openclawsec 1.0.0

package/src/commands/monitor.js

@@ -0,0 +1,175 @@
+const out = require('../utils/output');
+const ora = require('ora');
+const fs = require('fs');
+const path = require('path');
+const version = require('../checks/version');
+const cve = require('../checks/cve');
+const configHarden = require('../checks/configHarden');
+
+const DEFAULT_INTERVAL = 60 * 60 * 1000;
+
+function getLogPath() {
+  const home = process.env.USERPROFILE || process.env.HOME || process.env.HOMEPATH;
+  const logDir = path.join(home, '.clawshield', 'logs');
+  
+  if (!fs.existsSync(logDir)) {
+    fs.mkdirSync(logDir, { recursive: true });
+  }
+  
+  return path.join(logDir, 'monitor-' + new Date().toISOString().split('T')[0] + '.json');
+}
+
+function saveResult(result) {
+  const logPath = getLogPath();
+  let logs = [];
+  
+  try {
+    if (fs.existsSync(logPath)) {
+      logs = JSON.parse(fs.readFileSync(logPath, 'utf8'));
+    }
+  } catch (e) {}
+  
+  logs.push({
+    timestamp: new Date().toISOString(),
+    ...result
+  });
+  
+  fs.writeFileSync(logPath, JSON.stringify(logs, null, 2));
+}
+
+async function runMonitor(interval = DEFAULT_INTERVAL) {
+  const spinner = ora({ spinner: 'dots' });
+  
+  console.log('');
+  console.log(out.COLORS.title('╔══════════════════════════════════════════════════╗'));
+  console.log(out.COLORS.title('║           CLAWSHIELD MONITOR MODE                 ║'));
+  console.log(out.COLORS.title('╚══════════════════════════════════════════════════╝'));
+  console.log('');
+  
+  console.log(`Monitoring interval: ${interval / 1000 / 60} minutes`);
+  console.log('Press Ctrl+C to stop\n');
+  
+  out.info('Starting continuous monitoring...');
+  out.text('Results will be logged to: ~/.clawshield/logs/');
+  console.log('');
+  
+  const runScan = async () => {
+    spinner.start('Running security scan...');
+    
+    try {
+      const versionResult = await version.check();
+      const cveResult = await cve.check(versionResult.installed);
+      const configPath = configHarden.getOpenClawConfigPath();
+      const config = configHarden.getConfigFromFile(configPath);
+      const configResult = configHarden.check(config);
+      
+      let score = 100;
+      if (versionResult.outdated) score -= 20;
+      if (cveResult.vulnerable) score -= cveResult.count * 15;
+      if (configResult.gateway?.exposed) score -= 25;
+      score = Math.max(0, score);
+      
+      const result = {
+        score,
+        version: versionResult,
+        cve: cveResult,
+        config: configResult,
+        timestamp: new Date().toISOString()
+      };
+      
+      saveResult(result);
+      
+      if (score < 60) {
+        spinner.fail(`ALERT: Security score dropped to ${score}/100`);
+        out.critical('Security issues detected! Review logs for details.');
+      } else if (score < 80) {
+        spinner.warn(`Warning: Security score is ${score}/100`);
+      } else {
+        spinner.succeed(`All clear - Score: ${score}/100`);
+      }
+      
+    } catch (error) {
+      spinner.fail('Scan failed: ' + error.message);
+    }
+    
+    console.log('');
+  };
+  
+  await runScan();
+  
+  console.log(out.COLORS.dim(`Next scan in ${interval / 1000 / 60} minutes...`));
+  console.log('');
+  
+  const intervalId = setInterval(async () => {
+    await runScan();
+    console.log(out.COLORS.dim(`Next scan in ${interval / 1000 / 60} minutes...`));
+    console.log('');
+  }, interval);
+  
+  process.on('SIGINT', () => {
+    console.log('');
+    out.info('Stopping monitor...');
+    clearInterval(intervalId);
+    process.exit(0);
+  });
+  
+  return intervalId;
+}
+
+function checkStatus() {
+  const logPath = getLogPath().replace(new Date().toISOString().split('T')[0], '*');
+  const logDir = path.join(process.env.USERPROFILE || process.env.HOME || process.env.HOMEPATH, '.clawshield', 'logs');
+  
+  console.log('');
+  console.log(out.COLORS.title('╔══════════════════════════════════════════════════╗'));
+  console.log(out.COLORS.title('║           CLAWSHIELD STATUS CHECK                 ║'));
+  console.log(out.COLORS.title('╚══════════════════════════════════════════════════╝'));
+  console.log('');
+  
+  if (!fs.existsSync(logDir)) {
+    out.warning('No monitoring data found');
+    out.text('Run: clawshield monitor to start monitoring');
+    return;
+  }
+  
+  const files = fs.readdirSync(logDir).filter(f => f.endsWith('.json'));
+  
+  if (files.length === 0) {
+    out.warning('No monitoring data found');
+    return;
+  }
+  
+  const latestFile = files.sort().pop();
+  const latestPath = path.join(logDir, latestFile);
+  
+  try {
+    const logs = JSON.parse(fs.readFileSync(latestPath, 'utf8'));
+    const latest = logs[logs.length - 1];
+    
+    out.keyValue('Last Scan', latest.timestamp);
+    out.keyValue('Security Score', `${latest.score}/100`);
+    out.keyValue('Log File', latestFile);
+    out.keyValue('Total Scans', logs.length.toString());
+    
+    console.log('');
+    
+    if (latest.cve?.vulnerable) {
+      out.critical(`⚠ ${latest.cve.count} CVE vulnerability(ies) detected!`);
+    } else {
+      out.passed('No CVE vulnerabilities found');
+    }
+    
+    if (latest.config?.gateway?.exposed) {
+      out.critical('⚠ Gateway is exposed!');
+    } else {
+      out.passed('Gateway is protected');
+    }
+    
+    console.log('');
+    
+  } catch (e) {
+    out.error('Failed to read monitoring data');
+  }
+}
+
+module.exports = { runMonitor, checkStatus };

package/src/commands/scan.js

@@ -0,0 +1,144 @@
+const out = require('../utils/output');
+const ora = require('ora');
+const version = require('../checks/version');
+const cve = require('../checks/cve');
+const configHarden = require('../checks/configHarden');
+const skillAudit = require('../checks/skillAudit');
+const secretsCheck = require('../checks/secretsCheck');
+
+function calculateScore(results) {
+  let score = 100;
+  
+  if (results.version.outdated) score -= 20;
+  if (results.cve.vulnerable) score -= results.cve.count * 15;
+  if (results.config.gateway?.exposed) score -= 25;
+  if (results.config.dmPolicy?.issues?.length > 0) score -= 10;
+  if (results.config.tools?.issues?.length > 0) score -= 5;
+  if (results.skills.criticalCount > 0) score -= results.skills.criticalCount * 20;
+  if (results.skills.warningCount > 0) score -= results.skills.warningCount * 5;
+  if (results.secrets.findings?.length > 0) score -= results.secrets.findings.length * 10;
+  if (results.secrets.sensitiveFiles > 0) score -= 5;
+  
+  return Math.max(0, Math.min(100, score));
+}
+
+function getSeverityCounts(results) {
+  let critical = 0;
+  let warnings = 0;
+  
+  if (results.version.outdated) critical++;
+  if (results.cve.vulnerable) critical += results.cve.count || 0;
+  if (results.config.gateway?.exposed) critical++;
+  if (results.config.dmPolicy?.issues?.length > 0) warnings++;
+  if (results.skills.criticalCount > 0) critical += results.skills.criticalCount;
+  if (results.skills.warningCount > 0) warnings += results.skills.warningCount;
+  if (results.secrets.findings?.length > 0) critical += results.secrets.findings.length;
+  
+  return { critical, warnings };
+}
+
+async function scan() {
+  out.banner();
+  
+  const spinner = ora({
+    text: 'Running comprehensive security scan...',
+    spinner: 'dots'
+  }).start();
+  
+  const results = {
+    version: { status: 'unknown', outdated: false },
+    cve: { cves: [], vulnerable: false },
+    config: {},
+    skills: { criticalCount: 0, warningCount: 0 },
+    secrets: { findings: [], filesScanned: 0 }
+  };
+  
+  try {
+    spinner.text = 'Checking OpenClaw version...';
+    results.version = await version.check();
+    out.divider();
+    
+    spinner.text = 'Checking CVE vulnerabilities...';
+    results.cve = await cve.check(results.version.installed);
+    out.divider();
+    
+    spinner.text = 'Analyzing configuration...';
+    const configPath = configHarden.getOpenClawConfigPath();
+    const config = configHarden.getConfigFromFile(configPath);
