openclaw - 💡(How to fix) Fix 401 Unauthorized on control-ui-config.json after any config change via Control UI [1 comments, 2 participants]

Bug Description

Every time I change config through the Control UI settings panel, the UI immediately breaks with 401 Unauthorized on /__openclaw/control-ui-config.json. A full page hard-refresh (Ctrl+Shift+R) or killing and restarting the gateway fixes it until the next change.

Environment

• OpenClaw version: 2026.5.18
• Gateway mode: local
• Auth mode: token
• Bind: loopback (127.0.0.1:18789)
• OS: Linux (CachyOS)

Steps to Reproduce

1. Open Control UI at http://127.0.0.1:18789
2. Change any config value (e.g. toggle a setting, change model alias)
3. Save
4. Observe 401 on control-ui-config.json and broken UI

Browser Console Output

GET http://127.0.0.1:18789/__openclaw/control-ui-config.json 401 (Unauthorized)
The FetchEvent for "http://127.0.0.1:18789/chat?..." resulted in a network error response
sw.js: Uncaught (in promise) TypeError: Failed to convert value to 'Response'

Root Cause Analysis

When openclaw.json is rewritten, the runtime config snapshot refreshes via setRuntimeConfigSnapshot(), but the gateway's resolvedAuth used by authorizeControlUiReadRequest() is evaluated through getResolvedAuth() → resolveGatewayAuth() which reads from getActiveSecretsRuntimeSnapshot()?.config.gateway?.auth.

The secrets runtime snapshot (activeSnapshot) is only refreshed during explicit activateSecretsRuntimeSnapshotState() calls. After a config write, finalizeRuntimeSnapshotWrite() updates the config snapshot but does not trigger a corresponding secrets snapshot refresh when only the config file changed (no auth store reload). The result: resolvedAuth resolves stale auth state while the Control UI sends its current device token. The auth check fails with 401.

The service worker crash is secondary — fetch() rejects when the gateway closes the connection during the auth failure, and event.respondWith() receives a rejected promise instead of a Response.

Workarounds

• Hard refresh (Ctrl+Shift+R) usually recovers
• Kill + restart gateway fully fixes until next config change
• Changing config via CLI (openclaw config set ...) does not trigger this bug