negodiy/openclaw
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

feat(secrets): allow opt-in symlink exec command paths

Browse Source
This commit is contained in:
joshavant
2026-02-25 23:25:23 -06:00
committed by Peter Steinberger
parent 06290b49b2
commit f46b9c996f
9 changed files with 222 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/gateway/configuration-reference.md
View File

@@ -2444,7 +2444,9 @@ Validation:
Notes:
- `file` provider supports `mode: "json"` and `mode: "singleValue"` (`id` must be `"value"` in singleValue mode).
- `exec` provider requires an absolute non-symlink `command` path and uses protocol payloads on stdin/stdout.
- `exec` provider requires an absolute `command` path and uses protocol payloads on stdin/stdout.
- By default, symlink command paths are rejected. Set `allowSymlinkCommand: true` to allow symlink paths while validating the resolved target path.
- If `trustedDirs` is configured, the trusted-dir check applies to the resolved target path.
- `exec` child environment is minimal by default; pass required variables explicitly with `passEnv`.
- Secret refs are resolved at activation time into an in-memory snapshot, then request paths read the snapshot only.