taodeng/olp
1
0
Fork 0
mirror of https://github.com/dtzp555-max/olp.git synced 2026-07-19 09:45:07 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(readme): document client-side shell-tool routing limitation

Browse Source 
OLP cannot fully prevent agentic clients with shell/fs tools from
reporting OLP-server-side state as their own "self-check" results.
This is an architectural property of spawn-CLI proxying.

Phase 6c's --system-prompt override (ADR 0009 Amendment 1) addresses
the prompt-side leak (claude CLI's <env>cwd=...</env> injection). But
if a client like OpenClaw is configured to route shell/fs tool calls
to the OLP server host (not the user's local machine), the agent will
correctly execute tools — and correctly report results — except the
model may describe those results as "my own state" when in fact they
describe the OLP server.

OLP is stateless and doesn't know which client is calling. The system
message is owned by the client. So this is documented as a known
limitation with per-client recommendations:

- OpenClaw client mode: configure shell/fs tools to route locally
- Hermes Agent: not affected (pre-processes tools on its host)
- Cline / Continue.dev / Cursor / Aider: not affected (local tools)
- Generic agentic clients: integrators document to their users

Cross-references ADR 0014 for the multi-tenant security counterpart
(sandbox-runtime prevents cross-client OAuth token reads even when
shell-tool routing is misconfigured — once PR-B HTTP-path activation
ships).

The IDENTITY.md hint that was added to the maintainer's Mac mini
OpenClaw workspace during the 2026-05-28 session was a temporary
client-side hack and is out of OLP scope per maintainer feedback —
it has been reverted.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
taodeng
2026-05-28 19:36:45 +10:00
co-authored by Claude Opus 4.7
parent b1e24b7cb0
commit 3551921f55
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+9
View File
@@ -546,6 +546,15 @@ Behaviors that work correctly at personal/family scale but have ratified follow-
**New config block consumed at D45:** `config.json auth.{ allow_anonymous, owner_only_endpoints, fallback_detail_header_policy }`. Default `allow_anonymous: false` (production-off); set true to accept requests without an OLP API key (development / single-user dev mode). Startup emits a warn when `allow_anonymous: true` so the relaxed posture is observable.
- **Provider-level `cacheKeyFields` mask not implemented.** Cache keys include every IR field including ones individual plugins drop at spawn (e.g., Anthropic plugin drops `temperature`). Spurious cache misses possible (extra spawn cost; never spurious hits). Conservative posture documented in [ADR 0005 Amendment 7](./docs/adr/0005-cache-cross-provider.md). Tracked in [v1.x roadmap #5](./docs/v1x-roadmap.md).
- **Agentic clients with shell-tool routing may report OLP-server-side state as "self".** This is an architectural property of spawn-CLI proxying that OLP cannot fully fix at the proxy layer. When a client like OpenClaw runs in **client mode** (gateway on user's machine, LLM backend pointed at remote OLP) and the agent exposes shell / fs tools, those tool calls execute on whatever machine the client's tool-handler is wired to. If the client's `ocp` / `olp` plugin routes shell to the OLP server host, an in-agent "do a self-check" prompt produces results describing the OLP host (e.g. PI231) rather than the user's local machine. OLP cannot inject "you are the client, not the server" into the prompt because (a) the client owns the system message, and (b) OLP is stateless and doesn't know which client is calling. **Phase 6c's `--system-prompt` override (ADR 0009 Amendment 1) addresses one side of this — claude CLI no longer injects `<env>cwd=...</env>` blocks into the prompt** — but it cannot prevent the client from sending tool-results that the model then describes as its own state. Recommendations for integrators:
- **OpenClaw client mode** — if you want bot self-checks to describe the user's local machine, configure OpenClaw's tool plugins (`plugins.entries.{ocp,olp}` etc.) so shell / fs tools route to the local host, not to the OLP server. The bundled `olp-plugin/` ships as a read-only telemetry surface (no shell mutations); the older `ocp` plugin's shell-routing semantics are OCP-era legacy and may misroute when OLP is the LLM backend.
- **Hermes Agent client mode** — Hermes pre-processes tools on its own host before sending; the LLM emits no tool_use that reaches OLP, so this limitation does not apply to chat-only Hermes flows. Tool-using Hermes flows behave correctly: Hermes runs the tool locally and includes the result as a follow-up user message.
- **Cline / Continue.dev / Cursor / Aider** — IDE clients typically run shell / fs tools locally on the user's machine, so self-checks report the user's machine correctly. No OLP-side action needed.
- **Generic agentic clients** — if your client routes tool execution to the OLP server, expect bot self-reports to describe the OLP server's state. Either: (1) configure your client's tool handler to run tools locally, or (2) document this to your client users as a known limitation.
See [ADR 0014](./docs/adr/0014-sandbox-runtime-integration.md) for the multi-tenant security counterpart of this issue — even with shell-tool routing, OLP server-side sandboxing prevents one client from reading another client's OAuth tokens (Phase 7 PR-A shipped; PR-B HTTP-path activation pending).
---
## Architecture