惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

The GitHub Blog
The GitHub Blog
Jina AI
Jina AI
月光博客
月光博客
博客园 - Franky
小众软件
小众软件
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
V
Visual Studio Blog
有赞技术团队
有赞技术团队
V
V2EX
IT之家
IT之家
阮一峰的网络日志
阮一峰的网络日志
Stack Overflow Blog
Stack Overflow Blog
H
Help Net Security
Apple Machine Learning Research
Apple Machine Learning Research
腾讯CDC
D
DataBreaches.Net
Hugging Face - Blog
Hugging Face - Blog
Martin Fowler
Martin Fowler
罗磊的独立博客
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
WordPress大学
WordPress大学
C
Check Point Blog
Microsoft Azure Blog
Microsoft Azure Blog
Microsoft Security Blog
Microsoft Security Blog

Recent Commits to openclaw:main

test: merge chat side-result checks · openclaw/openclaw@ddd2c2a test: merge cron history checks · openclaw/openclaw@f7eb746 test: merge responsive navigation shell checks · openclaw/openclaw@c2e4b47 docs(changelog): add codex oauth fixes · openclaw/openclaw@628e6cd test: merge navigation routing cases · openclaw/openclaw@5d8cecb Tests: mock channel registry bundled fallback · openclaw/openclaw@2b08233 Secrets: avoid broad web search discovery for single plugin config · openclaw/openclaw@a464f59 test: merge config view browser checks · openclaw/openclaw@20cf511 fix(status): align oauth health with runtime · openclaw/openclaw@eed7116 feat: add macOS screen snapshots for monitor preview (#67954) thanks … · openclaw/openclaw@f377db1 fix: report shared auth scopes in hello-ok (#67810) thanks @BunsDev · openclaw/openclaw@0b6c39b Auto-reply: avoid eager bundled route fallback · openclaw/openclaw@3ea1bf4 Tests: narrow session binding contract setup · openclaw/openclaw@54e4e16 fix(macOS): enable undo/redo in webchat composer text input (#34962) · openclaw/openclaw@00951dc Tests: speed up channel setup promotion · openclaw/openclaw@82b529a Docs: refresh agent instructions · openclaw/openclaw@5775fe2 fix(auth): serialize OAuth refresh across agents to fix #26322 (#67876) · openclaw/openclaw@8e79080 test: allow ollama public surface boundary test · openclaw/openclaw@7d4f1a6 Docs: add test performance guardrails · openclaw/openclaw@89706d3 Tests: restore context-engine usage proof · openclaw/openclaw@e4c4f95 Tests: slim context engine runtime coverage · openclaw/openclaw@74c198f ci: retry failed custom checkouts · openclaw/openclaw@0ee5baf test: trim duplicate provider auth onboarding cases · openclaw/openclaw@1ffc02e matrix: fix sessions_spawn --thread subagent session spawning (#67643) · openclaw/openclaw@1ce2596 test: reduce auth choice fixture churn · openclaw/openclaw@857b9cd test: mock health status config boundaries · openclaw/openclaw@9d5ab4a test: mock onboard config io boundary · openclaw/openclaw@299694d test: mock legacy state plugin boundaries · openclaw/openclaw@2713089 test: mock channel install boundaries · openclaw/openclaw@b945248 test: mock doctor preview channel boundaries · openclaw/openclaw@b1a3ad4
fix: honor wildcard tool denylists in factory planning (#...
steipete · 2026-05-04 · via Recent Commits to openclaw:main
Original file line numberDiff line numberDiff line change

@@ -10,7 +10,7 @@ Docs: https://docs.openclaw.ai

1010
1111

### Changes

1212
13-

- Agents/tools: skip optional media and PDF tool factories when the effective tool denylist already blocks them, avoiding unnecessary hot-path setup for tools that will be filtered out before model use.

13+

- Agents/tools: skip optional media and PDF tool factories when the effective tool denylist already blocks them, avoiding unnecessary hot-path setup for tools that will be filtered out before model use. (#76773) Thanks @dorukardahan.

1414

- Gateway/performance: lazy-load early runtime discovery and shutdown-hook helpers, defer maintenance timers until after readiness, and trim duplicate plugin auto-enable work during Gateway startup.

1515

- QA/Mantis: add a `pnpm openclaw qa mantis discord-smoke` runner and manual GitHub workflow that verify the Mantis Discord bot can see the configured guild/channel, post a smoke message, add a reaction, and upload artifacts.

