openclaw-plugin-vt-sentinel 0.8.1 → 0.8.3

package/dist/index.js

@@ -145,7 +145,10 @@ function generateUpdateCommands(opts) {
         return lines.join('\n');
     }
     const stateDir = opts.stateDir;
-    const quotedExtDir = `"${path.join(stateDir, 'extensions', PACKAGE_NAME)}"`;
+    // Escape double quotes in paths to prevent shell injection via OPENCLAW_STATE_DIR
+    const escapeForShell = (s) => s.replace(/"/g, '\\"');
+    const extDir = path.join(stateDir, 'extensions', PACKAGE_NAME);
+    const quotedExtDir = `"${escapeForShell(extDir)}"`;
     const configPath = path.join(stateDir, 'openclaw.json');
     const lines = [];
     lines.push(`Upgrade: v${opts.currentVersion} → v${opts.latestVersion}`);
@@ -167,9 +170,12 @@ function generateUpdateCommands(opts) {
     lines.push(`      rm -rf ${quotedExtDir}    (Linux/macOS)`);
     lines.push(`      rmdir /s /q ${quotedExtDir.replace(/\//g, '\\\\')}   (Windows)`);
     lines.push('');
-    lines.push(`  2b. Back up and clean the config entry:`);
-    // Generate a safe node -e script for config cleanup
-    const cleanupScript = `node -e "const fs=require('fs'),p='${configPath.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}';try{const b=fs.readFileSync(p,'utf8');fs.writeFileSync(p+'.bak',b);const c=JSON.parse(b);if(c.plugins){delete(c.plugins.entries||{})['${PACKAGE_NAME}'];delete(c.plugins.installs||{})['${PACKAGE_NAME}'];}fs.writeFileSync(p,JSON.stringify(c,null,2));console.log('Config cleaned (backup: '+p+'.bak)')}catch(e){console.error('Failed: '+e.message);process.exit(1)}"`;
+    lines.push(`  2b. Back up and clean the stale install entry (preserves your config):`);
+    // Generate a safe node -e script for config cleanup.
+    // Only deletes plugins.installs (stale install metadata), NOT plugins.entries (user config with apiKey etc.).
+    // Tries json5 parser first (likely available as openclaw dependency), falls back to JSON.parse.
+    const safeConfigPath = configPath.replace(/\\/g, '\\\\').replace(/'/g, "\\'").replace(/"/g, '\\"');
+    const cleanupScript = `node -e "const fs=require('fs'),p='${safeConfigPath}';try{const b=fs.readFileSync(p,'utf8');fs.writeFileSync(p+'.bak',b);const P=(()=>{try{return require('json5').parse}catch{return JSON.parse}})();const c=P(b);if(c.plugins&&c.plugins.installs){delete c.plugins.installs['${PACKAGE_NAME}'];}fs.writeFileSync(p,JSON.stringify(c,null,2));console.log('Config cleaned (backup: '+p+'.bak)')}catch(e){console.error('Failed: '+e.message+'. Manually remove ${PACKAGE_NAME} from plugins.installs in '+p);process.exit(1)}"`;
     lines.push(`      ${cleanupScript}`);
     lines.push('');
     lines.push(`  2c. Reinstall:`);
@@ -1031,7 +1037,7 @@ function vtSentinelPlugin(api) {
             required: [],
         },
         execute: async (_ctx, rawParams) => {
-            const params = rawParams || {};
+            const params = (typeof rawParams === 'object' && rawParams !== null) ? rawParams : {};
             // Strict validation: reject non-boolean confirm
             if ('confirm' in params && typeof params.confirm !== 'boolean') {
                 return textResponse('Error: confirm must be true or false');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-plugin-vt-sentinel",
-  "version": "0.8.1",
+  "version": "0.8.3",
   "description": "VirusTotal Sentinel for OpenClaw - Malware detection and AI-powered code analysis",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",