🔒 Aisle Security Analysis

We found 1 potential security issue(s) in this PR:

1. 🔵 Information disclosure via detailed fallback override denial message (exposes internal config key path)

Description

The fallback model/provider override authorization failure message for untrusted plugins now includes internal configuration structure (plugins.entries.<id>.subagent.allowModelOverride) and a docs URL.

This reason is later thrown as an exception and can propagate into user-visible/tool-visible surfaces:

• authorizeFallbackModelOverride() returns {allowed:false, reason: ...} with the detailed config key path.
• createGatewaySubagentRuntime().run() throws new Error(fallbackAuth.reason) when the override is requested in a fallback context.
• Tool execution wrappers (e.g., src/agents/pi-tool-definition-adapter.ts) convert thrown errors into tool results containing the raw err.message, and those can be surfaced in:
  • Tool event payloads / tool error warnings (depending on verbosity) and potentially end-user messaging
  • /tools/invoke HTTP API responses (returns tool results directly)

While not a direct auth bypass, disclosing internal configuration key paths and policy names to untrusted callers can aid security policy enumeration and increase the value of error or log scraping.

Vulnerable code (new detailed message):

reason:
  `plugin "${pluginId}" is not trusted for fallback provider/model override requests. ` +
  "See https://docs.openclaw.ai/tools/plugin#runtime-helpers and search for: " +
  "plugins.entries.<id>.subagent.allowModelOverride",

Recommendation

Return a generic client-facing error message and keep detailed guidance for logs/debug mode only.

For example:

​// server-plugins.ts
if (!policy?.allowModelOverride) {
  ​// Log detailed guidance for operators
  context?.logGateway?.warn(
    `untrusted plugin fallback override denied: pluginId=${pluginId}; enable via plugins.entries.<id>.subagent.allowModelOverride`,
  );

  ​// Client/tool-facing message should not enumerate internal config structure
  return {
    allowed: false,
    reason: `plugin "${pluginId}" is not trusted for fallback provider/model override requests.`,
  };
}

If you still want to direct operators to docs, consider using a short stable error code (e.g., E_PLUGIN_OVERRIDE_UNTRUSTED) and link docs without embedding config key paths in the thrown message.

Additionally, ensure any HTTP/WS error shaping avoids returning raw exception messages to untrusted clients in production (or gates detail behind a debug flag).

Analyzed PR: #49513 at commit d3f90e7

_{Last updated on: 2026-03-18T06:25:42Z}

Greptile Summary

This PR improves the developer experience for the plugin fallback provider/model override trust error by appending a docs URL and the exact config key to search for, and adds a focused regression test that covers the previously-untested untrusted-plugin rejection path.

• src/gateway/server-plugins.ts: The authorizeFallbackModelOverride rejection message now includes https://docs.openclaw.ai/tools/plugin#runtime-helpers and the hint plugins.entries.<id>.subagent.allowModelOverride, making the path to resolution discoverable directly from the runtime error.
• src/gateway/server-plugins.test.ts: A new test ("includes docs guidance when a plugin fallback override is not trusted") verifies the exact error message. The setup — no plugin config, fallback context set, "voice-call" scope active, provider/model override requested — correctly triggers the !policy?.allowModelOverride branch and matches the full updated message string.

Confidence Score: 5/5

• This PR is safe to merge — it only modifies an error message string and adds a test for it, with no logic changes.
• The change is restricted to a single error message string appending a docs URL and config key hint. The new test precisely mirrors that string, exercises the correct untrusted-plugin code path, and is consistent with the existing test setup/teardown pattern (module resets, globalThis-based policy state cleared by a fresh loadGatewayPlugins call with empty config). No existing behaviour is altered.
• No files require special attention.

_{Last reviewed commit: "Gateway: add docs hi..."}