@poolzin/pool-bot 2026.2.25 → 2026.2.26

package/dist/security/audit-channel.js

@@ -8,6 +8,40 @@ import { resolveDmAllowState } from "./dm-policy-shared.js";
 function normalizeAllowFromList(list) {
     return normalizeStringEntries(Array.isArray(list) ? list : undefined);
 }
+const DISCORD_ALLOWLIST_ID_PREFIXES = ["discord:", "user:", "pk:"];
+function isDiscordNameBasedAllowEntry(raw) {
+    const text = String(raw).trim();
+    if (!text || text === "*") {
+        return false;
+    }
+    const maybeId = text.replace(/^<@!?/, "").replace(/>$/, "");
+    if (/^\d+$/.test(maybeId)) {
+        return false;
+    }
+    const prefixed = DISCORD_ALLOWLIST_ID_PREFIXES.find((prefix) => text.startsWith(prefix));
+    if (prefixed) {
+        const candidate = text.slice(prefixed.length);
+        if (candidate) {
+            return false;
+        }
+    }
+    return true;
+}
+function addDiscordNameBasedEntries(params) {
+    if (!Array.isArray(params.values)) {
+        return;
+    }
+    for (const value of params.values) {
+        if (!isDiscordNameBasedAllowEntry(value)) {
+            continue;
+        }
+        const text = String(value).trim();
+        if (!text) {
+            continue;
+        }
+        params.target.add(`${params.source}:${text}`);
+    }
+}
 function classifyChannelWarningSeverity(message) {
     const s = message.toLowerCase();
     if (s.includes("dms: open") ||
@@ -108,6 +142,64 @@ export async function collectChannelSecurityFindings(params) {
         if (plugin.id === "discord") {
             const discordCfg = account?.config ??
                 {};
+            const storeAllowFrom = await readChannelAllowFromStore("discord").catch(() => []);
+            const discordNameBasedAllowEntries = new Set();
+            addDiscordNameBasedEntries({
+                target: discordNameBasedAllowEntries,
+                values: discordCfg.allowFrom,
+                source: "channels.discord.allowFrom",
+            });
+            addDiscordNameBasedEntries({
+                target: discordNameBasedAllowEntries,
+                values: discordCfg.dm?.allowFrom,
+                source: "channels.discord.dm.allowFrom",
+            });
+            addDiscordNameBasedEntries({
+                target: discordNameBasedAllowEntries,
+                values: storeAllowFrom,
+                source: "~/.poolbot/credentials/discord-allowFrom.json",
+            });
+            const discordGuildEntries = discordCfg.guilds ?? {};
+            for (const [guildKey, guildValue] of Object.entries(discordGuildEntries)) {
+                if (!guildValue || typeof guildValue !== "object") {
+                    continue;
+                }
+                const guild = guildValue;
+                addDiscordNameBasedEntries({
+                    target: discordNameBasedAllowEntries,
+                    values: guild.users,
+                    source: `channels.discord.guilds.${guildKey}.users`,
+                });
+                const channels = guild.channels;
+                if (!channels || typeof channels !== "object") {
+                    continue;
+                }
+                for (const [channelKey, channelValue] of Object.entries(channels)) {
+                    if (!channelValue || typeof channelValue !== "object") {
+                        continue;
+                    }
+                    const channel = channelValue;
+                    addDiscordNameBasedEntries({
+                        target: discordNameBasedAllowEntries,
+                        values: channel.users,
+                        source: `channels.discord.guilds.${guildKey}.channels.${channelKey}.users`,
+                    });
+                }
+            }
+            if (discordNameBasedAllowEntries.size > 0) {
+                const examples = Array.from(discordNameBasedAllowEntries).slice(0, 5);
+                const more = discordNameBasedAllowEntries.size > examples.length
+                    ? ` (+${discordNameBasedAllowEntries.size - examples.length} more)`
+                    : "";
+                findings.push({
+                    checkId: "channels.discord.allowFrom.name_based_entries",
+                    severity: "warn",
+                    title: "Discord allowlist contains name or tag entries",
+                    detail: "Discord name/tag allowlist matching uses normalized slugs and can collide across users. " +
