fix(doctor): warn when sandbox hides MCP tools by nxmxbbd · Pull Request #84699 · openclaw/openclaw

nxmxbbd · 2026-05-20T20:51:38Z

Summary

Problem: sandboxed agents could hide configured MCP server tools even though the MCP servers loaded successfully, and there was no clear openclaw doctor warning for the missing sandbox tool allow gate.
Solution: add a doctor warning when mcp.servers are configured but active sandbox tool policy does not allow bundle-mcp, group:plugins, or a matching server glob such as outlook__*.
What changed: mirror runtime sandbox policy fallback for per-agent partial overrides, preserve warnings when a separate agent intentionally denies MCP, polish warning grammar/source labels, and document sanitized server globs plus the current bundled-plugin/Claude .mcp.json diagnostic limitation.
What did NOT change (scope boundary): no sandbox defaults, provider serialization, MCP runtime behavior, runtime tool policy enforcement, or bundled-plugin/.mcp.json MCP discovery logic changed.

Motivation

Related to MCP server tools never reach outbound tools[] across 4.26 → 5.7 (cluster previously closed + locked as 'resolved') #80909: the reporter confirmed adding "bundle-mcp" to tools.sandbox.tools.alsoAllow made the real MCP tools visible again in sandboxed turns.
The failure mode is confusing because the MCP server can load successfully while the sandbox tool policy filters the provider-visible tool list before the request.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes MCP server tools never reach outbound tools[] across 4.26 → 5.7 (cluster previously closed + locked as 'resolved') #80909
This PR fixes a bug or regression

Real behavior proof

Behavior or issue addressed:

Sandboxed OpenClaw turns with configured mcp.servers now surface a doctor warning when the active sandbox tool allow gate would hide bundled MCP tools before provider requests.

Real environment tested:

Local OpenClaw checkout on branch fix/80909-sandbox-mcp-docs, rebased onto current upstream/main, using a temp state dir at /tmp/openclaw-80909-doctor-state and running the real pnpm openclaw doctor CLI.

Exact steps or command run after this patch:

OPENCLAW_STATE_DIR=/tmp/openclaw-80909-doctor-state pnpm openclaw doctor --non-interactive --no-workspace-suggestions

Evidence after fix:

Terminal capture from this branch, copied live output:

◇  Doctor warnings ───────────────────────────────────────────────────────╮
│                                                                         │
│  - mcp.servers defines 1 MCP server ("outlook"), but                    │
│    tools.sandbox.tools.alsoAllow does not include "bundle-mcp",         │
│    "group:plugins", or a matching "<server>__*" MCP tool pattern.       │
│    Sandboxed agents will filter bundled MCP tools before provider       │
│    requests. Add "bundle-mcp" to tools.sandbox.tools.alsoAllow (or use  │
│    "group:plugins" / server globs) if those MCP tools should be         │
│    visible; use tools.sandbox.tools.allow: [] only when you             │
│    intentionally want no sandbox allow gate.                            │
│                                                                         │
├─────────────────────────────────────────────────────────────────────────╯

The command exited 0. The run also printed unrelated local temp-state doctor findings such as missing UI assets, gateway auth/connect noise, and existing build warnings from bundled zod locale .d.cts files.

Observed result after fix:

openclaw doctor prints the targeted sandbox/MCP warning in the Doctor warnings panel instead of silently allowing the misconfiguration to pass.

What was not tested:

An end-to-end sandboxed provider turn against a live MCP server was not rerun in this checkout; the reporter's real setup already confirmed "bundle-mcp" fixes the missing provider-visible MCP tools. This PR also intentionally does not make doctor enumerate MCP servers loaded from bundled plugin manifests or Claude .mcp.json; the docs call that limitation out.

Before evidence (optional but encouraged):

Before the first fix commit, /tmp/openclaw-80909-red-check.mjs returned [] for the target config and failed because it expected the sandbox/MCP warning.

Root Cause (if applicable)

Root cause: sandbox tool policy is a second allow gate for sandboxed sessions. Configured MCP servers can load under bundle-mcp, but if tools.sandbox.tools lacks bundle-mcp, group:plugins, or a matching <server>__* pattern, those MCP tools are filtered before provider requests.
Missing detection / guardrail: openclaw doctor did not flag the configuration shape, so users could diagnose it as a provider serialization or MCP loading bug.
Contributing context: per-agent sandbox tool overrides fall back field-by-field at runtime, so the diagnostic must mirror that behavior to avoid false positives.

Regression Test Plan (if applicable)

Coverage level that should have caught this:
- Unit test
- Seam / integration test
- End-to-end test
- Existing coverage already sufficient
Target test or file: src/commands/doctor/shared/plugin-tool-allowlist-warnings.test.ts
Scenario the test should lock in: sandboxed mcp.servers warn when the active sandbox allow gate omits MCP/plugin entries, do not warn for bundle-mcp, group:plugins, server globs, or explicit allow-all, and do not false-positive on per-agent partial override fallback.
Why this is the smallest reliable guardrail: the warning helper owns the exact doctor warning logic and can exercise the sandbox policy combinations without a full gateway runtime.
Existing test that already covers this (if any): none for the new sandbox/MCP warning path before this branch.
If no new test is added, why not: N/A.

User-visible / Behavior Changes

openclaw doctor can now warn when sandbox policy is likely hiding configured MCP server tools from sandboxed agents. Docs now clarify which sandbox allow entries expose MCP/plugin tools, how sanitized server globs are formed, and that bundled-plugin/Claude .mcp.json MCP sources use the same gate but are not enumerated by this diagnostic yet.

Diagram (if applicable)

Before:
mcp.servers loads -> sandboxed session tool gate omits bundle-mcp -> provider sees no MCP tools -> doctor has no targeted warning

After:
mcp.servers loads -> doctor compares active sandbox allow policy -> warning explains bundle-mcp / group:plugins / server glob fix

Security Impact (required)

New permissions/capabilities? No
Secrets/tokens handling changed? No
New/changed network calls? No
Command/tool execution surface changed? No
Data access scope changed? No
If any Yes, explain risk + mitigation: N/A.

Repro + Verification

Environment

OS: Linux container/dev host
Runtime/container: local OpenClaw checkout with pnpm/node toolchain
Model/provider: N/A for doctor helper/unit coverage
Integration/channel (if any): configured MCP server shape from MCP server tools never reach outbound tools[] across 4.26 → 5.7 (cluster previously closed + locked as 'resolved') #80909
Relevant config (redacted): temp OPENCLAW_STATE_DIR=/tmp/openclaw-80909-doctor-state with sandbox mode enabled and mcp.servers.outlook configured

Steps

Run focused warning helper unit tests.
Run the original red repro script and verify it emits the target warning.
Run the fallback repro script and verify it emits [].
Run TS/docs format checks and docs MDX validation.
Run real openclaw doctor against the temp state dir and inspect the Doctor warnings panel.

Expected

Missing sandbox MCP allow entries produce the targeted warning.
Explicit MCP allow entries and runtime fallback-compatible configs do not warn.
Docs and formatting checks pass.

Actual

pnpm test:unit:fast -- src/commands/doctor/shared/plugin-tool-allowlist-warnings.test.ts -> 19 tests passed.
node --import tsx /tmp/openclaw-80909-red-check.mjs -> emitted the target warning.
node --import tsx /tmp/openclaw-80909-agent-fallback-red.mjs -> printed [].
pnpm exec oxfmt --check src/commands/doctor/shared/plugin-tool-allowlist-warnings.ts src/commands/doctor/shared/plugin-tool-allowlist-warnings.test.ts -> all matched files formatted.
pnpm format:docs:check -- docs/gateway/config-tools.md docs/gateway/sandbox-vs-tool-policy-vs-elevated.md -> docs formatting clean.
pnpm docs:check-mdx -> passed.
pnpm tsgo:core:test -> passed.
OPENCLAW_STATE_DIR=/tmp/openclaw-80909-doctor-state pnpm openclaw doctor --non-interactive --no-workspace-suggestions -> printed the target Doctor warnings panel and exited 0.

Evidence

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

What I personally verified (not just CI), and how:

Verified scenarios: missing sandbox MCP allow entry warning, bundle-mcp, group:plugins, server glob, explicit allow-all, sandbox off, per-agent fallback inheritance, intentional deny preserving global warning, sanitized server-name glob.
Edge cases checked: multi-source warning grammar, unset sandbox allowlist source label, sanitized mcp.servers["Outlook Graph"] prefix, docs for bundled-plugin/Claude .mcp.json diagnostic limitation.
What I did not verify: end-to-end sandboxed provider turn against a live MCP server after this local patch; bundled-plugin manifest or .mcp.json MCP discovery expansion, intentionally out of scope.

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

Backward compatible? Yes
Config/env changes? No
Migration needed? No
If yes, exact upgrade steps: N/A.

Risks and Mitigations

Risk: doctor warning could false-positive if it diverges from runtime sandbox tool policy fallback.
- Mitigation: helper now mirrors allow, alsoAllow, and deny fallback field-by-field, with focused regression tests for partial overrides and intentional deny behavior.
Risk: users with server names containing spaces/non-provider-safe characters could use the raw config key in a server glob.
- Mitigation: docs now state server globs use the sanitized provider-safe server prefix and tests cover "Outlook Graph" -> outlook-graph__*.
Risk: users might expect this diagnostic to cover all MCP sources.
- Mitigation: docs explicitly state bundled-plugin manifests and Claude .mcp.json MCP servers use the same sandbox gate but are not enumerated by this diagnostic yet.

AI assistance disclosure

This patch and PR draft were prepared with AI assistance and locally verified before submission.

clawsweeper · 2026-05-20T20:53:00Z

Codex review: needs maintainer review before merge.

Workflow note: Future ClawSweeper reviews update this same comment in place.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Summary
The PR adds openclaw doctor warnings, tests, and docs for mcp.servers configurations whose active sandbox tool allow policy hides bundle-mcp or plugin-owned tools.

Reproducibility: yes. source-reproducible rather than independently rerun: runtime code shows sandbox tool policy filters bundled MCP/plugin tools unless bundle-mcp, group:plugins, a matching tool pattern, or allow-all is present. The linked issue also has real-user confirmation that adding bundle-mcp restores provider-visible MCP tools.

PR rating
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Summary: Focused, well-scoped diagnostic PR with source-aligned tests and sufficient real CLI proof, with no blocking findings found in read-only review.

Rank-up moves:

none

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Real behavior proof
Sufficient (live_output): The PR body includes copied live output from a real openclaw doctor run after the patch showing the new sandbox/MCP warning and exit status 0.

Next step before merge
No repair lane is needed because the PR has no blocking review findings; remaining action is normal maintainer review, CI, and merge decision.

Security
Cleared: The patch adds static doctor diagnostics, tests, and docs; it does not add dependencies, CI changes, network calls, secret handling, or new execution paths.

Review details

Best possible solution:

Review and land this PR after normal CI; the linked issue should close only after the diagnostic/docs fix merges.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible rather than independently rerun: runtime code shows sandbox tool policy filters bundled MCP/plugin tools unless bundle-mcp, group:plugins, a matching tool pattern, or allow-all is present. The linked issue also has real-user confirmation that adding bundle-mcp restores provider-visible MCP tools.

Is this the best way to solve the issue?

Yes, this is the best narrow fix for the confirmed root cause: it adds a targeted doctor warning and docs without changing sandbox defaults, provider serialization, or MCP runtime behavior.

Label changes:

add P2: This is a focused user-facing doctor/docs fix for a confusing MCP sandbox configuration failure with limited blast radius.
add proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes copied live output from a real openclaw doctor run after the patch showing the new sandbox/MCP warning and exit status 0.
add rating: 🐚 platinum hermit: Current PR rating is 🐚 platinum hermit because proof is 🐚 platinum hermit, patch quality is 🐚 platinum hermit, and Focused, well-scoped diagnostic PR with source-aligned tests and sufficient real CLI proof, with no blocking findings found in read-only review.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes copied live output from a real openclaw doctor run after the patch showing the new sandbox/MCP warning and exit status 0.

Label justifications:

P2: This is a focused user-facing doctor/docs fix for a confusing MCP sandbox configuration failure with limited blast radius.
rating: 🐚 platinum hermit: Current PR rating is 🐚 platinum hermit because proof is 🐚 platinum hermit, patch quality is 🐚 platinum hermit, and Focused, well-scoped diagnostic PR with source-aligned tests and sufficient real CLI proof, with no blocking findings found in read-only review.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes copied live output from a real openclaw doctor run after the patch showing the new sandbox/MCP warning and exit status 0.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes copied live output from a real openclaw doctor run after the patch showing the new sandbox/MCP warning and exit status 0.

What I checked:

Related issue confirmation: The linked issue discussion includes a real 2026.5.18 confirmation that adding bundle-mcp to tools.sandbox.tools.alsoAllow restored MCP tools in the provider request and enabled a first successful tool round trip.
Current main docs gap: Current main documents core tool groups through group:openclaw but does not document group:plugins or the sandbox/MCP allow gate that the PR adds. Public docs: docs/gateway/config-tools.md. (docs/gateway/config-tools.md:45, 9e4eca00ff0f)
Runtime sandbox allow behavior: The sandbox resolver preserves allow: [] as allow-all, otherwise defaults to DEFAULT_TOOL_ALLOW plus alsoAllow; that default list excludes bundle-mcp, so configured MCP tools are filtered unless explicitly allowed. (src/agents/sandbox/tool-policy.ts:95, 9e4eca00ff0f)
Runtime policy application: The embedded Pi effective-tool pipeline applies params.sandboxToolPolicy to bundled tools after profile/global policy, matching the reported layer where MCP/plugin tools disappear. (src/agents/pi-embedded-runner/effective-tool-policy.ts:178, 9e4eca00ff0f)
PR implementation: The PR adds collectSandboxMcpAllowlistWarnings, checks configured mcp.servers, active sandbox modes, effective sandbox policy fields, bundle-mcp, group:plugins, and sanitized server globs, then keeps existing plugin allowlist warnings intact. (src/commands/doctor/shared/plugin-tool-allowlist-warnings.ts:329, e0290ceac5e0)
PR regression coverage: The PR adds focused tests for missing sandbox MCP allows, unset labels, plural grammar, bundle-mcp, group:plugins, server globs, sanitized server names, allow-all, sandbox-off, per-agent fallback, and intentional deny behavior. (src/commands/doctor/shared/plugin-tool-allowlist-warnings.test.ts:91, e0290ceac5e0)

Likely related people:

Ayaan Zaidi: Blame and file history show the current doctor allowlist warning helper, touched docs, and sandbox policy files in the current checkout originate from d41f595. (role: introduced current diagnostic surface; confidence: high; commits: d41f595c752d; files: src/commands/doctor/shared/plugin-tool-allowlist-warnings.ts, src/commands/doctor/shared/plugin-tool-allowlist-warnings.test.ts, docs/gateway/config-tools.md)
Peter Steinberger: History for resolveSandboxToolPolicyForAgent and adjacent sandbox inspector/refactor work includes multiple commits by Peter Steinberger on the sandbox policy area that this PR mirrors. (role: sandbox policy history contributor; confidence: medium; commits: a185ca283a74, bfada9e42551, bcbfb357bec7; files: src/agents/sandbox/tool-policy.ts, src/agents/sandbox/runtime-status.ts)
Vincent Koc: Local history shows Vincent Koc authored the embedded Pi bundle-MCP landing that made configured MCP tools part of the affected tool materialization path. (role: embedded Pi bundle-MCP feature introducer; confidence: medium; commits: 06459ca0dfba; files: src/agents/embedded-pi-mcp.ts, src/agents/pi-embedded-runner/run/attempt.ts)

Codex review notes: model gpt-5.5, reasoning high; reviewed against 9e4eca00ff0f.

clawsweeper · 2026-05-20T21:00:35Z

ClawSweeper PR egg

✨ Hatched: 🥚 common Cosmic Signal Puff

Hatch command

Comment @clawsweeper hatch when this PR is hatchable.

Hatchability rules:

Merged PRs are hatchable.
Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

Rarity: 🥚 common.
Trait: guards the happy path.
Image traits: location flaky test forest; accessory commit compass; palette amber, ink, and glacier blue; mood calm; pose leaning over a miniature review desk; shell matte ceramic shell; lighting cool dashboard glow; background tiny artifact crates.
Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Cosmic Signal Puff in ClawSweeper.

What is this egg doing here?

Eggs appear after the PR passes real-behavior proof. It is here for vibes, not verdicts: it does not change labels, ratings, merge decisions, or automation.
The shell reacts to review momentum: open follow-up work warms it up, re-review makes it wobble, and a clean final review lets it hatch.
Hatchability usually comes from sufficient real-behavior proof, no blocking P0/P1/P2 findings, no security attention needed, and clean correctness. A merged PR is already final, so merge makes the egg hatchable independently.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

Takhoffman · 2026-05-21T00:05:14Z

@clawsweeper automerge

clawsweeper · 2026-05-21T00:07:25Z

🦞🔧
ClawSweeper automerge is enabled.

Head: e0290ceac5e0
Label: clawsweeper:automerge
Action: repair worker queued. Run: https://github.com/openclaw/clawsweeper/actions/runs/26197309245
Flow: review this head, repair/rebase only if needed, then re-review the exact repaired head before merge.

Draft PRs stay fix-only until GitHub marks them ready for review. Pause with /clawsweeper stop.

Automerge progress:

2026-05-21 00:05:14 UTC review queued e0290ceac5e0 (queued)

2026-05-21 00:07:24 UTC repair queued e0290ceac5e0 (autonomous) Run: https://github.com/openclaw/clawsweeper/actions/runs/26197309245

2026-05-21 00:10:28 UTC repair started (running) in 1s Run: https://github.com/openclaw/clawsweeper/actions/runs/26197309245 automerge-openclaw-openclaw-84699

2026-05-21 00:10:42 UTC validation plan (passed) in 15s Run: https://github.com/openclaw/clawsweeper/actions/runs/26197309245 pnpm check:changed; pnpm lint; pnpm check:test-types

2026-05-21 00:10:53 UTC Codex write preflight (passed) in 25s Run: https://github.com/openclaw/clawsweeper/actions/runs/26197309245 danger-full-access

2026-05-21 00:16:53 UTC Codex edit 1 3e6f302ff206 (complete) in 6m 25s Run: https://github.com/openclaw/clawsweeper/actions/runs/26197309245 exit 0

2026-05-21 00:28:43 UTC validation and review 1 21051c13abf2 (base moved) in 18m 15s Run: https://github.com/openclaw/clawsweeper/actions/runs/26197309245 rebased

2026-05-21 00:29:31 UTC repair finished 21051c13abf2 (opened) in 19m 3s Run: https://github.com/openclaw/clawsweeper/actions/runs/26197309245 open_fix_pr

clawsweeper · 2026-05-21T00:29:29Z

ClawSweeper 🐠 reef update

Thanks for the work on this. ClawSweeper opened a replacement PR only because the source branch was not writable from the available bot permissions. branch tides, not contributor blame.

Why replacement: ClawSweeper could not update the source PR branch directly; GitHub did not grant sufficient push rights to the bot for that branch.
Replacement PR: #84742
Why close: this run explicitly closes the superseded source PR after the credited replacement PR is open, so review continues in one place.
Closing this one because the run was configured to close superseded source PRs after opening the replacement.
The original contribution stays credited in the replacement PR context.
Co-author credit kept:

@nxmxbbd: Co-authored-by: David 32288+nxmxbbd@users.noreply.github.com

fish notes: model gpt-5.5, reasoning high; reviewed against 21051c1.

…026.5.20) (#615) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.5.19` → `2026.5.20` | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/567) for more information. --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.5.20`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#2026520) [Compare Source](openclaw/openclaw@v2026.5.19...v2026.5.20) ##### Changes - Exec approvals: remove the old `cat SKILL.md && printf ... && <skill-wrapper>` allowlist compatibility path so skill files must be loaded with the read tool and only the real skill executable is auto-allowed. - Discord: let voice sessions follow configured Discord users into voice channels, with allowed-channel checks, multi-user handoff, bounded reconciliation, and DAVE recovery preservation. ([#84264](openclaw/openclaw#84264)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Discord/voice: include bounded `IDENTITY.md`, `USER.md`, and `SOUL.md` profile context in realtime voice session instructions by default, with `voice.realtime.bootstrapContextFiles: []` available to disable it. ([#84499](openclaw/openclaw#84499)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Dependencies: bump the bundled Codex harness to `@openai/codex` `0.132.0` and refresh the app-server model-list docs for the new catalog. - CLI/policy: add the bundled Policy plugin for policy-backed channel conformance checks, doctor lint findings, and opt-in workspace repair. ([#80407](openclaw/openclaw#80407)) Thanks [@giodl73-repo](https://github.com/giodl73-repo). - Agents/config: allow `agents.list[].experimental.localModelLean` so lean local-model mode can be enabled for one configured agent instead of globally. - Providers/xAI: add device-code OAuth login so remote and headless setups can authorize xAI without a localhost browser callback. ([#84005](openclaw/openclaw#84005)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Providers/OpenRouter: honor provider-level `params.provider` routing policy for OpenRouter requests, with model and agent params overriding the defaults. Thanks [@amknight](https://github.com/amknight). ##### Fixes - CLI/tasks: include stale-running task maintenance decisions in `openclaw tasks maintenance --json` so retained and reconcile candidates explain backing-session, cron, CLI, and wedged-subagent state. ([#84691](openclaw/openclaw#84691)) Thanks [@efpiva](https://github.com/efpiva). - Codex app-server: keep system-prompt reports working when bootstrap hooks provide workspace files with only a path and content, so hook-supplied SOUL/IDENTITY/TOOLS/USER context still reports injected characters correctly. ([#84736](openclaw/openclaw#84736)) Thanks [@JARVIS-Glasses](https://github.com/JARVIS-Glasses). - Providers/MiniMax music: stop advertising `durationSeconds` control and remove prompt-injected duration hints, so `music_generate` reports MiniMax duration as an unsupported override instead of suggesting MiniMax can enforce track length. Fixes [#84508](openclaw/openclaw#84508). Thanks [@neeravmakwana](https://github.com/neeravmakwana). - Doctor: warn when sandbox tool policy hides configured MCP server tools before provider requests. ([#84699](openclaw/openclaw#84699)) Thanks [@nxmxbbd](https://github.com/nxmxbbd). - WhatsApp: update Baileys to `7.0.0-rc12`. - Build: suppress per-locale `rolldown-plugin-dts:fake-js` CommonJS dts warnings emitted while bundling the intentionally-inlined `zod/v4/locales/*.d.cts` files, so `pnpm build` output stays readable after the 0.25.1 plugin bump. Thanks [@romneyda](https://github.com/romneyda). - CLI/nodes: route lazy plugin-registration logs to stderr for JSON-mode `openclaw nodes` commands so stdout stays parseable. ([#84684](openclaw/openclaw#84684)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Approvals: route manual `/approve` decisions through the trusted approval runtime so active exec and plugin approvals no longer look unknown or expired. - Mac app: update the About settings copyright year to 2026. ([#84385](openclaw/openclaw#84385)) Thanks [@pejmanjohn](https://github.com/pejmanjohn). - Dependencies: update `@openclaw/fs-safe` to `0.2.7` so OpenClaw's default Python-helper-off policy keeps best-effort Node write fallbacks for private stores, secret writes, run logs, and media attachments on Linux/macOS. - Infra/secrets: restore the fail-closed contract for `tryReadSecretFileSync` so credential loaders that pass `rejectSymlink: true` (Telegram, LINE, Zalo, IRC, Nextcloud Talk tokens) refuse symlinked credential files instead of silently accepting them, and the infra-state CI shard's secret-file symlink test passes again. Thanks [@romneyda](https://github.com/romneyda). - Browser: honor the configured image sanitization limit for screenshots and labeled snapshots so browser-captured images follow the same resize policy as other image results. ([#84595](openclaw/openclaw#84595)) - Doctor: remove unrecognized `models.providers.*.models[*].compat.thinkingFormat` values during `doctor --fix` so stale provider model config can validate after upgrade. Fixes [#77803](openclaw/openclaw#77803). - Doctor: warn when `openclaw.json` stores plaintext secret-bearing config fields, including model provider API keys and sensitive provider headers. ([#84718](openclaw/openclaw#84718)) Thanks [@lukaIvanic](https://github.com/lukaIvanic). - Status: show the configured default, session-selected model, reason, clear hint, and docs link when a session remains pinned to a model that differs from `agents.defaults.model.primary`. - WebChat: clear stale typing indicators when session change events mark the active chat run complete. - Mac app: keep local packaging signed with a stable app identity for permission testing and fix Control UI production builds under current Vite/Highlight.js exports. - macOS app: update the embedded Peekaboo bridge to 3.2.1 so OpenClaw-hosted UI automation works with current Peekaboo CLI capture flows. - Cron: deliver preferred final assistant output for successful scheduled runs when trailing plain tool warnings remain in diagnostics instead of marking the run failed. - fix(mattermost): fail closed on missing channel type \[AI]. ([#84091](openclaw/openclaw#84091)) Thanks [@pgondhi987](https://github.com/pgondhi987). - Recheck rebuilt system.run argv \[AI]. ([#84090](openclaw/openclaw#84090)) Thanks [@pgondhi987](https://github.com/pgondhi987). - CLI: keep the private QA subcommand out of exported command descriptors unless `OPENCLAW_ENABLE_PRIVATE_QA_CLI=1`, so root help and subcommand markers match runtime registration. ([#84519](openclaw/openclaw#84519)) - CLI/cron: bound `openclaw cron show` job lookup pagination so non-advancing or unbounded `cron.list` responses fail instead of hanging the command. Fixes [#83856](openclaw/openclaw#83856). ([#83989](openclaw/openclaw#83989)) - Agents/messages: stop message-tool-only turns after a successful source-channel `message` send while keeping transcript mirrors under the session write lock. ([#84289](openclaw/openclaw#84289)) - Agents: filter silent heartbeat response-tool transcript artifacts out of embedded context snapshots so later user turns are not polluted by heartbeat no-op messages. ([#83477](openclaw/openclaw#83477)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Agents/OpenAI: log repeated strict tool-schema downgrade diagnostics once per provider/model/tool signature, reducing duplicate debug noise while preserving `strict=false` fallback behavior. Fixes [#82930](openclaw/openclaw#82930). ([#82933](openclaw/openclaw#82933)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/code mode: spell out the `exec` tool's JavaScript/TypeScript, no Node module, and catalog-bridge constraints in model-visible schema text so agents can use enabled tools without trial-and-error. ([#84269](openclaw/openclaw#84269)) Thanks [@Kaspre](https://github.com/Kaspre). - Codex: give `image_generate` dynamic-tool calls a 120s default watchdog when no per-call or configured image timeout is set, so image generation no longer falls back to the generic 30s bridge timeout. ([#84254](openclaw/openclaw#84254)) Thanks [@moritzmmayerhofer](https://github.com/moritzmmayerhofer). - Codex: avoid duplicate dynamic tool terminal diagnostics while large diagnostic backlogs drain without blocking tool responses. ([#82937](openclaw/openclaw#82937)) Thanks [@galiniliev](https://github.com/galiniliev). - CLI/message: include a stable top-level `messageId` in `openclaw message --json` output when channel sends return one. ([#84191](openclaw/openclaw#84191)) Thanks [@100menotu001](https://github.com/100menotu001). - Cron: preserve legacy top-level array `jobs.json` stores when loading or adding scheduled jobs so old cron jobs are no longer treated as an empty store during upgrade. Fixes [#60799](openclaw/openclaw#60799). ([#84433](openclaw/openclaw#84433)) Thanks [@IWhatsskill](https://github.com/IWhatsskill). - Gateway/agents: use an agent's `identity.name` in Gateway agent summaries when `agents.list[].name` is unset, so configured agent labels remain visible in clients. ([#84355](openclaw/openclaw#84355); refs [#57835](openclaw/openclaw#57835)) Thanks [@luoyanglang](https://github.com/luoyanglang). - Channels/replies: keep normal `/verbose` failed-tool progress compact in message-tool replies and prevent late text-only tool output from appearing after the final answer. ([#84303](openclaw/openclaw#84303)) Thanks [@VACInc](https://github.com/VACInc). - Plugins/hooks: apply a default 30-second timeout to `before_compaction` and `after_compaction` hooks so a hung plugin handler no longer blocks compaction completion. ([#84153](openclaw/openclaw#84153)) - Discord: preserve disabled presentation buttons when adapting and rendering Discord message controls. ([#84188](openclaw/openclaw#84188)) Thanks [@100menotu001](https://github.com/100menotu001). - Twitch: add a test-only client-manager registry reset helper so non-isolated Twitch tests can clear cached managers between cases. Fixes [#83887](openclaw/openclaw#83887). ([#84244](openclaw/openclaw#84244)) Thanks [@hclsys](https://github.com/hclsys). - Cron: run main-session scheduled work on a cron-owned wake lane while preserving reply delivery context, so background cron turns no longer block human main-session chat. Fixes [#82766](openclaw/openclaw#82766). ([#82767](openclaw/openclaw#82767)) Thanks [@galiniliev](https://github.com/galiniliev). - Cron: use structured embedded-run denial metadata for isolated scheduled tasks so blocked exec requests fail the job without treating ordinary assistant prose as a denial. ([#84067](openclaw/openclaw#84067)) Thanks [@abnershang](https://github.com/abnershang). - Cron: keep recovered tool warnings diagnostic for successful scheduled runs so final cron output is delivered instead of being replaced by a post-processing warning. ([#84045](openclaw/openclaw#84045)) Thanks [@abnershang](https://github.com/abnershang). - Plugins/perf: thread explicit plugin discovery results through `loadBundledCapabilityRuntimeRegistry`, `resolveBundledPluginSources`, and `listChannelCatalogEntries` so callers that already hold a discovery result skip redundant filesystem walks. Thanks [@SebTardif](https://github.com/SebTardif). - harden update restart script creation \[AI]. ([#84088](openclaw/openclaw#84088)) Thanks [@pgondhi987](https://github.com/pgondhi987). - Docker: keep the bundled Codex plugin in official release image keep lists so the default OpenAI agent harness remains available after Docker pruning. Fixes [#83613](openclaw/openclaw#83613). ([#83626](openclaw/openclaw#83626)) Thanks [@YuanHanzhong](https://github.com/YuanHanzhong). - CLI/channels: preserve the first line of `openclaw channels logs` output when the rolling tail window starts exactly on a line boundary, mirroring the already-fixed `readLogSlice` behavior in `src/logging/log-tail.ts`. - Control UI: treat terminal session status as authoritative over stale active-run flags so completed terminal runs stop showing abort/live UI. ([#84057](openclaw/openclaw#84057)) - CLI: preserve embedded equals signs in inline root option values instead of truncating after the second separator. ([#83995](openclaw/openclaw#83995)) Thanks [@ThiagoCAltoe](https://github.com/ThiagoCAltoe). - Matrix/config: accept `messages.queue.byChannel.matrix` queue overrides and keep queue provider schema/type keys aligned for Matrix, Google Chat, and Mattermost. Thanks [@bdjben](https://github.com/bdjben). - CLI: format `openclaw acp client` failures through the shared error formatter so object-shaped errors stay readable instead of printing `[object Object]`. Fixes [#83904](openclaw/openclaw#83904). ([#84080](openclaw/openclaw#84080)) - Providers/Ollama: default unknown-capabilities models to tool-capable so discovered native Ollama models can use tools when `/api/show` omits capabilities. ([#84055](openclaw/openclaw#84055)) Thanks [@dutifulbob](https://github.com/dutifulbob). - Installer/Windows: launch `install.ps1` onboarding as an attached child process so fresh native Windows installs do not freeze visibly at `Starting setup...` or corrupt the wizard's terminal rendering. - CLI/update: keep restart health checks working across one-version CLI/Gateway protocol skew and use the managed Gateway service Node for all follow-up commands even when the package root is unchanged, so `openclaw update` no longer silently switches the gateway to a different Node binary when multiple Node installations are present. Thanks [@amknight](https://github.com/amknight). - CLI/gateway: include the running Gateway version in `gateway status` JSON output, preserving existing server metadata while falling back to status RPC data for read probes. Fixes [#56222](openclaw/openclaw#56222). Thanks [@galiniliev](https://github.com/galiniliev). - Memory/search: close local embedding providers when active-memory searches time out so pending local model loads and embedding contexts are aborted and released. ([#83858](openclaw/openclaw#83858)) Thanks [@brokemac79](https://github.com/brokemac79). - CLI/nodes: request pending node surface approval scopes before `openclaw nodes approve` so exec-capable node approval can use admin-scoped Gateway credentials instead of failing with `missing scope: operator.admin`. ([#84392](openclaw/openclaw#84392)) Thanks [@joshavant](https://github.com/joshavant). - Gateway: reject slow node event sends before outbound buffers grow unbounded and log the rejected payload diagnostic. ([#84387](openclaw/openclaw#84387)) Thanks [@samzong](https://github.com/samzong). - Agents: include bounded trajectory queued-writer diagnostics in `pi-trajectory-flush` timeout warnings so flush stalls show pending writes, queued bytes, and append state. Fixes [#82961](openclaw/openclaw#82961). ([#82962](openclaw/openclaw#82962)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/subagents: recover stale completion announces by retrying unsupported transcript-wait wakes without transcript waiting and forcing a message-tool handoff when the requester run is already stale. Fixes [#83699](openclaw/openclaw#83699). ([#83700](openclaw/openclaw#83700)) Thanks [@galiniliev](https://github.com/galiniliev). - Agents/subagents: constrain wildcard subagent target allowlists to configured agents while preserving explicitly listed compatibility targets. Fixes [#84040](openclaw/openclaw#84040). ([#84357](openclaw/openclaw#84357)) Thanks [@joshavant](https://github.com/joshavant). - Providers/Anthropic: route Anthropic model refs selected with Claude CLI auth through the Claude CLI runtime so shorthand refs such as `anthropic/opus-4.7` no longer fall back to embedded Anthropic billing. Fixes [#84222](openclaw/openclaw#84222). ([#84374](openclaw/openclaw#84374)) Thanks [@joshavant](https://github.com/joshavant). - Agents: honor explicit `models.providers.<id>.timeoutSeconds` values above the default idle watchdog for cloud and self-hosted providers, so long first-token waits no longer fall back at \~120s when the provider timeout is higher. ([#83979](openclaw/openclaw#83979)) Thanks [@yujiawei](https://github.com/yujiawei). - Agents/Codex: keep encrypted Responses reasoning replay provenance-bound so stale mirrored Codex transcripts drop invalid encrypted content before request assembly while preserving matching same-session replay. Fixes [#83836](openclaw/openclaw#83836). ([#84367](openclaw/openclaw#84367)) Thanks [@joshavant](https://github.com/joshavant). - Agents/subagents: skip stale embedded-run wake probes for dormant completion requesters, so late subagent completions go straight to requester-agent/direct handoff instead of producing `reason=no_active_run` queue noise. ([#82964](openclaw/openclaw#82964)) Thanks [@galiniliev](https://github.com/galiniliev). - CLI: retry config snapshot reads after a transient failure so one rejected read no longer poisons later commands in the same process. ([#83931](openclaw/openclaw#83931)) Thanks [@honor2030](https://github.com/honor2030). - Media: decode URL path basenames before using them as remote media fallback filenames, so files like `My%20Report.pdf` are surfaced as `My Report.pdf`. Fixes [#84050](openclaw/openclaw#84050). ([#84052](openclaw/openclaw#84052)) Thanks [@jbetala7](https://github.com/jbetala7). - WhatsApp: clarify inbound group diagnostics so observed but unregistered groups point to `channels.whatsapp.groups` without changing routing or sender authorization. ([#83846](openclaw/openclaw#83846)) Thanks [@neeravmakwana](https://github.com/neeravmakwana). - WhatsApp: drain pending outbound deliveries on a 30s periodic timer in addition to the reconnect handler, so messages enqueued while the provider is already connected no longer wait for the next reconnect to send. ([#79083](openclaw/openclaw#79083)) Thanks [@Oviemudiaga](https://github.com/Oviemudiaga). - CLI/TUI: include gateway plugin slash commands in TUI autocomplete, so connected sessions can suggest plugin-owned commands exposed by the running Gateway. ([#83640](openclaw/openclaw#83640)) Thanks [@se7en-agent](https://github.com/se7en-agent). - Gateway/mobile: restore QR setup-code handoff of bounded operator tokens for iOS and Android onboarding while keeping admin and pairing scopes out of bootstrap. ([#83684](openclaw/openclaw#83684)) Thanks [@ngutman](https://github.com/ngutman). - iOS: repair Release archive compilation for the TestFlight build. ([#84255](openclaw/openclaw#84255)) Thanks [@ngutman](https://github.com/ngutman). - Agents/compaction: bound plugin-owned CLI transcript compaction with the host safety timeout so a hung context engine can no longer stall post-turn cleanup. ([#84083](openclaw/openclaw#84083)) Thanks [@100yenadmin](https://github.com/100yenadmin). - Control UI/usage: truncate long context skill, tool, and file names in the usage panel while keeping the full name available on hover. ([#42197](openclaw/openclaw#42197)) Thanks [@Rain120](https://github.com/Rain120). - Codex: respect explicit `models auth order set` and `config.auth.order` precedence over stale `lastGood` in `/codex account`, and show `no working credential` when every explicit-order profile is ineligible instead of marking a lower-ranked profile as active. Fixes [#84386](openclaw/openclaw#84386). ([#84412](openclaw/openclaw#84412)) Thanks [@openperf](https://github.com/openperf). - Agents: honor `messages.suppressToolErrors` for mutating tool failures so configured chat surfaces do not receive separate warning payloads. ([#81561](openclaw/openclaw#81561)) Thanks [@moeedahmed](https://github.com/moeedahmed). - Agents/fallback: surface billing guidance for mixed rate-limit plus billing fallback exhaustion instead of generic failure copy. Fixes [#79396](openclaw/openclaw#79396). ([#79489](openclaw/openclaw#79489)) Thanks [@aayushprsingh](https://github.com/aayushprsingh). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/615

nxmxbbd added 4 commits May 21, 2026 04:44

fix(doctor): warn when sandbox hides MCP tools

c169e84

fix(doctor): mirror sandbox policy fallback

a6e8afc

fix(doctor): preserve sandbox deny diagnostics

92cb62b

fix(doctor): polish sandbox MCP warnings

e0290ce

nxmxbbd requested a review from a team as a code owner May 20, 2026 20:51

openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime commands Command implementations docker Docker and sandbox tooling size: M proof: supplied External PR includes structured after-fix real behavior proof. labels May 20, 2026

nxmxbbd mentioned this pull request May 20, 2026

MCP server tools never reach outbound tools[] across 4.26 → 5.7 (cluster previously closed + locked as 'resolved') #80909

Closed

clawsweeper Bot added the clawsweeper:automerge Maintainer opted this PR into bounded ClawSweeper-reviewed automerge label May 21, 2026

clawsweeper Bot mentioned this pull request May 21, 2026

fix(doctor): warn when sandbox hides MCP tools #84742

Merged

clawsweeper Bot closed this May 21, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(doctor): warn when sandbox hides MCP tools#84699

fix(doctor): warn when sandbox hides MCP tools#84699
nxmxbbd wants to merge 4 commits into
openclaw:mainfrom
nxmxbbd:fix/80909-sandbox-mcp-docs

nxmxbbd commented May 20, 2026

Uh oh!

clawsweeper Bot commented May 20, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 20, 2026

Uh oh!

Takhoffman commented May 21, 2026

Uh oh!

clawsweeper Bot commented May 21, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

nxmxbbd commented May 20, 2026

Summary

Motivation

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Real behavior proof

Root Cause (if applicable)

Regression Test Plan (if applicable)

User-visible / Behavior Changes

Diagram (if applicable)

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Review Conversations

Compatibility / Migration

Risks and Mitigations

AI assistance disclosure

Uh oh!

clawsweeper Bot commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 20, 2026

Hatch command

Uh oh!

Takhoffman commented May 21, 2026

Uh oh!

clawsweeper Bot commented May 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented May 20, 2026 •

edited

Loading

clawsweeper Bot commented May 21, 2026 •

edited

Loading