Skip to content

fix: protect global agent config defaults [AI]#90145

Merged
pgondhi987 merged 2 commits into
openclaw:mainfrom
pgondhi987:fix/fix-719
Jun 4, 2026
Merged

fix: protect global agent config defaults [AI]#90145
pgondhi987 merged 2 commits into
openclaw:mainfrom
pgondhi987:fix/fix-719

Conversation

@pgondhi987

@pgondhi987 pgondhi987 commented Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Removes global agent prompt overlays and global default model selection from the agent-facing gateway config mutation allowlist.
  • Keeps bounded agent runtime tuning, per-agent model selection, mention gating, and visible-reply settings available through the existing guard.
  • Updates the gateway security docs so the public trust-boundary description matches the runtime guard.
  • Adds regression coverage for both config.patch and config.apply attempts to rewrite global prompt/model defaults.

Linked context

Which issue does this close?

No public issue linked.

Which issues, PRs, or discussions are related?

Related: maintainer security hardening request

Was this requested by a maintainer or owner?

Yes, via maintainer-directed security hardening intake.

Real behavior proof (required for external PRs)

  • Behavior or issue addressed: Agent-facing gateway config writes can no longer persistently rewrite global prompt overlays or the global default model.
  • Real environment tested: Local source checkout plus a real temporary openclaw gateway run process with isolated OPENCLAW_HOME, OPENCLAW_STATE_DIR, and OPENCLAW_CONFIG_PATH.
  • Exact steps or command run after this patch: OPENCLAW_HOME="$tmp_root/home" OPENCLAW_STATE_DIR="$tmp_root/state" OPENCLAW_CONFIG_PATH="$tmp_root/state/openclaw.json" pnpm openclaw gateway run --dev --reset --port 18879 --auth none --allow-unconfigured --ws-log compact
  • Exact steps or command run after this patch: OPENCLAW_HOME="$tmp_root/home" OPENCLAW_STATE_DIR="$tmp_root/state" OPENCLAW_CONFIG_PATH="$tmp_root/state/openclaw.json" OPENCLAW_GATEWAY_PORT=18879 pnpm tsx --eval '<createGatewayTool proof script>'
  • Evidence after fix (screenshot, recording, terminal capture, console output, redacted runtime log, linked artifact, or copied live output): global_prompt_overlays: REJECTED gateway config.patch cannot change protected config paths: agents.defaults.promptOverlays.gpt5.personality
  • Evidence after fix (screenshot, recording, terminal capture, console output, redacted runtime log, linked artifact, or copied live output): global_default_model: REJECTED gateway config.patch cannot change protected config paths: agents.defaults.model.primary
  • Evidence after fix (screenshot, recording, terminal capture, console output, redacted runtime log, linked artifact, or copied live output): allowed_reasoning_default: ALLOWED ok
  • Observed result after fix: The real gateway tool path rejects global prompt/model default mutations before forwarding the write, while a valid bounded tuning path still succeeds.
  • What was not tested: No external chat/channel UI was used; the proof invoked the agent-facing gateway tool directly against a real local gateway process.
  • Proof limitations or environment constraints: The gateway used auth-none in an isolated temp state dir with a dummy explicit gatewayToken only to satisfy the agent tool's explicit URL override contract; no real credentials were used.
  • Before evidence (optional but encouraged): Existing guard coverage asserted these global paths were present in the allowlist.

Tests and validation

Which commands did you run?

node scripts/run-vitest.mjs src/agents/tools/gateway-tool-guard-coverage.test.ts

OPENCLAW_HOME="$tmp_root/home" OPENCLAW_STATE_DIR="$tmp_root/state" OPENCLAW_CONFIG_PATH="$tmp_root/state/openclaw.json" pnpm openclaw gateway run --dev --reset --port 18879 --auth none --allow-unconfigured --ws-log compact

OPENCLAW_HOME="$tmp_root/home" OPENCLAW_STATE_DIR="$tmp_root/state" OPENCLAW_CONFIG_PATH="$tmp_root/state/openclaw.json" OPENCLAW_GATEWAY_PORT=18879 pnpm tsx --eval '<createGatewayTool proof script>'

What regression coverage was added or updated?

Updated gateway mutation guard coverage to assert global prompt overlays and global default model paths are not allowlisted, plus new blocked config.patch and config.apply cases.

What failed before this fix, if known?

Before this change, the allowlist coverage expected agents.defaults.promptOverlays and agents.defaults.model to be agent-tunable.

If no test was added, why not?

Not applicable; focused regression tests were added.

Risk checklist

Did user-visible behavior change? (Yes/No)

Yes. Agent-driven gateway config.patch and gateway config.apply calls that target global prompt overlays or global default model settings now fail as protected config changes.

Did config, environment, or migration behavior change? (Yes/No)

No config shape, environment variable, or migration behavior changed.

Did security, auth, secrets, network, or tool execution behavior change? (Yes/No)

Yes. The agent-facing gateway tool boundary is stricter for persistent global prompt/model config writes; auth, secrets, network, sandbox, plugin, channel, provider, and tool execution behavior are otherwise unchanged.

What is the highest-risk area?

Compatibility for workflows that asked the model to persist global default model or prompt overlay changes through the gateway tool.

How is that risk mitigated?

The stricter behavior is limited to the model-facing gateway mutation guard; trusted operators can still edit those settings through operator-controlled config surfaces.

Current review state

What is the next action?

Await ClawSweeper re-review and GitHub CI completion.

What is still waiting on author, maintainer, CI, or external proof?

GitHub CI and maintainer review are still pending.

Which bot or reviewer comments were addressed?

Addressed ClawSweeper proof feedback by adding real temporary gateway proof for blocked global prompt/model writes and one allowed bounded tuning write.

@pgondhi987 pgondhi987 requested a review from a team as a code owner June 4, 2026 03:31
@openclaw-barnacle openclaw-barnacle Bot added docs Improvements or additions to documentation gateway Gateway runtime agents Agent runtime and tooling size: XS maintainer Maintainer-authored PR labels Jun 4, 2026
@clawsweeper

clawsweeper Bot commented Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed June 4, 2026, 12:00 AM ET / 04:00 UTC.

Summary
The PR removes global prompt overlays and global default model selection from the agent-facing gateway config mutation allowlist, updates guard coverage, and aligns gateway security docs.

PR surface: Source -2, Tests +37, Docs +1. Total +36 across 3 files.

Reproducibility: yes. Current main source shows the two global default prefixes in the agent-facing allowlist, and the PR body reports a real gateway run where those same writes are rejected after the patch.

Review metrics: 1 noteworthy metric.

  • Agent-tunable default surfaces: 2 removed from allowlist. Removing global prompt overlays and global default model from model-facing writes is a compatibility-sensitive security-boundary change.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • [P2] Maintainer should explicitly accept the compatibility tradeoff for existing model-facing global default writes before merge.

Risk before merge

  • [P1] Existing workflows that ask the model-facing gateway tool to persist global prompt overlay or global default model changes will now fail with protected-config-path errors; maintainers need to accept that compatibility tradeoff before merge.

Maintainer options:

  1. Confirm the protected-default boundary (recommended)
    A maintainer can accept the stricter model-facing boundary if agent-driven global prompt/model writes are intentionally no longer supported.
  2. Add upgrade-facing release context
    If maintainers want extra discoverability, require PR-body or squash-message release-note context that points users to operator-controlled config surfaces for global defaults.
  3. Pause if self-tuning defaults are required
    If agent-driven global default tuning is still a supported product workflow, pause this PR and design a narrower explicit operator-approved path instead.

Next step before merge

  • Human maintainer review remains because the PR has a protected maintainer label and intentionally changes compatibility-sensitive gateway config behavior; no automated repair is indicated.

Security
Cleared: The diff tightens an agent-facing config-write boundary and does not add dependency, workflow, secret, or code-execution surface.

Review details

Best possible solution:

Land the stricter allowlist only after maintainer confirmation that global prompt/model defaults are operator-controlled settings, with CLI/UI config remaining the supported edit path.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main source shows the two global default prefixes in the agent-facing allowlist, and the PR body reports a real gateway run where those same writes are rejected after the patch.

Is this the best way to solve the issue?

Yes, conditional on maintainer acceptance of the compatibility break. Removing the two prefixes at the existing fail-closed allowlist is the narrowest owner-boundary fix and leaves trusted operator config surfaces intact.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 32282418eb88.

Label changes

Label changes:

  • add proof: sufficient: Contributor real behavior proof is sufficient. The PR body now includes copied live output from a real temporary gateway process showing both global default writes rejected and a bounded tuning write allowed.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body now includes copied live output from a real temporary gateway process showing both global default writes rejected and a bounded tuning write allowed.
  • remove rating: 🦪 silver shellfish: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
  • remove status: 📣 needs proof: Current PR status label is status: 👀 ready for maintainer look.

