Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: project-local .env is ignored in 2026.3.28, OPENCLAW_CONFIG_PATH falls back to ~/.openclaw/openclaw.json [3 pull requests, 1 comments, 2 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#57408•Fetched 2026-04-08 01:50:00
View on GitHub
Comments
1
Participants
2
Timeline
6
Reactions
0
Author
chaoscaroschaoscaros
Participants
chaoscaroschaoscarossaitarrunsaitarrun
Timeline (top)
cross-referenced ×3commented ×1labeled ×1referenced ×1

There appears to be a regression between 2026.3.24 and 2026.3.28.

In 2026.3.28, the project-local .env is not picked up during CLI bootstrap. OPENCLAW_CONFIG_PATH set in the project .env is ignored, and OpenClaw falls back to ~/.openclaw/openclaw.json.

As a result, gateway.mode=local in the intended config file is not respected.

Root Cause

There appears to be a regression between 2026.3.24 and 2026.3.28.

In 2026.3.28, the project-local .env is not picked up during CLI bootstrap. OPENCLAW_CONFIG_PATH set in the project .env is ignored, and OpenClaw falls back to ~/.openclaw/openclaw.json.

As a result, gateway.mode=local in the intended config file is not respected.

Fix Action

Fixed

PR fix notes

PR #57416: Fix project-local .env regression (#57408)

Description (problem / solution / changelog)

Summary

Fixes #57408: Project-local .env files were being ignored during CLI bootstrap.

Problem

OPENCLAW_CONFIG_PATH was blocked from workspace .env files, preventing users from setting project-level configurations. Additionally, the security analysis identified that allowing OPENCLAW_STATE_DIR could enable redirection attacks.

Solution

The refined fix:

✅ ALLOWS: OPENCLAW_CONFIG_PATH from workspace .env (enables project-level config override) 🔒 BLOCKS: OPENCLAW_STATE_DIR (prevents directory redirection attacks)

Security Hardening

  • Compute global env path BEFORE loading workspace .env
  • Prevents malicious .env from redirecting which global config is loaded
  • Prevents shadow .env directory attacks

Testing

Users can now set project-local configuration:

OPENCLAW_CONFIG_PATH=/path/to/project/config.json5

And both pnpm openclaw config file and pnpm openclaw gateway --verbose will use the project configuration correctly.

Files Changed

  • src/infra/dotenv.ts:

    • Allow OPENCLAW_CONFIG_PATH from workspace .env
    • Block OPENCLAW_STATE_DIR to prevent attacks
    • Compute global path before workspace load

  • src/infra/dotenv.test.ts:

    • Update tests to verify correct blocking/allowing behavior
    • Verify OPENCLAW_STATE_DIR remains blocked
    • Verify OPENCLAW_CONFIG_PATH loads from project .env

Security Review

✅ Passed Greptile security review ✅ Prevents .env redirection attacks ✅ Balances user functionality with security

Changed files

  • src/infra/dotenv.test.ts (modified, +11/-9)
  • src/infra/dotenv.ts (modified, +12/-2)

PR #57429: fix: allow absolute paths for OPENCLAW_CONFIG_PATH and OPENCLAW_STATE_DIR in workspace .env

Description (problem / solution / changelog)

Summary

Fixes a regression introduced in 2026.3.28 where OPENCLAW_CONFIG_PATH and OPENCLAW_STATE_DIR were blocked from being loaded from a project-local .env file, even when set to absolute paths.

Root Cause

PR #54631 added both keys to BLOCKED_WORKSPACE_DOTENV_KEYS to prevent malicious workspace files from redirecting config/state loading (e.g. OPENCLAW_CONFIG_PATH=./evil-config.json). However, this was overly broad and also blocked the legitimate user case of configuring these paths to absolute locations in a project .env.

Fix

The security concern is specifically about relative paths, not absolute paths. Absolute paths are safe because they are explicitly configured by the user — they cannot redirect loading to an attacker-controlled relative location.

This PR introduces ABSOLUTE_PATH_ONLY_WORKSPACE_DOTENV_KEYS — a set of keys that are allowed from workspace .env only when the value is an absolute path. Relative path values for these keys remain blocked.

Changes

  • src/infra/dotenv.ts: Replace broad block on OPENCLAW_CONFIG_PATH / OPENCLAW_STATE_DIR with a value-aware check (path.isAbsolute) that only blocks relative paths
  • src/infra/dotenv.test.ts: Add tests for both allowed (absolute path) and blocked (relative path) cases

Testing

All existing tests pass. New tests added and verified:

  • ✅ Allows absolute OPENCLAW_CONFIG_PATH and OPENCLAW_STATE_DIR from workspace .env
  • ✅ Blocks relative OPENCLAW_STATE_DIR and OPENCLAW_CONFIG_PATH from CWD .env
  • ✅ Blocks relative path values even when env vars are unset

Fixes #57408

Changed files

  • openclaw-2026-03-07.log (added, +129/-0)
  • src/infra/dotenv.test.ts (modified, +95/-1)
  • src/infra/dotenv.ts (modified, +113/-8)
  • src/infra/json-files.ts (modified, +37/-13)
  • src/slack/monitor/provider.ts (modified, +59/-2)

PR #57433: fix: allow absolute paths for OPENCLAW_CONFIG_PATH and OPENCLAW_STATE_DIR in workspace .env

Description (problem / solution / changelog)

Summary

Fixes a regression introduced in 2026.3.28 where OPENCLAW_CONFIG_PATH and OPENCLAW_STATE_DIR were blocked from being loaded from a project-local .env file, even when set to absolute paths.

