@aiassesstech/mighty-mark 0.4.9 → 0.5.0

package/dist/checks/security-hardening.d.ts

@@ -14,6 +14,10 @@ export declare function checkDmScope(ctx?: CheckContext): Promise<CheckResult>;
 export declare function checkExecSecurity(ctx?: CheckContext): Promise<CheckResult>;
 export declare function checkMemoryFlush(ctx?: CheckContext): Promise<CheckResult>;
 export declare function checkSpawnPrevention(ctx?: CheckContext): Promise<CheckResult>;
-/** Run all platform hardening security checks. */
+export declare function checkModelDefaults(ctx?: CheckContext): Promise<CheckResult>;
+export declare function checkSecretPermissions(ctx?: CheckContext): Promise<CheckResult>;
+export declare function checkTelegramAllowlist(ctx?: CheckContext): Promise<CheckResult>;
+export declare function checkWorkspacePersonalization(ctx?: CheckContext): Promise<CheckResult>;
+/** Run all platform hardening + post-install security checks. */
 export declare function runSecurityChecks(ctx?: CheckContext): Promise<CheckResult[]>;
 //# sourceMappingURL=security-hardening.d.ts.map

package/dist/checks/security-hardening.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-hardening.d.ts","sourceRoot":"","sources":["../../src/checks/security-hardening.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA+B3E,wBAAsB,YAAY,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAiD3E;AAED,wBAAsB,iBAAiB,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAiDhF;AAED,wBAAsB,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA+C/E;AAED,wBAAsB,oBAAoB,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA0DnF;AAED,kDAAkD;AAClD,wBAAsB,iBAAiB,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAOlF"}
+{"version":3,"file":"security-hardening.d.ts","sourceRoot":"","sources":["../../src/checks/security-hardening.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAA2C,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAuChG,wBAAsB,YAAY,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAiD3E;AAED,wBAAsB,iBAAiB,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAiDhF;AAED,wBAAsB,gBAAgB,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CA+C/E;AAED,wBAAsB,oBAAoB,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAsDnF;AAeD,wBAAsB,kBAAkB,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAwEjF;AAED,wBAAsB,sBAAsB,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAqErF;AAED,wBAAsB,sBAAsB,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAuErF;AAED,wBAAsB,6BAA6B,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAsF5F;AAED,iEAAiE;AACjE,wBAAsB,iBAAiB,CAAC,GAAG,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAWlF"}

package/dist/checks/security-hardening.js

@@ -9,7 +9,8 @@
  *   - agents.defaults.compaction.memoryFlush.enabled = true
  */
 import fs from 'node:fs';
-import { getConfigPath, now } from './check-context.js';
+import path from 'node:path';
+import { getConfigPath, now, resolveOpenClawHome } from './check-context.js';
 const CATEGORY = 'security';
 function loadConfig(ctx) {
     const configPath = getConfigPath(ctx);
@@ -179,42 +180,333 @@ export async function checkSpawnPrevention(ctx) {
             durationMs: Date.now() - start,
         };
     }
+    const depth = subagents.maxSpawnDepth;
+    const children = subagents.maxChildrenPerAgent;
+    if (depth === 1 && children === 1) {
+        return {
+            name: 'Spawn prevention',
+            category: CATEGORY,
+            status: 'pass',
+            message: 'maxSpawnDepth=1, maxChildrenPerAgent=1 (OpenClaw minimum)',
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
     const issues = [];
-    if (!Array.isArray(subagents.allowAgents) || subagents.allowAgents.length > 0) {
-        issues.push(`allowAgents=${JSON.stringify(subagents.allowAgents)}`);
+    if (depth !== 1)
+        issues.push(`maxSpawnDepth=${depth ?? 'not set'}`);
+    if (children !== 1)
+        issues.push(`maxChildrenPerAgent=${children ?? 'not set'}`);
+    return {
+        name: 'Spawn prevention',
+        category: CATEGORY,
+        status: (depth ?? Infinity) > 1 || (children ?? Infinity) > 1 ? 'fail' : 'warn',
+        message: `Not fully locked: ${issues.join(', ')} (expected 1/1)`,
+        timestamp: now(),
+        durationMs: Date.now() - start,
+    };
+}
+// ================================================================
+// Post-Install Hardening Checks (Check H)
+//
+// Per SPEC-OPENCLAW-POST-INSTALL-HARDENING-CHECKLIST v1.1:
+//   - Model defaults configured with fallbacks
+//   - Secrets file exists with correct permissions
+//   - Telegram DM policy set to allowlist
+//   - Workspace personalization files exist and are customized
+// ================================================================
+const EXPECTED_AGENTS = ['grillo', 'jessie', 'noah', 'nole', 'mighty-mark', 'sam'];
+const MIN_PERSONALIZATION_BYTES = 100;
+export async function checkModelDefaults(ctx) {
+    const start = Date.now();
+    const config = loadConfig(ctx);
+    if (!config) {
+        return {
+            name: 'Model defaults',
+            category: CATEGORY,
+            status: 'warn',
+            message: 'openclaw.json not found or unreadable',
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
     }
-    if (subagents.maxSpawnDepth !== 0) {
-        issues.push(`maxSpawnDepth=${subagents.maxSpawnDepth}`);
+    const model = config.agents?.defaults?.model;
+    if (!model) {
+        return {
+            name: 'Model defaults',
+            category: CATEGORY,
+            status: 'warn',
+            message: 'no model config — using OpenClaw defaults (single point of failure)',
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
     }
-    if (subagents.maxChildrenPerAgent !== 0) {
-        issues.push(`maxChildrenPerAgent=${subagents.maxChildrenPerAgent}`);
+    if (typeof model === 'string') {
+        return {
+            name: 'Model defaults',
+            category: CATEGORY,
+            status: 'warn',
+            message: `primary=${model}, no fallbacks configured`,
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
     }
-    if (issues.length > 0) {
+    const primary = model.primary;
+    const fallbacks = model.fallbacks ?? [];
+    if (!primary) {
         return {
-            name: 'Spawn prevention',
+            name: 'Model defaults',
+            category: CATEGORY,
+            status: 'warn',
