PR #75441: fix(config): log observe recovery write failures

• Repository: openclaw/openclaw
• Author: sallyom
• State: closed | merged: True
• Link: https://github.com/openclaw/openclaw/pull/75441

Description (problem / solution / changelog)

Summary

• Log config health-state write failures instead of silently swallowing them.
• Add async and sync regression coverage for the remaining config observe-recovery paths from #63423.

Fixes #63423

Test plan

• pnpm test src/config/io.observe-recovery.test.ts src/config/io.audit.test.ts
• pnpm lint:core
• pnpm tsgo:core
• pnpm tsgo:core:test
• pnpm exec oxfmt --check --threads=1 CHANGELOG.md src/config/io.audit.ts src/config/io.ts src/config/io.observe-recovery.ts src/config/io.observe-recovery.test.ts
• git diff --check

Changed files

• CHANGELOG.md (modified, +1/-0)
• src/config/io.observe-recovery.test.ts (modified, +83/-0)
• src/config/io.observe-recovery.ts (modified, +16/-4)
• src/config/io.ts (modified, +6/-6)
• src/config/io.write-config.test.ts (modified, +60/-0)

PR #70515: fix(config): surface backup restore copy failures in audit and logs

• Repository: openclaw/openclaw
• Author: davidangularme
• State: closed | merged: True
• Link: https://github.com/openclaw/openclaw/pull/70515

Description (problem / solution / changelog)

Summary

• Problem: During suspicious-read recovery in maybeRecoverSuspiciousConfigRead (async and sync), copyFile(backupPath, configPath) is wrapped in a bare catch {}. When the copy fails (disk full, EACCES), the code still logs "Config auto-restored from backup" and writes the audit record with valid: true.
• Why it matters: Users and audit tooling believe the config was repaired when it was not. A corrupted config persists silently.
• What changed: Capture the copyFile error, emit a distinct failure warning, set valid to restoredFromBackup, and persist restoreErrorCode / restoreErrorMessage on the audit record.
• What did NOT change: No changes to the merge-patch pipeline, config reload watcher, or any other recovery path.

Change Type (select all)

• Bug fix

Scope (select all touched areas)

• Gateway / orchestration

Linked Issue/PR

• This PR fixes a bug or regression

Root Cause (if applicable)

• Root cause: Bare catch {} around copyFile in io.observe-recovery.ts lines 659-662 swallowed all errors unconditionally.
• Missing detection / guardrail: No test covered a failing copyFile during recovery.
• Contributing context: Pattern appears in multiple sites in observe-recovery.ts, this PR addresses the backup-restore path.

Regression Test Plan (if applicable)

• Coverage level:
  • Unit test
• Target test or file: src/config/io.observe-recovery.test.ts
• Scenario: records copyFile failure instead of falsely claiming restore succeeded — injects a failing copyFile (EACCES), asserts failure warning fires, success warning does not, audit record has restoredFromBackup: false, valid: false, restoreErrorCode: "EACCES".
• Why smallest reliable guardrail: Unit test with injected fs failure covers the exact branch.

User-visible / Behavior Changes

• Failed backup restores now log a warning instead of falsely claiming success.
• Audit records for failed restores now show valid: false with error details.

Diagram (if applicable)

Before:
[copyFile fails] -> [log "restored from backup"] -> [audit: valid: true]

After:
[copyFile fails] -> [log "restore FAILED: <error>"] -> [audit: valid: false, restoreErrorCode: "EACCES"]

Security Impact (required)

• New permissions/capabilities? No
• Secrets/tokens handling changed? No
• New/changed network calls? No
• Command/tool execution surface changed? No
• Data access scope changed? No

Repro + Verification

Environment

• OS: Linux (Ubuntu 24)
• Runtime/container: Node 24

Steps

1. Trigger a suspicious config read with a valid .bak file present
2. Make the .bak -> config copyFile fail (simulate EACCES)
3. Observe logs and audit record

Expected

• Warning log: "Config auto-restore from backup failed"
• Audit record: valid: false, restoreErrorCode: "EACCES"

Actual (before fix)

• Success log: "Config auto-restored from backup"
• Audit record: valid: true, no error info

Evidence

• Failing test/log before + passing after

Human Verification (required)

• Verified scenarios: Unit test with injected EACCES copyFile failure
• Edge cases checked: Both async and sync recovery paths
• What I did not verify: Full integration test with real disk-full scenario

Compatibility / Migration

• Backward compatible? Yes
• Config/env changes? No
• Migration needed? No

Risks and Mitigations

• Risk: Audit record schema gains two new nullable fields (restoreErrorCode, restoreErrorMessage)
  • Mitigation: Fields default to null on non-recovery paths, no breaking change for consumers

Changed files

• CHANGELOG.md (modified, +6/-0)
• src/config/io.audit.ts (modified, +2/-0)
• src/config/io.observe-recovery.test.ts (modified, +76/-0)
• src/config/io.observe-recovery.ts (modified, +66/-10)
• src/config/io.ts (modified, +4/-0)