$ the-wire · showcase
Exec approval hardening, Hyper-V provisioning hangs
By RepoJournal · Filed · About OpenClaw
10 people shipped this
Security hardening for system.run closes whitespace and env-var bypasses while provisioning fixes prevent Hyper-V hangs and OpenRouter cost accounting is corrected.
Two exploit-class fixes shipped in the Windows node. ExecEnvSanitizer now blocks interpreter and tool code-injection environment overrides beyond the previous set, including GIT_CONFIG_* via prefix-block, GIT_PAGER, JAVA_TOOL_OPTIONS, and DOTNET_STARTUP_HOOKS [1]. Separately, ValidateExecApprovalRules normalizes all whitespace to a single ASCII space before checking forbidden fragments, closing a bypass where tab-separated patterns like "iex<TAB>*" evaded the trailing-space match [2]. Both are in openclaw/openclaw-windows-node.
The new exec approvals pipeline now actually executes commands when approved. Previously the handler returned a typed error for every result, including Allow, so no command could ever run through that path. With this change, SystemCapability runs the approved payload directly, bypassing the shell so nothing is re-derived from the raw request [3]. These are breaking changes for anyone relying on the old error behavior.
Provisioning fixes and cost accounting corrections land across the stack. Hyper-V provisioning no longer hangs indefinitely: the first PowerShell Direct call after Start-VM could block instead of fast-failing, stalling the whole retry loop, and plain Windows templates failed when OpenSSH Server was absent [4]. OpenRouter token accounting was corrected: applyProviderReportedUsageCost overwrote only cost.total, leaving component estimates stale so input + output + cacheRead + cacheWrite stopped summing to the total. The fix re-establishes the breakdown [5]. Media kind logic was consolidated onto one canonical MediaKind union, replacing roughly 40 duplicate declarations across core and channel plugins, and fixing a fallback bug where a stored "unknown" reply-chain kind preempted MIME inference [6].
A repository history compaction restored publish performance for clawsweeper-state. Compacting the 30GB history plus stale scratch branches resolved shallow-fetch and merge-base failures behind the 2026-07-19/20 outage [7]. Separately, a docs-only design proposal describes server-bound egress session identity to close the "residual resurrection window" where a session ID evicted after 256 replacements becomes valid again [8].
Action items
- → Deploy openclaw/openclaw-windows-node changes to close the whitespace and env-var bypasses, then update allow-rule configs that relied on tab-separated patterns. openclaw/openclaw-windows-node [immediate]
- → Upgrade Crabbox and retest Hyper-V provisioning if you provision Windows guests on that provider. openclaw/crabbox [plan]
- → Review the server-bound egress session identity design proposal and plan adoption before the tombstone limit is reached. openclaw/crabbox [monitor]
References
- [1] fix(exec-approval): harden environment overrides for system.run ↗ openclaw/openclaw-windows-node
- [2] fix(exec-approval): normalize whitespace in allow-rule validation ↗ openclaw/openclaw-windows-node
- [3] feat: enable the new exec approvals pipeline behind an opt-in setting (#985) ↗ openclaw/openclaw-windows-node
- [4] fix(hyperv): provisioning hangs while Windows guests boot ↗ openclaw/crabbox
- [5] fix(ai): agent lane drops OpenRouter cache-write tokens and under-counts context (#111435) ↗ openclaw/openclaw
- [6] refactor(media): consolidate parallel media-kind unions onto canonical MediaKind (#112063) ↗ openclaw/openclaw
- [7] chore(state): compact history to a fresh root ↗ openclaw/clawsweeper-state
- [8] docs(plan): propose server-bound egress session identity ↗ openclaw/crabbox
