ewilliams28/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-12 21:53:00 -06:00
Code Issues Packages Projects Releases Wiki Activity

test(secrets): cover Code Mode exec store env and document the harness boundary (#122405)

Browse Source 
* test(secrets): cover code-mode nested exec store env; document harness boundary

* docs(secrets): warn that store env does not reach external agent harnesses
This commit is contained in:
Peter Steinberger
2026-08-12 07:06:40 -07:00
committed by GitHub
parent 4fcd9e12d9
commit 85230cf76c
3 changed files with 32 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/cli/secrets.md
+5 -1
View File
@@ -92,7 +92,11 @@ openclaw secrets store get LOG_LEVEL
Secret values never appear in human, `--json`, or `--plain` output. `store get` refuses a `secret` entry as write-only by design and exits `2`; it exits `3` when the name does not exist. Environment-kind values are readable.
Team-scoped `env` entries also reach agent exec environments. Explicit per-call env wins over store values, and host/sandbox security filters can reject protected or credential-shaped names with a warning. `secret` entries are never exposed as subprocess env; use them through `store` SecretRefs instead.
Team-scoped `env` entries also reach commands run by OpenClaw's own exec tool, including Code Mode, sandboxed exec, and `node`-hosted exec. Explicit per-call env wins over store values, and host/sandbox security filters can reject protected or credential-shaped names with a warning. `secret` entries are never exposed as subprocess env; use them through `store` SecretRefs instead.
<Warning>
Store entries do not reach commands run inside an external agent harness. The Codex app-server and its sandbox exec-server, and ACP children such as Claude Code, build their own child environment and never pass through OpenClaw's exec preparation. If an agent run is delegated to one of those harnesses, set the variable in that harness's own configuration instead.
</Warning>
### Remove values