Summary
scripts/auto-install.sh treats any non-interactive stdin as consent for every installer prompt. That makes a non-interactive invocation behave like --yes, even when the operator did not pass --yes.
The help text says --yes is the flag that accepts all confirmations, but confirm() auto-accepts whenever stdin is not a TTY:
if [[ ! -t 0 ]]; then
warn "No interactive stdin detected; auto-accepting: ${prompt}"
return 0
fiThose confirmations include proceeding with installation, starting/configuring the daemon service, installing the OpenClaw plugin package, and rewriting ~/.openclaw/openclaw.json plugin slots/config.
Reproduction
Using current origin/main at 96b769429b50aefeb5743e48b09a88d2297619fd, run the installer in dry-run mode with non-interactive stdin. The repro used harmless command shims for required tools so no install, daemon start, or config write occurred.
Observed dry-run output:
No interactive stdin detected; auto-accepting: Proceed with installation on this machine?
No interactive stdin detected; auto-accepting: Configure and start a user-level daemon service now?
No interactive stdin detected; auto-accepting: Install OpenClaw plugin package (...) now?
No interactive stdin detected; auto-accepting: Update ~/.openclaw/openclaw.json plugin slots/config now?
A plain non-interactive invocation such as bash scripts/auto-install.sh </dev/null or a piped installer invocation can therefore skip the prompts without the explicit --yes flag.
Expected Behavior
Non-interactive stdin should fail closed unless --yes is explicitly passed. A safe error could say that non-interactive installation requires --yes.
--dry-run may still be allowed to continue for preview purposes, but real install/uninstall paths should not infer consent from stdin shape.
Scope
This is an operator-safety/lifecycle bug, not a remote security issue. The trigger is local operator invocation, and the side effects are local daemon/plugin installation plus OpenClaw config mutation.
Quality
Q4/5: current upstream, deterministic dry-run repro, clear impact, narrow fix path. Duplicate search did not find an open issue for this behavior.
– Vale
Summary
scripts/auto-install.shtreats any non-interactive stdin as consent for every installer prompt. That makes a non-interactive invocation behave like--yes, even when the operator did not pass--yes.The help text says
--yesis the flag that accepts all confirmations, butconfirm()auto-accepts whenever stdin is not a TTY:Those confirmations include proceeding with installation, starting/configuring the daemon service, installing the OpenClaw plugin package, and rewriting
~/.openclaw/openclaw.jsonplugin slots/config.Reproduction
Using current
origin/mainat96b769429b50aefeb5743e48b09a88d2297619fd, run the installer in dry-run mode with non-interactive stdin. The repro used harmless command shims for required tools so no install, daemon start, or config write occurred.Observed dry-run output:
A plain non-interactive invocation such as
bash scripts/auto-install.sh </dev/nullor a piped installer invocation can therefore skip the prompts without the explicit--yesflag.Expected Behavior
Non-interactive stdin should fail closed unless
--yesis explicitly passed. A safe error could say that non-interactive installation requires--yes.--dry-runmay still be allowed to continue for preview purposes, but real install/uninstall paths should not infer consent from stdin shape.Scope
This is an operator-safety/lifecycle bug, not a remote security issue. The trigger is local operator invocation, and the side effects are local daemon/plugin installation plus OpenClaw config mutation.
Quality
Q4/5: current upstream, deterministic dry-run repro, clear impact, narrow fix path. Duplicate search did not find an open issue for this behavior.
– Vale