@darkelogix/openclaw-trusted-mode 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -9,8 +9,8 @@ Terminology and acronyms: [`GLOSSARY.md`](./GLOSSARY.md).
 - `CLI`: Command Line Interface
 - `CI`: Continuous Integration
 
-## Unreleased
-- Add governed release artifacts (`SECURITY.md`, `RELEASE_v1.0.0.md`, compatibility matrix).
+## Unreleased
+- Add governed release artifacts (`SECURITY.md`, `RELEASE_v1.0.0.md`, compatibility matrix).
 - Add Trusted Mode Check attestation status contract (`ENFORCED_OK`, `LOCKDOWN_ONLY`, `UNSAFE`) with JSON output.
 - Add CI gates for release artifact and changelog version discipline.
 - Add runtime certification gating (`CERTIFIED_ENFORCED` vs `LOCKDOWN_ONLY`/`UNSUPPORTED`) in plugin.
@@ -25,9 +25,13 @@ Terminology and acronyms: [`GLOSSARY.md`](./GLOSSARY.md).
 - Add generated `SECURITY_RELEASE_INDEX.md` artifact and workflow integration for release evidence traceability.
 - Add enterprise hardening options in plugin config (`toolPolicyMode`, `allowedTools`, `requireTenantId`, `allowedTenantIds`) with fail-closed validation behavior.
 - Add plugin schema/runtime contract check (`verify-plugin-schema-contract`) and CI enforcement.
-- Add consolidated release evidence bundling command (`bundle-release-evidence`) and release workflow artifact publication.
-- Add enterprise TCTP/EVTP validation matrix runner (`npm run test-pack-matrix`) against live PDP.
-- Add release documentation for deterministic certification proof (`decision_proof`) vs timestamped operational `outcome_event`.
+- Add consolidated release evidence bundling command (`bundle-release-evidence`) and release workflow artifact publication.
+- Add enterprise TCTP/EVTP validation matrix runner (`npm run test-pack-matrix`) against live PDP.
+- Add release documentation for deterministic certification proof (`decision_proof`) vs timestamped operational `outcome_event`.
+
+## v1.0.1
+- normalize constrained paths before prefix enforcement so `/tmp-evil`, traversal segments, and Windows path-prefix collisions do not bypass policy
+- add regression coverage for path normalization and descendant-boundary checks
 
 ## v1.0.0
 - Add Trusted Mode Check CLI (Node) with mock PDP for CI.

package/README.md

@@ -57,12 +57,13 @@ For governed release declaration, see [`RELEASE_v1.0.0.md`](./RELEASE_v1.0.0.md)
 
 ## What it does
 
-- Free standalone mode defaults to local hardening with a minimal allowlist:
-  - `read_file`
-  - `list_files`
-  - `search_files`
-- Blocks high-risk tools such as `exec`, file writes/edits, and deletes unless you deliberately widen the policy.
-- Sends tool call context to a Policy Decision Point (PDP) endpoint.
+- Free standalone mode defaults to local hardening with a minimal allowlist:
+  - `read_file`
+  - `list_files`
+  - `search_files`
+- Blocks high-risk tools such as `exec`, file writes/edits, and deletes unless you deliberately widen the policy.
+- Normalizes constrained paths before enforcing allowed prefixes so traversal and lookalike prefixes do not slip through.
+- Sends tool call context to a Policy Decision Point (PDP) endpoint.
 - Denies execution when PDP returns a deny decision.
 - Optionally enforces returned constraints.
 - Supports fail-closed (default) or fail-open behavior.

package/SELF_SERVICE_FAQ.md

@@ -69,9 +69,9 @@ If not loaded:
 
 If you are using standalone free mode, check these first:
 
-1. Confirm `toolPolicyMode` is `ALLOWLIST_ONLY`.
-2. Confirm the blocked tool is not present in `allowedTools`.
-3. For shell execution, verify the runtime tool name is `exec`.
+1. Confirm `toolPolicyMode` is `ALLOWLIST_ONLY`.
+2. Confirm the blocked tool is not present in `allowedTools`.
+3. For shell execution, the runtime commonly emits `exec`; current SDE governance canonicalizes `exec`, `execute_shell`, and `run_shell_command` to the same shell policy, but verifying the observed tool id is still useful for troubleshooting.
 
 Run SDE smoke test:
 

package/dist/constraints.js

@@ -1,6 +1,58 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.enforceConstraints = enforceConstraints;
+const node_path_1 = __importDefault(require("node:path"));
+function normalizePathValue(value) {
+    const trimmed = String(value || '').trim();
+    if (!trimmed)
+        return null;
+    const windows = /^[a-zA-Z]:[\\/]/.test(trimmed) || trimmed.includes('\\');
+    const pathApi = windows ? node_path_1.default.win32 : node_path_1.default.posix;
+    const separator = windows ? '\\' : '/';
+    const root = pathApi.parse(trimmed).root;
+    let normalized = pathApi.normalize(trimmed);
+    if (windows)
+        normalized = normalized.replace(/\//g, '\\');
+    while (normalized.length > root.length &&
+        (normalized.endsWith('/') || normalized.endsWith('\\'))) {
+        normalized = normalized.slice(0, -1);
+    }
+    return {
+        normalized: normalized || root || separator,
+        root,
+        separator,
+        windows,
+    };
+}
+function isPathWithinPrefix(value, prefix) {
+    const normalizedValue = normalizePathValue(value);
+    const normalizedPrefix = normalizePathValue(prefix);
+    if (!normalizedValue || !normalizedPrefix)
+        return false;
+    if (normalizedValue.windows !== normalizedPrefix.windows)
+        return false;
+    const left = normalizedValue.windows
+        ? normalizedValue.normalized.toLowerCase()
+        : normalizedValue.normalized;
+    const right = normalizedPrefix.windows
+        ? normalizedPrefix.normalized.toLowerCase()
+        : normalizedPrefix.normalized;
+    if (left === right)
+        return true;
+    if (right === normalizedPrefix.root) {
+        return left.startsWith(right);
+    }
+    return left.startsWith(`${right}${normalizedPrefix.separator}`);
+}
+function matchesAllowedPrefix(key, value, prefix) {
+    if (key.toLowerCase().includes('path')) {
+        return isPathWithinPrefix(value, prefix);
+    }
+    return value.startsWith(prefix);
+}
 function enforceConstraints(params, constraints) {
     if (!Array.isArray(constraints)) {
         throw new Error(`[Trusted Mode ERROR] Invalid constraints format`);
@@ -15,7 +67,7 @@ function enforceConstraints(params, constraints) {
         const value = params?.[key];
         if (typeof value !== 'string')
             continue;
-        const ok = allowedPrefixes.some((prefix) => value.startsWith(prefix));
+        const ok = allowedPrefixes.some((prefix) => typeof prefix === 'string' && matchesAllowedPrefix(key, value, prefix));
         if (!ok) {
             throw new Error(`[Trusted Mode BLOCKED] Constraint violation for "${key}" (allowed prefixes: ${allowedPrefixes.join(', ')})`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@darkelogix/openclaw-trusted-mode",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "MIT-licensed OpenClaw Trusted Mode plugin with standalone hardening and optional SDE-backed governance",
   "license": "MIT",
   "main": "dist/index.js",