Description

The agent harness runtime can be sourced from process.env.OPENCLAW_AGENT_RUNTIME (or config) and is only .trim()’d in normalizeEmbeddedAgentRuntime, allowing arbitrary characters (including newlines/control characters).

When a non-registered runtime is forced and PI fallback is disabled, the runtime string is interpolated directly into a thrown error message:

• Input: OPENCLAW_AGENT_RUNTIME (environment) or config embeddedHarness.runtime
• No validation: normalizeEmbeddedAgentRuntime() returns the trimmed string as-is for plugin ids
• Sink: throw new Error(Requested agent harness "${runtime}" ...)

If the resulting Error message is later logged or printed (common in CLI/server error handlers), an attacker who can influence environment/config could inject newlines/CRLF into logs/telemetry, spoofing log entries or obscuring the true source of messages.

Vulnerable code:

if (policy.fallback === "none") {
  throw new Error(
    `Requested agent harness "${runtime}" is not registered and PI fallback is disabled.`,
  );
}

Recommendation

Constrain plugin runtime ids to a safe character set/length at normalization time (or before use in logs/errors) and reject invalid values.

For example:

const RUNTIME_ID_RE = /^[a-z0-9][a-z0-9_-]{0,63}$/i;

export function normalizeEmbeddedAgentRuntime(raw: string | undefined): EmbeddedAgentRuntime {
  const value = raw?.trim();
  if (!value) return "auto";
  if (value === "pi" || value === "auto") return value;
  if (!RUNTIME_ID_RE.test(value)) {
    throw new Error("Invalid agent runtime id");
  }
  return value;
}

Additionally, when embedding identifiers into human-readable log/error strings, consider escaping control characters (e.g., replacing \r/\n with visible sequences) to prevent log forging if an invalid value slips through.

Description

OPENCLAW_AGENT_HARNESS_FALLBACK is intended to control whether the system may fall back from a plugin harness to the built-in PI harness. However, unrecognized values are silently treated as if the override was not set.

Impact:

• If an operator attempts to disable PI fallback via OPENCLAW_AGENT_HARNESS_FALLBACK but provides an invalid value (typo, unexpected string), the override is ignored.
• In runtime: "auto" (or when config fallback is otherwise "pi"/defaulted), this can lead to unexpected fallback to PI, weakening the intended deployment isolation/controls.

Vulnerable behavior:

const raw = env.OPENCLAW_AGENT_HARNESS_FALLBACK?.trim().toLowerCase();
if (raw === "pi" || raw === "none") {
  return raw;
}
return undefined; // invalid values are ignored

This is a fail-open behavior from a security-policy perspective: invalid policy input results in default behavior (which may allow PI fallback) rather than a hard failure or explicit warning.

Recommendation

Treat an explicitly-provided but invalid OPENCLAW_AGENT_HARNESS_FALLBACK as a configuration error.

Options:

1. Fail fast (recommended for security-sensitive deployments):

export function resolveEmbeddedAgentHarnessFallback(
  env: NodeJS.ProcessEnv = process.env,
): EmbeddedAgentHarnessFallback | undefined {
  const raw = env.OPENCLAW_AGENT_HARNESS_FALLBACK;
  if (raw == null) return undefined;
  const normalized = raw.trim().toLowerCase();
  if (normalized === "pi" || normalized === "none") return normalized;
  throw new Error(
    `Invalid OPENCLAW_AGENT_HARNESS_FALLBACK=${JSON.stringify(raw)} (expected "pi" or "none")`,
  );
}

2. If backward compatibility requires non-throwing behavior, emit a high-visibility warning and consider defaulting to the safer option ("none") when the variable is set but invalid.