Config Backup for OpenCode, Oh-My-OpenAgent & OpenClaw

Backup and restore scripts for opencode, oh-my-opencode, and openclaw configuration files. All secrets are automatically sanitized before backup, making this safe to store in a public Git repository.

⚡ Quick Start

Backup Your Configs

# Dry run first (recommended)
./backup.sh --dry-run

# Actual backup with verbose output
./backup.sh -v

# Check what was created
ls -la config/

Restore From Backup

# Interactive restore (asks for confirmation)
./restore.sh -v

# Force restore (no confirmation)
./restore.sh --force

🔒 Security Model

What Gets Sanitized

The following secrets are automatically removed from all backed-up files:

Secret Type	Pattern	Example
API Keys	apiKey	sk-b3a7b522c9ca...
Context7 Key	CONTEXT7_API_KEY	ctx7sk-4d520962-...
Bot Tokens	botToken	461718350:AAHSQ...
Gateway Tokens	token, gatewayToken	74622258fe10f...
Socket Tokens	socketToken	xS4eU919GMaX...
Perplexity Key	perplexityApiKey	pplx-WafEFtXG10...

What NEVER Gets Backed Up

These directories and file types are completely excluded for security:

• ~/.openclaw/identity/ — Device authentication tokens
• ~/.openclaw/credentials/ — Bot credentials
• ~/.openclaw/telegram/ — Telegram bot state and tokens
• ~/.openclaw/logs/ — Runtime logs
• All .md files (rules, commands, workspace docs, agent definitions)
• All non-JSON configuration files

What Gets Backed Up (Sanitized)

Only JSON config files are backed up:

File	Location	Sanitized?
opencode.json	~/.config/opencode/	✅ Yes
opencode.json	~/.opencode/ (if exists)	✅ Yes
openclaw.json	~/.openclaw/	✅ Yes
config.json	~/.config/clawhub/	✅ Yes

Everything else is excluded — no markdown files, no workspace docs, no agent configs, no plugin data.

📦 What's Included

Scripts

• backup.sh — Main backup script with sanitization
• restore.sh — Restore from backup with credential prompts
• lib/sanitize.sh — Shared sanitization library

Directory Structure After Backup

config_files/
├── backup.sh
├── restore.sh
├── lib/
│   └── sanitize.sh
├── config/                    # Created by backup.sh
│   ├── opencode/
│   │   ├── config.json       # Sanitized (~/.config/opencode/)
│   │   └── opencode-secondary.json  # Sanitized (~/.opencode/, if exists)
│   ├── openclaw/
│   │   └── config.json       # Sanitized (~/.openclaw/openclaw.json)
│   └── clawhub/
│       └── config.json       # Sanitized (~/.config/clawhub/)
├── .gitignore
└── README.md

🔧 Usage

Backup Options

# Show help
./backup.sh --help

# Dry run (test without changes)
./backup.sh --dry-run

# Verbose output
./backup.sh -v

# Combined
./backup.sh --dry-run -v

Restore Options

# Show help
./restore.sh --help

# Verbose restore
./restore.sh -v

# Force overwrite (no confirmation)
./restore.sh --force

# Skip credential prompts (edit manually later)
./restore.sh --skip-credentials

🔐 Credential Setup

By default, restore.sh will interactively prompt for ALL required API keys and tokens:

OpenCode Credentials

1. Context7 API Key (ctx7sk-...) — Context7 MCP service
2. Provider API Key (sk-...) — Model provider (e.g., KIT/scc.kit.edu)

OpenClaw Credentials

3. Model Provider API Key (sk-...) — Primary model endpoint
4. Telegram Bot Token (123456:ABC-...) — From @BotFather
5. Gateway Auth Token — Device communication authentication
6. Perplexity API Key (pplx-...) — Web search plugin

Clawhub Credentials

7. Clawhub Registry Token (clh_4_...) — Plugin registry access

Each prompt hides your input for security. Press Enter to skip any credential (you can edit files manually later, but features won't work).

