Clawsec Suite

# Exclude local caches and build outputs from ClawHub upload
.DS_Store
.git/
__pycache__/
*.pyc
*.pyo
*.egg-info/
dist/
build/
.env
.venv/
.cache/

# Exclude local test harness files from published payloads.
test/

-----BEGIN PUBLIC KEY-----
MCowBQYDK2VwAyEAS7nijfMcUoOBCj4yOXJX+GYGv2pFl2Yaha1P4v5Cm6A=
-----END PUBLIC KEY-----

{
  "version": "0.0.2",
  "updated": "2026-02-08T06:16:28Z",
  "description": "Community-driven security advisory feed for ClawSec. Automatically updated with OpenClaw-related CVEs from NVD and community-reported security incidents.",
  "advisories": [
    {
      "id": "CVE-2026-25593",
      "severity": "high",
      "type": "vulnerable_skill",
      "title": "OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use t...",
      "description": "OpenClaw is a personal AI assistant. Prior to 2026.1.20, an unauthenticated local client could use the Gateway WebSocket API to write config via config.apply and set unsafe cliPath values that were later used for command discovery, enabling command injection as the gateway user. This vulnerability is fixed in 2026.1.20.",
      "affected": [],
      "action": "Review and update affected components. See NVD for remediation details.",
      "published": "2026-02-06T21:16:17.790",
      "references": [
        "https://github.com/openclaw/openclaw/security/advisories/GHSA-g55j-c2v4-pjcg"
      ],
      "cvss_score": 8.4,
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25593"
    },
    {
      "id": "CVE-2026-25475",
      "severity": "medium",
      "type": "vulnerable_skill",
      "title": "OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/...",
      "description": "OpenClaw is a personal AI assistant. Prior to version 2026.1.30, the isValidMedia() function in src/media/parse.ts allows arbitrary file paths including absolute paths, home directory paths, and directory traversal sequences. An agent can read any file on the system by outputting MEDIA:/path/to/file, exfiltrating sensitive data to the user/channel. This issue has been patched in version 2026.1.30.",
      "affected": [],
      "action": "Review and update affected components. See NVD for remediation details.",
      "published": "2026-02-04T20:16:07.287",
      "references": [
        "https://github.com/openclaw/openclaw/security/advisories/GHSA-r8g4-86fx-92mq"
      ],
      "cvss_score": 6.5,
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25475"
    },
    {
      "id": "CVE-2026-25157",
      "severity": "high",
      "type": "vulnerable_skill",
      "title": "OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vu...",
      "description": "OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in sshNodeCommand. The sshNodeCommand function constructed a shell script without properly escaping the user-supplied project path in an error message. When the cd command failed, the unescaped path was interpolated directly into an echo statement, allowing arbitrary command execution on the remote SSH host. The parseSSHTarget function did not validate that SSH target strings could not begin with a dash. An attacker-supplied target like -oProxyCommand=... would be interpreted as an SSH configuration flag rather than a hostname, allowing arbitrary command execution on the local machine. This issue has been patched in version 2026.1.29.",
      "affected": [],
      "action": "Review and update affected components. See NVD for remediation details.",
      "published": "2026-02-04T20:16:06.577",
      "references": [
        "https://github.com/openclaw/openclaw/security/advisories/GHSA-q284-4pvr-m585"
      ],
      "cvss_score": 7.7,
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25157"
    },
    {
      "id": "CLAW-2026-0001",
      "severity": "high",
      "type": "prompt_injection",
      "title": "Data exfiltration attempt via helper-plus skill",
      "description": "The helper-plus skill was observed sending conversation data to an external server (suspicious-domain.com) on every invocation. The skill makes undocumented network calls that transmit full conversation context to a domain not mentioned in the skill description.",
      "affected": [
        "helper-plus@1.0.0",
        "helper-plus@1.0.1"
      ],
      "action": "Remove helper-plus immediately. Do not use versions 1.0.0 or 1.0.1. Wait for a verified patched version.",
      "published": "2026-02-04T09:30:00Z",
      "references": [],
      "source": "Community Report",
      "github_issue_url": "https://github.com/prompt-security/clawsec/issues/1",
      "reporter": {
        "agent_name": "SecurityBot",
        "opener_type": "agent"
      }
    },
    {
      "id": "CVE-2026-24763",
      "severity": "high",
      "type": "vulnerable_skill",
      "title": "OpenClaw (formerly  Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026....",
      "description": "OpenClaw (formerly  Clawdbot) is a personal AI assistant you run on your own devices. Prior to 2026.1.29, a command injection vulnerability existed in OpenClaw’s Docker sandbox execution mechanism due to unsafe handling of the PATH environment variable when constructing shell commands. An authenticated user able to control environment variables could influence command execution within the container context. This vulnerability is fixed in 2026.1.29.",
      "affected": [],
      "action": "Review and update affected components. See NVD for remediation details.",
      "published": "2026-02-02T23:16:08.593",
      "references": [
        "https://github.com/openclaw/openclaw/commit/771f23d36b95ec2204cc9a0054045f5d8439ea75",
        "https://github.com/openclaw/openclaw/releases/tag/v2026.1.29",
        "https://github.com/openclaw/openclaw/security/advisories/GHSA-mc68-q9jw-2h3v"
      ],
      "cvss_score": 8.8,
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24763"
    },
    {
      "id": "CVE-2026-25253",
      "severity": "high",
      "type": "vulnerable_skill",
      "title": "OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string a...",
      "description": "OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket connection without prompting, sending a token value.",
      "affected": [],
      "action": "Review and update affected components. See NVD for remediation details.",
      "published": "2026-02-01T23:15:49.717",
      "references": [
        "https://depthfirst.com/post/1-click-rce-to-steal-your-moltbot-data-and-keys",
        "https://ethiack.com/news/blog/one-click-rce-moltbot",
        "https://github.com/openclaw/openclaw/security/advisories/GHSA-g8p2-7wf7-98mq"
      ],
      "cvss_score": 8.8,
      "nvd_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25253"
    }
  ]
}