+            message: 'no primary model set',
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
+    if (fallbacks.length === 0) {
+        return {
+            name: 'Model defaults',
+            category: CATEGORY,
+            status: 'warn',
+            message: `primary=${primary}, no fallbacks (single point of failure)`,
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
+    return {
+        name: 'Model defaults',
+        category: CATEGORY,
+        status: 'pass',
+        message: `primary=${primary}, ${fallbacks.length} fallback(s)`,
+        timestamp: now(),
+        durationMs: Date.now() - start,
+    };
+}
+export async function checkSecretPermissions(ctx) {
+    const start = Date.now();
+    const openClawHome = ctx?.configPath
+        ? path.dirname(ctx.configPath)
+        : resolveOpenClawHome();
+    const secretsDir = path.join(openClawHome, 'secrets');
+    const secretsFile = path.join(secretsDir, 'openclaw.env');
+    if (!fs.existsSync(secretsDir)) {
+        return {
+            name: 'Secret file permissions',
+            category: CATEGORY,
+            status: 'fail',
+            message: `secrets directory not found at ${secretsDir}`,
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
+    if (!fs.existsSync(secretsFile)) {
+        return {
+            name: 'Secret file permissions',
+            category: CATEGORY,
+            status: 'fail',
+            message: 'secrets directory exists but openclaw.env not found',
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
+    try {
+        const dirStat = fs.statSync(secretsDir);
+        const fileStat = fs.statSync(secretsFile);
+        const dirMode = (dirStat.mode & 0o777).toString(8);
+        const fileMode = (fileStat.mode & 0o777).toString(8);
+        const issues = [];
+        if (dirMode !== '700')
+            issues.push(`dir=${dirMode} (expected 700)`);
+        if (fileMode !== '600')
+            issues.push(`file=${fileMode} (expected 600)`);
+        if (issues.length > 0) {
+            return {
+                name: 'Secret file permissions',
+                category: CATEGORY,
+                status: 'warn',
+                message: `permissions not strict: ${issues.join(', ')}`,
+                timestamp: now(),
+                durationMs: Date.now() - start,
+            };
+        }
+        return {
+            name: 'Secret file permissions',
+            category: CATEGORY,
+            status: 'pass',
+            message: 'secrets dir=700, file=600',
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
+    catch {
+        return {
+            name: 'Secret file permissions',
+            category: CATEGORY,
+            status: 'warn',
+            message: 'could not stat secrets files',
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
+}
+export async function checkTelegramAllowlist(ctx) {
+    const start = Date.now();
+    const config = loadConfig(ctx);
+    if (!config) {
+        return {
+            name: 'Telegram DM policy',
+            category: CATEGORY,
+            status: 'warn',
+            message: 'openclaw.json not found or unreadable',
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
+    const telegram = config.telegram;
+    if (!telegram) {
+        return {
+            name: 'Telegram DM policy',
+            category: CATEGORY,
+            status: 'warn',
+            message: 'no telegram config — skipped (may not use Telegram)',
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
+    const policy = telegram.dmPolicy;
+    if (policy === 'allowlist') {
+        const allowCount = telegram.allowFrom?.length ?? 0;
+        if (allowCount === 0) {
+            return {
+                name: 'Telegram DM policy',
+                category: CATEGORY,
+                status: 'warn',
+                message: 'allowlist enabled but allowFrom is empty — nobody can DM',
+                timestamp: now(),
+                durationMs: Date.now() - start,
+            };
+        }
+        return {
+            name: 'Telegram DM policy',
+            category: CATEGORY,
+            status: 'pass',
+            message: `allowlist, ${allowCount} allowed ID(s)`,
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
+    if (policy === 'open' || !policy) {
+        return {
+            name: 'Telegram DM policy',
             category: CATEGORY,
             status: 'fail',
-            message: `Not fully locked: ${issues.join(', ')}`,
+            message: `${policy ?? 'NOT SET'} — anyone can message and consume API credits`,
             timestamp: now(),
             durationMs: Date.now() - start,
         };
     }
     return {
-        name: 'Spawn prevention',
+        name: 'Telegram DM policy',
+        category: CATEGORY,
+        status: 'warn',
+        message: `${policy} — verify manually`,
+        timestamp: now(),
+        durationMs: Date.now() - start,
+    };
+}
+export async function checkWorkspacePersonalization(ctx) {
+    const start = Date.now();
+    const openClawHome = ctx?.configPath
+        ? path.dirname(ctx.configPath)
+        : resolveOpenClawHome();
+    const extensionsDir = path.join(openClawHome, 'extensions');
+    if (!fs.existsSync(extensionsDir)) {
+        return {
+            name: 'Workspace personalization',
+            category: CATEGORY,
+            status: 'warn',
+            message: 'extensions directory not found — cannot check agent files',
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
+    const requiredFiles = ['SOUL.md', 'IDENTITY.md'];
+    const agentsMissing = [];
+    const agentsSmall = [];
+    let agentsChecked = 0;
+    for (const agent of EXPECTED_AGENTS) {
+        const agentDir = path.join(extensionsDir, agent, 'agent');
+        if (!fs.existsSync(agentDir))
+            continue;
+        agentsChecked++;
+        for (const file of requiredFiles) {
+            const filePath = path.join(agentDir, file);
+            if (!fs.existsSync(filePath)) {
+                agentsMissing.push(`${agent}/${file}`);
+            }
+            else {
+                try {
+                    const stat = fs.statSync(filePath);
+                    if (stat.size < MIN_PERSONALIZATION_BYTES) {
+                        agentsSmall.push(`${agent}/${file}(${stat.size}B)`);
+                    }
+                }
+                catch {
