fix(mcp): harden stdio env filtering by eleqtrizit · Pull Request #91751 · openclaw/openclaw

eleqtrizit · 2026-06-09T18:49:39Z

Summary

Harden stdio MCP server environment filtering so configured child-process env drops inherited execution/config pivot variables consistently with OpenClaw host process hardening.

Changes

Adds a dedicated MCP stdio env predicate that keeps existing always-dangerous host env blocking.
Drops inherited child-process config pivots such as Ansible and Terraform config env keys before stdio MCP spawn.
Preserves explicit MCP credential env keys, such as GITHUB_TOKEN, so configured authenticated MCP servers keep working.
Documents the explicit credential allowlist maintenance contract so future policy additions keep credential keys separate from loader/search/config pivots.
Expands resolveMcpTransportConfig coverage for the new dropped and preserved env behavior.

Validation

node scripts/run-vitest.mjs src/agents/mcp-transport-config.test.ts -> 1 file passed, 9 tests passed.
git diff --check -> passed.
git diff origin/main...HEAD --check -> passed.
.agents/skills/autoreview/scripts/autoreview --mode local -> clean, no accepted/actionable findings.
Real MCP stdio proof with an isolated temporary config:
- Command path: OPENCLAW_CONFIG_PATH=<temp>/openclaw.json OPENCLAW_TEST_FAST=1 corepack pnpm openclaw mcp add env-proof ... --no-probe, then OPENCLAW_CONFIG_PATH=<temp>/openclaw.json OPENCLAW_TEST_FAST=1 corepack pnpm openclaw mcp probe env-proof --json.
- Probe result: connected successfully, listed env-proof__ping, diagnostics [].
- Startup warnings: ANSIBLE_CONFIG and TF_CLI_CONFIG_FILE were blocked for stdio startup safety.
- Spawned child proof JSON: ANSIBLE_CONFIG_present=false, TF_CLI_CONFIG_FILE_present=false, GITHUB_TOKEN_present=true, HTTP_PROXY_present=true.

Notes

Compatibility impact is intentional: configured stdio MCP env keys already classified as inherited child-process config pivots are now ignored with the existing startup-safety warning.
Explicit credential env keys and allowed inherited operator env such as GITHUB_TOKEN and HTTP_PROXY continue to pass.
Refs NVIDIA tracking issue: https://github.com/NVIDIA-dev/openclaw-tracking/issues/745

clawsweeper · 2026-06-09T18:52:34Z

Codex review: needs changes before merge. Reviewed June 9, 2026, 5:04 PM ET / 21:04 UTC.

Summary
The PR hardens MCP stdio environment filtering to drop inherited child-process config-pivot variables while preserving selected explicit credential and operator env keys.

PR surface: Source +36, Tests +9. Total +45 across 2 files.

Reproducibility: yes. from source: current main only calls isDangerousHostEnvVarName for MCP stdio env, while ANSIBLE_CONFIG and TF_CLI_CONFIG_FILE are only dangerous through isDangerousHostInheritedEnvVarName. I did not run the live MCP proof locally because this review is read-only, but the contributor's terminal proof matches the inspected code path.

Review metrics: 1 noteworthy metric.

Configured env behavior: 1 documented config surface changed. The patch changes which keys survive under stdio MCP server env config, so upgrade and docs evidence matter before merge.

Merge readiness
Overall: 🦐 gold shrimp
Proof: 🦞 diamond lobster
Patch quality: 🦐 gold shrimp
Result: needs maintainer review before merge.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Update the MCP stdio env safety docs for inherited child-process config pivots.
[P2] Get explicit maintainer acceptance of the compatibility tradeoff before merge.

Risk before merge

[P1] Existing stdio MCP configs that intentionally set inherited child-process config-pivot env keys will stop passing those values to the child process after merge; contributor comments accept this, but the protected maintainer label means a maintainer-owned compatibility decision is still needed.
[P1] The public MCP docs on the PR head still omit the newly blocked inherited config-pivot class, so operators would not see the upgrade behavior before their configured env keys are ignored.

Maintainer options:

Document and approve the hardening tradeoff (recommended)
Update the public MCP stdio env safety docs for inherited config pivots, then have a maintainer explicitly accept the existing-config break before merge.
Preserve compatibility by default
If maintainers do not want existing configured pivot env keys to stop working, redesign this as a compatibility-preserving default plus an explicit strict hardening path.

Next step before merge

[P2] A narrow docs repair is automatable, but merge still needs human maintainer acceptance for the compatibility tradeoff.

Security
Cleared: The diff tightens stdio child-process env filtering and does not add dependency, workflow, package, or secret-handling supply-chain changes.

Review findings

[P1] Gate the env break on maintainer approval — src/agents/mcp-config-shared.ts:102
[P2] Document the expanded stdio env filter — src/agents/mcp-config-shared.ts:102

Review details

Best possible solution:

Land the hardening after docs describe the expanded blocked-key class and a maintainer explicitly accepts the compatibility tradeoff for existing stdio MCP configs.

Do we have a high-confidence way to reproduce the issue?

Yes from source: current main only calls isDangerousHostEnvVarName for MCP stdio env, while ANSIBLE_CONFIG and TF_CLI_CONFIG_FILE are only dangerous through isDangerousHostInheritedEnvVarName. I did not run the live MCP proof locally because this review is read-only, but the contributor's terminal proof matches the inspected code path.

Is this the best way to solve the issue?

No, not as submitted: the code path is a plausible and well-scoped hardening fix, but the best merge-ready solution also updates the public MCP docs and records maintainer acceptance of the compatibility tradeoff.

Full review comments:

[P1] Gate the env break on maintainer approval — src/agents/mcp-config-shared.ts:102
Switching the stdio MCP filter to inherited-dangerous env keys means existing mcp.servers.*.env entries such as ANSIBLE_CONFIG or TF_CLI_CONFIG_FILE will be ignored after merge. The PR author has described that tradeoff, but repo policy treats config/env behavior as compatibility-sensitive and the PR has the protected maintainer label, so this needs explicit maintainer acceptance or a compatibility-preserving design before merge.
Confidence: 0.88
[P2] Document the expanded stdio env filter — src/agents/mcp-config-shared.ts:102
This same filtering change expands the documented mcp.servers.*.env behavior, but the public MCP docs on the PR head still describe only interpreter-startup keys and do not mention inherited child-process config pivots like ANSIBLE_CONFIG or TF_CLI_CONFIG_FILE. Please update docs/cli/mcp.md so operators can see which configured keys are now ignored and why.
Confidence: 0.93

Overall correctness: patch is incorrect
Overall confidence: 0.88

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 21410d1c3247.

Label changes

Label justifications:

P2: The PR is a bounded MCP hardening fix with normal priority and limited blast radius.
merge-risk: 🚨 compatibility: Existing stdio MCP configs that intentionally set inherited config-pivot env keys will stop passing those keys after merge.
rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦞 diamond lobster and patch quality is 🦐 gold shrimp.
status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Sufficient (terminal): The contributor provided after-fix real stdio MCP proof using an isolated config and a spawned child process that showed blocked pivots absent and configured credential/proxy keys present.
proof: sufficient: Contributor real behavior proof is sufficient. The contributor provided after-fix real stdio MCP proof using an isolated config and a spawned child process that showed blocked pivots absent and configured credential/proxy keys present.

Evidence reviewed

PR surface:

Source +36, Tests +9. Total +45 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	38	2	+36
Tests	1	11	2	+9
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	49	4	+45

Acceptance criteria:

[P1] git diff --check.
[P1] git diff origin/main...HEAD --check.

