openclawdreams 2.3.0 → 2.4.0

package/dist/openclaw/src/config/group-policy.js

@@ -1,287 +0,0 @@
-import { resolveAccountEntry } from "../routing/account-lookup.js";
-import { normalizeAccountId } from "../routing/session-key.js";
-import { parseToolsBySenderTypedKey, } from "./types.tools.js";
-function resolveChannelGroupConfig(groups, groupId, caseInsensitive = false) {
-    if (!groups) {
-        return undefined;
-    }
-    const direct = groups[groupId];
-    if (direct) {
-        return direct;
-    }
-    if (!caseInsensitive) {
-        return undefined;
-    }
-    const target = groupId.toLowerCase();
-    const matchedKey = Object.keys(groups).find((key) => key !== "*" && key.toLowerCase() === target);
-    if (!matchedKey) {
-        return undefined;
-    }
-    return groups[matchedKey];
-}
-const warnedLegacyToolsBySenderKeys = new Set();
-const compiledToolsBySenderCache = new WeakMap();
-function normalizeSenderKey(value, options = {}) {
-    const trimmed = value.trim();
-    if (!trimmed) {
-        return "";
-    }
-    const withoutAt = options.stripLeadingAt && trimmed.startsWith("@") ? trimmed.slice(1) : trimmed;
-    return withoutAt.toLowerCase();
-}
-function normalizeTypedSenderKey(value, type) {
-    return normalizeSenderKey(value, {
-        stripLeadingAt: type === "username",
-    });
-}
-function normalizeLegacySenderKey(value) {
-    return normalizeSenderKey(value, {
-        stripLeadingAt: true,
-    });
-}
-function warnLegacyToolsBySenderKey(rawKey) {
-    const trimmed = rawKey.trim();
-    if (!trimmed || warnedLegacyToolsBySenderKeys.has(trimmed)) {
-        return;
-    }
-    warnedLegacyToolsBySenderKeys.add(trimmed);
-    process.emitWarning(`toolsBySender key "${trimmed}" is deprecated. Use explicit prefixes (id:, e164:, username:, name:). Legacy unprefixed keys are matched as id only.`, {
-        type: "DeprecationWarning",
-        code: "OPENCLAW_TOOLS_BY_SENDER_UNTYPED_KEY",
-    });
-}
-function parseSenderPolicyKey(rawKey) {
-    const trimmed = rawKey.trim();
-    if (!trimmed) {
-        return undefined;
-    }
-    if (trimmed === "*") {
-        return { kind: "wildcard" };
-    }
-    const typed = parseToolsBySenderTypedKey(trimmed);
-    if (typed) {
-        const key = normalizeTypedSenderKey(typed.value, typed.type);
-        if (!key) {
-            return undefined;
-        }
-        return {
-            kind: "typed",
-            type: typed.type,
-            key,
-        };
-    }
-    // Backward-compatible fallback: untyped keys now map to immutable sender IDs only.
-    warnLegacyToolsBySenderKey(trimmed);
-    const key = normalizeLegacySenderKey(trimmed);
-    if (!key) {
-        return undefined;
-    }
-    return {
-        kind: "typed",
-        type: "id",
-        key,
-    };
-}
-function createSenderPolicyBuckets() {
-    return {
-        id: new Map(),
-        e164: new Map(),
-        username: new Map(),
-        name: new Map(),
-    };
-}
-function compileToolsBySenderPolicy(toolsBySender) {
-    const entries = Object.entries(toolsBySender);
-    if (entries.length === 0) {
-        return undefined;
-    }
-    const buckets = createSenderPolicyBuckets();
-    let wildcard;
-    for (const [rawKey, policy] of entries) {
-        if (!policy) {
-            continue;
-        }
-        const parsed = parseSenderPolicyKey(rawKey);
-        if (!parsed) {
-            continue;
-        }
-        if (parsed.kind === "wildcard") {
-            wildcard = policy;
-            continue;
-        }
-        const bucket = buckets[parsed.type];
-        if (!bucket.has(parsed.key)) {
-            bucket.set(parsed.key, policy);
-        }
-    }
-    return { buckets, wildcard };
-}
-function resolveCompiledToolsBySenderPolicy(toolsBySender) {
-    const cached = compiledToolsBySenderCache.get(toolsBySender);
-    if (cached) {
-        return cached;
-    }
-    const compiled = compileToolsBySenderPolicy(toolsBySender);
-    if (!compiled) {
-        return undefined;
-    }
-    // Config is loaded once and treated as immutable; cache compiled sender policy by object identity.
-    compiledToolsBySenderCache.set(toolsBySender, compiled);
-    return compiled;
-}
-function normalizeCandidate(value, type) {
-    const trimmed = value?.trim();
-    if (!trimmed) {
-        return "";
-    }
-    return normalizeTypedSenderKey(trimmed, type);
-}
-function normalizeSenderIdCandidates(value) {
-    const trimmed = value?.trim();
-    if (!trimmed) {
-        return [];
-    }
-    const typed = normalizeTypedSenderKey(trimmed, "id");
-    const legacy = normalizeLegacySenderKey(trimmed);
-    if (!typed) {
-        return legacy ? [legacy] : [];
-    }
-    if (!legacy || legacy === typed) {
-        return [typed];
-    }
-    return [typed, legacy];
-}
-function matchToolsBySenderPolicy(compiled, params) {
-    for (const senderIdCandidate of normalizeSenderIdCandidates(params.senderId)) {
-        const match = compiled.buckets.id.get(senderIdCandidate);
-        if (match) {
-            return match;
-        }
-    }
-    const senderE164 = normalizeCandidate(params.senderE164, "e164");
-    if (senderE164) {
-        const match = compiled.buckets.e164.get(senderE164);
-        if (match) {
-            return match;
-        }
-    }
-    const senderUsername = normalizeCandidate(params.senderUsername, "username");
-    if (senderUsername) {
-        const match = compiled.buckets.username.get(senderUsername);
-        if (match) {
-            return match;
-        }
-    }
-    const senderName = normalizeCandidate(params.senderName, "name");
-    if (senderName) {
-        const match = compiled.buckets.name.get(senderName);
-        if (match) {
-            return match;
-        }
-    }
-    return compiled.wildcard;
-}
-export function resolveToolsBySender(params) {
-    const toolsBySender = params.toolsBySender;
-    if (!toolsBySender) {
-        return undefined;
-    }
-    const compiled = resolveCompiledToolsBySenderPolicy(toolsBySender);
-    if (!compiled) {
-        return undefined;
-    }
-    return matchToolsBySenderPolicy(compiled, params);
-}
-function resolveChannelGroups(cfg, channel, accountId) {
-    const normalizedAccountId = normalizeAccountId(accountId);
-    const channelConfig = cfg.channels?.[channel];
-    if (!channelConfig) {
-        return undefined;
-    }
-    const accountGroups = resolveAccountEntry(channelConfig.accounts, normalizedAccountId)?.groups;
-    return accountGroups ?? channelConfig.groups;
-}
-function resolveChannelGroupPolicyMode(cfg, channel, accountId) {
-    const normalizedAccountId = normalizeAccountId(accountId);
-    const channelConfig = cfg.channels?.[channel];
-    if (!channelConfig) {
-        return undefined;
-    }
-    const accountPolicy = resolveAccountEntry(channelConfig.accounts, normalizedAccountId)?.groupPolicy;
-    return accountPolicy ?? channelConfig.groupPolicy;
-}
-export function resolveChannelGroupPolicy(params) {
-    const { cfg, channel } = params;
-    const groups = resolveChannelGroups(cfg, channel, params.accountId);
-    const groupPolicy = resolveChannelGroupPolicyMode(cfg, channel, params.accountId);
-    const hasGroups = Boolean(groups && Object.keys(groups).length > 0);
-    const allowlistEnabled = groupPolicy === "allowlist" || hasGroups;
-    const normalizedId = params.groupId?.trim();
-    const groupConfig = normalizedId
-        ? resolveChannelGroupConfig(groups, normalizedId, params.groupIdCaseInsensitive)
-        : undefined;
-    const defaultConfig = groups?.["*"];
-    const allowAll = allowlistEnabled && Boolean(groups && Object.hasOwn(groups, "*"));
-    // When groupPolicy is "allowlist" with groupAllowFrom but no explicit groups,
-    // allow the group through — sender-level filtering handles access control.
