From 17dc84082c706ec46b506c72b1e6f71a058d9045 Mon Sep 17 00:00:00 2001
From: Developer <developer@noveria.net>
Date: Sun, 12 Jul 2026 22:07:11 +0200
Subject: [PATCH] feat: switch agent identity from openclaw.json to
 agents-sanitized.json

Completes P4 migration: Nexus API no longer reads openclaw.json.

Changes:
- AgentService: default path -> agents-sanitized.json
- OpenClawGatewayClient: LoadAgentIdsFromConfig + GetAvailableModels
  both now read from agents-sanitized.json
- compose.yaml: mount agents-sanitized.json instead of openclaw.json

The deploy script (.gitea/scripts/deploy-nexus.sh) already generates
agents-sanitized.json during deployment, extracting only the
section (list + defaults) without gateway/auth/password secrets.

DoD:
- No read access to openclaw.json from Nexus API container
- No uid-1654 ACL dependency for agent identity resolution
- No secrets in agent responses or config files
---
 backend/Services/AgentService.cs          |  2 +-
 backend/Services/OpenClawGatewayClient.cs | 11 ++++++-----
 compose.yaml                              |  2 +-
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/backend/Services/AgentService.cs b/backend/Services/AgentService.cs
index 538a3c2..2d1b11e 100644
--- a/backend/Services/AgentService.cs
+++ b/backend/Services/AgentService.cs
@@ -235,7 +235,7 @@ public sealed class AgentService(IConfiguration configuration, IAgentRuntime run
     private async Task<IReadOnlyList<AgentConfig>> LoadAgentConfigsAsync(CancellationToken cancellationToken)
     {
         var path = configuration.GetValue<string>("AgentConfigPath")
-            ?? "/home/node/.openclaw/openclaw.json";
+            ?? "/home/node/.openclaw/agents-sanitized.json";
 
         if (!File.Exists(path))
             return BuildFallbackConfigs();
diff --git a/backend/Services/OpenClawGatewayClient.cs b/backend/Services/OpenClawGatewayClient.cs
index b46b92f..4a4b144 100644
--- a/backend/Services/OpenClawGatewayClient.cs
+++ b/backend/Services/OpenClawGatewayClient.cs
@@ -123,7 +123,7 @@ public sealed class OpenClawGatewayClient(HttpClient httpClient, IConfiguration
             )
         };
 
-        // Load agent IDs from openclaw.json config
+        // Load agent IDs from sanitized agents config (no secrets)
         var agentIds = LoadAgentIdsFromConfig();
 
         var agents = new List<DashboardAgentInfo>();
@@ -227,7 +227,8 @@ public sealed class OpenClawGatewayClient(HttpClient httpClient, IConfiguration
     }
 
     /// <summary>
-    /// Loads agent IDs from the OpenClaw config file (openclaw.json).
+    /// Loads agent IDs from the sanitized agents config (agents-sanitized.json).
+    /// No secrets — only agent list and defaults are exposed.
     /// Falls back to the known list if the config file is unavailable.
     /// </summary>
     private List<string> LoadAgentIdsFromConfig()
@@ -235,7 +236,7 @@ public sealed class OpenClawGatewayClient(HttpClient httpClient, IConfiguration
         try
         {
             var configPath = configuration.GetValue<string>("AgentConfigPath")
-                ?? "/home/node/.openclaw/openclaw.json";
+                ?? "/home/node/.openclaw/agents-sanitized.json";
 
             if (!System.IO.File.Exists(configPath))
                 return GetDefaultAgentIds();
@@ -1077,7 +1078,7 @@ public sealed class OpenClawGatewayClient(HttpClient httpClient, IConfiguration
     }
 
     /// <summary>
-    /// Returns the list of available models by reading from the OpenClaw config,
+    /// Returns the list of available models by reading from the sanitized agents config,
     /// with fallback to hardcoded list.
     /// </summary>
     public List<ModelOption> GetAvailableModels()
@@ -1085,7 +1086,7 @@ public sealed class OpenClawGatewayClient(HttpClient httpClient, IConfiguration
         try
         {
             var configPath = configuration.GetValue<string>("AgentConfigPath")
-                ?? "/home/node/.openclaw/openclaw.json";
+                ?? "/home/node/.openclaw/agents-sanitized.json";
 
             if (!System.IO.File.Exists(configPath))
                 return GetDefaultModels();
diff --git a/compose.yaml b/compose.yaml
index 4656e67..fb9e7c3 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -68,7 +68,7 @@ services:
       retries: 3
       start_period: 15s
     volumes:
-      - /home/projekte_bao/openclaw/data/openclaw/openclaw.json:/home/node/.openclaw/openclaw.json:ro
+      - /home/projekte_bao/openclaw/data/openclaw/agents-sanitized.json:/home/node/.openclaw/agents-sanitized.json:ro
       - /home/projekte_bao/openclaw/data/openclaw/workspace-iris:/mnt/workspace-iris
       - /home/projekte_bao/openclaw/data/openclaw/workspace-programmer:/mnt/workspace-programmer
       - /home/projekte_bao/openclaw/data/openclaw/workspace-reviewer:/mnt/workspace-reviewer