What I checked:

Repository policy applied: Root policy and scoped src/agents/docs guidance were read; root policy treats config/env behavior changes as compatibility-sensitive and docs guidance applies to the missing public MCP documentation. (AGENTS.md:1, 21410d1c3247)
Current main MCP env behavior: Current main only drops keys matched by isDangerousHostEnvVarName for MCP stdio env, so inherited-only pivots such as ANSIBLE_CONFIG and TF_CLI_CONFIG_FILE are not blocked by this path today. (src/agents/mcp-config-shared.ts:66, 21410d1c3247)
Inherited env policy contract: Host env policy marks ANSIBLE_CONFIG and TF_CLI_CONFIG_FILE as inherited-dangerous, and tests assert they are not always-dangerous but are dangerous when inherited. (src/infra/host-env-security-policy.json:224, 21410d1c3247)
PR changes the env predicate: The PR adds an MCP stdio-specific predicate that preserves selected explicit credentials, then applies isDangerousHostInheritedEnvVarName to other keys before stdio spawn config is returned. (src/agents/mcp-config-shared.ts:102, c440454b5b6d)
PR test coverage: The updated focused test covers ANSIBLE_CONFIG and TF_CLI_CONFIG_FILE being dropped while GITHUB_TOKEN and HTTP_PROXY remain present in resolved stdio env. (src/agents/mcp-transport-config.test.ts:51, c440454b5b6d)
Docs gap on PR head: On the PR head, the MCP stdio docs still describe interpreter-startup env keys only; a PR-head grep finds ANSIBLE_CONFIG and TF_CLI_CONFIG_FILE in tests/policy but not in docs. Public docs: docs/cli/mcp.md. (docs/cli/mcp.md:676, c440454b5b6d)

Likely related people:

pgondhi987: Authored and merged the recent host-env denylist and git-protocol env-control hardening that defines the policy this PR is extending into MCP stdio env handling. (role: recent host-env security contributor; confidence: high; commits: 9f413acc183d, 86bab9699d0d; files: src/infra/host-env-security-policy.json, src/infra/host-env-security.ts, src/infra/host-env-security.test.ts)
Peter Steinberger: Recent history shows MCP config documentation refresh work in docs/cli/mcp.md, which is the public doc surface that still needs this PR's expanded env-filter behavior. (role: recent MCP docs contributor; confidence: medium; commits: 6067fe59d821, 1d1c52e6e6c9; files: docs/cli/mcp.md)
vincentkoc: Merged the bot-authored baseline commit that introduced the current MCP config helper files and has recent MCP documentation history near this surface. (role: baseline merger and adjacent docs contributor; confidence: low; commits: e949809f6e3b, c42659176a56, 22ffe7b1debd; files: src/agents/mcp-config-shared.ts, src/agents/mcp-stdio.ts, src/agents/mcp-transport-config.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

eleqtrizit · 2026-06-09T19:19:37Z

Behavioral Proof

Real MCP stdio launch proof on PR head c440454b5b6d71786fea579fde3e0010db948b95 using an isolated temporary OPENCLAW_CONFIG_PATH. The proof server was a real spawned stdio MCP child process; it wrote its own process.env snapshot during tools/list.

Command path run:

OPENCLAW_CONFIG_PATH=<temp>/openclaw.json OPENCLAW_TEST_FAST=1 corepack pnpm openclaw mcp add env-proof \
  --command node \
  --arg=-e \
  --arg '<inline stdio MCP server that writes child process.env proof JSON>' \
  --arg <temp>/proof-output.json \
  --env ANSIBLE_CONFIG=/tmp/evil-ansible.cfg \
  --env TF_CLI_CONFIG_FILE=/tmp/evil-terraform.rc \
  --env GITHUB_TOKEN=<redacted dummy credential> \
  --env HTTP_PROXY=http://proxy.invalid:8080 \
  --no-probe

OPENCLAW_CONFIG_PATH=<temp>/openclaw.json OPENCLAW_TEST_FAST=1 corepack pnpm openclaw mcp probe env-proof --json

Observed OpenClaw startup-safety output from the real probe:

[bundle-mcp] server "env-proof": env "ANSIBLE_CONFIG" is blocked for stdio startup safety and was ignored.
[bundle-mcp] server "env-proof": env "TF_CLI_CONFIG_FILE" is blocked for stdio startup safety and was ignored.

Observed MCP probe result:

{
  "servers": {
    "env-proof": {
      "tools": 1,
      "requestTimeoutMs": 60000
    }
  },
  "tools": ["env-proof__ping"],
  "diagnostics": []
}

Observed child-process proof JSON, written by the spawned stdio MCP server itself:

{
  "keys": {
    "ANSIBLE_CONFIG": {
      "present": false,
      "value": null
    },
    "TF_CLI_CONFIG_FILE": {
      "present": false,
      "value": null
    },
    "GITHUB_TOKEN": {
      "present": true,
      "matchesConfigured": true,
      "value": "<redacted>"
    },
    "HTTP_PROXY": {
      "present": true,
      "matchesConfigured": true,
      "value": "<redacted>"
    }
  }
}

This proves the requested real behavior after OpenClaw config save, MCP transport normalization, SDK default env merge, and stdio spawn(...): inherited child-process config pivots ANSIBLE_CONFIG and TF_CLI_CONFIG_FILE do not reach the child, while an explicit configured credential (GITHUB_TOKEN) still reaches the child.

Compatibility tradeoff: accepted for this hardening PR. Stdio MCP configs that intentionally set inherited child-process config-pivot env keys such as ANSIBLE_CONFIG or TF_CLI_CONFIG_FILE will now have those keys ignored with startup-safety warnings. Explicit credentials and allowed operator env such as GITHUB_TOKEN and HTTP_PROXY continue to pass.

Additional fresh validation:

node scripts/run-vitest.mjs src/agents/mcp-transport-config.test.ts
[test] passed 1 Vitest shard in 3.54s; 1 file passed, 9 tests passed

git diff --check
passed

git diff upstream/main...HEAD --check
passed

eleqtrizit · 2026-06-09T20:27:26Z

Relevance

This PR addresses a verified security hardening gap where MCP stdio child-process environment filtering was less restrictive than OpenClaw's established inherited child-process execution policy. Three independent relevance checks confirmed the gap: toMcpEnvRecord() only called isDangerousHostEnvVarName() (checking always-dangerous vars like NODE_OPTIONS, LD_PRELOAD, BASH_ENV) but did not call isDangerousHostInheritedEnvVarName() (checking inherited-dangerous vars like ANSIBLE_CONFIG, TF_CLI_CONFIG_FILE). The fix aligns MCP stdio env filtering with the existing sanitizeHostInheritedEnvEntry() policy.

Compatibility

A dedicated compatibility check confirmed no exported symbols, type shapes, import paths, CLI commands/flags, gateway protocol messages, plugin SDK surfaces, or config schemas are removed or renamed. The only runtime change is intentional security hardening: configured stdio MCP env keys already classified as dangerous for inherited child-process execution are now dropped before MCP stdio child process launch. Explicit credential env keys (GITHUB_TOKEN, DATABASE_URL, AWS_ACCESS_KEY_ID, etc.) and allowed inherited operator env (HTTP_PROXY, SSH_AUTH_SOCK, HOME, etc.) continue to pass through. The compatibility tradeoff is accepted — these keys already violate the inherited child-process execution policy this PR now applies consistently.

ClawSweeper

ClawSweeper review confirmed the patch quality is sound (platinum hermit) and cleared security/supply-chain concerns. The two blocking items — missing real behavior proof and unconfirmed compatibility tradeoff — have been resolved. Real MCP stdio behavioral proof was produced using an isolated temp config and a live spawned MCP child process, demonstrating that ANSIBLE_CONFIG and TF_CLI_CONFIG_FILE are dropped while GITHUB_TOKEN and HTTP_PROXY remain present. The compatibility tradeoff is explicitly accepted.

Code Reviews Completed

Multiple independent code reviews were conducted, all converging on the same verdict: the fix is correct, well-scoped, and necessary. The sole actionable concern — a hardcoded credential allowlist without a maintenance contract — was addressed with an inline comment documenting the purpose, what to add, what not to add, and how to keep it in sync with the policy JSON.

All Checks Completed

Check	Status
Unit tests (mcp-transport-config)	9/9 passed
Real MCP stdio behavioral proof	Verified — blocked keys absent, credential keys present
Compatibility analysis	No exported surface changed; intentional hardening only
CI checks	All passing (lint, types, security, CodeQL, build artifacts)
Import boundary checks	Clean (src, SDK, test helpers)
Git diff whitespace check	Clean
Autoreview	No accepted/actionable findings
Code review — fix correctness	Fix targets right function, reuses existing policy
Code review — credential allowlist	Maintenance contract documented inline
Code review — test coverage	Validates both dropped and preserved behaviors
Security review	Correctly identifies and fixes a genuine hardening gap
Patch quality (ClawSweeper)	Platinum hermit — implementation is sound
Maintainer compatibility acceptance	Compatibility tradeoff accepted

eleqtrizit · 2026-06-09T20:31:16Z

@clawsweeper re-review

Docs have been updated for the stdio env safety filter to cover child-process config pivots such as ANSIBLE_CONFIG and TF_CLI_CONFIG_FILE, and the compatibility tradeoff is accepted for this hardening change.

clawsweeper · 2026-06-09T20:31:18Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

eleqtrizit · 2026-06-09T20:53:48Z

@clawsweeper re-review

clawsweeper · 2026-06-09T20:53:51Z

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27235226343
Updated: 2026-06-09T21:05:14.538Z

…26.6.6) (#1040) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.5` → `2026.6.6` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.6`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202666) [Compare Source](openclaw/openclaw@v2026.6.5...v2026.6.6) ##### Highlights - Security boundaries are substantially tighter across transcripts, sandbox binds, host environment inheritance, MCP stdio, Codex HTTP access, native search policy, elevated sender checks, deleted-agent ACP bypasses, loopback tools, Discord moderation, and Teams group actions; exec approvals now fail closed on timeout. ([#91529](openclaw/openclaw#91529), [#91618](openclaw/openclaw#91618), [#91615](openclaw/openclaw#91615), [#91619](openclaw/openclaw#91619), [#91741](openclaw/openclaw#91741), [#91745](openclaw/openclaw#91745), [#91746](openclaw/openclaw#91746), [#91748](openclaw/openclaw#91748), [#91749](openclaw/openclaw#91749), [#91750](openclaw/openclaw#91750), [#91751](openclaw/openclaw#91751), [#91752](openclaw/openclaw#91752), [#91763](openclaw/openclaw#91763), [#89938](openclaw/openclaw#89938)) Thanks [@joshavant](https://github.com/joshavant), [@pgondhi987](https://github.com/pgondhi987), [@mmaps](https://github.com/mmaps), [@eleqtrizit](https://github.com/eleqtrizit), [@shakkernerd](https://github.com/shakkernerd), and [@drobison00](https://github.com/drobison00). - Telegram delivery is safer and more coherent: account-scoped topics route to the right agent, streamed text survives tool calls, `/compact` works on generic ingress, callback handling uses concrete APIs, draft chunking is shared, durable dispatch dedupe moved into the SDK, and unauthorized DM text stays out of cache and prompt context. ([#91189](openclaw/openclaw#91189), [#88682](openclaw/openclaw#88682), [#89588](openclaw/openclaw#89588), [#90212](openclaw/openclaw#90212), [#91876](openclaw/openclaw#91876), [#91874](openclaw/openclaw#91874), [#91904](openclaw/openclaw#91904), [#91478](openclaw/openclaw#91478), [#91915](openclaw/openclaw#91915)) Thanks [@codysai001](https://github.com/codysai001), [@alexzhu0](https://github.com/alexzhu0), [@joelnishanth](https://github.com/joelnishanth), [@snowzlm](https://github.com/snowzlm), [@obviyus](https://github.com/obviyus), and [@sallyom](https://github.com/sallyom). - iMessage recovery and delivery now cover always-on inbound restart, durable echo markers, block streaming, idle approval discovery, hardened outbound transport, and actionable inbound startup diagnostics. ([#91335](openclaw/openclaw#91335), [#91449](openclaw/openclaw#91449), [#88969](openclaw/openclaw#88969), [#88530](openclaw/openclaw#88530), [#91783](openclaw/openclaw#91783), [#91785](openclaw/openclaw#91785)) Thanks [@omarshahine](https://github.com/omarshahine), [@jmissig](https://github.com/jmissig), and [@colmbrogan](https://github.com/colmbrogan). - Browser and MCP connectivity gained existing-session CDP support, discovered WebSocket validation, default-profile `cdpUrl` handling, safer browser-output boundaries, Streamable HTTP loopback transport, corrected OAuth/SSE authorization handling, and broader schema compatibility. ([#91422](openclaw/openclaw#91422), [#89851](openclaw/openclaw#89851), [#91736](openclaw/openclaw#91736), [#91747](openclaw/openclaw#91747), [#91451](openclaw/openclaw#91451), [#80143](openclaw/openclaw#80143)) Thanks [@pgondhi987](https://github.com/pgondhi987), [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia), [@lifuyue](https://github.com/lifuyue), [@eleqtrizit](https://github.com/eleqtrizit), [@LiuwqGit](https://github.com/LiuwqGit), and [@HemantSudarshan](https://github.com/HemantSudarshan). - Control UI startup and first-reply latency are lower through cached model metadata, removal of the startup catalog wait, lazy slash-command loading, and first-event tracing with slow-reply diagnostics. ([#91531](openclaw/openclaw#91531), [#91538](openclaw/openclaw#91538), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583), [#91598](openclaw/openclaw#91598)) - Provider support expands with OpenRouter OAuth onboarding and Claude Fable 5 adaptive thinking, while Codex sessions keep correct compaction ownership, local models skip guardian review, dynamic tool progress normalizes cleanly, and Gemma 4 reasoning replay is preserved. ([#91830](openclaw/openclaw#91830), [#91882](openclaw/openclaw#91882), [#91590](openclaw/openclaw#91590), [#88630](openclaw/openclaw#88630), [#88768](openclaw/openclaw#88768), [#91696](openclaw/openclaw#91696)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@joshavant](https://github.com/joshavant), [@bdjben](https://github.com/bdjben), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). ##### Changes - CLI progress: emit Claude CLI commentary progress events and bridge inter-tool commentary into channel progress without exposing internal protocol scaffolding. ([#89834](openclaw/openclaw#89834), [#90883](openclaw/openclaw#90883)) Thanks [@anagnorisis2peripeteia](https://github.com/anagnorisis2peripeteia). - Observability: allow trusted diagnostics channels to capture tool input/output content, add first-assistant-event traces, and warn on slow initial replies. ([#91256](openclaw/openclaw#91256), [#91568](openclaw/openclaw#91568), [#91583](openclaw/openclaw#91583)) Thanks [@amknight](https://github.com/amknight). - Plugins/ClawHub: dogfood reusable package publishing, let dry runs skip publish approval, allow declared installed trusted hooks, report managed plugin version drift, and warn instead of failing on retired Skill Workshop configuration. ([#91574](openclaw/openclaw#91574), [#91591](openclaw/openclaw#91591), [#90004](openclaw/openclaw#90004), [#90927](openclaw/openclaw#90927), [#90838](openclaw/openclaw#90838)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen), [@brokemac79](https://github.com/brokemac79), and [@lonexreb](https://github.com/lonexreb). - Memory/providers: move the local llama.cpp runtime into its provider plugin, batch embeddings across files, persist the agent model catalog cache, and keep QMD JSON search one-shot while filtering stale REM recall previews. ([#91324](openclaw/openclaw#91324), [#89138](openclaw/openclaw#89138), [#90457](openclaw/openclaw#90457), [#91837](openclaw/openclaw#91837), [#91851](openclaw/openclaw#91851)) Thanks [@osolmaz](https://github.com/osolmaz), [@mushuiyu886](https://github.com/mushuiyu886), [@ai-hpc](https://github.com/ai-hpc), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Channels/mobile: add the QQBot group mention toggle, improve iPad and iPhone control surfaces, and expose the active connection host in the TUI footer. ([#91423](openclaw/openclaw#91423), [#91557](openclaw/openclaw#91557), [#89909](openclaw/openclaw#89909)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh), [@Solvely-Colin](https://github.com/Solvely-Colin), and [@baskduf](https://github.com/baskduf). - Performance: prewarm TUI runtime plugins, deduplicate plugin auto-enable fanout, trim dense text-delta snapshots, and reuse prepared startup model metadata. ([#90782](openclaw/openclaw#90782), [#89978](openclaw/openclaw#89978), [#91580](openclaw/openclaw#91580), [#91531](openclaw/openclaw#91531)) Thanks [@RomneyDa](https://github.com/RomneyDa) and [@ai-hpc](https://github.com/ai-hpc). ##### Fixes - Agent/session recovery: drop stale approval follow-ups after session rebind, remove drained reply-queue items by identity, recover stale main and visible replies, preserve Codex context-engine compaction ownership, lower the default compaction timeout to 180 seconds while respecting explicit configuration, and keep provider-failure terminal lifecycle state correct. ([#85679](openclaw/openclaw#85679), [#91450](openclaw/openclaw#91450), [#91566](openclaw/openclaw#91566), [#91840](openclaw/openclaw#91840), [#91590](openclaw/openclaw#91590), [#91361](openclaw/openclaw#91361), [#91895](openclaw/openclaw#91895)) Thanks [@openperf](https://github.com/openperf), [@yetval](https://github.com/yetval), [@joshavant](https://github.com/joshavant), [@wangmiao0668000666](https://github.com/wangmiao0668000666), and [@TurboTheTurtle](https://github.com/TurboTheTurtle). - User-visible content boundaries: suppress Codex/Harmony protocol artifacts, neutralize browser and LanceDB memory media directives, redact transcript images, and preserve native `/compact` replies through source suppression. ([#89151](openclaw/openclaw#89151), [#91422](openclaw/openclaw#91422), [#91425](openclaw/openclaw#91425), [#91529](openclaw/openclaw#91529), [#90212](openclaw/openclaw#90212)) Thanks [@joelnishanth](https://github.com/joelnishanth), [@pgondhi987](https://github.com/pgondhi987), [@joshavant](https://github.com/joshavant), and [@snowzlm](https://github.com/snowzlm). - Channel delivery: keep WhatsApp captured replies attached to the successor controller after restart, retry Feishu rate limits, preserve Mattermost thread replies, canonicalize LINE webhook paths, restore Discord reply hydration and runtime timeout exports, and show OpenAI Realtime WebRTC assistant transcripts. ([#85823](openclaw/openclaw#85823), [#89659](openclaw/openclaw#89659), [#91684](openclaw/openclaw#91684), [#91649](openclaw/openclaw#91649), [#90263](openclaw/openclaw#90263), [#91686](openclaw/openclaw#91686), [#90426](openclaw/openclaw#90426)) Thanks [@itsuzef](https://github.com/itsuzef), [@ladygege](https://github.com/ladygege), [@jacobtomlinson](https://github.com/jacobtomlinson), [@fuller-stack-dev](https://github.com/fuller-stack-dev), and [@shushushv](https://github.com/shushushv). - Cron: cancel active task runs cleanly, preserve terminal timeout/cancel state, and recover no-deliver tool warnings instead of silently losing the outcome. ([#90666](openclaw/openclaw#90666), [#90678](openclaw/openclaw#90678)) Thanks [@ai-hpc](https://github.com/ai-hpc). - Gateway/config/auth: share the approval runtime socket token, replace arrays explicitly in `config.patch`, skip the deleted-agent guard only for valid ACP harness sessions, surface headless LaunchAgent state, verify SQLite auth migration before cleanup, and arm QMD startup maintenance. ([#87105](openclaw/openclaw#87105), [#91551](openclaw/openclaw#91551), [#91219](openclaw/openclaw#91219), [#91614](openclaw/openclaw#91614), [#91740](openclaw/openclaw#91740), [#91978](openclaw/openclaw#91978)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev) and [@scotthuang](https://github.com/scotthuang). - Providers/Codex: clarify quota errors, restore the Codex synthetic usage line, canonicalize Codex protocol assets, require API-key auth for realtime voice, normalize ACP model refs, preserve Gemma 4 `reasoning_content`, and avoid guardian review for local models. ([#91390](openclaw/openclaw#91390), [#91709](openclaw/openclaw#91709), [#91507](openclaw/openclaw#91507), [#91567](openclaw/openclaw#91567), [#88630](openclaw/openclaw#88630), [#91696](openclaw/openclaw#91696)) Thanks [@hxy91819](https://github.com/hxy91819), [@brokemac79](https://github.com/brokemac79), [@RomneyDa](https://github.com/RomneyDa), [@joshavant](https://github.com/joshavant), and [@Coder-Wangyankun](https://github.com/Coder-Wangyankun). - Updates/builds: recover package Gateway restarts after refresh failure, expose plugin convergence repair, fall back to Corepack in PATH-less pnpm environments, seed the correct Docker store packages, and keep ClawHub dry-run and publish paths reusable. ([#91581](openclaw/openclaw#91581), [#91599](openclaw/openclaw#91599), [#91547](openclaw/openclaw#91547), [#91591](openclaw/openclaw#91591)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev), [@sallyom](https://github.com/sallyom), and [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - UI: require explicit user intent before opening chat sessions and drain restored chat queues after session switches. ([#91480](openclaw/openclaw#91480)) Thanks [@TurboTheTurtle](https://github.com/TurboTheTurtle). - Android: avoid the `dataSync` foreground-service type for persistent nodes. ([#80082](openclaw/openclaw#80082)) Thanks [@davelutztx](https://github.com/davelutztx). - Native hooks: bound relay lifetimes so abandoned native hook connections cannot linger indefinitely. ([#91550](openclaw/openclaw#91550)) Thanks [@joshavant](https://github.com/joshavant). </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/1040

openclaw-barnacle Bot added agents Agent runtime and tooling size: S maintainer Maintainer-authored PR labels Jun 9, 2026

fix(mcp): harden stdio env filtering

c440454

eleqtrizit force-pushed the 745 branch from c5a904e to c440454 Compare June 9, 2026 19:11

eleqtrizit merged commit 314de69 into openclaw:main Jun 9, 2026
189 of 194 checks passed

github-actions Bot mentioned this pull request Jun 9, 2026

📡 Upstream Digest — 2026-06-09 21:46 UTC curtismercier/openclaw-mods#1048

Open

github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jun 10, 2026

fix(mcp): harden stdio env filtering (openclaw#91751)

94e2655

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(mcp): harden stdio env filtering#91751

fix(mcp): harden stdio env filtering#91751
eleqtrizit merged 1 commit into
openclaw:mainfrom
eleqtrizit:745

eleqtrizit commented Jun 9, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

eleqtrizit commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Validation

Notes

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 9, 2026

Behavioral Proof

Uh oh!

eleqtrizit commented Jun 9, 2026

Relevance

Compatibility

ClawSweeper

Code Reviews Completed

All Checks Completed

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

eleqtrizit commented Jun 9, 2026

Uh oh!

clawsweeper Bot commented Jun 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

eleqtrizit commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading

clawsweeper Bot commented Jun 9, 2026 •

edited

Loading