@gguf/claw 2026.2.9 → 2026.2.13

package/dist/{audit-Dn2cBl2x.js → audit-CfPZ_5Id.js}

@@ -1,23 +1,24 @@
 import { g as resolveStateDir, m as resolveOAuthDir, o as resolveConfigPath } from "./paths-DVBShlw6.js";
 import { l as normalizeAgentId } from "./session-key-BWxPj0z_.js";
-import { n as runExec } from "./exec-DFOtZbI0.js";
-import { c as resolveDefaultAgentId, s as resolveAgentWorkspaceDir } from "./agent-scope-DnyDZ5RH.js";
+import { n as runExec } from "./exec-BPQSKwGa.js";
+import { c as resolveDefaultAgentId, s as resolveAgentWorkspaceDir } from "./agent-scope-GYIs5dyU.js";
 import { t as formatCliCommand } from "./command-format-ChfKqObn.js";
-import { D as INCLUDE_KEY, O as MAX_INCLUDE_DEPTH, r as createConfigIO } from "./config-Bj2eDa02.js";
-import { a as MANIFEST_KEY } from "./manifest-registry-DyMRD3rY.js";
-import { n as listChannelPlugins } from "./plugins-CQw3z3Nw.js";
-import { $ as resolveSandboxToolPolicyForAgent, Z as resolveSandboxConfigForAgent, ot as resolveToolProfilePolicy } from "./sandbox-qt49csTr.js";
-import { i as loadWorkspaceSkillEntries } from "./skills-_eKGrw9z.js";
-import { n as formatErrorMessage } from "./errors-B0eT3jVv.js";
-import { a as resolveProfile, i as resolveBrowserConfig } from "./server-context-39mkstUs.js";
-import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-CHRYQtAM.js";
-import { t as GatewayClient } from "./client-C0gQ7hrj.js";
-import { t as buildGatewayConnectionDetails } from "./call-CM25qgxz.js";
-import { i as readChannelAllowFromStore } from "./pairing-store-BpPUNzmB.js";
-import { c as resolveNativeSkillsEnabled, n as isToolAllowedByPolicies, s as resolveNativeCommandsEnabled } from "./pi-tools.policy-gG96mWwA.js";
-import { t as resolveChannelDefaultAccountId } from "./helpers-C89IG08W.js";
-import { t as scanDirectoryWithSummary } from "./skill-scanner-DrVEHfC6.js";
-import { i as resolveGatewayAuth } from "./auth-DkjJ3pm-.js";
+import { A as MAX_INCLUDE_DEPTH, k as INCLUDE_KEY, r as createConfigIO } from "./config-CeWMHOiQ.js";
+import { a as MANIFEST_KEY, l as normalizePluginsConfig } from "./manifest-registry-jeAPx6AW.js";
+import { n as listChannelPlugins } from "./plugins-CTjLu-z-.js";
+import { $ as resolveSandboxConfigForAgent, ct as resolveToolProfilePolicy, tt as resolveSandboxToolPolicyForAgent } from "./sandbox-BAChxjC5.js";
+import { i as loadWorkspaceSkillEntries } from "./skills-Dz15dAM4.js";
+import { n as formatErrorMessage } from "./errors-Bv81hF2P.js";
+import { a as resolveProfile, i as resolveBrowserConfig } from "./server-context-RY7lRaxl.js";
+import { h as GATEWAY_CLIENT_NAMES, m as GATEWAY_CLIENT_MODES } from "./message-channel-CTtrEkmW.js";
+import { t as GatewayClient } from "./client-DyAxKXKY.js";
+import { t as buildGatewayConnectionDetails } from "./call-DAfkvtVq.js";
+import { i as readChannelAllowFromStore } from "./pairing-store-gQdv7Ruh.js";
+import { c as resolveNativeSkillsEnabled, n as isToolAllowedByPolicies, s as resolveNativeCommandsEnabled } from "./pi-tools.policy-z5Wd_2WN.js";
+import { i as resolveGatewayAuth } from "./auth-9nTeB2Je.js";
+import { n as resolveBrowserControlAuth } from "./control-auth-C8rIqEdA.js";
+import { t as resolveChannelDefaultAccountId } from "./helpers-HyeZXsnu.js";
+import { t as scanDirectoryWithSummary } from "./skill-scanner-CucvxYhu.js";
 import os from "node:os";
 import path from "node:path";
 import JSON5 from "json5";
@@ -109,6 +110,143 @@ async function probeGateway(opts) {
 	});
 }
 
+//#endregion
+//#region src/gateway/node-command-policy.ts
+const CANVAS_COMMANDS = [
+	"canvas.present",
+	"canvas.hide",
+	"canvas.navigate",
+	"canvas.eval",
+	"canvas.snapshot",
+	"canvas.a2ui.push",
+	"canvas.a2ui.pushJSONL",
+	"canvas.a2ui.reset"
+];
+const CAMERA_COMMANDS = ["camera.list"];
+const CAMERA_DANGEROUS_COMMANDS = ["camera.snap", "camera.clip"];
+const SCREEN_DANGEROUS_COMMANDS = ["screen.record"];
+const LOCATION_COMMANDS = ["location.get"];
+const DEVICE_COMMANDS = ["device.info", "device.status"];
+const CONTACTS_COMMANDS = ["contacts.search"];
+const CONTACTS_DANGEROUS_COMMANDS = ["contacts.add"];
+const CALENDAR_COMMANDS = ["calendar.events"];
+const CALENDAR_DANGEROUS_COMMANDS = ["calendar.add"];
+const REMINDERS_COMMANDS = ["reminders.list"];
+const REMINDERS_DANGEROUS_COMMANDS = ["reminders.add"];
+const PHOTOS_COMMANDS = ["photos.latest"];
+const MOTION_COMMANDS = ["motion.activity", "motion.pedometer"];
+const SMS_DANGEROUS_COMMANDS = ["sms.send"];
+const IOS_SYSTEM_COMMANDS = ["system.notify"];
+const SYSTEM_COMMANDS = [
+	"system.run",
+	"system.which",
+	"system.notify",
+	"system.execApprovals.get",
+	"system.execApprovals.set",
+	"browser.proxy"
+];
+const DEFAULT_DANGEROUS_NODE_COMMANDS = [
+	...CAMERA_DANGEROUS_COMMANDS,
+	...SCREEN_DANGEROUS_COMMANDS,
+	...CONTACTS_DANGEROUS_COMMANDS,
+	...CALENDAR_DANGEROUS_COMMANDS,
+	...REMINDERS_DANGEROUS_COMMANDS,
+	...SMS_DANGEROUS_COMMANDS
+];
+const PLATFORM_DEFAULTS = {
+	ios: [
+		...CANVAS_COMMANDS,
+		...CAMERA_COMMANDS,
+		...LOCATION_COMMANDS,
+		...DEVICE_COMMANDS,
+		...CONTACTS_COMMANDS,
+		...CALENDAR_COMMANDS,
+		...REMINDERS_COMMANDS,
+		...PHOTOS_COMMANDS,
+		...MOTION_COMMANDS,
+		...IOS_SYSTEM_COMMANDS
+	],
+	android: [
+		...CANVAS_COMMANDS,
+		...CAMERA_COMMANDS,
+		...LOCATION_COMMANDS,
+		...DEVICE_COMMANDS,
+		...CONTACTS_COMMANDS,
+		...CALENDAR_COMMANDS,
+		...REMINDERS_COMMANDS,
+		...PHOTOS_COMMANDS,
+		...MOTION_COMMANDS
+	],
+	macos: [
+		...CANVAS_COMMANDS,
+		...CAMERA_COMMANDS,
+		...LOCATION_COMMANDS,
+		...DEVICE_COMMANDS,
+		...CONTACTS_COMMANDS,
+		...CALENDAR_COMMANDS,
+		...REMINDERS_COMMANDS,
+		...PHOTOS_COMMANDS,
+		...MOTION_COMMANDS,
+		...SYSTEM_COMMANDS
+	],
+	linux: [...SYSTEM_COMMANDS],
+	windows: [...SYSTEM_COMMANDS],
+	unknown: [
+		...CANVAS_COMMANDS,
+		...CAMERA_COMMANDS,
+		...LOCATION_COMMANDS,
+		...SYSTEM_COMMANDS
+	]
+};
+function normalizePlatformId(platform, deviceFamily) {
+	const raw = (platform ?? "").trim().toLowerCase();
+	if (raw.startsWith("ios")) return "ios";
+	if (raw.startsWith("android")) return "android";
+	if (raw.startsWith("mac")) return "macos";
+	if (raw.startsWith("darwin")) return "macos";
+	if (raw.startsWith("win")) return "windows";
+	if (raw.startsWith("linux")) return "linux";
+	const family = (deviceFamily ?? "").trim().toLowerCase();
+	if (family.includes("iphone") || family.includes("ipad") || family.includes("ios")) return "ios";
+	if (family.includes("android")) return "android";
+	if (family.includes("mac")) return "macos";
+	if (family.includes("windows")) return "windows";
+	if (family.includes("linux")) return "linux";
+	return "unknown";
+}
+function resolveNodeCommandAllowlist(cfg, node) {
+	const base = PLATFORM_DEFAULTS[normalizePlatformId(node?.platform, node?.deviceFamily)] ?? PLATFORM_DEFAULTS.unknown;
+	const extra = cfg.gateway?.nodes?.allowCommands ?? [];
+	const deny = new Set(cfg.gateway?.nodes?.denyCommands ?? []);
+	const allow = new Set([...base, ...extra].map((cmd) => cmd.trim()).filter(Boolean));
+	for (const blocked of deny) {
+		const trimmed = blocked.trim();
+		if (trimmed) allow.delete(trimmed);
+	}
+	return allow;
+}
+function isNodeCommandAllowed(params) {
+	const command = params.command.trim();
+	if (!command) return {
+		ok: false,
+		reason: "command required"
+	};
+	if (!params.allowlist.has(command)) return {
+		ok: false,
+		reason: "command not allowlisted"
+	};
+	if (Array.isArray(params.declaredCommands) && params.declaredCommands.length > 0) {
+		if (!params.declaredCommands.includes(command)) return {
+			ok: false,
+			reason: "command not declared by node"
+		};
+	} else return {
+		ok: false,
+		reason: "node did not declare commands"
+	};
+	return { ok: true };
+}
+
 //#endregion
 //#region src/security/audit-extra.sync.ts
 const SMALL_MODEL_PARAM_B_MAX = 300;
@@ -143,6 +281,11 @@ function looksLikeEnvRef(value) {
 	const v = value.trim();
 	return v.startsWith("${") && v.endsWith("}");
 }
+function isGatewayRemotelyExposed(cfg) {
+	if ((typeof cfg.gateway?.bind === "string" ? cfg.gateway.bind : "loopback") !== "loopback") return true;
+	const tailscaleMode = cfg.gateway?.tailscale?.mode ?? "off";
+	return tailscaleMode === "serve" || tailscaleMode === "funnel";
+}
 function addModel(models, raw, source) {
 	if (typeof raw !== "string") return;
 	const id = raw.trim();
@@ -221,9 +364,14 @@ function isClaude45OrHigher(id) {
 function extractAgentIdFromSource(source) {
 	return source.match(/^agents\.list\.([^.]*)\./)?.[1] ?? null;
 }
-function pickToolPolicy(config) {
+function unionAllow$1(base, extra) {
+	if (!Array.isArray(extra) || extra.length === 0) return base;
+	if (!Array.isArray(base) || base.length === 0) return Array.from(new Set(["*", ...extra]));
+	return Array.from(new Set([...base, ...extra]));
+}
+function pickToolPolicy$1(config) {
 	if (!config) return null;
-	const allow = Array.isArray(config.allow) ? config.allow : void 0;
+	const allow = Array.isArray(config.allow) ? unionAllow$1(config.allow, config.alsoAllow) : Array.isArray(config.alsoAllow) && config.alsoAllow.length > 0 ? unionAllow$1(void 0, config.alsoAllow) : void 0;
 	const deny = Array.isArray(config.deny) ? config.deny : void 0;
 	if (!allow && !deny) return null;
 	return {
@@ -231,13 +379,54 @@ function pickToolPolicy(config) {
 		deny
 	};
 }
-function resolveToolPolicies(params) {
+function hasConfiguredDockerConfig(docker) {
+	if (!docker || typeof docker !== "object") return false;
+	return Object.values(docker).some((value) => value !== void 0);
+}
+function normalizeNodeCommand(value) {
+	return typeof value === "string" ? value.trim() : "";
+}
+function listKnownNodeCommands(cfg) {
+	const baseCfg = {
+		...cfg,
+		gateway: {
+			...cfg.gateway,
+			nodes: {
+				...cfg.gateway?.nodes,
+				denyCommands: []
+			}
+		}
+	};
+	const out = /* @__PURE__ */ new Set();
+	for (const platform of [
+		"ios",
+		"android",
+		"macos",
+		"linux",
+		"windows",
+		"unknown"
+	]) {
+		const allow = resolveNodeCommandAllowlist(baseCfg, { platform });
+		for (const cmd of allow) {
+			const normalized = normalizeNodeCommand(cmd);
+			if (normalized) out.add(normalized);
+		}
+	}
+	return out;
+}
+function looksLikeNodeCommandPattern(value) {
+	if (!value) return false;
+	if (/[?*[\]{}(),|]/.test(value)) return true;
+	if (value.startsWith("/") || value.endsWith("/") || value.startsWith("^") || value.endsWith("$")) return true;