+                        `Found: ${examples.join(", ")}${more}.`,
+                    remediation: "Prefer stable Discord IDs (or <@id>/user:<id>/pk:<id>) in channels.discord.allowFrom and channels.discord.guilds.*.users.",
+                });
+            }
             const nativeEnabled = resolveNativeCommandsEnabled({
                 providerId: "discord",
                 providerSetting: coerceNativeSetting(discordCfg.commands?.native),
@@ -122,7 +214,7 @@ export async function collectChannelSecurityFindings(params) {
             if (slashEnabled) {
                 const defaultGroupPolicy = params.cfg.channels?.defaults?.groupPolicy;
                 const groupPolicy = discordCfg.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
-                const guildEntries = discordCfg.guilds ?? {};
+                const guildEntries = discordGuildEntries;
                 const guildsConfigured = Object.keys(guildEntries).length > 0;
                 const hasAnyUserAllowlist = Object.values(guildEntries).some((guild) => {
                     if (!guild || typeof guild !== "object") {
@@ -146,7 +238,6 @@ export async function collectChannelSecurityFindings(params) {
                 });
                 const dmAllowFromRaw = discordCfg.dm?.allowFrom;
                 const dmAllowFrom = Array.isArray(dmAllowFromRaw) ? dmAllowFromRaw : [];
-                const storeAllowFrom = await readChannelAllowFromStore("discord").catch(() => []);
                 const ownerAllowFromConfigured = normalizeAllowFromList([...dmAllowFrom, ...storeAllowFrom]).length > 0;
                 const useAccessGroups = params.cfg.commands?.useAccessGroups !== false;
                 if (!useAccessGroups &&

package/dist/security/audit-extra.async.js

@@ -8,9 +8,12 @@ import path from "node:path";
 import { resolveDefaultAgentId } from "../agents/agent-scope.js";
 import { isToolAllowedByPolicies } from "../agents/pi-tools.policy.js";
 import { resolveSandboxConfigForAgent, resolveSandboxToolPolicyForAgent, } from "../agents/sandbox.js";
+import { SANDBOX_BROWSER_SECURITY_HASH_EPOCH } from "../agents/sandbox/constants.js";
+import { execDockerRaw } from "../agents/sandbox/docker.js";
 import { loadWorkspaceSkillEntries } from "../agents/skills.js";
 import { resolveToolProfilePolicy } from "../agents/tool-policy.js";
 import { listAgentWorkspaceDirs } from "../agents/workspace-dirs.js";
+import { formatCliCommand } from "../cli/command-format.js";
 import { MANIFEST_KEY } from "../compat/legacy-names.js";
 import { resolveNativeSkillsEnabled } from "../config/commands.js";
 import { createConfigIO } from "../config/config.js";
@@ -180,6 +183,157 @@ async function readInstalledPackageVersion(dir) {
 // --------------------------------------------------------------------------
 // Exported collectors
 // --------------------------------------------------------------------------
+function normalizeDockerLabelValue(raw) {
+    const trimmed = raw?.trim() ?? "";
+    if (!trimmed || trimmed === "<no value>") {
+        return null;
+    }
+    return trimmed;
+}
+async function listSandboxBrowserContainers(execDockerRawFn) {
+    try {
+        const result = await execDockerRawFn(["ps", "-a", "--filter", "label=poolbot.sandboxBrowser=1", "--format", "{{.Names}}"], { allowFailure: true });
+        if (result.code !== 0) {
+            return null;
+        }
+        return result.stdout
+            .toString("utf8")
+            .split(/\r?\n/)
+            .map((entry) => entry.trim())
+            .filter(Boolean);
+    }
+    catch {
+        return null;
+    }
+}
+async function readSandboxBrowserHashLabels(params) {
+    try {
+        const result = await params.execDockerRawFn([
+            "inspect",
+            "-f",
+            '{{ index .Config.Labels "poolbot.configHash" }}\t{{ index .Config.Labels "poolbot.browserConfigEpoch" }}',
+            params.containerName,
+        ], { allowFailure: true });
+        if (result.code !== 0) {
+            return null;
+        }
+        const [hashRaw, epochRaw] = result.stdout.toString("utf8").split("\t");
+        return {
+            configHash: normalizeDockerLabelValue(hashRaw),
+            epoch: normalizeDockerLabelValue(epochRaw),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+function parsePublishedHostFromDockerPortLine(line) {
+    const trimmed = line.trim();
+    const rhs = trimmed.includes("->") ? (trimmed.split("->").at(-1)?.trim() ?? "") : trimmed;
+    if (!rhs) {
+        return null;
+    }
+    const bracketHost = rhs.match(/^\[([^\]]+)\]:\d+$/);
+    if (bracketHost?.[1]) {
+        return bracketHost[1];
+    }
+    const hostPort = rhs.match(/^([^:]+):\d+$/);
+    if (hostPort?.[1]) {
+        return hostPort[1];
+    }
+    return null;
+}
+function isLoopbackPublishHost(host) {
+    const normalized = host.trim().toLowerCase();
+    return normalized === "127.0.0.1" || normalized === "::1" || normalized === "localhost";
+}
+async function readSandboxBrowserPortMappings(params) {
+    try {
+        const result = await params.execDockerRawFn(["port", params.containerName], {
+            allowFailure: true,
+        });
+        if (result.code !== 0) {
+            return null;
+        }
+        return result.stdout
+            .toString("utf8")
+            .split(/\r?\n/)
+            .map((entry) => entry.trim())
+            .filter(Boolean);
+    }
+    catch {
+        return null;
+    }
+}
+export async function collectSandboxBrowserHashLabelFindings(params) {
+    const findings = [];
+    const execFn = params?.execDockerRawFn ?? execDockerRaw;
+    const containers = await listSandboxBrowserContainers(execFn);
+    if (!containers || containers.length === 0) {
+        return findings;
+    }
+    const missingHash = [];
+    const staleEpoch = [];
+    const nonLoopbackPublished = [];
+    for (const containerName of containers) {
+        const labels = await readSandboxBrowserHashLabels({ containerName, execDockerRawFn: execFn });
+        if (!labels) {
+            continue;
+        }
+        if (!labels.configHash) {
+            missingHash.push(containerName);
+        }
+        if (labels.epoch !== SANDBOX_BROWSER_SECURITY_HASH_EPOCH) {
+            staleEpoch.push(containerName);
+        }
+        const portMappings = await readSandboxBrowserPortMappings({
+            containerName,
+            execDockerRawFn: execFn,
+        });
+        if (!portMappings?.length) {
+            continue;
+        }
+        const exposedMappings = portMappings.filter((line) => {
+            const host = parsePublishedHostFromDockerPortLine(line);
+            return Boolean(host && !isLoopbackPublishHost(host));
+        });
+        if (exposedMappings.length > 0) {
+            nonLoopbackPublished.push(`${containerName} (${exposedMappings.join("; ")})`);
+        }
+    }
+    if (missingHash.length > 0) {
+        findings.push({
+            checkId: "sandbox.browser_container.hash_label_missing",
+            severity: "warn",
+            title: "Sandbox browser container missing config hash label",
+            detail: `Containers: ${missingHash.join(", ")}. ` +
+                "These browser containers predate hash-based drift checks and may miss security remediations until recreated.",
+            remediation: `${formatCliCommand("poolbot sandbox recreate --browser --all")} (add --force to skip prompt).`,
+        });
+    }
+    if (staleEpoch.length > 0) {
+        findings.push({
+            checkId: "sandbox.browser_container.hash_epoch_stale",
+            severity: "warn",
+            title: "Sandbox browser container hash epoch is stale",
+            detail: `Containers: ${staleEpoch.join(", ")}. ` +
+                `Expected poolbot.browserConfigEpoch=${SANDBOX_BROWSER_SECURITY_HASH_EPOCH}.`,
+            remediation: `${formatCliCommand("poolbot sandbox recreate --browser --all")} (add --force to skip prompt).`,
+        });
+    }
+    if (nonLoopbackPublished.length > 0) {
+        findings.push({
+            checkId: "sandbox.browser_container.non_loopback_publish",
+            severity: "critical",
+            title: "Sandbox browser container publishes ports on non-loopback interfaces",
+            detail: `Containers: ${nonLoopbackPublished.join(", ")}. ` +
+                "Sandbox browser observer/control ports should stay loopback-only to avoid unintended remote access.",
+            remediation: `${formatCliCommand("poolbot sandbox recreate --browser --all")} (add --force to skip prompt), ` +
+                "then verify published ports are bound to 127.0.0.1.",
+        });
+    }
+    return findings;
+}
 export async function collectPluginsTrustFindings(params) {
     const findings = [];
     const { extensionsDir, pluginDirs } = await listInstalledPluginDirs({
@@ -265,7 +419,7 @@ export async function collectPluginsTrustFindings(params) {
                     sandboxMode,
                     agentId: context.agentId,
                 });
-                const broadPolicy = isToolAllowedByPolicies("__openclaw_plugin_probe__", policies);
+                const broadPolicy = isToolAllowedByPolicies("__poolbot_plugin_probe__", policies);
                 const explicitPluginAllow = !restrictiveProfile &&
                     (hasExplicitPluginAllow({
                         allowEntries: collectAllowEntries(params.cfg.tools),
@@ -346,7 +500,7 @@ export async function collectPluginsTrustFindings(params) {
                 severity: "warn",
                 title: "Plugin install records drift from installed package versions",
                 detail: `Detected plugin install metadata drift:\n${pluginVersionDrift.map((entry) => `- ${entry}`).join("\n")}`,
-                remediation: "Run `openclaw plugins update --all` (or reinstall affected plugins) to refresh install metadata.",
+                remediation: "Run `poolbot plugins update --all` (or reinstall affected plugins) to refresh install metadata.",
             });
         }
     }
@@ -397,7 +551,7 @@ export async function collectPluginsTrustFindings(params) {
                 severity: "warn",
                 title: "Hook install records drift from installed package versions",
                 detail: `Detected hook install metadata drift:\n${hookVersionDrift.map((entry) => `- ${entry}`).join("\n")}`,
-                remediation: "Run `openclaw hooks update --all` (or reinstall affected hooks) to refresh install metadata.",
+                remediation: "Run `poolbot hooks update --all` (or reinstall affected hooks) to refresh install metadata.",
             });
         }
     }
@@ -666,7 +820,7 @@ export async function collectPluginsCodeSafetyFindings(params) {
                 severity: "critical",
                 title: `Plugin "${pluginName}" has extension entry path traversal`,
                 detail: `Found extension entries that escape the plugin directory:\n${escapedEntries.map((entry) => `  - ${entry}`).join("\n")}`,
-                remediation: "Update the plugin manifest so all openclaw.extensions entries stay inside the plugin directory.",
+                remediation: "Update the plugin manifest so all poolbot.extensions entries stay inside the plugin directory.",
             });
         }
         const summary = await skillScanner
@@ -694,7 +848,7 @@ export async function collectPluginsCodeSafetyFindings(params) {
                 severity: "critical",
                 title: `Plugin "${pluginName}" contains dangerous code patterns`,
                 detail: `Found ${summary.critical} critical issue(s) in ${summary.scannedFiles} scanned file(s):\n${details}`,
-                remediation: "Review the plugin source code carefully before use. If untrusted, remove the plugin from your OpenClaw extensions state directory.",
+                remediation: "Review the plugin source code carefully before use. If untrusted, remove the plugin from your Pool Bot extensions state directory.",
             });
         }
         else if (summary.warn > 0) {

package/dist/security/audit-extra.js

@@ -9,4 +9,4 @@
 // Sync collectors
 export { collectAttackSurfaceSummaryFindings, collectExposureMatrixFindings, collectGatewayHttpNoAuthFindings, collectGatewayHttpSessionKeyOverrideFindings, collectHooksHardeningFindings, collectMinimalProfileOverrideFindings, collectModelHygieneFindings, collectNodeDenyCommandPatternFindings, collectSandboxDangerousConfigFindings, collectSandboxDockerNoopFindings, collectSecretsInConfigFindings, collectSmallModelRiskFindings, collectSyncedFolderFindings, } from "./audit-extra.sync.js";
 // Async collectors
-export { collectIncludeFilePermFindings, collectInstalledSkillsCodeSafetyFindings, collectPluginsCodeSafetyFindings, collectPluginsTrustFindings, collectStateDeepFilesystemFindings, readConfigSnapshotForAudit, } from "./audit-extra.async.js";
+export { collectSandboxBrowserHashLabelFindings, collectIncludeFilePermFindings, collectInstalledSkillsCodeSafetyFindings, collectPluginsCodeSafetyFindings, collectPluginsTrustFindings, collectStateDeepFilesystemFindings, readConfigSnapshotForAudit, } from "./audit-extra.async.js";

