gnezim/clawsec
1
0
Fork 0
mirror of https://github.com/prompt-security/clawsec.git synced 2026-06-13 05:28:02 +03:00
Code Issues Packages Projects Releases Wiki Activity
Files
7cdb4ab7e245d210b8cacf66874f9eb491e93464
clawsec/docs/REMEDIATION_PLAN.md
T
Aldo Delgado 7cdb4ab7e2 fix(portability): harden cross-platform path handling and install workflows (#62) 
* docs: add agent collaboration and git safety rules to AGENTS.md

* fix(portability): harden cross-platform path handling and install workflows

- add shared path resolution utility for advisory guardian components
- expand and normalize home-path tokens: ~, $HOME, ${HOME}, %USERPROFILE%, $env:USERPROFILE
- reject unresolved/escaped home tokens to prevent literal "$HOME" directory creation
- fix install/runtime path handling in:
  - openclaw-audit-watchdog setup_cron and suppression config loader
  - clawsec-suite advisory hook handler, suppression loader, and guarded installer
- remove hardcoded Homebrew binary assumptions in watchdog scripts/tests
- add LF enforcement via .gitattributes to reduce CRLF script breakage
- expand CI Node checks to linux/macos/windows matrix
- add cross-platform test coverage for path expansion and token rejection
- update README and SKILL docs with bash/zsh/PowerShell-safe path guidance
- add compatibility deliverables:
  - docs/COMPATIBILITY_REPORT.md
  - docs/REMEDIATION_PLAN.md
  - docs/PLATFORM_VERIFICATION.md

Validation:
- node skills/clawsec-suite/test/path_resolution.test.mjs
- node skills/clawsec-suite/test/guarded_install.test.mjs
- node skills/clawsec-suite/test/advisory_suppression.test.mjs
- node skills/openclaw-audit-watchdog/test/suppression_config.test.mjs
- node skills/openclaw-audit-watchdog/test/render_report_suppression.test.mjs

* fix(advisory): avoid fail-open on invalid path vars and cover watchdog tests

* docs: move signing runbooks into docs folder

* docs: remove root-level signing runbooks after move

* chore(clawsec-suite): bump version to 0.1.3

* chore(openclaw-audit-watchdog): bump version to 0.1.1

* docs(changelog): add entries for clawsec-suite 0.1.3 and watchdog 0.1.1

* docs(changelog): credit @aldodelgado for PR #62 contributions

* feat(clawsec-suite): scope advisories to openclaw application

* fix(ci): run advisory scope tests without TypeScript loader

---------

Co-authored-by: David Abutbul <David.a@prompt.security>
2026-02-25 13:24:31 +02:00

2.5 KiB
Raw Blame History

Cross-Platform Remediation Plan

Phase 1: Immediate Risk Closure (Completed)

Milestones

  • Implement explicit home-path expansion + suspicious token rejection in high-risk runtime/install paths.
  • Add regression tests for path expansion and escaped-token rejection.
  • Add .gitattributes LF policy.
  • Expand Node lint/type/build CI coverage to Linux/macOS/Windows.
  • Update install docs with shell-specific guidance and literal $HOME troubleshooting.

Outcomes

  • Literal $HOME path propagation bug addressed at source.
  • Core advisory/install path config now fails fast on invalid path tokens.

Phase 2: Windows Parity for Critical Workflows (Next)

Quick wins

  • Add PowerShell equivalents for the most-used manual install/check commands in:
    • skills/clawsec-suite/SKILL.md
    • skills/openclaw-audit-watchdog/SKILL.md
    • README.md
  • Add a lightweight scripts/preflight.mjs to detect missing tools and print OS-specific install hints.

Milestones

  • Native PowerShell instructions for suite setup and advisory hook.
  • WSL/Git Bash fallback documented where shell scripts are unavoidable.

Phase 3: Reduce POSIX Shell Surface (Deeper Refactor)

Refactor targets

  • scripts/populate-local-feed.sh
  • scripts/populate-local-skills.sh
  • scripts/release-skill.sh

Approach

  • Re-implement critical paths in Node/Python to remove dependency on jq/sed/awk/find/chmod pipelines.
  • Preserve shell wrappers for backward compatibility; route to new cross-platform implementations.

Migration notes

  • Keep old script entrypoints as wrappers for at least one minor release.
  • Emit deprecation warnings with exact migration commands.

Phase 4: CI Hardening and Ongoing Verification

Milestones

  • Keep Node matrix (Linux/macOS/Windows) as required check.
  • Add targeted Windows smoke tests for install path handling.
  • Add macOS check for OpenSSL command compatibility notes where relevant.

Test strategy

  • Local:
    • Run Node test suites that cover path expansion/suppression/install behavior.
    • Run syntax checks for modified scripts.
  • CI:
    • Matrix Node checks + guarded installer/suppression/path tests.
    • Linux-only security scans remain, but explicitly marked as Linux-scoped.

Rollout / Release Considerations

  • No breaking interface changes introduced in this patch set; behavior is stricter only for invalid/unexpanded path tokens.
  • Communicate in release notes:
    • path token validation now enforced
    • how to correct invalid quoted env values
    • where PowerShell examples live
Reference in New Issue View Git Blame Copy Permalink