Inspect configuration without exposing secrets

Verifiedon 2026-07-302026.7.1-2

Read narrowly, validate first

openclaw config file identifies the active configuration file. openclaw config validate --json checks it against the active schema without starting the gateway. For a hypothesis, use config get <path> rather than copying the whole file: the documented command reads from a redacted config snapshot, so secrets do not print.

Lab: configuration evidence card

Record: active config path category (not the full private path if it identifies a person), validator exit/result, and one non-secret setting relevant to the symptom. Good examples are a workspace path category, selected model name, or whether a channel account is enabled. Use config schema when you need to understand a path before reading it.

Write safety

Do not turn this lesson into a repair. config set can parse JSON5 and object assignment can replace values. If a later repair needs config patch, first create a patch file, run openclaw config patch --file ./openclaw.patch.json5 --dry-run, and preserve the current validation result. In Nix mode, writers intentionally refuse; change the declared Nix source rather than bypassing that boundary.

Checkpoint

A missing path returns a non-zero result. That is evidence for a missing or renamed configuration surface—not permission to invent a replacement key. Check the current schema and version before changing anything.