claw-dashboard 2.1.1 → 2.2.0

package/CHANGELOG.md

@@ -5,7 +5,35 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [2.2.0] - 2026-07-28
+
+### Security
+- Fixed all npm audit vulnerabilities (brace-expansion, js-yaml, @babel/core)
+- Added brace-expansion override to force safe version across transitive deps
+- Enabled Dependabot security updates on repository
+
+### Dependencies
+- Updated eslint 10.0.3 → 10.8.0
+- Updated jest 30.3.0 → 30.4.2
+- Updated systeminformation 5.31.7 → 5.33.1
+- Updated c8 11 → 12
+- Updated lint-staged 16 → 17
+
+### Improvements
+- Bumped minimum Node.js version from 18 to 20
+- Updated CI matrix to test on Node 20, 22, 24
+- Tightened ESLint rules (no-unused-vars, no-undef, prefer-const, no-var, no-console as warnings)
+- Raised coverage thresholds (statements/lines 25→35, branches 30→35, functions 4→20)
+- Removed dead CJS files (index.cjs, build-cjs.js, cjs-shim.js)
+- Removed stale files (test.js, node_trace.1.log, start.sh)
+- Added node_trace.*.log to .gitignore
+
+### Lean/Clean Refactor (from v2.1.1+)
+- Removed sql.js dep + full historical DB module (backlog only; stores no longer called from refresh/start/web paths; WASM/init/DB-file overhead eliminated for lean runtime).
+- ESM-only: dropped CJS require conditions in exports, build:cjs script, and active dual-build in release (ci unaffected). "files" + .npmignore hygiene to exclude dead (src/database.js, index.cjs, build-cjs*, dist/widgets.cjs).
+- Synced tests (config, errors, integration), config, errors, docs, and database stub for removed surface. Full suite green for core.
+- Core TUI, retained features (snapshots, --web, plugins, perf, etc.), visuals, and controls 100% preserved.
+- Pre-existing snapshot path validation and web defaults noted (addressed with comments + minimal containment; no scope creep into general security refactor).
 
 ## [2.0.0] - 2026-02-28
 

package/docs/API.md

@@ -626,7 +626,6 @@ Returns a JSON-serializable representation of the error.
 | `AuthError` | `AUTH_ERROR` | Authentication failures |
 | `NetworkError` | `NETWORK_ERROR` | Network issues |
 | `UIError` | `UI_ERROR` | UI/rendering errors |
-| `DatabaseError` | `DATABASE_ERROR` | Database operations |
 | `ValidationError` | `VALIDATION_ERROR` | Input validation |
 | `TimeoutError` | `TIMEOUT_ERROR` | Operation timeouts |
 
@@ -668,7 +667,7 @@ import { ERROR_CODES } from './src/errors.js';
 // Available codes:
 // CONFIG_ERROR, SETTINGS_ERROR, GATEWAY_ERROR, SESSION_ERROR,
 // DATA_FETCH_ERROR, AUTH_ERROR, NETWORK_ERROR, UI_ERROR,
-// DATABASE_ERROR, VALIDATION_ERROR, TIMEOUT_ERROR, DASHBOARD_ERROR
+// VALIDATION_ERROR, TIMEOUT_ERROR, DASHBOARD_ERROR
 ```
 
 ---

package/index.js

@@ -9,7 +9,7 @@ import http from 'http';
 import os from 'os';
 import fs from 'fs';
 import { fileURLToPath } from 'url';
-import { dirname, join, resolve } from 'path';
+import { dirname, join, resolve, sep } from 'path';
 import logger from './src/logger.js';
 import {
   cycleTheme, getCurrentTheme, loadTheme, saveTheme, getThemeName,
@@ -20,11 +20,10 @@ import retry from './src/retry.js';
 import config, { DASHBOARD_VERSION, WIDGET_SIZES, WIDGET_SIZE_PRESETS } from './src/config.js';
 import validation from './src/validation.js';
 import cache from './src/cache.js';
-import database from './src/database.js';
 import { setSecurePermissionsSync } from './src/security.js';
 import { showSplashScreen } from './src/splash.js';
 import { showFirstRunHints } from './src/hints.js';
-import { DashboardError, ConfigError, SettingsError, GatewayError, SessionError, DataFetchError, AuthError, NetworkError, UIError, DatabaseError, ValidationError, TimeoutError, getErrorCode } from './src/errors.js';
+import { DashboardError, ConfigError, SettingsError, GatewayError, SessionError, DataFetchError, AuthError, NetworkError, UIError, ValidationError, TimeoutError, getErrorCode } from './src/errors.js';
 import { ConfigWatcher, watchSettingsFile } from './src/config-watcher.js';
 import { PluginReloadManager } from './src/plugin-reload.js';
 import { WidgetLoader } from './src/widgets/widget-loader.js';
@@ -59,7 +58,6 @@ import {
   generateSnapshotFilename,
   getSnapshotsDirectory,
   listSnapshots,
-  deleteSnapshot,
   getSnapshotSummary,
 } from './src/snapshot.js';
 import {
@@ -79,7 +77,7 @@ const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const execAsync = promisify(exec);
 
-// Safe file path validation
+// Safe file path validation (used for settings/export paths; allows any subpath under home or listed dirs; contrast to validatePluginPath used by snapshots which adds char/hidden filters - see the allowedHidden list and hidden check comment in security.js + export/import/delete comments in snapshot.js for snapshot path rules)
 function validateFilePath(filePath, allowedDirs = []) {
   try {
     // Handle null/undefined input
@@ -87,8 +85,10 @@ function validateFilePath(filePath, allowedDirs = []) {
       return { valid: false, resolvedPath: filePath, error: "Invalid file path" };
     }
     
-    // Replace leading ~ with home directory before resolving
-    const normalizedPath = filePath.startsWith('~')
+    // Replace leading ~ with home directory before resolving (robust for '~/...' and '~...' )
+    const normalizedPath = filePath.startsWith('~/')
+      ? join(os.homedir(), filePath.slice(2))
+      : filePath.startsWith('~')
       ? join(os.homedir(), filePath.slice(1))
       : filePath;
     
@@ -105,8 +105,8 @@ function validateFilePath(filePath, allowedDirs = []) {
     const homeDir = os.homedir();
     const defaultAllowedDirs = [
       homeDir,
-      homeDir + "/.openclaw",
-      homeDir + "/.openclaw/agents",
+      join(homeDir, '.openclaw'),
+      join(homeDir, '.openclaw', 'agents'),
       "/tmp"
     ];
     
@@ -115,7 +115,7 @@ function validateFilePath(filePath, allowedDirs = []) {
     // Check if resolved path is within any allowed directory
     const isAllowed = allAllowedDirs.some(allowedDir => {
       const resolvedAllowed = resolve(allowedDir);
-      return resolvedPath.startsWith(resolvedAllowed + "/") || resolvedPath === resolvedAllowed;
+      return resolvedPath.startsWith(resolvedAllowed + sep) || resolvedPath === resolvedAllowed;
     });
     
     if (!isAllowed) {
@@ -840,8 +840,7 @@ class Dashboard {
     this.sessionSearchQuery = this.settings.sessionSearchQuery || '';
     this.isSearchMode = false;
     this.filteredSessions = [];
-    // Widget navigation state - index into focusableWidgets array
-    this.focusedWidgetIndex = 0;
+    // Widget navigation state - index into focusableWidgets array (set to -1 for no initial focus)
     this.focusableWidgets = [];
     // Restore search filter if query was persisted
     if (this.sessionSearchQuery) {
@@ -861,7 +860,6 @@ class Dashboard {
     this.corruptedSessionsCount = 0;
     this.corruptedSessionsWarningShown = false;
     // Widget focus navigation state
-    this.focusableWidgets = [];
     this.focusedWidgetIndex = -1; // -1 means no widget focused (normal mode)
     // Widget arrangement mode state
     this.isWidgetArrangeMode = false;
@@ -2702,7 +2700,7 @@ class Dashboard {
   }
 
   exportDashboard() {
-    const exportDir = this.settings.exportDirectory || os.homedir() + '/.openclaw/exports';
+    const exportDir = this.settings.exportDirectory || join(os.homedir(), '.openclaw', 'exports');
     const timestamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
     const format = this.settings.exportFormat || 'json';
     const filename = `dashboard-${timestamp}.${format}`;
@@ -2716,7 +2714,7 @@ class Dashboard {
       return;
     }
     const validatedExportDir = pathValidation.resolvedPath;
-    const filepath = validatedExportDir + '/' + filename;
+    const filepath = join(validatedExportDir, filename);
 
     try {
       // Create export directory if it doesn't exist
@@ -2814,7 +2812,7 @@ class Dashboard {
 
       const snapshotDir = getSnapshotsDirectory();
       const filename = generateSnapshotFilename('dashboard');
-      const filepath = `${snapshotDir}/${filename}`;
+      const filepath = join(snapshotDir, filename);
 
       const result = exportSnapshotToFile(snapshot, filepath);
 
@@ -2870,8 +2868,10 @@ class Dashboard {
     this.w.snapshotPrompt.input('Enter snapshot file path:', '', (err, value) => {
       if (!err && value && value.trim()) {
         let filePath = value.trim();
-        if (filePath.startsWith('~')) {
-          filePath = os.homedir() + filePath.substring(1);
+        if (filePath.startsWith('~/')) {
+          filePath = join(os.homedir(), filePath.slice(2));
+        } else if (filePath.startsWith('~')) {
+          filePath = join(os.homedir(), filePath.slice(1));
         }
         this.loadAndApplySnapshot(filePath);
       }
@@ -3816,12 +3816,12 @@ class Dashboard {
         break;
       case 11: // Cycle export directory: ~/.openclaw/exports -> ~/Downloads -> ~/Desktop -> Custom
         const exportDirs = [
-          os.homedir() + '/.openclaw/exports',
-          os.homedir() + '/Downloads',
-          os.homedir() + '/Desktop',
+          join(os.homedir(), '.openclaw', 'exports'),
+          join(os.homedir(), 'Downloads'),
+          join(os.homedir(), 'Desktop'),
           'custom'
         ];
-        const currentExportDir = this.settings.exportDirectory || os.homedir() + '/.openclaw/exports';
+        const currentExportDir = this.settings.exportDirectory || join(os.homedir(), '.openclaw', 'exports');
         let currentDirIdx = exportDirs.indexOf(currentExportDir);
         if (currentDirIdx === -1) {
           // Current dir is custom, start from beginning
@@ -3845,8 +3845,10 @@ class Dashboard {
           this.w.customPathPrompt.input('Enter custom export path (~ for home):', currentExportDir, (err, value) => {
             if (!err && value && value.trim()) {
               let customPath = value.trim();
-              if (customPath.startsWith('~')) {
-                customPath = os.homedir() + customPath.substring(1);
+              if (customPath.startsWith('~/')) {
+                customPath = join(os.homedir(), customPath.slice(2));
+              } else if (customPath.startsWith('~')) {
+                customPath = join(os.homedir(), customPath.slice(1));
               }
               const pathValidation = validateFilePath(customPath);
               if (pathValidation.valid) {
@@ -4619,28 +4621,20 @@ class Dashboard {
   async start(updateProgress) {
     const progress = updateProgress || (() => {});
     
-    // Initialize the database
-    progress(15, 'Initializing database...');
-    await database.initDatabase();
-    
-    // Clean up old data (older than 30 days) on startup
-    progress(25, 'Cleaning up old data...');
-    database.cleanupOldData(30);
-    
     // Initialize gateway manager with settings
-    progress(35, 'Initializing gateway...');
+    progress(15, 'Initializing gateway...');
     gatewayManager.init(this.settings);
     
     // Start performance monitoring
-    progress(45, 'Starting performance monitor...');
+    progress(30, 'Starting performance monitor...');
     performanceMonitor.start();
     
     // Wire up worker pool for metrics tracking
-    progress(55, 'Starting workers...');
+    progress(45, 'Starting workers...');
     setWorkerPool(workerPool);
     
     // Start watching for config hot-reload
-    progress(65, 'Setting up config watcher...');
+    progress(60, 'Setting up config watcher...');
     this.startConfigWatcher();
     
     // Start watching for plugin hot-reload if --watch flag is set
@@ -5135,7 +5129,7 @@ class Dashboard {
           }
         }
       } catch (err) {
-        // eslint-disable-next-line no-console
+         
         logger.error('Session fetch error:', err.message);
         this.data.sessions = this.data.sessions || [];
         this.data.openclaw = { gateway: { reachable: false } };
@@ -5216,8 +5210,6 @@ class Dashboard {
       });
 
       this.render();
-      // Store metrics in database for historical tracking
-      database.storeMetricsSnapshot(this.data);
     } catch (e) {}
   }
 
@@ -5737,8 +5729,6 @@ class WebDashboard extends Dashboard {
     }
 
     // Initialize data fetching (reuse parent's start() logic but without UI)
-    await database.initDatabase();
-    database.cleanupOldData(30);
     gatewayManager.init(this.settings);
     performanceMonitor.start();
 

package/package.json

@@ -1,16 +1,14 @@
 {
   "name": "claw-dashboard",
-  "version": "2.1.1",
+  "version": "2.2.0",
   "description": "A beautiful console dashboard for monitoring OpenClaw instances — inspired by htop/btop/mactop",
   "main": "index.js",
   "exports": {
     ".": {
-      "import": "./index.js",
-      "require": "./index.cjs"
+      "import": "./index.js"
     },
     "./widgets": {
-      "import": "./src/widgets/index.js",
-      "require": "./dist/widgets.cjs"
+      "import": "./src/widgets/index.js"
     },
     "./package.json": "./package.json"
   },
@@ -20,6 +18,19 @@
   "man": [
     "./man/clawdash.1"
   ],
+  "files": [
+    "index.js",
+    "src/**/*.js",
+    "src/**/*.ts",
+    "!src/database.js",
+    "man/clawdash.1",
+    "docs/*.md",
+    "schemas/*.json",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "package.json"
+  ],
   "type": "module",
   "scripts": {
     "start": "node index.js",
@@ -31,7 +42,6 @@
     "coverage:clean": "rm -rf coverage",
     "build": "node esbuild.config.js",
     "build:dev": "node esbuild.config.js --dev",
-    "build:cjs": "node build-cjs.js",
     "lint": "eslint src/ --ignore-pattern 'src/workers/**'",
     "release": "node scripts/release.js",
     "release:sign": "node scripts/release.js --sign",
@@ -57,23 +67,22 @@
   "author": "Kevin Smith",
   "license": "MIT",
   "engines": {
-    "node": ">=18"
+    "node": ">=20"
   },
   "dependencies": {
     "@pm2/blessed": "^0.1.81",
     "blessed": "npm:@pm2/blessed@^0.1.81",
     "chalk": "^5.3.0",
-    "sql.js": "^1.14.0",
     "systeminformation": "^5.21.22"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "c8": "^11.0.0",
-    "esbuild": "^0.27.3",
+    "c8": "^12.0.0",
+    "esbuild": "^0.28.1",
     "eslint": "^10.0.2",
     "husky": "^9.1.7",
     "jest": "^30.2.0",
-    "lint-staged": "^16.3.0"
+    "lint-staged": "^17.2.0"
   },
   "lint-staged": {
     "src/**/*.{js,mjs,cjs}": [
@@ -85,6 +94,7 @@
     "xml2js": "^0.6.2",
     "form-data": "^4.0.0",
     "qs": "^6.14.1",
-    "tough-cookie": "^5.0.0"
+    "tough-cookie": "^5.0.0",
+    "brace-expansion": "^5.0.8"
   }
 }

package/src/auto-save.js

@@ -22,15 +22,21 @@ function validateFilePath(filePath) {
   }
 
   // Expand tilde to home directory
-  const resolvedPath = filePath.startsWith('~')
+  const resolvedPath = filePath.startsWith('~/')
+    ? path.join(os.homedir(), filePath.slice(2))
+    : filePath.startsWith('~')
     ? path.join(os.homedir(), filePath.slice(1))
     : path.resolve(filePath);
 
-  // Check for path traversal - allow home directory and temp directories
+  // Check for path traversal - allow home directory and temp directories (sep + === to prevent prefix collisions e.g. /home/userfoo; matches index/snapshot/security style)
   const homeDir = os.homedir();
   const tempDirs = ['/tmp', os.tmpdir()];
-  const isInAllowedDir = resolvedPath.startsWith(homeDir) ||
-    tempDirs.some(tmpDir => resolvedPath.startsWith(tmpDir));
+  const resolvedHome = path.resolve(homeDir);
+  const isInAllowedDir = resolvedPath.startsWith(resolvedHome + path.sep) || resolvedPath === resolvedHome ||
+    tempDirs.some(tmpDir => {
+      const rtmp = path.resolve(tmpDir);
+      return resolvedPath.startsWith(rtmp + path.sep) || resolvedPath === rtmp;
+    });
   if (!isInAllowedDir) {
     return { valid: false, error: 'Path must be within home or temp directory' };
   }
@@ -354,7 +360,7 @@ export class AutoSaveManager {
       }
 
       // Ensure directory exists
-      const dir = pathValidation.resolvedPath.substring(0, pathValidation.resolvedPath.lastIndexOf('/'));
+      const dir = path.dirname(pathValidation.resolvedPath);
       if (!fs.existsSync(dir)) {
         fs.mkdirSync(dir, { recursive: true });
       }

package/src/cli/export-snapshot.js

@@ -82,7 +82,9 @@ Examples:
     let filePath;
     if (outputPath) {
       let resolvedPath = outputPath;
-      if (outputPath.startsWith('~')) {
+      if (outputPath.startsWith('~/')) {
+        resolvedPath = join(os.homedir(), outputPath.slice(2));
+      } else if (outputPath.startsWith('~')) {
         resolvedPath = join(os.homedir(), outputPath.slice(1));
       }
       filePath = resolve(resolvedPath);

package/src/cli/import-snapshot.js

@@ -117,7 +117,9 @@ Examples:
   try {
     // Resolve the path
     let resolvedPath = filePath;
-    if (filePath.startsWith('~')) {
+    if (filePath.startsWith('~/')) {
+      resolvedPath = join(os.homedir(), filePath.slice(2));
+    } else if (filePath.startsWith('~')) {
       resolvedPath = join(os.homedir(), filePath.slice(1));
     }
     resolvedPath = resolve(resolvedPath);

package/src/config.js

@@ -101,17 +101,6 @@ export const CACHE_CONFIG = {
   container: { ttl: CACHE_TTL.CONTAINER },
 };
 
-// ============================================================================
-// DATABASE SETTINGS
-// ============================================================================
-
-export const DATABASE = {
-  PATH: os.homedir() + '/.openclaw/dashboard-history.db',
-  SAVE_INTERVAL_MS: 30000,     // Save every 30 seconds
-  CLEANUP_INTERVAL_MS: 60 * 60 * 1000,  // Cleanup every hour
-  DEFAULT_RETENTION_DAYS: 30,
-};
-
 // ============================================================================
 // CHECKSUM VERIFICATION SETTINGS
 // ============================================================================
@@ -375,6 +364,12 @@ export const WORKER_OVERLOAD = {
 
 export const WEB = {
   DEFAULT_PORT: 18790,        // Default port for web interface
+  // SECURITY NOTE (pre-existing defaults; --web is for remote/trusted use only):
+  // - HOST '0.0.0.0' binds all interfaces (consider '127.0.0.1' for localhost-only).
+  // - CORS '*' allows all (restrict to specific origins in production).
+  // - AUTH.ENABLED=false (opt-in only; enable + keys for production).
+  // Health endpoint intentionally unauthed. See web-server.js and README for guidance.
+  // These were not changed in lean trim to avoid UX break for existing --web users.
   HOST: '0.0.0.0',            // Bind to all interfaces by default
   CORS_ORIGIN: '*',           // CORS origin (restrict in production)
   REQUEST_TIMEOUT: 30000,       // Request timeout in milliseconds
@@ -396,8 +391,8 @@ export const WEB = {
   },
   // CORS configuration
   CORS: {
-    // Production: specify allowed origins as array (e.g., ['https://example.com'])
-    // Development: use '*' to allow all origins
+    // SECURITY: Production: specify allowed origins as array (e.g., ['https://example.com'])
+    // Development: use '*' to allow all origins (default here; see note on WEB.HOST/AUTH)
     ALLOWED_ORIGINS: '*',     // Default to allow all (restrict in production)
     ALLOWED_METHODS: ['GET', 'POST', 'OPTIONS'],
     ALLOWED_HEADERS: ['Content-Type', 'Authorization'],
@@ -406,7 +401,7 @@ export const WEB = {
   },
   // Authentication configuration
   AUTH: {
-    ENABLED: false,           // Disabled by default (enable explicitly)
+    ENABLED: false,           // Disabled by default - must explicitly enable (see WEB security note above)
     HEADER_NAME: 'Authorization',  // HTTP header for API key
     SCHEME: 'Bearer',         // Auth scheme (Bearer, ApiKey, etc.)
     KEY_PREFIX: 'cd_',        // Prefix for auto-generated API keys
@@ -656,7 +651,6 @@ export default {
   UI,
   CACHE_TTL,
   CACHE_CONFIG,
-  DATABASE,
   RETRY,
   DEFAULT_RETRY_OPTIONS,
   AUTO_RETRY,

package/src/errors.js

@@ -94,14 +94,6 @@ export class UIError extends DashboardError {
   }
 }
 
-// Database errors
-export class DatabaseError extends DashboardError {
-  constructor(message, details = {}) {
-    super(message, 'DATABASE_ERROR', details);
-    this.name = 'DatabaseError';
-  }
-}
-
 // Validation errors
 export class ValidationError extends DashboardError {
   constructor(message, details = {}) {
@@ -147,7 +139,6 @@ export const ERROR_CODES = {
   AUTH_ERROR: 'AUTH_ERROR',
   NETWORK_ERROR: 'NETWORK_ERROR',
   UI_ERROR: 'UI_ERROR',
-  DATABASE_ERROR: 'DATABASE_ERROR',
   VALIDATION_ERROR: 'VALIDATION_ERROR',
   TIMEOUT_ERROR: 'TIMEOUT_ERROR',
   CHECKSUM_ERROR: 'CHECKSUM_ERROR',

package/src/security.js

@@ -394,8 +394,12 @@ function validatePluginPath(inputPath, options = {}) {
 
     // Check for hidden files/directories (starting with .)
     if (part.startsWith('.') && part !== '.' && part !== '..') {
-      // Allow specific hidden files like .gitkeep but not arbitrary ones
-      const allowedHidden = ['.gitkeep', '.gitignore', '.npmignore'];
+      // Allow specific hidden files like .gitkeep but not arbitrary ones.
+      // '.openclaw' whitelisted for standard ~/.openclaw/snapshots + /plugins flows (PATHS.OPENCLAW_DIR etc.)
+      // and user arbitrary paths under dot-dirs; other dot components still rejected for security.
+      // This rule (via shared validatePluginPath) applies to snapshot export/import (even with allowAbsolute:true, e.g. ~/.config/.secret/snap.json or /tmp/.foo/bar rejected); delete uses allowedDirs.
+      // See the validateFilePath comment in index.js (settings uses different/broader rules under ~), and export/import/delete comments in snapshot.js.
+      const allowedHidden = ['.gitkeep', '.gitignore', '.npmignore', '.openclaw'];
       if (!allowedHidden.includes(part)) {
         return { valid: false, path: null, error: `Hidden files/directories are not allowed: ${part}` };
       }