.4.1 with at least one provider (e.g., minimax) already configured with a valid apiKey.
2. Open the Control UI → Config workspace.
3. Modify any unrelated setting (e.g., change models.maxTokens or toggle a feature flag).
4. Save the config.
5. Observe that config.json now contains "apiKey": "__OPENCLAW_REDACTED__" for the previously-valid provider entries.
6. Restart the gateway — provider requests fail with authentication errors.

Root cause

In io-CHHRUM9X.js, the writeConfigFile function:

1. Computes nextCfg (the correct, de-redacted config) and writes it to disk ✅
2. But then calls notifyConfigWriteListeners({ runtimeConfig: runtimeConfigSnapshot, sourceConfig: nextCfg, ... }) passing the pre-write, still-redacted runtimeConfigSnapshot as runtimeConfig

The hot-reload subscriber receives this redacted snapshot, stores it as pendingInProcessConfig, and a subsequent applySnapshot(pendingInProcessConfig) re-writes __OPENCLAW_REDACTED__ back to disk — overwriting the correct value just written.

Relevant code path:

• writeConfigFile (io-CHHRUM9X.js, ~line 20821)
• notifyConfigWriteListeners → subscribeToWrites callback
• pendingInProcessConfig set to the redacted snapshot
• applySnapshot(pendingInProcessConfig) writes __OPENCLAW_REDACTED__ to disk

Suggested fix

In writeConfigFile, change the notifyConfigWriteListeners call from:

notifyConfigWriteListeners({
    configPath: io.configPath,
    sourceConfig: nextCfg,
    runtimeConfig: runtimeConfigSnapshot,  // ← bug: should be nextCfg
    persistedHash: writeResult.persistedHash,
    writtenAtMs: Date.now()
});

to:

notifyConfigWriteListeners({
    configPath: io.configPath,
    sourceConfig: nextCfg,
    runtimeConfig: nextCfg,  // ← pass the de-redacted config
    persistedHash: writeResult.persistedHash,
    writtenAtMs: Date.now()
});

Related issues

• PR #58044 (merged March 31) attempted to harden SecretRef round-trip handling in Control UI and RPC writes, but did not cover this writeConfigFile → notifyConfigWriteListeners code path.
• PR #55034 (fixed Discord token id field corruption on save)