From 814d1fdf1aff18fe044f0d93a244802eaf1fdf95 Mon Sep 17 00:00:00 2001 From: Vincent Koc Date: Thu, 30 Jul 2026 13:02:57 +0800 Subject: [PATCH] fix(test): review Codex runtime scan chunks (#116212) * fix(test): review Codex runtime scan chunks * fix(test): count reviewed scan findings --- .../npm-install-security-scan.release.test.ts | 110 ++++++++++++------ 1 file changed, 76 insertions(+), 34 deletions(-) diff --git a/src/plugins/npm-install-security-scan.release.test.ts b/src/plugins/npm-install-security-scan.release.test.ts index 896624a5704e..1ce4fbe8c65a 100644 --- a/src/plugins/npm-install-security-scan.release.test.ts +++ b/src/plugins/npm-install-security-scan.release.test.ts @@ -23,28 +23,32 @@ type PublishablePluginPackage = { }; const execFileAsync = promisify(execFile); -const REQUIRED_REVIEWED_PUBLISHABLE_CRITICAL_FINDINGS = new Set([ - "@openclaw/acpx:dangerous-exec:src/codex-auth-bridge.ts", - "@openclaw/acpx:dangerous-exec:src/runtime-internals/mcp-proxy.mjs", - "@openclaw/codex:dangerous-exec:src/app-server/sandbox-exec-server/http.ts", - "@openclaw/codex:dangerous-exec:src/app-server/sandbox-exec-server/processes.ts", - "@openclaw/codex:dangerous-exec:src/app-server/transport-stdio.ts", - "@openclaw/codex:dangerous-exec:src/node-cli-sessions.ts", - "@openclaw/discord:dangerous-exec:src/voice/audio.ts", - "@openclaw/google-meet:dangerous-exec:src/node-host.ts", - "@openclaw/mxc-sandbox:dangerous-exec:src/readiness.ts", - "@openclaw/raft:dangerous-exec:src/gateway.ts", - "@openclaw/signal:dangerous-exec:src/daemon.ts", - "@openclaw/voice-call:dangerous-exec:src/tunnel.ts", +const REQUIRED_REVIEWED_PUBLISHABLE_CRITICAL_FINDING_COUNTS = new Map([ + ["@openclaw/acpx:dangerous-exec:src/codex-auth-bridge.ts", 1], + ["@openclaw/acpx:dangerous-exec:src/runtime-internals/mcp-proxy.mjs", 1], + ["@openclaw/codex:dangerous-exec:src/app-server/sandbox-exec-server/http.ts", 1], + ["@openclaw/codex:dangerous-exec:src/app-server/sandbox-exec-server/processes.ts", 1], + ["@openclaw/codex:dangerous-exec:src/app-server/transport-stdio.ts", 1], + ["@openclaw/codex:dangerous-exec:src/node-cli-sessions.ts", 1], + ["@openclaw/discord:dangerous-exec:src/voice/audio.ts", 1], + ["@openclaw/google-meet:dangerous-exec:src/node-host.ts", 1], + ["@openclaw/mxc-sandbox:dangerous-exec:src/readiness.ts", 2], + ["@openclaw/raft:dangerous-exec:src/gateway.ts", 1], + ["@openclaw/signal:dangerous-exec:src/daemon.ts", 1], + ["@openclaw/voice-call:dangerous-exec:src/tunnel.ts", 1], ]); -const OPTIONAL_REVIEWED_PUBLISHABLE_DIST_CRITICAL_FINDINGS = new Set([ - "@openclaw/acpx:dangerous-exec:dist/mcp-proxy.mjs", - "@openclaw/acpx:dangerous-exec:dist/service-.js", - "@openclaw/codex:dangerous-exec:dist/client-.js", - "@openclaw/google-meet:dangerous-exec:dist/index.js", - "@openclaw/slack:dynamic-code-execution:dist/outbound-payload.test-harness-.js", - "@openclaw/voice-call:dangerous-exec:dist/runtime-entry-.js", +// Generated chunks can contain multiple reviewed execution sites. Counts are +// part of the contract so an added or missing site fails the release scan. +const OPTIONAL_REVIEWED_PUBLISHABLE_DIST_CRITICAL_FINDING_COUNTS = new Map([ + ["@openclaw/acpx:dangerous-exec:dist/mcp-proxy.mjs", 1], + ["@openclaw/acpx:dangerous-exec:dist/service-.js", 1], + ["@openclaw/codex:dangerous-exec:dist/run-attempt-.js", 2], + ["@openclaw/codex:dangerous-exec:dist/session-catalog-.js", 1], + ["@openclaw/codex:dangerous-exec:dist/transport-stdio-.js", 1], + ["@openclaw/google-meet:dangerous-exec:dist/index.js", 1], + ["@openclaw/slack:dynamic-code-execution:dist/outbound-payload.test-harness-.js", 1], + ["@openclaw/voice-call:dangerous-exec:dist/runtime-entry-.js", 1], ]); function parseNpmPackFiles(raw: string, packageName: string): string[] { @@ -87,7 +91,14 @@ function isScannerWalkedPackedPath(packedPath: string): boolean { } function normalizePackedFindingPath(packedPath: string): string { - for (const prefix of ["client", "outbound-payload.test-harness", "runtime-entry", "service"]) { + for (const prefix of [ + "outbound-payload.test-harness", + "run-attempt", + "runtime-entry", + "service", + "session-catalog", + "transport-stdio", + ]) { if (packedPath.startsWith(`dist/${prefix}-`) && packedPath.endsWith(".js")) { return `dist/${prefix}-.js`; } @@ -100,8 +111,12 @@ function expectedOptionalReviewedFindingsForPackedPath( packedPath: string, ): string[] { const normalizedPath = normalizePackedFindingPath(packedPath); - return [...OPTIONAL_REVIEWED_PUBLISHABLE_DIST_CRITICAL_FINDINGS].filter( - (key) => key.startsWith(`${packageName}:`) && key.endsWith(`:${normalizedPath}`), + const keyPrefix = `${packageName}:`; + const keySuffix = `:${normalizedPath}`; + return [...OPTIONAL_REVIEWED_PUBLISHABLE_DIST_CRITICAL_FINDING_COUNTS].flatMap(([key, count]) => + key.startsWith(keyPrefix) && key.endsWith(keySuffix) + ? Array.from({ length: count }, () => key) + : [], ); } @@ -240,8 +255,8 @@ async function scanPublishablePluginPackage(plugin: PublishablePluginPackage): P const packedPath = normalizePackedFindingPath(toRepoPath(relative(stageDir, finding.file))); const key = `${plugin.packageName}:${finding.ruleId}:${packedPath}`; if ( - REQUIRED_REVIEWED_PUBLISHABLE_CRITICAL_FINDINGS.has(key) || - OPTIONAL_REVIEWED_PUBLISHABLE_DIST_CRITICAL_FINDINGS.has(key) + REQUIRED_REVIEWED_PUBLISHABLE_CRITICAL_FINDING_COUNTS.has(key) || + OPTIONAL_REVIEWED_PUBLISHABLE_DIST_CRITICAL_FINDING_COUNTS.has(key) ) { reviewedCriticalFindings.push(key); continue; @@ -281,7 +296,7 @@ describe("publishable plugin npm package install security scan", () => { ); const missingPackages = [ ...new Set( - [...REQUIRED_REVIEWED_PUBLISHABLE_CRITICAL_FINDINGS].map((key) => + [...REQUIRED_REVIEWED_PUBLISHABLE_CRITICAL_FINDING_COUNTS.keys()].map((key) => key.slice(0, key.indexOf(":")), ), ), @@ -301,6 +316,35 @@ describe("publishable plugin npm package install security scan", () => { }); }); + it("does not review unknown Codex dist chunk names", () => { + const packedPath = "dist/future-exec-unknown.js"; + + expect(normalizePackedFindingPath(packedPath)).toBe(packedPath); + expect(expectedOptionalReviewedFindingsForPackedPath("@openclaw/codex", packedPath)).toEqual( + [], + ); + }); + + it("requires exact occurrence counts for reviewed Codex dist chunks", () => { + const runAttemptKey = "@openclaw/codex:dangerous-exec:dist/run-attempt-.js"; + + expect( + expectedOptionalReviewedFindingsForPackedPath( + "@openclaw/codex", + "dist/run-attempt-current.js", + ), + ).toEqual([runAttemptKey, runAttemptKey]); + expect( + expectedOptionalReviewedFindingsForPackedPath( + "@openclaw/codex", + "dist/session-catalog-current.js", + ), + ).toEqual(["@openclaw/codex:dangerous-exec:dist/session-catalog-.js"]); + expect( + expectedOptionalReviewedFindingsForPackedPath("@openclaw/codex", "dist/client-retired.js"), + ).toEqual([]); + }); + test.concurrent.each(publishablePluginPackages)( "keeps $packageName files clear of unexpected critical hits", async (plugin) => { @@ -308,18 +352,16 @@ describe("publishable plugin npm package install security scan", () => { if (!result) { throw new Error(`Missing package scan result for ${plugin.packageName}`); } - const expectedReviewedCriticalFindings = new Set( - [...REQUIRED_REVIEWED_PUBLISHABLE_CRITICAL_FINDINGS].filter((key) => - key.startsWith(`${plugin.packageName}:`), + const expectedReviewedCriticalFindings = [ + ...[...REQUIRED_REVIEWED_PUBLISHABLE_CRITICAL_FINDING_COUNTS].flatMap(([key, count]) => + key.startsWith(`${plugin.packageName}:`) ? Array.from({ length: count }, () => key) : [], ), - ); - for (const key of result.expectedReviewedCriticalFindings) { - expectedReviewedCriticalFindings.add(key); - } + ...result.expectedReviewedCriticalFindings, + ]; expect(result.unexpectedCriticalFindings.toSorted()).toStrictEqual([]); expect(result.reviewedCriticalFindings.toSorted()).toEqual( - [...expectedReviewedCriticalFindings].toSorted(), + expectedReviewedCriticalFindings.toSorted(), ); }, );