Confusion about how to modify `openclaw.json`

### Description

`nemoclaw v0.0.112-5-gc9515609e`

im trying to configure my openclaw agent in various ways which requires modifications to `/sandbox/.openclaw/openclaw.json`. I understand that the correct way to do this is through `nemoclaw sandbox config set --key --value `

but i can only get certain config values to take. for example:

## this works:

```
pjth010@epr-rd-nemo-d01:~/agent-exploration/openclaw-workspaces/eula-bot$ nemoclaw eula-bot config set --key plugins.entries.firecrawl.enabled --value true --config-accept-new-path
Reading openclaw config...
Agent: openclaw
Key: plugins.entries.firecrawl.enabled
Old value: (not set)
New value: true
Writing config to sandbox (/sandbox/.openclaw/openclaw.json)...
openclaw config updated.

Note: Some config changes require a sandbox restart to take effect.
Re-run with --restart or run: nemoclaw 'eula-bot' gateway restart

pjth010@epr-rd-nemo-d01:~/agent-exploration/openclaw-workspaces/eula-bot$ nemoclaw eula-bot config set --key tools.web.search.provider --value 'firecrawl' --config-accept-new-path
Reading openclaw config...
Agent: openclaw
Key: tools.web.search.provider
Old value: "[REDACTED_STRING]"
New value: "[REDACTED_STRING]"
Writing config to sandbox (/sandbox/.openclaw/openclaw.json)...
openclaw config updated.

Note: Some config changes require a sandbox restart to take effect.
Re-run with --restart or run: nemoclaw 'eula-bot' gateway restart
```

## This does not work:

```
pjth010@epr-rd-nemo-d01:~/agent-exploration/openclaw-workspaces/eula-bot$ nemoclaw eula-bot config set --key agents.defaults.thinkingDefault --value 'on'
Reading openclaw config...
Agent: openclaw
Key: agents.defaults.thinkingDefault
Old value: "[REDACTED_STRING]"
New value: "[REDACTED_STRING]"
OpenClaw config schema rejected the candidate at agents.defaults.thinkingDefault; existing config was not changed

pjth010@epr-rd-nemo-d01:~/agent-exploration/openclaw-workspaces/eula-bot$ nemoclaw eula-bot config set --key agents.defaults.fetch.contextPruning --value '{"mode": "cache-ttl"}' --config-accept-new-path
Reading openclaw config...
Agent: openclaw
Key: agents.defaults.fetch.contextPruning
Old value: (not set)
New value: {"mode":"[REDACTED_STRING]"}
OpenClaw config schema rejected the candidate at agents.defaults; existing config was not changed
```

I cant figure out why these are failing.. is it because nemoclaw is interpreting my modifications as containing an API Key which is a big no-no?

Im also not able to set this for a more clear reason:

```
pjth010@epr-rd-nemo-d01:~/agent-exploration/openclaw-workspaces/eula-bot$ nemoclaw eula-bot config set --key plugins.entries.firecrawl.config --value '{"webSearch":{"apiKey":"dummy","baseUrl":"http://11.20.132.56:3002"}}' --config-accept-new-path
Reading openclaw config...
Agent: openclaw
Key: plugins.entries.firecrawl.config
Old value: (not set)
New value: {"webSearch":{"apiKey":"[REDACTED]","baseUrl":"[REDACTED_URL]"}}
URL validation failed for http://11.20.132.56:3002/: URL pointsto private/internal address "11.20.132.56". This could expose internal services to the sandbox.
```

but what is the proper way to handle this? I need to be able to point openclaw towards an internally hosted Firecrawl service.

### Affected Page

_No response_

### Issue Type

Missing documentation

### Suggested Fix

clearer explanation for how to modify `/sandbox/.openclaw/openclaw.json` and any pitfalls associated with said modifications.

Start with the `nemoclaw config set` entry point, the `/sandbox/.openclaw/openclaw.json` configuration path, and the OpenClaw schema and URL validation behavior shown in the examples. Review existing NemoClaw configuration documentation, then document accepted value formats, schema rejection, redaction, restart requirements, and the handling of private or internal service URLs. Done means a user can determine why each example fails and where the supported procedure is explained.

Written by the indexing model from the issue text.