fix: strip conda env marker from host tool runs (#99425)

* fix: strip conda env marker from host exec env

* fix(infra): block Conda default environment selector

Co-authored-by: 丁宇婷0668001435 <ding.yuting@xydigit.com>

---------

Co-authored-by: Peter Steinberger <steipete@gmail.com>
Co-authored-by: 丁宇婷0668001435 <ding.yuting@xydigit.com>

apps/macos/Sources/OpenClaw/HostEnvSecurityPolicy.generated.swift

@@ -51,6 +51,8 @@ enum HostEnvSecurityPolicy {
         "CMAKE_C_COMPILER",
         "CMAKE_TOOLCHAIN_FILE",
         "COMPOSER_HOME",
+        "CONDA_DEFAULT_ENV",
+        "CONDA_PREFIX",
         "CONFIG_SHELL",
         "CONFIG_SITE",
         "CORECLR_PROFILER",
@@ -366,6 +368,8 @@ enum HostEnvSecurityPolicy {
         "CGO_LDFLAGS",
         "CLASSPATH",
         "COMPOSER_HOME",
+        "CONDA_DEFAULT_ENV",
+        "CONDA_PREFIX",
         "CORECLR_PROFILER_PATH",
         "CPATH",
         "CPLUS_INCLUDE_PATH",

src/infra/host-env-security-policy.json

@@ -214,6 +214,8 @@
     "GEM_PATH",
     "BUNDLE_GEMFILE",
     "COMPOSER_HOME",
+    "CONDA_DEFAULT_ENV",
+    "CONDA_PREFIX",
     "CARGO_BUILD_RUSTC_WRAPPER",
     "XDG_CACHE_HOME",
     "XDG_CONFIG_DIRS",

src/infra/host-env-security.reported-baseline.json

@@ -147,6 +147,8 @@
     "CGO_LDFLAGS",
     "CLASSPATH",
     "COMPOSER_HOME",
+    "CONDA_DEFAULT_ENV",
+    "CONDA_PREFIX",
     "CORECLR_PROFILER_PATH",
     "CPATH",
     "CPLUS_INCLUDE_PATH",
@@ -267,5 +269,5 @@
     "YARN_RC_FILENAME",
     "ZDOTDIR"
   ],
-  "expectedTotalReportedEntries": 262
+  "expectedTotalReportedEntries": 264
 }

src/infra/host-env-security.reported-baseline.test.ts

@@ -97,7 +97,7 @@ describe("host env reported baseline coverage", () => {
       baseline.reportedDangerousEverywhereKeys.length +
         baseline.reportedDangerousOverrideOnlyKeys.length,
     ).toBe(baseline.expectedTotalReportedEntries);
-    expect(baseline.expectedTotalReportedEntries).toBe(262);
+    expect(baseline.expectedTotalReportedEntries).toBe(264);
     expect(sortUniqueUpper(baseline.reportedDangerousEverywhereKeys)).toEqual(
       baseline.reportedDangerousEverywhereKeys,
     );

src/infra/host-env-security.test.ts

@@ -595,6 +595,8 @@ describe("sanitizeHostExecEnv", () => {
       ["GOPATH", "/tmp/evil-go"],
       ["PYTHONUSERBASE", "/tmp/evil-python-userbase"],
       ["VIRTUAL_ENV", "/tmp/evil-venv"],
+      ["CONDA_DEFAULT_ENV", "evil-conda"],
+      ["CONDA_PREFIX", "/tmp/evil-conda"],
       ["SHELLOPTS", "xtrace"],
       ["PS4", "$(touch /tmp/pwned)"],
       ["CLASSPATH", "/tmp/evil-classpath"],
@@ -703,6 +705,8 @@ describe("sanitizeHostExecEnv", () => {
     expect(env.NODE_V8_COVERAGE).toBeUndefined();
     expect(env.PYTHONUSERBASE).toBeUndefined();
     expect(env.VIRTUAL_ENV).toBeUndefined();
+    expect(env.CONDA_DEFAULT_ENV).toBeUndefined();
+    expect(env.CONDA_PREFIX).toBeUndefined();
     expect(env.SAFE).toBe("ok");
     expect(env.HOME).toBe("/tmp/trusted-home");
     expect(env.ZDOTDIR).toBe("/tmp/trusted-zdotdir");
@@ -1063,6 +1067,8 @@ describe("isDangerousHostEnvOverrideVarName", () => {
     expect(isDangerousHostEnvOverrideVarName("goenv")).toBe(true);
     expect(isDangerousHostEnvOverrideVarName("PYTHONUSERBASE")).toBe(true);
     expect(isDangerousHostEnvOverrideVarName("virtual_env")).toBe(true);
+    expect(isDangerousHostEnvOverrideVarName("conda_default_env")).toBe(true);
+    expect(isDangerousHostEnvOverrideVarName("conda_prefix")).toBe(true);
     expect(isDangerousHostEnvOverrideVarName("KUBECONFIG")).toBe(true);
     expect(isDangerousHostEnvOverrideVarName("google_application_credentials")).toBe(true);
     expect(isDangerousHostEnvOverrideVarName("AWS_SHARED_CREDENTIALS_FILE")).toBe(true);
@@ -1241,6 +1247,8 @@ describe("sanitizeHostExecEnvWithDiagnostics", () => {
       ["RUSTUP_TOOLCHAIN", "/tmp/evil-toolchain"],
       ["RUSTUP_UPDATE_ROOT", "https://evil.example.test/rustup"],
       ["VIRTUAL_ENV", "/tmp/evil-venv"],
+      ["CONDA_DEFAULT_ENV", "evil-conda"],
+      ["CONDA_PREFIX", "/tmp/evil-conda"],
       ["JAVA_OPTS", "-javaagent:/tmp/evil.jar"],
       ["YARN_RC_FILENAME", ".evil-yarnrc.yml"],
       ["HTTPS_PROXY", "http://proxy.example.test:8080"],
@@ -1267,6 +1275,8 @@ describe("sanitizeHostExecEnvWithDiagnostics", () => {
       "CARGO_REGISTRIES_CRATES_IO_INDEX",
       "CLASSPATH",
       "CMAKE_C_COMPILER",
+      "CONDA_DEFAULT_ENV",
+      "CONDA_PREFIX",
       "CPATH",
       "CPLUS_INCLUDE_PATH",
       "CURL_CA_BUNDLE",
@@ -1415,6 +1425,8 @@ describe("sanitizeHostExecEnvWithDiagnostics", () => {
     expect(result.env.RUSTUP_TOOLCHAIN).toBeUndefined();
     expect(result.env.RUSTUP_UPDATE_ROOT).toBeUndefined();
     expect(result.env.VIRTUAL_ENV).toBeUndefined();
+    expect(result.env.CONDA_DEFAULT_ENV).toBeUndefined();
+    expect(result.env.CONDA_PREFIX).toBeUndefined();
     expect(result.env.YARN_RC_FILENAME).toBeUndefined();
   });