OpenClaw makes configured secret references fail closed

openclaw/openclaw PR #127669 is the inspected primary source: “fix(secrets): fail closed for configured references.” The related records below were inspected as supporting context rather than independent confirmation.

The facts

- openclaw/openclaw PR #127669 was created 2026-08-21T22:50:10Z and was open at inspection; its title is “fix(secrets): fail closed for configured references.” - openclaw/openclaw PR #127716 was created 2026-08-22T00:34:54Z and was open at inspection; its title is “fix(onboard): preserve named-agent profiles during config resets.” - openclaw/openclaw PR #127703 was created 2026-08-22T00:18:19Z and was closed at inspection; its title is “fix(config): diagnose an unwritable config directory instead of leaking EACCES.” - The repository reported 387044 stars, 6183 open issues, default branch main, and last push 2026-08-22T00:40:30Z. - The latest tagged-release baseline checked was v2026.8.1-beta.2 published 2026-08-15T05:36:23Z.

What changed

openclaw/openclaw PR #127669 reports: What Problem This Solves Fixes an issue where an explicitly configured SecretRef that was unavailable could be discarded and replaced by unrelated ambient credentials. This affected Gateway password onboarding and probes, Buzz credentials, the default IRC password, the default Nextcloud Talk bot secret, and GitHub Copilot discovery and embeddings. Why This Change Was Made Explicit SecretRefs now remain authoritative across the shared Gateway, probe, provider, channel-account, and outbound-selection boundaries. Historical environment, plaintext, and credential-file precedence remains unchanged when no SecretRef owns the exact credential surface. The repair absorbs duplicated policy into the owning boundaries and is net-negative production code. AI-assisted: yes. User Impact When a configured secret backend is unavailable, OpenClaw no longer authenticates, probes, discovers, embeds, or sends as an unintended account using an ambient fallback. The affected owner instead reports a redacted unavailable state and performs no outbound action. Existing configurations without SecretRefs retain their shipped precedence. Evidence Added pre-fix regression matrices for Gateway auth/onboarding/probes, account isolation, direct sends, Buzz discovery, IRC connections, Nextcloud Talk delivery, and GitHub Copilot discovery/embeddings. Focused post-fix proof passed across the affected core and plugin owners; the final absorbing refactor passed 291 tests across 21 files and six Vitest shards, plus core and extension production typechecks, formatting, and git diff --check. Fresh structured review against current main reported no actionable P0/P1 findings. Full

openclaw/openclaw PR #127716 reports: What Problem This Solves Fixes an issue where users resetting only their OpenClaw configuration could not reuse an existing provider profile for a named first agent. For example, openclaw onboard --reset --reset-scope config --agent-name robby --auth-choice apiKey --token-provider anthropic incorrectly rejected setup as missing a profile even though the preserved robby agent already owned one. Why This Change Was Made Reset preflight correctly validates against the future empty configuration, but it previously resolved provider profiles without the future agent identity or selected workspace, implicitly looking under main. Resolve the pending post-reset target through the existing canonical onboarding owner and carry its agent directory and workspace into both plugin-provider and custom-provider validation. Configuration-only resets may reuse preserved profiles; reset scopes that delete credentials continue to fail before changing state. User Impact Operators can reconfigure an existing named agent without reentering a provider key when requesting a configuration-only reset. Named-agent normalization, inherited main profiles, default-agent setup, selected workspaces, and destructive-reset safety retain their existing behavior. Evidence The exact unmodified production owner reproduced both failures before the fix: plugin and custom validation each received no agent directory and no selected workspace. An actual installed models auth --agent robby command created a real isolated named-only SQLite provider profile; both actual onboard and setup then exited 1 before reset despite that preserved profile. Replaying the

openclaw/openclaw PR #127703 reports: What Problem This Solves When the OpenClaw config directory is not writable, every config write fails with a raw Node errno that names the **lock file** — an internal artifact — instead of the directory whose permissions are the actual problem. Reproduced on the real dist CLI with an isolated HOME and chmod 555 on the config directory: --json emits the same raw text inside its cli_error envelope. Two successes are reported, then a bare errno pointing at openclaw.json.lock. An operator reading that will investigate or delete the lock file, which changes nothing. This is not onboarding-specific. withConfigMutationLock is the choke point for **every** config write, so config set, doctor --fix, hooks enable, and everything else that persists config failed the same unhelpful way. Why This Change Was Made withConfigMutationLock (src/config/mutate.ts) prepares the directory and then takes the cross-process lock: mkdir is a no-op when the directory already exists, so an existing-but-unwritable directory sails past it and the failure lands inside withFileLock. Nothing in the lock stack (src/plugin-sdk/file-lock.ts, src/infra/file-lock*.ts) has permission-specific handling, so the raw errno reaches the CLI's generic error printer. Every neighbouring failure class in this product diagnoses itself: an invalid config prints File / Problem / Inspect / Fix, and a gateway health failure prints Classification / Last probe / Fix. A permission failure on the config

Why it matters

Configured identity has to outrank ambient convenience. A missing secret reference should stop the action, while a configuration-only reset should preserve the profile the operator intentionally kept. The operator test is whether the system remains bounded and its receipts still describe the action after failure, retry or restart.

Current

The primary record was open when captured on 2026-08-22. The tagged-release baseline was v2026.8.1-beta.2 published 2026-08-15T05:36:23Z. Repository metadata, full source bodies, current pull requests and issues, releases, Google News, Hacker News, Lobsters, Metamesh and the rendered ClawCharts row were inspected. ClawCharts selected the subject; it did not prove the claim.

Evidence

The primary URL is https://github.com/openclaw/openclaw/pull/127669. Supporting records are https://github.com/openclaw/openclaw/pull/127716 and https://github.com/openclaw/openclaw/pull/127703. Source bodies, timestamps and states are preserved in the daily evidence bundle. Test counts and reproductions remain attributed to their authors unless identified as independently rerun.

Source boundary

Open work is described as open, closed work as closed, and operator reports as reports. A pull request is evidence of proposed or reviewed direction, not proof of a shipped release. Search residue, package mirrors and historically published source spines were excluded.

Operator take

Keep explicit references authoritative, return redacted unavailable state, and test reset and permission failures without silently changing credential ownership. Preserve a before-state receipt, make the smallest reversible change, and verify the original failure independently.

Caveat

Public project records are mutable. Status, scope and evidence can change after publication. This brief records the inspected state and does not authorize changes to a reader’s deployment.

Source inspected; source state, environment and release boundary remain explicit.