import fs from "node:fs/promises";
import os from "node:os";
import path from "node:path";
import { uniqueStrings, resolveConfiguredPath } from "./lib/utils.mjs";
import { defaultChecksumsUrl, loadLocalFeed, loadRemoteFeed } from "./lib/feed.mjs";
import type { HookEvent, FeedPayload, AdvisoryMatch } from "./lib/types.ts";
import { loadState, persistState } from "./lib/state.ts";
import { discoverInstalledSkills, findMatches, matchKey, buildAlertMessage } from "./lib/matching.ts";
import { loadAdvisorySuppression, isAdvisorySuppressed } from "./lib/suppression.mjs";

const DEFAULT_FEED_URL =
  "https://clawsec.prompt.security/advisories/feed.json";
const DEFAULT_SCAN_INTERVAL_SECONDS = 300;
let unsignedModeWarningShown = false;

function parsePositiveInteger(value: string | undefined, fallback: number): number {
  const parsed = Number.parseInt(String(value ?? ""), 10);
  if (!Number.isFinite(parsed) || parsed <= 0) {
    return fallback;
  }
  return parsed;
}

function toEventName(event: HookEvent): string {
  const eventType = String(event.type ?? "").trim();
  const action = String(event.action ?? "").trim();
  if (!eventType || !action) return "";
  return `${eventType}:${action}`;
}

function shouldHandleEvent(event: HookEvent): boolean {
  const eventName = toEventName(event);
  return eventName === "agent:bootstrap" || eventName === "command:new";
}

function epochMs(isoTimestamp: string | null): number {
  if (!isoTimestamp) return 0;
  const parsed = Date.parse(isoTimestamp);
  return Number.isNaN(parsed) ? 0 : parsed;
}

function scannedRecently(lastScan: string | null, minIntervalSeconds: number): boolean {
  const sinceMs = Date.now() - epochMs(lastScan);
  return sinceMs >= 0 && sinceMs < minIntervalSeconds * 1000;
}

function configuredPath(
  explicit: string | undefined,
  fallback: string,
  label: string,
): string {
  return resolveConfiguredPath(explicit, fallback, {
    label,
    onInvalid: (error, rawValue) => {
      console.warn(
        `[clawsec-advisory-guardian] invalid ${label} path "${rawValue}", using default "${fallback}": ${String(error)}`,
      );
    },
  });
}