+	return /\s/.test(value) || value.includes("group:");
+}
+function resolveToolPolicies$1(params) {
 	const policies = [];
 	const profilePolicy = resolveToolProfilePolicy(params.agentTools?.profile ?? params.cfg.tools?.profile);
 	if (profilePolicy) policies.push(profilePolicy);
-	const globalPolicy = pickToolPolicy(params.cfg.tools ?? void 0);
+	const globalPolicy = pickToolPolicy$1(params.cfg.tools ?? void 0);
 	if (globalPolicy) policies.push(globalPolicy);
-	const agentPolicy = pickToolPolicy(params.agentTools);
+	const agentPolicy = pickToolPolicy$1(params.agentTools);
 	if (agentPolicy) policies.push(agentPolicy);
 	if (params.sandboxMode === "all") {
 		const sandboxPolicy = resolveSandboxToolPolicyForAgent(params.cfg, params.agentId ?? void 0);
@@ -285,13 +474,14 @@ function listGroupPolicyOpen(cfg) {
 function collectAttackSurfaceSummaryFindings(cfg) {
 	const group = summarizeGroupPolicy(cfg);
 	const elevated = cfg.tools?.elevated?.enabled !== false;
-	const hooksEnabled = cfg.hooks?.enabled === true;
+	const webhooksEnabled = cfg.hooks?.enabled === true;
+	const internalHooksEnabled = cfg.hooks?.internal?.enabled === true;
 	const browserEnabled = cfg.browser?.enabled ?? true;
 	return [{
 		checkId: "summary.attack_surface",
 		severity: "info",
 		title: "Attack surface summary",
-		detail: `groups: open=${group.open}, allowlist=${group.allowlist}\ntools.elevated: ${elevated ? "enabled" : "disabled"}\nhooks: ${hooksEnabled ? "enabled" : "disabled"}\nbrowser control: ${browserEnabled ? "enabled" : "disabled"}`
+		detail: `groups: open=${group.open}, allowlist=${group.allowlist}\ntools.elevated: ${elevated ? "enabled" : "disabled"}\nhooks.webhooks: ${webhooksEnabled ? "enabled" : "disabled"}\nhooks.internal: ${internalHooksEnabled ? "enabled" : "disabled"}\nbrowser control: ${browserEnabled ? "enabled" : "disabled"}`
 	}];
 }
 function collectSyncedFolderFindings(params) {
@@ -353,6 +543,97 @@ function collectHooksHardeningFindings(cfg) {
 		detail: "hooks.path='/' would shadow other HTTP endpoints and is unsafe.",
 		remediation: "Use a dedicated path like '/hooks'."
 	});
+	const allowRequestSessionKey = cfg.hooks?.allowRequestSessionKey === true;
+	const defaultSessionKey = typeof cfg.hooks?.defaultSessionKey === "string" ? cfg.hooks.defaultSessionKey.trim() : "";
+	const allowedPrefixes = Array.isArray(cfg.hooks?.allowedSessionKeyPrefixes) ? cfg.hooks.allowedSessionKeyPrefixes.map((prefix) => prefix.trim()).filter((prefix) => prefix.length > 0) : [];
+	const remoteExposure = isGatewayRemotelyExposed(cfg);
+	if (!defaultSessionKey) findings.push({
+		checkId: "hooks.default_session_key_unset",
+		severity: "warn",
+		title: "hooks.defaultSessionKey is not configured",
+		detail: "Hook agent runs without explicit sessionKey use generated per-request keys. Set hooks.defaultSessionKey to keep hook ingress scoped to a known session.",
+		remediation: "Set hooks.defaultSessionKey (for example, \"hook:ingress\")."
+	});
+	if (allowRequestSessionKey) findings.push({
+		checkId: "hooks.request_session_key_enabled",
+		severity: remoteExposure ? "critical" : "warn",
+		title: "External hook payloads may override sessionKey",
+		detail: "hooks.allowRequestSessionKey=true allows `/hooks/agent` callers to choose the session key. Treat hook token holders as full-trust unless you also restrict prefixes.",
+		remediation: "Set hooks.allowRequestSessionKey=false (recommended) or constrain hooks.allowedSessionKeyPrefixes."
+	});
+	if (allowRequestSessionKey && allowedPrefixes.length === 0) findings.push({
+		checkId: "hooks.request_session_key_prefixes_missing",
+		severity: remoteExposure ? "critical" : "warn",
+		title: "Request sessionKey override is enabled without prefix restrictions",
+		detail: "hooks.allowRequestSessionKey=true and hooks.allowedSessionKeyPrefixes is unset/empty, so request payloads can target arbitrary session key shapes.",
+		remediation: "Set hooks.allowedSessionKeyPrefixes (for example, [\"hook:\"]) or disable request overrides."
+	});
+	return findings;
+}
+function collectSandboxDockerNoopFindings(cfg) {
+	const findings = [];
+	const configuredPaths = [];
+	const agents = Array.isArray(cfg.agents?.list) ? cfg.agents.list : [];
+	const defaultsSandbox = cfg.agents?.defaults?.sandbox;
+	const hasDefaultDocker = hasConfiguredDockerConfig(defaultsSandbox?.docker);
+	const defaultMode = defaultsSandbox?.mode ?? "off";
+	const hasAnySandboxEnabledAgent = agents.some((entry) => {
+		if (!entry || typeof entry !== "object" || typeof entry.id !== "string") return false;
+		return resolveSandboxConfigForAgent(cfg, entry.id).mode !== "off";
+	});
+	if (hasDefaultDocker && defaultMode === "off" && !hasAnySandboxEnabledAgent) configuredPaths.push("agents.defaults.sandbox.docker");
+	for (const entry of agents) {
+		if (!entry || typeof entry !== "object" || typeof entry.id !== "string") continue;
+		if (!hasConfiguredDockerConfig(entry.sandbox?.docker)) continue;
+		if (resolveSandboxConfigForAgent(cfg, entry.id).mode === "off") configuredPaths.push(`agents.list.${entry.id}.sandbox.docker`);
+	}
+	if (configuredPaths.length === 0) return findings;
+	findings.push({
+		checkId: "sandbox.docker_config_mode_off",
+		severity: "warn",
+		title: "Sandbox docker settings configured while sandbox mode is off",
+		detail: "These docker settings will not take effect until sandbox mode is enabled:\n" + configuredPaths.map((entry) => `- ${entry}`).join("\n"),
+		remediation: "Enable sandbox mode (`agents.defaults.sandbox.mode=\"non-main\"` or `\"all\"`) where needed, or remove unused docker settings."
+	});
+	return findings;
+}
+function collectNodeDenyCommandPatternFindings(cfg) {
+	const findings = [];
+	const denyListRaw = cfg.gateway?.nodes?.denyCommands;
+	if (!Array.isArray(denyListRaw) || denyListRaw.length === 0) return findings;
+	const denyList = denyListRaw.map(normalizeNodeCommand).filter(Boolean);
+	if (denyList.length === 0) return findings;
+	const knownCommands = listKnownNodeCommands(cfg);
+	const patternLike = denyList.filter((entry) => looksLikeNodeCommandPattern(entry));
+	const unknownExact = denyList.filter((entry) => !looksLikeNodeCommandPattern(entry) && !knownCommands.has(entry));
+	if (patternLike.length === 0 && unknownExact.length === 0) return findings;
+	const detailParts = [];
+	if (patternLike.length > 0) detailParts.push(`Pattern-like entries (not supported by exact matching): ${patternLike.join(", ")}`);
+	if (unknownExact.length > 0) detailParts.push(`Unknown command names (not in defaults/allowCommands): ${unknownExact.join(", ")}`);
+	const examples = Array.from(knownCommands).slice(0, 8);
+	findings.push({
+		checkId: "gateway.nodes.deny_commands_ineffective",
+		severity: "warn",
+		title: "Some gateway.nodes.denyCommands entries are ineffective",
+		detail: "gateway.nodes.denyCommands uses exact command-name matching only.\n" + detailParts.map((entry) => `- ${entry}`).join("\n"),
+		remediation: `Use exact command names (for example: ${examples.join(", ")}). If you need broader restrictions, remove risky commands from allowCommands/default workflows.`
+	});
+	return findings;
+}
+function collectMinimalProfileOverrideFindings(cfg) {
+	const findings = [];
+	if (cfg.tools?.profile !== "minimal") return findings;
+	const overrides = (cfg.agents?.list ?? []).filter((entry) => {
+		return Boolean(entry && typeof entry === "object" && typeof entry.id === "string" && entry.tools?.profile && entry.tools.profile !== "minimal");
+	}).map((entry) => `${entry.id}=${entry.tools?.profile}`);
+	if (overrides.length === 0) return findings;
+	findings.push({
+		checkId: "tools.profile_minimal_overridden",
+		severity: "warn",
+		title: "Global tools.profile=minimal is overridden by agent profiles",
+		detail: "Global minimal profile is set, but these agent profiles take precedence:\n" + overrides.map((entry) => `- agents.list.${entry}`).join("\n"),
+		remediation: "Set those agents to `tools.profile=\"minimal\"` (or remove the agent override) if you want minimal tools enforced globally."
+	});
 	return findings;
 }
 function collectModelHygieneFindings(cfg) {
@@ -434,7 +715,7 @@ function collectSmallModelRiskFindings(params) {
 		const agentId = extractAgentIdFromSource(entry.source);
 		const sandboxMode = resolveSandboxConfigForAgent(params.cfg, agentId ?? void 0).mode;
 		const agentTools = agentId && params.cfg.agents?.list ? params.cfg.agents.list.find((agent) => agent?.id === agentId)?.tools : void 0;
-		const policies = resolveToolPolicies({
+		const policies = resolveToolPolicies$1({
 			cfg: params.cfg,
 			agentTools,
 			sandboxMode,
@@ -860,6 +1141,68 @@ function formatCodeSafetyDetails(findings, rootDir) {
 		return `  - [${finding.ruleId}] ${finding.message} (${normalizedPath}:${finding.line})`;
 	}).join("\n");
 }
+function unionAllow(base, extra) {
+	if (!Array.isArray(extra) || extra.length === 0) return base;
+	if (!Array.isArray(base) || base.length === 0) return Array.from(new Set(["*", ...extra]));
+	return Array.from(new Set([...base, ...extra]));
+}
+function pickToolPolicy(config) {
+	if (!config) return;
+	const allow = Array.isArray(config.allow) ? unionAllow(config.allow, config.alsoAllow) : Array.isArray(config.alsoAllow) && config.alsoAllow.length > 0 ? unionAllow(void 0, config.alsoAllow) : void 0;
+	const deny = Array.isArray(config.deny) ? config.deny : void 0;
+	if (!allow && !deny) return;
+	return {
+		allow,
+		deny
+	};
+}
+function resolveToolPolicies(params) {
+	const policies = [
+		resolveToolProfilePolicy(params.agentTools?.profile ?? params.cfg.tools?.profile),
+		pickToolPolicy(params.cfg.tools ?? void 0),
+		pickToolPolicy(params.agentTools)
+	];
+	if (params.sandboxMode === "all") policies.push(resolveSandboxToolPolicyForAgent(params.cfg, params.agentId ?? void 0));
+	return policies;
+}
+function normalizePluginIdSet(entries) {
+	return new Set(entries.map((entry) => entry.trim().toLowerCase()).filter(Boolean));
+}
+function resolveEnabledExtensionPluginIds(params) {
+	const normalized = normalizePluginsConfig(params.cfg.plugins);
+	if (!normalized.enabled) return [];
+	const allowSet = normalizePluginIdSet(normalized.allow);
+	const denySet = normalizePluginIdSet(normalized.deny);
+	const entryById = /* @__PURE__ */ new Map();
+	for (const [id, entry] of Object.entries(normalized.entries)) entryById.set(id.trim().toLowerCase(), entry);
+	const enabled = [];
+	for (const id of params.pluginDirs) {
+		const normalizedId = id.trim().toLowerCase();
+		if (!normalizedId) continue;
+		if (denySet.has(normalizedId)) continue;
+		if (allowSet.size > 0 && !allowSet.has(normalizedId)) continue;
+		if (entryById.get(normalizedId)?.enabled === false) continue;
+		enabled.push(normalizedId);
+	}
+	return enabled;
+}
+function collectAllowEntries(config) {
+	const out = [];
+	if (Array.isArray(config?.allow)) out.push(...config.allow);
+	if (Array.isArray(config?.alsoAllow)) out.push(...config.alsoAllow);
+	return out.map((entry) => entry.trim().toLowerCase()).filter(Boolean);
+}
+function hasExplicitPluginAllow(params) {
+	return params.allowEntries.some((entry) => entry === "group:plugins" || params.enabledPluginIds.has(entry));
+}
+function hasProviderPluginAllow(params) {
+	if (!params.byProvider) return false;
+	for (const policy of Object.values(params.byProvider)) if (hasExplicitPluginAllow({
+		allowEntries: collectAllowEntries(policy),
+		enabledPluginIds: params.enabledPluginIds
+	})) return true;
+	return false;
+}
 async function collectPluginsTrustFindings(params) {
 	const findings = [];
 	const extensionsDir = path.join(params.stateDir, "extensions");
@@ -895,6 +1238,55 @@ async function collectPluginsTrustFindings(params) {
 			remediation: "Set plugins.allow to an explicit list of plugin ids you trust."
