Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix redactSensitive: "all" causes gateway crash-loop [2 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#60828•Fetched 2026-04-08 02:46:41
View on GitHub
Comments
0
Participants
1
Timeline
4
Reactions
0
Author
Belthezar46Belthezar46
Participants
Belthezar46Belthezar46
Timeline (top)
cross-referenced ×2referenced ×2

Setting logging.redactSensitive to "all" in openclaw.json causes a config validation failure that puts the gateway into a crash-loop. The gateway fails to start and keeps restarting via LaunchAgent.

Error Message

  • The openclaw security audit tool does not warn about this invalid value before it's applied Option B (minimum): Add config validation that rejects "all" with a clear error message before startup, and document valid values in the security guide.

Root Cause

Setting logging.redactSensitive to "all" in openclaw.json causes a config validation failure that puts the gateway into a crash-loop. The gateway fails to start and keeps restarting via LaunchAgent.

Fix Action

Fixed

PR fix notes

PR #60849: feat(logging): add "all" as valid redactSensitive mode

Description (problem / solution / changelog)

Summary

Fixes #60828. Setting logging.redactSensitive: "all" in openclaw.json caused a config validation crash-loop because only "off" and "tools" were valid enum values.

  • Adds "all" as a valid redactSensitive value to the zod schema, TypeScript type, and JSON schema
  • "all" extends "tools" behaviour to cover all log surfaces (session transcripts, file output) — not just tool call summaries
  • Updates normalizeMode() to preserve "all" instead of folding it into "tools"
  • Fixes redactToolDetail() to gate on === "off" so "all" mode also redacts tool summaries (previously !== "tools" would have skipped redaction for "all")
  • Updates help text in schema.help.ts and schema.base.generated.ts to document all three valid values
  • Updates security audit remediation message to suggest "tools" or "all"

Test plan

  • Set logging.redactSensitive: "all" in config — gateway should start without crash
  • Set logging.redactSensitive: "tools" — tool summaries are redacted, other surfaces unchanged
  • Set logging.redactSensitive: "off" — no redaction applied
  • Set an invalid value (e.g. "partial") — zod validation rejects it with a clear error
  • Run openclaw security audit — check that "all" does not trigger the redaction-disabled warning

🤖 Generated with Claude Code

Changed files

  • src/config/schema.base.generated.ts (modified, +5/-1)
  • src/config/schema.help.ts (modified, +1/-1)
  • src/config/types.base.ts (modified, +2/-2)
  • src/config/zod-schema.ts (modified, +1/-1)
  • src/logging/redact.ts (modified, +9/-3)
  • src/security/audit.ts (modified, +1/-1)

PR #60869: fix: accept redactSensitive:all as valid config value, prevent crash-loop

Description (problem / solution / changelog)

Summary

Setting logging.redactSensitive: "all" caused a config validation failure that put the gateway into a crash-loop. Only "off" and "tools" were valid values.

Fix

Added "all" as a valid enum value for redactSensitive. In "all" mode, redaction is applied to all log surfaces (same patterns as "tools", available broadly rather than only on tool-call payloads). Prevents the crash-loop for users attempting maximum log redaction.

Changes

  • src/config/zod-schema.ts — Added "all" to the Zod enum union
  • src/config/types.base.ts — Extended TypeScript type to include "all"
  • src/logging/redact.ts — Updated RedactSensitiveMode type, normalizeMode(), redactSensitiveText(), and redactToolDetail() to handle "all"
  • src/config/schema.help.ts — Updated help text to document the new value
  • src/config/schema.base.generated.ts — Added "all" to the JSON schema and updated help text

Fixes openclaw/openclaw#60828

Changed files

  • src/config/schema.base.generated.ts (modified, +5/-1)
  • src/config/schema.help.ts (modified, +1/-1)
  • src/config/types.base.ts (modified, +1/-1)
  • src/config/zod-schema.ts (modified, +3/-1)
  • src/logging/redact.ts (modified, +13/-4)
RAW_BUFFERClick to expand / collapse

Description

Setting logging.redactSensitive to "all" in openclaw.json causes a config validation failure that puts the gateway into a crash-loop. The gateway fails to start and keeps restarting via LaunchAgent.

Steps to Reproduce

  1. Edit ~/.openclaw/openclaw.json
  2. Set "logging": { "redactSensitive": "all" }
  3. Restart gateway: openclaw gateway restart
  4. Gateway fails to start — LaunchAgent enters crash-loop

Expected Behavior

Either:

  • "all" should be a valid option that redacts sensitive data from all log surfaces (not just tool calls)
  • Or the docs should clearly state that only "off" and "tools" are valid values

Actual Behavior

Gateway crashes on config validation. The only valid values in OpenClaw 2026.3.28 are "off" and "tools".

Impact

  • Users attempting maximum log redaction get a broken gateway instead
  • Recovery requires SSH/terminal access to revert the config change
  • If running headless (e.g., VPS), this can cause extended downtime
  • The openclaw security audit tool does not warn about this invalid value before it's applied

Environment

  • OpenClaw version: 2026.3.28
  • OS: macOS 26.2 (Apple Silicon)
  • Node.js: v25.8.1

Suggested Fix

Option A (preferred): Add "all" as a valid redaction level that extends "tools" to also cover session transcripts, memory ingestion, and log files.

Option B (minimum): Add config validation that rejects "all" with a clear error message before startup, and document valid values in the security guide.

Labels

bug, security, gateway

extent analysis

TL;DR

To resolve the issue, set "logging.redactSensitive" to a valid value, either "off" or "tools", in openclaw.json to prevent the gateway from crashing.

Guidance

  • Verify the current value of "logging.redactSensitive" in ~/.openclaw/openclaw.json and update it to a supported value.
  • Check the OpenClaw documentation for the latest information on valid configuration options for log redaction.
  • Consider submitting a feature request to add "all" as a valid redaction level or to improve config validation and error messaging.
  • Before applying any changes, ensure you have a backup of the original openclaw.json file to facilitate easy reversion if needed.

Example

No code snippet is provided as the issue is related to configuration rather than code.

Notes

The current version of OpenClaw (2026.3.28) does not support "all" as a valid value for "logging.redactSensitive". Until this is addressed, using "off" or "tools" are the only options to prevent the gateway from crashing.

Recommendation

Apply workaround: Use a valid value for "logging.redactSensitive" until a fixed version of OpenClaw is released that supports "all" or provides better config validation. This ensures the gateway remains operational while awaiting a more comprehensive solution.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#environment variable#network issue#logging issue#authentication issue#prompt issue

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING