Description

The CLI command agentCliCommand falls back to running the embedded agent whenever agentViaGatewayCommand throws any error.

This is security-sensitive because agentViaGatewayCommand calls the Gateway RPC (callGateway({ method: "agent", ... })), which can fail for reasons beyond connectivity—e.g. authorization/permission/policy enforcement.

From src/gateway/client.ts, gateway-side errors are surfaced as GatewayClientRequestError with a gatewayCode (e.g., permission/policy/unauthenticated-type codes). Those errors would be caught and silently downgraded to embedded execution, potentially bypassing:

• Gateway-side approvals / enterprise policy checks
• Centralized auditing or sandboxing controls enforced by the gateway
• “Remote-only” restrictions that are meant to prevent local execution

Vulnerable code:

try {
  return await agentViaGatewayCommand(opts, runtime);
} catch (err) {
  runtime.error?.(
    `EMBEDDED FALLBACK: Gateway agent failed; running embedded agent: ${String(err)}`,
  );
  return await agentCommand(
    {
      ...localOpts,
      resultMetaOverrides: EMBEDDED_FALLBACK_META,
    },
    runtime,
    deps,
  );
}

Recommendation

Only fall back to embedded execution for a narrow set of connectivity/unavailability failures, and never for authorization/policy/validation failures.

Suggested approach:

• Detect gateway request errors (e.g., err instanceof GatewayClientRequestError) and check err.gatewayCode.
• Only allow fallback for codes like UNAVAILABLE, TIMEOUT, connection close/handshake failures.
• Re-throw (or surface) errors like UNAUTHENTICATED, PERMISSION_DENIED, POLICY_DENIED, etc.
• Consider requiring an explicit --local flag (or config setting) to permit embedded execution at all.

Example:

import { GatewayClientRequestError } from "../gateway/client.js";

try {
  return await agentViaGatewayCommand(opts, runtime);
} catch (err) {
  if (err instanceof GatewayClientRequestError) {
    const fallbackAllowed = ["UNAVAILABLE", "DEADLINE_EXCEEDED"].includes(err.gatewayCode);
    if (!fallbackAllowed) throw err; // don’t bypass gateway enforcement
  }
  ​// Optionally: also only fallback for network-ish Errors (ECONNREFUSED, etc.)
  return await agentCommand({ ...localOpts, resultMetaOverrides: EMBEDDED_FALLBACK_META }, runtime, deps);
}

Description

In agentCliCommand, the gateway failure is logged to stderr using String(err). Errors thrown from callGateway() commonly embed connectionDetails.message, which includes the full gateway target URL (from --url / OPENCLAW_GATEWAY_URL) and config path. If the URL contains embedded credentials (e.g., wss://user:pass@​host) or sensitive query parameters/tokens, these can be leaked to terminal/CI logs.

• Input/source: gateway URL from CLI --url or env OPENCLAW_GATEWAY_URL (and potentially other error message content)
• Sink: runtime.error (stderr) with unredacted String(err)

Vulnerable code:

runtime.error?.(
  `EMBEDDED FALLBACK: Gateway agent failed; running embedded agent: ${String(err)}`,
);

Because this path triggers specifically when the gateway call fails, it may occur in automated environments where stderr is collected centrally, increasing the impact of accidental secret exposure.

Recommendation

Avoid logging raw error stringification; log a sanitized, minimal message.

• Prefer err instanceof Error ? err.message : "<unknown error>" (not stack).
• Redact credentials/query parameters from URLs before printing.

Example:

function redactUrlSecrets(text: string): string {
  ​// Remove userinfo and common token query params
  return text
    .replace(/(wss?:\/\/)([^\s/@]+):([^\s/@]+)@/g, "$1***:***@")
    .replace(/([?&](token|access_token|auth|password)=)[^&#\s]+/gi, "$1***");
}

const msg = err instanceof Error ? err.message : String(err);
runtime.error?.(
  `EMBEDDED FALLBACK: Gateway agent failed; running embedded agent: ${redactUrlSecrets(msg)}`,
);

If structured JSON output is expected, consider emitting only a short fixed diagnostic to stderr (no interpolation), and include sanitized failure metadata in the JSON meta instead.