To skip prompts entirely, use --skip-credentials.

🚀 Post-Restore Setup

The restore script will automatically prompt for all required credentials after restoring config files.

Interactive Credential Prompts

When you run ./restore.sh, you'll be prompted for each credential listed above.

Tips:

• Press Enter to skip any credential (edit file manually later)
• Input is hidden for security
• Skipped credentials remain as [REDACTED] in config files

Manual Entry (If Needed)

If you skipped credentials or prefer manual editing, edit these files:

~/.config/opencode/opencode.json:

{
  "mcp": {
    "context7": {
      "headers": {
        "CONTEXT7_API_KEY": "ctx7sk-YOUR_KEY_HERE"
      }
    }
  },
  "provider": {
    "KIT": {
      "options": {
        "apiKey": "sk-YOUR_KEY_HERE"
      }
    }
  }
}

~/.openclaw/openclaw.json:

{
  "models": {
    "providers": {
      "custom-ki-toolbox-scc-kit-edu": {
        "apiKey": "sk-YOUR_KEY_HERE"
      }
    }
  },
  "channels": {
    "telegram": {
      "botToken": "BOT_TOKEN_HERE"
    }
  },
  "gateway": {
    "auth": {
      "token": "GATEWAY_TOKEN_HERE"
    }
  },
  "plugins": {
    "entries": {
      "perplexity": {
        "config": {
          "webSearch": {
            "apiKey": "pplx-YOUR_KEY_HERE"
          }
        }
      }
    }
  }
}

~/.config/clawhub/config.json:

{
  "registry": "https://clawhub.ai",
  "token": "clh_4_YOUR_TOKEN_HERE"
}

Device Re-Pairing

After restoring credentials, re-pair your devices:

openclaw wizard

Or manually restore ~/.openclaw/identity/ from your secure encrypted backup.

🛡️ Security Verification

After backup, verify no secrets leaked:

# Scan for common secret patterns
grep -rE 'sk-[a-zA-Z0-9]+' config/
grep -rE 'ctx7sk-[a-zA-Z0-9-]+' config/
grep -rE 'clh_4_[a-zA-Z0-9-]+' config/
grep -rE 'pplx-[a-zA-Z0-9]+' config/
grep -rE '[0-9]{9}:[A-Za-z0-9_-]{35}' config/  # Telegram bot token

# Should return NO results

The backup script runs this verification automatically and will fail if secrets are detected.

➕ Adding Custom Exclusions

To exclude additional files:

Edit backup.sh

Add conditions to skip specific files:

if [ -f "$HOME_DIR/.config/opencode/custom.json" ]; then
    # Skip this file
    log_verbose "Excluding: ~/.config/opencode/custom.json"
fi

Add New Sanitization Patterns

Edit lib/sanitize.sh to add new secret patterns:

sanitize_customSecret() {
    local file="$1"
    sed -i -E 's/"customSecret"[[:space:]]*:[[:space:]]*"[^"]+"/"customSecret": "[REDACTED]"/g' "$file"
}

Then call it in the appropriate sanitization function.

🤝 Contributing

This project is designed for public sharing. Feel free to:

1. Fork and customize for your own setup
2. Submit improvements to sanitization patterns
3. Add support for additional config locations
4. Improve documentation

Development Workflow

# Test changes safely
./backup.sh --dry-run -v

# Verify sanitization
./backup.sh
grep -rE 'sk-' config/  # Should find nothing

# Restore to test
./restore.sh --force

📝 License

MIT License — Use freely, modify as needed, no warranty provided.

⚠️ Disclaimer

This tool is provided as-is. Always:

• Test backups before relying on them
• Keep separate encrypted backups of credentials
• Verify restored configs work in your environment
• Review sanitized files before committing to public repos

You are responsible for ensuring no secrets leak through your backups.