Repository navigation
fix(config): preserve sensitivity and URL redaction metadata - #139337
Merged
Merged
Conversation
Contributor
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review completeClawSweeper finished reviewing this revision. The review result is being finalized. |
steipete
marked this pull request as ready for review
September 5, 2026 19:50
Contributor
|
Codex review: needs maintainer review before merge. Reviewed September 5, 2026, 4:10 PM ET / 20:10 UTC. ClawSweeper reviewWhat this changesPreserves channel plugins’ credential-redaction declarations across owner changes and restores redacted credential-bearing URLs correctly during config saves. Merge readiness✅ Ready for maintainer review This remains a useful, focused repair: the inspected main revision still contains both defects. No actionable introduced findings were identified, and the broader recovery PR does not supersede this independent change. Priority: P2 Review scores
Verification
How this fits togetherPlugin manifests supply configuration schemas and sensitivity hints to Gateway settings responses and system-agent reads. The same hints help restore hidden credentials when edited configuration is saved. flowchart TD
A[Discovered plugin manifests] --> B[Select channel schema owner]
A --> C[Combine positive redaction declarations]
B --> D[Runtime configuration metadata]
C --> D
D --> E[Redacted Gateway and agent reads]
E --> F[Edited configuration]
F --> G[Restore original hidden credentials]
D --> G
Before mergeNone. Agent review detailsSecurityNone. PR surfaceSource -1, Tests +172, Docs +8. Total +179 across 9 files. View PR surface stats
Review metrics
Technical reviewBest possible solution: Keep sensitivity preservation at the shared metadata producer and maintain symmetric redaction/restoration without changing stored credentials or selected schemas. Do we have a high-confidence way to reproduce the issue? Yes, from source: switching between channel owners drops the inactive owner’s sensitivity hints, and sensitive:false prevents restoration of URLs that the read path redacts. Execution was not performed in this read-only review. Is this the best way to solve the issue? Yes. Repairing the shared metadata producer protects both consumers; separate Gateway and system-agent guards would duplicate policy and leave restoration inconsistent. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning medium; reviewed against 3dd0be4132a5. LabelsLabel changes:
Label justifications:
EvidenceWhat I checked:
Likely related people:
Rating scale
Overall follows the weaker of proof and patch quality. Workflow
HistoryReview history (1 earlier review cycle)
|
steipete
force-pushed
the
steipete/split-135868-config-redaction
branch
from
September 5, 2026 20:02
32b40a7 to
5dc9f6c
Compare
Contributor
Author
|
Merged via squash.
|
github-actions Bot
pushed a commit
to Desicool/openclaw
that referenced
this pull request
Sep 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related: #135868
Independent side-Gateway stage 1 of 3 in the #135868 split: concern F, config sensitivity and URL redaction metadata.
What Problem This Solves
Fixes an issue where switching the plugin that owns a channel could expose credentials retained for another owner in Gateway config responses and system-agent reads. It also fixes config saves rejecting redacted credential-bearing URLs when their UI hint says
sensitive: false.Why This Change Was Made
Channel metadata collection now preserves every discovered owner's positive sensitivity and
url-secretdeclarations while the selected owner still supplies the schema, labels, and other presentation. URL restoration follows the same protection rule as redaction. The existing object-restoration branches and sensitivity-classifier helpers are consolidated without changing SecretRef or wildcard behavior.The metadata producer is the common boundary for Gateway and system-agent consumers; duplicating protection in those consumers would leave schema and write-side restoration inconsistent. The manifest documentation now explains the contract.
User Impact
Retained channel credentials stay redacted after owner changes. Public URLs remain visible, and credential-bearing URLs survive a config read/edit/save round trip. No new configuration, storage schema, dependency, or protocol changes.
Evidence
node scripts/check-changed.mjspassed, including core/test typechecking, lint, config-doc and architecture guards, and all three Knip scans with zero entries.32b40a7a44d(run); exact-head CI for rebased5dc9f6ca2d7passed (run).The exact introducing commit is not established; the defects were reproduced against the task's main baseline before production changes. This PR carries only the independently useful config concern from #135868; automatic recovery and Gateway cleanup authority remain in their owning stages.