feat(exec): mark child command env with OPENCLAW_CLI by vincentkoc · Pull Request #41411 · openclaw/openclaw

vincentkoc · 2026-03-09T20:26:05Z

Summary

Problem: child shell/exec processes had no stable env marker to identify OpenClaw-originated invocations across host exec helpers, node-host system.run, and sandboxed command surfaces.
Why it matters: downstream tools cannot reliably strip OpenClaw-specific token spam or adjust behavior only when launched by OpenClaw.
What changed: added a shared OPENCLAW_CLI=1 marker helper and applied it at CLI startup, host exec env sanitization, generic runCommandWithTimeout env resolution, and sandbox Docker env injection, plus focused regression tests.
What did NOT change (scope boundary): no command output shaping or token filtering logic was added in this PR; this only establishes the marker consistently.
AI-assisted: yes. Testing: focused tests run locally.

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

Closes #
Related #

User-visible / Behavior Changes

Child processes launched by OpenClaw now receive OPENCLAW_CLI=1, including host exec flows and Docker sandboxes.

Security Impact (required)

New permissions/capabilities? (Yes/No) No
Secrets/tokens handling changed? (Yes/No) No
New/changed network calls? (Yes/No) No
Command/tool execution surface changed? (Yes/No) Yes
Data access scope changed? (Yes/No) No
If any Yes, explain risk + mitigation:
This changes child-process environment contents by adding a single non-secret marker variable. Risk is limited to tooling that reacts to the presence of OPENCLAW_CLI; mitigation is the value is explicit, stable, and covered by focused tests on host env sanitization, generic exec env resolution, and sandbox env creation.

Repro + Verification

Environment

OS: macOS
Runtime/container: Node 22 / pnpm workspace
Model/provider: N/A
Integration/channel (if any): N/A
Relevant config (redacted): default local dev config

Steps

Launch OpenClaw CLI or any flow that reaches runCommandWithTimeout, node-host system.run, or sandbox container creation.
Inspect the child environment or sandbox create args.
Verify OPENCLAW_CLI=1 is present.

Expected

OpenClaw-launched child commands and sandbox containers carry a stable OPENCLAW_CLI=1 marker.

Actual

Before this change, no general-purpose marker was injected consistently across those execution paths.

Evidence

Attach at least one:

Failing test/log before + passing after
Trace/log snippets
Screenshot/recording
Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

Verified scenarios: ran pnpm test src/process/exec.test.ts src/infra/host-env-security.test.ts src/agents/sandbox-create-args.test.ts in the PR worktree; all passed.
Edge cases checked: host env sanitization still blocks dangerous overrides while preserving the marker; sandbox env creation still sanitizes env vars and now includes the marker.
What you did not verify: full-repo test suite, live downstream consumer logic that strips spam based on the marker.

Review Conversations

I replied to or resolved every bot review conversation I addressed in this PR.
I left unresolved only the conversations that still need reviewer or maintainer judgment.

If a bot review conversation is addressed by this PR, resolve that conversation yourself. Do not leave bot review conversation cleanup for maintainers.

Compatibility / Migration

Backward compatible? (Yes/No) Yes
Config/env changes? (Yes/No) Yes
Migration needed? (Yes/No) No
If yes, exact upgrade steps:

Failure Recovery (if this breaks)

How to disable/revert this change quickly: revert commit 536a572
Files/config to restore: exec env helper wiring in src/entry.ts, src/infra/host-env-security.ts, src/process/exec.ts, and src/agents/sandbox/docker.ts
Known bad symptoms reviewers should watch for: downstream tooling unexpectedly changing behavior whenever OPENCLAW_CLI is present.

Risks and Mitigations

Risk: some downstream command/tooling may already use OPENCLAW_CLI for an unrelated purpose.
- Mitigation: the variable name is explicit to OpenClaw and is now documented in the PR body; if collision appears, the wiring is isolated and easy to rename.

greptile-apps · 2026-03-09T23:15:42Z

Greptile Summary

This PR introduces a consistent OPENCLAW_CLI=1 environment marker across all OpenClaw-managed child execution paths — CLI startup (entry.ts), host exec env sanitization (host-env-security.ts), generic command exec (exec.ts), and Docker sandbox container creation (docker.ts). The change is narrow in scope and well-isolated via a new shared openclaw-exec-env.ts helper, with focused regression tests for each injection point.

One issue found:

Docker path: marker injected before sanitization (src/agents/sandbox/docker.ts:369) — markOpenClawExecEnv is applied to cfg.env before it is passed to sanitizeEnvVars. The sandbox sanitizer's ALLOWED_ENV_VAR_PATTERNS allowlist does not include OPENCLAW_CLI, so if sanitizeEnvVars is ever called with strictMode: true at this site, the marker would be silently stripped and appear in the blocked-variable warning log. Every other injection point in this PR correctly applies markOpenClawExecEnv after sanitization; the Docker path should do the same.

