@theaux/clawdbot 2026.1.14 → 2026.1.15

package/dist/security/audit-extra.js

@@ -0,0 +1,525 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import JSON5 from "json5";
+import { createConfigIO } from "../config/config.js";
+import { resolveOAuthDir } from "../config/paths.js";
+import { resolveDefaultAgentId } from "../agents/agent-scope.js";
+import { INCLUDE_KEY, MAX_INCLUDE_DEPTH } from "../config/includes.js";
+import { normalizeAgentId } from "../routing/session-key.js";
+import { formatOctal, isGroupReadable, isGroupWritable, isWorldReadable, isWorldWritable, modeBits, safeStat, } from "./audit-fs.js";
+function expandTilde(p, env) {
+    if (!p.startsWith("~"))
+        return p;
+    const home = typeof env.HOME === "string" && env.HOME.trim() ? env.HOME.trim() : null;
+    if (!home)
+        return null;
+    if (p === "~")
+        return home;
+    if (p.startsWith("~/") || p.startsWith("~\\"))
+        return path.join(home, p.slice(2));
+    return null;
+}
+function summarizeGroupPolicy(cfg) {
+    const channels = cfg.channels;
+    if (!channels || typeof channels !== "object")
+        return { open: 0, allowlist: 0, other: 0 };
+    let open = 0;
+    let allowlist = 0;
+    let other = 0;
+    for (const value of Object.values(channels)) {
+        if (!value || typeof value !== "object")
+            continue;
+        const section = value;
+        const policy = section.groupPolicy;
+        if (policy === "open")
+            open += 1;
+        else if (policy === "allowlist")
+            allowlist += 1;
+        else
+            other += 1;
+    }
+    return { open, allowlist, other };
+}
+export function collectAttackSurfaceSummaryFindings(cfg) {
+    const group = summarizeGroupPolicy(cfg);
+    const elevated = cfg.tools?.elevated?.enabled !== false;
+    const hooksEnabled = cfg.hooks?.enabled === true;
+    const browserEnabled = Boolean(cfg.browser?.enabled ?? cfg.browser?.controlUrl);
+    const detail = `groups: open=${group.open}, allowlist=${group.allowlist}` +
+        `\n` +
+        `tools.elevated: ${elevated ? "enabled" : "disabled"}` +
+        `\n` +
+        `hooks: ${hooksEnabled ? "enabled" : "disabled"}` +
+        `\n` +
+        `browser control: ${browserEnabled ? "enabled" : "disabled"}`;
+    return [
+        {
+            checkId: "summary.attack_surface",
+            severity: "info",
+            title: "Attack surface summary",
+            detail,
+        },
+    ];
+}
+function isProbablySyncedPath(p) {
+    const s = p.toLowerCase();
+    return (s.includes("icloud") ||
+        s.includes("dropbox") ||
+        s.includes("google drive") ||
+        s.includes("googledrive") ||
+        s.includes("onedrive"));
+}
+export function collectSyncedFolderFindings(params) {
+    const findings = [];
+    if (isProbablySyncedPath(params.stateDir) || isProbablySyncedPath(params.configPath)) {
+        findings.push({
+            checkId: "fs.synced_dir",
+            severity: "warn",
+            title: "State/config path looks like a synced folder",
+            detail: `stateDir=${params.stateDir}, configPath=${params.configPath}. Synced folders (iCloud/Dropbox/OneDrive/Google Drive) can leak tokens and transcripts onto other devices.`,
+            remediation: `Keep CLAWDBOT_STATE_DIR on a local-only volume and re-run "clawdbot security audit --fix".`,
+        });
+    }
+    return findings;
+}
+function looksLikeEnvRef(value) {
+    const v = value.trim();
+    return v.startsWith("${") && v.endsWith("}");
+}
+export function collectSecretsInConfigFindings(cfg) {
+    const findings = [];
+    const password = typeof cfg.gateway?.auth?.password === "string" ? cfg.gateway.auth.password.trim() : "";
+    if (password && !looksLikeEnvRef(password)) {
+        findings.push({
+            checkId: "config.secrets.gateway_password_in_config",
+            severity: "warn",
+            title: "Gateway password is stored in config",
+            detail: "gateway.auth.password is set in the config file; prefer environment variables for secrets when possible.",
+            remediation: "Prefer CLAWDBOT_GATEWAY_PASSWORD (env) and remove gateway.auth.password from disk.",
+        });
+    }
+    const browserToken = typeof cfg.browser?.controlToken === "string" ? cfg.browser.controlToken.trim() : "";
+    if (browserToken && !looksLikeEnvRef(browserToken)) {
+        findings.push({
+            checkId: "config.secrets.browser_control_token_in_config",
+            severity: "warn",
+            title: "Browser control token is stored in config",
+            detail: "browser.controlToken is set in the config file; prefer environment variables for secrets when possible.",
+            remediation: "Prefer CLAWDBOT_BROWSER_CONTROL_TOKEN (env) and remove browser.controlToken from disk.",
+        });
+    }
+    const hooksToken = typeof cfg.hooks?.token === "string" ? cfg.hooks.token.trim() : "";
+    if (cfg.hooks?.enabled === true && hooksToken && !looksLikeEnvRef(hooksToken)) {
+        findings.push({
+            checkId: "config.secrets.hooks_token_in_config",
+            severity: "info",
+            title: "Hooks token is stored in config",
+            detail: "hooks.token is set in the config file; keep config perms tight and treat it like an API secret.",
+        });
+    }
+    return findings;
+}
+export function collectHooksHardeningFindings(cfg) {
+    const findings = [];
+    if (cfg.hooks?.enabled !== true)
+        return findings;
+    const token = typeof cfg.hooks?.token === "string" ? cfg.hooks.token.trim() : "";
+    if (token && token.length < 24) {
+        findings.push({
+            checkId: "hooks.token_too_short",
+            severity: "warn",
+            title: "Hooks token looks short",
+            detail: `hooks.token is ${token.length} chars; prefer a long random token.`,
+        });
+    }
+    const gatewayToken = typeof cfg.gateway?.auth?.token === "string" && cfg.gateway.auth.token.trim()
+        ? cfg.gateway.auth.token.trim()
+        : null;
+    if (token && gatewayToken && token === gatewayToken) {
+        findings.push({
+            checkId: "hooks.token_reuse_gateway_token",
+            severity: "warn",
+            title: "Hooks token reuses the Gateway token",
+            detail: "hooks.token matches gateway.auth token; compromise of hooks expands blast radius to the Gateway API.",
+            remediation: "Use a separate hooks.token dedicated to hook ingress.",
+        });
+    }
+    const browserToken = typeof cfg.browser?.controlToken === "string" && cfg.browser.controlToken.trim()
+        ? cfg.browser.controlToken.trim()
+        : process.env.CLAWDBOT_BROWSER_CONTROL_TOKEN?.trim() || null;
+    if (token && browserToken && token === browserToken) {
+        findings.push({
+            checkId: "hooks.token_reuse_browser_token",
+            severity: "warn",
+            title: "Hooks token reuses the browser control token",
+            detail: "hooks.token matches browser control token; compromise of hooks may enable browser control endpoints.",
+            remediation: "Use a separate hooks.token dedicated to hook ingress.",
+        });
+    }
+    const rawPath = typeof cfg.hooks?.path === "string" ? cfg.hooks.path.trim() : "";
+    if (rawPath === "/") {
+        findings.push({
+            checkId: "hooks.path_root",
+            severity: "critical",
+            title: "Hooks base path is '/'",
+            detail: "hooks.path='/' would shadow other HTTP endpoints and is unsafe.",
+            remediation: "Use a dedicated path like '/hooks'.",
+        });
+    }
+    return findings;
+}
+function addModel(models, raw, source) {
+    if (typeof raw !== "string")
+        return;
+    const id = raw.trim();
+    if (!id)
+        return;
+    models.push({ id, source });
+}
+function collectModels(cfg) {
+    const out = [];
+    addModel(out, cfg.agents?.defaults?.model?.primary, "agents.defaults.model.primary");
+    for (const f of cfg.agents?.defaults?.model?.fallbacks ?? [])
+        addModel(out, f, "agents.defaults.model.fallbacks");
+    addModel(out, cfg.agents?.defaults?.imageModel?.primary, "agents.defaults.imageModel.primary");
+    for (const f of cfg.agents?.defaults?.imageModel?.fallbacks ?? [])
+        addModel(out, f, "agents.defaults.imageModel.fallbacks");
+    const list = Array.isArray(cfg.agents?.list) ? cfg.agents?.list : [];
+    for (const agent of list ?? []) {
+        if (!agent || typeof agent !== "object")
+            continue;
+        const id = typeof agent.id === "string" ? agent.id : "";
+        const model = agent.model;
+        if (typeof model === "string") {
+            addModel(out, model, `agents.list.${id}.model`);
+        }
+        else if (model && typeof model === "object") {
+            addModel(out, model.primary, `agents.list.${id}.model.primary`);
+            const fallbacks = model.fallbacks;
+            if (Array.isArray(fallbacks)) {
+                for (const f of fallbacks)
+                    addModel(out, f, `agents.list.${id}.model.fallbacks`);
+            }
+        }
+    }
+    return out;
+}
+const LEGACY_MODEL_PATTERNS = [
+    { id: "openai.gpt35", re: /\bgpt-3\.5\b/i, label: "GPT-3.5 family" },
+    { id: "anthropic.claude2", re: /\bclaude-(instant|2)\b/i, label: "Claude 2/Instant family" },
+    { id: "openai.gpt4_legacy", re: /\bgpt-4-(0314|0613)\b/i, label: "Legacy GPT-4 snapshots" },
+];
+export function collectModelHygieneFindings(cfg) {
+    const findings = [];
+    const models = collectModels(cfg);
+    if (models.length === 0)
+        return findings;
+    const matches = [];
+    for (const entry of models) {
+        for (const pat of LEGACY_MODEL_PATTERNS) {
+            if (pat.re.test(entry.id)) {
+                matches.push({ model: entry.id, source: entry.source, reason: pat.label });
+                break;
+            }
+        }
+    }
+    if (matches.length > 0) {
+        const lines = matches
+            .slice(0, 12)
+            .map((m) => `- ${m.model} (${m.reason}) @ ${m.source}`)
+            .join("\n");
+        const more = matches.length > 12 ? `\n…${matches.length - 12} more` : "";
+        findings.push({
+            checkId: "models.legacy",
+            severity: "warn",
+            title: "Some configured models look legacy",
+            detail: "Older/legacy models can be less robust against prompt injection and tool misuse.\n" +
+                lines +
+                more,
+            remediation: "Prefer modern, instruction-hardened models for any bot that can run tools.",
+        });
+    }
+    return findings;
+}
+export async function collectPluginsTrustFindings(params) {
+    const findings = [];
+    const extensionsDir = path.join(params.stateDir, "extensions");
+    const st = await safeStat(extensionsDir);
+    if (!st.ok || !st.isDir)
+        return findings;
+    const entries = await fs.readdir(extensionsDir, { withFileTypes: true }).catch(() => []);
+    const pluginDirs = entries
+        .filter((e) => e.isDirectory())
+        .map((e) => e.name)
+        .filter(Boolean);
+    if (pluginDirs.length === 0)
+        return findings;
+    const allow = params.cfg.plugins?.allow;
+    const allowConfigured = Array.isArray(allow) && allow.length > 0;
+    if (!allowConfigured) {
+        findings.push({
+            checkId: "plugins.extensions_no_allowlist",
+            severity: "warn",
+            title: "Extensions exist but plugins.allow is not set",
+            detail: `Found ${pluginDirs.length} extension(s) under ${extensionsDir}. Without plugins.allow, any discovered plugin id may load (depending on config and plugin behavior).`,
+            remediation: "Set plugins.allow to an explicit list of plugin ids you trust.",
+        });
+    }
+    return findings;
+}
+function resolveIncludePath(baseConfigPath, includePath) {
+    return path.normalize(path.isAbsolute(includePath)
+        ? includePath
+        : path.resolve(path.dirname(baseConfigPath), includePath));
+}
+function listDirectIncludes(parsed) {
+    const out = [];
+    const visit = (value) => {
+        if (!value)
+            return;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                visit(item);
+            return;
+        }
+        if (typeof value !== "object")
+            return;
+        const rec = value;
+        const includeVal = rec[INCLUDE_KEY];
+        if (typeof includeVal === "string")
+            out.push(includeVal);
+        else if (Array.isArray(includeVal)) {
+            for (const item of includeVal) {
+                if (typeof item === "string")
+                    out.push(item);
+            }
+        }
+        for (const v of Object.values(rec))
+            visit(v);
+    };
+    visit(parsed);
+    return out;
+}
+async function collectIncludePathsRecursive(params) {
+    const visited = new Set();
+    const result = [];
+    const walk = async (basePath, parsed, depth) => {
+        if (depth > MAX_INCLUDE_DEPTH)
+            return;
+        for (const raw of listDirectIncludes(parsed)) {
+            const resolved = resolveIncludePath(basePath, raw);
+            if (visited.has(resolved))
+                continue;
+            visited.add(resolved);
+            result.push(resolved);
+            const rawText = await fs.readFile(resolved, "utf-8").catch(() => null);
+            if (!rawText)
+                continue;
+            const nestedParsed = (() => {
+                try {
+                    return JSON5.parse(rawText);
+                }
+                catch {
+                    return null;
+                }
+            })();
+            if (nestedParsed) {
+                // eslint-disable-next-line no-await-in-loop
+                await walk(resolved, nestedParsed, depth + 1);
+            }
+        }
+    };
+    await walk(params.configPath, params.parsed, 0);
+    return result;
+}
+export async function collectIncludeFilePermFindings(params) {
+    const findings = [];
+    if (!params.configSnapshot.exists)
+        return findings;
+    const configPath = params.configSnapshot.path;
+    const includePaths = await collectIncludePathsRecursive({
+        configPath,
+        parsed: params.configSnapshot.parsed,
+    });
+    if (includePaths.length === 0)
+        return findings;
+    for (const p of includePaths) {
+        // eslint-disable-next-line no-await-in-loop
+        const st = await safeStat(p);
+        if (!st.ok)
+            continue;
+        const bits = modeBits(st.mode);
+        if (isWorldWritable(bits) || isGroupWritable(bits)) {
+            findings.push({
+                checkId: "fs.config_include.perms_writable",
+                severity: "critical",
+                title: "Config include file is writable by others",
+                detail: `${p} mode=${formatOctal(bits)}; another user could influence your effective config.`,
+                remediation: `chmod 600 ${p}`,
+            });
+        }
+        else if (isWorldReadable(bits)) {
+            findings.push({
+                checkId: "fs.config_include.perms_world_readable",
+                severity: "critical",
+                title: "Config include file is world-readable",
+                detail: `${p} mode=${formatOctal(bits)}; include files can contain tokens and private settings.`,
+                remediation: `chmod 600 ${p}`,
+            });
+        }
+        else if (isGroupReadable(bits)) {
+            findings.push({
+                checkId: "fs.config_include.perms_group_readable",
+                severity: "warn",
+                title: "Config include file is group-readable",
+                detail: `${p} mode=${formatOctal(bits)}; include files can contain tokens and private settings.`,
+                remediation: `chmod 600 ${p}`,
+            });
+        }
+    }
+    return findings;
+}
+export async function collectStateDeepFilesystemFindings(params) {
+    const findings = [];
+    const oauthDir = resolveOAuthDir(params.env, params.stateDir);
+    const oauthStat = await safeStat(oauthDir);
+    if (oauthStat.ok && oauthStat.isDir) {
+        const bits = modeBits(oauthStat.mode);
+        if (isWorldWritable(bits) || isGroupWritable(bits)) {
+            findings.push({
+                checkId: "fs.credentials_dir.perms_writable",
+                severity: "critical",
+                title: "Credentials dir is writable by others",
+                detail: `${oauthDir} mode=${formatOctal(bits)}; another user could drop/modify credential files.`,
+                remediation: `chmod 700 ${oauthDir}`,
+            });
+        }
+        else if (isGroupReadable(bits) || isWorldReadable(bits)) {
+            findings.push({
+                checkId: "fs.credentials_dir.perms_readable",
+                severity: "warn",
+                title: "Credentials dir is readable by others",
+                detail: `${oauthDir} mode=${formatOctal(bits)}; credentials and allowlists can be sensitive.`,
+                remediation: `chmod 700 ${oauthDir}`,
+            });
+        }
+    }
+    const agentIds = Array.isArray(params.cfg.agents?.list)
+        ? params.cfg.agents?.list
+            .map((a) => (a && typeof a === "object" && typeof a.id === "string" ? a.id.trim() : ""))
+            .filter(Boolean)
+        : [];
+    const defaultAgentId = resolveDefaultAgentId(params.cfg);
+    const ids = Array.from(new Set([defaultAgentId, ...agentIds])).map((id) => normalizeAgentId(id));
+    for (const agentId of ids) {
+        const agentDir = path.join(params.stateDir, "agents", agentId, "agent");
+        const authPath = path.join(agentDir, "auth-profiles.json");
+        // eslint-disable-next-line no-await-in-loop
+        const authStat = await safeStat(authPath);
+        if (authStat.ok) {
+            const bits = modeBits(authStat.mode);
+            if (isWorldWritable(bits) || isGroupWritable(bits)) {
+                findings.push({
+                    checkId: "fs.auth_profiles.perms_writable",
+                    severity: "critical",
+                    title: "auth-profiles.json is writable by others",
+                    detail: `${authPath} mode=${formatOctal(bits)}; another user could inject credentials.`,
+                    remediation: `chmod 600 ${authPath}`,
+                });
+            }
+            else if (isWorldReadable(bits) || isGroupReadable(bits)) {
+                findings.push({
+                    checkId: "fs.auth_profiles.perms_readable",
+                    severity: "warn",
+                    title: "auth-profiles.json is readable by others",
+                    detail: `${authPath} mode=${formatOctal(bits)}; auth-profiles.json contains API keys and OAuth tokens.`,
+                    remediation: `chmod 600 ${authPath}`,
+                });
+            }
+        }
+        const storePath = path.join(params.stateDir, "agents", agentId, "sessions", "sessions.json");
+        // eslint-disable-next-line no-await-in-loop
+        const storeStat = await safeStat(storePath);
+        if (storeStat.ok) {
+            const bits = modeBits(storeStat.mode);
+            if (isWorldReadable(bits) || isGroupReadable(bits)) {
+                findings.push({
+                    checkId: "fs.sessions_store.perms_readable",
+                    severity: "warn",
+                    title: "sessions.json is readable by others",
+                    detail: `${storePath} mode=${formatOctal(bits)}; routing and transcript metadata can be sensitive.`,
+                    remediation: `chmod 600 ${storePath}`,
+                });
+            }
+        }
+    }
+    const logFile = typeof params.cfg.logging?.file === "string" ? params.cfg.logging.file.trim() : "";
+    if (logFile) {
+        const expanded = logFile.startsWith("~") ? expandTilde(logFile, params.env) : logFile;
+        if (expanded) {
+            const logPath = path.resolve(expanded);
+            const st = await safeStat(logPath);
+            if (st.ok) {
+                const bits = modeBits(st.mode);
+                if (isWorldReadable(bits) || isGroupReadable(bits)) {
+                    findings.push({
+                        checkId: "fs.log_file.perms_readable",
+                        severity: "warn",
+                        title: "Log file is readable by others",
+                        detail: `${logPath} mode=${formatOctal(bits)}; logs can contain private messages and tool output.`,
+                        remediation: `chmod 600 ${logPath}`,
+                    });
+                }
+            }
+        }
+    }
+    return findings;
+}
+function listGroupPolicyOpen(cfg) {
+    const out = [];
+    const channels = cfg.channels;
+    if (!channels || typeof channels !== "object")
+        return out;
+    for (const [channelId, value] of Object.entries(channels)) {
+        if (!value || typeof value !== "object")
+            continue;
+        const section = value;
+        if (section.groupPolicy === "open")
+            out.push(`channels.${channelId}.groupPolicy`);
+        const accounts = section.accounts;
+        if (accounts && typeof accounts === "object") {
+            for (const [accountId, accountVal] of Object.entries(accounts)) {
+                if (!accountVal || typeof accountVal !== "object")
+                    continue;
+                const acc = accountVal;
+                if (acc.groupPolicy === "open")
+                    out.push(`channels.${channelId}.accounts.${accountId}.groupPolicy`);
+            }
+        }
+    }
+    return out;
+}
+export function collectExposureMatrixFindings(cfg) {
+    const findings = [];
+    const openGroups = listGroupPolicyOpen(cfg);
+    if (openGroups.length === 0)
+        return findings;
+    const elevatedEnabled = cfg.tools?.elevated?.enabled !== false;
+    if (elevatedEnabled) {
+        findings.push({
+            checkId: "security.exposure.open_groups_with_elevated",
+            severity: "critical",
+            title: "Open groupPolicy with elevated tools enabled",
+            detail: `Found groupPolicy="open" at:\n${openGroups.map((p) => `- ${p}`).join("\n")}\n` +
+                "With tools.elevated enabled, a prompt injection in those rooms can become a high-impact incident.",
+            remediation: `Set groupPolicy="allowlist" and keep elevated allowlists extremely tight.`,
+        });
+    }
+    return findings;
+}
+export async function readConfigSnapshotForAudit(params) {
+    return await createConfigIO({
+        env: params.env,
+        configPath: params.configPath,
+    }).readConfigFileSnapshot();
+}

package/dist/security/audit-fs.js

@@ -0,0 +1,55 @@
+import fs from "node:fs/promises";
+export async function safeStat(targetPath) {
+    try {
+        const lst = await fs.lstat(targetPath);
+        return {
+            ok: true,
+            isSymlink: lst.isSymbolicLink(),
+            isDir: lst.isDirectory(),
+            mode: typeof lst.mode === "number" ? lst.mode : null,
+            uid: typeof lst.uid === "number" ? lst.uid : null,
+            gid: typeof lst.gid === "number" ? lst.gid : null,
+        };
+    }
+    catch (err) {
+        return {
+            ok: false,
+            isSymlink: false,
+            isDir: false,
+            mode: null,
+            uid: null,
+            gid: null,
+            error: String(err),
+        };
+    }
+}
+export function modeBits(mode) {
+    if (mode == null)
+        return null;
+    return mode & 0o777;
+}
+export function formatOctal(bits) {
+    if (bits == null)
+        return "unknown";
+    return bits.toString(8).padStart(3, "0");
+}
+export function isWorldWritable(bits) {
+    if (bits == null)
+        return false;
+    return (bits & 0o002) !== 0;
+}
+export function isGroupWritable(bits) {
+    if (bits == null)
+        return false;
+    return (bits & 0o020) !== 0;
+}
+export function isWorldReadable(bits) {
+    if (bits == null)
+        return false;
+    return (bits & 0o004) !== 0;
+}
+export function isGroupReadable(bits) {
+    if (bits == null)
+        return false;
+    return (bits & 0o040) !== 0;
+}

package/dist/security/audit.js

@@ -0,0 +1,469 @@
+import { listChannelPlugins } from "../channels/plugins/index.js";
+import { resolveChannelDefaultAccountId } from "../channels/plugins/helpers.js";
+import { resolveBrowserConfig } from "../browser/config.js";
+import { resolveConfigPath, resolveStateDir } from "../config/paths.js";
+import { resolveGatewayAuth } from "../gateway/auth.js";
+import { buildGatewayConnectionDetails } from "../gateway/call.js";
+import { probeGateway } from "../gateway/probe.js";
+import { collectAttackSurfaceSummaryFindings, collectExposureMatrixFindings, collectHooksHardeningFindings, collectIncludeFilePermFindings, collectModelHygieneFindings, collectPluginsTrustFindings, collectSecretsInConfigFindings, collectStateDeepFilesystemFindings, collectSyncedFolderFindings, readConfigSnapshotForAudit, } from "./audit-extra.js";
+import { formatOctal, isGroupReadable, isGroupWritable, isWorldReadable, isWorldWritable, modeBits, safeStat, } from "./audit-fs.js";
+function countBySeverity(findings) {
+    let critical = 0;
+    let warn = 0;
+    let info = 0;
+    for (const f of findings) {
+        if (f.severity === "critical")
+            critical += 1;
+        else if (f.severity === "warn")
+            warn += 1;
+        else
+            info += 1;
+    }
+    return { critical, warn, info };
+}
+function normalizeAllowFromList(list) {
+    if (!Array.isArray(list))
+        return [];
+    return list.map((v) => String(v).trim()).filter(Boolean);
+}
+function classifyChannelWarningSeverity(message) {
+    const s = message.toLowerCase();
+    if (s.includes("dms: open") ||
+        s.includes('grouppolicy="open"') ||
+        s.includes('dmpolicy="open"')) {
+        return "critical";
+    }
+    if (s.includes("allows any") || s.includes("anyone can dm") || s.includes("public")) {
+        return "critical";
+    }
+    if (s.includes("locked") || s.includes("disabled")) {
+        return "info";
+    }
+    return "warn";
+}
+async function collectFilesystemFindings(params) {
+    const findings = [];
+    const stateDirStat = await safeStat(params.stateDir);
+    if (stateDirStat.ok) {
+        const bits = modeBits(stateDirStat.mode);
+        if (stateDirStat.isSymlink) {
+            findings.push({
+                checkId: "fs.state_dir.symlink",
+                severity: "warn",
+                title: "State dir is a symlink",
+                detail: `${params.stateDir} is a symlink; treat this as an extra trust boundary.`,
+            });
+        }
+        if (isWorldWritable(bits)) {
+            findings.push({
+                checkId: "fs.state_dir.perms_world_writable",
+                severity: "critical",
+                title: "State dir is world-writable",
+                detail: `${params.stateDir} mode=${formatOctal(bits)}; other users can write into your Clawdbot state.`,
+                remediation: `chmod 700 ${params.stateDir}`,
+            });
+        }
+        else if (isGroupWritable(bits)) {
+            findings.push({
+                checkId: "fs.state_dir.perms_group_writable",
+                severity: "warn",
+                title: "State dir is group-writable",
+                detail: `${params.stateDir} mode=${formatOctal(bits)}; group users can write into your Clawdbot state.`,
+                remediation: `chmod 700 ${params.stateDir}`,
+            });
+        }
+        else if (isGroupReadable(bits) || isWorldReadable(bits)) {
+            findings.push({
+                checkId: "fs.state_dir.perms_readable",
+                severity: "warn",
+                title: "State dir is readable by others",
+                detail: `${params.stateDir} mode=${formatOctal(bits)}; consider restricting to 700.`,
+                remediation: `chmod 700 ${params.stateDir}`,
+            });
+        }
+    }
+    const configStat = await safeStat(params.configPath);
+    if (configStat.ok) {
+        const bits = modeBits(configStat.mode);
+        if (configStat.isSymlink) {
+            findings.push({
+                checkId: "fs.config.symlink",
+                severity: "warn",
+                title: "Config file is a symlink",
+                detail: `${params.configPath} is a symlink; make sure you trust its target.`,
+            });
+        }
+        if (isWorldWritable(bits) || isGroupWritable(bits)) {
+            findings.push({
+                checkId: "fs.config.perms_writable",
+                severity: "critical",
+                title: "Config file is writable by others",
+                detail: `${params.configPath} mode=${formatOctal(bits)}; another user could change gateway/auth/tool policies.`,
+                remediation: `chmod 600 ${params.configPath}`,
+            });
+        }
+        else if (isWorldReadable(bits)) {
+            findings.push({
+                checkId: "fs.config.perms_world_readable",
+                severity: "critical",
+                title: "Config file is world-readable",
+                detail: `${params.configPath} mode=${formatOctal(bits)}; config can contain tokens and private settings.`,
+                remediation: `chmod 600 ${params.configPath}`,
+            });
+        }
+        else if (isGroupReadable(bits)) {
+            findings.push({
+                checkId: "fs.config.perms_group_readable",
+                severity: "warn",
+                title: "Config file is group-readable",
+                detail: `${params.configPath} mode=${formatOctal(bits)}; config can contain tokens and private settings.`,
+                remediation: `chmod 600 ${params.configPath}`,
+            });
+        }
+    }
+    return findings;
+}
+function collectGatewayConfigFindings(cfg) {
+    const findings = [];
+    const bind = typeof cfg.gateway?.bind === "string" ? cfg.gateway.bind : "loopback";
+    const tailscaleMode = cfg.gateway?.tailscale?.mode ?? "off";
+    const auth = resolveGatewayAuth({ authConfig: cfg.gateway?.auth, tailscaleMode });
+    if (bind !== "loopback" && auth.mode === "none") {
+        findings.push({
+            checkId: "gateway.bind_no_auth",
+            severity: "critical",
+            title: "Gateway binds beyond loopback without auth",
+            detail: `gateway.bind="${bind}" but no gateway.auth token/password is configured.`,
+            remediation: `Set gateway.auth (token recommended) or bind to loopback.`,
+        });
+    }
+    if (tailscaleMode === "funnel") {
+        findings.push({
+            checkId: "gateway.tailscale_funnel",
+            severity: "critical",
+            title: "Tailscale Funnel exposure enabled",
+            detail: `gateway.tailscale.mode="funnel" exposes the Gateway publicly; keep auth strict and treat it as internet-facing.`,
+            remediation: `Prefer tailscale.mode="serve" (tailnet-only) or set tailscale.mode="off".`,
+        });
+    }
+    else if (tailscaleMode === "serve") {
+        findings.push({
+            checkId: "gateway.tailscale_serve",
+            severity: "info",
+            title: "Tailscale Serve exposure enabled",
+            detail: `gateway.tailscale.mode="serve" exposes the Gateway to your tailnet (loopback behind Tailscale).`,
+        });
+    }
+    const token = typeof auth.token === "string" && auth.token.trim().length > 0 ? auth.token.trim() : null;
+    if (auth.mode === "token" && token && token.length < 24) {
+        findings.push({
+            checkId: "gateway.token_too_short",
+            severity: "warn",
+            title: "Gateway token looks short",
+            detail: `gateway auth token is ${token.length} chars; prefer a long random token.`,
+        });
+    }
+    return findings;
+}
+function isLoopbackClientHost(hostname) {
+    const h = hostname.trim().toLowerCase();
+    return h === "localhost" || h === "127.0.0.1" || h === "::1";
+}
+function collectBrowserControlFindings(cfg) {
+    const findings = [];
+    let resolved;
+    try {
+        resolved = resolveBrowserConfig(cfg.browser);
+    }
+    catch (err) {
+        findings.push({
+            checkId: "browser.control_invalid_config",
+            severity: "warn",
+            title: "Browser control config looks invalid",
+            detail: String(err),
+            remediation: `Fix browser.controlUrl/browser.cdpUrl in ${resolveConfigPath()} and re-run "clawdbot security audit --deep".`,
+        });
+        return findings;
+    }
+    if (!resolved.enabled)
+        return findings;
+    const url = new URL(resolved.controlUrl);
+    const isLoopback = isLoopbackClientHost(url.hostname);
+    const envToken = process.env.CLAWDBOT_BROWSER_CONTROL_TOKEN?.trim();
+    const controlToken = (envToken || resolved.controlToken)?.trim() || null;
+    if (!isLoopback) {
+        if (!controlToken) {
+            findings.push({
+                checkId: "browser.control_remote_no_token",
+                severity: "critical",
+                title: "Remote browser control is missing an auth token",
+                detail: `browser.controlUrl is non-loopback (${resolved.controlUrl}) but no browser.controlToken (or CLAWDBOT_BROWSER_CONTROL_TOKEN) is configured.`,
+                remediation: "Set browser.controlToken (or export CLAWDBOT_BROWSER_CONTROL_TOKEN) and prefer serving over Tailscale Serve or HTTPS reverse proxy.",
+            });
+        }
+        if (url.protocol === "http:") {
+            findings.push({
+                checkId: "browser.control_remote_http",
+                severity: "warn",
+                title: "Remote browser control uses HTTP",
+                detail: `browser.controlUrl=${resolved.controlUrl} is http; this is OK only if it's tailnet-only (Tailscale) or behind another encrypted tunnel.`,
+                remediation: `Prefer HTTPS termination (Tailscale Serve) and keep the endpoint tailnet-only.`,
+            });
+        }
+        if (controlToken && controlToken.length < 24) {
+            findings.push({
+                checkId: "browser.control_token_too_short",
+                severity: "warn",
+                title: "Browser control token looks short",
+                detail: `browser control token is ${controlToken.length} chars; prefer a long random token.`,
+            });
+        }
+        const tailscaleMode = cfg.gateway?.tailscale?.mode ?? "off";
+        const gatewayAuth = resolveGatewayAuth({ authConfig: cfg.gateway?.auth, tailscaleMode });
+        const gatewayToken = gatewayAuth.mode === "token" &&
+            typeof gatewayAuth.token === "string" &&
+            gatewayAuth.token.trim()
+            ? gatewayAuth.token.trim()
+            : null;
+        if (controlToken && gatewayToken && controlToken === gatewayToken) {
+            findings.push({
+                checkId: "browser.control_token_reuse_gateway_token",
+                severity: "warn",
+                title: "Browser control token reuses the Gateway token",
+                detail: `browser.controlToken matches gateway.auth token; compromise of browser control expands blast radius to the Gateway API.`,
+                remediation: `Use a separate browser.controlToken dedicated to browser control.`,
+            });
+        }
+    }
+    return findings;
+}
+function collectLoggingFindings(cfg) {
+    const redact = cfg.logging?.redactSensitive;
+    if (redact !== "off")
+        return [];
+    return [
+        {
+            checkId: "logging.redact_off",
+            severity: "warn",
+            title: "Tool summary redaction is disabled",
+            detail: `logging.redactSensitive="off" can leak secrets into logs and status output.`,
+            remediation: `Set logging.redactSensitive="tools".`,
+        },
+    ];
+}
+function collectElevatedFindings(cfg) {
+    const findings = [];
+    const enabled = cfg.tools?.elevated?.enabled;
+    const allowFrom = cfg.tools?.elevated?.allowFrom ?? {};
+    const anyAllowFromKeys = Object.keys(allowFrom).length > 0;
+    if (enabled === false)
+        return findings;
+    if (!anyAllowFromKeys)
+        return findings;
+    for (const [provider, list] of Object.entries(allowFrom)) {
+        const normalized = normalizeAllowFromList(list);
+        if (normalized.includes("*")) {
+            findings.push({
+                checkId: `tools.elevated.allowFrom.${provider}.wildcard`,
+                severity: "critical",
+                title: "Elevated exec allowlist contains wildcard",
+                detail: `tools.elevated.allowFrom.${provider} includes "*" which effectively approves everyone on that channel for elevated mode.`,
+            });
+        }
+        else if (normalized.length > 25) {
+            findings.push({
+                checkId: `tools.elevated.allowFrom.${provider}.large`,
+                severity: "warn",
+                title: "Elevated exec allowlist is large",
+                detail: `tools.elevated.allowFrom.${provider} has ${normalized.length} entries; consider tightening elevated access.`,
+            });
+        }
+    }
+    return findings;
+}
+async function collectChannelSecurityFindings(params) {
+    const findings = [];
+    const warnDmPolicy = async (input) => {
+        const policyPath = input.policyPath ?? `${input.allowFromPath}policy`;
+        const configAllowFrom = normalizeAllowFromList(input.allowFrom);
+        const hasWildcard = configAllowFrom.includes("*");
+        if (input.dmPolicy === "open") {
+            const allowFromKey = `${input.allowFromPath}allowFrom`;
+            findings.push({
+                checkId: `channels.${input.provider}.dm.open`,
+                severity: "critical",
+                title: `${input.label} DMs are open`,
+                detail: `${policyPath}="open" allows anyone to DM the bot.`,
+                remediation: `Use pairing/allowlist; if you really need open DMs, ensure ${allowFromKey} includes "*".`,
+            });
+            if (!hasWildcard) {
+                findings.push({
+                    checkId: `channels.${input.provider}.dm.open_invalid`,
+                    severity: "warn",
+                    title: `${input.label} DM config looks inconsistent`,
+                    detail: `"open" requires ${allowFromKey} to include "*".`,
+                });
+            }
+            return;
+        }
+        if (input.dmPolicy === "disabled") {
+            findings.push({
+                checkId: `channels.${input.provider}.dm.disabled`,
+                severity: "info",
+                title: `${input.label} DMs are disabled`,
+                detail: `${policyPath}="disabled" ignores inbound DMs.`,
+            });
+        }
+    };
+    for (const plugin of params.plugins) {
+        if (!plugin.security)
+            continue;
+        const accountIds = plugin.config.listAccountIds(params.cfg);
+        const defaultAccountId = resolveChannelDefaultAccountId({
+            plugin,
+            cfg: params.cfg,
+            accountIds,
+        });
+        const account = plugin.config.resolveAccount(params.cfg, defaultAccountId);
+        const enabled = plugin.config.isEnabled ? plugin.config.isEnabled(account, params.cfg) : true;
+        if (!enabled)
+            continue;
+        const configured = plugin.config.isConfigured
+            ? await plugin.config.isConfigured(account, params.cfg)
+            : true;
+        if (!configured)
+            continue;
+        const dmPolicy = plugin.security.resolveDmPolicy?.({
+            cfg: params.cfg,
+            accountId: defaultAccountId,
+            account,
+        });
+        if (dmPolicy) {
+            await warnDmPolicy({
+                label: plugin.meta.label ?? plugin.id,
+                provider: plugin.id,
+                dmPolicy: dmPolicy.policy,
+                allowFrom: dmPolicy.allowFrom,
+                policyPath: dmPolicy.policyPath,
+                allowFromPath: dmPolicy.allowFromPath,
+            });
+        }
+        if (plugin.security.collectWarnings) {
+            const warnings = await plugin.security.collectWarnings({
+                cfg: params.cfg,
+                accountId: defaultAccountId,
+                account,
+            });
+            for (const message of warnings ?? []) {
+                const trimmed = String(message).trim();
+                if (!trimmed)
+                    continue;
+                findings.push({
+                    checkId: `channels.${plugin.id}.warning.${findings.length + 1}`,
+                    severity: classifyChannelWarningSeverity(trimmed),
+                    title: `${plugin.meta.label ?? plugin.id} security warning`,
+                    detail: trimmed.replace(/^-\s*/, ""),
+                });
+            }
+        }
+    }
+    return findings;
+}
+async function maybeProbeGateway(params) {
+    const connection = buildGatewayConnectionDetails({ config: params.cfg });
+    const url = connection.url;
+    const isRemoteMode = params.cfg.gateway?.mode === "remote";
+    const remoteUrlRaw = typeof params.cfg.gateway?.remote?.url === "string" ? params.cfg.gateway.remote.url.trim() : "";
+    const remoteUrlMissing = isRemoteMode && !remoteUrlRaw;
+    const resolveAuth = (mode) => {
+        const authToken = params.cfg.gateway?.auth?.token;
+        const authPassword = params.cfg.gateway?.auth?.password;
+        const remote = params.cfg.gateway?.remote;
+        const token = mode === "remote"
+            ? typeof remote?.token === "string" && remote.token.trim()
+                ? remote.token.trim()
+                : undefined
+            : process.env.CLAWDBOT_GATEWAY_TOKEN?.trim() ||
+                (typeof authToken === "string" && authToken.trim() ? authToken.trim() : undefined);
+        const password = process.env.CLAWDBOT_GATEWAY_PASSWORD?.trim() ||
+            (mode === "remote"
+                ? typeof remote?.password === "string" && remote.password.trim()
+                    ? remote.password.trim()
+                    : undefined
+                : typeof authPassword === "string" && authPassword.trim()
+                    ? authPassword.trim()
+                    : undefined);
+        return { token, password };
+    };
+    const auth = remoteUrlMissing ? resolveAuth("local") : resolveAuth("remote");
+    const res = await params.probe({ url, auth, timeoutMs: params.timeoutMs }).catch((err) => ({
+        ok: false,
+        url,
+        connectLatencyMs: null,
+        error: String(err),
+        close: null,
+        health: null,
+        status: null,
+        presence: null,
+        configSnapshot: null,
+    }));
+    return {
+        gateway: {
+            attempted: true,
+            url,
+            ok: res.ok,
+            error: res.ok ? null : res.error,
+            close: res.close ? { code: res.close.code, reason: res.close.reason } : null,
+        },
+    };
+}
+export async function runSecurityAudit(opts) {
+    const findings = [];
+    const cfg = opts.config;
+    const env = process.env;
+    const stateDir = opts.stateDir ?? resolveStateDir(env);
+    const configPath = opts.configPath ?? resolveConfigPath(env, stateDir);
+    findings.push(...collectAttackSurfaceSummaryFindings(cfg));
+    findings.push(...collectSyncedFolderFindings({ stateDir, configPath }));
+    findings.push(...collectGatewayConfigFindings(cfg));
+    findings.push(...collectBrowserControlFindings(cfg));
+    findings.push(...collectLoggingFindings(cfg));
+    findings.push(...collectElevatedFindings(cfg));
+    findings.push(...collectHooksHardeningFindings(cfg));
+    findings.push(...collectSecretsInConfigFindings(cfg));
+    findings.push(...collectModelHygieneFindings(cfg));
+    findings.push(...collectExposureMatrixFindings(cfg));
+    const configSnapshot = opts.includeFilesystem !== false
+        ? await readConfigSnapshotForAudit({ env, configPath }).catch(() => null)
+        : null;
+    if (opts.includeFilesystem !== false) {
+        findings.push(...(await collectFilesystemFindings({ stateDir, configPath })));
+        if (configSnapshot) {
+            findings.push(...(await collectIncludeFilePermFindings({ configSnapshot })));
+        }
+        findings.push(...(await collectStateDeepFilesystemFindings({ cfg, env, stateDir })));
+        findings.push(...(await collectPluginsTrustFindings({ cfg, stateDir })));
+    }
+    if (opts.includeChannelSecurity !== false) {
+        const plugins = opts.plugins ?? listChannelPlugins();
+        findings.push(...(await collectChannelSecurityFindings({ cfg, plugins })));
+    }
+    const deep = opts.deep === true
+        ? await maybeProbeGateway({
+            cfg,
+            timeoutMs: Math.max(250, opts.deepTimeoutMs ?? 5000),
+            probe: opts.probeGatewayFn ?? probeGateway,
+        })
+        : undefined;
+    if (deep?.gateway?.attempted && deep.gateway.ok === false) {
+        findings.push({
+            checkId: "gateway.probe_failed",
+            severity: "warn",
+            title: "Gateway probe failed (deep)",
+            detail: deep.gateway.error ?? "gateway unreachable",
+            remediation: `Run "clawdbot status --all" to debug connectivity/auth, then re-run "clawdbot security audit --deep".`,
+        });
+    }
+    const summary = countBySeverity(findings);
+    return { ts: Date.now(), summary, findings, deep };
+}

package/dist/security/fix.js

@@ -0,0 +1,317 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import JSON5 from "json5";
+import { createConfigIO } from "../config/config.js";
+import { resolveConfigPath, resolveOAuthDir, resolveStateDir } from "../config/paths.js";
+import { resolveDefaultAgentId } from "../agents/agent-scope.js";
+import { INCLUDE_KEY, MAX_INCLUDE_DEPTH } from "../config/includes.js";
+import { normalizeAgentId } from "../routing/session-key.js";
+import { readChannelAllowFromStore } from "../pairing/pairing-store.js";
+async function safeChmod(params) {
+    try {
+        const st = await fs.lstat(params.path);
+        if (st.isSymbolicLink()) {
+            return {
+                kind: "chmod",
+                path: params.path,
+                mode: params.mode,
+                ok: false,
+                skipped: "symlink",
+            };
+        }
+        if (params.require === "dir" && !st.isDirectory()) {
+            return {
+                kind: "chmod",
+                path: params.path,
+                mode: params.mode,
+                ok: false,
+                skipped: "not-a-directory",
+            };
+        }
+        if (params.require === "file" && !st.isFile()) {
+            return {
+                kind: "chmod",
+                path: params.path,
+                mode: params.mode,
+                ok: false,
+                skipped: "not-a-file",
+            };
+        }
+        const current = st.mode & 0o777;
+        if (current === params.mode) {
+            return {
+                kind: "chmod",
+                path: params.path,
+                mode: params.mode,
+                ok: false,
+                skipped: "already",
+            };
+        }
+        await fs.chmod(params.path, params.mode);
+        return { kind: "chmod", path: params.path, mode: params.mode, ok: true };
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT") {
+            return {
+                kind: "chmod",
+                path: params.path,
+                mode: params.mode,
+                ok: false,
+                skipped: "missing",
+            };
+        }
+        return {
+            kind: "chmod",
+            path: params.path,
+            mode: params.mode,
+            ok: false,
+            error: String(err),
+        };
+    }
+}
+function setGroupPolicyAllowlist(params) {
+    if (!params.cfg.channels)
+        return;
+    const section = params.cfg.channels[params.channel];
+    if (!section || typeof section !== "object")
+        return;
+    const topPolicy = section.groupPolicy;
+    if (topPolicy === "open") {
+        section.groupPolicy = "allowlist";
+        params.changes.push(`channels.${params.channel}.groupPolicy=open -> allowlist`);
+        params.policyFlips.add(`channels.${params.channel}.`);
+    }
+    const accounts = section.accounts;
+    if (!accounts || typeof accounts !== "object")
+        return;
+    for (const [accountId, accountValue] of Object.entries(accounts)) {
+        if (!accountId)
+            continue;
+        if (!accountValue || typeof accountValue !== "object")
+            continue;
+        const account = accountValue;
+        if (account.groupPolicy === "open") {
+            account.groupPolicy = "allowlist";
+            params.changes.push(`channels.${params.channel}.accounts.${accountId}.groupPolicy=open -> allowlist`);
+            params.policyFlips.add(`channels.${params.channel}.accounts.${accountId}.`);
+        }
+    }
+}
+function setWhatsAppGroupAllowFromFromStore(params) {
+    const section = params.cfg.channels?.whatsapp;
+    if (!section || typeof section !== "object")
+        return;
+    if (params.storeAllowFrom.length === 0)
+        return;
+    const maybeApply = (prefix, obj) => {
+        if (!params.policyFlips.has(prefix))
+            return;
+        const allowFrom = Array.isArray(obj.allowFrom) ? obj.allowFrom : [];
+        const groupAllowFrom = Array.isArray(obj.groupAllowFrom) ? obj.groupAllowFrom : [];
+        if (allowFrom.length > 0)
+            return;
+        if (groupAllowFrom.length > 0)
+            return;
+        obj.groupAllowFrom = params.storeAllowFrom;
+        params.changes.push(`${prefix}groupAllowFrom=pairing-store`);
+    };
+    maybeApply("channels.whatsapp.", section);
+    const accounts = section.accounts;
+    if (!accounts || typeof accounts !== "object")
+        return;
+    for (const [accountId, accountValue] of Object.entries(accounts)) {
+        if (!accountValue || typeof accountValue !== "object")
+            continue;
+        const account = accountValue;
+        maybeApply(`channels.whatsapp.accounts.${accountId}.`, account);
+    }
+}
+function applyConfigFixes(params) {
+    const next = structuredClone(params.cfg ?? {});
+    const changes = [];
+    const policyFlips = new Set();
+    if (next.logging?.redactSensitive === "off") {
+        next.logging = { ...next.logging, redactSensitive: "tools" };
+        changes.push('logging.redactSensitive=off -> "tools"');
+    }
+    for (const channel of [
+        "telegram",
+        "whatsapp",
+        "discord",
+        "signal",
+        "imessage",
+        "slack",
+        "msteams",
+    ]) {
+        setGroupPolicyAllowlist({ cfg: next, channel, changes, policyFlips });
+    }
+    return { cfg: next, changes, policyFlips };
+}
+function listDirectIncludes(parsed) {
+    const out = [];
+    const visit = (value) => {
+        if (!value)
+            return;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                visit(item);
+            return;
+        }
+        if (typeof value !== "object")
+            return;
+        const rec = value;
+        const includeVal = rec[INCLUDE_KEY];
+        if (typeof includeVal === "string")
+            out.push(includeVal);
+        else if (Array.isArray(includeVal)) {
+            for (const item of includeVal) {
+                if (typeof item === "string")
+                    out.push(item);
+            }
+        }
+        for (const v of Object.values(rec))
+            visit(v);
+    };
+    visit(parsed);
+    return out;
+}
+function resolveIncludePath(baseConfigPath, includePath) {
+    return path.normalize(path.isAbsolute(includePath)
+        ? includePath
+        : path.resolve(path.dirname(baseConfigPath), includePath));
+}
+async function collectIncludePathsRecursive(params) {
+    const visited = new Set();
+    const result = [];
+    const walk = async (basePath, parsed, depth) => {
+        if (depth > MAX_INCLUDE_DEPTH)
+            return;
+        for (const raw of listDirectIncludes(parsed)) {
+            const resolved = resolveIncludePath(basePath, raw);
+            if (visited.has(resolved))
+                continue;
+            visited.add(resolved);
+            result.push(resolved);
+            const rawText = await fs.readFile(resolved, "utf-8").catch(() => null);
+            if (!rawText)
+                continue;
+            const nestedParsed = (() => {
+                try {
+                    return JSON5.parse(rawText);
+                }
+                catch {
+                    return null;
+                }
+            })();
+            if (nestedParsed) {
+                // eslint-disable-next-line no-await-in-loop
+                await walk(resolved, nestedParsed, depth + 1);
+            }
+        }
+    };
+    await walk(params.configPath, params.parsed, 0);
+    return result;
+}
+async function chmodCredentialsAndAgentState(params) {
+    const credsDir = resolveOAuthDir(params.env, params.stateDir);
+    params.actions.push(await safeChmod({ path: credsDir, mode: 0o700, require: "dir" }));
+    const credsEntries = await fs.readdir(credsDir, { withFileTypes: true }).catch(() => []);
+    for (const entry of credsEntries) {
+        if (!entry.isFile())
+            continue;
+        if (!entry.name.endsWith(".json"))
+            continue;
+        const p = path.join(credsDir, entry.name);
+        // eslint-disable-next-line no-await-in-loop
+        params.actions.push(await safeChmod({ path: p, mode: 0o600, require: "file" }));
+    }
+    const ids = new Set();
+    ids.add(resolveDefaultAgentId(params.cfg));
+    const list = Array.isArray(params.cfg.agents?.list) ? params.cfg.agents?.list : [];
+    for (const agent of list ?? []) {
+        if (!agent || typeof agent !== "object")
+            continue;
+        const id = typeof agent.id === "string" ? agent.id.trim() : "";
+        if (id)
+            ids.add(id);
+    }
+    for (const agentId of ids) {
+        const normalizedAgentId = normalizeAgentId(agentId);
+        const agentRoot = path.join(params.stateDir, "agents", normalizedAgentId);
+        const agentDir = path.join(agentRoot, "agent");
+        const sessionsDir = path.join(agentRoot, "sessions");
+        // eslint-disable-next-line no-await-in-loop
+        params.actions.push(await safeChmod({ path: agentRoot, mode: 0o700, require: "dir" }));
+        // eslint-disable-next-line no-await-in-loop
+        params.actions.push(await safeChmod({ path: agentDir, mode: 0o700, require: "dir" }));
+        const authPath = path.join(agentDir, "auth-profiles.json");
+        // eslint-disable-next-line no-await-in-loop
+        params.actions.push(await safeChmod({ path: authPath, mode: 0o600, require: "file" }));
+        // eslint-disable-next-line no-await-in-loop
+        params.actions.push(await safeChmod({ path: sessionsDir, mode: 0o700, require: "dir" }));
+        const storePath = path.join(sessionsDir, "sessions.json");
+        // eslint-disable-next-line no-await-in-loop
+        params.actions.push(await safeChmod({ path: storePath, mode: 0o600, require: "file" }));
+    }
+}
+export async function fixSecurityFootguns(opts) {
+    const env = opts?.env ?? process.env;
+    const stateDir = opts?.stateDir ?? resolveStateDir(env);
+    const configPath = opts?.configPath ?? resolveConfigPath(env, stateDir);
+    const actions = [];
+    const errors = [];
+    const io = createConfigIO({ env, configPath });
+    const snap = await io.readConfigFileSnapshot();
+    if (!snap.valid) {
+        errors.push(...snap.issues.map((i) => `${i.path}: ${i.message}`));
+    }
+    let configWritten = false;
+    let changes = [];
+    if (snap.valid) {
+        const fixed = applyConfigFixes({ cfg: snap.config, env });
+        changes = fixed.changes;
+        const whatsappStoreAllowFrom = await readChannelAllowFromStore("whatsapp", env).catch(() => []);
+        if (whatsappStoreAllowFrom.length > 0) {
+            setWhatsAppGroupAllowFromFromStore({
+                cfg: fixed.cfg,
+                storeAllowFrom: whatsappStoreAllowFrom,
+                changes,
+                policyFlips: fixed.policyFlips,
+            });
+        }
+        if (changes.length > 0) {
+            try {
+                await io.writeConfigFile(fixed.cfg);
+                configWritten = true;
+            }
+            catch (err) {
+                errors.push(`writeConfigFile failed: ${String(err)}`);
+            }
+        }
+    }
+    actions.push(await safeChmod({ path: stateDir, mode: 0o700, require: "dir" }));
+    actions.push(await safeChmod({ path: configPath, mode: 0o600, require: "file" }));
+    if (snap.exists) {
+        const includePaths = await collectIncludePathsRecursive({
+            configPath: snap.path,
+            parsed: snap.parsed,
+        }).catch(() => []);
+        for (const p of includePaths) {
+            // eslint-disable-next-line no-await-in-loop
+            actions.push(await safeChmod({ path: p, mode: 0o600, require: "file" }));
+        }
+    }
+    await chmodCredentialsAndAgentState({ env, stateDir, cfg: snap.config ?? {}, actions }).catch((err) => {
+        errors.push(`chmodCredentialsAndAgentState failed: ${String(err)}`);
+    });
+    return {
+        ok: errors.length === 0,
+        stateDir,
+        configPath,
+        configWritten,
+        changes,
+        actions,
+        errors,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theaux/clawdbot",
-  "version": "2026.1.14",
+  "version": "2026.1.15",
   "description": "WhatsApp gateway CLI (Baileys web) with Pi RPC agent",
   "type": "module",
   "main": "dist/index.js",
@@ -30,6 +30,7 @@
     "dist/process/**",
     "dist/plugins/**",
     "dist/sessions/**",
+    "dist/security/**",
     "dist/providers/**",
     "dist/signal/**",
     "dist/slack/**",