| name | config-guardian |
| description | Safe OpenClaw gateway configuration changes with validation and auto-rollback |
| version | 1.0.0 |
| author | Agent |
Config Guardian
MANDATORY: Never edit /data/.openclaw/openclaw.json directly.
Any configuration change MUST go through Config Guardian.
Why
The gateway performs a hot-reload on file change. An invalid config = gateway crash.
Config Guardian validates changes BEFORE writing, creates a backup, and automatically
rolls back if the gateway degrades after the change.
Commands
Execute via exec tool:
Set a specific key (safest method)
bash /data/.openclaw/workspace/scripts/config_guardian.sh set <key> <value>
Examples:
bash /data/.openclaw/workspace/scripts/config_guardian.sh set agents.defaults.heartbeat.every "2h"
bash /data/.openclaw/workspace/scripts/config_guardian.sh set agents.defaults.model.primary "anthropic/claude-sonnet-4-6"
Delete a key
bash /data/.openclaw/workspace/scripts/config_guardian.sh unset <key>
Apply a JSON patch (for complex changes)
bash /data/.openclaw/workspace/scripts/config_guardian.sh patch '<json>'
Example:
bash /data/.openclaw/workspace/scripts/config_guardian.sh patch '{"agents":{"defaults":{"model":{"primary":"anthropic/claude-sonnet-4-6"}}}}'
Validate a file (dry run)
bash /data/.openclaw/workspace/scripts/config_guardian.sh validate <file>
Exit Codes
| Code | Meaning | Action |
|---|
| 0 | Successfully applied | None |
| 1 | Validation failed | Fix input data and retry |
| 2 | Applied but rolled back | Investigate docker logs --since 1m |
| 3 | Usage error | Check command syntax |
Rules
- One change at a time. No bulk config overwrites.
- Always check the exit code before reporting success to the user.
- If exit 2: read logs (
docker logs --since 1m <your-container-name>) and report the rollback reason.
- Never use
openclaw plugins enable/disable as a "fix" — it overwrites the config.
- For gateway.*, plugins, discovery changes: warn the user that a container restart is needed.
Prohibited
edit or write to /data/.openclaw/openclaw.json
openclaw config set/unset directly (without the guardian wrapper)
openclaw plugins enable/disable (overwrites config unpredictably)
🇺🇦 Українською
Безпечна зміна конфігурації OpenClaw gateway з валідацією та авто-відкатом. Ніколи не редагуйте openclaw.json напряму — всі зміни проходять через Config Guardian, який валідує, бекапить і автоматично відкочує при деградації.