fix: expand unsafe host env denylist by pgondhi987 · Pull Request #91618 · openclaw/openclaw

pgondhi987 · 2026-06-09T05:13:59Z

Summary

Expands the shared host environment safety policy to reject additional interpreter startup and search-path variables before they reach host command execution.
Regenerates the macOS host environment policy from the shared JSON source so app and Node-host sanitizers stay aligned.
Updates focused regression coverage and user-facing docs that enumerate the blocked environment override classes.
Intentionally does not change the sanitizer control flow; this keeps the existing policy-driven behavior and only expands the denylist data.

AI-assisted: yes.

Linked context

No public issue linked in this PR body.

Real behavior proof (required for external PRs)

Behavior addressed: Host environment overrides for additional interpreter startup/search-path variables are rejected by the existing node-host system.run handler before process execution.
Real environment tested: Local OpenClaw checkout on Linux using the actual handleSystemRunInvoke runtime path and a real child process spawn for the safe case.
Exact steps or command run after this patch: pnpm exec tsx /tmp/openclaw-system-run-proof-91618.ts
Evidence after fix: The blocked request reported SYSTEM_RUN_DENIED: environment override rejected (blocked override keys: BASHOPTS, FPATH, KSH_ENV, TCLLIBPATH) with executed: false; the safe request reported executed: true, ok: true, stdout: "ok\nBASHOPTS_UNSET\n", and exitCode: 0.
Observed result after fix: The four risky env overrides are rejected before system.run executes, while an ordinary OPENCLAW_PROOF_SAFE=ok env override still reaches the spawned process.
What was not tested: Full gateway-to-paired-node WebSocket round trip and full repository CI were not run locally.
Proof limitations or environment constraints: The proof uses the real node-host handler and real process execution in a local checkout, but not a separately paired node service.
Before evidence: Existing tests did not cover these variables in the shared policy baseline.

Tests and validation

node scripts/run-vitest.mjs src/infra/host-env-security.test.ts src/infra/host-env-security.policy-parity.test.ts src/infra/host-env-security.reported-baseline.test.ts
node scripts/generate-host-env-security-policy-swift.mjs --check
git diff --check
scripts/pr review-tests 91618 src/infra/host-env-security.test.ts src/infra/host-env-security.policy-parity.test.ts src/infra/host-env-security.reported-baseline.test.ts
timeout 1800 .agents/skills/autoreview/scripts/autoreview --mode branch --base origin/main
pnpm exec tsx /tmp/openclaw-system-run-proof-91618.ts

Regression coverage was added for dangerous-key classification, inherited sanitization, override sanitization, diagnostics, reported baseline coverage, and generated macOS policy parity.

Risk checklist

Did user-visible behavior change? Yes

Did config, environment, or migration behavior change? Yes

Did security, auth, secrets, network, or tool execution behavior change? Yes

Highest-risk area: Host command execution environment filtering.

Risk mitigation: The change reuses the existing denylist policy mechanism, keeps ordinary credential/proxy/server-specific variables unaffected, adds focused tests for the expanded policy surface, and includes runtime proof that safe env overrides still pass.

Current review state

Next action: Wait for automated CI, ClawSweeper re-review, and maintainer review.

Still waiting on: GitHub CI and any maintainer-requested broader validation.

Bot or reviewer comments addressed: ClawSweeper proof request addressed by adding runtime system.run handler proof to this PR body.

clawsweeper · 2026-06-09T05:15:55Z

Codex review: needs maintainer review before merge. Reviewed June 9, 2026, 2:06 AM ET / 06:06 UTC.

Summary
The branch adds BASHOPTS, FPATH, KSH_ENV, and TCLLIBPATH to the shared host environment denylist, regenerates the macOS policy mirror, and updates focused tests and docs.

PR surface: Source +8, Tests +35, Docs 0, Generated +8. Total +51 across 8 files.

Reproducibility: yes. Current main lacks the four keys in the shared policy, and both node-host and macOS system.run paths reject keys classified by that policy before execution.

Review metrics: 1 noteworthy metric.

Denied Env Keys: 4 added. The patch expands the shared host execution denylist, which is the compatibility-sensitive part maintainers need to accept before merge.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Refresh CI and merge state on the current head before landing.
Have a maintainer or secops reviewer explicitly accept the env compatibility change.

Risk before merge

[P1] Merging intentionally rejects or strips BASHOPTS, FPATH, KSH_ENV, and TCLLIBPATH across shared host env consumers; existing setups that depend on those request-scoped variables will need host or service-level configuration instead.
[P1] The branch base is behind current main; touched files did not move on main, but maintainers should still refresh CI and merge state before landing.

Maintainer options:

Accept The Hardened Denylist (recommended)
Land after maintainer or secops review explicitly accepts that these four request-scoped env overrides are no longer supported and fresh checks are green.
Request A Compatibility Path
If maintainers know legitimate request-scoped uses for these variables, ask for a documented safe path or narrower policy before merge.

Next step before merge

[P2] The remaining action is maintainer acceptance of a compatibility-sensitive security-boundary change, not an automated code repair.

Security
Cleared: The diff narrows the host process environment attack surface through the existing policy mechanism and adds no new dependencies, workflows, secret handling, or code execution paths.

Review details

Best possible solution:

Land the shared policy-data expansion only after maintainers accept the compatibility-sensitive hardening and current CI/merge checks pass.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main lacks the four keys in the shared policy, and both node-host and macOS system.run paths reject keys classified by that policy before execution.

Is this the best way to solve the issue?

Yes, as a patch shape. Updating the shared JSON policy plus the generated Swift mirror keeps the existing owner boundary and avoids new sanitizer control flow, but the compatibility decision still needs maintainer acceptance.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 4c98a547d09a.

Label changes

Label justifications:

P2: This is a normal-priority security hardening PR with focused blast radius and no current evidence of a live broken workflow.
merge-risk: 🚨 compatibility: Existing users who pass BASHOPTS, FPATH, KSH_ENV, or TCLLIBPATH through system.run or related host env surfaces will now see those values rejected or stripped.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The PR body includes after-fix terminal proof using the real node-host system.run handler path and a real spawned process for the safe case.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes after-fix terminal proof using the real node-host system.run handler path and a real spawned process for the safe case.

Evidence reviewed

PR surface:

Source +8, Tests +35, Docs 0, Generated +8. Total +51 across 8 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	2	9	1	+8
Tests	2	232	197	+35
Docs	3	3	3	0
Config	0	0	0	0
Generated	1	8	0	+8
Other	0	0	0	0
Total	8	252	201	+51

Acceptance criteria:

[P1] node scripts/run-vitest.mjs src/infra/host-env-security.test.ts src/infra/host-env-security.policy-parity.test.ts src/infra/host-env-security.reported-baseline.test.ts.
[P1] node scripts/generate-host-env-security-policy-swift.mjs --check.
[P1] git diff --check.

What I checked:

Repository policy read: The root AGENTS.md and scoped docs/AGENTS.md were read; their security-boundary, docs, and compatibility-sensitive review guidance applies to this PR. (AGENTS.md:1, 4c98a547d09a)
Current main policy path: Current main derives dangerous inherited and override key sets from the shared host-env policy and rejects matching override keys before accepting them. (src/infra/host-env-security.ts:190, 4c98a547d09a)
Current main still lacks requested keys: Current main has no BASHOPTS, FPATH, KSH_ENV, or TCLLIBPATH entries under the host-env policy, macOS generated policy, or touched docs, so the PR is not already implemented on main. (src/infra/host-env-security-policy.json:2, 4c98a547d09a)
PR policy change: The PR adds BASHOPTS, KSH_ENV, FPATH, and TCLLIBPATH to blockedEverywhereKeys, which flows into both inherited filtering and request override rejection through the shared loader. (src/infra/host-env-security-policy.json:15, aa22f7a307a5)
Node-host entry point: The node-host system.run path calls inspectHostExecEnvOverrides and returns SYSTEM_RUN_DENIED before execution when rejected override keys are present. (src/node-host/invoke-system-run.ts:421, 4c98a547d09a)
macOS sibling parity: The generated macOS policy mirror contains the same new keys in blocked inherited and blocked override sets used by HostEnvSanitizer. (apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift:31, aa22f7a307a5)

Likely related people:

steipete: Peter Steinberger authored the original startup-file env injection block and later generated host env policy refactor that define this surface. (role: introduced behavior and feature-history owner; confidence: high; commits: 2cdbadee1f8f, 4894d907faa7; files: src/infra/host-env-security.ts, apps/macos/Sources/OpenClaw/HostEnvSanitizer.swift, apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift)
joshavant: Josh Avant authored the later host env override hardening across gateway and node, including the node-host and macOS sanitizer paths this PR extends. (role: recent hardening contributor; confidence: high; commits: 7abfff756d6c; files: src/infra/host-env-security.ts, src/node-host/invoke-system-run.ts, apps/macos/Sources/OpenClaw/HostEnvSanitizer.swift)
Agustin Rivera: Agustin Rivera authored the inherited host exec env filtering alignment that is directly affected by adding keys to blockedEverywhereKeys. (role: adjacent behavior contributor; confidence: medium; commits: fa82193c7273; files: src/infra/host-env-security-policy.json, src/infra/host-env-security.ts)
vincentkoc: Vincent Koc most recently touched the host-env policy and sanitizer files through release/baseline work visible in current blame and log history. (role: recent area contributor; confidence: medium; commits: 2e08f0f4221f, ebb9c6a013b5; files: src/infra/host-env-security-policy.json, src/infra/host-env-security.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

pgondhi987 · 2026-06-09T05:31:28Z

Updated the PR body with real behavior proof for the node-host system.run handler path.

Proof added: pnpm exec tsx /tmp/openclaw-system-run-proof-91618.ts shows the blocked request is denied before execution for BASHOPTS, FPATH, KSH_ENV, and TCLLIBPATH, while a safe OPENCLAW_PROOF_SAFE=ok override reaches a spawned process.

@clawsweeper re-review

clawsweeper · 2026-06-09T05:31:31Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Superseded
Detail: A newer re-review for this item started before this run finished, so GitHub cancelled this older run. Check the latest ClawSweeper run for the current result.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27186015055
Updated: 2026-06-09T05:36:21.853Z

pgondhi987 · 2026-06-09T06:11:02Z

Verification complete for final head aa22f7a307a54f5b053d1d9f2b33e5c44e657ccd.

Behavior fixed: request-scoped host exec env filtering now blocks BASHOPTS, FPATH, KSH_ENV, and TCLLIBPATH through the shared host-env policy, with regenerated macOS policy parity, docs updates, reported-baseline coverage, and sanitizer regression coverage. NODE_REPL_EXTERNAL_MODULE was already blocked on main.

Local / review proof:

node scripts/run-vitest.mjs src/infra/host-env-security.test.ts src/infra/host-env-security.policy-parity.test.ts src/infra/host-env-security.reported-baseline.test.ts -> passed, 34 tests.
node scripts/generate-host-env-security-policy-swift.mjs --check -> passed.
git diff --check -> passed.
OPENCLAW_OPENGREP_BASE_REF=origin/main...HEAD OPENCLAW_OPENGREP_MERGE_HEAD_FIRST_PARENT=1 scripts/run-opengrep.sh --changed --error with OpenGrep 1.22.0 -> passed, 0 findings.
Runtime proof via pnpm exec tsx /tmp/openclaw-system-run-proof-91618.ts -> blocked BASHOPTS, FPATH, KSH_ENV, and TCLLIBPATH overrides before execution; safe env command still executed.
scripts/pr review-tests 91618 src/infra/host-env-security.test.ts src/infra/host-env-security.policy-parity.test.ts src/infra/host-env-security.reported-baseline.test.ts -> passed in review-pr mode.

Gates:

GHSA dry-run after the final source change: PASS (ACCEPT / SOLVES / PASS).
review-pr: passed on aa22f7a307a5, READY FOR /prepare-pr, findings 0, artifacts validated.
autoreview: passed on aa22f7a307a5, clean with no accepted/actionable findings.
GHSA real gate: PASS (ACCEPT / SOLVES / PASS), tracking issue evaluation posted: https://github.com/NVIDIA-dev/openclaw-tracking/issues/735#issuecomment-4656654438.
GitHub CI: clean on aa22f7a307a5, no pending checks, no related failures, mergeable MERGEABLE / CLEAN. One failed-job rerun was needed after runner/harness-inconsistent CI failures; the rerun cleared them. Superseded cancelled routine auto-response / Real behavior proof runs were ignored.

Known proof gap: I did not run the full repository suite locally; GitHub CI and the focused local/review/security checks above are green for the touched surface.

* fix: expand unsafe host env denylist * test: annotate host env security fixtures * test: align opengrep fixture suppressions * test: keep opengrep suppressions inline * test: avoid opengrep fixture call patterns

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

fix: expand unsafe host env denylist

bbd94a7

openclaw-barnacle Bot added docs Improvements or additions to documentation app: macos App: macos plugin: file-transfer size: S maintainer Maintainer-authored PR labels Jun 9, 2026

test: annotate host env security fixtures

d0ae726

pgondhi987 added 3 commits June 9, 2026 05:46

test: align opengrep fixture suppressions

dfccafe

test: keep opengrep suppressions inline

553c94f

test: avoid opengrep fixture call patterns

aa22f7a

openclaw-barnacle Bot added size: M and removed size: S labels Jun 9, 2026

Merge remote-tracking branch 'origin/main' into fix/fix-735

b6a4e02

pgondhi987 merged commit 9f413ac into openclaw:main Jun 9, 2026
1 check passed

github-actions Bot mentioned this pull request Jun 9, 2026

📡 Upstream Digest — 2026-06-09 14:30 UTC curtismercier/openclaw-mods#1045

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: expand unsafe host env denylist#91618

fix: expand unsafe host env denylist#91618
pgondhi987 merged 6 commits into
openclaw:mainfrom
pgondhi987:fix/fix-735

pgondhi987 commented Jun 9, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

pgondhi987 commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

pgondhi987 commented Jun 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

pgondhi987 commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked context

Real behavior proof (required for external PRs)

Tests and validation

Risk checklist

Current review state

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jun 9, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

pgondhi987 commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading