OpenClaw sandbox config hash treated order-only changes as unchanged
OpenClaw's sandbox configuration hash function incorrectly sorted primitive arrays, causing order-sensitive Docker settings to hash identically despite changed order. This prevented necessary sandbox container recreation when configuration order changed.
What happened
The normalizeForHash function in OpenClaw's sandbox configuration hash module recursively sorted arrays containing only primitive values. This caused order-sensitive sandbox configuration arrays to hash to the same value even when the order changed.
In OpenClaw sandbox flows, the hash is used to determine whether existing sandbox containers should be recreated. As a result, order-only configuration changes such as different Docker DNS and binds array order could be treated as unchanged, causing stale containers to be reused instead of being recreated.
Reported impact
Configuration integrity of sandbox container recreation behavior was affected. Order-sensitive settings in Docker configuration could fail to trigger necessary container recreation.
Index analysis
Array ordering is now preserved during hash normalization; only object key ordering remains normalized for deterministic hashing. The fix was released in version 2026.2.15, with affected versions at 2026.2.14 and earlier.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.