-    const senderFilterBypass = groupPolicy === "allowlist" && !hasGroups && Boolean(params.hasGroupAllowFrom);
-    const allowed = groupPolicy === "disabled"
-        ? false
-        : !allowlistEnabled || allowAll || Boolean(groupConfig) || senderFilterBypass;
-    return {
-        allowlistEnabled,
-        allowed,
-        groupConfig,
-        defaultConfig,
-    };
-}
-export function resolveChannelGroupRequireMention(params) {
-    const { requireMentionOverride, overrideOrder = "after-config" } = params;
-    const { groupConfig, defaultConfig } = resolveChannelGroupPolicy(params);
-    const configMention = typeof groupConfig?.requireMention === "boolean"
-        ? groupConfig.requireMention
-        : typeof defaultConfig?.requireMention === "boolean"
-            ? defaultConfig.requireMention
-            : undefined;
-    if (overrideOrder === "before-config" && typeof requireMentionOverride === "boolean") {
-        return requireMentionOverride;
-    }
-    if (typeof configMention === "boolean") {
-        return configMention;
-    }
-    if (overrideOrder !== "before-config" && typeof requireMentionOverride === "boolean") {
-        return requireMentionOverride;
-    }
-    return true;
-}
-export function resolveChannelGroupToolsPolicy(params) {
-    const { groupConfig, defaultConfig } = resolveChannelGroupPolicy(params);
-    const groupSenderPolicy = resolveToolsBySender({
-        toolsBySender: groupConfig?.toolsBySender,
-        senderId: params.senderId,
-        senderName: params.senderName,
-        senderUsername: params.senderUsername,
-        senderE164: params.senderE164,
-    });
-    if (groupSenderPolicy) {
-        return groupSenderPolicy;
-    }
-    if (groupConfig?.tools) {
-        return groupConfig.tools;
-    }
-    const defaultSenderPolicy = resolveToolsBySender({
-        toolsBySender: defaultConfig?.toolsBySender,
-        senderId: params.senderId,
-        senderName: params.senderName,
-        senderUsername: params.senderUsername,
-        senderE164: params.senderE164,
-    });
-    if (defaultSenderPolicy) {
-        return defaultSenderPolicy;
-    }
-    if (defaultConfig?.tools) {
-        return defaultConfig.tools;
-    }
-    return undefined;
-}
-//# sourceMappingURL=group-policy.js.map

package/dist/openclaw/src/config/includes.d.ts

@@ -1,44 +0,0 @@
-/**
- * Config includes: $include directive for modular configs
- *
- * @example
- * ```json5
- * {
- *   "$include": "./base.json5",           // single file
- *   "$include": ["./a.json5", "./b.json5"] // merge multiple
- * }
- * ```
- */
-import fs from "node:fs";
-export declare const INCLUDE_KEY = "$include";
-export declare const MAX_INCLUDE_DEPTH = 10;
-export declare const MAX_INCLUDE_FILE_BYTES: number;
-export type IncludeResolver = {
-    readFile: (path: string) => string;
-    readFileWithGuards?: (params: IncludeFileReadParams) => string;
-    parseJson: (raw: string) => unknown;
-};
-export type IncludeFileReadParams = {
-    includePath: string;
-    resolvedPath: string;
-    rootRealDir: string;
-    ioFs?: typeof fs;
-    maxBytes?: number;
-};
-export declare class ConfigIncludeError extends Error {
-    readonly includePath: string;
-    readonly cause?: Error | undefined;
-    constructor(message: string, includePath: string, cause?: Error | undefined);
-}
-export declare class CircularIncludeError extends ConfigIncludeError {
-    readonly chain: string[];
-    constructor(chain: string[]);
-}
-/** Deep merge: arrays concatenate, objects merge recursively, primitives: source wins */
-export declare function deepMerge(target: unknown, source: unknown): unknown;
-export declare function readConfigIncludeFileWithGuards(params: IncludeFileReadParams): string;
-/**
- * Resolves all $include directives in a parsed config object.
- */
-export declare function resolveConfigIncludes(obj: unknown, configPath: string, resolver?: IncludeResolver): unknown;
-//# sourceMappingURL=includes.d.ts.map

package/dist/openclaw/src/config/includes.js

@@ -1,256 +0,0 @@
-/**
- * Config includes: $include directive for modular configs
- *
- * @example
- * ```json5
- * {
- *   "$include": "./base.json5",           // single file
- *   "$include": ["./a.json5", "./b.json5"] // merge multiple
- * }
- * ```
- */
-import fs from "node:fs";
-import path from "node:path";
-import JSON5 from "json5";
-import { canUseBoundaryFileOpen, openBoundaryFileSync } from "../infra/boundary-file-read.js";
-import { isPathInside } from "../security/scan-paths.js";
-import { isPlainObject } from "../utils.js";
-import { isBlockedObjectKey } from "./prototype-keys.js";
-export const INCLUDE_KEY = "$include";
-export const MAX_INCLUDE_DEPTH = 10;
-export const MAX_INCLUDE_FILE_BYTES = 2 * 1024 * 1024;
-// ============================================================================
-// Errors
-// ============================================================================
-export class ConfigIncludeError extends Error {
-    includePath;
-    cause;
-    constructor(message, includePath, cause) {
-        super(message);
-        this.includePath = includePath;
-        this.cause = cause;
-        this.name = "ConfigIncludeError";
-    }
-}
-export class CircularIncludeError extends ConfigIncludeError {
-    chain;
-    constructor(chain) {
-        super(`Circular include detected: ${chain.join(" -> ")}`, chain[chain.length - 1]);
-        this.chain = chain;
-        this.name = "CircularIncludeError";
-    }
-}
-// ============================================================================
-// Utilities
-// ============================================================================
-/** Deep merge: arrays concatenate, objects merge recursively, primitives: source wins */
-export function deepMerge(target, source) {
-    if (Array.isArray(target) && Array.isArray(source)) {
-        return [...target, ...source];
-    }
-    if (isPlainObject(target) && isPlainObject(source)) {
-        const result = { ...target };
-        for (const key of Object.keys(source)) {
-            if (isBlockedObjectKey(key)) {
-                continue;
-            }
-            result[key] = key in result ? deepMerge(result[key], source[key]) : source[key];
-        }
-        return result;
-    }
-    return source;
-}
-// ============================================================================
-// Include Resolver Class
-// ============================================================================
-class IncludeProcessor {
-    basePath;
-    resolver;
-    visited = new Set();
-    depth = 0;
-    rootDir;
-    rootRealDir;
-    constructor(basePath, resolver, rootDir) {
-        this.basePath = basePath;
-        this.resolver = resolver;
-        this.visited.add(path.normalize(basePath));
-        this.rootDir = path.normalize(rootDir ?? path.dirname(basePath));
-        this.rootRealDir = path.normalize(safeRealpath(this.rootDir));
-    }
-    process(obj) {
-        if (Array.isArray(obj)) {
-            return obj.map((item) => this.process(item));
-        }
-        if (!isPlainObject(obj)) {
-            return obj;
-        }
-        if (!(INCLUDE_KEY in obj)) {
-            return this.processObject(obj);
-        }
-        return this.processInclude(obj);
-    }
-    processObject(obj) {
-        const result = {};
-        for (const [key, value] of Object.entries(obj)) {
-            result[key] = this.process(value);
-        }
-        return result;
-    }
-    processInclude(obj) {
-        const includeValue = obj[INCLUDE_KEY];
-        const otherKeys = Object.keys(obj).filter((k) => k !== INCLUDE_KEY);
-        const included = this.resolveInclude(includeValue);
-        if (otherKeys.length === 0) {
-            return included;
-        }
-        if (!isPlainObject(included)) {
-            throw new ConfigIncludeError("Sibling keys require included content to be an object", typeof includeValue === "string" ? includeValue : INCLUDE_KEY);
-        }
-        // Merge included content with sibling keys
-        const rest = {};
-        for (const key of otherKeys) {
-            rest[key] = this.process(obj[key]);
-        }
-        return deepMerge(included, rest);
-    }
-    resolveInclude(value) {
-        if (typeof value === "string") {
-            return this.loadFile(value);
-        }
-        if (Array.isArray(value)) {
-            return value.reduce((merged, item) => {
-                if (typeof item !== "string") {
-                    throw new ConfigIncludeError(`Invalid $include array item: expected string, got ${typeof item}`, String(item));
-                }
-                return deepMerge(merged, this.loadFile(item));
-            }, {});
-        }
-        throw new ConfigIncludeError(`Invalid $include value: expected string or array of strings, got ${typeof value}`, String(value));
-    }
-    loadFile(includePath) {
