openclaw - 💡(How to fix) Fix openclaw path: OC_PATH_TOO_DEEP forces hand-edits for paths > 4 segments deep in openclaw.json [1 pull requests]

Summary

openclaw path set/get rejects any oc://openclaw.json/... path deeper than 4 segments with OC_PATH_TOO_DEEP. Real-world openclaw.json config commonly has paths 5–6 segments deep (e.g. agents.list[N].tools.exec.security), so the most common edits to that file fall back to hand-editing JSON — bypassing the comment/format-preserving substrate that was the whole point of #78051.

Repro

Fresh ~/.openclaw/openclaw.json with an agents.list[] array entry that has tools.exec.security:

cd ~/.openclaw
openclaw path set "oc://openclaw.json/agents/list/8/tools/exec/security" "allowlist"

Result:

{"error":{"code":"OC_PATH_TOO_DEEP","message":"parse failed: Too many segments in oc:// path (max 4): oc://openclaw.json/agents/list/8/tools/exec/security"}}

openclaw 2026.5.22 (a374c3a) on macOS arm64.

Why this hurts

The 4-segment scheme (FILE/SECTION/ITEM/FIELD) maps cleanly to flat configs and agent workspace files (AGENTS.md sections, daily-note items, jsonl rows). But openclaw.json itself is hierarchical — most useful edits live at depths 5–7:

Falling back to hand-editing the live openclaw.json is exactly the comment-eating / formatting-drift / redaction-sentinel-leakage risk that the oc:// substrate was meant to eliminate (#65623, #62438, etc.).

Asks (in priority order)

1. Raise the depth cap for openclaw.json slot to whatever's needed to cover the live schema — empirically that's at least 7 (e.g. gateway.auth.token would be 3, but agent-list entries plus tool config keys reach 6–7).
2. If unlimited depth is undesirable, document the cap on docs/cli/path.md with the explicit pattern for editing nested config (recommended fallback: openclaw config set? jq? node?).
3. Better error suggestion: when OC_PATH_TOO_DEEP fires on a known-deep config path, the error could recommend the next-best CLI (e.g. "for openclaw.json paths > 4 deep, use openclaw config set <dot-path>").

Context: hit during a v2026.5.12 → v2026.5.22 upgrade where I needed to add tools.exec.security: "allowlist" to one entry in agents.list[]. Followup to your #78051 — substrate works great where the depth fits.

cc @giodl73-repo since #78051 was your design.