fix(diagnostics-otel): support preloaded sdk mode by vincentkoc · Pull Request #71450 · openclaw/openclaw

vincentkoc · 2026-04-25T06:52:26Z

Summary

support OPENCLAW_OTEL_PRELOADED=1 in diagnostics-otel so hosts with an existing global OpenTelemetry SDK do not get a second plugin-owned NodeSDK
keep OpenClaw diagnostic event listeners active in preloaded mode, including OTEL spans, metrics instruments, and log export wiring
document the preload mode and add regression coverage for trace gating when diagnostics.otel.traces is disabled

Extracted from the safe preloaded-SDK portion of #70424 without taking the direct agent-runtime span instrumentation, root dependency, Dockerfile, or preload script changes.

Validation

pnpm test extensions/diagnostics-otel/src/service.test.ts
git diff --check HEAD~1..HEAD

aisle-research-bot · 2026-04-25T06:52:39Z

🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

#	Severity	Title
1	🟡 Medium	Telemetry export policy bypass when `OPENCLAW_OTEL_PRELOADED=1` uses global OpenTelemetry providers

1. 🟡 Telemetry export policy bypass when `OPENCLAW_OTEL_PRELOADED=1` uses global OpenTelemetry providers

Property	Value
Severity	Medium
CWE	CWE-201
Location	`extensions/diagnostics-otel/src/service.ts:408-476`

Description

In diagnostics-otel service startup, setting OPENCLAW_OTEL_PRELOADED=1 causes the plugin to skip creating its own NodeSDK and OTLP trace/metric exporters, but it still emits spans/metrics via the global OpenTelemetry API providers.

Impact:

The configured diagnostics.otel.endpoint and diagnostics.otel.headers are not applied to traces/metrics in preloaded mode.
Any globally-registered/preloaded SDK (potentially attacker-controlled in an untrusted host/runtime, or misconfigured via preload hooks) can export OpenClaw telemetry to an arbitrary endpoint.
Telemetry can include sensitive attributes (e.g., provider/model metadata, trace context, and optionally content attributes when diagnostics.otel.captureContent is enabled), making this a potential data exfiltration vector.

Vulnerable behavior:

const sdkPreloaded = hasPreloadedOtelSdk();
...
if (!sdkPreloaded && (tracesEnabled || metricsEnabled)) {
  // configure OTLP exporters with endpoint/headers and start NodeSDK
} else if (sdkPreloaded && (tracesEnabled || metricsEnabled)) {
  ctx.logger.info("diagnostics-otel: using preloaded OpenTelemetry SDK");
}

const meter = metrics.getMeter("openclaw");
const tracer = trace.getTracer("openclaw");

Recommendation

Harden preloaded-SDK mode to prevent unintentional routing of telemetry to untrusted exporters:

Require an explicit config opt-in in addition to the env var (or instead of it), e.g. diagnostics.otel.allowPreloadedSdk: true.
When preloaded mode is enabled, emit a prominent warning that endpoint/headers/sampleRate are not enforced for traces/metrics.
Optionally, validate/allowlist exporter endpoints (when detectable) or disable sensitive content capture in preloaded mode unless explicitly re-enabled.

Example (gating by config):

const sdkPreloaded = process.env.OPENCLAW_OTEL_PRELOADED === "1";
const allowPreloaded = otel.allowPreloadedSdk === true;

if (sdkPreloaded && !allowPreloaded) {
  ctx.logger.warn("diagnostics-otel: preloaded SDK requested but not allowed by config");
  return;
}

Analyzed PR: #71450 at commit dad424c

_{Last updated on: 2026-04-25T06:54:16Z}

greptile-apps · 2026-04-25T06:54:57Z

Greptile Summary

This PR adds OPENCLAW_OTEL_PRELOADED=1 support to the diagnostics-otel plugin so that hosts with an existing global OpenTelemetry SDK can skip plugin-owned NodeSDK startup/shutdown while keeping all diagnostic event listeners (spans, metrics, logs) active. The implementation is clean: a hasPreloadedOtelSdk() guard wraps the NodeSDK construction block, the existing null-check in stopStarted naturally prevents SDK shutdown in preloaded mode, and the plugin-owned LoggerProvider is still created independently when logs is enabled.

Confidence Score: 4/5

PR is safe to merge; only a minor changelog attribution issue was found.

The implementation is correct and test coverage is thorough. The only finding is a P2 style issue: the CHANGELOG entry references the parent PR #70424 rather than this PR #71450.

CHANGELOG.md — wrong PR reference in the new entry.

Prompt To Fix All With AI

This is a comment left during a code review.
Path: CHANGELOG.md
Line: 9

Comment:
**Wrong PR reference in changelog entry**

The CHANGELOG entry credits `#70424` (the original parent PR) rather than this PR (`#71450`). Changelog entries should reference the PR that actually merges the change into the main branch; linking to the parent PR makes it harder to trace the merge history.

How can I resolve this? If you propose a fix, please make it concise.

_{Reviews (1): Last reviewed commit: "fix(diagnostics-otel): support preloaded..." | Re-trigger Greptile}

greptile-apps · 2026-04-25T06:55:01Z


 ### Changes

+- Diagnostics/OTEL: support `OPENCLAW_OTEL_PRELOADED=1` so the plugin can reuse an already-registered OpenTelemetry SDK while keeping OpenClaw diagnostic listeners wired. (#70424) Thanks @jlapenna.


Wrong PR reference in changelog entry

The CHANGELOG entry credits #70424 (the original parent PR) rather than this PR (#71450). Changelog entries should reference the PR that actually merges the change into the main branch; linking to the parent PR makes it harder to trace the merge history.

Prompt To Fix With AI

This is a comment left during a code review. Path: CHANGELOG.md Line: 9 Comment: **Wrong PR reference in changelog entry** The CHANGELOG entry credits `#70424` (the original parent PR) rather than this PR (`#71450`). Changelog entries should reference the PR that actually merges the change into the main branch; linking to the parent PR makes it harder to trace the merge history. How can I resolve this? If you propose a fix, please make it concise.

@vincentkoc

- Two Diagnostics/OTEL Changes entries credited issue #70424 (jlapenna's open meta-tracing proposal) as the PR ref. The actual implementing PRs landed as #71451 (exec-process telemetry) and #71450 (preloaded SDK mode), both authored by @vincentkoc — corrected. - Telegram/webhook fix had no Thanks credit. Issue #71392 reporter @joelforsberg46-source identified the delivery-retry behaviour, so credit them on the entry.

@vincentkoc

… tool-result pruning entries Three entries were missing co-credits I should have preserved: - Diagnostics/OTEL exec-process spans (#71451): @vincentkoc implemented, but @jlapenna's #70424 proposed the broader tracing work this entry builds on. Now credits both. - Diagnostics/OTEL preloaded SDK (#71450): same pattern — credits @vincentkoc and @jlapenna. - Agents/tool-result pruning (#51267): @cgdusek's PR explicitly built on prior work in #39331 by @alvinttang and #34980 by @coffeexcoin. Now credits all three.

@vincentkoc

- Two Diagnostics/OTEL Changes entries credited issue openclaw#70424 (jlapenna's open meta-tracing proposal) as the PR ref. The actual implementing PRs landed as openclaw#71451 (exec-process telemetry) and openclaw#71450 (preloaded SDK mode), both authored by @vincentkoc — corrected. - Telegram/webhook fix had no Thanks credit. Issue openclaw#71392 reporter @joelforsberg46-source identified the delivery-retry behaviour, so credit them on the entry.

@vincentkoc

… tool-result pruning entries Three entries were missing co-credits I should have preserved: - Diagnostics/OTEL exec-process spans (openclaw#71451): @vincentkoc implemented, but @jlapenna's openclaw#70424 proposed the broader tracing work this entry builds on. Now credits both. - Diagnostics/OTEL preloaded SDK (openclaw#71450): same pattern — credits @vincentkoc and @jlapenna. - Agents/tool-result pruning (openclaw#51267): @cgdusek's PR explicitly built on prior work in openclaw#39331 by @alvinttang and openclaw#34980 by @coffeexcoin. Now credits all three.

@vincentkoc

- Two Diagnostics/OTEL Changes entries credited issue openclaw#70424 (jlapenna's open meta-tracing proposal) as the PR ref. The actual implementing PRs landed as openclaw#71451 (exec-process telemetry) and openclaw#71450 (preloaded SDK mode), both authored by @vincentkoc — corrected. - Telegram/webhook fix had no Thanks credit. Issue openclaw#71392 reporter @joelforsberg46-source identified the delivery-retry behaviour, so credit them on the entry.

@vincentkoc

… tool-result pruning entries Three entries were missing co-credits I should have preserved: - Diagnostics/OTEL exec-process spans (openclaw#71451): @vincentkoc implemented, but @jlapenna's openclaw#70424 proposed the broader tracing work this entry builds on. Now credits both. - Diagnostics/OTEL preloaded SDK (openclaw#71450): same pattern — credits @vincentkoc and @jlapenna. - Agents/tool-result pruning (openclaw#51267): @cgdusek's PR explicitly built on prior work in openclaw#39331 by @alvinttang and openclaw#34980 by @coffeexcoin. Now credits all three.

@vincentkoc

- Two Diagnostics/OTEL Changes entries credited issue openclaw#70424 (jlapenna's open meta-tracing proposal) as the PR ref. The actual implementing PRs landed as openclaw#71451 (exec-process telemetry) and openclaw#71450 (preloaded SDK mode), both authored by @vincentkoc — corrected. - Telegram/webhook fix had no Thanks credit. Issue openclaw#71392 reporter @joelforsberg46-source identified the delivery-retry behaviour, so credit them on the entry.

@vincentkoc

… tool-result pruning entries Three entries were missing co-credits I should have preserved: - Diagnostics/OTEL exec-process spans (openclaw#71451): @vincentkoc implemented, but @jlapenna's openclaw#70424 proposed the broader tracing work this entry builds on. Now credits both. - Diagnostics/OTEL preloaded SDK (openclaw#71450): same pattern — credits @vincentkoc and @jlapenna. - Agents/tool-result pruning (openclaw#51267): @cgdusek's PR explicitly built on prior work in openclaw#39331 by @alvinttang and openclaw#34980 by @coffeexcoin. Now credits all three.

@vincentkoc

- Two Diagnostics/OTEL Changes entries credited issue openclaw#70424 (jlapenna's open meta-tracing proposal) as the PR ref. The actual implementing PRs landed as openclaw#71451 (exec-process telemetry) and openclaw#71450 (preloaded SDK mode), both authored by @vincentkoc — corrected. - Telegram/webhook fix had no Thanks credit. Issue openclaw#71392 reporter @joelforsberg46-source identified the delivery-retry behaviour, so credit them on the entry.

@vincentkoc

… tool-result pruning entries Three entries were missing co-credits I should have preserved: - Diagnostics/OTEL exec-process spans (openclaw#71451): @vincentkoc implemented, but @jlapenna's openclaw#70424 proposed the broader tracing work this entry builds on. Now credits both. - Diagnostics/OTEL preloaded SDK (openclaw#71450): same pattern — credits @vincentkoc and @jlapenna. - Agents/tool-result pruning (openclaw#51267): @cgdusek's PR explicitly built on prior work in openclaw#39331 by @alvinttang and openclaw#34980 by @coffeexcoin. Now credits all three.

@vincentkoc

- Two Diagnostics/OTEL Changes entries credited issue openclaw#70424 (jlapenna's open meta-tracing proposal) as the PR ref. The actual implementing PRs landed as openclaw#71451 (exec-process telemetry) and openclaw#71450 (preloaded SDK mode), both authored by @vincentkoc — corrected. - Telegram/webhook fix had no Thanks credit. Issue openclaw#71392 reporter @joelforsberg46-source identified the delivery-retry behaviour, so credit them on the entry.

@vincentkoc

… tool-result pruning entries Three entries were missing co-credits I should have preserved: - Diagnostics/OTEL exec-process spans (openclaw#71451): @vincentkoc implemented, but @jlapenna's openclaw#70424 proposed the broader tracing work this entry builds on. Now credits both. - Diagnostics/OTEL preloaded SDK (openclaw#71450): same pattern — credits @vincentkoc and @jlapenna. - Agents/tool-result pruning (openclaw#51267): @cgdusek's PR explicitly built on prior work in openclaw#39331 by @alvinttang and openclaw#34980 by @coffeexcoin. Now credits all three.

fix(diagnostics-otel): support preloaded sdk mode

dad424c

vincentkoc self-assigned this Apr 25, 2026

vincentkoc marked this pull request as ready for review April 25, 2026 06:52

openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime extensions: diagnostics-otel Extension: diagnostics-otel size: S maintainer Maintainer-authored PR labels Apr 25, 2026

greptile-apps Bot reviewed Apr 25, 2026

View reviewed changes

vincentkoc merged commit 56eb1ff into main Apr 25, 2026
94 of 97 checks passed

vincentkoc deleted the fix/otel-tracing-split branch April 25, 2026 06:55

github-actions Bot mentioned this pull request Apr 25, 2026

📡 Upstream Digest — 2026-04-25 07:04 UTC curtismercier/openclaw-mods#675

Open

steipete pushed a commit to MonkeyLeeT/openclaw that referenced this pull request Apr 25, 2026

fix(diagnostics-otel): support preloaded sdk mode (openclaw#71450)

7cde921

Angfr95 pushed a commit to Angfr95/openclaw that referenced this pull request Apr 25, 2026

fix(diagnostics-otel): support preloaded sdk mode (openclaw#71450)

dd10f4f

ayesha-aziz123 pushed a commit to ayesha-aziz123/openclaw that referenced this pull request Apr 26, 2026

fix(diagnostics-otel): support preloaded sdk mode (openclaw#71450)

e3c42d1

ogt-redknie pushed a commit to ogt-redknie/OPENX that referenced this pull request May 2, 2026

fix(diagnostics-otel): support preloaded sdk mode (openclaw#71450)

ed51996

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request May 9, 2026

fix(diagnostics-otel): support preloaded sdk mode (openclaw#71450)

a83ede2

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(diagnostics-otel): support preloaded sdk mode#71450

fix(diagnostics-otel): support preloaded sdk mode#71450
vincentkoc merged 1 commit intomainfrom
fix/otel-tracing-split

vincentkoc commented Apr 25, 2026

Uh oh!

aisle-research-bot Bot commented Apr 25, 2026 •

edited

Loading

Description

Recommendation

Uh oh!

greptile-apps Bot commented Apr 25, 2026

Uh oh!

greptile-apps Bot Apr 25, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant


		### Changes

		- Diagnostics/OTEL: support `OPENCLAW_OTEL_PRELOADED=1` so the plugin can reuse an already-registered OpenTelemetry SDK while keeping OpenClaw diagnostic listeners wired. (#70424) Thanks @jlapenna.

Uh oh!

Conversation

vincentkoc commented Apr 25, 2026

Summary

Validation

Uh oh!

aisle-research-bot Bot commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔒 Aisle Security Analysis

Description

Recommendation

Uh oh!

greptile-apps Bot commented Apr 25, 2026

Greptile Summary

Confidence Score: 4/5

Uh oh!

greptile-apps Bot Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

aisle-research-bot Bot commented Apr 25, 2026 •

edited

Loading