fix launcher can't save model api_key issue (#1928)

* fix launcher can't save model api_key issue

* add backup for old data before migrate config and fix migrate to empty
security issue

pkg/config/config.go

@@ -1350,11 +1350,14 @@ type MCPConfig struct {
 }
 
 func LoadConfig(path string) (*Config, error) {
+	logger.Debugf("loading config from %s", path)
 	data, err := os.ReadFile(path)
 	if err != nil {
 		if os.IsNotExist(err) {
+			logger.WarnF("config file not found, using default config", map[string]any{"path": path})
 			return DefaultConfig(), nil
 		}
+		logger.Errorf("failed to read config file: %v", err)
 		return nil, err
 	}
 
@@ -1366,6 +1369,7 @@ func LoadConfig(path string) (*Config, error) {
 		return nil, fmt.Errorf("failed to detect config version: %w", e)
 	}
 	if len(data) <= 10 {
+		logger.Warn(fmt.Sprintf("content is [%s]", string(data)))
 		return DefaultConfig().WithSecurity(&SecurityConfig{}), nil
 	}
 
@@ -1381,23 +1385,23 @@ func LoadConfig(path string) (*Config, error) {
 		}
 		cfg, e = v.Migrate()
 		if e != nil {
-			logger.DebugF("config migrate fail", map[string]any{"from": versionInfo.Version, "to": CurrentVersion})
+			logger.ErrorF("config migrate fail", map[string]any{"from": versionInfo.Version, "to": CurrentVersion})
 			return nil, e
 		}
-		logger.DebugF("config migrate success", map[string]any{"from": versionInfo.Version, "to": CurrentVersion})
+		logger.InfoF("config migrate success", map[string]any{"from": versionInfo.Version, "to": CurrentVersion})
-		defer func() {
+		err = makeBackup(path)
+		if err != nil {
+			return nil, err
+		}
+		defer func(cfg *Config) {
 			_ = SaveConfig(path, cfg)
-		}()
+		}(cfg)
 	case CurrentVersion:
 		// Current version
 		cfg, err = loadConfig(data)
 		if err != nil {
 			return nil, err
 		}
-	default:
-		return nil, fmt.Errorf("unsupported config version: %d", versionInfo.Version)
-	}
-
 		// Load security configuration
 		securityPath := securityPath(path)
 		sec, err := loadSecurityConfig(securityPath)
@@ -1410,6 +1414,9 @@ func LoadConfig(path string) (*Config, error) {
 		if err := applySecurityConfig(cfg, sec); err != nil {
 			return nil, fmt.Errorf("failed to apply security config: %w", err)
 		}
+	default:
+		return nil, fmt.Errorf("unsupported config version: %d", versionInfo.Version)
+	}
 
 	if passphrase := credential.PassphraseProvider(); passphrase != "" {
 		for _, m := range cfg.ModelList {
@@ -1462,6 +1469,19 @@ func LoadConfig(path string) (*Config, error) {
 	return cfg, nil
 }
 
+func makeBackup(path string) error {
+	if _, err := os.Stat(path); os.IsNotExist(err) {
+		return nil
+	}
+	// Create backup of the config file before migration
+	bakPath := path + ".bak"
+	if err := fileutil.CopyFile(path, bakPath, 0o600); err != nil {
+		logger.ErrorF("failed to create config backup", map[string]any{"error": err})
+		return fmt.Errorf("failed to create config backup: %w", err)
+	}
+	return nil
+}
+
 func copyArray[T any](dst, src *[]T) {
 	*dst = make([]T, len(*src))
 	copy(*dst, *src)
@@ -1474,6 +1494,7 @@ func applySecurityConfig(cfg *Config, sec *SecurityConfig) error {
 		return nil
 	}
 
+	if sec.Web != nil {
 		if sec.Web.Brave != nil && len(sec.Web.Brave.APIKeys) > 0 {
 			copyArray(&cfg.Tools.Web.Brave.apiKeys, &sec.Web.Brave.APIKeys)
 		}
@@ -1493,7 +1514,9 @@ func applySecurityConfig(cfg *Config, sec *SecurityConfig) error {
 		if sec.Web.BaiduSearch != nil && sec.Web.BaiduSearch.APIKey != "" {
 			cfg.Tools.Web.BaiduSearch.apiKey = sec.Web.BaiduSearch.APIKey
 		}
+	}
 
+	if sec.Skills != nil {
 		if sec.Skills.Github != nil && sec.Skills.Github.Token != "" {
 			cfg.Tools.Skills.Github.token = sec.Skills.Github.Token
 		}
@@ -1501,6 +1524,7 @@ func applySecurityConfig(cfg *Config, sec *SecurityConfig) error {
 		if sec.Skills.ClawHub != nil && sec.Skills.ClawHub.AuthToken != "" {
 			cfg.Tools.Skills.Registries.ClawHub.authToken = sec.Skills.ClawHub.AuthToken
 		}
+	}
 
 	names := toNameIndex(cfg.ModelList)
 	for i, model := range cfg.ModelList {
@@ -1521,6 +1545,7 @@ func applySecurityConfig(cfg *Config, sec *SecurityConfig) error {
 		}
 	}
 
+	if sec.Channels != nil {
 		// Handle Telegram token
 		if sec.Channels.Telegram != nil && sec.Channels.Telegram.Token != "" {
 			cfg.Channels.Telegram.token = sec.Channels.Telegram.Token
@@ -1642,6 +1667,7 @@ func applySecurityConfig(cfg *Config, sec *SecurityConfig) error {
 		if sec.Channels.QQ != nil && sec.Channels.QQ.AppSecret != "" {
 			cfg.Channels.QQ.appSecret = sec.Channels.QQ.AppSecret
 		}
+	}
 
 	cfg.security = sec
 

pkg/config/config_old.go

@@ -5,7 +5,9 @@
 
 package config
 
-import "encoding/json"
+import (
+	"encoding/json"
+)
 
 type agentDefaultsV0 struct {
 	Workspace                 string         `json:"workspace"                       env:"PICOCLAW_AGENTS_DEFAULTS_WORKSPACE"`
@@ -139,21 +141,21 @@ func (v *channelsConfigV0) ToChannelsConfig() (ChannelsConfig, ChannelsSecurity)
 			Pico:       pico,
 			IRC:        irc,
 		}, ChannelsSecurity{
-			Telegram:   &telegramSecurity,
+			Telegram:   telegramSecurity,
-			Feishu:     &feishuSecurity,
+			Feishu:     feishuSecurity,
-			Discord:    &discordSecurity,
+			Discord:    discordSecurity,
-			QQ:         &qqSecurity,
+			QQ:         qqSecurity,
-			Weixin:     &weixinSecurity,
+			Weixin:     weixinSecurity,
-			DingTalk:   &dingtalkSecurity,
+			DingTalk:   dingtalkSecurity,
-			Slack:      &slackSecurity,
+			Slack:      slackSecurity,
-			Matrix:     &matrixSecurity,
+			Matrix:     matrixSecurity,
-			LINE:       &lineSecurity,
+			LINE:       lineSecurity,
-			OneBot:     &onebotSecurity,
+			OneBot:     onebotSecurity,
-			WeCom:      &wecomSecurity,
+			WeCom:      wecomSecurity,
-			WeComApp:   &wecomappSecurity,
+			WeComApp:   wecomappSecurity,
-			WeComAIBot: &wecomaibotSecurity,
+			WeComAIBot: wecomaibotSecurity,
-			Pico:       &picoSecurity,
+			Pico:       picoSecurity,
-			IRC:        &ircSecurity,
+			IRC:        ircSecurity,
 		}
 }
 
@@ -169,7 +171,13 @@ type qqConfigV0 struct {
 	ReasoningChannelID   string              `json:"reasoning_channel_id"     env:"PICOCLAW_CHANNELS_QQ_REASONING_CHANNEL_ID"`
 }
 
-func (v *qqConfigV0) ToQQConfig() (QQConfig, QQSecurity) {
+func (v *qqConfigV0) ToQQConfig() (QQConfig, *QQSecurity) {
+	var sec *QQSecurity
+	if v.AppSecret != "" {
+		sec = &QQSecurity{
+			AppSecret: v.AppSecret,
+		}
+	}
 	return QQConfig{
 		Enabled:              v.Enabled,
 		AppID:                v.AppID,
@@ -179,9 +187,7 @@ func (v *qqConfigV0) ToQQConfig() (QQConfig, QQSecurity) {
 		MaxBase64FileSizeMiB: v.MaxBase64FileSizeMiB,
 		SendMarkdown:         v.SendMarkdown,
 		ReasoningChannelID:   v.ReasoningChannelID,
-		}, QQSecurity{
+	}, sec
-			AppSecret: v.AppSecret,
-		}
 }
 
 type telegramConfigV0 struct {
@@ -197,7 +203,13 @@ type telegramConfigV0 struct {
 	UseMarkdownV2      bool                `json:"use_markdown_v2"         env:"PICOCLAW_CHANNELS_TELEGRAM_USE_MARKDOWN_V2"`
 }
 
-func (v *telegramConfigV0) ToTelegramConfig() (TelegramConfig, TelegramSecurity) {
+func (v *telegramConfigV0) ToTelegramConfig() (TelegramConfig, *TelegramSecurity) {
+	var sec *TelegramSecurity
+	if v.Token != "" {
+		sec = &TelegramSecurity{
+			Token: v.Token,
+		}
+	}
 	return TelegramConfig{
 		Enabled:            v.Enabled,
 		token:              v.Token,
@@ -209,9 +221,7 @@ func (v *telegramConfigV0) ToTelegramConfig() (TelegramConfig, TelegramSecurity)
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
 		UseMarkdownV2:      v.UseMarkdownV2,
-		}, TelegramSecurity{
+	}, sec
-			Token: v.Token,
-		}
 }
 
 type feishuConfigV0 struct {
@@ -228,7 +238,15 @@ type feishuConfigV0 struct {
 	IsLark              bool                `json:"is_lark"                 env:"PICOCLAW_CHANNELS_FEISHU_IS_LARK"`
 }
 
-func (v *feishuConfigV0) ToFeishuConfig() (FeishuConfig, FeishuSecurity) {
+func (v *feishuConfigV0) ToFeishuConfig() (FeishuConfig, *FeishuSecurity) {
+	var sec *FeishuSecurity
+	if v.AppSecret != "" || v.EncryptKey != "" || v.VerificationToken != "" {
+		sec = &FeishuSecurity{
+			AppSecret:         v.AppSecret,
+			EncryptKey:        v.EncryptKey,
+			VerificationToken: v.VerificationToken,
+		}
+	}
 	return FeishuConfig{
 		Enabled:            v.Enabled,
 		AppID:              v.AppID,
@@ -237,11 +255,7 @@ func (v *feishuConfigV0) ToFeishuConfig() (FeishuConfig, FeishuSecurity) {
 		GroupTrigger:       v.GroupTrigger,
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, FeishuSecurity{
+	}, sec
-			AppSecret:         v.AppSecret,
-			EncryptKey:        v.EncryptKey,
-			VerificationToken: v.VerificationToken,
-		}
 }
 
 type discordConfigV0 struct {
@@ -256,7 +270,13 @@ type discordConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_DISCORD_REASONING_CHANNEL_ID"`
 }
 
-func (v *discordConfigV0) ToDiscordConfig() (DiscordConfig, DiscordSecurity) {
+func (v *discordConfigV0) ToDiscordConfig() (DiscordConfig, *DiscordSecurity) {
+	var sec *DiscordSecurity
+	if v.Token != "" {
+		sec = &DiscordSecurity{
+			Token: v.Token,
+		}
+	}
 	return DiscordConfig{
 		Enabled:            v.Enabled,
 		token:              v.Token,
@@ -267,9 +287,7 @@ func (v *discordConfigV0) ToDiscordConfig() (DiscordConfig, DiscordSecurity) {
 		Typing:             v.Typing,
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, DiscordSecurity{
+	}, sec
-			Token: v.Token,
-		}
 }
 
 type maixcamConfigV0 struct {
@@ -299,7 +317,13 @@ type dingtalkConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_DINGTALK_REASONING_CHANNEL_ID"`
 }
 
-func (v *dingtalkConfigV0) ToDingTalkConfig() (DingTalkConfig, DingTalkSecurity) {
+func (v *dingtalkConfigV0) ToDingTalkConfig() (DingTalkConfig, *DingTalkSecurity) {
+	var sec *DingTalkSecurity
+	if v.ClientSecret != "" {
+		sec = &DingTalkSecurity{
+			ClientSecret: v.ClientSecret,
+		}
+	}
 	return DingTalkConfig{
 		Enabled:            v.Enabled,
 		ClientID:           v.ClientID,
@@ -307,9 +331,7 @@ func (v *dingtalkConfigV0) ToDingTalkConfig() (DingTalkConfig, DingTalkSecurity)
 		AllowFrom:          v.AllowFrom,
 		GroupTrigger:       v.GroupTrigger,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, DingTalkSecurity{
+	}, sec
-			ClientSecret: v.ClientSecret,
-		}
 }
 
 type slackConfigV0 struct {
@@ -323,7 +345,14 @@ type slackConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_SLACK_REASONING_CHANNEL_ID"`
 }
 
-func (v *slackConfigV0) ToSlackConfig() (SlackConfig, SlackSecurity) {
+func (v *slackConfigV0) ToSlackConfig() (SlackConfig, *SlackSecurity) {
+	var sec *SlackSecurity
+	if v.BotToken != "" || v.AppToken != "" {
+		sec = &SlackSecurity{
+			BotToken: v.BotToken,
+			AppToken: v.AppToken,
+		}
+	}
 	return SlackConfig{
 		Enabled:            v.Enabled,
 		botToken:           v.BotToken,
@@ -333,10 +362,7 @@ func (v *slackConfigV0) ToSlackConfig() (SlackConfig, SlackSecurity) {
 		Typing:             v.Typing,
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, SlackSecurity{
+	}, sec
-			BotToken: v.BotToken,
-			AppToken: v.AppToken,
-		}
 }
 
 type matrixConfigV0 struct {
@@ -353,7 +379,13 @@ type matrixConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"     env:"PICOCLAW_CHANNELS_MATRIX_REASONING_CHANNEL_ID"`
 }
 
-func (v *matrixConfigV0) ToMatrixConfig() (MatrixConfig, MatrixSecurity) {
+func (v *matrixConfigV0) ToMatrixConfig() (MatrixConfig, *MatrixSecurity) {
+	var sec *MatrixSecurity
+	if v.AccessToken != "" {
+		sec = &MatrixSecurity{
+			AccessToken: v.AccessToken,
+		}
+	}
 	return MatrixConfig{
 		Enabled:            v.Enabled,
 		Homeserver:         v.Homeserver,
@@ -366,9 +398,7 @@ func (v *matrixConfigV0) ToMatrixConfig() (MatrixConfig, MatrixSecurity) {
 		GroupTrigger:       v.GroupTrigger,
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, MatrixSecurity{
+	}, sec
-			AccessToken: v.AccessToken,
-		}
 }
 
 type lineConfigV0 struct {
@@ -385,7 +415,14 @@ type lineConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_LINE_REASONING_CHANNEL_ID"`
 }
 
-func (v *lineConfigV0) ToLINEConfig() (LINEConfig, LINESecurity) {
+func (v *lineConfigV0) ToLINEConfig() (LINEConfig, *LINESecurity) {
+	var sec *LINESecurity
+	if v.ChannelSecret != "" || v.ChannelAccessToken != "" {
+		sec = &LINESecurity{
+			ChannelSecret:      v.ChannelSecret,
+			ChannelAccessToken: v.ChannelAccessToken,
+		}
+	}
 	return LINEConfig{
 		Enabled:            v.Enabled,
 		channelSecret:      v.ChannelSecret,
@@ -398,10 +435,7 @@ func (v *lineConfigV0) ToLINEConfig() (LINEConfig, LINESecurity) {
 		Typing:             v.Typing,
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, LINESecurity{
+	}, sec
-			ChannelSecret:      v.ChannelSecret,
-			ChannelAccessToken: v.ChannelAccessToken,
-		}
 }
 
 type onebotConfigV0 struct {
@@ -417,7 +451,13 @@ type onebotConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_ONEBOT_REASONING_CHANNEL_ID"`
 }
 
-func (v *onebotConfigV0) ToOneBotConfig() (OneBotConfig, OneBotSecurity) {
+func (v *onebotConfigV0) ToOneBotConfig() (OneBotConfig, *OneBotSecurity) {
+	var sec *OneBotSecurity
+	if v.AccessToken != "" {
+		sec = &OneBotSecurity{
+			AccessToken: v.AccessToken,
+		}
+	}
 	return OneBotConfig{
 		Enabled:            v.Enabled,
 		WSUrl:              v.WSUrl,
@@ -429,9 +469,7 @@ func (v *onebotConfigV0) ToOneBotConfig() (OneBotConfig, OneBotSecurity) {
 		Typing:             v.Typing,
 		Placeholder:        v.Placeholder,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, OneBotSecurity{
+	}, sec
-			AccessToken: v.AccessToken,
-		}
 }
 
 type wecomConfigV0 struct {
@@ -448,7 +486,14 @@ type wecomConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_WECOM_REASONING_CHANNEL_ID"`
 }
 
-func (v *wecomConfigV0) ToWeComConfig() (WeComConfig, WeComSecurity) {
+func (v *wecomConfigV0) ToWeComConfig() (WeComConfig, *WeComSecurity) {
+	var sec *WeComSecurity
+	if v.Token != "" || v.EncodingAESKey != "" {
+		sec = &WeComSecurity{
+			Token:          v.Token,
+			EncodingAESKey: v.EncodingAESKey,
+		}
+	}
 	return WeComConfig{
 		Enabled:            v.Enabled,
 		token:              v.Token,
@@ -461,10 +506,7 @@ func (v *wecomConfigV0) ToWeComConfig() (WeComConfig, WeComSecurity) {
 		ReplyTimeout:       v.ReplyTimeout,
 		GroupTrigger:       v.GroupTrigger,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, WeComSecurity{
+	}, sec
-			Token:          v.Token,
-			EncodingAESKey: v.EncodingAESKey,
-		}
 }
 
 type weixinConfigV0 struct {
@@ -477,7 +519,13 @@ type weixinConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WEIXIN_REASONING_CHANNEL_ID"`
 }
 
-func (v *weixinConfigV0) ToWeiXinConfig() (WeixinConfig, WeixinSecurity) {
+func (v *weixinConfigV0) ToWeiXinConfig() (WeixinConfig, *WeixinSecurity) {
+	var sec *WeixinSecurity
+	if v.Token != "" {
+		sec = &WeixinSecurity{
+			Token: v.Token,
+		}
+	}
 	return WeixinConfig{
 		Enabled:            v.Enabled,
 		token:              v.Token,
@@ -486,9 +534,7 @@ func (v *weixinConfigV0) ToWeiXinConfig() (WeixinConfig, WeixinSecurity) {
 		Proxy:              v.Proxy,
 		AllowFrom:          v.AllowFrom,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, WeixinSecurity{
+	}, sec
-			Token: v.Token,
-		}
 }
 
 type wecomappConfigV0 struct {
@@ -507,7 +553,15 @@ type wecomappConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_WECOM_APP_REASONING_CHANNEL_ID"`
 }
 
-func (v *wecomappConfigV0) ToWeComAppConfig() (WeComAppConfig, WeComAppSecurity) {
+func (v *wecomappConfigV0) ToWeComAppConfig() (WeComAppConfig, *WeComAppSecurity) {
+	var sec *WeComAppSecurity
+	if v.CorpSecret != "" || v.Token != "" || v.EncodingAESKey != "" {
+		sec = &WeComAppSecurity{
+			CorpSecret:     v.CorpSecret,
+			Token:          v.Token,
+			EncodingAESKey: v.EncodingAESKey,
+		}
+	}
 	return WeComAppConfig{
 		Enabled:            v.Enabled,
 		CorpID:             v.CorpID,
@@ -522,11 +576,7 @@ func (v *wecomappConfigV0) ToWeComAppConfig() (WeComAppConfig, WeComAppSecurity)
 		ReplyTimeout:       v.ReplyTimeout,
 		GroupTrigger:       v.GroupTrigger,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, WeComAppSecurity{
+	}, sec
-			CorpSecret:     v.CorpSecret,
-			Token:          v.Token,
-			EncodingAESKey: v.EncodingAESKey,
-		}
 }
 
 type wecomaibotConfigV0 struct {
@@ -542,7 +592,15 @@ type wecomaibotConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id" env:"PICOCLAW_CHANNELS_WECOM_AIBOT_REASONING_CHANNEL_ID"`
 }
 
-func (v *wecomaibotConfigV0) ToWeComAIBotConfig() (WeComAIBotConfig, WeComAIBotSecurity) {
+func (v *wecomaibotConfigV0) ToWeComAIBotConfig() (WeComAIBotConfig, *WeComAIBotSecurity) {
+	var sec *WeComAIBotSecurity
+	if v.Token != "" || v.Secret != "" || v.EncodingAESKey != "" {
+		sec = &WeComAIBotSecurity{
+			Token:          v.Token,
+			Secret:         v.Secret,
+			EncodingAESKey: v.EncodingAESKey,
+		}
+	}
 	return WeComAIBotConfig{
 		Enabled:            v.Enabled,
 		WebhookPath:        v.WebhookPath,
@@ -551,11 +609,7 @@ func (v *wecomaibotConfigV0) ToWeComAIBotConfig() (WeComAIBotConfig, WeComAIBotS
 		MaxSteps:           v.MaxSteps,
 		WelcomeMessage:     v.WelcomeMessage,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, WeComAIBotSecurity{
+	}, sec
-			Token:          v.Token,
-			Secret:         v.Secret,
-			EncodingAESKey: v.EncodingAESKey,
-		}
 }
 
 type picoConfigV0 struct {
@@ -571,7 +625,13 @@ type picoConfigV0 struct {
 	Placeholder     PlaceholderConfig   `json:"placeholder,omitempty"`
 }
 
-func (v *picoConfigV0) ToPicoConfig() (PicoConfig, PicoSecurity) {
+func (v *picoConfigV0) ToPicoConfig() (PicoConfig, *PicoSecurity) {
+	var sec *PicoSecurity
+	if v.Token != "" {
+		sec = &PicoSecurity{
+			Token: v.Token,
+		}
+	}
 	return PicoConfig{
 		Enabled:         v.Enabled,
 		token:           v.Token,
@@ -583,9 +643,7 @@ func (v *picoConfigV0) ToPicoConfig() (PicoConfig, PicoSecurity) {
 		MaxConnections:  v.MaxConnections,
 		AllowFrom:       v.AllowFrom,
 		Placeholder:     v.Placeholder,
-		}, PicoSecurity{
+	}, sec
-			Token: v.Token,
-		}
 }
 
 type ircConfigV0 struct {
@@ -607,7 +665,15 @@ type ircConfigV0 struct {
 	ReasoningChannelID string              `json:"reasoning_channel_id"    env:"PICOCLAW_CHANNELS_IRC_REASONING_CHANNEL_ID"`
 }
 
-func (v *ircConfigV0) ToIRCConfig() (IRCConfig, IRCSecurity) {
+func (v *ircConfigV0) ToIRCConfig() (IRCConfig, *IRCSecurity) {
+	var sec *IRCSecurity
+	if v.Password != "" || v.NickServPassword != "" || v.SASLPassword != "" {
+		sec = &IRCSecurity{
+			Password:         v.Password,
+			NickServPassword: v.NickServPassword,
+			SASLPassword:     v.SASLPassword,
+		}
+	}
 	return IRCConfig{
 		Enabled:            v.Enabled,
 		Server:             v.Server,
@@ -625,11 +691,7 @@ func (v *ircConfigV0) ToIRCConfig() (IRCConfig, IRCSecurity) {
 		GroupTrigger:       v.GroupTrigger,
 		Typing:             v.Typing,
 		ReasoningChannelID: v.ReasoningChannelID,
-		}, IRCSecurity{
+	}, sec
-			Password:         v.Password,
-			NickServPassword: v.NickServPassword,
-			SASLPassword:     v.SASLPassword,
-		}
 }
 
 type providersConfigV0 struct {
@@ -783,7 +845,7 @@ func (c *configV0) Migrate() (*Config, error) {
 	cfg.Tools.Web, secWeb = c.Tools.Web.ToWebToolsConfig()
 	cfg.Tools.Cron = c.Tools.Cron
 	cfg.Tools.Exec = c.Tools.Exec
-	var secSkills SkillsSecurity
+	var secSkills *SkillsSecurity
 	cfg.Tools.Skills, secSkills = c.Tools.Skills.ToSkillsToolsConfig()
 	cfg.Tools.MediaCleanup = c.Tools.MediaCleanup
 	cfg.Tools.MCP = c.Tools.MCP
@@ -835,16 +897,18 @@ func (c *configV0) Migrate() (*Config, error) {
 		for i, m := range c.ModelList {
 			// Merge APIKey and APIKeys, deduplicating
 			mergedKeys := MergeAPIKeys(m.APIKey, m.APIKeys)
+			if len(mergedKeys) > 0 {
 				secModels[names[i]] = ModelSecurityEntry{
 					APIKeys: mergedKeys,
 				}
 			}
 		}
+	}
 