Confidence Score: 3/5

Safe to merge with the low risk of the Docker pre-sanitization ordering becoming a latent bug if strictMode is enabled in the future.
The overall approach is sound and the three injection points in host-env-security.ts, exec.ts, and entry.ts are implemented correctly. The Docker path has an inconsistent ordering where the marker is added before sanitization, which works today (strictMode is false) but would silently drop the marker if strictMode were ever enabled. This reduces confidence from a clean 4-5 to a 3.
src/agents/sandbox/docker.ts — marker injection should be moved to after sanitizeEnvVars, consistent with all other injection points in this PR.

_{Last reviewed commit: 71febcc}

greptile-apps · 2026-03-09T23:15:46Z

src/agents/sandbox/docker.ts

    args.push("--user", params.cfg.user);
  }
-  const envSanitization = sanitizeEnvVars(params.cfg.env ?? {});
+  const envSanitization = sanitizeEnvVars(markOpenClawExecEnv(params.cfg.env ?? {}));


Marker injected before sanitization — fragile ordering

markOpenClawExecEnv is called on the raw cfg.env input before it is passed to sanitizeEnvVars. The sanitizer's ALLOWED_ENV_VAR_PATTERNS allowlist does not include OPENCLAW_CLI, so if sanitizeEnvVars is ever invoked with strictMode: true (or any caller adds that option at this call-site), OPENCLAW_CLI will be classified as a blocked variable, a warning will be emitted ("Blocked sensitive environment variables: OPENCLAW_CLI"), and the marker will be silently dropped from the container environment — exactly the opposite of the intended behaviour.

All other injection points in this PR (host-env-security.ts, exec.ts) correctly apply markOpenClawExecEnv after sanitization. The Docker path should follow the same pattern:

Suggested change

const envSanitization = sanitizeEnvVars(markOpenClawExecEnv(params.cfg.env ?? {}));

const envSanitization = sanitizeEnvVars(params.cfg.env ?? {});

Then apply the marker after sanitization, immediately before pushing --env args:

for (const [key, value] of Object.entries(markOpenClawExecEnv(envSanitization.allowed))) { args.push("--env", `${key}=${value}`); }

This also makes the test in sandbox-create-args.test.ts correctly reflect the real execution path.

Prompt To Fix With AI

This is a comment left during a code review. Path: src/agents/sandbox/docker.ts Line: 369 Comment: **Marker injected before sanitization — fragile ordering** `markOpenClawExecEnv` is called on the raw `cfg.env` input **before** it is passed to `sanitizeEnvVars`. The sanitizer's `ALLOWED_ENV_VAR_PATTERNS` allowlist does not include `OPENCLAW_CLI`, so if `sanitizeEnvVars` is ever invoked with `strictMode: true` (or any caller adds that option at this call-site), `OPENCLAW_CLI` will be classified as a blocked variable, a warning will be emitted ("Blocked sensitive environment variables: OPENCLAW_CLI"), and the marker will be silently dropped from the container environment — exactly the opposite of the intended behaviour. All other injection points in this PR (`host-env-security.ts`, `exec.ts`) correctly apply `markOpenClawExecEnv` **after** sanitization. The Docker path should follow the same pattern: ```suggestion const envSanitization = sanitizeEnvVars(params.cfg.env ?? {}); ``` Then apply the marker after sanitization, immediately before pushing `--env` args: ```typescript for (const [key, value] of Object.entries(markOpenClawExecEnv(envSanitization.allowed))) { args.push("--env", `${key}=${value}`); } ``` This also makes the test in `sandbox-create-args.test.ts` correctly reflect the real execution path. How can I resolve this? If you propose a fix, please make it concise.

* main: (33 commits) Exec: mark child command env with OPENCLAW_CLI (openclaw#41411) fix(plugins): expose model auth API to context-engine plugins (openclaw#41090) Add HTTP 499 to transient error codes for model fallback (openclaw#41468) Logging: harden probe suppression for observations (openclaw#41338) fix(discord): apply effective maxLinesPerMessage in live replies (openclaw#40133) build(protocol): regenerate Swift models after pending node work schemas (openclaw#41477) Agents: add fallback error observations (openclaw#41337) acp: harden follow-up reliability and attachments (openclaw#41464) fix(agents): probe single-provider billing cooldowns (openclaw#41422) acp: add regression coverage and smoke-test docs (openclaw#41456) acp: forward attachments into ACP runtime sessions (openclaw#41427) acp: enrich streaming updates for ide clients (openclaw#41442) Sandbox: import STATE_DIR from paths directly (openclaw#41439) acp: restore session context and controls (openclaw#41425) acp: fail honestly in bridge mode (openclaw#41424) Gateway: tighten node pending drain semantics (openclaw#41429) Gateway: add pending node work primitives (openclaw#41409) fix(auth): reset cooldown error counters on expiry to prevent infinite escalation (openclaw#41028) fix(cron): do not misclassify empty/NO_REPLY as interim acknowledgement (openclaw#41401) iOS: reconnect gateway on foreground return (openclaw#41384) ...

