ext/hyperframes
2
0
Fork 0
mirror of https://github.com/heygen-com/hyperframes.git synced 2026-10-30 09:16:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(cli): stop shipping an env var name that endpoint scanners flag (#6369)

Browse Source 
* fix(cli): stop shipping an env var name that endpoint scanners flag

Cisco Secure Endpoint ships an IoC signature that matches the literal
name of the openclaw state-dir env var. Any file containing it is
quarantined, which deletes a CLI dist chunk (the CLI then fails on its
second run) and the Studio app.asar.

Key the openclaw agent-runtime rule on OPENCLAW_CONFIG_PATH only. openclaw
sets both variables on the subprocesses it spawns, so detection is
unchanged. Drop the state-dir name from the comments and from the test,
which now covers detection through the config-path variable.

Fixes #5245

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(cli): keep the openclaw comment under the comment-share ratchet

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* fix(cli): drop the external-repo citation from the openclaw comment

The comment-citations check resolves file:line references against this
repo, and that path lives in the openclaw repo.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
James Russo
2026-10-26 01:11:17 +00:00
committed by GitHub
co-authored by Claude Opus 5.5
parent f4a48ad3e0
commit cbf1176cf0
2 changed files with 6 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/cli/src/telemetry/agent_runtime.test.ts
+2 -3
View File
@@ -22,7 +22,6 @@ const VENDOR_ENV_KEYS = [
"REPL_ID",
"REPLIT_USER",
"HERMES_QUIET",
"OPENCLAW_STATE_DIR",
"OPENCLAW_CONFIG_PATH",
"PI_CODING_AGENT",
"CLINE_ACTIVE",
@@ -220,8 +219,8 @@ describe("detectAgentRuntime — Replit / Hermes / openclaw / Pi", () => {
expect(detectAgentRuntime()).toBe("hermes");
});
it("detects openclaw via inherited OPENCLAW_STATE_DIR", async () => {
process.env["OPENCLAW_STATE_DIR"] = "/tmp/openclaw";
it("detects openclaw via inherited OPENCLAW_CONFIG_PATH", async () => {
process.env["OPENCLAW_CONFIG_PATH"] = "/tmp/openclaw/openclaw.json";
const { detectAgentRuntime } = await import("./agent_runtime.js");
expect(detectAgentRuntime()).toBe("openclaw");
});
packages/cli/src/telemetry/agent_runtime.ts
+4 -8
View File
@@ -134,17 +134,13 @@ const VENDOR_RULES: VendorRule[] = [
name: "hermes",
check: (env) => typeof env["HERMES_QUIET"] === "string",
},
// openclaw — multi-channel AI gateway. When openclaw spawns a CLI
// subprocess it builds the child env with OPENCLAW_STATE_DIR /
// OPENCLAW_CONFIG_PATH / OPENCLAW_DISABLE_AUTO_UPDATE set explicitly
// (extensions/qa-matrix/src/runners/contract/scenario-runtime-cli.ts:344-351).
// We key on OPENCLAW_STATE_DIR since it's a path scope-bound to openclaw.
// openclaw — multi-channel AI gateway. It sets OPENCLAW_CONFIG_PATH on the
// CLI subprocesses it spawns. Never name its state-dir var here: endpoint
// scanners flag that string as an IoC and quarantine the bundle (#5245).
// Source: https://github.com/openclaw/openclaw
{
name: "openclaw",
check: (env) =>
typeof env["OPENCLAW_STATE_DIR"] === "string" ||
typeof env["OPENCLAW_CONFIG_PATH"] === "string",
check: (env) => typeof env["OPENCLAW_CONFIG_PATH"] === "string",
},
// Pi coding agent (https://pi.dev, https://github.com/earendil-works/pi).
// packages/coding-agent/src/cli.ts:13 unconditionally executes