clawhatch 0.1.0

package/dist/discover.js

@@ -0,0 +1,281 @@
+/**
+ * File discovery for OpenClaw installations.
+ *
+ * Finds all relevant files to scan, handling:
+ * - Default and custom paths
+ * - Symlink detection and boundary checking
+ * - Windows/macOS/Linux path differences
+ * - Graceful missing-file handling
+ */
+import { lstat, readlink, readdir, access, constants } from "node:fs/promises";
+import { homedir, platform } from "node:os";
+import { join, resolve } from "node:path";
+import { glob } from "glob";
+/** Common alternative locations for OpenClaw installations */
+function getAlternativePaths() {
+    const home = homedir();
+    const paths = [join(home, ".openclaw")];
+    if (platform() === "win32") {
+        const appdata = process.env.APPDATA;
+        if (appdata) {
+            paths.push(join(appdata, "openclaw"));
+        }
+        paths.push(join(home, "AppData", "Roaming", "openclaw"));
+    }
+    return paths;
+}
+/**
+ * Resolve ~ to home directory.
+ */
+function expandHome(p) {
+    if (p.startsWith("~")) {
+        return join(homedir(), p.slice(1));
+    }
+    return p;
+}
+/**
+ * Check if a path is a symlink and if it stays within expected boundaries.
+ * Returns the resolved real path, or null if it's suspicious.
+ */
+async function safeResolvePath(filePath, expectedRoot) {
+    try {
+        const lstats = await lstat(filePath);
+        if (lstats.isSymbolicLink()) {
+            const target = await readlink(filePath);
+            const resolved = resolve(filePath, "..", target);
+            // FIX: Only use case-insensitive comparison on case-insensitive filesystems (Windows/macOS)
+            const caseSensitive = platform() === "linux";
+            const outsideBoundary = caseSensitive
+                ? !resolved.startsWith(expectedRoot)
+                : !resolved.toLowerCase().startsWith(expectedRoot.toLowerCase());
+            return { path: resolved, isSymlink: true, outsideBoundary };
+        }
+        return { path: filePath, isSymlink: false, outsideBoundary: false };
+    }
+    catch {
+        return { path: filePath, isSymlink: false, outsideBoundary: false };
+    }
+}
+/**
+ * Auto-detect OpenClaw installation path.
+ */
+export async function findOpenClawDir(customPath) {
+    if (customPath) {
+        const expanded = expandHome(customPath);
+        try {
+            await access(expanded, constants.R_OK);
+            return expanded;
+        }
+        catch {
+            return null;
+        }
+    }
+    for (const candidate of getAlternativePaths()) {
+        try {
+            await access(candidate, constants.R_OK);
+            return candidate;
+        }
+        catch {
+            continue;
+        }
+    }
+    return null;
+}
+/**
+ * Discover all scannable files in an OpenClaw installation.
+ */
+export async function discoverFiles(openclawDir, workspaceDir) {
+    const symlinkWarnings = [];
+    const resolvedRoot = resolve(openclawDir);
+    const files = {
+        configPath: null,
+        envPath: null,
+        credentialFiles: [],
+        authProfileFiles: [],
+        sessionLogFiles: [],
+        workspaceMarkdownFiles: [],
+        skillFiles: [],
+        customCommandFiles: [],
+        skillPackageFiles: [],
+        privateKeyFiles: [],
+        sshKeyFiles: [],
+        openclawDir: resolvedRoot,
+        workspaceDir: workspaceDir ? resolve(workspaceDir) : null,
+    };
+    // Config file
+    const configCandidate = join(resolvedRoot, "openclaw.json");
+    try {
+        const resolved = await safeResolvePath(configCandidate, resolvedRoot);
+        if (resolved.isSymlink && resolved.outsideBoundary) {
+            symlinkWarnings.push(`Symlink: ${configCandidate} -> ${resolved.path} (outside OpenClaw directory)`);
+        }
+        else {
+            await access(resolved.path, constants.R_OK);
+            files.configPath = resolved.path;
+        }
+    }
+    catch {
+        // No config file
+    }
+    // .env file
+    const envCandidate = join(resolvedRoot, ".env");
+    try {
+        await access(envCandidate, constants.R_OK);
+        files.envPath = envCandidate;
+    }
+    catch {
+        // No .env
+    }
+    // Credential files
+    try {
+        const credDir = join(resolvedRoot, "credentials");
+        const resolved = await safeResolvePath(credDir, resolvedRoot);
+        if (resolved.isSymlink && resolved.outsideBoundary) {
+            symlinkWarnings.push(`Symlink: credentials/ -> ${resolved.path} (outside OpenClaw directory)`);
+        }
+        else {
+            try {
+                const credFiles = await readdir(credDir);
+                for (const f of credFiles) {
+                    if (f.endsWith(".json")) {
+                        files.credentialFiles.push(join(credDir, f));
+                    }
+                }
+            }
+            catch {
+                // No credentials dir
+            }
+        }
+    }
+    catch {
+        // Can't stat
+    }
+    // Auth profile files (agents/*/auth-profiles.json)
+    try {
+        const matches = await glob("agents/*/auth-profiles.json", {
+            cwd: resolvedRoot,
+            absolute: true,
+        });
+        files.authProfileFiles = matches;
+    }
+    catch {
+        // glob failed
+    }
+    // Session log files (agents/*/sessions/*.jsonl)
+    try {
+        const matches = await glob("agents/*/sessions/*.jsonl", {
+            cwd: resolvedRoot,
+            absolute: true,
+        });
+        files.sessionLogFiles = matches;
+    }
+    catch {
+        // glob failed
+    }
+    // Skill files (managed)
+    try {
+        const matches = await glob("skills/*/SKILL.md", {
+            cwd: resolvedRoot,
+            absolute: true,
+        });
+        files.skillFiles = matches;
+    }
+    catch {
+        // glob failed
+    }
+    // Workspace files
+    if (workspaceDir) {
+        const wsResolved = resolve(workspaceDir);
+        const mdFiles = ["SOUL.md", "AGENTS.md", "TOOLS.md", "MEMORY.md"];
+        for (const md of mdFiles) {
+            const candidate = join(wsResolved, md);
+            try {
+                await access(candidate, constants.R_OK);
+                files.workspaceMarkdownFiles.push(candidate);
+            }
+            catch {
+                // File doesn't exist
+            }
+        }
+        // memory/*.md
+        try {
+            const matches = await glob("memory/*.md", {
+                cwd: wsResolved,
+                absolute: true,
+            });
+            files.workspaceMarkdownFiles.push(...matches);
+        }
+        catch {
+            // glob failed
+        }
+        // Workspace skills
+        try {
+            const matches = await glob("skills/*/SKILL.md", {
+                cwd: wsResolved,
+                absolute: true,
+            });
+            files.skillFiles.push(...matches);
+        }
+        catch {
+            // glob failed
+        }
+        // Custom command files (.claude/commands/*.md)
+        try {
+            const matches = await glob(".claude/commands/*.md", {
+                cwd: wsResolved,
+                absolute: true,
+            });
+            files.customCommandFiles.push(...matches);
+        }
+        catch {
+            // glob failed
+        }
+        // Skill package.json files (workspace)
+        try {
+            const matches = await glob("skills/*/package.json", {
+                cwd: wsResolved,
+                absolute: true,
+            });
+            files.skillPackageFiles.push(...matches);
+        }
+        catch {
+            // glob failed
+        }
+        // Private key files
+        try {
+            const matches = await glob("**/*.{pem,key,p12}", {
+                cwd: wsResolved,
+                absolute: true,
+                maxDepth: 3,
+            });
+            files.privateKeyFiles.push(...matches);
+        }
+        catch {
+            // glob failed
+        }
+        // SSH key files
+        for (const name of ["id_rsa", "id_ed25519"]) {
+            const candidate = join(wsResolved, name);
+            try {
+                await access(candidate, constants.R_OK);
+                files.sshKeyFiles.push(candidate);
+            }
+            catch {
+                // doesn't exist
+            }
+        }
+    }
+    // Skill package.json files (openclaw dir)
+    try {
+        const matches = await glob("skills/*/package.json", {
+            cwd: resolvedRoot,
+            absolute: true,
+        });
+        files.skillPackageFiles.push(...matches);
+    }
+    catch {
+        // glob failed
+    }
+    return { files, symlinkWarnings };
+}
+//# sourceMappingURL=discover.js.map

package/dist/discover.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discover.js","sourceRoot":"","sources":["../src/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAQ,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,8DAA8D;AAC9D,SAAS,mBAAmB;IAC1B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC;IAExC,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;QACpC,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,QAAgB,EAChB,YAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;YAC5B,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;YACjD,4FAA4F;YAC5F,MAAM,aAAa,GAAG,QAAQ,EAAE,KAAK,OAAO,CAAC;YAC7C,MAAM,eAAe,GAAG,aAAa;gBACnC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC;gBACpC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;YACnE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QAC9D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAmB;IAEnB,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACvC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,mBAAmB,EAAE,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YACxC,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,YAA2B;IAE3B,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAoB;QAC7B,UAAU,EAAE,IAAI;QAChB,OAAO,EAAE,IAAI;QACb,eAAe,EAAE,EAAE;QACnB,gBAAgB,EAAE,EAAE;QACpB,eAAe,EAAE,EAAE;QACnB,sBAAsB,EAAE,EAAE;QAC1B,UAAU,EAAE,EAAE;QACd,kBAAkB,EAAE,EAAE;QACtB,iBAAiB,EAAE,EAAE;QACrB,eAAe,EAAE,EAAE;QACnB,WAAW,EAAE,EAAE;QACf,WAAW,EAAE,YAAY;QACzB,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI;KAC1D,CAAC;IAEF,cAAc;IACd,MAAM,eAAe,GAAG,IAAI,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QACtE,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YACnD,eAAe,CAAC,IAAI,CAClB,YAAY,eAAe,OAAO,QAAQ,CAAC,IAAI,+BAA+B,CAC/E,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;YAC5C,KAAK,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC;QACnC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;IAED,YAAY;IACZ,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC3C,KAAK,CAAC,OAAO,GAAG,YAAY,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,UAAU;IACZ,CAAC;IAED,mBAAmB;IACnB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,eAAe,EAAE,CAAC;YACnD,eAAe,CAAC,IAAI,CAClB,4BAA4B,QAAQ,CAAC,IAAI,+BAA+B,CACzE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;gBACzC,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;oBAC1B,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;wBACxB,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;oBAC/C,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,qBAAqB;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,aAAa;IACf,CAAC;IAED,mDAAmD;IACnD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,6BAA6B,EAAE;YACxD,GAAG,EAAE,YAAY;YACjB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,KAAK,CAAC,gBAAgB,GAAG,OAAO,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IAED,gDAAgD;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,2BAA2B,EAAE;YACtD,GAAG,EAAE,YAAY;YACjB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,KAAK,CAAC,eAAe,GAAG,OAAO,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE;YAC9C,GAAG,EAAE,YAAY;YACjB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IAED,kBAAkB;IAClB,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;QAElE,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACvC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACxC,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,qBAAqB;YACvB,CAAC;QACH,CAAC;QAED,cAAc;QACd,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE;gBACxC,GAAG,EAAE,UAAU;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QAED,mBAAmB;QACnB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,EAAE;gBAC9C,GAAG,EAAE,UAAU;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE;gBAClD,GAAG,EAAE,UAAU;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QAED,uCAAuC;QACvC,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE;gBAClD,GAAG,EAAE,UAAU;gBACf,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QAED,oBAAoB;QACpB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE;gBAC/C,GAAG,EAAE,UAAU;gBACf,QAAQ,EAAE,IAAI;gBACd,QAAQ,EAAE,CAAC;aACZ,CAAC,CAAC;YACH,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QAED,gBAAgB;QAChB,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,EAAE,CAAC;YAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YACzC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;gBACxC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,0CAA0C;IAC1C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE;YAClD,GAAG,EAAE,YAAY;YACjB,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;AACpC,CAAC"}

package/dist/fixer.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Auto-fix system.
+ *
+ * Rules:
+ * 1. ALWAYS back up before modifying any file (.bak.{timestamp})
+ * 2. "safe" fixes: permissions, .gitignore, tokens — applied automatically
+ * 3. "behavioral" fixes: dmPolicy, sandbox changes — prompt user first
+ * 4. Log all changes made
+ */
+import type { Finding, FixResult } from "./types.js";
+/**
+ * Apply fixes for all auto-fixable findings.
+ * Returns a list of what was fixed and what was skipped.
+ */
+export declare function applyFixes(findings: Finding[], configPath: string | null, openclawDir: string): Promise<FixResult[]>;
+//# sourceMappingURL=fixer.d.ts.map

package/dist/fixer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fixer.d.ts","sourceRoot":"","sources":["../src/fixer.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AASH,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAkB,MAAM,YAAY,CAAC;AAuBrE;;;GAGG;AACH,wBAAsB,UAAU,CAC9B,QAAQ,EAAE,OAAO,EAAE,EACnB,UAAU,EAAE,MAAM,GAAG,IAAI,EACzB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,EAAE,CAAC,CAqEtB"}

package/dist/fixer.js

@@ -0,0 +1,361 @@
+/**
+ * Auto-fix system.
+ *
+ * Rules:
+ * 1. ALWAYS back up before modifying any file (.bak.{timestamp})
+ * 2. "safe" fixes: permissions, .gitignore, tokens — applied automatically
+ * 3. "behavioral" fixes: dmPolicy, sandbox changes — prompt user first
+ * 4. Log all changes made
+ */
+import { readFile, writeFile, copyFile, chmod } from "node:fs/promises";
+import { createInterface } from "node:readline";
+import { platform } from "node:os";
+import { join } from "node:path";
+import { randomBytes } from "node:crypto";
+import JSON5 from "json5";
+import chalk from "chalk";
+function backupPath(filePath) {
+    const ts = new Date().toISOString().replace(/[:.]/g, "-");
+    return `${filePath}.bak.${ts}`;
+}
+async function backupFile(filePath) {
+    const dest = backupPath(filePath);
+    await copyFile(filePath, dest);
+    return dest;
+}
+async function promptUser(message) {
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(`${message} [y/N] `, (answer) => {
+            rl.close();
+            resolve(answer.toLowerCase() === "y" || answer.toLowerCase() === "yes");
+        });
+    });
+}
+/**
+ * Apply fixes for all auto-fixable findings.
+ * Returns a list of what was fixed and what was skipped.
+ */
+export async function applyFixes(findings, configPath, openclawDir) {
+    const results = [];
+    const fixable = findings.filter((f) => f.autoFixable);
+    if (fixable.length === 0) {
+        console.log(chalk.dim("\n  No auto-fixable issues found.\n"));
+        return results;
+    }
+    console.log(chalk.cyan(`\n  Found ${fixable.length} auto-fixable issue(s). Applying fixes...\n`));
+    // Group config-related fixes to apply them in a single write
+    const configFixes = [];
+    const permissionFixes = [];
+    const otherFixes = [];
+    for (const f of fixable) {
+        if (isConfigFix(f)) {
+            configFixes.push(f);
+        }
+        else if (isPermissionFix(f)) {
+            permissionFixes.push(f);
+        }
+        else {
+            otherFixes.push(f);
+        }
+    }
+    // Apply config fixes (batch — single backup + write)
+    if (configFixes.length > 0 && configPath) {
+        const configResults = await applyConfigFixes(configFixes, configPath);
+        results.push(...configResults);
+    }
+    // Apply permission fixes
+    for (const f of permissionFixes) {
+        const r = await applyPermissionFix(f);
+        results.push(r);
+    }
+    // Apply other fixes (e.g., .gitignore)
+    for (const f of otherFixes) {
+        if (f.id === "SECRET-002") {
+            const r = await applyGitignoreFix(openclawDir);
+            results.push(r);
+        }
+    }
+    // Summary
+    console.log("");
+    const applied = results.filter((r) => r.applied).length;
+    const skipped = results.filter((r) => !r.applied).length;
+    console.log(chalk.green(`  ${applied} fix(es) applied, ${skipped} skipped.`));
+    for (const r of results) {
+        if (r.applied) {
+            console.log(chalk.green(`    + ${r.description}`));
+            if (r.backupPath) {
+                console.log(chalk.dim(`      Backup: ${r.backupPath}`));
+            }
+        }
+        else {
+            console.log(chalk.dim(`    - Skipped: ${r.description} (${r.skippedReason})`));
+        }
+    }
+    console.log("");
+    return results;
+}
+function isConfigFix(finding) {
+    // FIX: Removed IDENTITY-008 — applyConfigMutation doesn't implement it,
+    // so it would silently fail with "Mutation not implemented" message
+    return [
+        "IDENTITY-001", "IDENTITY-003", "IDENTITY-005", "IDENTITY-007",
+        "IDENTITY-009",
+        "NETWORK-001", "NETWORK-002", "NETWORK-003", "NETWORK-004",
+        "NETWORK-006", "NETWORK-007",
+        "SANDBOX-001", "SANDBOX-006", "SANDBOX-007", "SANDBOX-008",
+    ].includes(finding.id);
+}
+function isPermissionFix(finding) {
+    return [
+        "IDENTITY-012",
+        "SECRET-003", "SECRET-004", "SECRET-005", "SECRET-006",
+    ].includes(finding.id);
+}
+async function applyConfigFixes(fixes, configPath) {
+    const results = [];
+    // Separate safe vs behavioral
+    const safeFixes = fixes.filter((f) => f.fixType === "safe");
+    const behavioralFixes = fixes.filter((f) => f.fixType === "behavioral");
+    // Prompt for behavioral fixes
+    const approvedBehavioral = [];
+    for (const f of behavioralFixes) {
+        console.log(chalk.yellow(`  Behavioral change: ${f.title}`));
+        console.log(chalk.dim(`    ${f.description}`));
+        const approved = await promptUser(chalk.yellow("    Apply this change?"));
+        if (approved) {
+            approvedBehavioral.push(f);
+        }
+        else {
+            results.push({
+                finding: f,
+                applied: false,
+                description: f.title,
+                skippedReason: "User declined behavioral change",
+            });
+        }
+    }
+    const allApproved = [...safeFixes, ...approvedBehavioral];
+    if (allApproved.length === 0)
+        return results;
+    // Backup config file
+    const bak = await backupFile(configPath);
+    console.log(chalk.dim(`  Backup created: ${bak}`));
+    // Read and parse config
+    const raw = await readFile(configPath, "utf-8");
+    let config;
+    try {
+        config = JSON5.parse(raw);
+    }
+    catch {
+        results.push({
+            finding: allApproved[0],
+            applied: false,
+            description: "Config file fixes",
+            skippedReason: "Could not parse openclaw.json",
+        });
+        return results;
+    }
+    // Apply each fix
+    for (const f of allApproved) {
+        const applied = applyConfigMutation(config, f);
+        results.push({
+            finding: f,
+            applied,
+            backupPath: bak,
+            description: f.title,
+            skippedReason: applied ? undefined : "Mutation not implemented for this check",
+        });
+    }
+    // Write updated config
+    await writeFile(configPath, JSON.stringify(config, null, 2), "utf-8");
+    return results;
+}
+function applyConfigMutation(config, finding) {
+    switch (finding.id) {
+        // Network fixes
+        case "NETWORK-001": {
+            if (!config.gateway)
+                config.gateway = {};
+            config.gateway.bind = "127.0.0.1";
+            return true;
+        }
+        case "NETWORK-002": {
+            if (!config.gateway)
+                config.gateway = {};
+            if (!config.gateway.auth)
+                config.gateway.auth = {};
+            config.gateway.auth.mode = "token";
+            config.gateway.auth.token = randomBytes(32).toString("hex");
+            return true;
+        }
+        case "NETWORK-003":
+        case "NETWORK-004": {
+            if (!config.gateway)
+                config.gateway = {};
+            if (!config.gateway.auth)
+                config.gateway.auth = {};
+            config.gateway.auth.token = randomBytes(32).toString("hex");
+            return true;
+        }
+        case "NETWORK-006": {
+            if (!config.gateway)
+                config.gateway = {};
+            config.gateway.allowInsecureAuth = false;
+            return true;
+        }
+        case "NETWORK-007": {
+            if (!config.gateway)
+                config.gateway = {};
+            config.gateway.dangerouslyDisableDeviceAuth = false;
+            return true;
+        }
+        // Identity fixes (behavioral — already prompted)
+        case "IDENTITY-001": {
+            // Set dmPolicy to "pairing" for matching channel
+            if (config.channels) {
+                for (const ch of Object.values(config.channels)) {
+                    if (ch.dmPolicy === "open") {
+                        ch.dmPolicy = "pairing";
+                    }
+                }
+            }
+            return true;
+        }
+        case "IDENTITY-003": {
+            if (config.channels) {
+                for (const ch of Object.values(config.channels)) {
+                    if (ch.groupPolicy === "open") {
+                        ch.groupPolicy = "allowlist";
+                    }
+                }
+            }
+            return true;
+        }
+        case "IDENTITY-005": {
+            if (config.channels) {
+                for (const ch of Object.values(config.channels)) {
+                    if (ch.requireMention === false) {
+                        ch.requireMention = true;
+                    }
+                }
+            }
+            return true;
+        }
+        case "IDENTITY-007": {
+            if (!config.pairing)
+                config.pairing = {};
+            config.pairing.storeTTL = 86400; // 24 hours
+            return true;
+        }
+        case "IDENTITY-009": {
+            if (!config.commands)
+                config.commands = {};
+            config.commands.useAccessGroups = true;
+            return true;
+        }
+        // Sandbox fixes
+        case "SANDBOX-001": {
+            if (!config.sandbox)
+                config.sandbox = {};
+            config.sandbox.mode = "all";
+            return true;
+        }
+        case "SANDBOX-006": {
+            if (config.sandbox?.docker) {
+                config.sandbox.docker.network = "none";
+            }
+            return true;
+        }
+        case "SANDBOX-007": {
+            if (config.sandbox?.docker) {
+                config.sandbox.docker.socketMounted = false;
+            }
+            return true;
+        }
+        case "SANDBOX-008": {
+            if (config.sandbox?.browser) {
+                config.sandbox.browser.allowHostControl = false;
+            }
+            return true;
+        }
+        default:
+            return false;
+    }
+}
+async function applyPermissionFix(finding) {
+    if (platform() === "win32") {
+        return {
+            finding,
+            applied: false,
+            description: finding.title,
+            skippedReason: "File permission fixes require Unix (use Windows Security settings)",
+        };
+    }
+    if (!finding.file) {
+        return {
+            finding,
+            applied: false,
+            description: finding.title,
+            skippedReason: "No file path in finding",
+        };
+    }
+    try {
+        const mode = finding.id === "SECRET-003" ? 0o700 : 0o600;
+        await chmod(finding.file, mode);
+        return {
+            finding,
+            applied: true,
+            description: `Set ${finding.file} to ${mode.toString(8)}`,
+        };
+    }
+    catch (err) {
+        return {
+            finding,
+            applied: false,
+            description: finding.title,
+            skippedReason: `chmod failed: ${err instanceof Error ? err.message : "unknown error"}`,
+        };
+    }
+}
+async function applyGitignoreFix(openclawDir) {
+    // FIX: Removed redundant dynamic import — join is now imported at top level
+    const gitignorePath = join(openclawDir, ".gitignore");
+    try {
+        let content = "";
+        try {
+            content = await readFile(gitignorePath, "utf-8");
+        }
+        catch {
+            // File doesn't exist — create it
+        }
+        const bak = content ? await backupFile(gitignorePath) : undefined;
+        const entries = [".env", ".env.*", "credentials/", "*.key", "*.pem"];
+        const missing = entries.filter((e) => !content.includes(e));
+        if (missing.length === 0) {
+            return {
+                finding: { id: "SECRET-002" },
+                applied: false,
+                description: "Update .gitignore",
+                skippedReason: "All entries already present",
+            };
+        }
+        const addition = `\n# Added by Clawhatch security scanner\n${missing.join("\n")}\n`;
+        await writeFile(gitignorePath, content + addition, "utf-8");
+        return {
+            finding: { id: "SECRET-002" },
+            applied: true,
+            backupPath: bak,
+            description: `Added ${missing.length} entries to .gitignore`,
+        };
+    }
+    catch (err) {
+        return {
+            finding: { id: "SECRET-002" },
+            applied: false,
+            description: "Update .gitignore",
+            skippedReason: `Failed: ${err instanceof Error ? err.message : "unknown error"}`,
+        };
+    }
+}
+//# sourceMappingURL=fixer.js.map