- environment.md: add OPENCLAW_CLI=1 runtime marker (landed in openclaw#41411 without docs update) - acp.md: document --provenance flag with off/meta/meta+receipt modes (landed in openclaw#40473 without Options section update) - onboarding.md: document remote gateway token field added in 6b338dd - gmail-pubsub.md: standardize hook token to ${OPENCLAW_HOOKS_TOKEN} to match webhook.md (was using literal "OPENCLAW_HOOK_TOKEN")

(cherry picked from commit b48291e)

Exec: mark child command env with OPENCLAW_CLI

536a572

vincentkoc self-assigned this Mar 9, 2026

openclaw-barnacle bot added docker Docker and sandbox tooling agents Agent runtime and tooling size: XS maintainer Maintainer-authored PR labels Mar 9, 2026

vincentkoc marked this pull request as ready for review March 9, 2026 23:13

Merge branch 'main' into vincentkoc-code/openclaw-cli-env-marker

71febcc

vincentkoc changed the title ~~[AI-assisted] Exec: mark child command env with OPENCLAW_CLI~~ feat(exec): mark child command env with OPENCLAW_CLI Mar 9, 2026

vincentkoc merged commit b48291e into openclaw:main Mar 9, 2026
25 of 26 checks passed

vincentkoc deleted the vincentkoc-code/openclaw-cli-env-marker branch March 9, 2026 23:14

greptile-apps bot reviewed Mar 9, 2026

View reviewed changes

github-actions bot mentioned this pull request Mar 10, 2026

📡 Upstream Digest — 2026-03-10 01:16 UTC curtismercier/openclaw-mods#224

Open

hougangdev mentioned this pull request Mar 10, 2026

docs: fix stale documentation for recent features #41613

Open

3 tasks

ademczuk pushed a commit to ademczuk/openclaw that referenced this pull request Mar 10, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

e50319b

mukhtharcm pushed a commit to hnykda/openclaw that referenced this pull request Mar 10, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

f714c98

jenawant pushed a commit to jenawant/openclaw that referenced this pull request Mar 10, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

29adf37

vincentkoc mentioned this pull request Mar 10, 2026

fix(sandbox): sanitize Docker env before marking OPENCLAW_CLI #42256

Merged

20 tasks

aiwatching pushed a commit to aiwatching/openclaw that referenced this pull request Mar 10, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

86e4d6f

alexey-pelykh mentioned this pull request Mar 10, 2026

Cherry-pick: Tool re-exposure under restrictive profiles, skill download roots remoteclaw/remoteclaw#922

Closed

4 tasks

Moshiii pushed a commit to Moshiii/openclaw that referenced this pull request Mar 11, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

cc8a4d6

Moshiii pushed a commit to Moshiii/openclaw that referenced this pull request Mar 11, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

3b3bdb9

dominicnunez pushed a commit to dominicnunez/openclaw that referenced this pull request Mar 11, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

3c6b48c

dhoman pushed a commit to dhoman/chrono-claw that referenced this pull request Mar 11, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

25aecb2

Ruijie-Ysp pushed a commit to Ruijie-Ysp/clawdbot that referenced this pull request Mar 12, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

af92d54

qipyle pushed a commit to qipyle/openclaw that referenced this pull request Mar 12, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

d767576

senw-developers pushed a commit to senw-developers/va-openclaw that referenced this pull request Mar 17, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

352dcd8

V-Gutierrez pushed a commit to V-Gutierrez/openclaw-vendor that referenced this pull request Mar 17, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

40708da

alexey-pelykh pushed a commit to remoteclaw/remoteclaw that referenced this pull request Mar 22, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

d9c5044

(cherry picked from commit b48291e)

alexey-pelykh pushed a commit to remoteclaw/remoteclaw that referenced this pull request Mar 22, 2026

Exec: mark child command env with OPENCLAW_CLI (openclaw#41411)

5833fd3

(cherry picked from commit b48291e)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(exec): mark child command env with OPENCLAW_CLI#41411

feat(exec): mark child command env with OPENCLAW_CLI#41411
vincentkoc merged 2 commits intoopenclaw:mainfrom
vincentkoc:vincentkoc-code/openclaw-cli-env-marker

vincentkoc commented Mar 9, 2026

Uh oh!

Uh oh!

greptile-apps bot commented Mar 9, 2026

Uh oh!

greptile-apps bot Mar 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	const envSanitization = sanitizeEnvVars(markOpenClawExecEnv(params.cfg.env ?? {}));
	const envSanitization = sanitizeEnvVars(params.cfg.env ?? {});

Uh oh!

Conversation

vincentkoc commented Mar 9, 2026

Summary

Change Type (select all)

Scope (select all touched areas)

Linked Issue/PR

User-visible / Behavior Changes

Security Impact (required)

Repro + Verification

Environment

Steps

Expected

Actual

Evidence

Human Verification (required)

Review Conversations

Compatibility / Migration

Failure Recovery (if this breaks)

Risks and Mitigations

Uh oh!

Uh oh!

greptile-apps bot commented Mar 9, 2026

Greptile Summary

Confidence Score: 3/5

Uh oh!

greptile-apps bot Mar 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant