fix(cli): guard secrets plan JSON.parse against malformed input by krissding · Pull Request #109721 · openclaw/openclaw

krissding · 2026-07-17T06:36:41Z

What Problem This Solves

readPlanFile() in src/cli/secrets-cli.ts reads a user-specified plan file and calls JSON.parse() on it without a try-catch. If the file is malformed (corrupted on disk, truncated, or hand-edited), the raw SyntaxError is not user-actionable.

This follows the established pattern from #98660 (solodmd) and #98587 (lsr911) for guarding JSON.parse against malformed input.

Evidence

Test

src/cli/secrets-cli.test.ts — 16 tests pass, including 1 new test:
- "shows a user-friendly error when the secrets plan file is malformed JSON" — verifies that malformed JSON produces a message containing "Malformed JSON in secrets plan file:" instead of a raw SyntaxError

CI

 Test Files  1 passed (1)
      Tests  16 passed (16)

Merge Risk

Low. +6 lines in a private helper function, throws a descriptive Error with the malformed JSON cause preserved via { cause: err }.

readPlanFile reads a user-specified file and parses it with JSON.parse without a try-catch. A malformed or corrupted plan file produces a raw SyntaxError that is not user-actionable. Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

clawsweeper · 2026-07-17T06:54:13Z

Codex review: needs real behavior proof before merge. Reviewed July 17, 2026, 4:56 AM ET / 08:56 UTC.

Summary
The PR catches malformed secrets-plan JSON, reports the plan path in a descriptive CLI error, preserves the parse error as the cause, and adds regression coverage.

PR surface: Source +5, Tests +14. Total +19 across 2 files.

Reproducibility: yes. at source level: passing malformed JSON through secrets apply --from reaches an unguarded JSON.parse on current main. A real current-main command run was not supplied, so this is source-reproducible rather than directly reproduced here.

Review metrics: none identified.

Stored data model
Persistent data-model change detected: serialized state: src/cli/secrets-cli.test.ts, serialized state: src/cli/secrets-cli.ts. Confirm migration or upgrade compatibility proof before merge.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🧂 unranked krab
Patch quality: 🐚 platinum hermit
Result: blocked until real behavior proof from a real setup is added.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

[P1] Add a redacted after-fix terminal transcript or screenshot showing the malformed-plan command, descriptive error, and non-application result.

Proof guidance:

[P1] Needs real behavior proof before merge: Only the mocked Commander regression test and CI output are supplied; add a redacted terminal run showing malformed openclaw secrets apply --from <file> input produces the new message without applying anything. After updating the PR body, a fresh review should trigger automatically; otherwise ask a maintainer to comment @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Risk before merge

[P1] No contributor-run evidence yet confirms the final terminal-visible message and exit behavior in a real OpenClaw CLI setup.

Maintainer options:

Decide the mitigation before merge
Keep the path-specific parse guard and regression test, with the final CLI behavior demonstrated by a redacted real terminal run before merge.
Pause or close
Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

[P1] No automated code repair remains; wait for contributor-owned real CLI proof, then complete ordinary maintainer review and exact-head checks.

Security
Cleared: The two-file patch adds no dependency, permission, secret exposure, execution, persistence, or supply-chain surface and preserves the underlying parse error only as an internal cause.

Review details

Best possible solution:

Keep the path-specific parse guard and regression test, with the final CLI behavior demonstrated by a redacted real terminal run before merge.

Do we have a high-confidence way to reproduce the issue?

Yes at source level: passing malformed JSON through secrets apply --from reaches an unguarded JSON.parse on current main. A real current-main command run was not supplied, so this is source-reproducible rather than directly reproduced here.

Is this the best way to solve the issue?

Yes. Wrapping the existing parse boundary, preserving the cause, and leaving plan-schema validation unchanged is the narrowest maintainable fix; the updated test exercises the public CLI entry point.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 07a36f6eda75.

Label changes

Label justifications:

P2: This fixes a real but bounded CLI diagnostic failure with limited runtime blast radius.
rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: Only the mocked Commander regression test and CI output are supplied; add a redacted terminal run showing malformed openclaw secrets apply --from <file> input produces the new message without applying anything. After updating the PR body, a fresh review should trigger automatically; otherwise ask a maintainer to comment @clawsweeper re-review. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence reviewed

PR surface:

Source +5, Tests +14. Total +19 across 2 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	1	6	1	+5
Tests	1	16	2	+14
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	2	22	3	+19

What I checked:

Current-main bug path: At current main, readPlanFile() reads the user-selected file and passes its contents directly to JSON.parse, so malformed input produces an uncontextualized parse error before plan validation. (src/cli/secrets-cli.ts:56, 07a36f6eda75)
Narrow runtime repair: The PR head wraps only the existing parse operation, adds the plan pathname to the error, and retains the original error through cause; schema validation remains unchanged. (src/cli/secrets-cli.ts:56, fcdc48d47a65)
Regression coverage: The added test passes malformed contents through the actual Commander secrets apply --from entry point, verifies the runtime error text, and confirms that apply execution is not invoked. (src/cli/secrets-cli.test.ts:388, fcdc48d47a65)
Prior finding resolved: The updated withPlanFile helper accepts custom contents while retaining its finally cleanup, resolving the earlier review finding about leaving the malformed temporary plan behind. (src/cli/secrets-cli.test.ts:128, fcdc48d47a65)
Feature provenance: External secrets management and the secrets apply --from workflow entered main through the merged external-secrets implementation, making its author a strong routing candidate for the plan contract and CLI behavior. (src/cli/secrets-cli.ts:1, 47fc6a0806d6)
Current proof state: The PR body supplies one focused test run, while the supplied discussion and timeline contain no contributor terminal transcript, logs, recording, or linked artifact showing the changed command after the fix. (fcdc48d47a65)

Likely related people:

joshavant: Authored the merged external-secrets implementation that introduced the secrets plan and secrets apply --from workflow. (role: introduced behavior; confidence: high; commits: 47fc6a0806d6; files: src/cli/secrets-cli.ts, src/secrets/plan.ts)
steipete: Authored the latest PR-head commit tightening the malformed-plan regression coverage and temporary-file handling. (role: recent area contributor; confidence: high; commits: fcdc48d47a65; files: src/cli/secrets-cli.test.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (2 earlier review cycles)

reviewed 2026-07-17T06:51:12.596Z sha 9cbd8ff :: needs real behavior proof before merge. :: [P3] Clean up the temporary secrets plan file
reviewed 2026-07-17T07:33:04.663Z sha 9cbd8ff :: needs real behavior proof before merge. :: [P3] Remove the temporary plan file after the test

Co-authored-by: 丁宇婷0668001435 <[email protected]>

steipete · 2026-07-17T09:00:40Z

Merged via squash.

Prepared head SHA: fcdc48d47a652649774b27f7563d6777249d3d39
Landed commit: af469c85cf6c5ce6ba83319b3d7366fb39023dfa

…claw#109721) * fix(cli): guard secrets plan JSON.parse against malformed input readPlanFile reads a user-specified file and parses it with JSON.parse without a try-catch. A malformed or corrupted plan file produces a raw SyntaxError that is not user-actionable. Co-Authored-By: Claude Sonnet 4.6 <[email protected]> * test: tighten malformed secrets plan proof Co-authored-by: 丁宇婷0668001435 <[email protected]> --------- Co-authored-by: Claude Sonnet 4.6 <[email protected]> Co-authored-by: Peter Steinberger <[email protected]>

openclaw-barnacle Bot added cli CLI command changes size: XS labels Jul 17, 2026

krissding force-pushed the fix/guard-secrets-plan-json-parse branch from 209a618 to 9cbd8ff Compare July 17, 2026 06:44

krissding mentioned this pull request Jul 17, 2026

fix: guard JSON.parse against malformed network response bodies #109754

Open

test: tighten malformed secrets plan proof

fcdc48d

Co-authored-by: 丁宇婷0668001435 <[email protected]>

steipete merged commit af469c8 into openclaw:main Jul 17, 2026
112 of 114 checks passed

This was referenced Jul 17, 2026

fix(promotions): guard JSON.parse against corrupt DB data #109883

Open

fix(proxy): guard JSON.parse in proxy error response parsing #109884

Open

github-actions Bot mentioned this pull request Jul 17, 2026

📡 Upstream Digest — 2026-07-17 09:48 UTC curtismercier/openclaw-mods#1321

Open

krissding mentioned this pull request Jul 17, 2026

fix(cli): guard plugins JSON.parse against malformed input #109935

Closed

Monkey-wusky mentioned this pull request Jul 17, 2026

fix(workspaces): guard layout JSON.parse against malformed input #109747

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(cli): guard secrets plan JSON.parse against malformed input#109721

fix(cli): guard secrets plan JSON.parse against malformed input#109721
steipete merged 2 commits into
openclaw:mainfrom
krissding:fix/guard-secrets-plan-json-parse

krissding commented Jul 17, 2026

Uh oh!

clawsweeper Bot commented Jul 17, 2026 •

edited

Loading

Uh oh!

Uh oh!

steipete commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Uh oh!

Conversation

krissding commented Jul 17, 2026

What Problem This Solves

Evidence

Test

CI

Merge Risk

Uh oh!

clawsweeper Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

steipete commented Jul 17, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clawsweeper Bot commented Jul 17, 2026 •

edited

Loading