OpenClaw merged a small but sharp CLI security fix in PR #127856: openclaw nodes describe now sanitizes approved node command identifiers before rendering them in human-readable terminal output.
The affected surface is narrow. A node can advertise command identifiers, and nodes describe prints the effective command list for an operator. If an identifier contained control characters, that text could be rendered directly by the terminal. The PR calls out two concrete classes of bad output: escape sequences and forged lines.
JSON output is intentionally unchanged. Machine consumers still receive the exact raw protocol values. The fix applies at the terminal display boundary, where human-readable text can affect what an operator sees.
What Changed
The production patch is intentionally tiny: the effective-command list now passes command identifiers through OpenClaw's existing terminal-text sanitizer before printing them.
That means normal command names continue to appear normally, while malicious or malformed command names cannot clear the screen, rewrite nearby output, or make terminal text look like something OpenClaw did not actually say.
This is the right place for the guard. The protocol value remains exact for structured consumers, but terminal output gets the same defensive treatment that other untrusted display text needs.
Why It Matters
CLI output is part of the trust surface for operators. Even if a malformed command identifier cannot directly execute code, it can still mislead a human reading diagnostics.
Terminal escape handling is a classic example. A hostile string can hide previous lines, alter colors, move the cursor, or print fake status text. In an agent runtime where nodes and paired devices can advertise capabilities, the command name is not a good place to trust raw text.
PR #127856 closes that gap without changing the underlying node protocol. The machine-readable path stays compatible, and the human-readable path becomes safer.
Operator Impact
For most users, this should be invisible. Normal node command names render exactly as before. The change matters when an approved node command identifier contains control characters or newline tricks.
After the fix:
- human-readable
nodes describeoutput is sanitized; - JSON output preserves raw command identifiers;
- terminals are protected from command-name escape effects;
- tests cover both raw escape sequences and forged newline output.
This is a good example of a security fix that does not need a new setting. The CLI simply treats untrusted display text as untrusted.
Validation
The PR reports that the pre-fix regression failed on a raw ESC[2J sequence plus a forged newline. After the repair, 44 tests passed across src/cli/program.nodes-basic.e2e.test.ts and src/cli/program.nodes-diagnostics-auth.e2e.test.ts. A targeted post-rebase nodes describe regression also passed.
The full changed-file gate passed typechecks, type-aware lint, schema and store guards, media and sidecar checks, import-cycle checks, and pairing guards. git diff --check passed, and autoreview reported no accepted or actionable findings.
Bottom Line
OpenClaw's node diagnostics now keep terminal display separate from raw protocol data. That is a small code change with a clear operator-safety payoff.