Add OpenClaw environment type#402
Conversation
This PR adds a new OpenClaw environment that exposes agentic tool capabilities
for reinforcement learning training. OpenClaw is a personal AI assistant framework
that provides agents with access to:
- File system operations (read, write, edit)
- Shell command execution (exec)
- Web research tools (web_search, web_fetch)
- Memory/context management (memory_search, memory_get)
The environment wraps these capabilities as MCP (Model Context Protocol) tools,
enabling RL agents to learn real-world agentic workflows like coding, research,
and automation tasks.
Features:
- Full MCP tool integration following the OpenEnv patterns
- Isolated workspace per episode for safe exploration
- Sandbox mode for web tools (simulated results)
- Comprehensive test suite
- Docker support with CI integration
Usage:
```python
from openclaw_env import OpenClawEnv
with OpenClawEnv(base_url="http://localhost:8000") as env:
env.reset()
tools = env.list_tools()
result = env.call_tool("exec", command="echo hello")
```
meta-cla
Bot
added
the
CLA Signed
Greptile SummaryAdds a new OpenClaw environment following the MCP (Model Context Protocol) pattern established in RFC 003. The implementation provides 8 tools for agentic RL training: file operations (read/write/edit), shell execution (exec), web tools (web_search/web_fetch - simulated in sandbox), and memory management (memory_search/memory_get). Key Changes:
Architecture Alignment:
Confidence Score: 5/5
Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Agent] -->|ListToolsAction| B[OpenClawEnvironment]
A -->|CallToolAction| B
B --> C{Tool Router}
C -->|exec| D[Shell Execution]
C -->|read/write/edit| E[File Operations]
C -->|web_search/web_fetch| F[Web Tools - Simulated]
C -->|memory_search/memory_get| G[Memory Management]
D --> H[Workspace Sandbox]
E --> H
G --> H
H -->|Observation| A
F -->|Observation| A
I[Infrastructure] -->|reset| B
I -->|state| B
B -->|Creates per episode| H
style H fill:#e1f5ff
style A fill:#fff4e1
style I fill:#ffe1f5
style B fill:#e1ffe1
Last reviewed commit: 984320c |
|
Hi @zkwentz! Thank you for your pull request. We require contributors to sign our Contributor License Agreement, and yours needs attention. You currently have a record in our system, but the CLA is no longer valid, and will need to be resubmitted. ProcessIn order for us to review and merge your suggested changes, please sign at https://code.facebook.com/cla. If you are contributing on behalf of someone else (eg your employer), the individual CLA may not be sufficient and your employer may need to sign the corporate CLA. Once the CLA is signed, our tooling will perform checks and validations. Afterwards, the pull request will be tagged with If you have received this in error or have any questions, please contact us at cla@meta.com. Thanks! |
Darktex
left a comment
Darktex
left a comment
There was a problem hiding this comment.
Alignment Review — PR #402
Tier 1: Fixes Required
1. Path traversal vulnerability in _resolve_path() — openclaw_environment.py
Relative paths like ../../etc/passwd resolve via self._workspace / path_obj without calling .resolve() or stripping .. components. This allows escaping the workspace sandbox through any read/write/edit/exec tool call.
Fix: call .resolve() on the final path and assert it remains rooted within self._workspace:
def _resolve_path(self, path: str) -> Path:
resolved = (self._workspace / path).resolve()
if not str(resolved).startswith(str(self._workspace.resolve())):
raise ValueError(f"Path escapes workspace sandbox: {path}")
return resolved2. os.environ leak in exec tool — openclaw_environment.py
The line env={**os.environ, "HOME": str(env._workspace)} forwards the full server process environment to every agent-spawned subprocess. If the server has AWS_SECRET_ACCESS_KEY, HF_TOKEN, OPENAI_API_KEY, etc., agents can read them via exec("env"). Use an allowlist instead:
safe_env = {
"HOME": str(env._workspace),
"PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
"TERM": "xterm",
}3. Dead code in app.py try/except ImportError
Both branches import identically — the except block is unreachable. The except branch should use the standalone import path (from server.openclaw_environment import OpenClawEnvironment).
Tier 2: Alignment Flags (for @Darktex)
FLAG 1: shell=True exec tool threat model — The environment relies entirely on Docker container isolation. The Dockerfile/README should document required container security constraints (no --privileged, no host mounts). Has a security threat model been reviewed?
FLAG 2: memory_search/memory_get cross-episode persistence — Does reset() flush the memory store? If memory from episode N is visible in episode N+1, this violates the "one env = one trajectory" invariant and allows cross-episode information leakage.
FLAG 3: Client-server separation — client.py appears clean (extends MCPToolClient only), but please confirm no server/ imports exist. No models.py is present, which is acceptable if the client imports nothing from the server package.
FLAG 4: Missing RFC — This is a general-purpose agentic environment (shell + filesystem + web + memory), not a narrow domain env. Per PRINCIPLES.md, architectural decisions about new environment categories should be documented in an RFC. Was one filed?
Verdict: REQUEST_CHANGES — The path traversal and os.environ leak are security blockers. The alignment flags warrant human review before merge.
2 participants
Summary
Adds a new OpenClaw environment type following the MCP (Model Context Protocol) pattern.
Features
Tools
Testing
cd tests/envs pytest test_openclaw_environment.py -vRelated