async function loadFeed(options: {
  feedUrl: string;
  feedSignatureUrl: string;
  feedChecksumsUrl: string;
  feedChecksumsSignatureUrl: string;
  localFeedPath: string;
  localFeedSignaturePath: string;
  localFeedChecksumsPath: string;
  localFeedChecksumsSignaturePath: string;
  feedPublicKeyPath: string;
  allowUnsigned: boolean;
  verifyChecksumManifest: boolean;
}): Promise<FeedPayload> {
  const publicKeyPem = options.allowUnsigned ? "" : await fs.readFile(options.feedPublicKeyPath, "utf8");

  const remoteFeed = await loadRemoteFeed(options.feedUrl, {
    signatureUrl: options.feedSignatureUrl,
    checksumsUrl: options.feedChecksumsUrl,
    checksumsSignatureUrl: options.feedChecksumsSignatureUrl,
    publicKeyPem,
    checksumsPublicKeyPem: publicKeyPem,
    allowUnsigned: options.allowUnsigned,
    verifyChecksumManifest: options.verifyChecksumManifest,
  });
  if (remoteFeed) return remoteFeed;

  return await loadLocalFeed(options.localFeedPath, {
    signaturePath: options.localFeedSignaturePath,
    checksumsPath: options.localFeedChecksumsPath,
    checksumsSignaturePath: options.localFeedChecksumsSignaturePath,
    publicKeyPem,
    checksumsPublicKeyPem: publicKeyPem,
    allowUnsigned: options.allowUnsigned,
    verifyChecksumManifest: options.verifyChecksumManifest,
    checksumPublicKeyEntry: path.basename(options.feedPublicKeyPath),
  });
}

const handler = async (event: HookEvent): Promise<void> => {
  if (!shouldHandleEvent(event)) return;

  const installRoot = configuredPath(
    process.env.CLAWSEC_INSTALL_ROOT || process.env.INSTALL_ROOT,
    path.join(os.homedir(), ".openclaw", "skills"),
    "CLAWSEC_INSTALL_ROOT",
  );
  const suiteDir = configuredPath(
    process.env.CLAWSEC_SUITE_DIR,
    path.join(installRoot, "clawsec-suite"),
    "CLAWSEC_SUITE_DIR",
  );
  const localFeedPath = configuredPath(
    process.env.CLAWSEC_LOCAL_FEED,
    path.join(suiteDir, "advisories", "feed.json"),
    "CLAWSEC_LOCAL_FEED",
  );
  const localFeedSignaturePath = configuredPath(
    process.env.CLAWSEC_LOCAL_FEED_SIG,
    `${localFeedPath}.sig`,
    "CLAWSEC_LOCAL_FEED_SIG",
  );
  const localFeedChecksumsPath = configuredPath(
    process.env.CLAWSEC_LOCAL_FEED_CHECKSUMS,
    path.join(path.dirname(localFeedPath), "checksums.json"),
    "CLAWSEC_LOCAL_FEED_CHECKSUMS",
  );
  const localFeedChecksumsSignaturePath = configuredPath(
    process.env.CLAWSEC_LOCAL_FEED_CHECKSUMS_SIG,
    `${localFeedChecksumsPath}.sig`,
    "CLAWSEC_LOCAL_FEED_CHECKSUMS_SIG",
  );
  const feedPublicKeyPath = configuredPath(
    process.env.CLAWSEC_FEED_PUBLIC_KEY,
    path.join(suiteDir, "advisories", "feed-signing-public.pem"),
    "CLAWSEC_FEED_PUBLIC_KEY",
  );
  const stateFile = configuredPath(
    process.env.CLAWSEC_SUITE_STATE_FILE,
    path.join(os.homedir(), ".openclaw", "clawsec-suite-feed-state.json"),
    "CLAWSEC_SUITE_STATE_FILE",
  );
  const feedUrl = process.env.CLAWSEC_FEED_URL || DEFAULT_FEED_URL;
  const feedSignatureUrl = process.env.CLAWSEC_FEED_SIG_URL || `${feedUrl}.sig`;
  const feedChecksumsUrl = process.env.CLAWSEC_FEED_CHECKSUMS_URL || defaultChecksumsUrl(feedUrl);
  const feedChecksumsSignatureUrl =
    process.env.CLAWSEC_FEED_CHECKSUMS_SIG_URL || `${feedChecksumsUrl}.sig`;
  const allowUnsigned = process.env.CLAWSEC_ALLOW_UNSIGNED_FEED === "1";
  const verifyChecksumManifest = process.env.CLAWSEC_VERIFY_CHECKSUM_MANIFEST !== "0";
  const scanIntervalSeconds = parsePositiveInteger(
    process.env.CLAWSEC_HOOK_INTERVAL_SECONDS,
    DEFAULT_SCAN_INTERVAL_SECONDS,
  );

  if (allowUnsigned && !unsignedModeWarningShown) {
    unsignedModeWarningShown = true;
    console.warn(
      "[clawsec-advisory-guardian] CLAWSEC_ALLOW_UNSIGNED_FEED=1 is enabled. " +
        "This bypass is temporary migration compatibility and should be removed as soon as signed feed artifacts are available.",
    );
  }

  const forceScan = toEventName(event) === "command:new";
  const state = await loadState(stateFile);
  if (!forceScan && scannedRecently(state.last_hook_scan, scanIntervalSeconds)) {
    return;
  }

  let feed: FeedPayload;
  try {
    feed = await loadFeed({
      feedUrl,
      feedSignatureUrl,
      feedChecksumsUrl,
      feedChecksumsSignatureUrl,
      localFeedPath,
      localFeedSignaturePath,
      localFeedChecksumsPath,
      localFeedChecksumsSignaturePath,
      feedPublicKeyPath,
      allowUnsigned,
      verifyChecksumManifest,
    });
  } catch (error) {
    console.warn(`[clawsec-advisory-guardian] failed to load advisory feed: ${String(error)}`);
    return;
  }

  const nowIso = new Date().toISOString();
  state.last_hook_scan = nowIso;
  state.last_feed_check = nowIso;

  if (typeof feed.updated === "string" && feed.updated.trim()) {
    state.last_feed_updated = feed.updated;
  }

  const advisoryIds = feed.advisories
    .map((advisory) => advisory.id)
    .filter((id): id is string => typeof id === "string" && id.trim() !== "");
  state.known_advisories = uniqueStrings([...state.known_advisories, ...advisoryIds]);

  const installedSkills = await discoverInstalledSkills(installRoot);
  const allMatches = findMatches(feed, installedSkills);

  if (allMatches.length === 0) {
    await persistState(stateFile, state);
    return;
  }

  // Load advisory suppression config (sentinel-gated: requires enabledFor: ["advisory"])
  let suppressionConfig;
  try {
    suppressionConfig = await loadAdvisorySuppression();
  } catch (err) {
    console.warn(`[clawsec-advisory-guardian] failed to load suppression config: ${String(err)}`);
    suppressionConfig = { suppressions: [], enabledFor: [], source: "none" };
  }

  // Partition matches into active and suppressed
  const matches: AdvisoryMatch[] = [];
  const suppressedMatches: AdvisoryMatch[] = [];
  for (const match of allMatches) {
    if (isAdvisorySuppressed(match, suppressionConfig.suppressions)) {
      suppressedMatches.push(match);
    } else {
      matches.push(match);
    }
  }

  const unseenMatches: AdvisoryMatch[] = [];
  for (const match of matches) {
    const key = matchKey(match);
    if (state.notified_matches[key]) {
      continue;
    }
    unseenMatches.push(match);
    state.notified_matches[key] = nowIso;
  }

  if (unseenMatches.length > 0 && Array.isArray(event.messages)) {
    event.messages.push(buildAlertMessage(unseenMatches, installRoot));
  }

  if (suppressedMatches.length > 0 && Array.isArray(event.messages)) {
    event.messages.push(
      `[clawsec-advisory-guardian] ${suppressedMatches.length} advisory match(es) suppressed by allowlist config.`,
    );
  }

  await persistState(stateFile, state);
};

export default handler;

const ADVISORY_APPLICATION_OPENCLAW = "openclaw";
const ADVISORY_APPLICATION_ALL = "all";

/**
 * @param {unknown} value
 * @returns {string[]}
 */
function normalizeApplicationValue(value) {
  if (typeof value === "string") {
    const normalized = value.trim().toLowerCase();
    return normalized ? [normalized] : [];
  }

  if (Array.isArray(value)) {
    return value
      .filter((entry) => typeof entry === "string")
      .map((entry) => entry.trim().toLowerCase())
      .filter(Boolean);
  }

  return [];
}

/**
 * Decide whether an advisory should be considered by OpenClaw-facing flows.
 *
 * Backward compatibility rule:
 * - Advisories without `application` remain eligible.
 *
 * @param {{ application?: unknown }} advisory
 * @returns {boolean}
 */
export function advisoryAppliesToOpenclaw(advisory) {
  const application = advisory?.application;
  if (application === undefined || application === null) {
    return true;
  }

  const applications = normalizeApplicationValue(application);
  if (applications.length === 0) {
    return true;
  }

  return (
    applications.includes(ADVISORY_APPLICATION_OPENCLAW) ||
    applications.includes(ADVISORY_APPLICATION_ALL)
  );
}

import crypto from "node:crypto";
import https from "node:https";
import path from "node:path";
import { loadTextFile } from "./local_file_io.mjs";
import { isObject } from "./utils.mjs";

/**
 * Allowed domains for feed/signature fetching.
 * Only connections to these domains are permitted for security.
 */
const ALLOWED_DOMAINS = [
  "clawsec.prompt.security",
  "prompt.security",
  "raw.githubusercontent.com",
  "github.com",
];

/**
 * Custom error class for security policy violations.
 * These errors should always propagate and never be silently caught.
 */
class SecurityPolicyError extends Error {
  constructor(message) {
    super(message);
    this.name = "SecurityPolicyError";
  }
}

/**
 * Creates a secure HTTPS agent with TLS 1.2+ enforcement and certificate validation.
 * @returns {https.Agent}
 */
function createSecureAgent() {
  return new https.Agent({
    // Enforce minimum TLS 1.2 (eliminate TLS 1.0, 1.1)
    minVersion: "TLSv1.2",
    // Ensure certificate validation is enabled (reject unauthorized certificates)
    rejectUnauthorized: true,
    // Use strong cipher suites
    ciphers: "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256",
  });
}

/**
 * Validates that a URL is from an allowed domain.
 * @param {string} url
 * @returns {boolean}
 */
function isAllowedDomain(url) {
  try {
    const parsed = new URL(url);

    // Only allow HTTPS protocol
    if (parsed.protocol !== "https:") {
      return false;
    }

    const hostname = parsed.hostname.toLowerCase();

    // Check if hostname matches any allowed domain
    return ALLOWED_DOMAINS.some(
      (allowed) =>
        hostname === allowed || hostname.endsWith(`.${allowed}`)
    );
  } catch {
    return false;
  }
}

/**
 * Secure wrapper around fetch with TLS enforcement and domain validation.
 * @param {string} url
 * @param {RequestInit} [options]
 * @returns {Promise<Response>}
 * @throws {SecurityPolicyError} If URL is not from an allowed domain
 */
async function secureFetch(url, options = {}) {
  // Validate domain before making request
  if (!isAllowedDomain(url)) {
    throw new SecurityPolicyError(
      `Security policy violation: URL domain not allowed. ` +
      `Only connections to ${ALLOWED_DOMAINS.join(", ")} are permitted. ` +
      `Blocked: ${url}`
    );
  }

  // Use secure HTTPS agent with TLS 1.2+ enforcement
  const agent = createSecureAgent();

  return globalThis.fetch(url, {
    ...options,
    // Attach secure agent for Node.js fetch
    // @ts-ignore - agent is supported in Node.js fetch
    agent,
  });
}

/**
 * @param {string} rawSpecifier
 * @returns {{ name: string; versionSpec: string } | null}
 */
export function parseAffectedSpecifier(rawSpecifier) {
  const specifier = String(rawSpecifier ?? "").trim();
  if (!specifier) return null;

  const atIndex = specifier.lastIndexOf("@");
  if (atIndex <= 0) {
    return { name: specifier, versionSpec: "*" };
  }

  return {
    name: specifier.slice(0, atIndex),
    versionSpec: specifier.slice(atIndex + 1),
  };
}

/**
 * @param {unknown} raw
 * @returns {raw is import("./types.ts").FeedPayload}
 */
export function isValidFeedPayload(raw) {
  if (!isObject(raw)) return false;
  if (typeof raw.version !== "string" || !raw.version.trim()) return false;
  if (!Array.isArray(raw.advisories)) return false;

  for (const advisory of raw.advisories) {
    if (!isObject(advisory)) return false;
    if (typeof advisory.id !== "string" || !advisory.id.trim()) return false;
    if (typeof advisory.severity !== "string" || !advisory.severity.trim()) return false;
    if (!Array.isArray(advisory.affected)) return false;
    if (!advisory.affected.every((entry) => typeof entry === "string" && entry.trim())) return false;
  }

  return true;
}

/**
 * @param {string} signatureRaw
 * @returns {Buffer | null}
 */
function decodeSignature(signatureRaw) {
  const trimmed = String(signatureRaw ?? "").trim();
  if (!trimmed) return null;

  let encoded = trimmed;
  if (trimmed.startsWith("{")) {
    try {
      const parsed = JSON.parse(trimmed);
      if (isObject(parsed) && typeof parsed.signature === "string") {
        encoded = parsed.signature;
      }
    } catch {
      return null;
    }
  }

  const normalized = encoded.replace(/\s+/g, "");
  if (!normalized) return null;

  try {
    return Buffer.from(normalized, "base64");
  } catch {
    return null;
  }
}

/**
 * @param {string} payloadRaw
 * @param {string} signatureRaw
 * @param {string} publicKeyPem
 * @returns {boolean}
 */
export function verifySignedPayload(payloadRaw, signatureRaw, publicKeyPem) {
  const signature = decodeSignature(signatureRaw);
  if (!signature) return false;

  const keyPem = String(publicKeyPem ?? "").trim();
  if (!keyPem) return false;

  try {
    const publicKey = crypto.createPublicKey(keyPem);
    return crypto.verify(null, Buffer.from(payloadRaw, "utf8"), publicKey, signature);
  } catch {
    return false;
  }
}

/**
 * @param {string | Buffer} content
 * @returns {string}
 */
function sha256Hex(content) {
  return crypto.createHash("sha256").update(content).digest("hex");
}

/**
 * @param {unknown} value
 * @returns {string | null}
 */
function extractSha256Value(value) {
  if (typeof value === "string") {
    const normalized = value.trim().toLowerCase();
    return /^[a-f0-9]{64}$/.test(normalized) ? normalized : null;
  }

  if (isObject(value) && typeof value.sha256 === "string") {
    const normalized = value.sha256.trim().toLowerCase();
    return /^[a-f0-9]{64}$/.test(normalized) ? normalized : null;
  }

  return null;
}

/**
 * @param {string} manifestRaw
 * @returns {{ schemaVersion: string; algorithm: string; files: Record<string, string> }}
 */
function parseChecksumsManifest(manifestRaw) {
  let parsed;
  try {
    parsed = JSON.parse(manifestRaw);
  } catch {
    throw new Error("Checksum manifest is not valid JSON");
  }

  if (!isObject(parsed)) {
    throw new Error("Checksum manifest must be an object");
  }

  const algorithmRaw = typeof parsed.algorithm === "string" ? parsed.algorithm.trim().toLowerCase() : "sha256";
  if (algorithmRaw !== "sha256") {
    throw new Error(`Unsupported checksum manifest algorithm: ${algorithmRaw || "(empty)"}`);
  }

  // Support legacy manifest formats:
  // - New standard: schema_version field
  // - skill-release.yml: version field (e.g., "0.0.1")
  // - deploy-pages.yml (pre-fix): generated_at field (e.g., "2026-02-08T...")
  // - Ultimate fallback: "1"
  const schemaVersion = (
    typeof parsed.schema_version === "string" ? parsed.schema_version.trim() :
    typeof parsed.version === "string" ? parsed.version.trim() :
    typeof parsed.generated_at === "string" ? parsed.generated_at.trim() :
    "1"
  );

  if (!schemaVersion) {
    throw new Error("Checksum manifest missing schema_version");
  }

  if (!isObject(parsed.files)) {
    throw new Error("Checksum manifest missing files object");
  }

  const files = /** @type {Record<string, string>} */ ({});
  for (const [key, value] of Object.entries(parsed.files)) {
    if (!String(key).trim()) continue;
    const digest = extractSha256Value(value);
    if (!digest) {
      throw new Error(`Invalid checksum digest entry for ${key}`);
    }
    files[key] = digest;
  }

  if (Object.keys(files).length === 0) {
    throw new Error("Checksum manifest has no usable file digests");
  }

  return {
    schemaVersion,
    algorithm: algorithmRaw,
    files,
  };
}

/**
 * @param {string} entryName
 * @returns {string}
 */
function normalizeChecksumEntryName(entryName) {
  return String(entryName ?? "")
    .trim()
    .replace(/\\/g, "/")
    .replace(/^(?:\.\/)+/, "")
    .replace(/^\/+/, "");
}