 	cfg.WithSecurity(&SecurityConfig{
 		ModelList: secModels,
-		Channels:  secChannels,
+		Channels:  &secChannels,
-		Web:       secWeb,
+		Web:       &secWeb,
 		Skills:    secSkills,
 	})
 	cfg.Version = CurrentVersion
@@ -873,13 +937,17 @@ type braveConfigV0 struct {
 	MaxResults int      `json:"max_results" env:"PICOCLAW_TOOLS_WEB_BRAVE_MAX_RESULTS"`
 }
 
-func (v *braveConfigV0) ToBraveConfig() (BraveConfig, BraveSecurity) {
+func (v *braveConfigV0) ToBraveConfig() (BraveConfig, *BraveSecurity) {
+	var sec *BraveSecurity
+	if k := MergeAPIKeys(v.APIKey, v.APIKeys); len(k) > 0 {
+		sec = &BraveSecurity{
+			APIKeys: MergeAPIKeys(v.APIKey, v.APIKeys),
+		}
+	}
 	return BraveConfig{
 		Enabled:    v.Enabled,
 		MaxResults: v.MaxResults,
-		}, BraveSecurity{
+	}, sec
-			APIKeys: MergeAPIKeys(v.APIKey, v.APIKeys),
-		}
 }
 
 type tavilyConfigV0 struct {
@@ -890,14 +958,18 @@ type tavilyConfigV0 struct {
 	MaxResults int      `json:"max_results" env:"PICOCLAW_TOOLS_WEB_TAVILY_MAX_RESULTS"`
 }
 
-func (v *tavilyConfigV0) ToTavilyConfig() (TavilyConfig, TavilySecurity) {
+func (v *tavilyConfigV0) ToTavilyConfig() (TavilyConfig, *TavilySecurity) {
+	var sec *TavilySecurity
+	if k := MergeAPIKeys(v.APIKey, v.APIKeys); len(k) > 0 {
+		sec = &TavilySecurity{
+			APIKeys: k,
+		}
+	}
 	return TavilyConfig{
 		Enabled:    v.Enabled,
 		BaseURL:    v.BaseURL,
 		MaxResults: v.MaxResults,
-		}, TavilySecurity{
+	}, sec
-			APIKeys: MergeAPIKeys(v.APIKey, v.APIKeys),
-		}
 }
 
 type perplexityConfigV0 struct {
@@ -907,13 +979,17 @@ type perplexityConfigV0 struct {
 	MaxResults int      `json:"max_results" env:"PICOCLAW_TOOLS_WEB_PERPLEXITY_MAX_RESULTS"`
 }
 
-func (v *perplexityConfigV0) ToPerplexityConfig() (PerplexityConfig, PerplexitySecurity) {
+func (v *perplexityConfigV0) ToPerplexityConfig() (PerplexityConfig, *PerplexitySecurity) {
+	var sec *PerplexitySecurity
+	if k := MergeAPIKeys(v.APIKey, v.APIKeys); len(k) > 0 {
+		sec = &PerplexitySecurity{
+			APIKeys: k,
+		}
+	}
 	return PerplexityConfig{
 		Enabled:    v.Enabled,
 		MaxResults: v.MaxResults,
-		}, PerplexitySecurity{
+	}, sec
-			APIKeys: MergeAPIKeys(v.APIKey, v.APIKeys),
-		}
 }
 
 type glmSearchConfigV0 struct {
@@ -923,15 +999,19 @@ type glmSearchConfigV0 struct {
 	SearchEngine string `json:"search_engine" env:"PICOCLAW_TOOLS_WEB_GLM_SEARCH_ENGINE"`
 }
 
-func (v *glmSearchConfigV0) ToGLMSearchConfig() (GLMSearchConfig, GLMSearchSecurity) {
+func (v *glmSearchConfigV0) ToGLMSearchConfig() (GLMSearchConfig, *GLMSearchSecurity) {
+	var sec *GLMSearchSecurity
+	if v.APIKey != "" {
+		sec = &GLMSearchSecurity{
+			APIKey: v.APIKey,
+		}
+	}
 	return GLMSearchConfig{
 		Enabled:      v.Enabled,
 		apiKey:       v.APIKey,
 		BaseURL:      v.BaseURL,
 		SearchEngine: v.SearchEngine,
-		}, GLMSearchSecurity{
+	}, sec
-			APIKey: v.APIKey,
-		}
 }
 
 func (v *webToolsConfigV0) ToWebToolsConfig() (WebToolsConfig, WebToolsSecurity) {
@@ -954,10 +1034,10 @@ func (v *webToolsConfigV0) ToWebToolsConfig() (WebToolsConfig, WebToolsSecurity)
 			Format:               v.Format,
 			PrivateHostWhitelist: v.PrivateHostWhitelist,
 		}, WebToolsSecurity{
-			Brave:      &braveSecurity,
+			Brave:      braveSecurity,
-			Tavily:     &tavilySecurity,
+			Tavily:     tavilySecurity,
-			Perplexity: &perplexitySecurity,
+			Perplexity: perplexitySecurity,
-			GLMSearch:  &glmSearchSecurity,
+			GLMSearch:  glmSearchSecurity,
 		}
 }
 
@@ -981,16 +1061,20 @@ type clawHubRegistryConfigV0 struct {
 	SkillsPath string `json:"skills_path" env:"PICOCLAW_SKILLS_REGISTRIES_CLAWHUB_SKILLS_PATH"`
 }
 
-func (v *clawHubRegistryConfigV0) ToClawHubRegistryConfig() (ClawHubRegistryConfig, ClawHubSecurity) {
+func (v *clawHubRegistryConfigV0) ToClawHubRegistryConfig() (ClawHubRegistryConfig, *ClawHubSecurity) {
+	var sec *ClawHubSecurity
+	if v.AuthToken != "" {
+		sec = &ClawHubSecurity{
+			AuthToken: v.AuthToken,
+		}
+	}
 	return ClawHubRegistryConfig{
 		Enabled:    v.Enabled,
 		BaseURL:    v.BaseURL,
 		authToken:  v.AuthToken,
 		SearchPath: v.SearchPath,
 		SkillsPath: v.SkillsPath,
-		}, ClawHubSecurity{
+	}, sec
-			AuthToken: v.AuthToken,
-		}
 }
 
 type skillsGithubConfigV0 struct {
@@ -998,13 +1082,17 @@ type skillsGithubConfigV0 struct {
 	Proxy string `json:"proxy,omitempty" env:"PICOCLAW_TOOLS_SKILLS_GITHUB_PROXY"`
 }
 
-func (v *skillsGithubConfigV0) ToSkillsGithubConfig() (SkillsGithubConfig, GithubSecurity) {
+func (v *skillsGithubConfigV0) ToSkillsGithubConfig() (SkillsGithubConfig, *GithubSecurity) {
+	var sec *GithubSecurity
+	if v.Token != "" {
+		sec = &GithubSecurity{
+			Token: v.Token,
+		}
+	}
 	return SkillsGithubConfig{
 		token: v.Token,
 		Proxy: v.Proxy,
-		}, GithubSecurity{
+	}, sec
-			Token: v.Token,
-		}
 }
 
 func (v *skillsRegistriesConfigV0) ToSkillsRegistriesConfig() (SkillsRegistriesConfig, *ClawHubSecurity) {
@@ -1012,21 +1100,25 @@ func (v *skillsRegistriesConfigV0) ToSkillsRegistriesConfig() (SkillsRegistriesC
 
 	return SkillsRegistriesConfig{
 		ClawHub: clawHub,
-	}, &clawHubSecurity
+	}, clawHubSecurity
 }
 
-func (v *skillsToolsConfigV0) ToSkillsToolsConfig() (SkillsToolsConfig, SkillsSecurity) {
+func (v *skillsToolsConfigV0) ToSkillsToolsConfig() (SkillsToolsConfig, *SkillsSecurity) {
 	registries, registriesSecurity := v.Registries.ToSkillsRegistriesConfig()
 	github, githubSecurity := v.Github.ToSkillsGithubConfig()
 
+	var sec *SkillsSecurity
+	if githubSecurity != nil || registriesSecurity != nil {
+		sec = &SkillsSecurity{
+			Github:  githubSecurity,
+			ClawHub: registriesSecurity,
+		}
+	}
 	return SkillsToolsConfig{
 		ToolConfig:            v.ToolConfig,
 		Registries:            registries,
 		Github:                github,
 		MaxConcurrentSearches: v.MaxConcurrentSearches,
 		SearchCache:           v.SearchCache,
-		}, SkillsSecurity{
+	}, sec
-			Github:  &githubSecurity,
-			ClawHub: registriesSecurity,
-		}
 }

pkg/config/config_test.go

@@ -1364,7 +1364,7 @@ func TestFilterSensitiveData_AllTokenTypes(t *testing.T) {
 			"test-model": {APIKeys: []string{"sk-model-key-12345"}},
 		},
 		// Channel tokens
-		Channels: ChannelsSecurity{
+		Channels: &ChannelsSecurity{
 			Telegram: &TelegramSecurity{Token: "telegram-bot-token-abcdef"},
 			Discord:  &DiscordSecurity{Token: "discord-bot-token-xyz789"},
 			Slack:    &SlackSecurity{BotToken: "xoxb-slack-bot-token", AppToken: "xapp-slack-app-token"},
@@ -1382,7 +1382,7 @@ func TestFilterSensitiveData_AllTokenTypes(t *testing.T) {
 			},
 		},
 		// Web tool API keys
-		Web: WebToolsSecurity{
+		Web: &WebToolsSecurity{
 			Brave:       &BraveSecurity{APIKeys: []string{"brave-api-key"}},
 			Tavily:      &TavilySecurity{APIKeys: []string{"tavily-api-key"}},
 			Perplexity:  &PerplexitySecurity{APIKeys: []string{"perplexity-api-key"}},
@@ -1390,7 +1390,7 @@ func TestFilterSensitiveData_AllTokenTypes(t *testing.T) {
 			BaiduSearch: &BaiduSearchSecurity{APIKey: "baidu-search-key"},
 		},
 		// Skills tokens
-		Skills: SkillsSecurity{
+		Skills: &SkillsSecurity{
 			Github:  &GithubSecurity{Token: "github-token-xyz"},
 			ClawHub: &ClawHubSecurity{AuthToken: "clawhub-auth-token"},
 		},

pkg/config/defaults.go

@@ -539,8 +539,9 @@ func DefaultConfig() *Config {
 		},
 		security: &SecurityConfig{
 			ModelList: map[string]ModelSecurityEntry{},
-			Channels:  ChannelsSecurity{},
+			Channels:  &ChannelsSecurity{},
-			Web:       WebToolsSecurity{},
+			Web:       &WebToolsSecurity{},
+			Skills:    &SkillsSecurity{},
 		},
 	}
 }

pkg/config/security.go

@@ -34,10 +34,10 @@ type SecurityConfig struct {
 	ModelList map[string]ModelSecurityEntry `yaml:"model_list,omitempty"`
 
 	// Channel tokens/secrets
-	Channels ChannelsSecurity `yaml:"channels,omitempty"`
+	Channels *ChannelsSecurity `yaml:"channels,omitempty"`
 
-	Web    WebToolsSecurity `yaml:"web,omitempty"`
+	Web    *WebToolsSecurity `yaml:"web,omitempty"`
-	Skills SkillsSecurity   `yaml:"skills,omitempty"`
+	Skills *SkillsSecurity   `yaml:"skills,omitempty"`
 
 	// cache for sensitive values and compiled regex (computed once)
 	sensitiveCache *SensitiveDataCache

pkg/config/security_test.go

@@ -59,12 +59,12 @@ func TestSaveAndLoadSecurityConfig(t *testing.T) {
 				APIKeys: []string{"key1", "key2"},
 			},
 		},
-		Channels: ChannelsSecurity{
+		Channels: &ChannelsSecurity{
 			Telegram: &TelegramSecurity{
 				Token: "telegram-token",
 			},
 		},
-		Web: WebToolsSecurity{
+		Web: &WebToolsSecurity{
 			Brave: &BraveSecurity{
 				APIKeys: []string{"brave-api-key"},
 			},

pkg/fileutil/file.go

@@ -117,3 +117,11 @@ func WriteFileAtomic(path string, data []byte, perm os.FileMode) error {
 	cleanup = false
 	return nil
 }
+
+func CopyFile(src, dst string, perm os.FileMode) error {
+	data, err := os.ReadFile(src)
+	if err != nil {
+		return err
+	}
+	return WriteFileAtomic(dst, data, perm)
+}

web/backend/api/models.go

@@ -9,6 +9,7 @@ import (
 	"sync"
 
 	"github.com/sipeed/picoclaw/pkg/config"
+	"github.com/sipeed/picoclaw/pkg/logger"
 )
 
 // registerModelRoutes binds model list management endpoints to the ServeMux.
@@ -158,7 +159,12 @@ func (h *Handler) handleUpdateModel(w http.ResponseWriter, r *http.Request) {
 	}
 	defer r.Body.Close()
 
-	var mc config.ModelConfig
+	type custom struct {
+		config.ModelConfig
+		APIKey string `json:"api_key"`
+	}
+
+	var mc custom
 	if err = json.Unmarshal(body, &mc); err != nil {
 		http.Error(w, fmt.Sprintf("Invalid JSON: %v", err), http.StatusBadRequest)
 		return
@@ -182,14 +188,18 @@ func (h *Handler) handleUpdateModel(w http.ResponseWriter, r *http.Request) {
 
 	// Preserve the existing API key when the caller omits it (empty string).
 	// This lets the UI update api_base / proxy without clearing the stored secret.
-	if mc.APIKey() == "" {
+	if mc.APIKey == "" {
-		mc.SetAPIKey(cfg.ModelList[idx].APIKey())
+		mc.ModelConfig.SetAPIKey(cfg.ModelList[idx].APIKey())
+	} else {
+		mc.ModelConfig.SetAPIKey(mc.APIKey)
 	}
 	if mc.ExtraBody == nil {
 		mc.ExtraBody = cfg.ModelList[idx].ExtraBody
 	}
 
-	cfg.ModelList[idx] = &mc
+	cfg.ModelList[idx] = &mc.ModelConfig
+
+	logger.Debugf("update model config: %#v", mc.ModelConfig)
 
 	if err := config.SaveConfig(h.configPath, cfg); err != nil {
 		http.Error(w, fmt.Sprintf("Failed to save config: %v", err), http.StatusInternalServerError)