Label justifications:

  • P1: The PR changes an agent-facing gateway security boundary for persistent config writes, which is urgent but still scoped to gateway config mutation behavior.
  • merge-risk: 🚨 compatibility: Merging makes existing model-facing config.patch or config.apply workflows for global prompt/model defaults fail closed.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body now includes copied live output from a real temporary gateway process showing both global default writes rejected and a bounded tuning write allowed.
  • proof: sufficient: Contributor real behavior proof is sufficient. The PR body now includes copied live output from a real temporary gateway process showing both global default writes rejected and a bounded tuning write allowed.
Evidence reviewed

PR surface:

Source -2, Tests +37, Docs +1. Total +36 across 3 files.

View PR surface stats
Area Files Added Removed Net
Source 1 1 3 -2
Tests 1 39 2 +37
Docs 1 4 3 +1
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 3 44 8 +36

What I checked:

Likely related people:

  • steipete: Current main blame for the gateway allowlist and security doc wording points to Peter Steinberger, with additional recent gateway-tool history in the same file. (role: recent area contributor; confidence: high; commits: 003bb8546db7, 32282418eb88; files: src/agents/tools/gateway-tool.ts, docs/gateway/security/index.md)
  • drobison00: The related merged fail-closed gateway config mutation allowlist work was authored by Devin Robison in the linked security hardening PR. (role: feature owner; confidence: high; commits: bceda6089aa7; files: src/agents/tools/gateway-tool.ts, src/agents/tools/gateway-tool-guard-coverage.test.ts)
  • Agustin Rivera: Recent history shows Agustin Rivera authored adjacent dangerous gateway config mutation and exec approval protection commits in the same gateway tool path. (role: adjacent owner; confidence: medium; commits: 29f206243b2d, b9e972e17495; files: src/agents/tools/gateway-tool.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P1 High-priority user-facing bug, regression, or broken workflow. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. labels Jun 4, 2026
@pgondhi987

pgondhi987 commented Jun 4, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review\n\nAdded real temporary gateway proof to the PR body: both global default config.patch attempts are rejected by the agent-facing gateway tool, and a valid bounded reasoningDefault patch succeeds.

@clawsweeper

clawsweeper Bot commented Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper assist is taking a look at your question.

I queued a lightweight read-only assist pass. It will post a separate answer comment and will not edit the durable ClawSweeper review comment or trigger close, merge, repair, label, or branch changes.

Request: review\n\nProof-only feedback has been addressed in the PR body; please run the full correctness/security re-review on the current head.

@github-actions github-actions Bot mentioned this pull request Jun 4, 2026
Open
@clawsweeper

clawsweeper Bot commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

ClawSweeper assist: The PR body now includes the requested real temporary gateway proof, so the prior “needs proof” concern appears addressed from the supplied context. A full correctness/security re-review still needs @clawsweeper review.

Evidence:

  • PR body now reports a real openclaw gateway run process with isolated OPENCLAW_HOME, OPENCLAW_STATE_DIR, and OPENCLAW_CONFIG_PATH.
  • Reported live tool results show agents.defaults.promptOverlays.gpt5.personality rejected and agents.defaults.model.primary rejected via config.patch.
  • Reported live tool result shows allowed bounded tuning still works: allowed_reasoning_default: ALLOWED ok.
  • Previous ClawSweeper review at fix: protect global agent config defaults [AI] #90145 (comment) specifically asked for real gateway-session proof.
  • The PR still has compatibility/security-boundary risk labels and pending CI/maintainer review per the PR body.

Suggested next action: Use @clawsweeper review for a full re-review of correctness and residual compatibility risk.

Source: #90145 (comment)
Assist model: gpt-5.5, reasoning low.

@pgondhi987

pgondhi987 commented Jun 4, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper review\n\nProof-only feedback has been addressed in the PR body; please run the full correctness/security re-review on the current head.

@clawsweeper

clawsweeper Bot commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

@clawsweeper

clawsweeper Bot commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

ClawSweeper assist: This needs the full review lane, not assist. The request is specifically for a correctness/security re-review on current head, so use @clawsweeper review.

Evidence:

  • Source comment requests @clawsweeper review for full correctness/security re-review: fix: protect global agent config defaults [AI] #90145 (comment)
  • Current PR head is 92286108b12c5d02de9e5457a1a6bf272b777af3.
  • Prior review only blocked on real behavior proof, and the PR body now reports real gateway proof for rejected global prompt/model writes plus allowed bounded tuning.
  • PR still carries compatibility/security-boundary labels including merge-risk: 🚨 compatibility and status: 📣 needs proof.

Suggested next action: Run @clawsweeper review for the full correctness/security re-review on the current head.