+                    agentsMissing.push(`${agent}/${file}`);
+                }
+            }
+        }
+    }
+    if (agentsChecked === 0) {
+        return {
+            name: 'Workspace personalization',
+            category: CATEGORY,
+            status: 'warn',
+            message: 'no agent directories found in extensions/',
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
+    if (agentsMissing.length > 0) {
+        return {
+            name: 'Workspace personalization',
+            category: CATEGORY,
+            status: 'fail',
+            message: `${agentsChecked} agents checked; missing: ${agentsMissing.join(', ')}`,
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
+    if (agentsSmall.length > 0) {
+        return {
+            name: 'Workspace personalization',
+            category: CATEGORY,
+            status: 'warn',
+            message: `${agentsChecked} agents checked; likely uncustomized: ${agentsSmall.join(', ')}`,
+            timestamp: now(),
+            durationMs: Date.now() - start,
+        };
+    }
+    return {
+        name: 'Workspace personalization',
         category: CATEGORY,
         status: 'pass',
-        message: 'allowAgents=[], maxSpawnDepth=0, maxChildrenPerAgent=0',
+        message: `${agentsChecked} agents checked, all personalization files present and customized`,
         timestamp: now(),
         durationMs: Date.now() - start,
     };
 }
-/** Run all platform hardening security checks. */
+/** Run all platform hardening + post-install security checks. */
 export async function runSecurityChecks(ctx) {
     return [
         await checkDmScope(ctx),
         await checkExecSecurity(ctx),
         await checkMemoryFlush(ctx),
         await checkSpawnPrevention(ctx),
+        await checkModelDefaults(ctx),
+        await checkSecretPermissions(ctx),
+        await checkTelegramAllowlist(ctx),
+        await checkWorkspacePersonalization(ctx),
     ];
 }
 //# sourceMappingURL=security-hardening.js.map

package/dist/checks/security-hardening.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-hardening.js","sourceRoot":"","sources":["../../src/checks/security-hardening.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,OAAO,EAAE,aAAa,EAAE,GAAG,EAAqB,MAAM,oBAAoB,CAAC;AAE3E,MAAM,QAAQ,GAAG,UAAmB,CAAC;AAmBrC,SAAS,UAAU,CAAC,GAAkB;IACpC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAkB;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uCAAuC;YAChD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAEtC,IAAI,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,KAAK,4CAA4C;YAC7D,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,KAAK,IAAI,SAAS,kCAAkC;QAChE,SAAS,EAAE,GAAG,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAkB;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uCAAuC;YAChD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;IAEpC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wCAAwC;YACjD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,SAAS,sBAAsB,CAAC;QAC3F,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC3C,OAAO,EAAE,YAAY,SAAS,EAAE;YAChC,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,QAAQ,IAAI,SAAS,oBAAoB;QACrD,SAAS,EAAE,GAAG,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAkB;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uCAAuC;YAChD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC;IAE/D,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sBAAsB,KAAK,CAAC,mBAAmB,IAAI,SAAS,EAAE;YACvE,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kDAAkD;YAC3D,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,gBAAgB;QACzB,SAAS,EAAE,GAAG,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAkB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uCAAuC;YAChD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;IAErD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,0DAA0D;YACnE,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,IAAI,SAAS,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,CAAC,IAAI,CAAC,eAAe,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,SAAS,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,IAAI,SAAS,CAAC,mBAAmB,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,uBAAuB,SAAS,CAAC,mBAAmB,EAAE,CAAC,CAAC;IACtE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qBAAqB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YACjD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,wDAAwD;QACjE,SAAS,EAAE,GAAG,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAkB;IACxD,OAAO;QACL,MAAM,YAAY,CAAC,GAAG,CAAC;QACvB,MAAM,iBAAiB,CAAC,GAAG,CAAC;QAC5B,MAAM,gBAAgB,CAAC,GAAG,CAAC;QAC3B,MAAM,oBAAoB,CAAC,GAAG,CAAC;KAChC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"security-hardening.js","sourceRoot":"","sources":["../../src/checks/security-hardening.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,mBAAmB,EAAqB,MAAM,oBAAoB,CAAC;AAEhG,MAAM,QAAQ,GAAG,UAAmB,CAAC;AA2BrC,SAAS,UAAU,CAAC,GAAkB;IACpC,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAkB;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uCAAuC;YAChD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAEtC,IAAI,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,KAAK,4CAA4C;YAC7D,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,6BAA6B;QACnC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,KAAK,IAAI,SAAS,kCAAkC;QAChE,SAAS,EAAE,GAAG,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAkB;IACxD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uCAAuC;YAChD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC;IAEpC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,wCAAwC;YACjD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,SAAS,sBAAsB,CAAC;QAC3F,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YAC3C,OAAO,EAAE,YAAY,SAAS,EAAE;YAChC,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,QAAQ,IAAI,SAAS,oBAAoB;QACrD,SAAS,EAAE,GAAG,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAkB;IACvD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uCAAuC;YAChD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC;IAE/D,IAAI,KAAK,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sBAAsB,KAAK,CAAC,mBAAmB,IAAI,SAAS,EAAE;YACvE,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kDAAkD;YAC3D,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,gBAAgB;QACzB,SAAS,EAAE,GAAG,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAkB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uCAAuC;YAChD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,SAAS,CAAC;IAErD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,0DAA0D;YACnE,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,CAAC;IACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,mBAAmB,CAAC;IAE/C,IAAI,KAAK,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2DAA2D;YACpE,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;IACpE,IAAI,QAAQ,KAAK,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,uBAAuB,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;IAEhF,OAAO;QACL,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,CAAC,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;QAC/E,OAAO,EAAE,qBAAqB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB;QAChE,SAAS,EAAE,GAAG,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,0CAA0C;AAC1C,EAAE;AACF,2DAA2D;AAC3D,+CAA+C;AAC/C,mDAAmD;AACnD,0CAA0C;AAC1C,+DAA+D;AAC/D,mEAAmE;AAEnE,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,CAAU,CAAC;AAC5F,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAEtC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAkB;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uCAAuC;YAChD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC;IAE7C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qEAAqE;YAC9E,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,WAAW,KAAK,2BAA2B;YACpD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC;IAExC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,sBAAsB;YAC/B,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,WAAW,OAAO,0CAA0C;YACrE,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,WAAW,OAAO,KAAK,SAAS,CAAC,MAAM,cAAc;QAC9D,SAAS,EAAE,GAAG,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAkB;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,YAAY,GAAG,GAAG,EAAE,UAAU;QAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC9B,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAE1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,kCAAkC,UAAU,EAAE;YACvD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAChC,OAAO;YACL,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qDAAqD;YAC9D,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAErD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,OAAO,iBAAiB,CAAC,CAAC;QACpE,IAAI,QAAQ,KAAK,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,QAAQ,iBAAiB,CAAC,CAAC;QAEvE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,IAAI,EAAE,yBAAyB;gBAC/B,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,2BAA2B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACvD,SAAS,EAAE,GAAG,EAAE;gBAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC/B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2BAA2B;YACpC,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,IAAI,EAAE,yBAAyB;YAC/B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,8BAA8B;YACvC,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAkB;IAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,uCAAuC;YAChD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IAEjC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,qDAAqD;YAC9D,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAEjC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,MAAM,UAAU,GAAG,QAAQ,CAAC,SAAS,EAAE,MAAM,IAAI,CAAC,CAAC;QACnD,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,0DAA0D;gBACnE,SAAS,EAAE,GAAG,EAAE;gBAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;aAC/B,CAAC;QACJ,CAAC;QACD,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,cAAc,UAAU,gBAAgB;YACjD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,oBAAoB;YAC1B,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,MAAM,IAAI,SAAS,+CAA+C;YAC9E,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,MAAM,oBAAoB;QACtC,SAAS,EAAE,GAAG,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,GAAkB;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,YAAY,GAAG,GAAG,EAAE,UAAU;QAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;QAC9B,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAC1B,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IAE5D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2DAA2D;YACpE,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,aAAa,CAAU,CAAC;IAC1D,MAAM,aAAa,GAAa,EAAE,CAAC;IACnC,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QACvC,aAAa,EAAE,CAAC;QAEhB,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC;oBACH,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACnC,IAAI,IAAI,CAAC,IAAI,GAAG,yBAAyB,EAAE,CAAC;wBAC1C,WAAW,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;oBACtD,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,aAAa,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;gBACzC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,2CAA2C;YACpD,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,aAAa,6BAA6B,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAChF,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,2BAA2B;YACjC,QAAQ,EAAE,QAAQ;YAClB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,GAAG,aAAa,yCAAyC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC1F,SAAS,EAAE,GAAG,EAAE;YAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;SAC/B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,GAAG,aAAa,mEAAmE;QAC5F,SAAS,EAAE,GAAG,EAAE;QAChB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;KAC/B,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAkB;IACxD,OAAO;QACL,MAAM,YAAY,CAAC,GAAG,CAAC;QACvB,MAAM,iBAAiB,CAAC,GAAG,CAAC;QAC5B,MAAM,gBAAgB,CAAC,GAAG,CAAC;QAC3B,MAAM,oBAAoB,CAAC,GAAG,CAAC;QAC/B,MAAM,kBAAkB,CAAC,GAAG,CAAC;QAC7B,MAAM,sBAAsB,CAAC,GAAG,CAAC;QACjC,MAAM,sBAAsB,CAAC,GAAG,CAAC;QACjC,MAAM,6BAA6B,CAAC,GAAG,CAAC;KACzC,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aiassesstech/mighty-mark",
-  "version": "0.4.9",
+  "version": "0.5.0",
   "description": "System Health Sentinel for AI Assess Tech Fleet — autonomous monitoring, watchdog recovery, and fleet infrastructure oversight.",
   "type": "module",
   "main": "dist/index.js",

package/src/scripts/apply-post-install-hardening.sh

@@ -0,0 +1,292 @@
+#!/bin/bash
+# ============================================================================
+# OpenClaw Post-Install Hardening — Apply Script
+# Author: Archie
+# Date: 2026-03-07
+# Spec: SPEC-OPENCLAW-POST-INSTALL-HARDENING-CHECKLIST v1.1 (BB Approved)
+#
+# Applies post-install hardening to a running OpenClaw VPS:
+#   1. Creates secrets directory with proper permissions
+#   2. Deploys MEMORY.md + HEARTBEAT.md to all agents
+#   3. Patches openclaw.json with hardening config
+#   4. Verifies the result with verify-post-install-hardening.sh
+#
+# Ships with @aiassesstech/mighty-mark npm package (src/scripts/).
+# After deployment via deploy-fleet.sh, run on VPS:
+#   bash ~/.openclaw/extensions/mighty-mark/node_modules/@aiassesstech/mighty-mark/src/scripts/apply-post-install-hardening.sh
+#
+# Or dry-run first:
+#   bash <same-path>/apply-post-install-hardening.sh --dry-run
+#
+# Exit codes:
+#   0 = all changes applied successfully
+#   1 = error occurred
+# ============================================================================
+
+set -euo pipefail
+
+DRY_RUN=false
+SKIP_RESTART=false
+
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --dry-run)       DRY_RUN=true; shift ;;
+    --skip-restart)  SKIP_RESTART=true; shift ;;
+    -h|--help)
+      echo "Usage: $0 [--dry-run] [--skip-restart]"
+      echo "  --dry-run       Preview changes without applying"
+      echo "  --skip-restart  Apply config but don't restart gateway"
+      exit 0
+      ;;
+    *) echo "Unknown option: $1"; exit 1 ;;
+  esac
+done
+
+OPENCLAW_HOME="${OPENCLAW_STATE_DIR:-${OPENCLAW_HOME:-$HOME}/.openclaw}"
+CONFIG_FILE="$OPENCLAW_HOME/openclaw.json"
+EXTENSIONS_DIR="$OPENCLAW_HOME/extensions"
+EXPECTED_AGENTS="grillo jessie noah nole mighty-mark sam"
+TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+
+echo ""
+echo "═══════════════════════════════════════════════════════"
+echo "  Post-Install Hardening — Apply"
+echo "  OPENCLAW_HOME: $OPENCLAW_HOME"
+echo "  Dry run: $DRY_RUN"
+echo "═══════════════════════════════════════════════════════"
+echo ""
+
+# ── Step 1: Secrets directory ───────────────────────────────
+echo "── Step 1: Secrets directory ──"
+
+SECRETS_DIR="$OPENCLAW_HOME/secrets"
+SECRETS_FILE="$SECRETS_DIR/openclaw.env"
+
+if [ ! -d "$SECRETS_DIR" ]; then
+  if $DRY_RUN; then
+    echo "  [DRY RUN] Would create $SECRETS_DIR with mode 700"
+  else
+    mkdir -p "$SECRETS_DIR"
+    chmod 700 "$SECRETS_DIR"
+    echo "  Created $SECRETS_DIR (mode 700)"
+  fi
+else
+  CURRENT_MODE=$(stat -c '%a' "$SECRETS_DIR" 2>/dev/null || stat -f '%Lp' "$SECRETS_DIR" 2>/dev/null)
+  if [ "$CURRENT_MODE" != "700" ]; then
+    if $DRY_RUN; then
+      echo "  [DRY RUN] Would chmod 700 $SECRETS_DIR (currently $CURRENT_MODE)"
+    else
+      chmod 700 "$SECRETS_DIR"
+      echo "  Fixed permissions on $SECRETS_DIR: $CURRENT_MODE -> 700"
+    fi
+  else
+    echo "  $SECRETS_DIR already exists with correct permissions (700)"
+  fi
+fi
+
+if [ -f "$SECRETS_FILE" ]; then
+  CURRENT_MODE=$(stat -c '%a' "$SECRETS_FILE" 2>/dev/null || stat -f '%Lp' "$SECRETS_FILE" 2>/dev/null)
+  if [ "$CURRENT_MODE" != "600" ]; then
+    if $DRY_RUN; then
+      echo "  [DRY RUN] Would chmod 600 $SECRETS_FILE (currently $CURRENT_MODE)"
+    else
+      chmod 600 "$SECRETS_FILE"
+      echo "  Fixed permissions on $SECRETS_FILE: $CURRENT_MODE -> 600"
+    fi
+  else
+    echo "  $SECRETS_FILE exists with correct permissions (600)"
+  fi
+else
+  echo "  ⚠️  $SECRETS_FILE does not exist — create it manually with your API keys"
+fi
+
+# ── Step 2: Deploy workspace files to agents ────────────────
+echo ""
+echo "── Step 2: Agent workspace files ──"
+
+for AGENT in $EXPECTED_AGENTS; do
+  AGENT_WS=""
+  if command -v openclaw &>/dev/null; then
+    AGENT_WS=$(openclaw agent workspace "$AGENT" 2>/dev/null || echo "")
+  fi
+  [ -z "$AGENT_WS" ] && AGENT_WS="$OPENCLAW_HOME/agents/$AGENT"
+
+  AGENT_EXT="$EXTENSIONS_DIR/$AGENT/agent"
+
+  if [ ! -d "$AGENT_EXT" ]; then
+    echo "  ⚠️  $AGENT: no extension dir at $AGENT_EXT — skip"
+    continue
+  fi
+
+  # MEMORY.md — long-term memory
+  if [ ! -f "$AGENT_WS/MEMORY.md" ] && [ ! -f "$AGENT_EXT/MEMORY.md" ]; then
+    TARGET_DIR="$AGENT_WS"
+    [ ! -d "$TARGET_DIR" ] && TARGET_DIR="$AGENT_EXT"
+    if $DRY_RUN; then
+      echo "  [DRY RUN] Would create $TARGET_DIR/MEMORY.md"
+    else
+      mkdir -p "$TARGET_DIR"
+      cat > "$TARGET_DIR/MEMORY.md" << 'MEMEOF'
+# Long-Term Memory
+
+Important learnings, decisions, and context that should persist across sessions.
+
+## Key Decisions
+
+
+## Lessons Learned
+
+
+## Important Context
+
+MEMEOF
+      echo "  $AGENT: created MEMORY.md"
+    fi
+  else
+    echo "  $AGENT: MEMORY.md already exists"
+  fi
+
+  # HEARTBEAT.md — periodic check instructions
+  if [ ! -f "$AGENT_WS/HEARTBEAT.md" ] && [ ! -f "$AGENT_EXT/HEARTBEAT.md" ]; then
+    TARGET_DIR="$AGENT_WS"
+    [ ! -d "$TARGET_DIR" ] && TARGET_DIR="$AGENT_EXT"
+    if $DRY_RUN; then
+      echo "  [DRY RUN] Would create $TARGET_DIR/HEARTBEAT.md"
+    else
+      mkdir -p "$TARGET_DIR"
+      cat > "$TARGET_DIR/HEARTBEAT.md" << 'HBEOF'
+## Cron Health Check (Every Heartbeat)
+
+1. Run `openclaw cron list --show-last-run` (or use /cron) to check all configured cron jobs
+2. If any job's `lastRunAtMs` is older than 2x its expected interval, it is stale
+3. If stale, force-run the missed jobs
+4. Report any exceptions briefly in today's memory file
+HBEOF
+      echo "  $AGENT: created HEARTBEAT.md"
+    fi
+  else
+    echo "  $AGENT: HEARTBEAT.md already exists"
+  fi
+done
+
+# ── Step 3: Patch openclaw.json with hardening config ───────
+echo ""
+echo "── Step 3: Config hardening ──"
+
+if [ ! -f "$CONFIG_FILE" ]; then
+  echo "  ❌ $CONFIG_FILE not found — cannot patch"
+  echo "     Run 'openclaw gateway run' first to generate the config"
+  exit 1
+fi
+
+if $DRY_RUN; then
+  echo "  [DRY RUN] Would patch $CONFIG_FILE with:"
+  echo "    - agents.defaults.model.fallbacks"
+  echo "    - agents.defaults.subagents (1/1 lockdown)"
+  echo "    - telegram.dmPolicy = allowlist"
+else
+  # Backup before modifying (Rule 003: Do No Harm)
+  cp "$CONFIG_FILE" "$CONFIG_FILE.bak.$TIMESTAMP"
+  echo "  Backup: $CONFIG_FILE.bak.$TIMESTAMP"
+
+  python3 -c "
+import json, sys
+
+with open('$CONFIG_FILE') as f:
+    cfg = json.load(f)
+
+changed = False
+
+# Model fallbacks
+defaults = cfg.setdefault('agents', {}).setdefault('defaults', {})
+model = defaults.get('model')
+if not model or isinstance(model, str):
+    print('  ⚠️  model config is a string or missing — not overwriting')
+    print('      Set model defaults manually: openclaw config set agents.defaults.model ...')
