fix(diagnostics): preserve plugin security identities · o...

Recent Commits to openclaw:main

vincentkoc · 2026-06-17 · via Recent Commits to openclaw:main

Original file line number	Diff line number	Diff line change
`@@ -978,9 +978,9 @@ describe("diagnostics-otel service", () => {`
`978`	`978`	`scopes: ["operator.read", "operator.approvals"],`
`979`	`979`	`},`
`980`	`980`	`target: {`
`981`		`-kind: "tool",`
`982`		`-name: "browser",`
`983`		`-owner: "browser-tools",`
	`981`	`+kind: "plugin",`
	`982`	`+name: "@acme/security-event-plugin",`
	`983`	`+owner: "plugin-installer",`
`984`	`984`	`},`
`985`	`985`	`policy: {`
`986`	`986`	`id: "tools.exec",`
`@@ -1021,9 +1021,9 @@ describe("diagnostics-otel service", () => {`
`1021`	`1021`	`"openclaw.security.actor.id_hash": "agent-hash-1",`
`1022`	`1022`	`"openclaw.security.actor.role": "operator",`
`1023`	`1023`	`"openclaw.security.actor.scopes": "operator.read,operator.approvals",`
`1024`		`-"openclaw.security.target.kind": "tool",`
`1025`		`-"openclaw.security.target.name": "browser",`
`1026`		`-"openclaw.security.target.owner": "browser-tools",`
	`1024`	`+"openclaw.security.target.kind": "plugin",`
	`1025`	`+"openclaw.security.target.name": "@acme/security-event-plugin",`
	`1026`	`+"openclaw.security.target.owner": "plugin-installer",`
`1027`	`1027`	`"openclaw.security.policy.id": "tools.exec",`
`1028`	`1028`	`"openclaw.security.policy.decision": "deny",`
`1029`	`1029`	`"openclaw.security.policy.reason": "allowlist.miss",`

Original file line number	Diff line number	Diff line change
`@@ -67,6 +67,7 @@ const DROPPED_OTEL_ATTRIBUTE_KEYS = new Set([`
`67`	`67`	`"openclaw.trace_id",`
`68`	`68`	`]);`
`69`	`69`	`const LOW_CARDINALITY_VALUE_RE = /^[A-Za-z0-9_.:-]{1,120}$/u;`
	`70`	`+const SECURITY_TARGET_NAME_VALUE_RE = /^[A-Za-z0-9@/_.:-]{1,256}$/u;`
`70`	`71`	`const MAX_OTEL_CONTENT_ATTRIBUTE_CHARS = 128 * 1024;`
`71`	`72`	`const MAX_OTEL_CONTENT_ARRAY_ITEMS = 200;`
`72`	`73`	`const MAX_OTEL_LOG_BODY_CHARS = 4 * 1024;`
`@@ -319,6 +320,18 @@ function lowCardinalityAttr(value: string \| undefined, fallback = "unknown"): st`
`319`	`320`	`return LOW_CARDINALITY_VALUE_RE.test(redacted) ? redacted : fallback;`
`320`	`321`	`}`
`321`	`322`
	`323`	`+function securityTargetNameAttr(value: string \| undefined, fallback = "unknown"): string {`
	`324`	`+if (!value) {`
	`325`	`+return fallback;`
	`326`	`+}`
	`327`	`+const redacted = redactSensitiveText(value.trim());`
	`328`	`+const redactedLower = redacted.toLowerCase();`
	`329`	`+if (redactedLower.startsWith("agent:") \|\| redactedLower.includes(":agent:")) {`
	`330`	`+return fallback;`
	`331`	`+}`
	`332`	`+return SECURITY_TARGET_NAME_VALUE_RE.test(redacted) ? redacted : fallback;`
	`333`	`+}`
	`334`	`+`
`322`	`335`	`function lowCardinalityQueueLaneAttr(value: string \| undefined, fallback = "unknown"): string {`
`323`	`336`	`if (!value) {`
`324`	`337`	`return fallback;`
`@@ -1124,7 +1137,7 @@ function assignOtelSecurityAttributes(`
`1124`	`1137`	`assignOtelLogAttribute(`
`1125`	`1138`	`attributes,`
`1126`	`1139`	`"openclaw.security.target.name",`
`1127`		`-lowCardinalityAttr(evt.target.name),`
	`1140`	`+securityTargetNameAttr(evt.target.name),`
`1128`	`1141`	`);`
`1129`	`1142`	`}`
`1130`	`1143`	`if (evt.target.owner) {`

Original file line number	Diff line number	Diff line change
`@@ -2496,25 +2496,32 @@ describe("installPluginFromNpmSpec", () => {`
`2496`	`2496`	`const npmDir = path.join(root, "npm");`
`2497`	`2497`	`const extensionsDir = path.join(root, "extensions");`
`2498`	`2498`	`const { scriptPath, logPath } = writeBlockingInstallPolicyScript(root);`
`2499`		`-mockNpmViewMetadata({ name: "@acme/policy-preflight-plugin" });`
	`2499`	`+const packageName = "@acme/policy-preflight-plugin";`
	`2500`	`+mockNpmViewMetadata({ name: packageName });`
	`2501`	`+const captured = captureSecurityEvents();`
`2500`	`2502`
`2501`		`-const result = await installPluginFromNpmSpec({`
`2502`		`-spec: "@acme/policy-preflight-plugin@1.0.0",`
`2503`		`- extensionsDir,`
`2504`		`- npmDir,`
`2505`		`-config: configWithInstallPolicy(scriptPath, logPath),`
`2506`		`-});`
	`2503`	`+let result: Awaited<ReturnType<typeof installPluginFromNpmSpec>>;`
	`2504`	`+try {`
	`2505`	`+result = await installPluginFromNpmSpec({`
	`2506`	+spec: `${packageName}@1.0.0`,
	`2507`	`+ extensionsDir,`
	`2508`	`+ npmDir,`
	`2509`	`+config: configWithInstallPolicy(scriptPath, logPath),`
	`2510`	`+});`
	`2511`	`+} finally {`
	`2512`	`+captured.stop();`
	`2513`	`+}`
`2507`	`2514`
`2508`		`-expect(result.ok).toBe(false);`
`2509`		`-if (!result.ok) {`
`2510`		`-expect(result.code, result.error).toBe(PLUGIN_INSTALL_ERROR_CODE.SECURITY_SCAN_BLOCKED);`
`2511`		`-expect(result.error).toContain("npm installs are disabled by policy");`
	`2515`	`+expect(result!.ok).toBe(false);`
	`2516`	`+if (!result!.ok) {`
	`2517`	`+expect(result!.code, result!.error).toBe(PLUGIN_INSTALL_ERROR_CODE.SECURITY_SCAN_BLOCKED);`
	`2518`	`+expect(result!.error).toContain("npm installs are disabled by policy");`
`2512`	`2519`	`}`
`2513`	`2520`	`expect(vi.mocked(runCommandWithTimeout)).toHaveBeenCalledTimes(1);`
`2514`	`2521`	`expect(vi.mocked(runCommandWithTimeout).mock.calls[0]?.[0]).toEqual([`
`2515`	`2522`	`"npm",`
`2516`	`2523`	`"view",`
`2517`		`-"@acme/policy-preflight-plugin@1.0.0",`
	`2524`	+`${packageName}@1.0.0`,
`2518`	`2525`	`"name",`
`2519`	`2526`	`"version",`
`2520`	`2527`	`"dist.integrity",`
`@@ -2531,6 +2538,16 @@ describe("installPluginFromNpmSpec", () => {`
`2531`	`2538`	`expect(requests[0]?.sourcePathKind).toBe("file");`
`2532`	`2539`	`expect(path.basename(requests[0]?.sourcePath ?? "")).toBe("npm-package-metadata.json");`
`2533`	`2540`	`expect(requests[0]?.plugin?.contentType).toBe("package");`
	`2541`	`+expect(captured.events).toHaveLength(1);`
	`2542`	`+expect(captured.events[0]).toMatchObject({`
	`2543`	`+action: "plugin.audit.failed",`
	`2544`	`+outcome: "denied",`
	`2545`	`+target: { kind: "plugin", name: packageName },`
	`2546`	`+attributes: {`
	`2547`	`+source_family: "npm",`
	`2548`	`+mode: "install",`
	`2549`	`+},`
	`2550`	`+});`
`2534`	`2551`	`});`
`2535`	`2552`
`2536`	`2553`	`it("reports effective install mode to policy when requested npm update has no installed target", async () => {`

Original file line number	Diff line number	Diff line change
`@@ -1223,6 +1223,9 @@ async function installPluginFromManagedNpmRoot(`
`1223`	`1223`	`if (!params.skipPolicyPreflight) {`
`1224`	`1224`	`const preflightPolicyResult = await runInstallSourceScan({`
`1225`	`1225`	subject: `Plugin "${expectedPluginId ?? params.packageName}"`,
	`1226`	`+pluginId: expectedPluginId ?? params.packageName,`
	`1227`	`+mode: effectiveMode,`
	`1228`	`+sourceFamily: "npm",`
`1226`	`1229`	`scan: async () =>`
`1227`	`1230`	`await preflightPluginNpmInstallPolicy({`
`1228`	`1231`	`config: params.config,`
`@@ -2355,6 +2358,18 @@ async function scanAndLinkInstalledPackage(params: {`
`2355`	`2358`	`}): Promise<Extract<InstallPluginResult, { ok: false }> \| null> {`
`2356`	`2359`	`const scanResult = await runInstallSourceScan({`
`2357`	`2360`	subject: `Plugin "${params.pluginId}"`,
	`2361`	`+pluginId: params.pluginId,`
	`2362`	`+mode: params.mode,`
	`2363`	`+sourceFamily:`
	`2364`	`+params.requestKind === "plugin-npm"`
	`2365`	`+ ? "npm"`
	`2366`	`+ : params.requestKind === "plugin-archive"`
	`2367`	`+ ? "archive"`
	`2368`	`+ : params.requestKind === "plugin-dir"`
	`2369`	`+ ? "directory"`
	`2370`	`+ : params.requestKind === "plugin-file"`
	`2371`	`+ ? "file"`
	`2372`	`+ : "installed-package",`
`2358`	`2373`	`scan: async () =>`
`2359`	`2374`	`await params.runtime.scanInstalledPackageDependencyTree({`
`2360`	`2375`	`...(params.additionalDependencyPackageDirs`
`@@ -2926,6 +2941,9 @@ export async function installPluginFromNpmSpec(`
`2926`	`2941`	`);`
`2927`	`2942`	`const preflightPolicyResult = await runInstallSourceScan({`
`2928`	`2943`	subject: `Plugin "${expectedPluginId ?? parsedSpec.name}"`,
	`2944`	`+pluginId: expectedPluginId ?? parsedSpec.name,`
	`2945`	`+mode: effectiveMode,`
	`2946`	`+sourceFamily: "npm",`
`2929`	`2947`	`scan: async () =>`
`2930`	`2948`	`await preflightPluginNpmInstallPolicy({`
`2931`	`2949`	`config: params.config,`

此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。原文来自 — 版权归原作者所有。

推荐订阅源

Recent Commits to openclaw:main