From cbf1176cf02b59d80df8863726b1eb5af10ff0ec Mon Sep 17 00:00:00 2001 From: James Russo Date: Mon, 26 Oct 2026 01:11:17 +0000 Subject: [PATCH] fix(cli): stop shipping an env var name that endpoint scanners flag (#6369) * fix(cli): stop shipping an env var name that endpoint scanners flag Cisco Secure Endpoint ships an IoC signature that matches the literal name of the openclaw state-dir env var. Any file containing it is quarantined, which deletes a CLI dist chunk (the CLI then fails on its second run) and the Studio app.asar. Key the openclaw agent-runtime rule on OPENCLAW_CONFIG_PATH only. openclaw sets both variables on the subprocesses it spawns, so detection is unchanged. Drop the state-dir name from the comments and from the test, which now covers detection through the config-path variable. Fixes #5245 Co-Authored-By: Claude Opus 5.5 (1M context) * fix(cli): keep the openclaw comment under the comment-share ratchet Co-Authored-By: Claude Opus 5.5 (1M context) * fix(cli): drop the external-repo citation from the openclaw comment The comment-citations check resolves file:line references against this repo, and that path lives in the openclaw repo. Co-Authored-By: Claude Opus 5.5 (1M context) --------- Co-authored-by: Claude Opus 5.5 (1M context) --- packages/cli/src/telemetry/agent_runtime.test.ts | 5 ++--- packages/cli/src/telemetry/agent_runtime.ts | 12 ++++-------- 2 files changed, 6 insertions(+), 11 deletions(-) diff --git a/packages/cli/src/telemetry/agent_runtime.test.ts b/packages/cli/src/telemetry/agent_runtime.test.ts index 5fd2f71f8f..6ee9ed9cda 100644 --- a/packages/cli/src/telemetry/agent_runtime.test.ts +++ b/packages/cli/src/telemetry/agent_runtime.test.ts @@ -22,7 +22,6 @@ const VENDOR_ENV_KEYS = [ "REPL_ID", "REPLIT_USER", "HERMES_QUIET", - "OPENCLAW_STATE_DIR", "OPENCLAW_CONFIG_PATH", "PI_CODING_AGENT", "CLINE_ACTIVE", @@ -220,8 +219,8 @@ describe("detectAgentRuntime — Replit / Hermes / openclaw / Pi", () => { expect(detectAgentRuntime()).toBe("hermes"); }); - it("detects openclaw via inherited OPENCLAW_STATE_DIR", async () => { - process.env["OPENCLAW_STATE_DIR"] = "/tmp/openclaw"; + it("detects openclaw via inherited OPENCLAW_CONFIG_PATH", async () => { + process.env["OPENCLAW_CONFIG_PATH"] = "/tmp/openclaw/openclaw.json"; const { detectAgentRuntime } = await import("./agent_runtime.js"); expect(detectAgentRuntime()).toBe("openclaw"); }); diff --git a/packages/cli/src/telemetry/agent_runtime.ts b/packages/cli/src/telemetry/agent_runtime.ts index 9f8ac5f706..ddb1858877 100644 --- a/packages/cli/src/telemetry/agent_runtime.ts +++ b/packages/cli/src/telemetry/agent_runtime.ts @@ -134,17 +134,13 @@ const VENDOR_RULES: VendorRule[] = [ name: "hermes", check: (env) => typeof env["HERMES_QUIET"] === "string", }, - // openclaw — multi-channel AI gateway. When openclaw spawns a CLI - // subprocess it builds the child env with OPENCLAW_STATE_DIR / - // OPENCLAW_CONFIG_PATH / OPENCLAW_DISABLE_AUTO_UPDATE set explicitly - // (extensions/qa-matrix/src/runners/contract/scenario-runtime-cli.ts:344-351). - // We key on OPENCLAW_STATE_DIR since it's a path scope-bound to openclaw. + // openclaw — multi-channel AI gateway. It sets OPENCLAW_CONFIG_PATH on the + // CLI subprocesses it spawns. Never name its state-dir var here: endpoint + // scanners flag that string as an IoC and quarantine the bundle (#5245). // Source: https://github.com/openclaw/openclaw { name: "openclaw", - check: (env) => - typeof env["OPENCLAW_STATE_DIR"] === "string" || - typeof env["OPENCLAW_CONFIG_PATH"] === "string", + check: (env) => typeof env["OPENCLAW_CONFIG_PATH"] === "string", }, // Pi coding agent (https://pi.dev, https://github.com/earendil-works/pi). // packages/coding-agent/src/cli.ts:13 unconditionally executes