+elif isinstance(model, dict) and not model.get('fallbacks'):
+    print('  ⚠️  model.primary is set but no fallbacks — add fallbacks manually')
+else:
+    print('  ✅ model defaults already have fallbacks')
+
+# Subagents lockdown
+subagents = defaults.get('subagents')
+if not subagents:
+    defaults['subagents'] = {'maxSpawnDepth': 1, 'maxChildrenPerAgent': 1}
+    changed = True
+    print('  Applied: subagents lockdown (1/1)')
+elif subagents.get('maxSpawnDepth') != 1 or subagents.get('maxChildrenPerAgent') != 1:
+    defaults['subagents'] = {'maxSpawnDepth': 1, 'maxChildrenPerAgent': 1}
+    changed = True
+    print('  Applied: subagents lockdown (1/1) — was depth=%s, children=%s' % (
+        subagents.get('maxSpawnDepth', '?'), subagents.get('maxChildrenPerAgent', '?')))
+else:
+    print('  ✅ subagents already locked down (1/1)')
+
+# Telegram DM policy
+telegram = cfg.get('telegram', {})
+if not telegram or telegram.get('dmPolicy') != 'allowlist':
+    if not telegram.get('allowFrom'):
+        print('  ⚠️  telegram.dmPolicy set to allowlist, but allowFrom is empty')
+        print('      Add your Telegram user ID: openclaw config set telegram.allowFrom ...')
+    cfg.setdefault('telegram', {})['dmPolicy'] = 'allowlist'
+    changed = True
+    print('  Applied: telegram.dmPolicy = allowlist')
+else:
+    print('  ✅ telegram.dmPolicy already set to allowlist')
+
+if changed:
+    with open('$CONFIG_FILE', 'w') as f:
+        json.dump(cfg, f, indent=2)
+    print('  Config saved to $CONFIG_FILE')
+else:
+    print('  No config changes needed')
+"
+
+  # Validate config before restart (Rule 807)
+  if command -v openclaw &>/dev/null; then
+    echo ""
+    echo "  Validating config..."
+    if openclaw doctor 2>&1 | head -5; then
+      echo "  ✅ Config validation passed"
+    else
+      echo "  ❌ Config validation failed — restoring backup"
+      cp "$CONFIG_FILE.bak.$TIMESTAMP" "$CONFIG_FILE"
+      echo "  Restored from $CONFIG_FILE.bak.$TIMESTAMP"
+      exit 1
+    fi
+  fi
+fi
+
+# ── Step 4: Restart gateway (optional) ──────────────────────
+if ! $DRY_RUN && ! $SKIP_RESTART; then
+  echo ""
+  echo "── Step 4: Gateway restart ──"
+  if command -v systemctl &>/dev/null && systemctl is-active openclaw-gateway &>/dev/null; then
+    systemctl restart openclaw-gateway
+    sleep 5
+    echo "  ✅ Gateway restarted via systemctl"
+    journalctl -u openclaw-gateway --no-pager -n 10 2>/dev/null || true
+  else
+    echo "  ⚠️  systemctl not available or gateway not managed by systemd"
+    echo "     Restart manually: openclaw gateway restart"
+  fi
+fi
+
+# ── Summary ─────────────────────────────────────────────────
+echo ""
+echo "═══════════════════════════════════════════════════════"
+if $DRY_RUN; then
+  echo "  DRY RUN COMPLETE — no changes made"
+  echo "  Run without --dry-run to apply"
+else
+  echo "  Post-Install Hardening Applied"
+  echo ""
+  echo "  Next steps:"
+  echo "    1. Add API keys to $SECRETS_DIR/openclaw.env"
+  echo "    2. Add your Telegram user ID to openclaw.json telegram.allowFrom"
+  echo "    3. Set model fallbacks if not already configured"
+  echo "    4. Run verify: bash /tmp/verify-post-install-hardening.sh"
+  echo "    5. Run Mighty Mark: mighty-mark check"
+fi
+echo "═══════════════════════════════════════════════════════"
+echo ""

package/src/scripts/verify-post-install-hardening.sh

@@ -0,0 +1,266 @@
+#!/bin/bash
+# ============================================================================
+# OpenClaw Post-Install Hardening Verification (Check H)
+# Author: Archie
+# Date: 2026-03-07
+# Spec: SPEC-OPENCLAW-POST-INSTALL-HARDENING-CHECKLIST v1.1 (BB Approved)
+#
+# Verifies post-install hardening items that complement Check G:
+#   1. Gateway is running
+#   2. Model defaults with fallbacks
+#   3. Secrets file permissions (700/600)
+#   4. Telegram DM policy = allowlist
+#   5. Workspace personalization (SOUL.md, IDENTITY.md per agent)
+#   6. MEMORY.md exists for each agent
+#   7. HEARTBEAT.md exists for each agent
+#   8. Cron jobs are not stale
+#   9. Spawn prevention (maxSpawnDepth/maxChildrenPerAgent)
+#
+# Usage:
+#   ./scripts/ops/verify-post-install-hardening.sh           # Normal run
+#   ./scripts/ops/verify-post-install-hardening.sh --json     # Machine-readable
+#   ./scripts/ops/verify-post-install-hardening.sh --quiet    # Exit code only
+#
+# Exit codes:
+#   0 = all checks pass
+#   1 = one or more FAIL results
+#
+# Ships with @aiassesstech/mighty-mark npm package (src/scripts/).
+# After deployment, available at:
+#   ~/.openclaw/extensions/mighty-mark/node_modules/@aiassesstech/mighty-mark/src/scripts/
+# Checks codified in: src/checks/security-hardening.ts
+# ============================================================================
+
+set -euo pipefail
+
+OUTPUT_MODE="human"
+while [[ $# -gt 0 ]]; do
+  case $1 in
+    --json)   OUTPUT_MODE="json"; shift ;;
+    --quiet)  OUTPUT_MODE="quiet"; shift ;;
+    -h|--help)
+      echo "Usage: $0 [--json|--quiet]"
+      echo "  --json   Machine-readable JSON output"
+      echo "  --quiet  No output, exit code only"
+      exit 0
+      ;;
+    *) echo "Unknown option: $1"; exit 1 ;;
+  esac
+done
+
+PASS=0
+WARN=0
+FAIL=0
+RESULTS=""
+
+check() {
+  local label=$1
+  local status=$2
+  local detail=$3
+
+  if [ "$status" = "PASS" ]; then
+    PASS=$((PASS + 1))
+    [ "$OUTPUT_MODE" = "human" ] && echo "  ✅ $label — $detail"
+  elif [ "$status" = "WARN" ]; then
+    WARN=$((WARN + 1))
+    [ "$OUTPUT_MODE" = "human" ] && echo "  ⚠️  $label — $detail"
+  else
+    FAIL=$((FAIL + 1))
+    [ "$OUTPUT_MODE" = "human" ] && echo "  ❌ $label — $detail"
+  fi
+
+  if [ "$OUTPUT_MODE" = "json" ]; then
+    RESULTS="${RESULTS:+$RESULTS,}{\"name\":\"$label\",\"status\":\"$status\",\"detail\":\"$detail\"}"
+  fi
+}
+
+OPENCLAW_HOME="${OPENCLAW_STATE_DIR:-${OPENCLAW_HOME:-$HOME}/.openclaw}"
+CONFIG_FILE="$OPENCLAW_HOME/openclaw.json"
+EXPECTED_AGENTS="grillo jessie noah nole mighty-mark sam"
+
+[ "$OUTPUT_MODE" = "human" ] && echo ""
+[ "$OUTPUT_MODE" = "human" ] && echo "═══════════════════════════════════════════════════════"
+[ "$OUTPUT_MODE" = "human" ] && echo "  Check H: Post-Install Hardening Verification"
+[ "$OUTPUT_MODE" = "human" ] && echo "  Spec: SPEC-OPENCLAW-POST-INSTALL-HARDENING v1.1"
+[ "$OUTPUT_MODE" = "human" ] && echo "═══════════════════════════════════════════════════════"
+[ "$OUTPUT_MODE" = "human" ] && echo ""
+
+# --- H.1: Gateway running ---
+if pgrep -f "openclaw.*gateway" > /dev/null 2>&1; then
+  check "H.1 Gateway process" "PASS" "running"
+else
+  check "H.1 Gateway process" "FAIL" "not detected"
+fi
+
+# --- H.2: Config file readable ---
+if [ ! -f "$CONFIG_FILE" ]; then
+  check "H.2 Config file" "FAIL" "$CONFIG_FILE not found"
+  # Without config, skip config-dependent checks
+  [ "$OUTPUT_MODE" = "human" ] && echo ""
+  [ "$OUTPUT_MODE" = "human" ] && echo "  Config missing — skipping config-dependent checks"
+else
+  check "H.2 Config file" "PASS" "$CONFIG_FILE"
+
+  # --- H.3: Model defaults with fallbacks ---
+  PRIMARY=$(python3 -c "
+import json, sys
+with open('$CONFIG_FILE') as f: c = json.load(f)
+m = c.get('agents',{}).get('defaults',{}).get('model')
+if not m: sys.exit(1)
+if isinstance(m, str): print(m); sys.exit(0)
+print(m.get('primary',''))
+" 2>/dev/null) || PRIMARY=""
+
+  FALLBACK_COUNT=$(python3 -c "
+import json, sys
+with open('$CONFIG_FILE') as f: c = json.load(f)
+m = c.get('agents',{}).get('defaults',{}).get('model',{})
+if isinstance(m, str): print(0); sys.exit(0)
+print(len(m.get('fallbacks',[])))
+" 2>/dev/null) || FALLBACK_COUNT="0"
+
+  if [ -n "$PRIMARY" ] && [ "$FALLBACK_COUNT" -gt 0 ] 2>/dev/null; then
+    check "H.3 Model defaults" "PASS" "primary=$PRIMARY, $FALLBACK_COUNT fallback(s)"
+  elif [ -n "$PRIMARY" ]; then
+    check "H.3 Model defaults" "WARN" "primary=$PRIMARY, no fallbacks"
+  else
+    check "H.3 Model defaults" "WARN" "no model defaults configured"
+  fi
+
+  # --- H.4: Telegram DM policy ---
+  DM_POLICY=$(python3 -c "
+import json
+with open('$CONFIG_FILE') as f: c = json.load(f)
+print(c.get('telegram',{}).get('dmPolicy',''))
+" 2>/dev/null) || DM_POLICY=""
+
+  ALLOW_COUNT=$(python3 -c "
+import json
+with open('$CONFIG_FILE') as f: c = json.load(f)
+print(len(c.get('telegram',{}).get('allowFrom',[])))
+" 2>/dev/null) || ALLOW_COUNT="0"
+
+  if [ "$DM_POLICY" = "allowlist" ] && [ "$ALLOW_COUNT" -gt 0 ] 2>/dev/null; then
+    check "H.4 Telegram DM policy" "PASS" "allowlist, $ALLOW_COUNT allowed"
+  elif [ "$DM_POLICY" = "allowlist" ]; then
+    check "H.4 Telegram DM policy" "WARN" "allowlist but allowFrom empty"
+  elif [ "$DM_POLICY" = "open" ] || [ -z "$DM_POLICY" ]; then
+    check "H.4 Telegram DM policy" "FAIL" "${DM_POLICY:-NOT SET} — open to all"
+  else
+    check "H.4 Telegram DM policy" "WARN" "$DM_POLICY — verify manually"
+  fi
+
+  # --- H.5: Spawn prevention ---
+  SPAWN_DEPTH=$(python3 -c "
+import json
+with open('$CONFIG_FILE') as f: c = json.load(f)
+print(c.get('agents',{}).get('defaults',{}).get('subagents',{}).get('maxSpawnDepth',''))
+" 2>/dev/null) || SPAWN_DEPTH=""
+
+  CHILDREN=$(python3 -c "
+import json
+with open('$CONFIG_FILE') as f: c = json.load(f)
+print(c.get('agents',{}).get('defaults',{}).get('subagents',{}).get('maxChildrenPerAgent',''))
+" 2>/dev/null) || CHILDREN=""
+
+  if [ "$SPAWN_DEPTH" = "1" ] && [ "$CHILDREN" = "1" ]; then
+    check "H.5 Spawn prevention" "PASS" "depth=1, children=1"
+  elif [ -n "$SPAWN_DEPTH" ] || [ -n "$CHILDREN" ]; then
+    check "H.5 Spawn prevention" "WARN" "depth=${SPAWN_DEPTH:-?}, children=${CHILDREN:-?}"
+  else
+    check "H.5 Spawn prevention" "WARN" "not configured"
+  fi
+fi
+
+# --- H.6: Secrets file permissions ---
+SECRETS_DIR="$OPENCLAW_HOME/secrets"
+SECRETS_FILE="$SECRETS_DIR/openclaw.env"
+
+if [ ! -d "$SECRETS_DIR" ]; then
+  check "H.6 Secrets permissions" "FAIL" "$SECRETS_DIR not found"
+elif [ ! -f "$SECRETS_FILE" ]; then
+  check "H.6 Secrets permissions" "FAIL" "dir exists but openclaw.env missing"
+else
+  DIR_PERM=$(stat -c '%a' "$SECRETS_DIR" 2>/dev/null || stat -f '%Lp' "$SECRETS_DIR" 2>/dev/null)
+  FILE_PERM=$(stat -c '%a' "$SECRETS_FILE" 2>/dev/null || stat -f '%Lp' "$SECRETS_FILE" 2>/dev/null)
+  ISSUES=""
+  [ "$DIR_PERM" != "700" ] && ISSUES="dir=$DIR_PERM(want 700) "
+  [ "$FILE_PERM" != "600" ] && ISSUES="${ISSUES}file=$FILE_PERM(want 600)"
+  if [ -z "$ISSUES" ]; then
+    check "H.6 Secrets permissions" "PASS" "dir=700, file=600"
+  else
+    check "H.6 Secrets permissions" "WARN" "$ISSUES"
+  fi
+fi
+
+# --- H.7–H.9: Per-agent workspace files ---
+EXTENSIONS_DIR="$OPENCLAW_HOME/extensions"
+MISSING_SOUL=""
+MISSING_IDENTITY=""
+MISSING_MEMORY=""
+MISSING_HEARTBEAT=""
+AGENT_COUNT=0
+
+for AGENT in $EXPECTED_AGENTS; do
+  AGENT_DIR="$EXTENSIONS_DIR/$AGENT/agent"
+  [ ! -d "$AGENT_DIR" ] && continue
+  AGENT_COUNT=$((AGENT_COUNT + 1))
+
+  [ ! -f "$AGENT_DIR/SOUL.md" ] && MISSING_SOUL="$MISSING_SOUL $AGENT"
+  [ ! -f "$AGENT_DIR/IDENTITY.md" ] && MISSING_IDENTITY="$MISSING_IDENTITY $AGENT"
+
+  AGENT_WS=$(openclaw agent workspace "$AGENT" 2>/dev/null || echo "")
+  [ -z "$AGENT_WS" ] && AGENT_WS="$OPENCLAW_HOME/agents/$AGENT"
+  [ ! -f "$AGENT_WS/MEMORY.md" ] && [ ! -f "$AGENT_DIR/MEMORY.md" ] && MISSING_MEMORY="$MISSING_MEMORY $AGENT"
+  [ ! -f "$AGENT_WS/HEARTBEAT.md" ] && [ ! -f "$AGENT_DIR/HEARTBEAT.md" ] && MISSING_HEARTBEAT="$MISSING_HEARTBEAT $AGENT"
+done
+
+if [ "$AGENT_COUNT" -eq 0 ]; then
+  check "H.7 Personalization" "WARN" "no agent dirs found"
+elif [ -n "$MISSING_SOUL" ] || [ -n "$MISSING_IDENTITY" ]; then
+  DETAIL=""
+  [ -n "$MISSING_SOUL" ] && DETAIL="SOUL.md:${MISSING_SOUL}"
+  [ -n "$MISSING_IDENTITY" ] && DETAIL="${DETAIL:+$DETAIL; }IDENTITY.md:${MISSING_IDENTITY}"
+  check "H.7 Personalization" "FAIL" "missing — $DETAIL"
+else
+  check "H.7 Personalization" "PASS" "$AGENT_COUNT agents have SOUL.md + IDENTITY.md"
+fi
+
+if [ "$AGENT_COUNT" -gt 0 ]; then
+  if [ -n "$MISSING_MEMORY" ]; then
+    check "H.8 MEMORY.md" "WARN" "missing for:${MISSING_MEMORY}"
+  else
+    check "H.8 MEMORY.md" "PASS" "$AGENT_COUNT agents"
+  fi
+
+  if [ -n "$MISSING_HEARTBEAT" ]; then
+    check "H.9 HEARTBEAT.md" "WARN" "missing for:${MISSING_HEARTBEAT}"
+  else
+    check "H.9 HEARTBEAT.md" "PASS" "$AGENT_COUNT agents"
+  fi
+fi
+
+# --- Summary ---
+TOTAL=$((PASS + WARN + FAIL))
+
+if [ "$OUTPUT_MODE" = "human" ]; then
+  echo ""
+  echo "───────────────────────────────────────────────────────"
+  echo "  Results: $PASS pass | $WARN warn | $FAIL fail  (total: $TOTAL)"
+  if [ "$FAIL" -eq 0 ] && [ "$WARN" -eq 0 ]; then
+    echo "  Status: ✅ ALL CLEAR"
+  elif [ "$FAIL" -eq 0 ]; then
+    echo "  Status: ⚠️  WARNINGS — review items above"
+  else
+    echo "  Status: ❌ FAILURES — action required"
+  fi
+  echo "───────────────────────────────────────────────────────"
+  echo ""
+fi
+
+if [ "$OUTPUT_MODE" = "json" ]; then
+  echo "{\"check\":\"post-install-hardening\",\"version\":\"1.1\",\"pass\":$PASS,\"warn\":$WARN,\"fail\":$FAIL,\"total\":$TOTAL,\"results\":[$RESULTS]}"
+fi
+
+[ "$FAIL" -gt 0 ] && exit 1
+exit 0