openclaw - 💡(How to fix) Fix config set/get/unset silently accepts malformed dot paths (empty segments) [1 pull requests]

Observed problem

openclaw config parses dot-notation paths with an internal parsePath that silently drops empty/whitespace key segments (consecutive, leading, or trailing dots). A typo'd path is normalized to a different valid key instead of being rejected. On config set/config unset this silently mutates the wrong key with no warning.

Current behavior on main

$ export OPENCLAW_CONFIG_PATH=$(mktemp -d)/openclaw.json
$ openclaw config set "gateway..port" 23456
Updated gateway.port. Restart the gateway to apply.
$ cat "$OPENCLAW_CONFIG_PATH"
{"gateway":{"port":23456}, ...}      # wrote gateway.port from a malformed path

$ openclaw config get ".gateway.port"
23456                                 # leading dot accepted

Trailing dots (gateway.port.), double dots (gateway..port), leading dots (.gateway.port), and whitespace-only segments (gateway. .port) are all silently collapsed.

Root cause: src/cli/config-cli.ts parsePath only pushes a segment when non-empty and relies on normalizeStringEntries (.filter(Boolean)) to scrub the rest; parseRequiredPath only rejects the fully-empty path. The sibling parser parseConfigPath in src/config/config-paths.ts already rejects empty segments, so the two config-path parsers disagree.

Expected behavior

A malformed path with an empty/whitespace segment should be rejected with a clear error and a non-zero exit, and must not read or write any key. Valid paths, escaped dots (a\.b), and bracket index segments after a dot (foo[0].bar) should keep working.

Duplicate search performed

• Issues (all states): "config path empty segment dot notation", "config set path notation invalid", "config trailing dot double dot path" — no matching issue.
• Open PRs: "config parsePath empty segment", "config dot notation empty segment", "config-cli" — no PR touches parsePath/empty-segment handling (#83391 "harden config and command validation" edits src/commands/** and src/config/{includes,env-substitution}, not src/cli/config-cli.ts).

Candidate fix shape

In parsePath, reject empty key segments (mirroring parseConfigPath's contract) while still accepting bracket index segments after a dot. ~12 lines, with regression tests in src/cli/config-cli.test.ts.