Skill: wangwu-30/elegant-config-guardian (version 0.1.0)

--- name: elegant-config-guardian description: Safely apply OpenClaw config changes with automatic rollback and ack timeout guard. Use when editing ~/.openclaw/openclaw.json, restarting gateway, enabling cross-context routing, or any risky runtime config change that must auto-revert if health checks or explicit ack are missing. --- # Elegant Config Guardian Use `scripts/safe_apply.sh` to enforce: backup → apply → restart → health check → optional ack wait → rollback on failure. ## Run ```bash bash scripts/safe_apply.sh \ --config ~/.openclaw/openclaw.json \ --apply-cmd 'python3 /tmp/patch.py' \ --ack-timeout 60 \ --require-ack ``` ## Ack mode When `--require-ack` is enabled, the script prints an ack token file path. A successful manual ack is: ```bash touch <ack-file-path> ``` If timeout expires without ack, rollback is triggered automatically. ## Defaults - Health probe command: `openclaw gateway status` and require `RPC probe: ok` - Restart command: `openclaw gateway restart` - Backup file: `<config>.bak.YYYYmmdd-HHMMSS` ## Recommended workflow 1. Prepare a deterministic patch command (`--apply-cmd`). 2. Run with `--require-ack --ack-timeout 45` for production changes. 3. Verify health. 4. Ack explicitly only after end-to-end validation. 5. Let timeout auto-rollback if validation cannot complete in time.

path: scripts/safe_apply.sh
content: #!/usr/bin/env bash
set -euo pipefail

CONFIG="$HOME/.openclaw/openclaw.json"
APPLY_CMD=""
ACK_TIMEOUT=45
REQUIRE_ACK=0

while [[ $# -gt 0 ]]; do
  case "$1" in
    --config) CONFIG="$2"; shift 2 ;;
    --apply-cmd) APPLY_CMD="$2"; shift 2 ;;
    --ack-timeout) ACK_TIMEOUT="$2"; shift 2 ;;
    --require-ack) REQUIRE_ACK=1; shift 1 ;;
    *) echo "unknown arg: $1"; exit 1 ;;
  esac
done

if [[ -z "$APPLY_CMD" ]]; then
  echo "--apply-cmd is required"
  exit 1
fi

TS="$(date +%Y%m%d-%H%M%S)"
BACKUP="${CONFIG}.bak.${TS}"
ACK_FILE="/tmp/openclaw-config-ack-${TS}.ok"
STATUS_FILE="/tmp/openclaw-safe-status-${TS}.txt"

cp "$CONFIG" "$BACKUP"
echo "[safe-apply] backup: $BACKUP"

eval "$APPLY_CMD"

echo "[safe-apply] restarting gateway..."
openclaw gateway restart >/dev/null 2>&1 || true
sleep 2

if ! openclaw gateway status >"$STATUS_FILE" 2>&1 || ! grep -q "RPC probe: ok" "$STATUS_FILE"; then
  echo "[safe-apply] health check failed -> rollback"
  cp "$BACKUP" "$CONFIG"
  openclaw gateway restart >/dev/null 2>&1 || true
  sleep 2
  exit 2
fi

echo "[safe-apply] health check passed"

if [[ "$REQUIRE_ACK" -eq 1 ]]; then
  echo "[safe-apply] ack required within ${ACK_TIMEOUT}s"
  echo "[safe-apply] ack file: $ACK_FILE"
  echo "touch '$ACK_FILE'"

  elapsed=0
  while [[ $elapsed -lt $ACK_TIMEOUT ]]; do
    if [[ -f "$ACK_FILE" ]]; then
      echo "[safe-apply] ack received"
      rm -f "$ACK_FILE"
      exit 0
    fi
    sleep 1
    elapsed=$((elapsed+1))
  done

  echo "[safe-apply] ack timeout -> rollback"
  cp "$BACKUP" "$CONFIG"
  openclaw gateway restart >/dev/null 2>&1 || true
  sleep 2
  exit 3
fi

echo "[safe-apply] done"


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: suspicious | SkillSpector: suspicious (HIGH)