5 Commits

Author	SHA1	Message	Date
Peter Steinberger	0b8aabe864	docs: document auth profile failure policy contract (#89613) ... * docs: document markdown marker renderer * docs: document rendered markdown chunking * docs: document markdown text chunking * docs: document shared text chunking * docs: document plugin text chunking exports * docs: document avatar policy constants * docs: document node match candidates * docs: document scoped expiring id cache * docs: document runtime import normalization * docs: document string sample summaries * docs: document session usage timeseries types * docs: document session usage response types * docs: document manifest frontmatter shapes * docs: document channel route input metadata * docs: document pair loop guard settings * docs: document migration config patch helpers * docs: document api provider registry * docs: document tool call repair payloads * docs: document plugin tool payload helpers * docs: document lazy promise loader * docs: document store writer queue state * docs: document thread binding lifecycle * docs: document concurrency helper contract * docs: document gateway client info contract * docs: document delivery context contracts * docs: document secret ref defaults contract * docs: document command gating contract * docs: document avatar policy contract * docs: document node match policy * docs: document message channel normalization * docs: document boolean parsing contract * docs: document zod parse helpers * docs: document direct dm guard policy * docs: document fixed window limiter contract * docs: document node presence event contract * docs: document secret normalization contract * docs: document progress draft line removal * docs: document usage formatting contracts * docs: document agent run status contract * docs: document runtime import helpers * docs: document provider utility ownership * docs: document invalid config helpers * docs: document json compat parser * docs: document channel config metadata ownership * docs: document channel logging helpers * docs: document sender identity validation ownership * docs: document string sampling helper * docs: document global singleton helpers * docs: document transcript tool helpers * docs: document exec safe-bin normalization * docs: document reaction level resolver * docs: document account snapshot redaction boundary * docs: document messaging target helpers * docs: document thread binding messages * docs: document conversation binding context * docs: document conversation resolution helper * docs: document owner display secret retention * docs: document provider request config types * docs: document skills config types * docs: document memory config types * docs: document imessage config types * docs: document crestodian config types * docs: document tools config policies * docs: document shared config base types * docs: document channel config contracts * docs: document openclaw config state types * docs: document model config contracts * docs: document shared agent config types * docs: document agent defaults config types * docs: document secret input contracts * docs: document auth config contracts * docs: document gateway config contracts * docs: document tool call stream repair contracts * docs: document memory host facades * docs: document llm core contracts * docs: document markdown core contracts * docs: document gateway connect error contracts * docs: document gateway protocol primitives * docs: document gateway frame schemas * docs: document gateway device schemas * docs: document gateway environment schemas * docs: document gateway push schemas * docs: document gateway plugin schemas * docs: document gateway artifact schemas * docs: document gateway command schemas * docs: document gateway task schemas * docs: document gateway exec approval schemas * docs: document gateway secret schemas * docs: document gateway config schemas * docs: document gateway snapshot schemas * docs: document gateway chat schemas * docs: document gateway wizard schemas * docs: document gateway node schemas * docs: document gateway plugin approval schemas * docs: document gateway talk schemas * docs: document gateway agent schemas * docs: document gateway session schemas * docs: document gateway cron schemas * docs: document gateway agent model skill schemas * docs: document gateway skill proposal tool schemas * docs: document gateway protocol registry * docs: document gateway channel status schemas * docs: document gateway schema regression tests * docs: document gateway schema barrel * docs: document gateway validator tests * docs: document gateway primitive