claw-dashboard 2.1.1 → 2.2.0

package/src/snapshot.js

@@ -6,9 +6,10 @@
 
 import fs from 'fs';
 import os from 'os';
-import { join } from 'path';
+import path from 'path';
 import { PATHS, DEFAULT_SETTINGS, DASHBOARD_VERSION } from './config.js';
 import logger from './logger.js';
+import { validatePluginPath } from './security.js';
 
 /**
  * Snapshot schema version for compatibility checking
@@ -186,21 +187,34 @@ export function mergeSnapshotSettings(existingSettings, snapshotSettings) {
  */
 export function exportSnapshotToFile(snapshot, filePath) {
   try {
-    const dir = filePath.substring(0, filePath.lastIndexOf('/'));
+    // Route through validator (allowAbsolute for documented arbitrary user paths e.g. ~/my-layout.json or /tmp/snap.json;
+    // traversal/characters/hidden still apply: hidden dirs only if whitelisted (see the allowedHidden list and hidden check in security.js: only .openclaw etc allowed; e.g. ~/.config/.secret/ or /tmp/.foo/ rejected even with abs).
+    // no allowedDirs to permit user-chosen locations (delete uses internal-dir restriction).
+    const validation = validatePluginPath(filePath, {
+      allowAbsolute: true,
+      mustExist: false,
+      expectedType: null,
+    });
+    if (!validation.valid) {
+      return { success: false, error: validation.error || 'Invalid snapshot path' };
+    }
+    const safePath = validation.path || filePath;
+
+    const dir = path.dirname(safePath);
     if (dir && !fs.existsSync(dir)) {
       fs.mkdirSync(dir, { recursive: true });
     }
 
-    fs.writeFileSync(filePath, JSON.stringify(snapshot, null, 2));
+    fs.writeFileSync(safePath, JSON.stringify(snapshot, null, 2));
 
     // Set secure permissions (owner read/write only)
     try {
-      fs.chmodSync(filePath, 0o600);
+      fs.chmodSync(safePath, 0o600);
     } catch (permErr) {
       logger.warn(`Could not set permissions on snapshot: ${permErr.message}`);
     }
 
-    return { success: true, path: filePath };
+    return { success: true, path: safePath };
   } catch (err) {
     return { success: false, error: err.message };
   }
@@ -213,16 +227,29 @@ export function exportSnapshotToFile(snapshot, filePath) {
  */
 export function importSnapshotFromFile(filePath) {
   try {
-    if (!fs.existsSync(filePath)) {
-      return { success: false, error: `File not found: ${filePath}` };
+    // Route through validator (allowAbsolute:true for arbitrary user-specified import paths per CLI/TUI/docs;
+    // traversal/character/hidden checks still enforced; omit allowedDirs to permit outside snap dir).
+    // Exact rule (shared w/ plugins): abs paths ok but dot-dir components limited to whitelisted ('.openclaw' etc per the allowedHidden list in security.js); other dots like .secret or .foo under ~ or /tmp are rejected (tests cover intended .openclaw + non-dot).
+    const validation = validatePluginPath(filePath, {
+      allowAbsolute: true,
+      mustExist: false,
+      expectedType: null,
+    });
+    if (!validation.valid) {
+      return { success: false, error: validation.error || 'Invalid snapshot path' };
     }
+    const safePath = validation.path || filePath;
 
-    const data = fs.readFileSync(filePath, 'utf8');
+    if (!fs.existsSync(safePath)) {
+      return { success: false, error: `File not found: ${safePath}` };
+    }
+
+    const data = fs.readFileSync(safePath, 'utf8');
     const snapshot = JSON.parse(data);
 
-    const validation = validateSnapshot(snapshot);
-    if (!validation.valid) {
-      return { success: false, error: validation.error };
+    const schemaValidation = validateSnapshot(snapshot);
+    if (!schemaValidation.valid) {
+      return { success: false, error: schemaValidation.error };
     }
 
     return { success: true, snapshot };
@@ -250,7 +277,7 @@ export function generateSnapshotFilename(name) {
  * @returns {string} Path to snapshots directory
  */
 export function getSnapshotsDirectory() {
-  return join(PATHS.OPENCLAW_DIR, 'snapshots');
+  return path.join(PATHS.OPENCLAW_DIR, 'snapshots');
 }
 
