ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-12 21:53:00 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix(agents): enforce Claude CLI cron tool policies (#112457)

Browse Source 
* fix(agents): enforce Claude CLI tool policies

* fix(agents): bound CLI runtime tool grants

* fix(agents): isolate restricted Claude runs
This commit is contained in:
Jason (Json)
2026-07-21 19:38:21 -06:00
committed by GitHub
parent 1790d92f7c
commit 24c20eec76
16 changed files with 462 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/plugins/cli-backend-plugins.md
+16 -6
View File
@@ -254,13 +254,23 @@ requires a no-tools CLI run.
Set `nativeToolMode: "selectable"` only when `resolveExecutionArgs` can disable
every backend-native tool for an individual run. For those restricted runs,
`ctx.toolAvailability.native` is an empty tuple and
`ctx.toolAvailability.native` is the exact backend-native tool list and
`ctx.toolAvailability.mcp` is the exact host-isolated MCP allowlist. The hook
must replace conflicting tool flags and return argv that enforces both values;
OpenClaw calls it once with the final fresh or resume argv and fails closed when
the backend cannot enforce the restriction. MCP names in this context are safe
to auto-approve only because the host has already limited the generated MCP
configuration to those servers and tools.
must replace conflicting tool flags, disable backend customization surfaces
that can execute outside those tools, and return argv that enforces both
values. OpenClaw calls it once with the final fresh or resume argv and fails
closed when the backend cannot enforce the restriction. MCP names in this
context are safe to auto-approve only because the host has already limited the
generated MCP configuration to those servers and tools.
To support OpenClaw runtime caps such as cron `toolsAllow`, also implement
`resolveRuntimeToolAvailability(ctx)`. OpenClaw passes a normalized,
group-expanded allowlist and always disables backend-native tools. Return only
host-isolated MCP names selected from that allowlist. Returning `null` or
`undefined` keeps the generic runner fail-closed. A backend may omit an allowed
tool it cannot represent, but must never add authority absent from the
allowlist. Before minting a grant, the host rejects any returned entry that is
not the exact `mcp__openclaw__<tool>` name for one of the allowed tools.
### `ownsNativeCompaction`: opting out of OpenClaw compaction