Skip to content

fix: block Cloud SDK workspace env controls [AI]#103918

Merged
pgondhi987 merged 5 commits into
openclaw:mainfrom
mmaps:fix/fix-857
Jul 14, 2026
Merged

fix: block Cloud SDK workspace env controls [AI]#103918
pgondhi987 merged 5 commits into
openclaw:mainfrom
mmaps:fix/fix-857

Conversation

@mmaps

@mmaps mmaps commented Jul 10, 2026

Copy link
Copy Markdown
Contributor

What Problem This Solves

Fixes an issue where users operating in an untrusted workspace could have workspace .env entries influence Google Cloud SDK launch controls during Gmail setup.

AI-assisted PR.

Why This Change Was Made

Workspace .env loading now blocks the CLOUDSDK_ namespace so Google Cloud SDK runtime controls cannot be imported from project-local env files. Gmail setup also clears inherited Cloud SDK Python argument controls when spawning gcloud, and the shared process env merge now honors explicit undefined overrides as removals.

User Impact

Users can run Gmail setup from a workspace without allowing that workspace's .env file to steer the Python launcher or its argument handling for gcloud. Normal user-defined non-control workspace env keys still load, and trusted global env files remain available for user-level configuration.

Evidence

  • node scripts/run-vitest.mjs src/infra/dotenv.test.ts src/hooks/gmail-setup-utils.test.ts src/process/exec.test.ts --reporter=verbose
  • Result: 3 Vitest shards passed: Gmail setup utilities 6/6, dotenv 35/35, process exec 20/20.
  • git diff --check
  • Result: clean.
  • Remote Testbox warmup was unavailable in this session because the Crabbox wrapper failed its binary sanity check before allocation.

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jul 10, 2026
@clawsweeper

clawsweeper Bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed July 13, 2026, 1:11 PM ET / 17:11 UTC.

Summary
Blocks workspace-loaded CLOUDSDK_* variables, removes inherited Cloud SDK Python arguments from Gmail gcloud launches, and makes explicit undefined child-environment overrides remove inherited keys.

PR surface: Source +3, Tests +34. Total +37 across 6 files.

Reproducibility: yes. at source level: current main loads Cloud SDK controls beyond CLOUDSDK_PYTHON and ignores the Gmail caller's explicit inherited-key removal. The after-fix real gcloud path was demonstrated, although no live before-fix exploit transcript was captured.

Review metrics: 2 noteworthy metrics.

  • Workspace environment boundary: 1 namespace newly blocked. CLOUDSDK_* controls configuration, authentication, project selection, properties, and launch behavior, so this is a compatibility-sensitive trust-boundary change.
  • Child environment semantics: 1 shared override contract changed. Explicit undefined values now remove inherited variables for all subprocess callers rather than being ignored.

Root-cause cluster
Relationship: canonical
Canonical: #103918
Summary: This PR is the active canonical follow-up for Cloud SDK workspace controls left outside the earlier Gmail gcloud hardening.

Members:

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🐚 platinum hermit
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

  • none.

Risk before merge

  • [P1] Project-local .env values such as CLOUDSDK_CONFIG, active configuration, project, account, and other gcloud properties will intentionally stop affecting OpenClaw; users relying on them must move the values to a trusted shell or global OpenClaw dotenv source.
  • [P1] The shared environment merge changes undefined from a no-op to an explicit removal for every subprocess caller, so the process-runtime contract should be accepted alongside the Gmail security fix.

Maintainer options:

  1. Approve the fail-closed boundary (recommended)
    Merge after the Gmail/process owner accepts the full workspace namespace reservation and shared environment-removal semantics.
  2. Narrow before merge
    Replace the prefix with an owner-approved list only if project-local Cloud SDK configuration is an intended OpenClaw workflow.

Next step before merge

  • [P2] A Gmail/process-runtime history owner should explicitly accept the full workspace namespace reservation and shared removal contract; no contributor-facing repair or proof work remains.

Maintainer decision needed

  • Question: Should OpenClaw reserve the complete CLOUDSDK_* namespace from untrusted workspace .env files and treat explicit undefined child-environment values as removal requests?
  • Rationale: The broader rule closes current and future Cloud SDK control injection, but it deliberately removes project-local gcloud configuration and changes shared subprocess environment semantics.
  • Likely owner: steipete — They introduced and repeatedly maintained the Gmail setup and gcloud execution path, making them the strongest available owner for the final boundary decision.
  • Options:
    • Reserve the full namespace (recommended): Accept the fail-closed workspace boundary and shared removal contract while documenting trusted shell or global dotenv sources as the supported alternative.
    • Enumerate dangerous controls: Preserve selected project-local Cloud SDK settings but maintain a complete dangerous-key list and narrower subprocess sanitization tests.

Security
Cleared: The patch tightens an existing subprocess trust boundary and adds no dependency, permission, secret-access, download, publishing, or supply-chain surface.

Review details

Best possible solution:

Reserve the complete CLOUDSDK_* workspace namespace, retain trusted shell and global dotenv configuration, and keep explicit child-environment removal as the single subprocess sanitization contract.

Do we have a high-confidence way to reproduce the issue?

Yes at source level: current main loads Cloud SDK controls beyond CLOUDSDK_PYTHON and ignores the Gmail caller's explicit inherited-key removal. The after-fix real gcloud path was demonstrated, although no live before-fix exploit transcript was captured.

Is this the best way to solve the issue?

Yes technically: namespace-level filtering matches Cloud SDK's extensible environment-control model, and shared undefined removal implements the caller's existing sanitization intent without introducing a parallel execution path.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 1c5e35f59011.

Label changes

Label justifications:

  • P0: An untrusted workspace can currently influence a credentialed setup subprocess and Python launcher arguments, creating a security-boundary bypass with potential code execution.
  • merge-risk: 🚨 compatibility: Merging intentionally disables project-local CLOUDSDK_* configuration and changes shared subprocess handling of undefined overrides.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): Exact-head live output with Google Cloud CLI 575.0.1 shows the injected Python arguments were blocked while benign workspace values and real gcloud execution continued to work.
  • proof: sufficient: Contributor real behavior proof is sufficient. Exact-head live output with Google Cloud CLI 575.0.1 shows the injected Python arguments were blocked while benign workspace values and real gcloud execution continued to work.
Evidence reviewed

PR surface:

Source +3, Tests +34. Total +37 across 6 files.

View PR surface stats
Area Files Added Removed Net
Source 3 10 7 +3
Tests 3 36 2 +34
Docs 0 0 0 0
Config 0 0 0 0
Generated 0 0 0 0
Other 0 0 0 0
Total 6 46 9 +37

What I checked:

  • Current-main workspace gap: Current main blocks only CLOUDSDK_PYTHON; other Cloud SDK controls still pass the workspace dotenv prefix filter. (github.com) (src/infra/dotenv.ts:109, 1c5e35f59011)
  • Namespace hardening: The PR replaces the single-key rule with a case-insensitive CLOUDSDK_ prefix reservation for untrusted workspace dotenv input. (github.com) (src/infra/dotenv.ts:183, 3a189a8a7726)
  • Gmail subprocess boundary: Current main sanitizes only CLOUDSDK_PYTHON; the PR additionally removes inherited CLOUDSDK_PYTHON_ARGS before every Gmail gcloud invocation. (github.com) (src/hooks/gmail-setup-utils.ts:153, 3a189a8a7726)
  • Shared removal contract: Current main ignores undefined overrides during environment merging; the patch deletes the inherited key, including case-insensitive Windows variants, with focused regression coverage. (github.com) (src/process/exec.ts:30, 3a189a8a7726)
  • Real behavior proof: The contributor's exact-head live output used Google Cloud CLI 575.0.1, observed that injected Python arguments did not execute, and confirmed benign workspace variables plus real gcloud --version launches still worked. (github.com) (src/hooks/gmail-setup-utils.ts:153, 3a189a8a7726)
  • Upstream Cloud SDK contract: Google documents that CLOUDSDK_* variables select configurations and override gcloud properties including project and account-related behavior, confirming that the namespace is operationally significant. (docs.cloud.google.com)

Likely related people:

  • pgondhi987: Authored the merged hardening that established the existing Cloud SDK workspace and Gmail subprocess security boundary this PR extends. (role: introduced behavior; confidence: high; commits: 86251f43916d; files: src/infra/dotenv.ts, src/hooks/gmail-setup-utils.ts, src/hooks/gmail-setup-utils.test.ts)
  • eleqtrizit: Recent merged work on workspace dotenv runtime-control and namespace hardening closely matches the fail-closed pattern used here. (role: adjacent security boundary contributor; confidence: high; commits: 018494fa3ebb, dbfcef319618; files: src/infra/dotenv.ts, src/infra/dotenv.test.ts)
  • steipete: Introduced the Gmail hooks workflow and the gcloud Python-resolution path, with several subsequent refactors in the same module. (role: original feature author; confidence: high; commits: 523d9ec, 5de3395, 3d23103; files: src/hooks/gmail-setup-utils.ts)
What the crustacean ranks mean
  • 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
  • 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
  • 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
  • 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
  • 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
  • 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
  • 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works
  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.
Review history (5 earlier review cycles)
  • reviewed 2026-07-10T20:05:53.525Z sha 3a189a8 :: needs real behavior proof before merge. :: none
  • reviewed 2026-07-10T21:47:42.391Z sha 3a189a8 :: needs maintainer review before merge. :: none
  • reviewed 2026-07-13T16:16:02.140Z sha 8b369de :: needs maintainer review before merge. :: none
  • reviewed 2026-07-13T16:36:03.813Z sha 8b369de :: needs maintainer review before merge. :: none
  • reviewed 2026-07-13T16:53:17.874Z sha 8b369de :: needs maintainer review before merge. :: none

@mmaps

mmaps commented Jul 10, 2026

Copy link
Copy Markdown
Contributor Author

ClawSweeper proof for current head 3a189a8a77267c5c398f2db53eccc4a5b0976d7e

Behavior proved: workspace .env Cloud SDK controls do not reach the Gmail setup gcloud subprocess, and a direct gcloud launch still works.

Environment: local PR checkout at the exact head above, Node v22.22.2, official Google Cloud CLI Linux tarball from dl.google.com, Google Cloud SDK 575.0.1 (core 2026.07.07, bundled Python 3.14.5). Remote Testbox/Crabbox was not available in this session because the repo wrapper failed its binary sanity check before allocation.

Command/artifact:

  • PATH=/tmp/openclaw-857-google-cloud-sdk/bin:$PATH gcloud --version
  • OPENCLAW_PROOF_HEAD=$(git rev-parse HEAD) corepack pnpm exec tsx /tmp/openclaw-857-gcloud-proof.ts
  • Output artifact: /tmp/openclaw-857-gcloud-proof.out

Evidence:

  • denied/blocked: DENIED=workspace CLOUDSDK_* controls blocked; inherited CLOUDSDK_PYTHON_ARGS marker absent; protected sink/source result: no subprocess exec used the injected Python args, and the marker file was not written.
  • positive benign control: CONTROL=SAFE_GCLOUD_PROOF loaded and benign gcloud --version completed twice; intended behavior result: the real gcloud --version subprocess exec succeeds after the fix, and a non-control workspace env key still loads.
  • entry point: src/hooks/gmail-setup-utils.ts runGcloud(['--version']), reached through the production dotenv loader and Gmail gcloud wrapper rather than a leaf-only helper.

Compatibility/operator note: project-local .env files no longer provide CLOUDSDK_* controls to OpenClaw, and Gmail setup clears Cloud SDK Python argument controls before launching gcloud. This proof did not change auth, approvals, sandboxing, storage, provider routing, plugin loading, channel delivery, or migrations.

Live gaps: no Gmail account OAuth, Pub/Sub topic creation, or live mailbox watch was exercised. The proof uses the direct real gcloud launch path ClawSweeper requested and avoids credentials or account data.

@mmaps

mmaps commented Jul 10, 2026

Copy link
Copy Markdown
Contributor Author

@clawsweeper re-review

@clawsweeper

clawsweeper Bot commented Jul 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

@clawsweeper clawsweeper Bot added proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. and removed rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jul 10, 2026
@clawsweeper clawsweeper Bot added P0 Emergency: data loss, security bypass, crash loop, or unusable core runtime. and removed P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. labels Jul 13, 2026
@pgondhi987
pgondhi987 merged commit 99ca359 into openclaw:main Jul 14, 2026
21 of 24 checks passed
@steipete steipete mentioned this pull request Jul 14, 2026
Closed
@github-actions github-actions Bot mentioned this pull request Jul 14, 2026
Open
@Yigtwxx Yigtwxx mentioned this pull request Jul 14, 2026
Closed
github-actions Bot pushed a commit to Desicool/openclaw that referenced this pull request Jul 15, 2026
@mmaps @pgondhi987
fix: block cloud sdk workspace env controls (openclaw#103918)
953a99f 
Co-authored-by: Pavan Kumar Gondhi <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

merge-risk: 🚨 compatibility 🚨 May break existing users, config, migrations, defaults, or upgrade paths. P0 Emergency: data loss, security bypass, crash loop, or unusable core runtime. proof: sufficient ClawSweeper judged the real behavior proof convincing. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. size: S status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@mmaps @pgondhi987