fix: keep blank agent allowlists fail closed (#85849) · o...

Recent Commits to openclaw:main

steipete · 2026-05-24 · via Recent Commits to openclaw:main

Original file line number	Diff line number	Diff line change
`@@ -137,6 +137,20 @@ describe("createAgentToAgentPolicy", () => {`
`137`	`137`	`expect(policy.matchesAllow("ops")).toBe(false);`
`138`	`138`	`});`
`139`	`139`
	`140`	`+it("keeps blank configured allow patterns fail-closed", () => {`
	`141`	`+const policy = createAgentToAgentPolicy({`
	`142`	`+tools: {`
	`143`	`+agentToAgent: {`
	`144`	`+enabled: true,`
	`145`	`+allow: [" "],`
	`146`	`+},`
	`147`	`+},`
	`148`	`+} as unknown as OpenClawConfig);`
	`149`	`+`
	`150`	`+expect(policy.matchesAllow("ops")).toBe(false);`
	`151`	`+expect(policy.isAllowed("main", "ops")).toBe(false);`
	`152`	`+});`
	`153`	`+`
`140`	`154`	`it("handles interior wildcards", () => {`
`141`	`155`	`const policy = createAgentToAgentPolicy({`
`142`	`156`	`tools: {`

Original file line number	Diff line number	Diff line change
`@@ -96,6 +96,7 @@ export function resolveSandboxSessionToolsVisibility(cfg: OpenClawConfig): "spaw`
`96`	`96`
`97`	`97`	`type CompiledAgentAllowPattern =`
`98`	`98`	`\| { kind: "all" }`
	`99`	`+\| { kind: "deny" }`
`99`	`100`	`\| { kind: "exact"; value: string }`
`100`	`101`	`\| {`
`101`	`102`	`kind: "wildcard";`
`@@ -104,10 +105,10 @@ type CompiledAgentAllowPattern =`
`104`	`105`	`interior: string[];`
`105`	`106`	`};`
`106`	`107`
`107`		`-function compileAgentAllowPattern(pattern: string): CompiledAgentAllowPattern \| null {`
	`108`	`+function compileAgentAllowPattern(pattern: string): CompiledAgentAllowPattern {`
`108`	`109`	`const raw = normalizeOptionalString(pattern) ?? "";`
`109`	`110`	`if (!raw) {`
`110`		`-return null;`
	`111`	`+return { kind: "deny" };`
`111`	`112`	`}`
`112`	`113`	`if (raw === "*") {`
`113`	`114`	`return { kind: "all" };`
`@@ -161,9 +162,7 @@ export function createAgentToAgentPolicy(cfg: OpenClawConfig): AgentToAgentPolic`
`161`	`162`	`const routingA2A = cfg.tools?.agentToAgent;`
`162`	`163`	`const enabled = routingA2A?.enabled === true;`
`163`	`164`	`const rawAllowPatterns = Array.isArray(routingA2A?.allow) ? routingA2A.allow : [];`
`164`		`-const allowPatterns = rawAllowPatterns`
`165`		`-.map((pattern) => compileAgentAllowPattern(pattern))`
`166`		`-.filter((pattern): pattern is CompiledAgentAllowPattern => pattern !== null);`
	`165`	`+const allowPatterns = rawAllowPatterns.map((pattern) => compileAgentAllowPattern(pattern));`
`167`	`166`	`const hasWildcardPatterns = allowPatterns.some((pattern) => pattern.kind === "wildcard");`
`168`	`167`	`const matchesAllow = (agentId: string) => {`
`169`	`168`	`if (allowPatterns.length === 0) {`
`@@ -174,6 +173,9 @@ export function createAgentToAgentPolicy(cfg: OpenClawConfig): AgentToAgentPolic`
`174`	`173`	`if (pattern.kind === "all") {`
`175`	`174`	`return true;`
`176`	`175`	`}`
	`176`	`+if (pattern.kind === "deny") {`
	`177`	`+return false;`
	`178`	`+}`
`177`	`179`	`if (pattern.kind === "exact") {`
`178`	`180`	`return pattern.value === agentId;`
`179`	`181`	`}`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main