fix: block git protocol env controls [AI] by pgondhi987 · Pull Request #91619 · openclaw/openclaw

pgondhi987 · 2026-06-09T05:14:14Z

Summary

Blocks request-scoped Git protocol-control environment variables in the shared host environment security policy.
Filters inherited GIT_ALLOW_PROTOCOL to Git safe default protocols and preserves inherited GIT_PROTOCOL_FROM_USER only when keeping it does not make Git more permissive, including false-like and malformed fail-closed values.
Keeps the macOS sanitizer and generated policy in parity with the shared TypeScript policy.
Adds focused sanitizer coverage plus live Git regressions for ext:: helper execution and restrictive allowlist non-widening.
AI-assisted.

Out of scope: broader host environment policy reshaping, config changes, and unrelated Git transport policy changes.

Linked context

Security maintainer-requested host environment hardening. Private tracking context intentionally omitted from the PR body.

Real behavior proof (required for external PRs)

Behavior addressed: Git protocol-control environment variables are blocked or filtered before host execution so inherited or request-scoped env cannot loosen Git transport policy.
Real environment tested: Local source checkout on Linux with system Git, Node/Vitest wrapper, core test-type lane, and local OpenGrep changed-path scan.
Exact steps or command run after this patch: node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo; node scripts/run-vitest.mjs src/infra/host-env-security.test.ts src/infra/host-env-security.reported-baseline.test.ts src/infra/host-env-security.policy-parity.test.ts; node scripts/generate-host-env-security-policy-swift.mjs --check; scripts/run-opengrep.sh --changed --json; git diff --check.
Evidence after fix: 3 Vitest files passed, 40 tests passed; generated Swift policy check passed; local changed-path OpenGrep reported 0 findings; GitHub PR checks passed on the final head.
Observed result after fix: Regression tests prove unsafe env can execute a Git ext:: helper before sanitization, while sanitized env blocks that path; inherited allowlists are filtered without widening local file transport access; inherited fail-closed GIT_PROTOCOL_FROM_USER values are preserved.
What was not tested: Full cross-platform package/release packaging.
Proof limitations or environment constraints: No live channel/provider credentials were used; this is a host-exec sanitizer boundary.
Before evidence: The prior policy did not include the two Git protocol-control variables in the blocked key set.

Tests and validation

node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo
node scripts/run-vitest.mjs src/infra/host-env-security.test.ts src/infra/host-env-security.reported-baseline.test.ts src/infra/host-env-security.policy-parity.test.ts
node scripts/generate-host-env-security-policy-swift.mjs --check
scripts/run-opengrep.sh --changed --json
git diff --check
Review-pr: passed on final head with zero findings.
Autoreview: passed on final head with no accepted/actionable findings.
GitHub PR checks: passed on final head.

Risk checklist

Did user-visible behavior change? (Yes/No): No.

Did config, environment, or migration behavior change? (Yes/No): Yes, host execution now blocks or filters two additional Git-related environment variables.

Did security, auth, secrets, network, or tool execution behavior change? (Yes/No): Yes, host tool execution environment sanitization is stricter for Git transport policy controls.

What is the highest-risk area?

Operators who intentionally relied on passing permissive Git protocol-control variables into OpenClaw-spawned host Git commands will no longer get that behavior.

How is that risk mitigated?

The blocked variables directly alter Git transport policy. The change lands in the existing host-env security policy boundary, keeps generated macOS parity, preserves inherited fail-closed restrictions, and adds focused regression coverage.

Current review state

Next action: maintainer review/merge.

Waiting on: None known.

Bot or reviewer comments addressed: Review-pr and autoreview findings were addressed; final review-pr and autoreview are clean.

clawsweeper · 2026-06-09T05:16:04Z

Codex review: needs real behavior proof before merge. Reviewed June 9, 2026, 11:09 AM ET / 15:09 UTC.

Summary
Adds Git protocol-control environment blocking/filtering to shared host environment sanitization and macOS policy parity, with regression coverage for Git ext:: and file-transport behavior.

PR surface: Source +59, Tests +340, Generated +4, Other +44. Total +447 across 9 files.

Reproducibility: yes. source-reproducible: current main lacks both Git protocol-control variables in the host env policy, and the PR adds focused Git regression tests for ext::, file transport non-widening, and forced-off GIT_PROTOCOL_FROM_USER. I did not run the Git regressions locally in this read-only review.

Review metrics: 1 noteworthy metric.

Git protocol env policy: 2 variables added to blocked/filtering policy. GIT_ALLOW_PROTOCOL and GIT_PROTOCOL_FROM_USER change host Git execution behavior and need maintainer-visible compatibility/security acceptance before merge.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦪 silver shellfish
Patch quality: 🦞 diamond lobster
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add redacted real host-exec or macOS app terminal/log output showing GIT_ALLOW_PROTOCOL and GIT_PROTOCOL_FROM_USER are stripped, narrowed, or forced after the patch.
Get maintainer/security owner acceptance of the compatibility tradeoff for operators relying on permissive Git protocol env controls.

Proof guidance:

[P1] Needs real behavior proof before merge: The PR body lists tests, CI, generated-policy check, and OpenGrep, but not redacted terminal/live output from an actual OpenClaw host-exec or macOS app path; add proof, redact private data, update the PR body for re-review, or ask a maintainer to comment @clawsweeper re-review.

Risk before merge

[P1] Merging intentionally tightens inherited and request-scoped Git protocol environment behavior; operator setups relying on permissive GIT_ALLOW_PROTOCOL or GIT_PROTOCOL_FROM_USER in OpenClaw-spawned host Git commands may fail closed after upgrade.
[P1] The external real behavior proof is still tests, CI, and static-analysis text rather than redacted terminal/live output from an actual OpenClaw host-exec or macOS app path after the patch.
[P1] The PR has the protected maintainer label and private security-maintainer context, so the compatibility and security-boundary tradeoff needs explicit maintainer handling before merge.

Maintainer options:

Require proof and owner acceptance (recommended)
Before merge, get maintainer/security-owner acceptance of the stricter Git protocol policy and add redacted real host-exec or macOS output showing the sanitizer behavior after the patch.
Accept the stricter policy deliberately
Maintainers can intentionally accept the operator compatibility break because the variables directly alter Git transport security policy.
Pause for a narrower policy
If maintainers do not want to break permissive inherited Git protocol controls, pause this PR and design an explicit opt-in or narrower owner-approved policy instead.

Next step before merge

[P1] Human maintainer handling is required for the protected label, security-boundary policy acceptance, compatibility tradeoff, and external real behavior proof gate.

Security
Cleared: No concrete supply-chain or new security regression was found; the diff tightens an existing host-exec sanitizer boundary while leaving a maintainer policy decision before merge.

Review details

Best possible solution:

Land the focused sanitizer hardening after maintainer/security owner acceptance and redacted real host-exec or macOS proof confirms the Git env variables are stripped, narrowed, or forced in an actual OpenClaw path.

Do we have a high-confidence way to reproduce the issue?

Yes, source-reproducible: current main lacks both Git protocol-control variables in the host env policy, and the PR adds focused Git regression tests for ext::, file transport non-widening, and forced-off GIT_PROTOCOL_FROM_USER. I did not run the Git regressions locally in this read-only review.

Is this the best way to solve the issue?

Yes, this appears to be the right boundary: the shared host env policy plus macOS parity is narrower and more maintainable than caller-specific Git handling. The remaining blockers are maintainer/security acceptance and real behavior proof, not a definite code defect.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 7cdec2870604.

Label changes

Label justifications:

P1: This is urgent host-execution security hardening with a compatibility-sensitive fail-closed behavior change.
merge-risk: 🚨 compatibility: Existing operator workflows that intentionally pass permissive Git protocol controls into OpenClaw-spawned Git commands may stop working after merge.
merge-risk: 🚨 security-boundary: The diff changes the host execution sanitizer boundary for Git transport policy controls, which requires explicit security-policy acceptance.
rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦪 silver shellfish and patch quality is 🦞 diamond lobster.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR body lists tests, CI, generated-policy check, and OpenGrep, but not redacted terminal/live output from an actual OpenClaw host-exec or macOS app path; add proof, redact private data, update the PR body for re-review, or ask a maintainer to comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +59, Tests +340, Generated +4, Other +44. Total +447 across 9 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	4	70	11	+59
Tests	3	549	209	+340
Docs	0	0	0	0
Config	0	0	0	0
Generated	1	4	0	+4
Other	1	44	0	+44
Total	9	667	220	+447

What I checked:

Repository policy read: Root AGENTS.md was read fully; its PR review guidance treats env/default/security-boundary changes as compatibility-sensitive and requires scoped code, tests, current behavior, and dependency-contract review. (AGENTS.md:1, 7cdec2870604)
Scoped agents policy read: The touched agent runtime path has a scoped AGENTS.md focused on keeping runtime imports and agent test coverage bounded; this review applied it when checking the bash exec runtime test addition. (src/agents/AGENTS.md:1, 7cdec2870604)
Current main lacks the new Git env policy: Current main has no GIT_ALLOW_PROTOCOL or GIT_PROTOCOL_FROM_USER entries in the host env policy, sanitizer, macOS sanitizer, or adjacent tests, so the PR is not already implemented on main. (src/infra/host-env-security-policy.json:1, 7cdec2870604)
Shared sanitizer change: The PR adds sanitizeHostInheritedEnvEntry, filters inherited GIT_ALLOW_PROTOCOL to Git safe default protocols, and forces permissive GIT_PROTOCOL_FROM_USER values to 0; sanitizeHostExecEnvWithDiagnostics now routes inherited entries through that helper. (src/infra/host-env-security.ts:177, c422f19b48c8)
Host exec caller parity: The bash host-exec helper now uses the shared inherited-env sanitizer instead of duplicating dangerous inherited key checks, keeping agent host execution aligned with the infra sanitizer. (src/agents/bash-tools.exec-runtime.ts:96, c422f19b48c8)
Policy and macOS parity: The PR adds both Git protocol-control variables to the shared policy JSON, generated Swift policy, and macOS sanitizer logic, preserving cross-surface parity for the host environment boundary. (apps/macos/Sources/OpenClaw/HostEnvSanitizer.swift:27, c422f19b48c8)

Likely related people:

steipete: Peter Steinberger centralized the host env policy and authored several early security hardening commits in this path; shortlog shows the largest share of history across the central files. (role: feature owner / original area contributor; confidence: high; commits: f202e73077a2, 2cdbadee1f8f, e80c803fa887; files: src/infra/host-env-security.ts, src/infra/host-env-security-policy.json, apps/macos/Sources/OpenClaw/HostEnvSanitizer.swift)
vincentkoc: Vincent Koc is the current-main blame owner for the host env sanitizer file in this checkout and previously landed Git helper/env hardening in the same security surface. (role: recent area contributor; confidence: high; commits: b3c946999d71, 1dcef7b64452, 276ee259ca2d; files: src/infra/host-env-security.ts, src/infra/host-env-security.test.ts)
pgondhi987: pgondhi987/Pavan Kumar Gondhi has recent merged host-env and Git env hardening commits in current main and authored earlier inherited Git env denylist work in this path. (role: recent adjacent contributor; confidence: medium; commits: bc3b05dce4b2, 9f413acc183d, 7cdec2870604; files: src/infra/host-env-security-policy.json, src/infra/host-env-security.test.ts, src/infra/host-env-security.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

pgondhi987 · 2026-06-09T06:59:22Z

Final verification for head a1beddf76b79811c810d75b31af02110bcc3d4fa:

Security dry-run gate: passed (ACCEPT / SOLVES / BC PASS, zero actionable bot comments).
Security real gate: passed.
Review-pr: passed, READY FOR /prepare-pr, zero findings, artifacts validated.
Autoreview: passed, no accepted/actionable findings.
Local validation: passed:
- node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo
- node scripts/run-vitest.mjs src/infra/host-env-security.test.ts src/infra/host-env-security.reported-baseline.test.ts src/infra/host-env-security.policy-parity.test.ts
- node scripts/generate-host-env-security-policy-swift.mjs --check
- scripts/run-opengrep.sh --changed --json
- git diff --check
GitHub PR checks: passed on the final head; latest statusCheckRollup had no relevant non-success checks.
Conflict check: GitHub reports mergeable with no file conflicts.

Behavior change: request-scoped Git protocol-control env vars are blocked before host execution, inherited GIT_ALLOW_PROTOCOL is filtered to Git safe defaults, and inherited GIT_PROTOCOL_FROM_USER preserves fail-closed restrictions instead of widening Git's default behavior. Regression risk is low and targeted to the existing host-env sanitizer boundary; no API, CLI, config, migration, or wire contract changed.

# Conflicts: # src/infra/host-env-security.reported-baseline.json # src/infra/host-env-security.reported-baseline.test.ts # src/infra/host-env-security.test.ts

pgondhi987 · 2026-06-09T15:19:56Z

Final verification for PR #91619

Behavior addressed: request-scoped Git protocol-control environment variables are now blocked before host exec env overrides are merged. Inherited GIT_ALLOW_PROTOCOL is filtered down to Git safe default protocols, inherited permissive GIT_PROTOCOL_FROM_USER values are forced to 0, and the shared inherited-env sanitizer is used by both sanitizeHostExecEnv and the bash exec runtime. The macOS sanitizer and generated policy are aligned with the TypeScript policy.

Head verified: c422f19b48c8a4dd65edaaa2e3bd0028ec475269.

Gate results:

GHSA dry-run: passed (ACCEPT / SOLVES / BC PASS, zero actionable bot comments).
GHSA real gate: passed (ACCEPT / SOLVES / BC PASS, zero actionable bot comments).
review-pr: passed, READY FOR /prepare-pr, zero findings, artifacts validated.
autoreview: passed clean with no accepted/actionable findings.
PR CI: relevant checks passed on the verified head; one cancelled auto-response run was ignored as routine workflow noise.

Local validation run:

node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.core.test.json --incremental --tsBuildInfoFile .artifacts/tsgo-cache/core-test.tsbuildinfo
node scripts/run-vitest.mjs src/infra/host-env-security.test.ts src/infra/host-env-security.reported-baseline.test.ts src/infra/host-env-security.policy-parity.test.ts src/agents/bash-tools.exec-runtime.test.ts
node scripts/generate-host-env-security-policy-swift.mjs --check
scripts/run-opengrep.sh --changed --json
git diff --check

Real environment tested: local source checkout with Git 2.34.1 behavior probes plus GitHub Actions PR CI. The direct Git probe confirmed GIT_PROTOCOL_FROM_USER=1 git clone ... succeeds, GIT_PROTOCOL_FROM_USER=0 git clone ... fails, and unset behavior is permissive, which is why the sanitizer now forces inherited permissive values to 0 instead of dropping them.

Best-fix judgment: this is the right boundary for the issue. The patch updates the shared host env security policy and shared inherited-env sanitizer instead of adding one-off caller logic, and it covers the sibling bash exec base-env path plus the macOS host sanitizer.

Regression risk: targeted host env security hardening. This intentionally changes Git protocol env handling for host exec, but it does not change public CLI/API contracts, config schema/defaults, wire formats, auth policy, approval flow, sandbox policy, storage, provider routing, plugin contracts, or channel behavior. This aligns with SECURITY.md by treating the affected surface as a trusted-operator host exec boundary and closing the demonstrated protocol-control bypass.

What was not tested: no live external remote/provider scenario and no Crabbox/Testbox run. Focused local tests, direct Git behavior proof, GHSA gates, review-pr, autoreview, and GitHub Actions CI were used for this PR.

* fix: block git protocol env controls * fix: preserve restrictive git protocol env * fix: preserve restrictive git allowlists * fix: filter inherited git protocol allowlists * test: cover restrictive git allowlists * test: avoid opengrep fixture false positives * test: type env fixture helper narrowly * fix: preserve zero git protocol booleans * fix: preserve invalid git protocol booleans * fix: force git protocol from user off * fix: share git inherited env sanitization

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

fix: block git protocol env controls

56d263f

openclaw-barnacle Bot added app: macos App: macos size: S maintainer Maintainer-authored PR labels Jun 9, 2026

pgondhi987 added 2 commits June 9, 2026 05:29

fix: preserve restrictive git protocol env

bb5daaf

fix: preserve restrictive git allowlists

5894e12

openclaw-barnacle Bot added size: M and removed size: S labels Jun 9, 2026

pgondhi987 added 2 commits June 9, 2026 05:50

fix: filter inherited git protocol allowlists

b1b9f35

test: cover restrictive git allowlists

e5d4ce2

test: avoid opengrep fixture false positives

ec8b192

openclaw-barnacle Bot added size: L and removed size: M labels Jun 9, 2026

pgondhi987 added 3 commits June 9, 2026 06:28

test: type env fixture helper narrowly

c22d91d

fix: preserve zero git protocol booleans

4843b7b

fix: preserve invalid git protocol booleans

a1beddf

Merge remote-tracking branch 'origin/main' into fix/fix-737

7c0c757

# Conflicts: # src/infra/host-env-security.reported-baseline.json # src/infra/host-env-security.reported-baseline.test.ts # src/infra/host-env-security.test.ts

pgondhi987 added 2 commits June 9, 2026 14:39

Merge remote-tracking branch 'origin/main' into fix/fix-737

bbad9b0

# Conflicts: # src/infra/host-env-security.reported-baseline.json # src/infra/host-env-security.reported-baseline.test.ts # src/infra/host-env-security.test.ts

fix: force git protocol from user off

5f691df

clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels Jun 9, 2026

fix: share git inherited env sanitization

c422f19

openclaw-barnacle Bot added the agents Agent runtime and tooling label Jun 9, 2026

pgondhi987 assigned steipete Jun 9, 2026

Merge remote-tracking branch 'origin/main' into fix/fix-737

5de0064

pgondhi987 merged commit 86bab96 into openclaw:main Jun 9, 2026

github-actions Bot mentioned this pull request Jun 9, 2026

📡 Upstream Digest — 2026-06-09 17:53 UTC curtismercier/openclaw-mods#1046

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: block git protocol env controls [AI]#91619

fix: block git protocol env controls [AI]#91619
pgondhi987 merged 14 commits into
openclaw:mainfrom
pgondhi987:fix/fix-737

pgondhi987 commented Jun 9, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

pgondhi987 commented Jun 9, 2026

Uh oh!

pgondhi987 commented Jun 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

pgondhi987 commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Linked context

Real behavior proof (required for external PRs)

Tests and validation

Risk checklist

Current review state

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pgondhi987 commented Jun 9, 2026

Uh oh!

pgondhi987 commented Jun 9, 2026

Final verification for PR #91619

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pgondhi987 commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading