@principles/core 1.229.0 → 1.231.0

package/dist/runtime-v2/__tests__/architecture-regression.test.js

@@ -3441,4 +3441,313 @@ describe('PRI-450 / PRI-462: core I/O seam registry guard', () => {
         expect(importsFsOrPath(`import type { Database } from 'better-sqlite3';`)).toBe(false);
     });
 });
+// ===========================================================================
+// SEC-BASE-1: Supply Chain Provenance Guards
+// Guards the npm publish / CI supply chain controls declared in
+// docs/architecture/SECURITY_BASELINE.md §3 (supply chain layer).
+// ===========================================================================
+describe('SEC-BASE-1: supply chain provenance guards', () => {
+    const REPO_ROOT = pathSync.resolve(__dirname, '../../../../..');
+    function readWorkflow(name) {
+        const p = pathSync.join(REPO_ROOT, '.github', 'workflows', name);
+        try {
+            return fsSync.readFileSync(p, 'utf8');
+        }
+        catch {
+            return null;
+        }
+    }
+    it('publish-npm.yml uses --provenance', () => {
+        const content = readWorkflow('publish-npm.yml');
+        expect(content, 'publish-npm.yml should exist').not.toBeNull();
+        expect(content).toMatch(/npm\s+publish\s+--provenance/);
+    });
+    it('publish-npm.yml uses npm ci --ignore-scripts', () => {
+        const content = readWorkflow('publish-npm.yml');
+        expect(content).not.toBeNull();
+        expect(content).toMatch(/npm\s+ci\s+--ignore-scripts/);
+    });
+    it('SECURITY.md exists at .github/SECURITY.md', () => {
+        const p = pathSync.join(REPO_ROOT, '.github', 'SECURITY.md');
+        expect(fsSync.existsSync(p), `${p} should exist`).toBe(true);
+    });
+    it('CodeQL workflow targets javascript-typescript', () => {
+        const content = readWorkflow('codeql.yml');
+        expect(content, 'codeql.yml should exist').not.toBeNull();
+        expect(content).toMatch(/javascript-typescript/);
+    });
+    it('dependabot.yml covers npm and github-actions', () => {
+        const p = pathSync.join(REPO_ROOT, '.github', 'dependabot.yml');
+        const content = fsSync.readFileSync(p, 'utf8');
+        expect(content).toMatch(/package-ecosystem:\s*['"]?npm['"]?/m);
+        expect(content).toMatch(/package-ecosystem:\s*['"]?github-actions['"]?/m);
+    });
+});
+// ===========================================================================
+// SEC-BASE-2: Sandbox Escape Regression Guards
+// Guards the vm sandbox layer declared in SECURITY_BASELINE.md §4.
+// Escape payload regression lives in
+// packages/openclaw-plugin/tests/core/sandbox-escape-regression.test.ts
+// ===========================================================================
+describe('SEC-BASE-2: sandbox escape regression guards', () => {
+    const REPO_ROOT = pathSync.resolve(__dirname, '../../../../..');
+    it('rule-code-validator forbids import.meta', async () => {
+        const { checkForbiddenPatterns } = await import('../internalization/rule-code-validator.js');
+        const labels = checkForbiddenPatterns('const u = import.meta.url;');
+        expect(labels).toContain('import.meta');
+    });
+    it('rule-code-validator forbids WeakRef / FinalizationRegistry', async () => {
+        const { checkForbiddenPatterns } = await import('../internalization/rule-code-validator.js');
+        expect(checkForbiddenPatterns('new WeakRef({});')).toContain('WeakRef');
+        expect(checkForbiddenPatterns('new FinalizationRegistry(() => {});')).toContain('FinalizationRegistry');
+    });
+    it('rule-code-validator forbids SharedArrayBuffer / Atomics', async () => {
+        const { checkForbiddenPatterns } = await import('../internalization/rule-code-validator.js');
+        expect(checkForbiddenPatterns('new SharedArrayBuffer(8);')).toContain('SharedArrayBuffer');
+        expect(checkForbiddenPatterns('Atomics.load(new Int32Array(1), 0);')).toContain('Atomics');
+    });
+    it('rule-implementation-runtime.ts uses spawnSync with bounded resources', () => {
+        const sourcePath = pathSync.join(REPO_ROOT, 'packages', 'openclaw-plugin', 'src', 'core', 'rule-implementation-runtime.ts');
+        const source = fsSync.readFileSync(sourcePath, 'utf8');
+        expect(source).toContain('spawnSync');
+        expect(source).toContain('windowsHide: true');
+        expect(source).toContain('maxBuffer');
+        expect(source).toContain('--max-old-space-size');
+        expect(source).toMatch(/timeout:\s*\w+/);
+    });
+});
+// ===========================================================================
+// SEC-BASE-3: PII Redaction Guards
+// Guards that the implemented PII sanitization patterns exist in
+// openclaw-plugin (trajectory.ts redactText) and that message-sanitize hook
+// applies sanitization to message content.
+//
+// IMPLEMENTED (MVP): <EMAIL>, <TOKEN> (sk/rk/pk prefix), <PATH>, <WINDOWS_PATH>
+// POST-MVP GAPS (documented in SECURITY_BASELINE.md): <PHONE>, <CARD>, <IP>
+// ===========================================================================
+describe('SEC-BASE-3: PII redaction guards', () => {
+    const REPO_ROOT = pathSync.resolve(__dirname, '../../../../..');
+    it('openclaw-plugin contains email redaction pattern with <EMAIL> replacement', () => {
+        const pluginDir = pathSync.join(REPO_ROOT, 'packages', 'openclaw-plugin', 'src');
+        const files = fsSync.readdirSync(pluginDir, { recursive: true, encoding: 'utf8' })
+            .filter((f) => typeof f === 'string' && f.endsWith('.ts') && !f.includes('__tests__'));
+        let foundEmail = false;
+        for (const f of files) {
+            const content = fsSync.readFileSync(pathSync.join(pluginDir, f), 'utf8');
+            // Look for: <EMAIL> replacement token AND a regex containing @ (email pattern)
+            if (/<EMAIL>/.test(content) && /\.\s*replace\s*\(\s*\/.*@.*\//.test(content)) {
+                foundEmail = true;
+                break;
+            }
+        }
+        expect(foundEmail, 'openclaw-plugin should contain email redaction pattern with <EMAIL> replacement').toBe(true);
+    });
+    it('openclaw-plugin contains API token redaction pattern (<TOKEN> with sk/rk/pk prefix)', () => {
+        const pluginDir = pathSync.join(REPO_ROOT, 'packages', 'openclaw-plugin', 'src');
+        const files = fsSync.readdirSync(pluginDir, { recursive: true, encoding: 'utf8' })
+            .filter((f) => typeof f === 'string' && f.endsWith('.ts') && !f.includes('__tests__'));
+        let foundToken = false;
+        for (const f of files) {
+            const content = fsSync.readFileSync(pathSync.join(pluginDir, f), 'utf8');
+            // Look for: <TOKEN> replacement token AND a regex containing (sk|rk|pk)
+            if (/<TOKEN>/.test(content) && /\(sk\|rk\|pk\)/.test(content)) {
+                foundToken = true;
+                break;
+            }
+        }
+        expect(foundToken, 'openclaw-plugin should contain API token redaction pattern with <TOKEN> replacement').toBe(true);
+    });
+    it('openclaw-plugin message-sanitize hook applies sanitization', () => {
+        const sourcePath = pathSync.join(REPO_ROOT, 'packages', 'openclaw-plugin', 'src', 'hooks', 'message-sanitize.ts');
+        const source = fsSync.readFileSync(sourcePath, 'utf8');
+        // Delegate pattern: import from core + apply to message content
+        expect(source).toMatch(/coreSanitize|sanitizeValue|sanitiz/i);
+    });
+});
+// ===========================================================================
+// SEC-BASE-4: Log Secret Redaction & SQLite SQL Injection Guards
+// Guards that:
+//   (a) core does not emit raw secret-named fields in logger output
+//   (b) core does not string-concatenate SQL (uses parameterized queries)
+// ===========================================================================
+describe('SEC-BASE-4: log secret redaction & SQL injection guards', () => {
+    const REPO_ROOT = pathSync.resolve(__dirname, '../../../../..');
+    it('core source does not log raw api_key / token / secret / password fields', () => {
+        const coreDir = pathSync.join(REPO_ROOT, 'packages', 'principles-core', 'src');
+        const files = fsSync.readdirSync(coreDir, { recursive: true, encoding: 'utf8' })
+            .filter((f) => typeof f === 'string' && f.endsWith('.ts') && !f.includes('__tests__'));
+        const suspicious = [];
+        for (const f of files) {
+            const content = fsSync.readFileSync(pathSync.join(coreDir, f), 'utf8');
+            const lines = content.split('\n');
+            lines.forEach((line, idx) => {
+                if (/log(ger)?\./i.test(line) || /console\./.test(line)) {
+                    if (/\b(api[_-]?key|token|secret|password|credential)\b/i.test(line) && !/<REDACTED>/.test(line) && !/sanitiz/i.test(line)) {
+                        suspicious.push(`${f}:${idx + 1}: ${line.trim()}`);
+                    }
+                }
+            });
+        }
+        expect(suspicious, `Suspicious unredacted logger lines in core:\n${suspicious.join('\n')}`).toEqual([]);
+    });
+    it('core source does not string-concatenate SQL statements', () => {
+        const coreDir = pathSync.join(REPO_ROOT, 'packages', 'principles-core', 'src');
+        const files = fsSync.readdirSync(coreDir, { recursive: true, encoding: 'utf8' })
+            .filter((f) => typeof f === 'string'
+            && f.endsWith('.ts')
+            && !f.endsWith('.test.ts')
+            && !f.includes('__tests__'));
+        const suspicious = [];
+        // Known-safe pre-built clause variables (constructed from controlled
+        // conditions with `?` placeholders for values — not user input).
+        // `placeholders` = e.g. `ids.map(() => '?').join(',')` → generates `?,?,?`
+        //   (a string of `?` placeholder characters, NOT user values).
+        const SAFE_CLAUSE_VARS = new Set([
+            'whereClause', 'orderByClause', 'limitClause', 'setClause',
+            'conflictClause', 'returningClause', 'onConflictClause',
+            'placeholders',
+        ]);
+        // DML statements that MUST use parameterized values (`?` placeholders).
+        // DDL (ALTER TABLE / CREATE TABLE / CREATE INDEX / DROP) is excluded
+        // because SQLite does not accept `?` placeholders for identifiers (column
+        // names, table names) — DDL string-concat with controlled constants is
+        // the only valid pattern and is verified separately.
+        const DML_RE = /\b(SELECT|INSERT\s+INTO|UPDATE\s+\w|DELETE\s+FROM)\b/i;
+        for (const f of files) {
+            const content = fsSync.readFileSync(pathSync.join(coreDir, f), 'utf8');
+            // Find line number offset for reporting.
+            const lines = content.split('\n');
+            // Match .prepare(`...`) and .exec(`...`) template-literal SQL arguments.
+            // Uses [\s\S]*? (non-greedy, dotAll-equivalent) to capture multi-line
+            // template literals. Only the FIRST argument (the SQL string) is inspected.
+            const templateSqlRe = /\.(prepare|exec)\s*\(\s*`([\s\S]*?)`/g;
+            let m;
+            while ((m = templateSqlRe.exec(content)) !== null) {
+                // rc-2-no-as-bypass: RegExpExecArray indices are `string | undefined`
+                // under noUncheckedIndexedAccess. Use array destructuring (ESLint
+                // prefer-destructuring) + explicit undefined check (fail-loud).
+                const [, , sqlBody] = m;
+                if (sqlBody === undefined)
+                    continue;
+                if (!DML_RE.test(sqlBody))
+                    continue; // DDL-only is allowed
+                // Find line number of the match start.
+                const matchOffset = m.index;
+                const lineNum = content.slice(0, matchOffset).split('\n').length;
+                // Check for `${X}` interpolations inside the SQL template body.
+                const interpRe = /\$\{([^}]+)\}/g;
+                let im;
+                while ((im = interpRe.exec(sqlBody)) !== null) {
+                    const [, expr] = im;
+                    if (expr === undefined)
+                        continue;
+                    const exprTrimmed = expr.trim();
+                    // Safe: ends with .join(...) — column-list / placeholder-list pattern.
+                    if (/\.join\s*\(/.test(exprTrimmed))
+                        continue;
+                    // Safe: known pre-built clause variable.
+                    const rootVar = exprTrimmed.split('.')[0]?.split('[')[0]?.split('(')[0];
+                    if (rootVar !== undefined && SAFE_CLAUSE_VARS.has(rootVar.trim()))
+                        continue;
+                    // Safe: numeric / length / index expressions (not user data).
+                    if (/^\d+$/.test(exprTrimmed) || /\.length$/.test(exprTrimmed))
+                        continue;
+                    suspicious.push(`${f}:${lineNum}: interpolation \${${exprTrimmed}} in DML template`);
+                }
+            }
+            // Also check for string-concatenation pattern: .prepare('...' + var + '...')
+            // This is a single-line check (string concat SQL is rarely multi-line).
+            const concatSqlRe = /\.(prepare|exec)\s*\(\s*['"][^'"]*['"]\s*\+/g;
+            let cm;
+            while ((cm = concatSqlRe.exec(content)) !== null) {
+                const lineNum = content.slice(0, cm.index).split('\n').length;
+                const line = lines[lineNum - 1] || '';
+                // Only flag if the concatenated string contains DML keywords.
+                if (DML_RE.test(line)) {
+                    suspicious.push(`${f}:${lineNum}: string-concat in DML: ${line.trim()}`);
+                }
+            }
+        }
+        expect(suspicious, `Suspicious string-concatenated or interpolated DML in core:\n${suspicious.join('\n')}`).toEqual([]);
+    });
+});
+// ===========================================================================
+// SEC-BASE-5: Network & Config Isolation Guards
+// Guards:
+//   (a) core does not import node:http / node:https / undici / fetch (NET-1)
+//   (b) pd-console server config does not default to 0.0.0.0 (NET-5)
+//   (c) code_tool_hook config defaults to require_approval (CFG-4)
+// ===========================================================================
+describe('SEC-BASE-5: network & config isolation guards', () => {
+    const REPO_ROOT = pathSync.resolve(__dirname, '../../../../..');
+    it('core does not import node:http / node:https / undici / fetch for business', () => {
+        const coreDir = pathSync.join(REPO_ROOT, 'packages', 'principles-core', 'src');
+        const files = fsSync.readdirSync(coreDir, { recursive: true, encoding: 'utf8' })
+            .filter((f) => typeof f === 'string' && f.endsWith('.ts') && !f.includes('__tests__'));
+        const violations = [];
+        for (const f of files) {
+            const content = fsSync.readFileSync(pathSync.join(coreDir, f), 'utf8');
+            const lines = content.split('\n');
+            lines.forEach((line, idx) => {
+                if (/^import\s+type/.test(line.trim()))
+                    return;
+                if (/from\s+['"]node:http['"]/.test(line) || /from\s+['"]node:https['"]/.test(line)
+                    || /from\s+['"]undici['"]/.test(line) || /from\s+['"]node-fetch['"]/.test(line)) {
+                    violations.push(`${f}:${idx + 1}: ${line.trim()}`);
+                }
+                if (!/^\s*(\/\/|\/\*|\*)/.test(line) && /\bfetch\s*\(/.test(line) && !/import/.test(line)) {
+                    violations.push(`${f}:${idx + 1}: ${line.trim()}`);
+                }
+            });
+        }
+        expect(violations, `core should not import network modules (NET-1):\n${violations.join('\n')}`).toEqual([]);
+    });
+    it('pd-console server config does not default to 0.0.0.0', () => {
+        const consoleDir = pathSync.join(REPO_ROOT, 'packages', 'pd-console', 'src');
+        if (!fsSync.existsSync(consoleDir)) {
+            // pd-console may not exist in this worktree — skip with explicit note
+            console.warn('SEC-BASE-5: pd-console src dir not found, skipping bind_host check');
+            return;
+        }
+        const files = fsSync.readdirSync(consoleDir, { recursive: true, encoding: 'utf8' })
+            .filter((f) => typeof f === 'string' && f.endsWith('.ts'));
+        const violations = [];
+        for (const f of files) {
+            const content = fsSync.readFileSync(pathSync.join(consoleDir, f), 'utf8');
+            const lines = content.split('\n');
+            lines.forEach((line, idx) => {
+                // rc-9-no-silent-fallback: previously used `!/comment/.test(line)` which
+                // matched any line containing the substring "comment" (e.g. a variable
+                // named `commentField`), silently skipping real 0.0.0.0 defaults.
+                // Only skip genuine comment lines.
+                const trimmed = line.trim();
+                const isCommentLine = trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*');
+                if (/host\s*[:=]\s*['"]0\.0\.0\.0['"]/.test(line) && !isCommentLine) {
+                    violations.push(`${f}:${idx + 1}: ${line.trim()}`);
+                }
+            });
+        }
+        expect(violations, `pd-console should not default to 0.0.0.0 (NET-5):\n${violations.join('\n')}`).toEqual([]);
+    });
+    it('code_tool_hook config defaults to require_approval', () => {
+        // rc-9-no-silent-fallback: this was previously `expect(true).toBe(true)`
+        // (a tautology that always passed, giving false confidence). Now it fails
+        // loud if the require_approval decision is removed from the codebase.
+        // The `requireApproval` decision is enforced in gate.ts and is the
+        // MVP-Core safety boundary for code_tool_hook.
+        const pluginDir = pathSync.join(REPO_ROOT, 'packages', 'openclaw-plugin', 'src');
+        const files = fsSync.readdirSync(pluginDir, { recursive: true, encoding: 'utf8' })
+            .filter((f) => typeof f === 'string' && f.endsWith('.ts') && !f.includes('__tests__'));
+        let foundRequireApproval = false;
+        for (const f of files) {
+            const content = fsSync.readFileSync(pathSync.join(pluginDir, f), 'utf8');
+            if (/code[_-]?tool[_-]?hook/i.test(content) && /require[_-]?approval/i.test(content)) {
+                foundRequireApproval = true;
+                break;
+            }
+        }
+        expect(foundRequireApproval, 'code_tool_hook should reference require_approval decision in openclaw-plugin src ' +
+            '(expected in hooks/gate.ts). If removed, the code_tool_hook safety boundary is broken.').toBe(true);
+    });
+});
 //# sourceMappingURL=architecture-regression.test.js.map