/**
 * @param {Record<string, string>} files
 * @param {string} entryName
 * @returns {{ key: string; digest: string } | null}
 */
function resolveChecksumManifestEntry(files, entryName) {
  const normalizedEntry = normalizeChecksumEntryName(entryName);
  if (!normalizedEntry) return null;

  const directCandidates = [
    normalizedEntry,
    path.posix.basename(normalizedEntry),
    `advisories/${path.posix.basename(normalizedEntry)}`,
  ].filter((candidate, index, all) => candidate && all.indexOf(candidate) === index);

  for (const candidate of directCandidates) {
    if (Object.prototype.hasOwnProperty.call(files, candidate)) {
      return { key: candidate, digest: files[candidate] };
    }
  }

  const basename = path.posix.basename(normalizedEntry);
  if (!basename) return null;

  const basenameMatches = Object.entries(files).filter(([key]) => {
    const normalizedKey = normalizeChecksumEntryName(key);
    return path.posix.basename(normalizedKey) === basename;
  });

  if (basenameMatches.length > 1) {
    throw new Error(
      `Checksum manifest entry is ambiguous for ${entryName}; ` +
        `multiple manifest keys share basename ${basename}`,
    );
  }

  if (basenameMatches.length === 1) {
    const [resolvedKey, digest] = basenameMatches[0];
    return { key: resolvedKey, digest };
  }

  return null;
}

/**
 * @param {{ files: Record<string, string> }} manifest
 * @param {Record<string, string | Buffer>} expectedEntries
 */
function verifyChecksums(manifest, expectedEntries) {
  for (const [entryName, entryContent] of Object.entries(expectedEntries)) {
    if (!entryName) continue;

    const resolved = resolveChecksumManifestEntry(manifest.files, entryName);
    if (!resolved) {
      throw new Error(`Checksum manifest missing required entry: ${entryName}`);
    }

    const actualDigest = sha256Hex(entryContent);
    if (actualDigest !== resolved.digest) {
      throw new Error(`Checksum mismatch for ${entryName} (manifest key: ${resolved.key})`);
    }
  }
}

/**
 * @param {string} feedUrl
 * @returns {string}
 */
export function defaultChecksumsUrl(feedUrl) {
  try {
    return new URL("checksums.json", feedUrl).toString();
  } catch {
    const fallbackBase = String(feedUrl ?? "").replace(/\/?[^/]*$/, "");
    return `${fallbackBase}/checksums.json`;
  }
}

/**
 * Safely extracts the basename from a URL or file path.
 * @param {string} urlOrPath
 * @param {string} fallback
 * @returns {string}
 */
function safeBasename(urlOrPath, fallback) {
  try {
    // Try parsing as URL first
    const parsed = new URL(urlOrPath);
    const pathname = parsed.pathname;
    const lastSlash = pathname.lastIndexOf("/");
    if (lastSlash >= 0 && lastSlash < pathname.length - 1) {
      return pathname.slice(lastSlash + 1);
    }
  } catch {
    // Not a URL, try as path
    const normalized = String(urlOrPath ?? "").trim();
    const lastSlash = normalized.lastIndexOf("/");
    if (lastSlash >= 0 && lastSlash < normalized.length - 1) {
      return normalized.slice(lastSlash + 1);
    }
  }
  return fallback;
}

/**
 * @param {Function} fetchFn
 * @param {string} targetUrl
 * @returns {Promise<string | null>}
 */
async function fetchText(fetchFn, targetUrl) {
  const controller = new globalThis.AbortController();
  const timeout = globalThis.setTimeout(() => controller.abort(), 10000);

  try {
    const response = await fetchFn(targetUrl, {
      method: "GET",
      signal: controller.signal,
      headers: { accept: "application/json,text/plain;q=0.9,*/*;q=0.8" },
    });
    if (!response.ok) return null;
    return await response.text();
  } catch (error) {
    // Re-throw security policy violations - these should never be silently caught
    if (error instanceof SecurityPolicyError) {
      throw error;
    }
    // Network errors, timeouts, etc. return null (graceful degradation)
    return null;
  } finally {
    globalThis.clearTimeout(timeout);
  }
}