package/dist/security/audit-extra.sync.js

@@ -290,7 +290,7 @@ export function collectSyncedFolderFindings(params) {
             severity: "warn",
             title: "State/config path looks like a synced folder",
             detail: `stateDir=${params.stateDir}, configPath=${params.configPath}. Synced folders (iCloud/Dropbox/OneDrive/Google Drive) can leak tokens and transcripts onto other devices.`,
-            remediation: `Keep CLAWDBOT_STATE_DIR on a local-only volume and re-run "${formatCliCommand("poolbot security audit --fix")}".`,
+            remediation: `Keep POOLBOT_STATE_DIR on a local-only volume and re-run "${formatCliCommand("poolbot security audit --fix")}".`,
         });
     }
     return findings;
@@ -337,20 +337,20 @@ export function collectHooksHardeningFindings(cfg, env = process.env) {
         tailscaleMode: cfg.gateway?.tailscale?.mode ?? "off",
         env,
     });
-    const envGatewayToken = typeof env.CLAWDBOT_GATEWAY_TOKEN === "string" && env.CLAWDBOT_GATEWAY_TOKEN.trim()
-        ? env.CLAWDBOT_GATEWAY_TOKEN.trim()
+    const poolbotGatewayToken = typeof env.POOLBOT_GATEWAY_TOKEN === "string" && env.POOLBOT_GATEWAY_TOKEN.trim()
+        ? env.POOLBOT_GATEWAY_TOKEN.trim()
         : null;
     const gatewayToken = gatewayAuth.mode === "token" &&
         typeof gatewayAuth.token === "string" &&
         gatewayAuth.token.trim()
         ? gatewayAuth.token.trim()
-        : envGatewayToken
-            ? envGatewayToken
+        : poolbotGatewayToken
+            ? poolbotGatewayToken
             : null;
     if (token && gatewayToken && token === gatewayToken) {
         findings.push({
             checkId: "hooks.token_reuse_gateway_token",
-            severity: "warn",
+            severity: "critical",
             title: "Hooks token reuses the Gateway token",
             detail: "hooks.token matches gateway.auth token; compromise of hooks expands blast radius to the Gateway API.",
             remediation: "Use a separate hooks.token dedicated to hook ingress.",
@@ -573,6 +573,40 @@ export function collectSandboxDangerousConfigFindings(cfg) {
             });
         }
     }
+    const browserExposurePaths = [];
+    const defaultBrowser = resolveSandboxConfigForAgent(cfg).browser;
+    if (defaultBrowser.enabled &&
+        defaultBrowser.network.trim().toLowerCase() === "bridge" &&
+        !defaultBrowser.cdpSourceRange?.trim()) {
+        browserExposurePaths.push("agents.defaults.sandbox.browser");
+    }
+    for (const entry of agents) {
+        if (!entry || typeof entry !== "object" || typeof entry.id !== "string") {
+            continue;
+        }
+        const browser = resolveSandboxConfigForAgent(cfg, entry.id).browser;
+        if (!browser.enabled) {
+            continue;
+        }
+        if (browser.network.trim().toLowerCase() !== "bridge") {
+            continue;
+        }
+        if (browser.cdpSourceRange?.trim()) {
+            continue;
+        }
+        browserExposurePaths.push(`agents.list.${entry.id}.sandbox.browser`);
+    }
+    if (browserExposurePaths.length > 0) {
+        findings.push({
+            checkId: "sandbox.browser_cdp_bridge_unrestricted",
+            severity: "warn",
+            title: "Sandbox browser CDP may be reachable by peer containers",
+            detail: "These sandbox browser configs use Docker bridge networking with no CDP source restriction:\n" +
+                browserExposurePaths.map((entry) => `- ${entry}`).join("\n"),
+            remediation: "Set sandbox.browser.network to a dedicated bridge network (recommended default: poolbot-sandbox-browser), " +
+                "or set sandbox.browser.cdpSourceRange (for example 172.21.0.1/32) to restrict container-edge CDP ingress.",
+        });
+    }
     return findings;
 }
 export function collectNodeDenyCommandPatternFindings(cfg) {
@@ -808,5 +842,50 @@ export function collectExposureMatrixFindings(cfg) {
             remediation: `Set groupPolicy="allowlist" and keep elevated allowlists extremely tight.`,
         });
     }
+    const contexts = [{ label: "agents.defaults" }];
+    for (const agent of cfg.agents?.list ?? []) {
+        if (!agent || typeof agent !== "object" || typeof agent.id !== "string") {
+            continue;
+        }
+        contexts.push({
+            label: `agents.list.${agent.id}`,
+            agentId: agent.id,
+            tools: agent.tools,
+        });
+    }
+    const riskyContexts = [];
+    let hasRuntimeRisk = false;
+    for (const context of contexts) {
+        const sandboxMode = resolveSandboxConfigForAgent(cfg, context.agentId).mode;
+        const policies = resolveToolPolicies({
+            cfg,
+            agentTools: context.tools,
+            sandboxMode,
+            agentId: context.agentId ?? null,
+        });
+        const runtimeTools = ["exec", "process"].filter((tool) => isToolAllowedByPolicies(tool, policies));
+        const fsTools = ["read", "write", "edit", "apply_patch"].filter((tool) => isToolAllowedByPolicies(tool, policies));
+        const fsWorkspaceOnly = context.tools?.fs?.workspaceOnly ?? cfg.tools?.fs?.workspaceOnly;
+        const runtimeUnguarded = runtimeTools.length > 0 && sandboxMode !== "all";
+        const fsUnguarded = fsTools.length > 0 && sandboxMode !== "all" && fsWorkspaceOnly !== true;
+        if (!runtimeUnguarded && !fsUnguarded) {
+            continue;
+        }
+        if (runtimeUnguarded) {
+            hasRuntimeRisk = true;
+        }
+        riskyContexts.push(`${context.label} (sandbox=${sandboxMode}; runtime=[${runtimeTools.join(", ") || "off"}]; fs=[${fsTools.join(", ") || "off"}]; fs.workspaceOnly=${fsWorkspaceOnly === true ? "true" : "false"})`);
+    }
+    if (riskyContexts.length > 0) {
+        findings.push({
+            checkId: "security.exposure.open_groups_with_runtime_or_fs",
+            severity: hasRuntimeRisk ? "critical" : "warn",
+            title: "Open groupPolicy with runtime/filesystem tools exposed",
+            detail: `Found groupPolicy="open" at:\n${openGroups.map((p) => `- ${p}`).join("\n")}\n` +
+                `Risky tool exposure contexts:\n${riskyContexts.map((line) => `- ${line}`).join("\n")}\n` +
+                "Prompt injection in open groups can trigger command/file actions in these contexts.",
+            remediation: 'For open groups, prefer tools.profile="messaging" (or deny group:runtime/group:fs), set tools.fs.workspaceOnly=true, and use agents.defaults.sandbox.mode="all" for exposed agents.',
+        });
+    }
     return findings;
 }

package/dist/security/audit.js

@@ -9,7 +9,7 @@ import { buildGatewayConnectionDetails } from "../gateway/call.js";
 import { resolveGatewayProbeAuth } from "../gateway/probe-auth.js";
 import { probeGateway } from "../gateway/probe.js";
 import { collectChannelSecurityFindings } from "./audit-channel.js";
-import { collectAttackSurfaceSummaryFindings, collectExposureMatrixFindings, collectGatewayHttpNoAuthFindings, collectGatewayHttpSessionKeyOverrideFindings, collectHooksHardeningFindings, collectIncludeFilePermFindings, collectInstalledSkillsCodeSafetyFindings, collectMinimalProfileOverrideFindings, collectModelHygieneFindings, collectNodeDenyCommandPatternFindings, collectSmallModelRiskFindings, collectSandboxDangerousConfigFindings, collectSandboxDockerNoopFindings, collectPluginsTrustFindings, collectSecretsInConfigFindings, collectPluginsCodeSafetyFindings, collectStateDeepFilesystemFindings, collectSyncedFolderFindings, readConfigSnapshotForAudit, } from "./audit-extra.js";
+import { collectAttackSurfaceSummaryFindings, collectExposureMatrixFindings, collectGatewayHttpNoAuthFindings, collectGatewayHttpSessionKeyOverrideFindings, collectHooksHardeningFindings, collectIncludeFilePermFindings, collectInstalledSkillsCodeSafetyFindings, collectSandboxBrowserHashLabelFindings, collectMinimalProfileOverrideFindings, collectModelHygieneFindings, collectNodeDenyCommandPatternFindings, collectSmallModelRiskFindings, collectSandboxDangerousConfigFindings, collectSandboxDockerNoopFindings, collectPluginsTrustFindings, collectSecretsInConfigFindings, collectPluginsCodeSafetyFindings, collectStateDeepFilesystemFindings, collectSyncedFolderFindings, readConfigSnapshotForAudit, } from "./audit-extra.js";
 import { formatPermissionDetail, formatPermissionRemediation, inspectPathPermissions, } from "./audit-fs.js";
 import { DEFAULT_GATEWAY_HTTP_TOOL_DENY } from "./dangerous-tools.js";
 function countBySeverity(findings) {
@@ -35,6 +35,29 @@ function normalizeAllowFromList(list) {
     }
     return list.map((v) => String(v).trim()).filter(Boolean);
 }
+function collectEnabledInsecureOrDangerousFlags(cfg) {
+    const enabledFlags = [];
+    if (cfg.gateway?.controlUi?.allowInsecureAuth === true) {
+        enabledFlags.push("gateway.controlUi.allowInsecureAuth=true");
+    }
+    if (cfg.gateway?.controlUi?.dangerouslyDisableDeviceAuth === true) {
+        enabledFlags.push("gateway.controlUi.dangerouslyDisableDeviceAuth=true");
+    }
+    if (cfg.hooks?.gmail?.allowUnsafeExternalContent === true) {
+        enabledFlags.push("hooks.gmail.allowUnsafeExternalContent=true");
+    }
+    if (Array.isArray(cfg.hooks?.mappings)) {
+        for (const [index, mapping] of cfg.hooks.mappings.entries()) {
+            if (mapping?.allowUnsafeExternalContent === true) {
+                enabledFlags.push(`hooks.mappings[${index}].allowUnsafeExternalContent=true`);
+            }
+        }
+    }
+    if (cfg.tools?.exec?.applyPatch?.workspaceOnly === false) {
+        enabledFlags.push("tools.exec.applyPatch.workspaceOnly=false");
+    }
+    return enabledFlags;
+}
 async function collectFilesystemFindings(params) {
     const findings = [];
     const stateDirPerms = await inspectPathPermissions(params.stateDir, {
@@ -245,9 +268,9 @@ function collectGatewayConfigFindings(cfg, env) {
     if (cfg.gateway?.controlUi?.allowInsecureAuth === true) {
         findings.push({
             checkId: "gateway.control_ui.insecure_auth",
-            severity: "critical",
-            title: "Control UI allows insecure HTTP auth",
-            detail: "gateway.controlUi.allowInsecureAuth=true allows token-only auth over HTTP and skips device identity.",
+            severity: "warn",
+            title: "Control UI insecure auth toggle enabled",
+            detail: "gateway.controlUi.allowInsecureAuth=true does not bypass secure context or device identity checks; only dangerouslyDisableDeviceAuth disables Control UI device identity checks.",
             remediation: "Disable it or switch to HTTPS (Tailscale Serve) or localhost.",
         });
     }
@@ -260,6 +283,16 @@ function collectGatewayConfigFindings(cfg, env) {
             remediation: "Disable it unless you are in a short-lived break-glass scenario.",
         });
     }
+    const enabledDangerousFlags = collectEnabledInsecureOrDangerousFlags(cfg);
+    if (enabledDangerousFlags.length > 0) {
+        findings.push({
+            checkId: "config.insecure_or_dangerous_flags",
+            severity: "warn",
+            title: "Insecure or dangerous config flags enabled",
+            detail: `Detected ${enabledDangerousFlags.length} enabled flag(s): ${enabledDangerousFlags.join(", ")}.`,
+            remediation: "Disable these flags when not actively debugging, or keep deployment scoped to trusted/local-only networks.",
+        });
+    }
     const token = typeof auth.token === "string" && auth.token.trim().length > 0 ? auth.token.trim() : null;
     if (auth.mode === "token" && token && token.length < 24) {
         findings.push({
@@ -536,6 +569,9 @@ export async function runSecurityAudit(opts) {
             findings.push(...(await collectIncludeFilePermFindings({ configSnapshot, env, platform, execIcacls })));
         }
         findings.push(...(await collectStateDeepFilesystemFindings({ cfg, env, stateDir, platform, execIcacls })));
+        findings.push(...(await collectSandboxBrowserHashLabelFindings({
+            execDockerRawFn: opts.execDockerRawFn,
+        })));
         findings.push(...(await collectPluginsTrustFindings({ cfg, stateDir })));
         if (opts.deep === true) {
             findings.push(...(await collectPluginsCodeSafetyFindings({ stateDir })));

package/dist/security/dm-policy-shared.js

@@ -1,5 +1,49 @@
 import { readChannelAllowFromStore } from "../pairing/pairing-store.js";
 import { normalizeStringEntries } from "../shared/string-normalization.js";
+export function resolveEffectiveAllowFromLists(params) {
+    const configAllowFrom = normalizeStringEntries(Array.isArray(params.allowFrom) ? params.allowFrom : undefined);
+    const configGroupAllowFrom = normalizeStringEntries(Array.isArray(params.groupAllowFrom) ? params.groupAllowFrom : undefined);
+    const storeAllowFrom = params.dmPolicy === "allowlist"
+        ? []
+        : normalizeStringEntries(Array.isArray(params.storeAllowFrom) ? params.storeAllowFrom : undefined);
+    const effectiveAllowFrom = normalizeStringEntries([...configAllowFrom, ...storeAllowFrom]);
+    const groupBase = configGroupAllowFrom.length > 0 ? configGroupAllowFrom : configAllowFrom;
+    const effectiveGroupAllowFrom = normalizeStringEntries([...groupBase, ...storeAllowFrom]);