-        const resolvedPath = this.resolvePath(includePath);
-        this.checkCircular(resolvedPath);
-        this.checkDepth(includePath);
-        const raw = this.readFile(includePath, resolvedPath);
-        const parsed = this.parseFile(includePath, resolvedPath, raw);
-        return this.processNested(resolvedPath, parsed);
-    }
-    resolvePath(includePath) {
-        const configDir = path.dirname(this.basePath);
-        const resolved = path.isAbsolute(includePath)
-            ? includePath
-            : path.resolve(configDir, includePath);
-        const normalized = path.normalize(resolved);
-        // SECURITY: Reject paths outside top-level config directory (CWE-22: Path Traversal)
-        if (!isPathInside(this.rootDir, normalized)) {
-            throw new ConfigIncludeError(`Include path escapes config directory: ${includePath} (root: ${this.rootDir})`, includePath);
-        }
-        // SECURITY: Resolve symlinks and re-validate to prevent symlink bypass
-        try {
-            const real = fs.realpathSync(normalized);
-            if (!isPathInside(this.rootRealDir, real)) {
-                throw new ConfigIncludeError(`Include path resolves outside config directory (symlink): ${includePath} (root: ${this.rootDir})`, includePath);
-            }
-        }
-        catch (err) {
-            if (err instanceof ConfigIncludeError) {
-                throw err;
-            }
-            // File doesn't exist yet - normalized path check above is sufficient
-        }
-        return normalized;
-    }
-    checkCircular(resolvedPath) {
-        if (this.visited.has(resolvedPath)) {
-            throw new CircularIncludeError([...this.visited, resolvedPath]);
-        }
-    }
-    checkDepth(includePath) {
-        if (this.depth >= MAX_INCLUDE_DEPTH) {
-            throw new ConfigIncludeError(`Maximum include depth (${MAX_INCLUDE_DEPTH}) exceeded at: ${includePath}`, includePath);
-        }
-    }
-    readFile(includePath, resolvedPath) {
-        try {
-            if (this.resolver.readFileWithGuards) {
-                return this.resolver.readFileWithGuards({
-                    includePath,
-                    resolvedPath,
-                    rootRealDir: this.rootRealDir,
-                });
-            }
-            return this.resolver.readFile(resolvedPath);
-        }
-        catch (err) {
-            if (err instanceof ConfigIncludeError) {
-                throw err;
-            }
-            throw new ConfigIncludeError(`Failed to read include file: ${includePath} (resolved: ${resolvedPath})`, includePath, err instanceof Error ? err : undefined);
-        }
-    }
-    parseFile(includePath, resolvedPath, raw) {
-        try {
-            return this.resolver.parseJson(raw);
-        }
-        catch (err) {
-            throw new ConfigIncludeError(`Failed to parse include file: ${includePath} (resolved: ${resolvedPath})`, includePath, err instanceof Error ? err : undefined);
-        }
-    }
-    processNested(resolvedPath, parsed) {
-        const nested = new IncludeProcessor(resolvedPath, this.resolver, this.rootDir);
-        nested.visited = new Set([...this.visited, resolvedPath]);
-        nested.depth = this.depth + 1;
-        return nested.process(parsed);
-    }
-}
-function safeRealpath(target) {
-    try {
-        return fs.realpathSync(target);
-    }
-    catch {
-        return target;
-    }
-}
-export function readConfigIncludeFileWithGuards(params) {
-    const ioFs = params.ioFs ?? fs;
-    const maxBytes = params.maxBytes ?? MAX_INCLUDE_FILE_BYTES;
-    if (!canUseBoundaryFileOpen(ioFs)) {
-        return ioFs.readFileSync(params.resolvedPath, "utf-8");
-    }
-    const opened = openBoundaryFileSync({
-        absolutePath: params.resolvedPath,
-        rootPath: params.rootRealDir,
-        rootRealPath: params.rootRealDir,
-        boundaryLabel: "config directory",
-        skipLexicalRootCheck: true,
-        maxBytes,
-        ioFs,
-    });
-    if (!opened.ok) {
-        if (opened.reason === "validation") {
-            throw new ConfigIncludeError(`Include file failed security checks (regular file, max ${maxBytes} bytes, no hardlinks): ${params.includePath}`, params.includePath);
-        }
-        throw new ConfigIncludeError(`Failed to read include file: ${params.includePath} (resolved: ${params.resolvedPath})`, params.includePath, opened.error instanceof Error ? opened.error : undefined);
-    }
-    try {
-        return ioFs.readFileSync(opened.fd, "utf-8");
-    }
-    finally {
-        ioFs.closeSync(opened.fd);
-    }
-}
-// ============================================================================
-// Public API
-// ============================================================================
-const defaultResolver = {
-    readFile: (p) => fs.readFileSync(p, "utf-8"),
-    readFileWithGuards: ({ includePath, resolvedPath, rootRealDir }) => readConfigIncludeFileWithGuards({ includePath, resolvedPath, rootRealDir }),
-    parseJson: (raw) => JSON5.parse(raw),
-};
-/**
- * Resolves all $include directives in a parsed config object.
