mirror of
https://github.com/prompt-security/clawsec.git
synced 2026-06-13 05:28:02 +03:00
Aldo Delgado
7cdb4ab7e2
* docs: add agent collaboration and git safety rules to AGENTS.md
* fix(portability): harden cross-platform path handling and install workflows
- add shared path resolution utility for advisory guardian components
- expand and normalize home-path tokens: ~, $HOME, ${HOME}, %USERPROFILE%, $env:USERPROFILE
- reject unresolved/escaped home tokens to prevent literal "$HOME" directory creation
- fix install/runtime path handling in:
- openclaw-audit-watchdog setup_cron and suppression config loader
- clawsec-suite advisory hook handler, suppression loader, and guarded installer
- remove hardcoded Homebrew binary assumptions in watchdog scripts/tests
- add LF enforcement via .gitattributes to reduce CRLF script breakage
- expand CI Node checks to linux/macos/windows matrix
- add cross-platform test coverage for path expansion and token rejection
- update README and SKILL docs with bash/zsh/PowerShell-safe path guidance
- add compatibility deliverables:
- docs/COMPATIBILITY_REPORT.md
- docs/REMEDIATION_PLAN.md
- docs/PLATFORM_VERIFICATION.md
Validation:
- node skills/clawsec-suite/test/path_resolution.test.mjs
- node skills/clawsec-suite/test/guarded_install.test.mjs
- node skills/clawsec-suite/test/advisory_suppression.test.mjs
- node skills/openclaw-audit-watchdog/test/suppression_config.test.mjs
- node skills/openclaw-audit-watchdog/test/render_report_suppression.test.mjs
* fix(advisory): avoid fail-open on invalid path vars and cover watchdog tests
* docs: move signing runbooks into docs folder
* docs: remove root-level signing runbooks after move
* chore(clawsec-suite): bump version to 0.1.3
* chore(openclaw-audit-watchdog): bump version to 0.1.1
* docs(changelog): add entries for clawsec-suite 0.1.3 and watchdog 0.1.1
* docs(changelog): credit @aldodelgado for PR #62 contributions
* feat(clawsec-suite): scope advisories to openclaw application
* fix(ci): run advisory scope tests without TypeScript loader
---------
Co-authored-by: David Abutbul <David.a@prompt.security>
74 lines
2.5 KiB
Markdown
74 lines
2.5 KiB
Markdown
# Cross-Platform Remediation Plan
|
|
|
|
## Phase 1: Immediate Risk Closure (Completed)
|
|
|
|
### Milestones
|
|
- Implement explicit home-path expansion + suspicious token rejection in high-risk runtime/install paths.
|
|
- Add regression tests for path expansion and escaped-token rejection.
|
|
- Add `.gitattributes` LF policy.
|
|
- Expand Node lint/type/build CI coverage to Linux/macOS/Windows.
|
|
- Update install docs with shell-specific guidance and literal `$HOME` troubleshooting.
|
|
|
|
### Outcomes
|
|
- Literal `$HOME` path propagation bug addressed at source.
|
|
- Core advisory/install path config now fails fast on invalid path tokens.
|
|
|
|
---
|
|
|
|
## Phase 2: Windows Parity for Critical Workflows (Next)
|
|
|
|
### Quick wins
|
|
- Add PowerShell equivalents for the most-used manual install/check commands in:
|
|
- `skills/clawsec-suite/SKILL.md`
|
|
- `skills/openclaw-audit-watchdog/SKILL.md`
|
|
- `README.md`
|
|
- Add a lightweight `scripts/preflight.mjs` to detect missing tools and print OS-specific install hints.
|
|
|
|
### Milestones
|
|
- Native PowerShell instructions for suite setup and advisory hook.
|
|
- WSL/Git Bash fallback documented where shell scripts are unavoidable.
|
|
|
|
---
|
|
|
|
## Phase 3: Reduce POSIX Shell Surface (Deeper Refactor)
|
|
|
|
### Refactor targets
|
|
- `scripts/populate-local-feed.sh`
|
|
- `scripts/populate-local-skills.sh`
|
|
- `scripts/release-skill.sh`
|
|
|
|
### Approach
|
|
- Re-implement critical paths in Node/Python to remove dependency on `jq/sed/awk/find/chmod` pipelines.
|
|
- Preserve shell wrappers for backward compatibility; route to new cross-platform implementations.
|
|
|
|
### Migration notes
|
|
- Keep old script entrypoints as wrappers for at least one minor release.
|
|
- Emit deprecation warnings with exact migration commands.
|
|
|
|
---
|
|
|
|
## Phase 4: CI Hardening and Ongoing Verification
|
|
|
|
### Milestones
|
|
- Keep Node matrix (Linux/macOS/Windows) as required check.
|
|
- Add targeted Windows smoke tests for install path handling.
|
|
- Add macOS check for OpenSSL command compatibility notes where relevant.
|
|
|
|
### Test strategy
|
|
- Local:
|
|
- Run Node test suites that cover path expansion/suppression/install behavior.
|
|
- Run syntax checks for modified scripts.
|
|
- CI:
|
|
- Matrix Node checks + guarded installer/suppression/path tests.
|
|
- Linux-only security scans remain, but explicitly marked as Linux-scoped.
|
|
|
|
---
|
|
|
|
## Rollout / Release Considerations
|
|
|
|
- No breaking interface changes introduced in this patch set; behavior is stricter only for invalid/unexpanded path tokens.
|
|
- Communicate in release notes:
|
|
- path token validation now enforced
|
|
- how to correct invalid quoted env values
|
|
- where PowerShell examples live
|