Repository navigation
Console Harness switching restricts an unrestricted native plugin allowlist #2256
Description
Commit or version
Verified upstream main: b13be62aae45f5b8eac9911c6b2bd7a22cadb57a. The defect remains in the OCE Console's updateModelConfiguration.
Environment
OCE Console, ordinary Create Agent workflow with a valid OpenClaw Preset and model Secret. Reproduced with Chromium through Playwright 1.63.0 on macOS, Node.js 24.3.0, real loopback Fastify routes, Native IAM, and in-memory platform storage. The test uses the filesystem Configuration Driver. No deployed runtime or model turn is needed to observe the Configuration rewrite.
Reproduction
-
Apply a valid OpenClaw Preset that contains an enabled native plugin entry. For example, its Configuration can contain this synthetic fragment, alongside its existing valid model and gateway settings:
{ "plugins": { "entries": { "knowledge": { "enabled": true, "config": { "collection": "example-notes" } } } } } -
Open Advanced settings and inspect Configuration JSON. Leave
plugins.allowomitted. -
Change Harness from OpenClaw to Codex.
-
Inspect
plugins.allow. Repeat with an explicitly authored empty array,plugins.allow: [].
The knowledge ID is synthetic; the rewrite can be observed without installing that plugin.
Expected behavior
Harness selection preserves the operator's native plugin permissions. Codex's runtime entry is added or removed separately.
Original plugins.allow |
After selecting Codex | After selecting OpenClaw |
|---|---|---|
| Omitted | Omitted | Omitted |
[] |
[] |
[] |
["knowledge"] |
Unchanged; Codex creation reports a conflict | Unchanged |
["knowledge", "codex"] |
Unchanged | Unchanged |
["codex"] |
Unchanged | Unchanged |
Missing or empty native allowlists stay unrestricted. Nonempty lists keep their authored restriction. Native deny settings and unrelated entries/configuration are preserved. The operator explicitly edits policy to permit a blocked Harness.
The same requirement applies to REST clients: Kubernetes Codex admission rejects native policy that disables or denies Codex, or a restrictive allowlist excluding it. Configuration can be staged separately. Agent create/update, deployment, and provisioning must reject conflicting policy without rewriting it. No browser click history or new persisted removal marker is required.
Actual behavior
For both omitted and empty allowlists, OCE writes plugins.allow: ["codex"]. This changes an unrestricted policy into a Codex-only allowlist. Other native entries remain in the JSON but are excluded by the new allowlist.
The OCE Console creates this restriction; the native runtime receives the already changed Configuration.
Related work and evidence
Proposed upstream fix: draft PR #2258, targeting main from the existing fork head.
Downstream PR #15 contains the same focused fix, regression, documentation, and native GitHub screenshots/video.
The Console and REST regressions fail against unchanged upstream production modules at the verified commit above. Updated source in the linked PRs preserves policy and rejects conflicts. Browser coverage passes 35 cases without skips; API/Compute coverage passes 357 cases with one existing Linux-only skip on macOS. Functional checks and final Storybook evidence were captured at 97e8f3826f5f9826638e3d4df57780d6b2d66c30; final head 0b4a067fda15d08567546d3c1ed7381477ee309b differs only by documentation cleanup.
The linked PRs contain current native GitHub screenshots/video and detailed verification limits. These checks establish configuration preservation and admission, not deployed plugin installation or model execution.
Activity
clawsweeper commentedon Oct 12, 2026
Codex review: this still needs some work.
Summary
This issue establishes a current Configuration rewrite on main, and the same author’s open draft repair at #2258 owns the fix.
Reproducibility: Current main’s handler, Codex template, and pinned native activation code establish the omitted/empty allowlist defect directly; no live reproduction or tests were run in this review.
Root-cause cluster
Relationship:
canonicalCanonical: #2256
Summary: This issue tracks the Console policy mutation, with an open candidate repair; the earlier runtime-preparation repair addresses a different producer.
Members:
fixed_by_candidate: fix: preserve native plugin permissions across Harness selection and admission #2258 - The open draft removes both Console allowlist mutations and adds conflicting-policy admission checks.adjacent_distinct: fix: preserve plugin restrictions and compose tool allowlists #238 - The merged repair preserves policy during runtime preparation, not Console Harness selection.Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.
Next step
Review #2258 at its updated head for policy preservation, round-trip coverage, and REST admission before landing the existing repair.
Security
Needs attention: Current main can silently broaden an authored native plugin restriction during Harness switching.
Review details
Best possible solution:
Keep authored native plugin policy unchanged across Harness switches and reject incompatible Codex admission with a clear explanation before resource writes.
Do we have a high-confidence way to reproduce the issue?
Current main’s handler, Codex template, and pinned native activation code establish the omitted/empty allowlist defect directly; no live reproduction or tests were run in this review.
Is this the best way to solve the issue?
The updated candidate addresses both narrowing and round-trip widening by preserving policy rather than conditionally granting Codex permission, with regression coverage through Console creation and REST admission.
AGENTS.md: found and applied where relevant.
Remaining risk / open question:
Codex review notes: model internal, reasoning medium; reviewed against 52fb0e35a9f8.
Label changes
Label changes:
impact:security: Switching to OpenClaw can turn the authored ["codex"] restriction into an unrestricted empty allowlist.clawsweeper:needs-security-review: Current issue advisory state selects this label.Label justifications:
P2: A deterministic policy rewrite affects a specific advanced Agent-creation workflow, with an existing focused repair and no demonstrated widespread outage.impact:ux-friction: Harness selection silently changes configured plugin permissions, forcing operators to inspect and repair advanced Configuration JSON.impact:security: Switching to OpenClaw can turn the authored ["codex"] restriction into an unrestricted empty allowlist.Evidence reviewed
Security concerns:
apps/controller/src/console/agents/create.mjs:746Selecting OpenClaw removes codex from plugins.allow; an authored ["codex"] becomes [], which native activation treats as unrestricted by the allowlist.
Confidence: 0.99
What I checked:
apps/controller/src/console/agents/create.mjs:735, 52fb0e35a9f8)apps/controller/src/drivers/compute/kubernetes/runtime-entrypoints.ts:926, 52fb0e35a9f8)src/plugins/config-activation-shared.ts:138, 90d30a1178a7)apps/controller/src/console/agents/create.mjs, 0b4a067fda15)tests/browser/console-agent-presets.test.mjs:1316, 0b4a067fda15)How this review workflow works
@clawsweeper re-reviewcomments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.@clawsweeper re-reviewor@clawsweeper re-runon an open PR or issue to request a fresh review only.@clawsweeper reviewto request a fresh review only.@clawsweeper explainto ask for more context, or@clawsweeper stopto stop active automation.Reviewed October 13, 2026, 10:34 AM ET / 14:34 UTC.