Severity: medium / Confidence: high / Category: bug
Triage: confirmed-bug
Detected against: openclaw v2026.5.18 (latest stable at time of scan, 2026-05-18)
Tooling: clawpatch 0.3.0 + acpx/claude-sonnet-4-5 via Brad Mills protocol

Evidence

• src/cli/root-option-value.ts:6-8 (takeCliRootOptionValue)

const [, value] = raw.split("=", 2);
    const trimmed = (value ?? "").trim();

Reasoning

Array destructuring with split("=", 2) limits the split result to 2 elements, so any characters after the second = in the raw token are silently discarded. For example, --token=abc=def yields value "abc" instead of "abc=def". API tokens and secrets frequently include base64-padding = characters; URLs with query parameters also contain =. The caller receives a silently corrupted value with no error or warning.

Reproduction

Pass any root option whose value contains =: e.g. openclaw --some-option=base64pad==. The resolved value will be "base64pad" instead of "base64pad==".

Recommendation

Replace raw.split("=", 2) with an index-based slice:

const eqIndex = raw.indexOf("=");
const value = raw.slice(eqIndex + 1);

This preserves all characters after the first =.

Why existing tests miss this

No tests are listed for src/cli/root-option-value.ts; the bug surface (option values with embedded =) is easy to overlook.

Suggested regression test

Add a Vitest test in a colocated root-option-value.test.ts that asserts takeCliRootOptionValue("--opt=abc=def", undefined).value === "abc=def" and likewise for base64 padding ("abc==").

Minimum fix scope

Single-line change in src/cli/root-option-value.ts replacing raw.split("=", 2) with index-slice logic.

Standardized clawpatch finding. Persistent in v2026.5.18 (not resolved by upgrading from v2026.5.12). Finding ID: fnd_sig-feat-cli-command-0c37e1d71a-_71ed7d37a6.