fix(config): log config overwrite audits

src/config/io.write-config.test.ts

@@ -1,6 +1,6 @@
 import fs from "node:fs/promises";
 import path from "node:path";
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 import { createConfigIO } from "./io.js";
 import { withTempHome } from "./test-helpers.js";
 
@@ -174,4 +174,66 @@ describe("config io write", () => {
       ]);
     });
   });
+
+  it("logs an overwrite audit entry when replacing an existing config file", async () => {
+    await withTempHome(async (home) => {
+      const configPath = path.join(home, ".openclaw", "openclaw.json");
+      await fs.mkdir(path.dirname(configPath), { recursive: true });
+      await fs.writeFile(
+        configPath,
+        JSON.stringify({ gateway: { port: 18789 } }, null, 2),
+        "utf-8",
+      );
+      const warn = vi.fn();
+      const io = createConfigIO({
+        env: {} as NodeJS.ProcessEnv,
+        homedir: () => home,
+        logger: {
+          warn,
+          error: vi.fn(),
+        },
+      });
+
+      const snapshot = await io.readConfigFileSnapshot();
+      expect(snapshot.valid).toBe(true);
+      const next = structuredClone(snapshot.config);
+      next.gateway = {
+        ...next.gateway,
+        auth: { mode: "token" },
+      };
+
+      await io.writeConfigFile(next);
+
+      const overwriteLog = warn.mock.calls
+        .map((call) => call[0])
+        .find((entry) => typeof entry === "string" && entry.startsWith("Config overwrite:"));
+      expect(typeof overwriteLog).toBe("string");
+      expect(overwriteLog).toContain(configPath);
+      expect(overwriteLog).toContain(`${configPath}.bak`);
+      expect(overwriteLog).toContain("sha256");
+    });
+  });
+
+  it("does not log an overwrite audit entry when creating config for the first time", async () => {
+    await withTempHome(async (home) => {
+      const warn = vi.fn();
+      const io = createConfigIO({
+        env: {} as NodeJS.ProcessEnv,
+        homedir: () => home,
+        logger: {
+          warn,
+          error: vi.fn(),
+        },
+      });
+
+      await io.writeConfigFile({
+        gateway: { mode: "local" },
+      });
+
+      const overwriteLogs = warn.mock.calls.filter(
+        (call) => typeof call[0] === "string" && call[0].startsWith("Config overwrite:"),
+      );
+      expect(overwriteLogs).toHaveLength(0);
+    });
+  });
 });