Source: #90145 (comment)
Assist model: gpt-5.5, reasoning low.

@pgondhi987

pgondhi987 commented Jun 4, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper review

@clawsweeper

clawsweeper Bot commented Jun 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@clawsweeper

clawsweeper Bot commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

ClawSweeper assist: The added PR-body proof addresses the prior proof-only blocker from the supplied context, but a full correctness/security re-review still belongs to the review lane.

Evidence:

  • PR body now reports a real temporary openclaw gateway run process with isolated OPENCLAW_HOME, OPENCLAW_STATE_DIR, and OPENCLAW_CONFIG_PATH.
  • Reported live gateway-tool output shows global prompt overlay and global default model config.patch attempts rejected.
  • Reported live gateway-tool output shows bounded reasoningDefault still allowed: allowed_reasoning_default: ALLOWED ok.
  • Previous ClawSweeper review at fix: protect global agent config defaults [AI] #90145 (comment) asked for real gateway-session proof.
  • The current head is 92286108b12c5d02de9e5457a1a6bf272b777af3.

Suggested next action: Use @clawsweeper review for the full correctness/security re-review on the current head.

Source: #90145 (comment)
Assist model: gpt-5.5, reasoning low.

@pgondhi987

pgondhi987 commented Jun 4, 2026

Copy link
Copy Markdown
Contributor Author

Verification before merge:

Behavior addressed: Agent-facing gateway config.patch / config.apply can no longer persistently rewrite global prompt overlays or the global default model.
Real environment tested: Local source checkout, isolated temporary local gateway process, GitHub Actions PR CI. No delegated remote provider was used.
Exact steps or command run after this patch:

  • node scripts/run-vitest.mjs src/agents/tools/gateway-tool-guard-coverage.test.ts
  • scripts/pr review-tests 90145 src/agents/tools/gateway-tool-guard-coverage.test.ts
  • timeout 1800 .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main
  • OPENCLAW_HOME="$tmp_root/home" OPENCLAW_STATE_DIR="$tmp_root/state" OPENCLAW_CONFIG_PATH="$tmp_root/state/openclaw.json" pnpm openclaw gateway run --dev --reset --port 18879 --auth none --allow-unconfigured --ws-log compact
  • OPENCLAW_HOME="$tmp_root/home" OPENCLAW_STATE_DIR="$tmp_root/state" OPENCLAW_CONFIG_PATH="$tmp_root/state/openclaw.json" OPENCLAW_GATEWAY_PORT=18879 pnpm tsx --eval '<createGatewayTool proof script>'
  • auto-pr.sh issue 719 --run-stage ghsa_dry_run
  • auto-pr.sh issue 719 --run-stage ghsa_real_gate
    Evidence after fix:
  • Head verified: 92286108b12c5d02de9e5457a1a6bf272b777af3.
  • Focused Vitest passed: 1 file, 44 tests.
  • Real gateway proof: global prompt overlay and global default model patches rejected as protected paths; bounded reasoningDefault patch returned ALLOWED ok.
  • review-pr: passed, READY FOR /prepare-pr, 0 findings; autoreview: passed, no accepted/actionable findings.
  • GHSA dry-run: passed; GHSA real gate: passed; CI: no pending/failing checks at the verified head.
    Observed result after fix: The model-facing gateway tool fails closed for global prompt/model defaults while preserving bounded runtime tuning through the existing guard.
    What was not tested: No external chat/channel UI was used; the live proof invoked the agent-facing gateway tool directly against a real local gateway.

Regression Risk:
Medium. This intentionally changes the agent-facing config write boundary: workflows relying on model-driven global prompt/model default edits will now fail closed. Auth, secrets, sandboxing, storage, migrations, provider/plugin/channel behavior, dependency contracts, and existing config shape/defaults are unchanged.

Best fix verdict: Best targeted fix. Removing the two global defaults from the existing fail-closed allowlist addresses the owner-boundary issue without adding runtime shims, new config, or dangerous-flag special cases.

User behavior change:
Before, an agent with the gateway tool could persist changes under agents.defaults.promptOverlays and agents.defaults.model. After, those global settings stay operator-controlled; trusted operators can still edit config through operator surfaces, and allowed bounded tuning paths remain available.

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jun 4, 2026
@clawsweeper

clawsweeper Bot commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

ClawSweeper assist: This request needs the full review lane, not assist. The maintainer explicitly asked for a correctness/security re-review on current head, so use @clawsweeper review.