1616

- Gateway/performance: lazy-load the heavy cron runtime after the rest of Gateway startup, defer restart-sentinel refresh after readiness, and let the Gateway startup benchmark write per-run V8 CPU profiles with `--cpu-prof-dir`.

Original file line numberDiff line numberDiff line change

@@ -276,6 +276,45 @@ describe("optional media tool factory planning", () => {

276276

});

277277

});

278278
279+

it("applies wildcard deny patterns to optional factory planning", () => {

280+

const config: OpenClawConfig = {};

281+

installSnapshot(config, [

282+

createPlugin({

283+

id: "image-owner",

284+

contracts: { imageGenerationProviders: ["image-owner"] },

285+

setupProviders: [{ id: "image-owner", envVars: ["IMAGE_OWNER_API_KEY"] }],

286+

}),

287+

createPlugin({

288+

id: "video-owner",

289+

contracts: { videoGenerationProviders: ["video-owner"] },

290+

setupProviders: [{ id: "video-owner", envVars: ["VIDEO_OWNER_API_KEY"] }],

291+

}),

292+

createPlugin({

293+

id: "music-owner",

294+

contracts: { musicGenerationProviders: ["music-owner"] },

295+

setupProviders: [{ id: "music-owner", envVars: ["MUSIC_OWNER_API_KEY"] }],

296+

}),

297+

createPlugin({

298+

id: "media-owner",

299+

contracts: { mediaUnderstandingProviders: ["anthropic"] },

300+

setupProviders: [{ id: "anthropic", envVars: ["ANTHROPIC_API_KEY"] }],

301+

}),

302+

]);

303+
304+

expect(

305+

__testing.resolveOptionalMediaToolFactoryPlan({

306+

config,

307+

authStore: createAuthStore(["image-owner", "video-owner", "music-owner", "anthropic"]),

308+

toolDenylist: ["*_generate", "p*"],

309+

}),

310+

).toEqual({

311+

imageGenerate: false,

312+

videoGenerate: false,

313+

musicGenerate: false,

314+

pdf: false,

315+

});

316+

});

317+
279318

it("keeps auth-backed providers on the factory path", () => {

280319

const config: OpenClawConfig = {};

281320

installSnapshot(config, [

Original file line numberDiff line numberDiff line change

@@ -22,7 +22,7 @@ import {

2222

import type { SandboxFsBridge } from "./sandbox/fs-bridge.js";

2323

import type { SpawnedToolContext } from "./spawned-context.js";

2424

import type { ToolFsPolicy } from "./tool-fs-policy.js";

25-

import { expandToolGroups, normalizeToolName } from "./tool-policy.js";

25+

import { isToolAllowedByPolicyName } from "./tool-policy-match.js";

2626

import { createAgentsListTool } from "./tools/agents-list-tool.js";

2727

import { createCanvasTool } from "./tools/canvas-tool.js";

2828

import type { AnyAgentTool } from "./tools/common.js";

@@ -83,31 +83,15 @@ function hasExplicitImageModelConfig(config: OpenClawConfig | undefined): boolea

8383

return hasToolModelConfig(coerceImageModelConfig(config));

8484

}

8585
86-

function isToolAllowedByFactoryAllowlist(toolName: string, allowlist?: string[]): boolean {

87-

if (!allowlist || allowlist.length === 0) {

88-

return true;

89-

}

90-

const expanded = new Set(expandToolGroups(allowlist));

91-

return expanded.has("*") || expanded.has(normalizeToolName(toolName));

92-

}

93-
94-

function isToolDeniedByFactoryDenylist(toolName: string, denylist?: string[]): boolean {

95-

if (!denylist || denylist.length === 0) {

96-

return false;

97-

}

98-

const expanded = new Set(expandToolGroups(denylist));

99-

return expanded.has("*") || expanded.has(normalizeToolName(toolName));

100-

}

101-
10286

function isToolAllowedByFactoryPolicy(params: {

10387

toolName: string;

10488

allowlist?: string[];

10589

denylist?: string[];

10690

}): boolean {

107-

if (isToolDeniedByFactoryDenylist(params.toolName, params.denylist)) {

108-

return false;

109-

}

110-

return isToolAllowedByFactoryAllowlist(params.toolName, params.allowlist);

91+

return isToolAllowedByPolicyName(params.toolName, {

92+

allow: params.allowlist,

93+

deny: params.denylist,

94+

});

11195

}

11296
11397

function resolveImageToolFactoryAvailable(params: {