Redact exec tool result payloads by nicknmorty · Pull Request #81185 · openclaw/openclaw

nicknmorty · 2026-05-12T21:54:00Z

2026-07-20 refresh

Exact head 69e5972 merges upstream main bf6961d.
The current-main timeout-guidance merge and missing type-import repair are pushed; the code matrix completed successfully. Scan changed paths (precise) failed before scanning because the Opengrep installer could not fetch available versions from GitHub, so an upstream rerun is required.
The remaining product gate is maintainer acceptance of redacted-by-default exec/process/node-host output. The older live receipt below remains historical behavior evidence.

Summary

redact exec foreground tool-result text and structured details.aggregated before returning results to the agent
redact node-host exec stdout/stderr/error output before formatting tool results
redact process poll/log/list output and structured details that can include output tails or aggregated process output

Real behavior proof

Behavior or issue addressed: Exec and background process tool results could return secret-shaped stdout/stderr/session text back to the agent. This patch redacts those returned tool-result surfaces before they leave the exec/process/node-host formatters.

Real environment tested: Real local OpenClaw checkout on branch fix/exec-tool-result-redaction at da701a0bbf6c, using an isolated temporary OPENCLAW_HOME. The proof used an obvious fake canary value, not a real credential.

Exact steps or command run after this patch: Ran a local runtime proof that exercised createExecTool and createProcessTool with a fake REDACTION_CANARY_SECRET value, then inspected the returned tool-result content[0].text and structured details.aggregated values for foreground exec, process poll, process log, and process list tail/details surfaces.

Evidence after fix: Copied live output from the local runtime proof:

{
  "foregroundExec": {
    "status": "completed",
    "text": "REDACTION_CANARY_SECRET=clawsw…7890",
    "detailsAggregated": "REDACTION_CANARY_SECRET=clawsw…7890",
    "rawCanaryValuePresent": false,
    "redactedMarkerPresent": true
  },
  "processPoll": {
    "status": "completed",
    "text": "REDACTION_CANARY_SECRET=clawsw…7890\n\n\nProcess exited with code 0.",
    "detailsAggregated": "REDACTION_CANARY_SECRET=clawsw…7890\n",
    "rawCanaryValuePresent": false,
    "redactedMarkerPresent": true
  },
  "processLog": {
    "status": "completed",
    "text": "REDACTION_CANARY_SECRET=clawsw…7890",
    "detailsAggregated": "",
    "rawCanaryValuePresent": false,
    "redactedMarkerPresent": true
  },
  "processList": {
    "status": "completed",
    "textTail": "REDACTION_CANARY_SECRET=clawsw…7890",
    "rawCanaryValuePresent": false,
    "redactedMarkerPresent": true
  }
}

Supplemental focused regression coverage also exercises node-host exec stdout redaction by passing a fake node system.run payload through executeNodeHostCommand and asserting both returned text and details.aggregated redact the raw canary.

Observed result after fix: The raw fake canary value was absent from returned foreground exec, process poll, process log, and process list output. Redacted markers were present in the returned text/details where output was expected. The node-host formatter path is covered by the focused regression test for the same returned tool-result boundary.

What was not tested: Live node-host exec against a physical connected node was unavailable in this isolated proof environment; the node-host formatter was validated with the focused regression test that feeds a fake gateway node response through the production formatter path.

Tests

corepack pnpm exec oxfmt --write --threads=1 src/agents/bash-tools.exec.ts src/agents/bash-tools.exec-host-node-phases.ts src/agents/bash-tools.process.ts src/agents/bash-tools.exec-foreground-failures.test.ts src/agents/bash-tools.exec-host-node.test.ts src/agents/bash-tools.process.poll-timeout.test.ts
git diff --check
corepack pnpm tsgo:core
corepack pnpm tsgo:core:test
corepack pnpm exec vitest run --config test/vitest/vitest.agents-core.config.ts src/agents/bash-tools.exec-foreground-failures.test.ts -t 'redacts secret-shaped stdout'
corepack pnpm exec vitest run --config test/vitest/vitest.agents-core.config.ts src/agents/bash-tools.process.poll-timeout.test.ts -t 'redacts secret-shaped output'
corepack pnpm exec vitest run --config test/vitest/vitest.agents-core.config.ts src/agents/bash-tools.exec-host-node.test.ts -t 'redacts secret-shaped node stdout'

Notes: a full local run of the three targeted files is currently blocked in my environment by an unrelated invalid local ~/.openclaw/openclaw.json model alias (openai-codex/gpt-5.3-codex) during the pre-existing foreground timeout test. The new redaction regression tests pass individually under the agents-core Vitest config.

Fixes #71211

Follow-up after review

Added commit bc79136bb7 to redact background exec details.tail before returning running-session tool results.
Added regression coverage for background exec details.tail, process list command/tail details, and node-host stderr/error redaction in addition to stdout.

Additional local verification after follow-up:

corepack pnpm tsgo:core
corepack pnpm tsgo:core:test
corepack pnpm exec vitest run --config test/vitest/vitest.agents-core.config.ts src/agents/bash-tools.exec-foreground-failures.test.ts -t 'redacts secret-shaped'
corepack pnpm exec vitest run --config test/vitest/vitest.agents-core.config.ts src/agents/bash-tools.process.poll-timeout.test.ts -t 'redacts secret-shaped'
corepack pnpm exec vitest run --config test/vitest/vitest.agents-core.config.ts src/agents/bash-tools.exec-host-node.test.ts -t 'redacts secret-shaped node'
git diff --check

Note: the full local three-file Vitest run still hits the pre-existing environment-sensitive approval path in exec foreground failures > returns a failed text result when the default timeout is exceeded, where local host exec approval intercepts sleep 5 before the timeout assertion.

Review feedback update - 2026-05-21

Addressed ClawSweeper P1 by removing the JSON embedded-fallback behavior change from this PR; openclaw agent --json fallback behavior is back to the existing contract.
Addressed ClawSweeper P2 by replacing the live-update process timing test with deterministic runExecProcess regression coverage, so the previous single-line skip branches are gone.
Final head verified: 8793847f206cca93c49abe33e4f49b9b55a0c4dc.

Additional verification on final head:

node scripts/run-vitest.mjs src/agents/bash-tools.exec-foreground-failures.test.ts -t 'redacts secret-shaped'\n- node scripts/run-vitest.mjs src/agents/bash-tools.exec-runtime.test.ts -t 'redacts secret-shaped stdout in update text and details tail'\n- node scripts/run-vitest.mjs src/commands/agent-via-gateway.test.ts -t 'JSON'\n- node scripts/run-vitest.mjs src/agents/bash-tools.process.poll-timeout.test.ts -t 'redacts secret-shaped'\n- node scripts/run-vitest.mjs src/agents/bash-tools.exec-host-node.test.ts -t 'redacts secret-shaped node'\n- pnpm exec oxlint src/agents/bash-tools.exec-foreground-failures.test.ts src/agents/bash-tools.exec-runtime.test.ts src/commands/agent-via-gateway.ts src/commands/agent-via-gateway.test.ts src/cli/program/register.agent.ts src/cli/program/register.agent.test.ts\n- git diff --check && git diff --cached --check\n\nChanged-file gate note: node scripts/crabbox-wrapper.mjs run --shell -- "pnpm check:changed" did not reach pnpm because local crabbox failed its binary sanity check. Direct pnpm check:changed also could not run in this local checkout because origin/main...HEAD has no merge base on the grafted/shallow branch. The focused tests, lint, and diff checks above passed on the final head.

Process control redaction update - 2026-05-21

Addressed ClawSweeper P1 by redacting command-derived process result names for running-session controls (write, submit, paste) plus kill, remove, poll, log, list, and send-keys.
Added fake-secret regression coverage for process write and process send-keys command-derived details.name values.
Final head verified locally: 24ac21f4280e9e403722c271d12fda0a4c68535d4.

Additional verification on final head:

node scripts/run-vitest.mjs src/agents/bash-tools.process.poll-timeout.test.ts -t 'redacts secret-shaped'\n- node scripts/run-vitest.mjs src/agents/bash-tools.process-send-keys.test.ts -t 'redacts secret-shaped'\n- node scripts/run-vitest.mjs src/agents/bash-tools.exec-foreground-failures.test.ts -t 'redacts secret-shaped'\n- node scripts/run-vitest.mjs src/agents/bash-tools.exec-runtime.test.ts -t 'redacts secret-shaped stdout in update text and details tail'\n- node scripts/run-vitest.mjs src/agents/bash-tools.exec-host-node.test.ts -t 'redacts secret-shaped node'\n- pnpm exec oxlint src/agents/bash-tools.process.ts src/agents/bash-tools.process-send-keys.ts src/agents/bash-tools.process.poll-timeout.test.ts src/agents/bash-tools.process-send-keys.test.ts\n- git diff --check && git diff --cached --check

clawsweeper · 2026-05-12T21:57:20Z

Codex review: needs maintainer review before merge. Reviewed July 20, 2026, 2:58 PM ET / 18:58 UTC.

Summary
The branch redacts secret-shaped output from exec, process, node-host, live-update, and active-process result surfaces, adding a warning, a structured redacted marker, and regression coverage.

PR surface: Source +294, Tests +633, Other -1. Total +926 across 19 files.

Reproducibility: yes. from source and supplied live proof: emitting a fake secret-shaped assignment through exec or process output reaches the returned tool-result boundary, and the branch’s canary run shows that boundary masked after the change.

Review metrics: 2 noteworthy metrics.

Result boundaries protected: 6 result families. The patch covers foreground exec, running updates, node-host, process controls, process listings, and active-process context rather than only the original foreground path.
Agent-facing signals added: 2 signals. A structured marker and visible warning reduce the risk that an agent treats masked placeholders as source data.

Stored data model
Persistent data-model change detected: serialized state: src/agents/bash-tools.exec-output.ts, serialized state: src/agents/bash-tools.process-redaction.ts, serialized state: src/agents/bash-tools.process-send-keys.test.ts, serialized state: src/agents/embedded-agent-runner/compaction-runtime-context.test.ts, serialized state: src/agents/embedded-agent-runner/run/attempt.test.ts. Confirm migration or upgrade compatibility proof before merge.

Root-cause cluster
Relationship: fixed_by_candidate
Canonical: #71211
Summary: This PR is the explicit candidate fix for the open exec tool-output secret-redaction security report; the marker issue is overlapping but independently broader.

Members:

canonical: Security: exec tool returns raw stdout/stderr to agent without secret redaction #71211 - The PR body uses the linked security report as its target, and the implementation covers its stated exec/process/node-host output boundary.
partial_overlap: Redacted tool output should include a machine-readable marker so agents can detect redaction #68425 - This branch adds a redaction marker and warning for its covered result surfaces, but that issue requests a broader cross-tool contract.
adjacent_distinct: Redact tool output secrets #85196 - The merged change broadened shared redaction detection and detail handling; this PR applies that contract to exec and process tool-result assembly.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🦞 diamond lobster
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Obtain explicit owner approval for the redacted-by-default contract.
Refresh against current main, inspect the exact merge result, and rerun the failed precise-path scan.

Risk before merge

[P1] Redacting tool-result output by default deliberately changes byte-exact exec/process/node-host output for existing agent workflows; agents that need literal secret-bearing output may lose access without an approved recovery contract.
[P1] The branch is behind current main; maintainers should refresh and inspect the exact merge result before landing, including a rerun of the failed precise-path scan.

Maintainer options:

Approve the confidential-by-default contract (recommended)
Accept redaction of secret-shaped result values and land the refreshed branch with its marker and warning as the stable agent-facing behavior.
Specify a narrow raw-output recovery path first
Define the supported escape hatch and its authorization/audit boundary before merging a change that can mask existing command output.
Pause for security-product direction
Leave this PR open while the security owner decides whether raw tool output is ever a supported agent contract.

Next step before merge

[P2] A narrow code repair is not remaining; an exec/runtime security owner must decide the persistent redacted-by-default contract and then review the refreshed merge result.

Maintainer decision needed

Question: Should OpenClaw redact secret-shaped exec, process, and node-host tool-result output by default, accepting that these result surfaces are no longer byte-exact when they contain secrets?
Rationale: The patch is a coherent security hardening change with proof, but choosing between confidential-by-default output and a future explicit raw-output recovery contract is a durable product and security policy decision.
Likely owner: amknight — Recent merged ownership of the shared tool-output redaction contract makes this the closest available routing candidate.
Options:
- Adopt redacted-by-default (recommended): Accept the proposed default redaction, marker, and warning as the agent tool-result contract, then refresh the branch and land it after the exact-head checks are complete.
- Require an explicit recovery design: Pause this PR until maintainers define a narrowly scoped, audited way to obtain raw output when that behavior is genuinely required.
- Defer the policy change: Keep the underlying security issue open but do not merge a default-behavior change until a broader tool-output policy is approved.

Security
Cleared: The diff introduces no new execution, dependency, permission, or secret-exposure path; it narrows the result-output exposure boundary, subject to the explicit product decision on default behavior.

Review details

Best possible solution:

Have an exec/runtime security owner explicitly adopt the redacted-by-default contract, retain the structured marker and visible warning, then rebase and land the exact reviewed merge result after the upstream scan is rerun.

Do we have a high-confidence way to reproduce the issue?

