Problem

Tool call logging captures some information but lacks key observability features needed for production auditing:

1. Input parameters are not sanitized - full arguments are logged, potentially exposing sensitive data
2. Errors are not categorized - only raw error messages, no structured error types
3. No context writeback tracking - when tools write to files/memory, no record of what was written

Current State

What's logged:

embedded run tool start: runId=xxx tool=exec toolCallId=xxx
embedded run tool end: runId=xxx tool=exec toolCallId=xxx

What's in JSONL:

{
  "role": "toolResult",
  "toolName": "exec",
  "isError": false,
  "content": [...]
}

What's missing:

Proposed Enhancement

1. Input Sanitization Log

Add a sanitized parameter summary at INFO level:

tool call: exec args={"command": "cat ~/.openclaw/...", "_sanitized": true}
tool call: gateway args={"action": "config.schema.lookup", "path": "tools"}
tool call: message args={"action": "send", "to": "***", "_redacted": ["message"]}

Rules:

• File paths: keep but truncate if too long
• Commands: truncate, don't log full multi-line scripts
• API keys/tokens: always redact
• Message content: redact or hash

2. Error Categorization

Add structured error type to toolResult:

{
  "errorType": "ENOENT",  // or "PERMISSION", "VALIDATION", "TIMEOUT", etc.
  "errorMessage": "no such file or directory",
  "errorRecoverable": true
}

Common categories:

• ENOENT - file not found
• PERMISSION - access denied
• VALIDATION - invalid input
• TIMEOUT - operation timed out
• RATE_LIMIT - API rate limited
• TOOL_ERROR - tool-specific error

3. Context Writeback Tracking

When tools write to files/memory, log what was written:

tool writeback: edit file=memory/2026-03-27.md lines=+5/-2
tool writeback: write file=WRITING_CHECKLIST.md bytes=2934
tool writeback: memory key="user.timezone" value="Asia/Shanghai"

This enables:

• Audit trail of what changed
• Recovery from bad writes
• Understanding agent behavior

Benefits

1. Security: Sanitized logs don't leak secrets
2. Debugging: Categorized errors are easier to search/monitor
3. Observability: Writeback tracking shows what the agent actually did

Related

• Tool policy audit logging: missing 'which rule matched' in logs #55801 - Tool policy audit logging (permission decision)
• Plugin system audit: missing load/health status in logs #55803 - Plugin system audit

Environment

• OpenClaw version: 2026.3.24
• Node: 22.22.0
• OS: Linux (WSL2)