 		});
 	}
+	const enabledExtensionPluginIds = resolveEnabledExtensionPluginIds({
+		cfg: params.cfg,
+		pluginDirs
+	});
+	if (enabledExtensionPluginIds.length > 0) {
+		const enabledPluginSet = new Set(enabledExtensionPluginIds);
+		const contexts = [{ label: "default" }];
+		for (const entry of params.cfg.agents?.list ?? []) {
+			if (!entry || typeof entry !== "object" || typeof entry.id !== "string") continue;
+			contexts.push({
+				label: `agents.list.${entry.id}`,
+				agentId: entry.id,
+				tools: entry.tools
+			});
+		}
+		const permissiveContexts = [];
+		for (const context of contexts) {
+			const profile = context.tools?.profile ?? params.cfg.tools?.profile;
+			const restrictiveProfile = Boolean(resolveToolProfilePolicy(profile));
+			const sandboxMode = resolveSandboxConfigForAgent(params.cfg, context.agentId).mode;
+			const broadPolicy = isToolAllowedByPolicies("__openclaw_plugin_probe__", resolveToolPolicies({
+				cfg: params.cfg,
+				agentTools: context.tools,
+				sandboxMode,
+				agentId: context.agentId
+			}));
+			const explicitPluginAllow = !restrictiveProfile && (hasExplicitPluginAllow({
+				allowEntries: collectAllowEntries(params.cfg.tools),
+				enabledPluginIds: enabledPluginSet
+			}) || hasProviderPluginAllow({
+				byProvider: params.cfg.tools?.byProvider,
+				enabledPluginIds: enabledPluginSet
+			}) || hasExplicitPluginAllow({
+				allowEntries: collectAllowEntries(context.tools),
+				enabledPluginIds: enabledPluginSet
+			}) || hasProviderPluginAllow({
+				byProvider: context.tools?.byProvider,
+				enabledPluginIds: enabledPluginSet
+			}));
+			if (broadPolicy || explicitPluginAllow) permissiveContexts.push(context.label);
+		}
+		if (permissiveContexts.length > 0) findings.push({
+			checkId: "plugins.tools_reachable_permissive_policy",
+			severity: "warn",
+			title: "Extension plugin tools may be reachable under permissive tool policy",
+			detail: `Enabled extension plugins: ${enabledExtensionPluginIds.join(", ")}.\nPermissive tool policy contexts:\n${permissiveContexts.map((entry) => `- ${entry}`).join("\n")}`,
+			remediation: "Use restrictive profiles (`minimal`/`coding`) or explicit tool allowlists that exclude plugin tools for agents handling untrusted input."
+		});
+	}
 	return findings;
 }
 async function collectIncludeFilePermFindings(params) {
@@ -1361,6 +1753,7 @@ function collectGatewayConfigFindings(cfg, env) {
 	const hasSharedSecret = auth.mode === "token" && hasToken || auth.mode === "password" && hasPassword;
 	const hasTailscaleAuth = auth.allowTailscale && tailscaleMode === "serve";
 	const hasGatewayAuth = hasSharedSecret || hasTailscaleAuth;
+	const remotelyExposed = bind !== "loopback" || tailscaleMode === "serve" || tailscaleMode === "funnel";
 	if (bind !== "loopback" && !hasSharedSecret) findings.push({
 		checkId: "gateway.bind_no_auth",
 		severity: "critical",
@@ -1416,9 +1809,28 @@ function collectGatewayConfigFindings(cfg, env) {
 		title: "Gateway token looks short",
 		detail: `gateway auth token is ${token.length} chars; prefer a long random token.`
 	});
+	const chatCompletionsEnabled = cfg.gateway?.http?.endpoints?.chatCompletions?.enabled === true;
+	const responsesEnabled = cfg.gateway?.http?.endpoints?.responses?.enabled === true;
+	if (chatCompletionsEnabled || responsesEnabled) {
+		const enabledEndpoints = [chatCompletionsEnabled ? "/v1/chat/completions" : null, responsesEnabled ? "/v1/responses" : null].filter((value) => Boolean(value));
+		findings.push({
+			checkId: "gateway.http.session_key_override_enabled",
+			severity: remotelyExposed ? "warn" : "info",
+			title: "HTTP APIs accept explicit session key override headers",
+			detail: `${enabledEndpoints.join(", ")} support x-openclaw-session-key. Any authenticated caller can route requests into arbitrary sessions.`,
+			remediation: "Treat HTTP API credentials as full-trust, disable unused endpoints, and avoid sharing tokens across tenants."
+		});
+	}
+	if (bind !== "loopback" && !cfg.gateway?.auth?.rateLimit) findings.push({
+		checkId: "gateway.auth_no_rate_limit",
+		severity: "warn",
+		title: "No auth rate limiting configured",
+		detail: "gateway.bind is not loopback but no gateway.auth.rateLimit is configured. Without rate limiting, brute-force auth attacks are not mitigated.",
+		remediation: "Set gateway.auth.rateLimit (e.g. { maxAttempts: 10, windowMs: 60000, lockoutMs: 300000 })."
+	});
 	return findings;
 }
-function collectBrowserControlFindings(cfg) {
+function collectBrowserControlFindings(cfg, env) {
 	const findings = [];
 	let resolved;
 	try {
@@ -1434,6 +1846,14 @@ function collectBrowserControlFindings(cfg) {
 		return findings;
 	}
 	if (!resolved.enabled) return findings;
+	const browserAuth = resolveBrowserControlAuth(cfg, env);
+	if (!browserAuth.token && !browserAuth.password) findings.push({
+		checkId: "browser.control_no_auth",
+		severity: "critical",
+		title: "Browser control has no auth",
+		detail: "Browser control HTTP routes are enabled but no gateway.auth token/password is configured. Any local process (or SSRF to loopback) can call browser control endpoints.",
+		remediation: "Set gateway.auth.token (recommended) or gateway.auth.password so browser control HTTP routes require authentication. Restarting the gateway will auto-generate gateway.auth.token when browser control is enabled."
+	});
 	for (const name of Object.keys(resolved.profiles)) {
 		const profile = resolveProfile(resolved, name);
 		if (!profile || profile.cdpIsLoopback) continue;
@@ -1535,7 +1955,7 @@ async function collectChannelSecurityFindings(params) {
 			severity: "warn",
 			title: `${input.label} DMs share the main session`,
 			detail: "Multiple DM senders currently share the main session, which can leak context across users.",
-			remediation: "Set session.dmScope=\"per-channel-peer\" (or \"per-account-channel-peer\" for multi-account channels) to isolate DM sessions per sender."
+			remediation: "Run: " + formatCliCommand("openclaw config set session.dmScope \"per-channel-peer\"") + " (or \"per-account-channel-peer\" for multi-account channels) to isolate DM sessions per sender."
 		});
 	};
 	for (const plugin of params.plugins) {
@@ -1778,10 +2198,13 @@ async function runSecurityAudit(opts) {
 		configPath
 	}));
 	findings.push(...collectGatewayConfigFindings(cfg, env));
-	findings.push(...collectBrowserControlFindings(cfg));
+	findings.push(...collectBrowserControlFindings(cfg, env));
 	findings.push(...collectLoggingFindings(cfg));
 	findings.push(...collectElevatedFindings(cfg));
 	findings.push(...collectHooksHardeningFindings(cfg));
+	findings.push(...collectSandboxDockerNoopFindings(cfg));
+	findings.push(...collectNodeDenyCommandPatternFindings(cfg));
+	findings.push(...collectMinimalProfileOverrideFindings(cfg));
 	findings.push(...collectSecretsInConfigFindings(cfg));
 	findings.push(...collectModelHygieneFindings(cfg));
 	findings.push(...collectSmallModelRiskFindings({
@@ -1855,4 +2278,4 @@ async function runSecurityAudit(opts) {
 }
 
 //#endregion
-export { probeGateway as i, createIcaclsResetCommand as n, formatIcaclsResetCommand as r, runSecurityAudit as t };
+export { resolveNodeCommandAllowlist as a, isNodeCommandAllowed as i, createIcaclsResetCommand as n, probeGateway as o, formatIcaclsResetCommand as r, runSecurityAudit as t };