push tests * docs: document gateway contract tests * docs: document native protocol guard * docs: document channel schema tests * docs: document gateway protocol smoke tests * docs: document gateway protocol entrypoint * docs: document gateway protocol type exports * docs: document gateway error codes * docs: document protocol schema registry * docs: document talk audio codec * docs: document talk activation names * docs: document talk consult questions * docs: document talk consult tool * docs: document talk run control contracts * docs: document talk run control adapter * docs: document talkback consult queue * docs: document talk consult transcript guard * docs: document talk fast context runtime * docs: document forced talk consult coordinator * docs: document talk output activity tracker * docs: document talk event metrics * docs: document talk diagnostics * docs: document talk observability hook * docs: document talk provider resolver * docs: document talk provider registry * docs: document talk runtime primitives * docs: document talk consult controller logs * docs: document channel identity helpers * docs: document channel account allowlist helpers * docs: document channel metadata draft controls * docs: document channel ingress policy * docs: document channel sender access gates * docs: document channel catalog message contracts * docs: document channel account plugin helpers * docs: document configured binding helpers * docs: document channel acp approval config helpers * docs: document channel bundled config write helpers * docs: document channel plugin utility contracts * docs: document channel config access helpers * docs: document channel message action helpers * docs: document channel outbound runtime helpers * docs: document channel pairing promotion helpers * docs: document channel registry helpers * docs: document channel setup wizard helpers * docs: document channel lifecycle status helpers * docs: document channel target thread helpers * docs: document channel session binding helpers * docs: document channel package module probes * docs: document channel setup wizard contracts * docs: document channel plugin API barrels * docs: document channel contract test helpers * docs: document channel core helpers * docs: document small core facades * docs: document provider runtime helpers * docs: document persistence and realtime helpers * docs: document mcp and state helpers * docs: document tool planner contracts * docs: document music generation runtime * docs: document crestodian command flow * docs: document utility helpers * docs: document node host helpers * docs: document transcript contracts * docs: document trajectory export contracts * docs: document image generation contracts * docs: document routing helper contracts * docs: document session helper contracts * docs: document video generation contracts * docs: document model catalog contracts * docs: document proxy capture contracts * docs: document status rendering contracts * docs: document test helper contracts * docs: document wizard setup contracts * docs: document process contracts * docs: document memory host sdk contracts * docs: document tts contracts * docs: document secrets runtime contracts * docs: document shared helper contracts * docs: document hook runtime contracts * docs: document security audit contracts * docs: document flow contracts * docs: document media understanding contracts * docs: document tui contracts * docs: document logging contracts * docs: document llm contracts * docs: document cron contracts * docs: document daemon contracts * docs: document task contracts * docs: document acp contracts * docs: document test utility contracts * docs: document skill contracts * docs: document config contracts * docs: document outbound infra contracts * docs: document command analysis contracts * docs: document provider usage infra contracts * docs: document file safety infra contracts * docs: document exec approval infra contracts * docs: document gateway runtime infra contracts * docs: document infra utility contracts * docs: document infra queue storage contracts * docs: document heartbeat infra contracts * docs: document remaining infra contracts * docs: document gateway auth contracts * docs: document gateway display helpers * docs: document gateway http helpers * docs: document gateway node helpers * docs: document gateway mcp helpers * docs: document gateway support helpers * docs: document gateway server runtime helpers * docs: document gateway runtime bootstrap helpers * docs: document gateway session events * docs: document gateway utility helpers * docs: document gateway talk helpers * docs: document gateway helper contracts * docs: document gateway server method helpers * docs: document gateway server auth helpers * docs: document gateway server tests * docs: document gateway test helpers * docs: document gateway node tests * docs: document gateway channel tests * docs: document gateway session tests * docs: document gateway server startup tests * docs: document gateway tool test helpers * docs: document gateway server test helpers * docs: document gateway server method tests * docs: document remaining gateway tests * docs: document plugin sdk public subpaths * docs: document plugin sdk runtime helpers * docs: document plugin sdk memory provider helpers * docs: document plugin sdk runtime facades * docs: document plugin sdk command approval helpers * docs: document plugin sdk runtime types * docs: document plugin sdk browser account helpers * docs: document plugin sdk media memory helpers * docs: document plugin sdk core tests * docs: document plugin sdk contract helpers * docs: document plugin sdk test helpers * docs: document remaining plugin sdk tests * docs: document cli utility helpers * docs: document cli runtime helpers * docs: document cli command registration helpers * docs: document node cli helpers * docs: document cli program registration * docs: document message cli registration * docs: document daemon cli helpers * docs: document cli route parsers	2026-06-03 15:20:39 -07:00
Peter Steinberger	538605ff44	[codex] Extract filesystem safety primitives (#77918) ... * refactor: extract filesystem safety primitives * refactor: use fs-safe for file access helpers * refactor: reuse fs-safe for media reads * refactor: use fs-safe for image reads * refactor: reuse fs-safe in qqbot media opener * refactor: reuse fs-safe for local media checks * refactor: consume cleaner fs-safe api * refactor: align fs-safe json option names * fix: preserve fs-safe migration contracts * refactor: use fs-safe primitive subpaths * refactor: use grouped fs-safe subpaths * refactor: align fs-safe api usage * refactor: adapt private state store api * chore: refresh proof gate * refactor: follow fs-safe json api split * refactor: follow reduced fs-safe surface * build: default fs-safe python helper off * fix: preserve fs-safe plugin sdk aliases * refactor: consolidate fs-safe usage * refactor: unify fs-safe store usage * refactor: trim fs-safe temp workspace usage * refactor: hide low-level fs-safe primitives * build: use published fs-safe package * fix: preserve outbound recovery durability after rebase * chore: refresh pr checks	2026-05-06 02:15:17 +01:00
Viz	f624b1d246	fix(security): 7 P1 hardening fixes — scan-paths, windows-acl, audit-extra (#67003) ... * test(security): add coverage tests before security fixes - scan-paths.ts: 100% line coverage (new test file, previously zero) - windows-acl.ts: 100% line coverage (SID bypass, whoami throw, no-user null return) - external-content.ts: 99% (line 248 defensive overlap guard, unreachable) - skill-scanner.ts: 93% (lines 293-294/330/571 are defensive guards for future extensibility, unreachable with current rules/patterns) 200+ tests covering TOCTOU paths, cache invalidation, forced-file escapes, dir-entry-cache hit, SID world-bypass, diacritic-strip fallback, fullwidth homoglyph markers, and more. * fix(security): 5 security hardening fixes in src/security/ scan-paths: default requireRealpath to false (safe). All production callers already pass requireRealpath: true; default callers are now secure. windows-acl: block world-equivalent SIDs (S-1-1-0 Everyone etc.) from being added to trusted set via USERSID env var. windows-acl: log resolveCurrentUserSid failures instead of bare catch{}. audit-extra: wrap JSON.parse in readPluginManifestExtensions with try-catch. Malformed package.json returns [] instead of crashing the audit. audit-extra: depth guard in listWorkspaceSkillMarkdownFiles to prevent resource exhaustion from deep symlink cycles. audit-extra: 2s timeout on fs.realpath in collectWorkspaceSkillSymlinkEscapeFindings to protect against hanging on slow/network filesystems. audit-extra: warn about phantom entries in plugins.allow that don't match any installed plugin (pre-approval exploitation vector). media-understanding/types: add allowPrivateNetwork to transport overrides (duplicate of PR #66967, required for tsgo to pass here). * fix(security): address security review findings in audit-extra.async.ts Issue 1 — Symlink escape audit bypass on realpath timeout: When realpathWithTimeout returns null (timeout or failure), the previous code called 'continue', silently skipping the escape check. An attacker with a symlink to a slow/network filesystem could hang realpath to prevent escape detection. Now treats unverifiable symlinks as potential escapes and includes them in the finding. Issue 2 — Malformed package.json hides extension entrypoints from deep scan: readPluginManifestExtensions previously swallowed JSON.parse errors and returned [], which a malicious plugin could exploit by crafting a malformed package.json to hide its openclaw.extensions entrypoints from the deep code scanner. Now re-throws the parse error (with cause) so the caller in collectPluginsCodeSafetyFindings can surface a warn finding and alert the user, while still scanning the plugin directory via getCodeSafetySummary. * fix(security): address PR review findings (P1 + P2) P1 — BFS realpath in listWorkspaceSkillMarkdownFiles lacks timeout: Extract realpathWithTimeout to module scope so the BFS dequeue loop uses the same 2 s guard as the outer escape-detection callers. Previously only the per-workspace and per-skill-file realpaths had the timeout; a hanging NFS/SMB directory entry inside the BFS could still block indefinitely. P1 (acknowledged limitation) — Promise.race leaves the underlying fs.realpath call running after timeout. fs.realpath cannot be cancelled once submitted to libuv. Callers are sequential (one await at a time), so at most one worker thread is occupied; the OS will eventually time out the stuck call. This is documented in the module-level JSDoc. P2 — Phantom allowlist check incorrectly flags bundled plugin IDs: listChannelPlugins() returns bundled channel plugin IDs (telegram, discord, browser, etc.) that are never in stateDir/extensions. Add bundledPluginIds exclusion so the phantom-entry finding is scoped to user-installed extension IDs only. P2 — Rename MAX_SYMLINK_DEPTH / depthGuard to MAX_TOTAL_DIR_VISITS / totalDirVisits to accurately reflect that the guard caps total BFS iterations (2_000 * 20 = 40_000), not per-path symlink depth. * fix(security): clean up realpathWithTimeout timer and add regression tests - Clear the timer handle when fs.realpath resolves before the deadline, preventing timer accumulation during large audit runs with many files. - Add .unref() on the timer so it cannot hold the process alive while waiting on a potentially hanging NFS/SMB path. Regression tests added for three audit-extra.async security fixes: - manifest parse error: malformed plugin package.json surfaces plugins.code_safety.manifest_parse_error (audit-extra.async.test.ts) - phantom allowlist with bundled exclusion: bundled channel plugin IDs are excluded from plugins.allow_phantom_entries warnings; non-installed non-bundled IDs are correctly reported (audit-plugins-phantom.test.ts) - unverifiable realpath escape: fs.realpath failure / timeout produces a skills.workspace.symlink_escape finding with 'realpath timed out' in the detail (audit-workspace-skill-escape.test.ts) * chore(security): add TODO for structured logger in windows-acl resolveCurrentUserSid console.warn is acceptable short-term but may be noisy on constrained Windows hosts; note the follow-up in-code so it is not lost. * chore: drop unrelated formatting churn from security PR Restores extensions/memory-lancedb/config.ts and src/agents/pi-embedded-helpers/errors.ts to their origin/main state. These were line-wrap-only formatting changes with no relation to the security fixes in this branch. * fix(security): address Codex P2 review findings 1. Normalize plugins.allow entries through normalizePluginId before phantom-entry filtering so that bundled plugin aliases and legacy IDs are correctly excluded. Without this, valid allow entries that resolve via alias normalization could generate false-positive phantom warnings. 2. Surface a skills.workspace.scan_truncated warn finding when the BFS visit cap (MAX_TOTAL_DIR_VISITS) is hit mid-traversal. Previously the scanner silently returned partial results, allowing escaped SKILL.md symlinks in the unvisited tree to go undetected. listWorkspaceSkillMarkdownFiles now returns {skillFilePaths, truncated} and collectWorkspaceSkillSymlinkEscapeFindings emits the new finding when truncated is true. Regression test added for the truncation path using a mocked readdir that fills the queue past the cap (40 001 fake entries) and a mocked realpath for zero-I/O iteration speed. --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-04-16 13:40:05 -04:00
Peter Steinberger	81b19aaa1a	fix(security): enforce plugin and hook path containment	2026-02-19 15:37:29 +01:00
Peter Steinberger	b373461032	refactor(security): share scan path helpers	2026-02-15 04:29:18 +00:00