Vincent Koc
|
b7615e0ce3
|
Exec/ACP: inject OPENCLAW_SHELL into child shell env (#31271)
* exec: mark runtime shell context in exec env
* tests(exec): cover OPENCLAW_SHELL in gateway exec
* tests(exec): cover OPENCLAW_SHELL in pty mode
* acpx: mark runtime shell context for spawned process
* tests(acpx): log OPENCLAW_SHELL in runtime fixture
* tests(acpx): assert OPENCLAW_SHELL in runtime prompt
* docs(env): document OPENCLAW_SHELL runtime markers
* docs(exec): describe OPENCLAW_SHELL exec marker
* docs(acp): document OPENCLAW_SHELL acp marker
* docs(gateway): note OPENCLAW_SHELL for background exec
* tui: tag local shell runs with OPENCLAW_SHELL
* tests(tui): assert OPENCLAW_SHELL in local shell runner
* acp client: tag spawned bridge env with OPENCLAW_SHELL
* tests(acp): cover acp client OPENCLAW_SHELL env helper
* docs(env): include acp-client and tui-local shell markers
* docs(acp): document acp-client OPENCLAW_SHELL marker
* docs(tui): document tui-local OPENCLAW_SHELL marker
* exec: keep shell runtime env string-only for docker args
* changelog: note OPENCLAW_SHELL runtime markers
|
2026-03-01 20:31:06 -08:00 |
|
Peter Steinberger
|
63dcd28ae0
|
fix(acp): harden permission tool-name validation
|
2026-02-24 01:11:34 +00:00 |
|
Peter Steinberger
|
12cc754332
|
fix(acp): harden permission auto-approval policy
|
2026-02-24 01:03:30 +00:00 |
|
Peter Steinberger
|
9f2b25426b
|
test(core): increase coverage for sessions, auth choice, and model listing
|
2026-02-22 14:08:51 +00:00 |
|
Peter Steinberger
|
4508b818a1
|
fix(acp): escape C0/C1 controls in resource link metadata
|
2026-02-22 08:16:38 +01:00 |
|
Peter Steinberger
|
6aa11f3092
|
fix(acp): harden resource link metadata formatting
|
2026-02-21 13:00:02 +01:00 |
|
Peter Steinberger
|
63e39d7f57
|
fix(security): harden ACP prompt size guardrails
|
2026-02-19 15:41:01 +01:00 |
|
cpojer
|
c4bd82d81d
|
chore: Fix types in tests 39/N.
|
2026-02-17 15:50:07 +09:00 |
|
Peter Steinberger
|
02124094bf
|
perf(test): fold acp event mapper tests into client suite
|
2026-02-16 02:45:00 +00:00 |
|
Peter Steinberger
|
153a7644ea
|
fix(acp): tighten safe kind inference
|
2026-02-14 13:18:49 +01:00 |
|
Peter Steinberger
|
bb1c3dfe10
|
fix(acp): prompt for non-read/search permissions
|
2026-02-14 12:53:27 +01:00 |
|
Peter Steinberger
|
ee31cd47b4
|
fix: close OC-02 gaps in ACP permission + gateway HTTP deny config (#15390) (thanks @aether-ai-agent)
|
2026-02-13 14:30:06 +01:00 |
|
aether-ai-agent
|
749e28dec7
|
fix(security): block dangerous tools from HTTP gateway and fix ACP auto-approval (OC-02)
Two critical RCE vectors patched:
Vector 1 - Gateway HTTP /tools/invoke:
- Add DEFAULT_GATEWAY_HTTP_TOOL_DENY blocking sessions_spawn,
sessions_send, gateway, whatsapp_login from HTTP invocation
- Apply deny filter after existing policy cascade, before tool lookup
- Add gateway.tools.{allow,deny} config override in GatewayConfig
Vector 2 - ACP client auto-approval:
- Replace blind allow_once selection with danger-aware permission handler
- Dangerous tools (exec, sessions_spawn, etc.) require interactive confirmation
- Safe tools retain auto-approve behavior (backward compatible)
- Empty options array now denied (was hardcoded "allow")
- 30s timeout auto-denies to prevent hung sessions
CWE-78 | CVSS:3.1 9.8 Critical
|
2026-02-13 14:30:06 +01:00 |
|