Yes from source and supplied live proof: emitting a fake secret-shaped assignment through exec or process output reaches the returned tool-result boundary, and the branch’s canary run shows that boundary masked after the change.

Is this the best way to solve the issue?

Unclear pending maintainer policy approval: the shared formatter boundary is the narrowest maintainable implementation, but redacted-by-default versus a supported raw-output recovery path is a product/security contract choice.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ba3711bb825d.

Label changes

Label justifications:

P1: The change addresses a secret-exposure path in agent tool results that can affect normal exec and background-process workflows.
merge-risk: 🚨 compatibility: Existing workflows can receive altered output whenever a command emits secret-shaped content.
merge-risk: 🚨 security-boundary: The PR changes the confidentiality boundary between command execution output and agent context.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (live_output): The PR body includes an after-fix runtime canary exercise showing raw values absent and masking markers present across foreground exec and process result paths; focused node-host coverage tests the same production formatter boundary.
proof: sufficient: Contributor real behavior proof is sufficient. The PR body includes an after-fix runtime canary exercise showing raw values absent and masking markers present across foreground exec and process result paths; focused node-host coverage tests the same production formatter boundary.

Evidence reviewed

PR surface:

Source +294, Tests +633, Other -1. Total +926 across 19 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	11	641	347	+294
Tests	7	633	0	+633
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	1	0	1	-1
Total	19	1274	348	+926

What I checked:

PR-head implementation: The proposed formatter boundary applies redactToolPayloadText/redactSecrets, adds a redaction marker, and prepends a warning before exec results are returned to the agent. (src/agents/bash-tools.exec-output.ts:1, 69e5972b786f)
Result-surface coverage: The branch routes foreground exec, running updates, node-host responses, process controls, and active process references through the new redaction helpers rather than changing only one foreground path. (src/agents/bash-tools.exec-result-format.ts:1, 69e5972b786f)
Real behavior proof: The PR body records a local runtime canary exercise for foreground exec, process poll/log/list, with raw values absent and redacted markers present; focused node-host coverage supplements the unavailable physical-node run. (69e5972b786f)
Related security contract: The still-open security report identifies raw exec stdout/stderr entering agent context; this PR is explicitly linked as its candidate implementation. (src/agents/bash-tools.exec.ts:1, 69e5972b786f)
Shared redaction provenance: Merged PR Redact tool output secrets #85196 expanded the shared tool-output redaction primitives that this branch consumes, but it did not itself establish this exec/process return-boundary policy. (src/logging/redact.ts:1, 3faf669801d0)
Current review state: The PR is cleanly mergeable but behind its base and has a current-head code matrix green; the remaining precise-path scan failed before scanning because its upstream installer could not fetch versions, so it needs a maintainer rerun rather than a code repair. (69e5972b786f)

Likely related people:

amknight: Authored the merged redaction expansion that owns the shared logging redaction helpers used by this branch. (role: recent redaction-contract contributor; confidence: high; commits: 3faf669801d0; files: src/logging/redact.ts, src/shared/net/redact-sensitive-url.ts)
steipete: Authored the merged removal of internal agent test seams that this branch rebased through, including the formatter-test ownership boundary. (role: recent adjacent agent-runtime contributor; confidence: medium; commits: dc61172e519c; files: src/agents/bash-tools.exec-output.ts, src/agents/bash-tools.exec-runtime.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (19 earlier review cycles; latest 8 shown)

reviewed 2026-07-13T19:03:08.289Z sha c0e5d62 :: found issues before merge. :: [P1] Mark redacted exec results before returning them
reviewed 2026-07-13T22:02:51.080Z sha 664ba25 :: needs maintainer review before merge. :: none
reviewed 2026-07-14T01:45:35.667Z sha a79c902 :: needs maintainer review before merge. :: none
reviewed 2026-07-15T08:41:14.867Z sha c866d8e :: needs maintainer review before merge. :: none
reviewed 2026-07-15T09:52:22.601Z sha c866d8e :: needs maintainer review before merge. :: none
reviewed 2026-07-16T02:09:18.140Z sha 3c2c89f :: needs maintainer review before merge. :: none
reviewed 2026-07-16T04:04:39.475Z sha 3c2c89f :: needs maintainer review before merge. :: none
reviewed 2026-07-20T18:16:17.025Z sha 69e5972 :: needs maintainer review before merge. :: none

nicknmorty · 2026-05-13T19:14:34Z

Added real behavior proof to the PR body using an obvious fake canary (REDACTION_CANARY_SECRET) and an isolated temporary OPENCLAW_HOME. The proof covers foreground exec, process poll, and process log returned tool-result surfaces and shows the raw canary value absent with redacted markers present.

@clawsweeper re-review

clawsweeper · 2026-05-13T19:15:50Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/25937744138
Updated: 2026-05-15T19:47:06.459Z

nicknmorty · 2026-05-15T19:14:20Z

Updated the PR body with the required real behavior proof field labels and added process-list coverage plus the node-host testing note. The Real behavior proof check is now passing.

@clawsweeper re-review

nicknmorty · 2026-05-17T23:44:16Z

Rebased onto current main to resolve the stale-base check-test-types failure (the Pick<AgentConfig, ...> type update in model-selection.ts).

Also addressed the ClawSweeper [P1] finding: applied redactToolPayloadText to both the tailText passed to renderExecUpdateText and details.tail in emitUpdate() in bash-tools.exec-runtime.ts, and added focused regression coverage for the live-update redaction path.

@clawsweeper re-review

clawsweeper · 2026-05-17T23:45:51Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26006350938
Updated: 2026-05-17T23:58:18.393Z

nicknmorty · 2026-06-15T06:25:26Z

Maintainer/security review request: #81185 is ready for maintainer look after confirming #71211 is still present in v2026.6.6.

ClawSweeper now has this at proof: sufficient / rating: 🐚 platinum hermit, with no author-side repair remaining. The only red exact-head gate I see is check-prod-types in extensions/telegram/src/rich-message.ts:300; this PR does not touch that file, and current origin/main has the same unused markdown parameter.

The remaining merge decision is whether maintainers accept the returned exec/process/node-host raw-output compatibility tradeoff to close the P1 tool-result secret exposure.

nicknmorty · 2026-06-17T15:16:55Z

@clawsweeper re-review

Branch rebased onto current main for daily watcher. Current head: 6d64410. Previous red CI was check-prod-types on old head 945c0a9, failing in extensions/telegram/src/rich-message.ts outside this PR diff; fresh CI is queued after rebase.

clawsweeper · 2026-06-17T15:16:58Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Failed
Detail: The targeted re-review timed out or was rate-limited while waiting for exact-review Codex capacity, and the bounded capacity retry limit is exhausted.
Run: https://github.com/openclaw/clawsweeper/actions/runs/27722041540
Updated: 2026-06-17T22:11:39.105Z

nicknmorty · 2026-06-17T21:28:20Z

@clawsweeper re-review

nicknmorty · 2026-06-19T03:58:59Z

@steipete quick maintainer/security decision request on this one since it has been sitting since May 12 and now has the June 18 ClawSweeper diamond-lobster review, sufficient proof, and green checks. The remaining question appears to be maintainer/security acceptance of redacted exec/process/node-host tool-result output as the default contract. Is that acceptable to merge, or should I split out an explicit raw-output reveal path before this lands?

nicknmorty · 2026-06-20T16:24:57Z

Pushed follow-up head:

14bc6a0c98 fix(exec): redact active process references

Addresses the ClawSweeper P1 active-reference gap from the June 20 review:

listActiveProcessSessionReferences now redacts active session command, derived name, and tail before they enter agent-visible runtime/compaction context.
Added redactProcessSessionText alongside the existing redacted session-name helper.
Added fake-secret regression coverage for both scoped compaction context and after-turn runtime context.

Local lightweight validation on a clean checkout of 14bc6a0c98:

git diff --check HEAD^: clean
oxfmt --check touched files: clean

I attempted the two focused Vitest files locally, but stopped the Pi run after it stayed in bundler/plugin timing churn for over a minute. GitHub CI is running on the pushed head.

@clawsweeper re-review

clawsweeper · 2026-06-20T16:24:59Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

nicknmorty · 2026-06-21T04:50:42Z

Pushed follow-up head:

ff43a0bfe7603a5a55e0fdbf075b4d56eb942df4 test(exec): align active process redaction assertions

This fixes the exact embedded-agent CI failures from 14bc6a0c98: the active-process context tests now assert the actual redaction contract (***) instead of expecting preserved fake-key prefix/suffix.

Final-head runtime proof for the ClawSweeper P1 proof request:

{
  "proof": "PR 81185 active process runtime/compaction context redaction",
  "head": "ff43a0bfe7603a5a55e0fdbf075b4d56eb942df4",
  "fakeSecretOutput": "OPENAI_API_KEY=sk-proj-redaction-canary-1234567890",
  "results": [
    {
      "label": "compaction",
      "activeProcessSessions": [
        {
          "sessionId": "sess-active-secret",
          "status": "running",
          "startedAt": 1782017342173,
          "runtimeMs": 1,
          "cwd": "/tmp",
          "command": "node worker.js --token ***",
          "name": "node worker.js",
          "tail": "last output OPENAI_API_KEY=***",
          "truncated": false
        }
      ],
      "containsRawFakeSecret": false,
      "commandRedacted": true,
      "tailRedacted": true
    },
    {
      "label": "afterTurn",
      "activeProcessSessions": [
        {
          "sessionId": "sess-session-secret",
          "status": "running",
          "startedAt": 1782017342219,
          "runtimeMs": 1,
          "cwd": "/tmp",
          "command": "node worker.js --token ***",
          "name": "node worker.js",
          "tail": "last output OPENAI_API_KEY=***",
          "truncated": false
        }
      ],
      "containsRawFakeSecret": false,
      "commandRedacted": true,
      "tailRedacted": true
    }
  ]
}

Local checks on a clean worktree:

git diff --check HEAD^: clean
oxfmt --check touched files: clean
node scripts/run-tsgo.mjs -p test/tsconfig/tsconfig.test.packages.json --incremental false --pretty false: clean

Focused Vitest for the two embedded-agent files was attempted locally but did not finish in a bounded Pi-local window due repeated bundler plugin timing churn. Exact-head GitHub CI is running after this push.

@clawsweeper re-review

clawsweeper · 2026-06-21T04:50:44Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

brokemac79 · 2026-07-05T19:58:24Z

Hi! Small heads-up: ClawSweeper had a short-lived label/comment sync bug that may have affected this PR.

Your latest ClawSweeper review comment appears to be for the current PR head and says this is ready for maintainer review, but the ready/proof/rating labels were later removed by stale local review state. The ClawSweeper fix has merged, but this PR needs a fresh author-triggered review so the labels and comment are reconciled again.

Could you please post a new comment asking ClawSweeper to re-review? Use the bot mention followed by re-review.

Thanks, and sorry for the noise.

nicknmorty · 2026-07-05T20:41:07Z

@clawsweeper re-review

clawsweeper · 2026-07-05T20:41:10Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

nicknmorty · 2026-07-06T20:18:10Z

Hey @steipete / @openclaw/openclaw-secops — quick nudge on #81185. I know everyone’s got a lot moving, so I’m trying not to keep poking this unnecessarily. This one has been open since May, checks are green, and ClawSweeper has it at proof: sufficient / ready for maintainer look.

I think the remaining blocker is not more code from me, but a maintainer/security call on the policy tradeoff:

Should exec/process/node-host tool results redact secret-shaped output by default to close Security: exec tool returns raw stdout/stderr to agent without secret redaction #71211, even if that means byte-exact command output may contain redacted substrings?

My preferred path is to merge the default-redaction fix as-is, then track an explicit raw-output reveal control separately if maintainers want that escape hatch. But if you’d rather require that reveal path in this PR before merge, I can add it.

I’ll keep the branch clean and mergeable while this is waiting, but I’m trying to avoid unnecessary churn unless CI breaks or maintainers ask for a change.

Could someone make the merge/no-merge call or point me at the right owner for that decision?

nicknmorty · 2026-07-08T15:19:19Z

Rebased onto current main and patched the remaining node-host warning redaction gap. Node-host warnings are now passed through redactToolPayloadText before rendering, with a focused fake-canary regression added.

Validation:

git diff --check passed.
Focused Vitest could not run in the temporary checkout because node_modules is missing; per maintenance constraints I did not install dependencies.

@clawsweeper re-review

clawsweeper · 2026-07-08T15:19:22Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

nicknmorty · 2026-07-13T21:32:21Z

@clawsweeper re-review

Addressed the P1 redaction-marker finding at head 6b6f96e:

Structured signal: execution results now carry details.redacted: true only when masking occurred, applied consistently across foreground exec results, live exec updates, node-host exec results, and process list/poll/log/write surfaces (including structured active-process references).
Visible warning: masked surfaces append "Warning: redacted secret-shaped output; masked values are not real source data and must not be written back." so agents cannot mistake placeholders for writable source data (ref Redacted tool output should include a machine-readable marker so agents can detect redaction #68425).
Regression coverage added for both redacted and unredacted paths: flag + warning present when masking occurs, absent otherwise.
LOC ratchet addressed by extracting bash-tools.exec-node-result.ts, bash-tools.exec-result-format.ts, bash-tools.process-helpers.ts.

Proof (local, at this head): git diff --check clean; tsgo core pass; touched-file oxlint/oxfmt clean; ts-max-loc check pass (11 changed production files); focused vitest 7 files / 300 tests pass (unit-fast 4, agents 296). Prior check-lint/check-docs/checks-fast-loc-ratchet failures were ours and are fixed at this head; checks-node-compact-small-1 failure is inherited from an unrelated tooling test on main (test/scripts/test-extension.test.ts).

clawsweeper · 2026-07-13T21:32:24Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
Run: https://github.com/openclaw/clawsweeper/actions/runs/29287787685
Updated: 2026-07-13T21:57:01.348Z

nicknmorty · 2026-07-13T21:35:09Z

@clawsweeper re-review

Repost: re-review requested for head 6b6f96e (redaction-marker P1 addressed; proof in previous comment).

nicknmorty · 2026-07-14T01:34:49Z

@clawsweeper re-review

Head a79c902: merged origin/main (conflict was our test-only 'testing' seam vs #106956 seam removal — resolved by dropping the seam and importing builders directly from bash-tools.exec-result-format.ts; EXEC_REDACTION_WARNING is no longer exported, tests derive it via prependRedactionWarning). Proof re-run locally: git diff --check, oxfmt, oxlint, tsgo core, deadcode-exports clean for our files, and 296 focused tests + contracts/send-keys shards pass. Prior CI failures (OpenClawKit dead-code intersect, extension-runtime-dependencies lobster contract) were base drift fixed on current main.

clawsweeper · 2026-07-14T01:34:51Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review published an exact durable review comment and queued an executing target-wide serialized router scan.
Run: https://github.com/openclaw/clawsweeper/actions/runs/29299162680
Updated: 2026-07-14T01:48:19.404Z

nicknmorty · 2026-07-20T18:27:32Z

Exact-head CI infrastructure note for 69e5972: Scan changed paths (precise) failed before any scan ran because the Opengrep installer could not fetch available versions from GitHub; the SARIF upload then had no file. The completed code matrix is green. Contributor credentials cannot rerun this upstream workflow (GitHub requires repository admin), so a maintainer rerun is requested. This is not a scan finding.

nicknmorty · 2026-07-22T18:23:09Z

@clawsweeper re-review

Refreshed non-force through current main at f766cc0. Exact-head CI is complete with zero failures or pending checks. Local refresh proof passed 317/317 focused exec/process redaction tests, core and core-test typechecks, touched-file format/lint, max-lines ratchet, conflict scan, and diff hygiene.

clawsweeper · 2026-07-22T18:23:12Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Review in progress
Detail: The exact-review queue leased this run; Codex is reviewing the item.
Run: https://github.com/openclaw/clawsweeper/actions/runs/29948965531
Updated: 2026-07-22T18:59:01.303Z

nicknmorty · 2026-07-24T23:46:36Z

@clawsweeper re-review

Refreshed exact head d847a42275872dc7c3790f06ccb641716b01b9e4 is MERGEABLE and rebased onto upstream main 872ba27ff3633f9b8458c50920ed6c1ac7e3f15d. GitHub completed 117/117 checks: 81 success, 35 skipped, 1 neutral, 0 failed, 0 pending. Local refresh proof passed 317 focused exec/process/redaction tests, fresh-cache core and core-test typechecks, touched-scope ratchet/conflict/diff gates, and retained the existing proof-sufficient security contract without unrelated scope.

clawsweeper · 2026-07-24T23:46:39Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: when the review finishes, ClawSweeper will create the durable review comment if needed or update the existing comment in place.

Re-review progress:

State: Review in progress
Detail: The exact-review queue leased this run; Codex is reviewing the item.
Run: https://github.com/openclaw/clawsweeper/actions/runs/30135693575
Updated: 2026-07-25T00:12:24.470Z

nicknmorty · 2026-07-25T00:00:13Z

Receipt correction: the exact current head is d847a42275877a5ad188a1e5de5186ed7ea809e1. The preceding review comment had the correct 12-character prefix but an incorrect manually expanded suffix. ClawSweeper’s acknowledgment is already bound to the actual PR head d847a42275877a5ad188a1e5de5186ed7ea809e1; CI and proof results are unchanged.

clawsweeper · 2026-07-25T00:12:40Z

ClawSweeper status: review started.

I am starting a fresh review of this pull request: Redact exec tool result payloads This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.

openclaw-barnacle Bot added agents Agent runtime and tooling size: M triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 12, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 13, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 13, 2026

clawsweeper Bot mentioned this pull request May 13, 2026

Security: exec tool returns raw stdout/stderr to agent without secret redaction #71211

Open

openclaw-barnacle Bot added the channel: telegram Channel integration: telegram label May 14, 2026

clawsweeper Bot added the mantis: telegram-visible-proof Mantis should capture Telegram visible proof. label May 14, 2026

nicknmorty force-pushed the fix/exec-tool-result-redaction branch from a67fbbe to da701a0 Compare May 15, 2026 18:36

openclaw-barnacle Bot removed the channel: telegram Channel integration: telegram label May 15, 2026

clawsweeper Bot removed the mantis: telegram-visible-proof Mantis should capture Telegram visible proof. label May 15, 2026

openclaw-barnacle Bot added proof: supplied External PR includes structured after-fix real behavior proof. and removed triage: needs-real-behavior-proof Candidate: external PR needs after-fix proof from a real setup. labels May 15, 2026

clawsweeper Bot added the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 15, 2026

openclaw-barnacle Bot removed the proof: sufficient ClawSweeper judged the real behavior proof convincing. label May 15, 2026

clawsweeper Bot added P1 High-priority user-facing bug, regression, or broken workflow. impact:security Security boundary, credential, authz, sandbox, or sensitive-data risk. labels May 17, 2026

openclaw-barnacle Bot added cli CLI command changes commands Command implementations size: L and removed size: M labels May 21, 2026

github-actions Bot mentioned this pull request Jul 14, 2026

🦞 OpenClaw 生态日报 2026-07-14 zx0828/big_model_radar#249

Open

fix(exec): redact tool result payloads

d847a42

github-actions Bot mentioned this pull request Jul 24, 2026

🦞 OpenClaw 生态日报 2026-07-25 junlinzhao327-oss/big_model_radar#151

Open

Uh oh!

Uh oh!

Conversation

nicknmorty commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2026-07-20 refresh

Summary

Real behavior proof

Tests

Follow-up after review

Review feedback update - 2026-05-21

Process control redaction update - 2026-05-21

Uh oh!

clawsweeper Bot commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nicknmorty commented May 13, 2026

Uh oh!

clawsweeper Bot commented May 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nicknmorty commented May 15, 2026

Uh oh!

nicknmorty commented May 17, 2026

Uh oh!

clawsweeper Bot commented May 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nicknmorty commented Jun 15, 2026

Uh oh!

nicknmorty commented Jun 17, 2026

Uh oh!

clawsweeper Bot commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nicknmorty commented Jun 17, 2026

Uh oh!

nicknmorty commented Jun 19, 2026

Uh oh!

nicknmorty commented Jun 20, 2026

Uh oh!

clawsweeper Bot commented Jun 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nicknmorty commented Jun 21, 2026

Uh oh!

clawsweeper Bot commented Jun 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

brokemac79 commented Jul 5, 2026

Uh oh!

nicknmorty commented Jul 5, 2026

Uh oh!

clawsweeper Bot commented Jul 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nicknmorty commented Jul 6, 2026

Uh oh!

nicknmorty commented Jul 8, 2026

Uh oh!

clawsweeper Bot commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nicknmorty commented Jul 13, 2026

Uh oh!

clawsweeper Bot commented Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nicknmorty commented Jul 13, 2026

Uh oh!

nicknmorty commented Jul 14, 2026

Uh oh!

clawsweeper Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

nicknmorty commented Jul 20, 2026

Uh oh!

nicknmorty commented Jul 22, 2026

Uh oh!

clawsweeper Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

nicknmorty commented May 12, 2026 •

edited

Loading

clawsweeper Bot commented May 12, 2026 •

edited

Loading

clawsweeper Bot commented May 13, 2026 •

edited

Loading

clawsweeper Bot commented May 17, 2026 •

edited

Loading

clawsweeper Bot commented Jun 17, 2026 •

edited

Loading

clawsweeper Bot commented Jun 20, 2026 •

edited

Loading

clawsweeper Bot commented Jun 21, 2026 •

edited

Loading

clawsweeper Bot commented Jul 5, 2026 •

edited

Loading

clawsweeper Bot commented Jul 8, 2026 •

edited

Loading

clawsweeper Bot commented Jul 13, 2026 •

edited

Loading

clawsweeper Bot commented Jul 14, 2026 •

edited

Loading

clawsweeper Bot commented Jul 22, 2026 •

edited

Loading

clawsweeper Bot commented Jul 24, 2026 •

edited

Loading