Config Rollback

OpenClaw 配置回滚管理 - 备份、超时保护、自动回滚

Security Scan

The skill's files and runtime instructions are coherent with its stated purpose (automated config backup and rollback); it makes local changes (scripts, cron job, backups) but does not request credentials or exfiltrate data.

Purpose & Capability

Name/description (config rollback, backups, timeout protection) match the provided scripts and README. Required binary is only bash, which is appropriate. The scripts operate on ~/.openclaw and the OpenClaw gateway CLI as expected.

Instruction Scope

SKILL.md instructs installing/copying scripts, setting a cron job, creating backups, and checking local files; the scripts read/write only local OpenClaw-related files and /tmp logs and call the OpenClaw CLI. There is no instruction to read unrelated sensitive config or send data externally.

Install Mechanism

No network downloads or external installers; the package is instruction+scripts and provides an install.sh that copies files into ~/.openclaw and sets permissions and a cron entry. This is a low-risk, local install mechanism.

Credentials

The skill requests no environment variables or credentials. It uses the local OpenClaw CLI and filesystem paths under the user's home directory, which are proportionate to its stated function.

Persistence & Privilege

The installer and instructions modify the user's crontab (adds a per-minute rollback guardian) and write scripts/backups under ~/.openclaw. This is expected for a rollback guardian but is a persistent change the user should be aware of.

Assessment

This skill appears to do what it claims: back up ~/.openclaw/openclaw.json, track a 5-minute window, and automatically restore a backup if the Gateway doesn't start. Before enabling: 1) Inspect the scripts (prepare-config-change.sh and rollback-guardian.sh) yourself to confirm behavior. 2) Ensure you have the OpenClaw CLI available (openclaw gateway status/restart are invoked). 3) Be aware the installer will copy scripts into ~/.openclaw/scripts and add a cron job that runs every minute; uninstalling requires removing that cron entry and the state/backup files. 4) Test in a safe environment first (or manually run the prepare script and guardian to confirm behavior). Note: some date invocations (date -v+5M) are BSD/macOS-specific and may fail on some Linux systems — check compatibility before relying on automatic timing.

Config Rollback Skill

OpenClaw 配置回滚管理技能，提供配置修改前的自动备份、超时保护和自动回滚功能。

---

🎯 功能

• 配置备份 - 修改前自动备份到 ~/.openclaw/backups/
• 超时保护 - 5 分钟倒计时，超时自动回滚
• 状态管理 - 跟踪配置修改状态
• 待验证事项 - 动态记录验证事项
• 启动自检 - Gateway 启动后自动验证配置

---

📋 使用方式

1. 准备修改配置

~/.openclaw/scripts/prepare-config-change.sh "修改描述" "验证事项 1,验证事项 2"

参数：

• 修改描述 - 简要描述修改内容（必需）
• 验证事项 - 逗号分隔的验证事项列表（可选）

示例：

~/.openclaw/scripts/prepare-config-change.sh "启用 obsidian 技能" "验证技能状态，验证 Gateway 启动"

输出：

• 备份文件路径
• 回滚截止时间（5 分钟后）
• 下一步操作提示

---

2. 修改配置

编辑 ~/.openclaw/openclaw.json

---

3. 重启 Gateway

必须在 5 分钟内完成：

openclaw gateway restart

---

4. 查看状态

# 查看当前配置修改状态
cat ~/.openclaw/.config-modified-state

# 查看待验证事项
cat ~/.openclaw/workspace/docs/PENDING_VERIFICATION.md

---

🔄 自动回滚机制

守护进程

脚本： ~/.openclaw/scripts/rollback-guardian.sh

Cron 任务： 每分钟执行一次

*/1 * * * * ~/.openclaw/scripts/rollback-guardian.sh

工作逻辑

状态	行为
无配置修改	直接退出（安静模式）
Gateway 正常运行	清除状态文件（任务完成）
Gateway 未运行 + 未超时	继续等待
Gateway 未运行 + 超时	执行回滚

---

📁 相关文件

文件	作用
scripts/prepare-config-change.sh	修改准备脚本
scripts/rollback-guardian.sh	超时回滚守护
scripts/config-alias.sh	交互式助手
backups/	配置备份目录
docs/PENDING_VERIFICATION.md	待验证事项记录
docs/CONFIG_QUICKREF.md	快速参考
CONFIG_CHANGE_RULES.md	详细规则

---

🚨 紧急回滚

# 手动回滚到最近备份
cp $(ls -t ~/.openclaw/backups/*.json | head -1) ~/.openclaw/openclaw.json
openclaw gateway restart

---

🔧 安装

自动安装（推荐）

openclaw skills enable config-rollback

手动安装

1. 复制脚本

   # 脚本已在工作区
   ls ~/.openclaw/workspace/skills/config-rollback/scripts/
   

2. 设置权限

   chmod +x ~/.openclaw/workspace/skills/config-rollback/scripts/*.sh
   

3. 设置 Cron

   (crontab -l 2>/dev/null | grep -v "rollback-guardian"; echo "*/1 * * * * ~/.openclaw/workspace/skills/config-rollback/scripts/rollback-guardian.sh") | crontab -
   

4. 验证

   crontab -l | grep rollback
   

---

📊 配置流程

修改配置
    ↓
执行 prepare-config-change.sh
├─ 自动备份到 backups/
├─ 创建状态文件 .config-modified-state
└─ 记录到 PENDING_VERIFICATION.md
    ↓
5 分钟倒计时开始
    ↓
守护进程每分钟检查
├─ 无状态文件 → 直接退出（安静模式）
├─ Gateway 正常运行 → 清除状态文件 ✅
├─ Gateway 未运行 + 未超时 → 继续等待
└─ Gateway 未运行 + 超时 → 自动回滚 ⚠️

---

🎯 最佳实践

修改前

1. 执行 prepare-config-change.sh
2. 记录修改原因到 docs/CONFIG_CHANGELOG.md

修改中

3. 验证 JSON 语法（可选）

   node -e "JSON.parse(require('fs').readFileSync('~/.openclaw/openclaw.json'))"
   

修改后

4. 5 分钟内重启 Gateway
5. 查看 Discord 上的 BOOT.md 自检报告
6. 更新 PENDING_VERIFICATION.md 中的验证状态

---

⚠️ 注意事项

1. 修改前必须执行准备脚本 - 否则没有备份和超时保护
2. 5 分钟内必须重启 - 否则会自动回滚
3. 验证事项与修改目的关联 - 不是固定的验证内容

---

📚 相关文档

• docs/CONFIG_QUICKREF.md - 快速参考
• CONFIG_CHANGE_RULES.md - 详细规则
• docs/CONFIG_MEMORY_SYSTEM.md - 记忆系统设计
• ~/brain2claw/Agent 工作案例/001-config-management-flow.md - 设计案例

---

🧪 测试

# 1. 执行准备脚本
~/.openclaw/scripts/prepare-config-change.sh "测试" "验证"

# 2. 查看状态
cat ~/.openclaw/.config-modified-state

# 3. 查看备份
ls -lt ~/.openclaw/backups/

# 4. 等待超时（或手动重启）
# 5 分钟后会自动回滚

# 5. 清理测试（可选）
rm -f ~/.openclaw/.config-modified-state

---

版本： 1.0.0
作者： 小麦 🌲
日期： 2026-03-16