- */
-export function resolveConfigIncludes(obj, configPath, resolver = defaultResolver) {
-    return new IncludeProcessor(configPath, resolver).process(obj);
-}
-//# sourceMappingURL=includes.js.map

package/dist/openclaw/src/config/io.d.ts

@@ -1,64 +0,0 @@
-import fs from "node:fs";
-import JSON5 from "json5";
-import type { OpenClawConfig, ConfigFileSnapshot } from "./types.js";
-export { CircularIncludeError, ConfigIncludeError } from "./includes.js";
-export { MissingEnvVarError } from "./env-substitution.js";
-export type ParseConfigJson5Result = {
-    ok: true;
-    parsed: unknown;
-} | {
-    ok: false;
-    error: string;
-};
-export type ConfigWriteOptions = {
-    /**
-     * Read-time env snapshot used to validate `${VAR}` restoration decisions.
-     * If omitted, write falls back to current process env.
-     */
-    envSnapshotForRestore?: Record<string, string | undefined>;
-    /**
-     * Optional safety check: only use envSnapshotForRestore when writing the
-     * same config file path that produced the snapshot.
-     */
-    expectedConfigPath?: string;
-    /**
-     * Paths that must be explicitly removed from the persisted file payload,
-     * even if schema/default normalization reintroduces them.
-     */
-    unsetPaths?: string[][];
-};
-export type ReadConfigFileSnapshotForWriteResult = {
-    snapshot: ConfigFileSnapshot;
-    writeOptions: ConfigWriteOptions;
-};
-export declare function resolveConfigSnapshotHash(snapshot: {
-    hash?: string;
-    raw?: string | null;
-}): string | null;
-export type ConfigIoDeps = {
-    fs?: typeof fs;
-    json5?: typeof JSON5;
-    env?: NodeJS.ProcessEnv;
-    homedir?: () => string;
-    configPath?: string;
-    logger?: Pick<typeof console, "error" | "warn">;
-};
-export declare function parseConfigJson5(raw: string, json5?: {
-    parse: (value: string) => unknown;
-}): ParseConfigJson5Result;
-export declare function createConfigIO(overrides?: ConfigIoDeps): {
-    configPath: string;
-    loadConfig: () => OpenClawConfig;
-    readConfigFileSnapshot: () => Promise<ConfigFileSnapshot>;
-    readConfigFileSnapshotForWrite: () => Promise<ReadConfigFileSnapshotForWriteResult>;
-    writeConfigFile: (cfg: OpenClawConfig, options?: ConfigWriteOptions) => Promise<void>;
-};
-export declare function clearConfigCache(): void;
-export declare function setRuntimeConfigSnapshot(config: OpenClawConfig, sourceConfig?: OpenClawConfig): void;
-export declare function clearRuntimeConfigSnapshot(): void;
-export declare function getRuntimeConfigSnapshot(): OpenClawConfig | null;
-export declare function loadConfig(): OpenClawConfig;
-export declare function readConfigFileSnapshot(): Promise<ConfigFileSnapshot>;
-export declare function readConfigFileSnapshotForWrite(): Promise<ReadConfigFileSnapshotForWriteResult>;
-export declare function writeConfigFile(cfg: OpenClawConfig, options?: ConfigWriteOptions): Promise<void>;
-//# sourceMappingURL=io.d.ts.map