 /**
@@ -267,14 +294,14 @@ export function listSnapshots() {
     const files = fs.readdirSync(dir)
       .filter(f => f.endsWith('.json'))
       .map(f => {
-        const path = join(dir, f);
+        const filePath = path.join(dir, f);
         try {
-          const data = fs.readFileSync(path, 'utf8');
+          const data = fs.readFileSync(filePath, 'utf8');
           const snapshot = JSON.parse(data);
-          const stats = fs.statSync(path);
+          const stats = fs.statSync(filePath);
           return {
             filename: f,
-            path,
+            path: filePath,
             name: snapshot.name || 'Unnamed',
             description: snapshot.description || '',
             createdAt: snapshot.createdAt || stats.mtime.toISOString(),
@@ -303,22 +330,42 @@ export function listSnapshots() {
  */
 export function deleteSnapshot(filename) {
   const dir = getSnapshotsDirectory();
-  const filePath = join(dir, filename);
-
-  // Security: ensure the resolved path is within snapshots directory
-  const resolvedPath = fs.realpathSync.safe
-    ? fs.realpathSync(filePath)
-    : filePath;
+  const filePath = path.join(dir, filename);
+
+  // Security: route through validator + proper realpath + trailing sep (fixes pre-existing broken .safe + startsWith).
+  // Mirrors validatePluginPath + validateFilePath patterns used elsewhere.
+  // For internal snapshots only (always under ~/.openclaw/snapshots); abs user paths for export/import use allowAbsolute no allowedDirs (see rules in exportSnapshotToFile/importSnapshotFromFile comments + security hidden whitelist).
+  const validation = validatePluginPath(filePath, {
+    allowedDirs: [dir],
+    allowAbsolute: true,
+    mustExist: false,
+    expectedType: null,
+  });
+  if (!validation.valid) {
+    return { success: false, error: validation.error || 'Invalid snapshot path' };
+  }
+  const safePath = validation.path || filePath;
 
-  if (!resolvedPath.startsWith(dir)) {
-    return { success: false, error: 'Invalid snapshot path' };
+  let unlinkPath = safePath;
+  try {
+    const resolvedPath = fs.realpathSync(safePath);
+    const resolvedDir = fs.realpathSync(dir);
+    if (!resolvedPath.startsWith(resolvedDir + path.sep) && resolvedPath !== resolvedDir) {
+      return { success: false, error: 'Invalid snapshot path' };
+    }
+    unlinkPath = resolvedPath;
+  } catch (realErr) {
+    // If file doesn't exist yet, proceed to not-found (or let later check handle)
+    if (!fs.existsSync(safePath)) {
+      return { success: false, error: 'Snapshot not found' };
+    }
   }
 
   try {
-    if (!fs.existsSync(filePath)) {
+    if (!fs.existsSync(unlinkPath)) {
       return { success: false, error: 'Snapshot not found' };
     }
-    fs.unlinkSync(filePath);
+    fs.unlinkSync(unlinkPath);
     return { success: true };
   } catch (err) {
     return { success: false, error: err.message };

package/src/web-server.js

@@ -298,16 +298,6 @@ class CorsManager {
   }
 }
 
-/**
- * Create CORS headers for HTTP responses (legacy function for backward compatibility)
- * @returns {Object} CORS headers
- * @deprecated Use CorsManager instead
- */
-function getCorsHeaders() {
-  const corsManager = new CorsManager();
-  return corsManager.getHeaders({ headers: {} });
-}
-
 /**
  * Send JSON response
  * @param {http.ServerResponse} res - HTTP response
@@ -334,6 +324,13 @@ function sendError(res, statusCode, message, headers = {}, extra = {}) {
 
 /**
  * Web Server class for exposing dashboard data via HTTP API
+ *
+ * SECURITY NOTE (pre-existing defaults, untouched by lean trim to preserve --web UX):
+ * - Binds to 0.0.0.0 + CORS * + auth disabled by default (see config WEB.HOST/AUTH/CORS).
+ * - Intended for trusted/remote/localhost use or with explicit --web-host + auth keys enabled.
+ * - Health is intentionally public; other endpoints (sessions with tokens, logs, metrics) are sensitive.
+ * - Recommend: bind localhost, enable auth, restrict CORS origins in production.
+ * No changes here as trim focused on deadcode/lean (db/CJS/legacy); no new surface added.
  */
 export class WebServer {
   constructor(options = {}) {

package/.c8rc.json

@@ -1,38 +0,0 @@
-{
-  "all": true,
-  "include": [
-    "index.js",
-    "src/**/*.js"
-  ],
-  "exclude": [
-    "node_modules/**",
-    "coverage/**",
-    "tests/**",
-    "dist/**",
-    "scripts/**",
-    "examples/**",
-    "src/workers/**",
-    "**/*.test.js",
-    "**/*.config.js"
-  ],
-  "reporter": [
-    "text",
-    "text-summary",
-    "lcov",
-    "html",
-    "json-summary"
-  ],
-  "check-coverage": true,
-  "statements": 35,
-  "branches": 30,
-  "functions": 20,
-  "lines": 35,
-  "watermarks": {
-    "statements": [70, 90],
-    "branches": [65, 85],
-    "functions": [70, 90],
-    "lines": [70, 90]
-  },
-  "report-dir": "./coverage",
-  "temp-dir": "./coverage/.tmp"
-}

package/.dockerignore

@@ -1,68 +0,0 @@
-# Dependencies
-node_modules
-npm-debug.log*
-yarn-debug.log*
-yarn-error.log*
-
-# Testing
-tests/
-coverage/
-*.test.js
-*.spec.js
-jest.config.js
-
-# Documentation
-docs/
-*.md
-CONTRIBUTING.md
-CHANGELOG.md
-README.md
-TODO.md
-
-# Git
-.git
-.gitignore
-.gitattributes
-
-# CI/CD
-.github/
-.travis.yml
-.gitlab-ci.yml
-
-# IDE
-.vscode/
-.idea/
-*.swp
-*.swo
-*~
-
-# OS
-.DS_Store
-Thumbs.db
-
-# Logs
-logs/
-*.log
-
-# Runtime data
-pids/
-*.pid
-*.seed
-*.pid.lock
-
-# Optional npm cache directory
-.npm
-
-# Optional eslint cache
-.eslintcache
-
-# Build outputs
-dist/
-build/
-
-# Worktrees
-.worktrees/
-
-# Installation scripts (not needed in container)
-install.sh
-start.sh

package/.github/dependabot.yml

@@ -1,45 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: 'npm'
-    directory: '/'
-    schedule:
-      interval: 'weekly'
-      day: 'monday'
-      time: '09:00'
-    open-pull-requests-limit: 10
-    reviewers:
-      - 'spleck'
-    assignees:
-      - 'spleck'
-    commit-message:
-      prefix: 'chore(deps)'
-      include: 'scope'
-    labels:
-      - 'dependencies'
-    groups:
-      dev-dependencies:
-        patterns:
-          - '*'
-        exclude-patterns:
-          - 'blessed*'
-          - 'systeminformation'
-      production-dependencies:
-        patterns:
-          - 'blessed*'
-          - 'systeminformation'
-
-  - package-ecosystem: 'github-actions'
-    directory: '/'
-    schedule:
-      interval: 'weekly'
-      day: 'monday'
-      time: '09:00'
-    open-pull-requests-limit: 5
-    reviewers:
-      - 'spleck'
-    commit-message:
-      prefix: 'chore(actions)'
-      include: 'scope'
-    labels:
-      - 'dependencies'
-      - 'github-actions'

package/.github/pull_request_template.md

@@ -1,39 +0,0 @@
-## Description
-
-Brief description of the changes in this PR.
-
-## Type of Change
-
-- [ ] Bug fix (non-breaking change that fixes an issue)
-- [ ] New feature (non-breaking change that adds functionality)
-- [ ] Breaking change (fix or feature that would cause existing functionality to not work as expected)
-- [ ] Documentation update
-- [ ] Refactoring (no functional changes)
-- [ ] Performance improvement
-- [ ] Test addition or improvement
-
-## Checklist
-
-- [ ] I have run `npm test` and all tests pass
-- [ ] I have run `npm run build` and the build succeeds
-- [ ] My code follows the project's style guidelines
-- [ ] I have performed a self-review of my code
-- [ ] I have commented my code, particularly in hard-to-understand areas
-- [ ] I have made corresponding changes to the documentation
-- [ ] My changes generate no new warnings
-- [ ] I have added tests that prove my fix is effective or that my feature works
-- [ ] New and existing unit tests pass locally with my changes
-
-## Testing
-
-Describe the tests you ran and how to reproduce them:
-
-## Screenshots (if applicable)
-
-## Related Issues
-
-Fixes #(issue number)
-
-## Additional Notes
-
-Any other information that would be helpful for reviewers.

package/.github/workflows/ci.yml

@@ -1,147 +0,0 @@
-name: CI
-
-on:
-  push:
-    branches: [main, dev]
-    paths-ignore:
-      - '**.md'
-      - 'docs/**'
-      - '.github/*.md'
-  pull_request:
-    branches: [main]
-    paths-ignore:
-      - '**.md'
-      - 'docs/**'
-      - '.github/*.md'
-
-jobs:
-  test:
-    name: Test (Node ${{ matrix.node-version }})
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [18, 20, 22]
-      fail-fast: false
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v6
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run linter (ESLint checks)
-        run: npm run lint
-
-      - name: Run tests
-        run: npm test
-
-      - name: Run tests with coverage
-        if: matrix.node-version == 20
-        run: npm run test:coverage
-
-      - name: Upload coverage to Codecov
-        if: matrix.node-version == 20 && github.event_name != 'pull_request'
-        uses: codecov/codecov-action@v5
-        with:
-          files: ./coverage/lcov.info
-          fail_ci_if_error: false
-          verbose: true
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-
-  build:
-    name: Build
-    runs-on: ubuntu-latest
-    needs: test
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: 20
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Build distribution
-        run: npm run build
-
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
-        with:
-          name: dist
-          path: dist/
-          retention-days: 7
-
-  docker:
-    name: Docker Build
-    runs-on: ubuntu-latest
-    needs: test
-    if: github.event_name == 'pull_request'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Build Docker image
-        uses: docker/build-push-action@v5
-        with:
-          context: .
-          push: false
-          tags: claw-dashboard:test
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
-
-  security-audit:
-    name: Security Audit
-    runs-on: ubuntu-latest
-    needs: test
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: 20
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run npm audit
-        run: npm audit --audit-level=moderate
-        continue-on-error: true
-
-      - name: Run Trivy vulnerability scanner
-        uses: aquasecurity/trivy-action@master
-        with:
-          scan-type: 'fs'
-          scan-ref: '.'
-          format: 'sarif'
-          output: 'trivy-results.sarif'
-
-      - name: Upload Trivy scan results
-        uses: github/codeql-action/upload-sarif@v4
-        if: always()
-        with:
-          sarif_file: 'trivy-results.sarif'

package/.github/workflows/release.yml

@@ -1,40 +0,0 @@
-name: Release
-
-on:
-  release:
-    types: [created, published]
-
-jobs:
-  build-and-publish:
-    name: Build and Publish
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: 20
-          cache: 'npm'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests
-        run: npm test
-
-      - name: Build all bundles
-        run: |
-          npm run build
-          npm run build:cjs
-
-      - name: Publish to npm
-        run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/security.yml

@@ -1,84 +0,0 @@
-name: Security Audit
-
-on:
-  push:
-    branches: [main, dev]
-  pull_request:
-    branches: [main]
-  schedule:
-    # Run daily at 2:00 AM UTC
-    - cron: '0 2 * * *'
-  workflow_dispatch:
-
-jobs:
-  npm-audit:
-    name: NPM Audit
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: 20
-          cache: 'npm'
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run npm audit
-        run: |
-          npm audit --audit-level=moderate || exit_code=$?
-          if [ "${exit_code:-0}" -eq 0 ]; then
-            echo "No vulnerabilities found"
-          elif [ "${exit_code:-0}" -eq 1 ]; then
-            echo "Vulnerabilities found! See above for details."
-            exit 1
-          fi
-
-  dependency-review:
-    name: Dependency Review
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Dependency Review
-        uses: actions/dependency-review-action@v4
-        with:
-          fail-on-severity: moderate
-          comment-summary-in-pr: true
-
-  codeql-analysis:
-    name: CodeQL Analysis
-    runs-on: ubuntu-latest
-    permissions:
-      actions: read
-      contents: read
-      security-events: write
-
-    strategy:
-      fail-fast: false
-      matrix:
-        language: ['javascript']
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
-        with:
-          languages: ${{ matrix.language }}
-
-      - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
-
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
-        with:
-          category: "/language:${{matrix.language}}"

package/.husky/pre-commit

@@ -1 +0,0 @@
-npx lint-staged