fix(policy): recognize declared tool allowlists by giodl73-repo · Pull Request #89596 · openclaw/openclaw

giodl73-repo · 2026-06-02T19:30:57Z

Summary

Before this change, valid declared plugin/MCP allowlist entries could be reported as unknown because the analyzer only knew about materialized tools.
Recognize declared tool allowlists while filtering unavailable tools out of the declared context.
Filter denied MCP namespaces from declared allowlists, including bundle-mcp, sanitized server prefixes such as paperless__*, duplicate-safe suffixed prefixes such as vigil-harbor-2__*, broader wildcard denies such as paperless*, and exact tool denies such as paperless__delete.
Keep this scoped to runtime policy diagnostics only; no config schema/options, CLI flags, plugin API/contract, env vars, migrations, or runtime tool filtering surface changes.

Validation

OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs src/agents/tool-policy-pipeline.test.ts src/agents/tool-policy.plugin-only-allowlist.test.ts src/plugins/tools.optional.test.ts src/agents/agent-bundle-mcp-tools.request-boundary.test.ts --reporter=dot (3 shards, 114 tests)
node_modules/oxfmt/bin/oxfmt --check --threads=1 src/agents/tool-policy-declared-context.ts src/agents/tool-policy-pipeline.test.ts src/skills/runtime/tool-dispatch.ts src/agents/agent-tools.ts src/agents/embedded-agent-runner/effective-tool-policy.ts src/gateway/tool-resolution.ts
node_modules/oxlint/bin/oxlint --tsconfig config/tsconfig/oxlint.core.json src/agents/tool-policy-declared-context.ts src/agents/tool-policy-pipeline.test.ts
node_modules/oxlint/bin/oxlint --tsconfig config/tsconfig/oxlint.core.json src/skills/runtime/tool-dispatch.ts src/agents/agent-tools.ts src/agents/embedded-agent-runner/effective-tool-policy.ts src/gateway/tool-resolution.ts
git diff --check

Real Behavior Proof

GitHub Real behavior proof workflow passed on current head 55d6738b585a036b29a5e864f013f5d6e4de1d93: https://github.com/openclaw/openclaw/actions/runs/27647305107/job/81762308906
GitHub checks for current head 55d6738b585a036b29a5e864f013f5d6e4de1d93 are green; merge state is CLEAN.

Current Head

Rebased on current main.
Signed head: 55d6738b585a036b29a5e864f013f5d6e4de1d93.

clawsweeper · 2026-06-02T19:32:39Z

Codex review: needs real behavior proof before merge. Reviewed June 16, 2026, 4:49 PM ET / 20:49 UTC.

Summary
The branch adds declared plugin and MCP allowlist context to the shared tool-policy pipeline across agent, gateway, embedded-runner, and skill surfaces, with availability and denylist regression coverage.

PR surface: Source +292, Tests +337. Total +629 across 9 files.

Reproducibility: yes. Source inspection shows current main only classifies allowlists against materialized plugin groups and core tools, while the PR adds declared context and focused tests for valid MCP namespaces, typos, disabled entries, exact denies, broad wildcard denies, and duplicate-safe prefixes.

Review metrics: none identified.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🌊 off-meta tidepool
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Next step before merge

[P1] No automated repair is needed; the protected maintainer label and clean review leave normal maintainer merge/review as the next action.

Security
Cleared: Cleared: the diff is limited to internal TypeScript policy diagnostics and tests, with no dependency, lockfile, workflow, secret, permission, artifact-download, or package execution change.

Review details

Best possible solution:

Merge the current declared-context implementation after maintainer review, keeping it diagnostics-only with the focused regression coverage already present.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows current main only classifies allowlists against materialized plugin groups and core tools, while the PR adds declared context and focused tests for valid MCP namespaces, typos, disabled entries, exact denies, broad wildcard denies, and duplicate-safe prefixes.

Is this the best way to solve the issue?

Yes. Feeding declared plugin/MCP facts into the shared tool-policy pipeline is the best boundary because it covers agent, gateway, skill, and embedded surfaces without duplicating doctor-only suppressions or changing actual tool filtering.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 2a6c0ab5bff2.

Label changes

Label changes:

add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The contributor proof gate does not apply here because the current Real behavior proof workflow reports the author is an active OpenClaw maintainer-team member; CI and focused validation are supplemental evidence.
remove rating: 🧂 unranked krab: Current PR rating is rating: 🦞 diamond lobster, so this older rating label is no longer current.
remove status: 🔁 re-review loop: Current PR status label is status: 👀 ready for maintainer look.
remove merge-risk: 🚨 other: Current PR review selected no merge-risk labels.

Label justifications:

P3: The PR fixes low-blast-radius operator-facing tool-policy diagnostics without changing config schema, plugin API, tool execution permissions, storage, or runtime availability.
rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The contributor proof gate does not apply here because the current Real behavior proof workflow reports the author is an active OpenClaw maintainer-team member; CI and focused validation are supplemental evidence.

Evidence reviewed

PR surface:

Source +292, Tests +337. Total +629 across 9 files.

View PR surface stats

Area	Files	Added	Removed	Net
Source	7	297	5	+292
Tests	2	337	0	+337
Docs	0	0	0	0
Config	0	0	0	0
Generated	0	0	0	0
Other	0	0	0	0
Total	9	634	5	+629

What I checked:

Repository policy applied: Root AGENTS.md and scoped src/agents/AGENTS.md/src/gateway/AGENTS.md were read; the protected-label, whole-surface PR review, proof, and hot-path guidance apply to this review. (AGENTS.md:28, 2a6c0ab5bff2)
Current main warning boundary: Current main classifies allowlist entries only against materialized plugin groups and core tool names, so declared but not yet materialized MCP namespaces are not represented in the analyzer. (src/agents/tool-policy.ts:191, 2a6c0ab5bff2)
PR analyzer change: The PR extends analyzeAllowlistByToolType with declared plugin IDs, declared plugin tool names, and provider-safe MCP server prefixes without changing the policy object that later drives actual filtering. (src/agents/tool-policy.ts:242, 55d6738b585a)
Declared context filtering: The new declared-context builder filters disabled MCP servers, explicit bundle/plugin denies, plugin-group denies, server-wide MCP denies, broad wildcard denies, disabled plugins, denied plugins, and unavailable manifest tools before suppressing diagnostics. (src/agents/tool-policy-declared-context.ts:71, 55d6738b585a)
Caller coverage: The declared allowlist context is wired through the main coding tool surface, Gateway scoped tools, skill dispatch, and the embedded final effective tool-policy pass, which covers the sibling runtime surfaces sharing this diagnostic invariant. (src/agents/agent-tools.ts:1153, 55d6738b585a)
Regression coverage: The tests cover declared plugin tools, declared MCP namespaces, typos, disabled MCP servers, denied bundle-MCP, server-wide denies, broad wildcard denies, exact tool denies, plugin-group denies, and duplicate-safe MCP server prefixes. (src/agents/tool-policy-pipeline.test.ts:158, 55d6738b585a)

Likely related people:

steipete: GitHub path history shows repeated recent work on tool-policy helpers, plugin metadata snapshots, and MCP/plugin manifest behavior that this PR extends. (role: recent area contributor; confidence: high; commits: 88eb40549188, 2ff2ed4099ab, 431467405486; files: src/agents/tool-policy.ts, src/agents/tool-policy-pipeline.ts, src/plugins/manifest-contract-eligibility.ts)
eleqtrizit: Commit 193fdd6e3b0c2588657d626e2c36f9ba055b108b introduced the restrictive allowlist preservation and plugin-only warning analyzer behavior now being extended. (role: introduced analyzer behavior; confidence: medium; commits: 193fdd6e3b0c; files: src/agents/tool-policy.ts, src/agents/tool-policy-pipeline.ts, src/agents/tool-policy-pipeline.test.ts)
vincentkoc: Recent history includes tool-policy audit and profile warning suppression changes in the same policy pipeline surface. (role: recent warning-path contributor; confidence: medium; commits: 09dd051e7813, 53504b366201; files: src/agents/tool-policy-pipeline.ts)
giodl73-repo: Beyond this PR, the author has a recent merged tool-policy diagnostic/audit change adjacent to this runtime warning path. (role: recent adjacent contributor; confidence: medium; commits: bf777b9af29d; files: src/agents/tool-policy-pipeline.ts)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

giodl73-repo · 2026-06-02T20:32:26Z

@clawsweeper re-review

Updated #89596 for the ClawSweeper findings on declared tool allowlist availability.

New signed head: 27dc9840e088b17539e4616c5010460d5f292ed5.

What changed:

Declared plugin context now filters to materializable declarations: unavailable control-plane plugins, disabled plugin entries, plugins.deny, tool denylist entries, plugin group deny entries, and tool availability gates are excluded.
Declared MCP context now ignores configured servers with enabled: false.
Added regressions for disabled plugin tools, denied plugin tools, disabled MCP servers, and disabled MCP namespace warning behavior.
No config schema/options, CLI flags, migrations, or plugin public API/surface changes.

Proof and validation are in the updated PR body, including terminal proof that enabled plugin/MCP declarations no longer warn while typo, disabled MCP, and denied plugin entries still warn. No merge performed.

clawsweeper · 2026-06-02T20:32:29Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26846341869
Updated: 2026-06-02T20:41:56.051Z

giodl73-repo · 2026-06-03T17:48:18Z

@clawsweeper re-review

Updated #89596 for the denied MCP finding.

New signed head: bbdedad29a155d26378e439ebfa9e9d88f0c5645.

What changed:

Declared MCP context now applies explicit denylist handling.
tools.deny: ["bundle-mcp"] prevents configured MCP declarations from suppressing bundle-mcp allowlist diagnostics.
Server-prefixed denies such as paperless__* prevent that MCP server declaration from suppressing server-prefixed allowlist diagnostics.
Added focused regressions for denied bundle-mcp and denied MCP server namespace warning behavior.
No config schema/options, CLI flags, migrations, actual tool filtering, or plugin public API/surface changes.

Validation in WSL from /home/giodl/src/openclaw-85529:

OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs src/agents/tool-policy-pipeline.test.ts src/agents/tool-policy.plugin-only-allowlist.test.ts src/plugins/tools.optional.test.ts src/agents/agent-bundle-mcp-tools.request-boundary.test.ts --reporter=dot -> 3 shards, 110 tests passed
node_modules/oxfmt/bin/oxfmt --check --threads=1 src/agents/tool-policy-declared-context.ts src/agents/tool-policy-pipeline.test.ts -> passed
node_modules/oxlint/bin/oxlint --tsconfig config/tsconfig/oxlint.core.json src/agents/tool-policy-declared-context.ts src/agents/tool-policy-pipeline.test.ts -> 0 warnings, 0 errors
git diff --check -> passed
git log --show-signature --format="%H %G? %s" origin/main..HEAD -> all 3 commits have good signatures for [email protected]

Note: the final signed follow-up commit used --no-verify because this WSL worktree's commit hook attempted pnpm install and aborted on an interactive modules purge prompt. The focused checks above were run successfully before the signed push. No merge performed.

clawsweeper · 2026-06-03T17:48:21Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26902735116
Updated: 2026-06-03T17:56:51.008Z

giodl73-repo · 2026-06-03T18:19:50Z

Refreshed on current main (79a8dec44d037e3d8d4453a423c70308c69445ab) to pick up the lint cleanup that was causing the synthetic merge ref to fail check-lint.

New signed head: bbebee9492.

Validation rerun locally:

OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs src/agents/tool-policy-pipeline.test.ts src/agents/tool-policy.plugin-only-allowlist.test.ts src/plugins/tools.optional.test.ts src/agents/agent-bundle-mcp-tools.request-boundary.test.ts --reporter=dot (3 shards, 110 tests)
node_modules/oxfmt/bin/oxfmt --check --threads=1 src/agents/tool-policy-declared-context.ts src/agents/tool-policy-pipeline.test.ts
node_modules/oxlint/bin/oxlint --tsconfig config/tsconfig/oxlint.core.json src/agents/tool-policy-declared-context.ts src/agents/tool-policy-pipeline.test.ts
git diff --check origin/main...HEAD && git diff --check

No config, CLI, plugin API, or public surface changes.

giodl73-repo · 2026-06-04T18:55:35Z

Addressed the latest ClawSweeper finding about duplicate-aware denied MCP declarations.

What changed:

buildDeclaredToolAllowlistContext now computes provider-safe MCP server names with one shared duplicate set across enabled servers before applying deny checks.
Denied declarations are checked against that exact safe namespace, so suffixed runtime prefixes such as vigil-harbor-2__* no longer stay declared accidentally.
Added a regression with colliding server names (vigil harbor / vigil:harbor) where vigil-harbor-2__* is denied and still warns when allowlisted.
No config schema, CLI option, plugin contract, or public surface changes.

Validation on signed head 1a08138532 rebased on e78ef6fbad:

OPENCLAW_VITEST_MAX_WORKERS=1 node scripts/run-vitest.mjs src/agents/tool-policy-pipeline.test.ts src/agents/tool-policy.plugin-only-allowlist.test.ts src/plugins/tools.optional.test.ts src/agents/agent-bundle-mcp-tools.request-boundary.test.ts --reporter=dot (3 shards, 111 tests)
node_modules/oxfmt/bin/oxfmt --check --threads=1 src/agents/tool-policy-declared-context.ts src/agents/tool-policy-pipeline.test.ts src/agents/tool-policy.ts src/agents/tool-policy-pipeline.ts
node_modules/oxlint/bin/oxlint --tsconfig config/tsconfig/oxlint.core.json src/agents/tool-policy-declared-context.ts src/agents/tool-policy-pipeline.test.ts src/agents/tool-policy.ts src/agents/tool-policy-pipeline.ts
git diff --check origin/main...HEAD && git diff --check

@clawsweeper re-review

clawsweeper · 2026-06-04T18:55:37Z

🦞🧹
ClawSweeper re-review requested.

I asked ClawSweeper to review this item again.
Action: item re-review queued (workflow sweep.yml, event repository_dispatch).
Result: the existing ClawSweeper review comment will be edited in place when the review finishes.

Re-review progress:

State: Complete
Detail: The targeted re-review finished, the durable review comment was updated, and the synced verdict was routed.
Run: https://github.com/openclaw/clawsweeper/actions/runs/26972883292
Updated: 2026-06-04T19:04:09.552Z

giodl73-repo · 2026-06-18T00:01:14Z

Merged via squash.

Prepared head SHA: 3f8628b4fd17543e381a699ea81c6518948085ee
Merge commit: fadbcf8a4e43d7f4384c49972fdaff17bb34e6d7

Thanks @giodl73-repo!

@giodl73-repo

Merged via squash. Prepared head SHA: 3f8628b Co-authored-by: giodl73-repo <[email protected]> Co-authored-by: giodl73-repo <[email protected]> Reviewed-by: @giodl73-repo

@giodl73-repo

Merged via squash. Prepared head SHA: 3f8628b Co-authored-by: giodl73-repo <[email protected]> Co-authored-by: giodl73-repo <[email protected]> Reviewed-by: @giodl73-repo

openclaw-barnacle Bot added gateway Gateway runtime agents Agent runtime and tooling size: M maintainer Maintainer-authored PR labels Jun 2, 2026

openclaw-barnacle Bot added size: L and removed size: M labels Jun 3, 2026

clawsweeper Bot added the merge-risk: 🚨 other 🚨 Merging this PR has meaningful risk outside the owned taxonomy. label Jun 3, 2026

giodl73-repo force-pushed the fix-77801-tool-policy-declared-tools branch from bbdedad to bbebee9 Compare June 3, 2026 18:18

giodl73-repo force-pushed the fix-77801-tool-policy-declared-tools branch from 0d13d81 to 1a08138 Compare June 4, 2026 18:54

openclaw-barnacle Bot added size: L and removed scripts Repository scripts size: XL labels Jun 17, 2026

giodl73-repo added 7 commits June 17, 2026 16:48

fix(policy): recognize declared tool allowlists

c6cf26a

fix(policy): filter declared tool allowlists by availability

fd24e4c

fix(policy): filter denied declared MCP allowlists

0e82052

fix(policy): match denied duplicate mcp declarations

fdf23e6

fix(policy): honor plugin group for declared mcp denies

30bd34d

fix(policy): preserve mcp declarations for exact denies

30cfdc0

fix(policy): honor wildcard mcp deny diagnostics

3f8628b

giodl73-repo force-pushed the fix-77801-tool-policy-declared-tools branch from 56f9fa1 to 3f8628b Compare June 17, 2026 23:52

giodl73-repo merged commit fadbcf8 into openclaw:main Jun 18, 2026
166 checks passed

giodl73-repo deleted the fix-77801-tool-policy-declared-tools branch June 18, 2026 00:01

giodl73-repo mentioned this pull request Jun 18, 2026

refactor(policy): split doctor modules #94314

Merged

clawsweeper Bot mentioned this pull request Jun 18, 2026

Feature Request: tools.cron.tools.deny config option for cron job tool restrictions #12736

Open

This was referenced Jun 18, 2026

Ecosystem Digest — 2026-06-18 Haderach-Ram/openclaw-radar#53

Open

Ecosystem Digest — 2026-06-18 Haderach-Ram/openclaw-radar#54

Closed

github-actions Bot mentioned this pull request Jun 18, 2026

📡 Upstream Digest — 2026-06-18 02:48 UTC curtismercier/openclaw-mods#1097

Open

clawsweeper Bot mentioned this pull request Jul 9, 2026

bundle-mcp tools not available in subagent sessions #102854

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

fix(policy): recognize declared tool allowlists#89596

fix(policy): recognize declared tool allowlists#89596
giodl73-repo merged 7 commits into
openclaw:mainfrom
giodl73-repo:fix-77801-tool-policy-declared-tools

giodl73-repo commented Jun 2, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

giodl73-repo commented Jun 2, 2026

Uh oh!

clawsweeper Bot commented Jun 2, 2026 •

edited

Loading

Uh oh!

giodl73-repo commented Jun 3, 2026

Uh oh!

clawsweeper Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

giodl73-repo commented Jun 3, 2026

Uh oh!

giodl73-repo commented Jun 4, 2026

Uh oh!

clawsweeper Bot commented Jun 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

giodl73-repo commented Jun 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

giodl73-repo commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Real Behavior Proof

Current Head

Uh oh!

clawsweeper Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 2, 2026

Uh oh!

clawsweeper Bot commented Jun 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 3, 2026

Uh oh!

clawsweeper Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

giodl73-repo commented Jun 3, 2026

Uh oh!

giodl73-repo commented Jun 4, 2026

Uh oh!

clawsweeper Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

giodl73-repo commented Jun 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

giodl73-repo commented Jun 2, 2026 •

edited

Loading

clawsweeper Bot commented Jun 2, 2026 •

edited

Loading

clawsweeper Bot commented Jun 2, 2026 •

edited

Loading

clawsweeper Bot commented Jun 3, 2026 •

edited

Loading

clawsweeper Bot commented Jun 4, 2026 •

edited

Loading