Evidence:

  • Source comment requests full re-review: fix: protect global agent config defaults [AI] #90145 (comment)
  • Current head is 92286108b12c5d02de9e5457a1a6bf272b777af3.
  • Prior proof blocker appears addressed: the PR body reports real gateway proof rejecting global prompt overlay and global default model writes, while allowing bounded reasoningDefault.
  • ClawSweeper later marked proof: sufficient and updated status to status: 👀 ready for maintainer look.

Suggested next action: Run @clawsweeper review for the full correctness/security re-review on the current head.

Source: #90145 (comment)
Assist model: gpt-5.5, reasoning low.

@pgondhi987 pgondhi987 merged commit 85b26bd into openclaw:main Jun 4, 2026
@clawsweeper

clawsweeper Bot commented Jun 4, 2026

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper could not start a freeform assist pass for this item.

Reason: freeform assist requires an open issue or PR.

Request: re-review\n\nAdded real temporary gateway proof to the PR body: both global default config.patch attempts are rejected by the agent-facing gateway tool, and a valid bounded reasoningDefault patch succeeds.

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 4, 2026
@pgondhi987
fix: protect global agent config defaults (openclaw#90145)
8c421b6
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request Jun 4, 2026
@pgondhi987 @SebTardif
fix: protect global agent config defaults (openclaw#90145)
4fd3c34
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request Jun 4, 2026
@pgondhi987 @SebTardif
fix: protect global agent config defaults (openclaw#90145)
1e9a6db
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request Jun 4, 2026
@pgondhi987 @SebTardif
fix: protect global agent config defaults (openclaw#90145)
5e893d5
SebTardif pushed a commit to SebTardif/openclaw that referenced this pull request Jun 4, 2026
@pgondhi987 @SebTardif
fix: protect global agent config defaults (openclaw#90145)
8dce88d
traoremp pushed a commit to traoremp/openclaw that referenced this pull request Jun 5, 2026
@pgondhi987
fix: protect global agent config defaults (openclaw#90145)
267164b
849261680 pushed a commit to 849261680/openclaw that referenced this pull request Jun 7, 2026
@pgondhi987 @849261680
fix: protect global agent config defaults (openclaw#90145)
7c7af77
wangmiao0668000666 pushed a commit to wangmiao0668000666/openclaw that referenced this pull request Jun 9, 2026
@pgondhi987 @wangmiao0668000666
fix: protect global agent config defaults (openclaw#90145)
6237254
eleboucher pushed a commit to eleboucher/homelab that referenced this pull request Jun 9, 2026
@eleboucher
fix(container): update image ghcr.io/openclaw/openclaw (2026.6.1 ➔ 20…
e04fa1a 
…26.6.5) (#963)

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.1` → `2026.6.5` |

---

### Release Notes

<details>
<summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary>

### [`v2026.6.5`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202665)

[Compare Source](openclaw/openclaw@v2026.6.1...v2026.6.5)

