@@ -554,6 +554,7 @@ async function scanDirectoryTarget(params: {
554554function buildBlockedScanResult(params: {
555555builtinScan: BuiltinInstallScan;
556556dangerouslyForceUnsafeInstall?: boolean;
557+trustedSourceLinkedOfficialInstall?: boolean;
557558targetLabel: string;
558559}): InstallSecurityScanResult | undefined {
559560if (params.builtinScan.status === "error") {
@@ -568,7 +569,7 @@ function buildBlockedScanResult(params: {
568569};
569570}
570571if (params.builtinScan.critical > 0) {
571-if (params.dangerouslyForceUnsafeInstall) {
572+if (params.dangerouslyForceUnsafeInstall || params.trustedSourceLinkedOfficialInstall) {
572573return undefined;
573574}
574575return {
@@ -594,6 +595,16 @@ function logDangerousForceUnsafeInstall(params: {
594595);
595596}
596597598+function logTrustedSourceLinkedOfficialInstall(params: {
599+findings: Array<{ file: string; line: number; message: string; severity: string }>;
600+logger: InstallScanLogger;
601+targetLabel: string;
602+}) {
603+params.logger.warn?.(
604+`WARNING: ${params.targetLabel} allowed because it is an official source-linked ClawHub package: ${buildCriticalDetails({ findings: params.findings })}`,
605+);
606+}
607+597608function resolveBuiltinScanDecision(
598609params: InstallSafetyOverrides & {
599610builtinScan: BuiltinInstallScan;
@@ -604,6 +615,7 @@ function resolveBuiltinScanDecision(
604615const builtinBlocked = buildBlockedScanResult({
605616builtinScan: params.builtinScan,
606617dangerouslyForceUnsafeInstall: params.dangerouslyForceUnsafeInstall,
618+trustedSourceLinkedOfficialInstall: params.trustedSourceLinkedOfficialInstall,
607619targetLabel: params.targetLabel,
608620});
609621if (params.dangerouslyForceUnsafeInstall && params.builtinScan.critical > 0) {
@@ -612,6 +624,12 @@ function resolveBuiltinScanDecision(
612624logger: params.logger,
613625targetLabel: params.targetLabel,
614626});
627+} else if (params.trustedSourceLinkedOfficialInstall && params.builtinScan.critical > 0) {
628+logTrustedSourceLinkedOfficialInstall({
629+findings: params.builtinScan.findings,
630+logger: params.logger,
631+targetLabel: params.targetLabel,
632+});
615633}
616634return builtinBlocked;
617635}
@@ -810,6 +828,7 @@ export async function scanPackageInstallSourceRuntime(
810828 builtinScan,
811829logger: params.logger,
812830dangerouslyForceUnsafeInstall: params.dangerouslyForceUnsafeInstall,
831+trustedSourceLinkedOfficialInstall: params.trustedSourceLinkedOfficialInstall,
813832targetLabel: `Plugin "${params.pluginId}" installation`,
814833});
815834@@ -913,6 +932,7 @@ export async function scanSkillInstallSourceRuntime(params: {
913932const builtinBlocked = buildBlockedScanResult({
914933 builtinScan,
915934dangerouslyForceUnsafeInstall: params.dangerouslyForceUnsafeInstall,
935+trustedSourceLinkedOfficialInstall: false,
916936targetLabel: `Skill "${params.skillName}" installation`,
917937});
918938if (params.dangerouslyForceUnsafeInstall && builtinScan.critical > 0) {
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。