openclaw - 💡(How to fix) Fix 2026.5.2: gateway rewrites legacy streaming/agentRuntime config that security audit flags invalid [1 comments, 2 participants]

Summary

After upgrading/running 2026.5.2, openclaw security audit --deep reports the live config as invalid because it contains legacy object-shaped Telegram streaming config and agents.defaults.agentRuntime.

Manually patching ~/.openclaw/openclaw.json to the current schema verifies clean on disk, but after gateway activity/restart the gateway rewrites the old-shape values back into the config file. This creates a loop where operators cannot permanently clear the audit/schema drift.

Version / environment

• OpenClaw: 2026.5.2 (8b2a6e5)
• Install: pnpm/global CLI, /usr/local/bin/openclaw
• OS: macOS 12.7.6 x64
• Node: 24.14.0
• Gateway: LaunchAgent, loopback 127.0.0.1:18789
• Telegram: multi-account setup, 20 accounts connected/working

Symptoms

openclaw security audit --deep prints invalid config diagnostics before the audit result:

Invalid config at ~/.openclaw/openclaw.json:
- agents.defaults: Unrecognized key: "agentRuntime"
- channels.telegram.streaming: Invalid input (allowed: true, false, "off", "partial", "block", "progress")
- channels.telegram.accounts.<account>.streaming: Invalid input ...

The file contains values shaped like:

"agents": {
  "defaults": {
    "agentRuntime": { "id": "auto" }
  }
},
"channels": {
  "telegram": {
    "streaming": { "mode": "off" },
    "accounts": {
      "alison": { "streaming": { "mode": "off" } }
    }
  }
}

The current audit/schema expects:

"streaming": "off"

and rejects agents.defaults.agentRuntime.

Reproduction observed

1. Patch config on disk:
   • remove agents.defaults.agentRuntime
   • convert channels.telegram.streaming from { "mode": "off" } to "off"
   • convert every channels.telegram.accounts.*.streaming similarly
2. Verify by parsing and scanning ~/.openclaw/openclaw.json: zero bad fields.
3. Run gateway restart / gateway health/status activity.
4. Re-check ~/.openclaw/openclaw.json: old fields are back.
5. openclaw security audit --deep again reports the same invalid config.

Expected

Either:

• config migration should permanently normalize legacy fields to the current schema, or
• security audit/config schema should accept the legacy object shape if the gateway still persists it, or
• the gateway should stop reserializing stale in-memory legacy config over the manually migrated file.

Actual

Gateway remains healthy and Telegram works, but the config file is repeatedly rewritten into a shape that security audit --deep flags invalid.

Impact

• Operators cannot clear post-upgrade config drift.
• Security audit reports noisy invalid-config diagnostics even while gateway/channel health is OK.
• Manual edits do not persist because the gateway writes the legacy shape back.
• This is risky because it trains operators to ignore audit output after upgrades.

Related

Likely adjacent to:

• #72872 (agents.defaults.agentRuntime schema rejection)
• #73257 (legacy agentRuntime regression PR)
• #73795 (streaming config shape/mode behavior)
• #76432 (2026.5.2 config clobbering, but different manifestation)

No secrets or tokens included here.