##### Highlights

- QQBot now strips model reasoning/thinking scaffolding before native delivery, preventing raw `<thinking>` content from leaking into channel replies. ([#&#8203;89913](openclaw/openclaw#89913), [#&#8203;90132](openclaw/openclaw#90132)) Thanks [@&#8203;openperf](https://github.com/openperf).
- MCP tool results now coerce `resource_link`, `resource`, `audio`, malformed image, and future non-text/image blocks at the materialize boundary, preventing Anthropic 400s and poisoned session history after a tool returns richer MCP content. ([#&#8203;90710](openclaw/openclaw#90710), [#&#8203;90728](openclaw/openclaw#90728)) Thanks [@&#8203;RanSHammer](https://github.com/RanSHammer) and [@&#8203;849261680](https://github.com/849261680).
- Anthropic extended-thinking sessions recover after prompt-cache expiry or Gateway restart because stream start events wait for `message_start`, letting pre-generation signature errors trigger the existing recovery retry. ([#&#8203;90667](openclaw/openclaw#90667), [#&#8203;90697](openclaw/openclaw#90697)) Thanks [@&#8203;openperf](https://github.com/openperf).
- Parallel is now a bundled `web_search` provider with `PARALLEL_API_KEY` discovery, guarded endpoint handling, cache-safe session ids, onboarding picker support, and docs. ([#&#8203;85158](openclaw/openclaw#85158)) Thanks [@&#8203;NormallyGaussian](https://github.com/NormallyGaussian).
- Google Vertex ADC users get static catalog rows and runtime model resolution again, while single-provider cooldown recovery and memory adapter status checks are more reliable. ([#&#8203;90506](openclaw/openclaw#90506), [#&#8203;90609](openclaw/openclaw#90609), [#&#8203;90717](openclaw/openclaw#90717), [#&#8203;90816](openclaw/openclaw#90816)) Thanks [@&#8203;849261680](https://github.com/849261680).
- Matrix can preflight voice notes before mention gating, preserve thread reads/replies through Matrix relations pagination, and carry QA coverage for voice and thread flows. ([#&#8203;78016](openclaw/openclaw#78016), [#&#8203;90415](openclaw/openclaw#90415))
- Auth and plugin install state is more durable: auth profiles now live in SQLite, official npm plugin install records keep their trusted pins, and prerelease fallback integrity checks avoid carrying stale integrity forward. ([#&#8203;89102](openclaw/openclaw#89102), [#&#8203;88585](openclaw/openclaw#88585))
- macOS node mode no longer silently self-reconnects away from a healthy direct Gateway session, reducing unexpected companion app session churn. ([#&#8203;90668](openclaw/openclaw#90668), [#&#8203;90815](openclaw/openclaw#90815)) Thanks [@&#8203;vrurg](https://github.com/vrurg).
- Upgrade and service paths are safer: cron legacy JSON stores migrate during doctor preflight, service env placeholders no longer mask state-dir secrets, WhatsApp startup waits are bounded, and disabled WhatsApp accounts tear down on config reload. ([#&#8203;90072](openclaw/openclaw#90072), [#&#8203;90208](openclaw/openclaw#90208), [#&#8203;90277](openclaw/openclaw#90277), [#&#8203;90488](openclaw/openclaw#90488), [#&#8203;90486](openclaw/openclaw#90486), [#&#8203;87951](openclaw/openclaw#87951), [#&#8203;87965](openclaw/openclaw#87965)) Thanks [@&#8203;MonkeyLeeT](https://github.com/MonkeyLeeT), [@&#8203;sallyom](https://github.com/sallyom), [@&#8203;mcaxtr](https://github.com/mcaxtr), and [@&#8203;MukundaKatta](https://github.com/MukundaKatta).

##### Changes

- Search/providers: add the Parallel bundled web-search plugin, live provider tests, registration contracts, onboarding/docs wiring, and guarded `api.parallel.ai/v1/search` support. ([#&#8203;85158](openclaw/openclaw#85158)) Thanks [@&#8203;NormallyGaussian](https://github.com/NormallyGaussian).
- Matrix/channels: add voice-message preflight and thread-aware read/reply behavior, including Matrix QA scenario wiring and docs for voice-message behavior. ([#&#8203;78016](openclaw/openclaw#78016), [#&#8203;90415](openclaw/openclaw#90415))
- Skills/ClawHub: install ClawHub skills backed by GitHub repositories through the resolved install API, download the pinned GitHub commit, keep install-policy checks, and report install telemetry after success. ([#&#8203;90478](openclaw/openclaw#90478)) Thanks [@&#8203;Patrick-Erichsen](https://github.com/Patrick-Erichsen).
- Google Chat/channels: add native approval card actions and click handling so Google Chat approvals use platform-native cards instead of generic message flow.
- Mobile: Android provider/model screens now surface expiring, unavailable, unresolved, and attention states more clearly, while iOS settings and Talk tabs keep diagnostics, gateway rows, attachment labels, and unavailable Talk controls reachable.
- Memory: QMD search can use the new rerank toggle, and memory adapter status uses the resolved default model identity when checking plain status. ([#&#8203;61834](openclaw/openclaw#61834))
- Docs/tooling: add Parallel search docs, refresh weather-skill guidance toward `web_fetch`, clarify legacy `openai-codex` auth, document release/test helper scripts, and tighten changed-test routing docs for CI/debugging work. ([#&#8203;90028](openclaw/openclaw#90028), [#&#8203;90250](openclaw/openclaw#90250)) Thanks [@&#8203;fuller-stack-dev](https://github.com/fuller-stack-dev).
- Release/process: switch release trains to `YYYY.M.PATCH` monthly patch numbering, keep pre-transition tags compatible, and pin the June 2026 floor at `2026.6.5` after the published beta.
- Platform maintenance: refresh Android, Swift/macOS, Docker, CodeQL, Buildx, Docker build/push, and Codex Action dependencies for this release train. ([#&#8203;74980](openclaw/openclaw#74980), [#&#8203;81757](openclaw/openclaw#81757), [#&#8203;86481](openclaw/openclaw#86481), [#&#8203;86483](openclaw/openclaw#86483), [#&#8203;90601](openclaw/openclaw#90601))
- QQBot: add `/bot-group-allways on|off` slash command (with named-account and default-account support) to toggle whether group messages require an `@mention` before the bot replies, and clear the runtime config snapshot after the write so the new account-level `defaultRequireMention` takes effect immediately without restart. ([#&#8203;91423](openclaw/openclaw#91423)) Thanks [@&#8203;cxyhhhhh](https://github.com/cxyhhhhh).

##### Fixes

- Channel content boundaries: QQBot now strips reasoning/thinking tags before sending, preserving final answers while hiding internal model narration from users. ([#&#8203;89913](openclaw/openclaw#89913), [#&#8203;90132](openclaw/openclaw#90132)) Thanks [@&#8203;openperf](https://github.com/openperf).
- Agents/MCP/providers: coerce non-text/image MCP tool-result blocks before they reach provider converters, preserving valid images and turning richer MCP content into text instead of malformed image blocks. ([#&#8203;90710](openclaw/openclaw#90710), [#&#8203;90728](openclaw/openclaw#90728)) Thanks [@&#8203;RanSHammer](https://github.com/RanSHammer) and [@&#8203;849261680](https://github.com/849261680).
- Anthropic/Codex/ACP/agent recovery: defer Anthropic stream start events until `message_start`, strip stale compaction thinking signatures before Anthropic replay, detect unsigned thinking-only stalls, refresh prompt fences after compaction writes, reject empty completion handoffs, preserve parent streaming-off overrides/shared progress commentary, forward heartbeat metadata to context-engine hooks, and cover Codex session/thread migration edge cases. ([#&#8203;90667](openclaw/openclaw#90667), [#&#8203;90697](openclaw/openclaw#90697), [#&#8203;90163](openclaw/openclaw#90163), [#&#8203;90108](openclaw/openclaw#90108), [#&#8203;89874](openclaw/openclaw#89874), [#&#8203;89505](openclaw/openclaw#89505), [#&#8203;90632](openclaw/openclaw#90632), [#&#8203;89302](openclaw/openclaw#89302), [#&#8203;90729](openclaw/openclaw#90729), [#&#8203;90317](openclaw/openclaw#90317), [#&#8203;90319](openclaw/openclaw#90319)) Thanks [@&#8203;openperf](https://github.com/openperf), [@&#8203;100yenadmin](https://github.com/100yenadmin), and [@&#8203;ooiuuii](https://github.com/ooiuuii).
- Provider/model resolution: preserve Google Vertex ADC auth markers in generated catalogs, re-probe a single-provider primary after cooldown, share Codex model visibility, fail closed for unknown model auth, preserve Codex alias availability, keep unresolved profile refs unknown, and avoid resolving auth while listing models. ([#&#8203;90506](openclaw/openclaw#90506), [#&#8203;90609](openclaw/openclaw#90609), [#&#8203;90717](openclaw/openclaw#90717), [#&#8203;90702](openclaw/openclaw#90702)) Thanks [@&#8203;849261680](https://github.com/849261680).
- Gateway/macOS/mobile: avoid duplicate Gateway probe warnings by identity, rate-limit node pairing requests while preserving paired-node reconnects, keep macOS node mode on a healthy direct Gateway session, keep iOS diagnostics and gateway rows reachable, and avoid Linux ARM Gradle resource tasks during Android builds. ([#&#8203;85791](openclaw/openclaw#85791), [#&#8203;90147](openclaw/openclaw#90147), [#&#8203;90668](openclaw/openclaw#90668), [#&#8203;90815](openclaw/openclaw#90815)) Thanks [@&#8203;giodl73-repo](https://github.com/giodl73-repo) and [@&#8203;vrurg](https://github.com/vrurg).
- TUI/chat/Workboard/auto-reply: optimistic user messages stay stable across stale history reloads, runId reassignment, and abort windows instead of disappearing, jumping, or lingering as ghost rows; Workboard stale lifecycle bulk updates no longer overwrite newer status/provenance; message-tool sends now count as delivery. ([#&#8203;86205](openclaw/openclaw#86205), [#&#8203;89600](openclaw/openclaw#89600), [#&#8203;88592](openclaw/openclaw#88592), [#&#8203;90123](openclaw/openclaw#90123)) Thanks [@&#8203;RomneyDa](https://github.com/RomneyDa).
- Cron/update/service env: doctor config preflight now migrates legacy cron JSON stores into SQLite before runtime reads, service env planning skips unresolved placeholders that would mask state-dir `.env` values, and session transcript rewrites keep registry markers/discriminants consistent. ([#&#8203;90072](openclaw/openclaw#90072), [#&#8203;90208](openclaw/openclaw#90208), [#&#8203;90277](openclaw/openclaw#90277), [#&#8203;90488](openclaw/openclaw#90488)) Thanks [@&#8203;MonkeyLeeT](https://github.com/MonkeyLeeT) and [@&#8203;sallyom](https://github.com/sallyom).
