@openclaw-cloud/agent-controller 3.1.0 → 3.1.1

package/dist/utils/write-workspace-files.js

@@ -17,32 +17,49 @@ import path from 'node:path';
 export async function writeWorkspaceFiles(files, workspaceDir) {
     const fileNames = Object.keys(files);
     if (fileNames.length === 0)
-        return;
+        return 0;
     await fs.mkdir(workspaceDir, { recursive: true });
+    const written = [];
     for (const [filePath, content] of Object.entries(files)) {
+        // Reject any key that escapes the workspace. The file_write handler applies
+        // the same sandbox; writeWorkspaceFiles previously had no guard, so a
+        // backend-supplied key like "../../etc/openclaw/agent.env" or an absolute
+        // path could write outside the workspace.
         const fullPath = path.join(workspaceDir, filePath);
+        const rel = path.relative(workspaceDir, fullPath);
+        // Segment-aware containment: reject absolute keys and real ".." traversal,
+        // but allow filenames that merely contain ".." (e.g. "notes..v2.md").
+        if (path.isAbsolute(filePath) ||
+            rel === '..' ||
+            rel.startsWith('..' + path.sep) ||
+            path.isAbsolute(rel)) {
+            console.error(`  ✗ ${filePath}: rejected (path escapes workspace)`);
+            continue;
+        }
         await fs.mkdir(path.dirname(fullPath), { recursive: true });
         try {
             await fs.writeFile(fullPath, content);
+            written.push(filePath);
             console.log(`  ✓ ${filePath}`);
         }
         catch (err) {
             console.error(`  ✗ ${filePath}: ${err instanceof Error ? err.message : err}`);
         }
     }
-    // Make .sh files executable
-    for (const filePath of fileNames) {
+    // Make .sh files executable (only the ones we actually wrote)
+    for (const filePath of written) {
         if (filePath.endsWith('.sh')) {
             const fullPath = path.join(workspaceDir, filePath);
             await fs.chmod(fullPath, 0o755);
         }
     }
     // Summary for deployed skills (under .agents/skills/<name>/...)
-    const skillFiles = fileNames.filter((f) => f.startsWith('.agents/skills/'));
+    const skillFiles = written.filter((f) => f.startsWith('.agents/skills/'));
     if (skillFiles.length > 0) {
         const skills = [...new Set(skillFiles.map((f) => f.split('/')[2]))];
         console.log(`  ✓ skills deployed: ${skills.join(', ')}`);
     }
-    console.log(`  wrote ${fileNames.length} workspace files`);
+    console.log(`  wrote ${written.length} workspace files`);
+    return written.length;
 }
 //# sourceMappingURL=write-workspace-files.js.map

package/dist/utils/write-workspace-files.js.map

@@ -1 +1 @@
-{"version":3,"file":"write-workspace-files.js","sourceRoot":"","sources":["../../src/utils/write-workspace-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA6B,EAC7B,YAAoB;IAEpB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEnC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAElD,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YACnD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC5E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,SAAS,CAAC,MAAM,kBAAkB,CAAC,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"write-workspace-files.js","sourceRoot":"","sources":["../../src/utils/write-workspace-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAA6B,EAC7B,YAAoB;IAEpB,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IAErC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAElD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,4EAA4E;QAC5E,sEAAsE;QACtE,0EAA0E;QAC1E,0CAA0C;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAClD,2EAA2E;QAC3E,sEAAsE;QACtE,IACE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YACzB,GAAG,KAAK,IAAI;YACZ,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;YAC/B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EACpB,CAAC;YACD,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,qCAAqC,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,OAAO,QAAQ,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YACnD,MAAM,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,gEAAgE;IAChE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAC1E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,wBAAwB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,MAAM,kBAAkB,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,MAAM,CAAC;AACxB,CAAC"}

package/package.json

@@ -1,17 +1,21 @@
 {
   "name": "@openclaw-cloud/agent-controller",
-  "version": "3.1.0",
+  "version": "3.1.1",
+  "packageManager": "pnpm@11.5.2",
   "type": "module",
+  "engines": {
+    "node": ">=22"
+  },
   "main": "dist/index.js",
   "bin": {
     "agent-controller": "bin/agent-controller.js"
   },
   "scripts": {
     "build": "tsc",
-    "prepublishOnly": "npm run build",
-    "test": "node --experimental-vm-modules node_modules/.bin/jest --forceExit",
+    "prepublishOnly": "pnpm run build",
+    "test": "NODE_OPTIONS=--experimental-vm-modules jest --forceExit",
     "start": "node bin/agent-controller.js",
-    "prepare": "[ -d .git ] && husky || true",
+    "prepare": "[ -e .git ] && husky || true",
     "lint": "eslint --fix ./src"
   },
   "files": [
@@ -25,6 +29,7 @@
     "zod": "^4.3.6"
   },
   "devDependencies": {
+    "@jest/globals": "^30.0.0",
     "@semantic-release/git": "^10.0.1",
     "@semantic-release/npm": "^13.1.5",
     "@types/jest": "^30.0.0",