+    results.config = configHarden.check(config);
+    out.divider();
+    
+    spinner.text = 'Auditing installed skills...';
+    results.skills = skillAudit.check();
+    out.divider();
+    
+    spinner.text = 'Scanning for exposed secrets...';
+    results.secrets = secretsCheck.check();
+    out.divider();
+    
+    spinner.succeed('Scan complete!');
+    
+    const score = calculateScore(results);
+    const severityCounts = getSeverityCounts(results);
+    
+    console.log('');
+    console.log(out.COLORS.title('=========================================='));
+    console.log(out.COLORS.title('         SECURITY SUMMARY'));
+    console.log(out.COLORS.title('=========================================='));
+    console.log('');
+    
+    console.log('  OpenClaw Version: ' + (results.version.installed || 'Unknown'));
+    console.log('  Version Status: ' + (results.version.outdated ? out.COLORS.error('OUTDATED') : out.COLORS.passed('UP TO DATE')));
+    console.log('');
+    
+    const scoreColor = score >= 80 ? out.COLORS.passed : (score >= 60 ? out.COLORS.warning : out.COLORS.critical);
+    console.log('  Security Score: ' + scoreColor(score + '/100'));
+    console.log('');
+    
+    console.log(out.COLORS.title('----------------------------------------'));
+    console.log('  Issues Found:');
+    console.log('    Critical:   ' + out.COLORS.error(severityCounts.critical.toString()));
+    console.log('    Warnings:   ' + out.COLORS.warning(severityCounts.warnings.toString()));
+    console.log(out.COLORS.title('----------------------------------------'));
+    console.log('');
+    
+    console.log('  Detailed Results:');
+    console.log('    CVEs Found:      ' + (results.cve.count ? out.COLORS.error(results.cve.count.toString()) : out.COLORS.passed('None')));
+    console.log('    Skills Scanned:  ' + out.COLORS.info((results.skills.total || 0).toString()));
+    console.log('    Malicious Skills: ' + (results.skills.criticalCount ? out.COLORS.error(results.skills.criticalCount.toString()) : out.COLORS.passed('0')));
+    console.log('    Exposed Secrets: ' + (results.secrets.findings?.length ? out.COLORS.error(results.secrets.findings.length.toString()) : out.COLORS.passed('0')));
+    console.log('    Gateway Exposed: ' + (results.config.gateway?.exposed ? out.COLORS.error('YES') : out.COLORS.passed('No')));
+    console.log('');
+    console.log(out.COLORS.title('=========================================='));
+    console.log('');
+    
+    if (severityCounts.critical > 0) {
+      console.log(out.COLORS.error('! ACTION REQUIRED: Critical security issues detected!'));
+      console.log('');
+      console.log('Recommendations:');
+      console.log('  1. Update OpenClaw: npm update -g openclaw');
+      console.log('  2. Remove malicious skills: clawhub uninstall <skill-name>');
+      console.log('  3. Revoke exposed API keys and regenerate new ones');
+      console.log('  4. Configure gateway token if not set');
+      console.log('');
+    }
+    
+    if (score >= 80) {
+      console.log(out.COLORS.success('[OK] Your OpenClaw deployment is in good shape!'));
+    } else if (score >= 60) {
+      console.log(out.COLORS.warning('[WARN] Your OpenClaw deployment needs some attention.'));
+    } else {
+      console.log(out.COLORS.error('[FAIL] Your OpenClaw deployment has critical issues!'));
+    }
+    
+    return results;
+    
+  } catch (error) {
+    spinner.fail('Scan failed: ' + error.message);
+    out.error('An error occurred during the scan');
+    out.text('Please report this issue with your OpenClaw version and configuration');
+    return results;
+  }
+}
+
+module.exports = { scan };

package/src/utils/output.js

@@ -0,0 +1,171 @@
+const chalk = require('chalk');
+
+const COLORS = {
+  critical: chalk.red,
+  warning: chalk.keyword('orange'),
+  passed: chalk.green,
+  info: chalk.blue,
+  title: chalk.bold.cyan,
+  subtitle: chalk.cyan,
+  cyan: chalk.cyan,
+  highlight: chalk.bold.white,
+  dim: chalk.gray,
+  success: chalk.green.bold,
+  error: chalk.red.bold,
+  bold: chalk.bold,
+  yellow: chalk.keyword('yellow')
+};
+
+function banner() {
+  console.log('');
+  console.log(COLORS.title('╔══════════════════════════════════════════════════╗'));
+  console.log(COLORS.title('║           CLAWSHIELD SECURITY REPORT            ║'));
+  console.log(COLORS.title('╠══════════════════════════════════════════════════╣'));
+}
+
+function footer(score) {
+  let scoreColor;
+  if (score >= 80) scoreColor = COLORS.passed;
+  else if (score >= 60) scoreColor = COLORS.warning;
+  else scoreColor = COLORS.critical;
+
+  console.log(COLORS.title('╠══════════════════════════════════════════════════╣'));
+  console.log(COLORS.title('║') + '  Security Score:  ' + scoreColor(`${score}/100`) + ' '.repeat(26) + COLORS.title('║'));
+  console.log(COLORS.title('╚══════════════════════════════════════════════════╝'));
+  console.log('');
+}
+
+function section(title) {
+  console.log('');
+  console.log(COLORS.subtitle(`━━━ ${title} ━━━`));
+  console.log('');
+}
+
+function critical(message) {
+  console.log(COLORS.critical('🔴 CRITICAL: ') + message);
+}
+
+function warning(message) {
+  console.log(COLORS.warning('🟡 WARNING: ') + message);
+}
+
+function passed(message) {
+  console.log(COLORS.passed('🟢 PASSED: ') + message);
+}
+
+function info(message) {
+  console.log(COLORS.info('🔵 INFO: ') + message);
+}
+
+function text(message) {
+  console.log('  ' + message);
+}
+
+function list(items, type = 'info') {
+  items.forEach(item => {
+    if (type === 'critical') critical(item);
+    else if (type === 'warning') warning(item);
+    else if (type === 'passed') passed(item);
+    else info(item);
+  });
+}
+
+function divider() {
+  console.log(COLORS.dim('─'.repeat(50)));
+}
+
+function label(label, value, color = COLORS.info) {
+  console.log(`  ${COLORS.dim(label)}: ${color(value)}`);
+}
+
+function keyValue(key, value) {
+  const k = COLORS.highlight(key.padEnd(20));
+  const v = COLORS.dim(value);
+  console.log(`  ${k}${v}`);
+}
+
+function success(message) {
+  console.log(COLORS.success('✓ ') + message);
+}
+
+function error(message) {
+  console.log(COLORS.error('✗ ') + message);
+}
+
+function heading(message) {
+  console.log(COLORS.title(`━━━ ${message} ━━━`));
+}
+
+function subheading(message) {
+  console.log(COLORS.subtitle(message));
+}
+
+function generateTable(items) {
+  const maxLen = 50;
+  items.forEach(item => {
+    const [label, value, status] = item;
+    let statusSymbol, statusColor;
+    
+    if (status === 'pass') {
+      statusSymbol = '✓';
+      statusColor = COLORS.passed;
+    } else if (status === 'warn') {
+      statusSymbol = '⚠';
+      statusColor = COLORS.warning;
+    } else if (status === 'fail') {
+      statusSymbol = '✗';
+      statusColor = COLORS.critical;
+    } else {
+      statusSymbol = '○';
+      statusColor = COLORS.info;
+    }
+
+    const labelPadded = (label + ' ').padEnd(maxLen);
+    console.log(`  ${statusColor(statusSymbol)} ${COLORS.dim(labelPadded)}${statusColor(value)}`);
+  });
+}
+
+function progressBar(current, total, width = 30) {
+  const filled = Math.round((current / total) * width);
+  const empty = width - filled;
+  const bar = '█'.repeat(filled) + '░'.repeat(empty);
+  return bar;
+}
+
+function scoreColor(score) {
+  if (score >= 80) return COLORS.passed;
+  if (score >= 60) return COLORS.warning;
+  return COLORS.critical;
+}
+
+function formatBytes(bytes) {
+  if (bytes === 0) return '0 Bytes';
+  const k = 1024;
+  const sizes = ['Bytes', 'KB', 'MB', 'GB'];
+  const i = Math.floor(Math.log(bytes) / Math.log(k));
+  return Math.round(bytes / Math.pow(k, i) * 100) / 100 + ' ' + sizes[i];
+}
+
+module.exports = {
+  COLORS,
+  banner,
+  footer,
+  section,
+  critical,
+  warning,
+  passed,
+  info,
+  text,
+  list,
+  divider,
+  label,
+  keyValue,
+  success,
+  error,
+  heading,
+  subheading,
+  generateTable,
+  progressBar,
+  scoreColor,
+  formatBytes
+};