- Security/config/tooling: guard MCP HTTP redirects, protect global agent config defaults, and keep release/test/tooling proof failures bounded and explicit. ([#&#8203;89732](openclaw/openclaw#89732), [#&#8203;90145](openclaw/openclaw#90145))
- Channels: WhatsApp restarts when per-account config changes, bounds background startup waits, closes failed sockets, and preserves reconnect behavior; Mattermost slash commands keep their state on `globalThis`; Feishu streaming cards preserve full merged content; voice-call tracks Twilio streams after connect; ClickClack reply tools respect `toolsAllow`. ([#&#8203;87951](openclaw/openclaw#87951), [#&#8203;87965](openclaw/openclaw#87965), [#&#8203;90486](openclaw/openclaw#90486), [#&#8203;68113](openclaw/openclaw#68113), [#&#8203;90534](openclaw/openclaw#90534), [#&#8203;90181](openclaw/openclaw#90181), [#&#8203;90607](openclaw/openclaw#90607), [#&#8203;89500](openclaw/openclaw#89500)) Thanks [@&#8203;MukundaKatta](https://github.com/MukundaKatta), [@&#8203;mcaxtr](https://github.com/mcaxtr), [@&#8203;infoanton](https://github.com/infoanton), [@&#8203;mushuiyu886](https://github.com/mushuiyu886), and [@&#8203;sahibzada-allahyar](https://github.com/sahibzada-allahyar).
- Feishu: retry transient send rate-limit errors (HTTP 429, per-chat code 230020, tenant-level code 11232) with linear backoff, including SDK responses that fulfill with rate-limit bodies instead of throwing, and route streaming-card sends through the retry wrapper. ([#&#8203;89659](openclaw/openclaw#89659)) Thanks [@&#8203;ladygege](https://github.com/ladygege).
- Release/CI/E2E: main CI guard drift, PR merge diff scoping, live Docker credential staging, base-image qualification, installer Docker classification, Playwright dependency install recovery, API-key auth for Codex live Docker lanes, Parallels option terminators, and JSON-mode progress handling are tighter so release proof fails cleaner. ([#&#8203;90532](openclaw/openclaw#90532), [#&#8203;90287](openclaw/openclaw#90287), [#&#8203;90058](openclaw/openclaw#90058)) Thanks [@&#8203;RomneyDa](https://github.com/RomneyDa), [@&#8203;hxy91819](https://github.com/hxy91819), and [@&#8203;mrunalp](https://github.com/mrunalp).
- Release/CI/E2E: Docker E2E and live Docker harness runs now apply default memory, CPU, and process ceilings while preserving explicit per-lane overrides.
- Release/CI/E2E: plugin lifecycle matrix resource sampling now fails phases that exceed RSS, wall-clock, or CPU ceilings instead of only logging the measurements.
- Release/CI/E2E: Codex npm plugin live assertions now cap transcript discovery and diagnostic log reads so failure proof stays bounded.
- Tests/state isolation: QA Lab valid-tool-call metrics now require runtime tool-call evidence when runtime parity data is available instead of counting tool-backed scenario pass status alone.
- Tests/state isolation: QA Lab runtime parity now fails planned-only tool-call rows without matching tool results instead of treating matching mock plans as real tool evidence.
- Tests/state isolation: provider, media, auth, cron, task, session, sandbox, Gateway, and Codex timeout fixtures now scope more home/state/env data per test, reducing cross-test leakage and making release validation failures less noisy. ([#&#8203;90027](openclaw/openclaw#90027), [#&#8203;89974](openclaw/openclaw#89974))

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about these updates again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xMDEuMSIsInVwZGF0ZWRJblZlciI6IjQzLjEwMS4xIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJyZW5vdmF0ZS9jb250YWluZXIiLCJ0eXBlL3BhdGNoIl19-->

Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/963
sablehead pushed a commit to sablehead/openclaw that referenced this pull request Jun 10, 2026
@pgondhi987
fix: protect global agent config defaults (openclaw#90145)
79ec48c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

agents Agent runtime and tooling docs Improvements or additions to documentation gateway Gateway runtime maintainer Maintainer-authored PR merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P1 High-priority user-facing bug, regression, or broken workflow. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: XS status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pgondhi987