Sliverp
84c7d45f15
* refactor(qqbot): remove bundled extension source Mechanical deletion half of the #107295 squashed rebase; the catalog repoint and host integration land in the follow-up commit. Co-authored-by: sliverp <870080352@qq.com> * refactor(qqbot): install plugin from Tencent package Squashed rebase of #107295 onto current main. Repoints the official external channel catalog at @tencent-connect/openclaw-qqbot@2.0.1 and adapts onboarding, doctor migrations, secrets, build guards, and tests. Documents the known limitation that the external package does not support structured SecretRef clientSecret values; operators move those to QQBOT_CLIENT_SECRET or clientSecretFile before upgrading. Co-authored-by: sliverp <870080352@qq.com> * fix(doctor): reuse shared hasOwnKey record helper The rebased QQBot migration carried its own hasOwnKey export, colliding with the one main now ships in legacy-config-record-shared.ts. Co-authored-by: sliverp <870080352@qq.com> * fix(plugins): carry catalog integrity through the update bridge The externalized-bundled-plugin bridge dropped the official catalog's expectedIntegrity pin, so bundled-user updates installed the external npm package without integrity verification. The bridge now carries the pin for the catalog's exact npm spec and both bridge install calls pass it through; update-channel spec overrides intentionally skip the pin since it only covers the pinned version. Co-authored-by: sliverp <870080352@qq.com> * chore(plugin-sdk): refresh per-entrypoint API baselines The QQBot compat export and bundled-type removal shift 26 entrypoint closure hashes in the new split baseline layout. Co-authored-by: sliverp <870080352@qq.com> * refactor(qqbot): drop helper reintroduced during rebase Main's coercion consolidation added this file after the deletion commit's base; its only consumers were the removed qqbot sources. Co-authored-by: sliverp <870080352@qq.com> --------- Co-authored-by: Peter Steinberger <steipete@gmail.com>
Compiled OpenGrep super-configs
precise.yml is OpenClaw's shipped precise OpenGrep rulepack. Each rule is tied
to a source advisory, vulnerability report, or review identifier through metadata
and is intended to have concrete coverage of the original vulnerable behavior or
a verified variant.
Rule provenance lives in each compiled rule's metadata; no separate manifest is committed or generated by default.
Noisy exploratory rules are intentionally kept out of the tracked repo. Anything
appended to precise.yml must be low-noise enough to run as a blocking PR-diff
check and as a manual full-repository audit.
Editing rules
precise.yml is the checked-in compiled rulepack. Prefer changing source rule
YAML and rerunning security/opengrep/compile-rules.mjs instead of hand-editing
compiled rules. The compiler appends new rule IDs by default; use
--replace-precise only when intentionally rebuilding the rulepack from a
complete source folder. Direct edits are discouraged because they can bypass ID,
metadata, duplicate, and OpenGrep validation.
Rule naming and metadata
Every rule's id is rewritten to <source-id>.<original-id>. Every rule's
metadata block is augmented with source fields enforced by
pnpm check:opengrep-rule-metadata:
| Key | Value |
|---|---|
ghsa |
GHSA-xxxx-xxxx-xxxx for GHSA-backed rules |
advisory-id |
non-GHSA source identifier, or the GHSA ID normalized by the compiler |
advisory-url |
durable URL to the advisory, report, review record, or source context |
detector-bucket |
precise |
source-rule-id |
the original source rule id |
source-file |
optional source YAML file used during compilation |
Recompiling
# from the openclaw repo root
node security/opengrep/compile-rules.mjs \
--rules-dir <folder-with-source-rule-yaml>
The script:
- Recursively walks every
.yml/.yamlfile under--rules-dir - Reads top-level
rulesarrays from those source files - Requires each source rule to provide
metadata.ghsaormetadata.advisory-id - Requires
metadata.advisory-urlfor non-GHSA source identifiers - Rewrites ids and injects metadata as above
- Appends only new precise rule ids to the existing
precise.ymlby default; pass--replace-preciseto rebuild it from just the supplied source folder - Runs
opengrep scan --no-strictagainst an empty target to identify schema-invalid or parser-invalid rules and drops mapped bad rules so the published super-config loads cleanly - Writes
precise.yml
Skipped, duplicate, or invalid rules are summarized on stdout/stderr for follow-up.
Validating locally
pnpm check:opengrep-rule-metadata
opengrep validate security/opengrep/precise.yml
The metadata check must pass before rules are committed. OpenGrep validation must
exit zero. Warnings about unknown fields are acceptable only when OpenGrep still
reports Configuration is valid and a non-zero rule count. The compile script
drops mapped schema/parser-invalid rules and fails closed when OpenGrep
validation itself cannot be completed.
Running locally
scripts/run-opengrep.sh
For SARIF output matching the PR workflow's diff-scoped scan:
scripts/run-opengrep.sh --changed --sarif
For SARIF output matching the manual full-repository workflow:
scripts/run-opengrep.sh --sarif
Why --no-strict?
Some generated rules trigger non-fatal opengrep warnings (for example,
unknown-field warnings on compatibility-only keys). --no-strict keeps
opengrep's exit code clean for those warnings. Parser-invalid rules are still
dropped during compilation so the checked-in super-config validates before CI
uses it.
Why --no-git-ignore?
Some OpenClaw paths are excluded by .gitignore for build reasons even though
they contain meaningful source code we want scanned. --no-git-ignore keeps
opengrep from skipping them.