vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-04-23 23:22:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(plugins): prevent untrusted workspace plugins from hijacking bundled provider auth choices [AI] (#62368)

Browse Source 
* fix: address issue

* fix: address review feedback

* docs(changelog): add onboarding auth-choice guard entry

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

* fix: address PR review feedback

---------

Co-authored-by: Devin Robison <drobison@nvidia.com>
This commit is contained in:
Pavan Kumar Gondhi
2026-04-08 23:08:14 +05:30
committed by GitHub
parent 2d0e25c23a
commit 2d97eae53e
11 changed files with 531 additions and 107 deletions
Download Patch File Download Diff File Expand all files Collapse all files

74
src/plugins/providers.test.ts
View File

@@ -548,6 +548,80 @@ describe("resolvePluginProviders", () => {
);
});
it("excludes untrusted workspace provider plugins from setup discovery when requested", () => {
resolvePluginProviders({
config: {
plugins: {
allow: ["openrouter"],
},
},
mode: "setup",
includeUntrustedWorkspacePlugins: false,
});
expectLastSetupRegistryLoad({
onlyPluginIds: ["google", "kilocode", "moonshot"],
});
});
it("keeps trusted but disabled workspace provider plugins eligible in setup discovery", () => {
resolvePluginProviders({
config: {
plugins: {
allow: ["openrouter", "workspace-provider"],
entries: {
"workspace-provider": { enabled: false },
},
},
},
mode: "setup",
includeUntrustedWorkspacePlugins: false,
});
expectLastSetupRegistryLoad({
onlyPluginIds: ["google", "kilocode", "moonshot", "workspace-provider"],
});
});
it("does not include trusted-but-disabled workspace providers when denylist blocks them", () => {
resolvePluginProviders({
config: {
plugins: {
allow: ["openrouter", "workspace-provider"],
deny: ["workspace-provider"],
entries: {
"workspace-provider": { enabled: false },
},
},
},
mode: "setup",
includeUntrustedWorkspacePlugins: false,
});
expectLastSetupRegistryLoad({
onlyPluginIds: ["google", "kilocode", "moonshot"],
});
});
it("does not include workspace providers blocked by allowlist gating", () => {
resolvePluginProviders({
config: {
plugins: {
allow: ["openrouter"],
entries: {
"workspace-provider": { enabled: true },
},
},
},
mode: "setup",
includeUntrustedWorkspacePlugins: false,
});
expectLastSetupRegistryLoad({
onlyPluginIds: ["google", "kilocode", "moonshot"],
});
});
it("loads provider plugins from the auto-enabled config snapshot", () => {
const { rawConfig, autoEnabledConfig } = createAutoEnabledProviderConfig();
applyPluginAutoEnableMock.mockReturnValue({