Root Cause

PR #54631 added both keys to BLOCKED_WORKSPACE_DOTENV_KEYS to prevent malicious workspace files from redirecting config/state loading (e.g. OPENCLAW_CONFIG_PATH=./evil-config.json). However, this was overly broad and also blocked the legitimate user case of configuring these paths to absolute locations in a project .env.

Fix

The security concern is specifically about relative paths, not absolute paths. Absolute paths are safe because they are explicitly configured by the user.

This PR introduces ABSOLUTE_PATH_ONLY_WORKSPACE_DOTENV_KEYS — a set of keys that are allowed from workspace .env only when the value is an absolute path. Relative path values for these keys remain blocked.

Changes

  • src/infra/dotenv.ts: Replace broad block on OPENCLAW_CONFIG_PATH / OPENCLAW_STATE_DIR with a value-aware check (path.isAbsolute) that only blocks relative paths
  • src/infra/dotenv.test.ts: Add tests for both allowed (absolute path) and blocked (relative path) cases

Testing

All existing tests pass. New tests added and verified:

  • Allows absolute OPENCLAW_CONFIG_PATH and OPENCLAW_STATE_DIR from workspace .env
  • Blocks relative OPENCLAW_STATE_DIR and OPENCLAW_CONFIG_PATH from CWD .env
  • Blocks relative path values even when env vars are unset

Fixes #57408

Changed files

  • src/infra/dotenv.test.ts (modified, +51/-2)
  • src/infra/dotenv.ts (modified, +31/-12)
RAW_BUFFERClick to expand / collapse

Bug type

Regression (worked before, now fails)

Beta release blocker

No

Summary

There appears to be a regression between 2026.3.24 and 2026.3.28.

In 2026.3.28, the project-local .env is not picked up during CLI bootstrap. OPENCLAW_CONFIG_PATH set in the project .env is ignored, and OpenClaw falls back to ~/.openclaw/openclaw.json.

As a result, gateway.mode=local in the intended config file is not respected.

Steps to reproduce

Create a project-local .env file with:

OPENCLAW_STATE_DIR=/Users/fenglian1/AI/_openclaw OPENCLAW_CONFIG_PATH=/Users/fenglian1/AI/openclaw/config/openclaw.runtime.json5

Set gateway.mode to local in /Users/fenglian1/AI/openclaw/config/openclaw.runtime.json5:

{ "gateway": { "mode": "local" } }

From the project root, run:

pnpm openclaw config file pnpm openclaw gateway --verbose Observe that OpenClaw resolves the config file to ~/.openclaw/openclaw.json instead of the path from OPENCLAW_CONFIG_PATH.

Expected behavior

OpenClaw should load the project-local .env, respect OPENCLAW_CONFIG_PATH, and use:

/Users/fenglian1/AI/openclaw/config/openclaw.runtime.json5

As a result, pnpm openclaw config file should print that path, and pnpm openclaw gateway --verbose should detect gateway.mode=local without reporting missing config.

Actual behavior

OpenClaw does not appear to load the project-local .env during CLI bootstrap.

pnpm openclaw config file resolves to:

~/.openclaw/openclaw.json

and pnpm openclaw gateway --verbose reports:

Missing config: Run 'openclaw setup' or set gateway.mode=local (or pass --allow-unconfigured)

OpenClaw version

2026.3.28

Operating system

macOS

Install method

pnpm dev

Model

N/A (configuration/bootstrap issue, not model-specific)

Provider / routing chain

N/A (configuration/bootstrap issue, not model-specific)

Additional provider/model setup details

No response

Logs, screenshots, and evidence

Impact and severity

No response

Additional information

No response

extent analysis

Fix Plan

To resolve the issue of OpenClaw not picking up the project-local .env file during CLI bootstrap, follow these steps:

  • Ensure that the dotenv package is properly configured to load the project-local .env file.
  • Verify that the OPENCLAW_CONFIG_PATH environment variable is set correctly in the .env file.
  • Update the OpenClaw configuration to respect the OPENCLAW_CONFIG_PATH environment variable.

Example code to load the .env file using dotenv:

require('dotenv').config({ path: './.env' });

Alternatively, you can use the following code to set the OPENCLAW_CONFIG_PATH environment variable programmatically:

process.env.OPENCLAW_CONFIG_PATH = './openclaw/config/openclaw.runtime.json5';

Make sure to update the OpenClaw configuration to use the OPENCLAW_CONFIG_PATH environment variable:

const openclawConfigPath = process.env.OPENCLAW_CONFIG_PATH;
// Use the openclawConfigPath to load the configuration file

Verification

To verify that the fix worked, run the following commands:

pnpm openclaw config file
pnpm openclaw gateway --verbose

The output should reflect the correct configuration file path and detect the gateway.mode=local setting without reporting missing configuration.

Extra Tips

  • Ensure that the .env file is in the correct location and is properly formatted.
  • Verify that the OPENCLAW_CONFIG_PATH environment variable is set correctly and is being used by OpenClaw.
  • If issues persist, try debugging the OpenClaw configuration loading process to identify where the issue is occurring.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

FAQ

Expected behavior

OpenClaw should load the project-local .env, respect OPENCLAW_CONFIG_PATH, and use:

/Users/fenglian1/AI/openclaw/config/openclaw.runtime.json5

As a result, pnpm openclaw config file should print that path, and pnpm openclaw gateway --verbose should detect gateway.mode=local without reporting missing config.

#prompt issue#agent setup#task chaining#parallel task#integration issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

openclaw - ✅(Solved) Fix [Bug]: project-local .env is ignored in 2026.3.28, OPENCLAW_CONFIG_PATH falls back to ~/.openclaw/openclaw.json [3 pull requests, 1 comments, 2 participants]