+    return { effectiveAllowFrom, effectiveGroupAllowFrom };
+}
+export function resolveDmGroupAccessDecision(params) {
+    const dmPolicy = params.dmPolicy ?? "pairing";
+    const groupPolicy = params.groupPolicy ?? "allowlist";
+    const effectiveAllowFrom = normalizeStringEntries(params.effectiveAllowFrom);
+    const effectiveGroupAllowFrom = normalizeStringEntries(params.effectiveGroupAllowFrom);
+    if (params.isGroup) {
+        if (groupPolicy === "disabled") {
+            return { decision: "block", reason: "groupPolicy=disabled" };
+        }
+        if (groupPolicy === "allowlist") {
+            if (effectiveGroupAllowFrom.length === 0) {
+                return { decision: "block", reason: "groupPolicy=allowlist (empty allowlist)" };
+            }
+            if (!params.isSenderAllowed(effectiveGroupAllowFrom)) {
+                return { decision: "block", reason: "groupPolicy=allowlist (not allowlisted)" };
+            }
+        }
+        return { decision: "allow", reason: `groupPolicy=${groupPolicy}` };
+    }
+    if (dmPolicy === "disabled") {
+        return { decision: "block", reason: "dmPolicy=disabled" };
+    }
+    if (dmPolicy === "open") {
+        return { decision: "allow", reason: "dmPolicy=open" };
+    }
+    if (params.isSenderAllowed(effectiveAllowFrom)) {
+        return { decision: "allow", reason: `dmPolicy=${dmPolicy} (allowlisted)` };
+    }
+    if (dmPolicy === "pairing") {
+        return { decision: "pairing", reason: "dmPolicy=pairing (not allowlisted)" };
+    }
+    return { decision: "block", reason: `dmPolicy=${dmPolicy} (not allowlisted)` };
+}
 export async function resolveDmAllowState(params) {
     const configAllowFrom = normalizeStringEntries(Array.isArray(params.allowFrom) ? params.allowFrom : undefined);
     const hasWildcard = configAllowFrom.includes("*");

package/dist/security/external-content.js

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 /**
  * Security utilities for handling untrusted external content.
  *
@@ -40,9 +41,20 @@ export function detectSuspiciousPatterns(content) {
 /**
  * Unique boundary markers for external content.
  * Using XML-style tags that are unlikely to appear in legitimate content.
+ * Each wrapper gets a unique random ID to prevent spoofing attacks where
+ * malicious content injects fake boundary markers.
  */
-const EXTERNAL_CONTENT_START = "<<<EXTERNAL_UNTRUSTED_CONTENT>>>";
-const EXTERNAL_CONTENT_END = "<<<END_EXTERNAL_UNTRUSTED_CONTENT>>>";
+const EXTERNAL_CONTENT_START_NAME = "EXTERNAL_UNTRUSTED_CONTENT";
+const EXTERNAL_CONTENT_END_NAME = "END_EXTERNAL_UNTRUSTED_CONTENT";
+function createExternalContentMarkerId() {
+    return randomBytes(8).toString("hex");
+}
+function createExternalContentStartMarker(id) {
+    return `<<<${EXTERNAL_CONTENT_START_NAME} id="${id}">>>`;
+}
+function createExternalContentEndMarker(id) {
+    return `<<<${EXTERNAL_CONTENT_END_NAME} id="${id}">>>`;
+}
 /**
  * Security warning prepended to external content.
  */
@@ -107,9 +119,16 @@ function replaceMarkers(content) {
         return content;
     }
     const replacements = [];
+    // Match markers with or without id attribute (handles both legacy and spoofed markers)
     const patterns = [
-        { regex: /<<<EXTERNAL_UNTRUSTED_CONTENT>>>/gi, value: "[[MARKER_SANITIZED]]" },
-        { regex: /<<<END_EXTERNAL_UNTRUSTED_CONTENT>>>/gi, value: "[[END_MARKER_SANITIZED]]" },
+        {
+            regex: /<<<EXTERNAL_UNTRUSTED_CONTENT(?:\s+id="[^"]{1,128}")?\s*>>>/gi,
+            value: "[[MARKER_SANITIZED]]",
+        },
+        {
+            regex: /<<<END_EXTERNAL_UNTRUSTED_CONTENT(?:\s+id="[^"]{1,128}")?\s*>>>/gi,
+            value: "[[END_MARKER_SANITIZED]]",
+        },
     ];
     for (const pattern of patterns) {
         pattern.regex.lastIndex = 0;
@@ -168,13 +187,14 @@ export function wrapExternalContent(content, options) {
     }
     const metadata = metadataLines.join("\n");
     const warningBlock = includeWarning ? `${EXTERNAL_CONTENT_WARNING}\n\n` : "";
+    const markerId = createExternalContentMarkerId();
     return [
         warningBlock,
-        EXTERNAL_CONTENT_START,
+        createExternalContentStartMarker(markerId),
         metadata,
         "---",
         sanitized,
-        EXTERNAL_CONTENT_END,
+        createExternalContentEndMarker(markerId),
     ].join("\n");
 }
 /**