/**
 * @param {string} feedPath
 * @param {{
 *   signaturePath?: string;
 *   checksumsPath?: string;
 *   checksumsSignaturePath?: string;
 *   publicKeyPem?: string;
 *   checksumsPublicKeyPem?: string;
 *   allowUnsigned?: boolean;
 *   verifyChecksumManifest?: boolean;
 *   checksumFeedEntry?: string;
 *   checksumSignatureEntry?: string;
 *   checksumPublicKeyEntry?: string;
 * }} [options]
 * @returns {Promise<import("./types.ts").FeedPayload>}
 */
export async function loadLocalFeed(feedPath, options = {}) {
  const signaturePath = options.signaturePath ?? `${feedPath}.sig`;
  const checksumsPath = options.checksumsPath ?? path.join(path.dirname(feedPath), "checksums.json");
  const checksumsSignaturePath = options.checksumsSignaturePath ?? `${checksumsPath}.sig`;
  const publicKeyPem = String(options.publicKeyPem ?? "");
  const checksumsPublicKeyPem = String(options.checksumsPublicKeyPem ?? publicKeyPem);
  const allowUnsigned = options.allowUnsigned === true;
  const verifyChecksumManifest = options.verifyChecksumManifest !== false;

  const payloadRaw = await loadTextFile(feedPath);

  if (!allowUnsigned) {
    const signatureRaw = await loadTextFile(signaturePath);
    if (!verifySignedPayload(payloadRaw, signatureRaw, publicKeyPem)) {
      throw new Error(`Feed signature verification failed for local feed: ${feedPath}`);
    }

    if (verifyChecksumManifest) {
      const checksumsRaw = await loadTextFile(checksumsPath);
      const checksumsSignatureRaw = await loadTextFile(checksumsSignaturePath);

      if (!verifySignedPayload(checksumsRaw, checksumsSignatureRaw, checksumsPublicKeyPem)) {
        throw new Error(`Checksum manifest signature verification failed: ${checksumsPath}`);
      }

      const checksumsManifest = parseChecksumsManifest(checksumsRaw);
      const checksumFeedEntry = options.checksumFeedEntry ?? path.basename(feedPath);
      const checksumSignatureEntry = options.checksumSignatureEntry ?? path.basename(signaturePath);
      const expectedEntries = /** @type {Record<string, string>} */ ({
        [checksumFeedEntry]: payloadRaw,
        [checksumSignatureEntry]: signatureRaw,
      });

      if (options.checksumPublicKeyEntry) {
        expectedEntries[options.checksumPublicKeyEntry] = publicKeyPem;
      }

      verifyChecksums(checksumsManifest, expectedEntries);
    }
  }

  const payload = JSON.parse(payloadRaw);
  if (!isValidFeedPayload(payload)) {
    throw new Error(`Invalid advisory feed format: ${feedPath}`);
  }
  return payload;
}

/**
 * @param {string} feedUrl
 * @param {{
 *   signatureUrl?: string;
 *   checksumsUrl?: string;
 *   checksumsSignatureUrl?: string;
 *   publicKeyPem?: string;
 *   checksumsPublicKeyPem?: string;
 *   allowUnsigned?: boolean;
 *   verifyChecksumManifest?: boolean;
 *   checksumFeedEntry?: string;
 *   checksumSignatureEntry?: string;
 * }} [options]
 * @returns {Promise<import("./types.ts").FeedPayload | null>}
 */
export async function loadRemoteFeed(feedUrl, options = {}) {
  // Use secure fetch with TLS 1.2+ enforcement and domain validation
  const fetchFn = secureFetch;
  if (typeof fetchFn !== "function") return null;

  const signatureUrl = options.signatureUrl ?? `${feedUrl}.sig`;
  const checksumsUrl = options.checksumsUrl ?? defaultChecksumsUrl(feedUrl);
  const checksumsSignatureUrl = options.checksumsSignatureUrl ?? `${checksumsUrl}.sig`;
  const publicKeyPem = String(options.publicKeyPem ?? "");
  const checksumsPublicKeyPem = String(options.checksumsPublicKeyPem ?? publicKeyPem);
  const allowUnsigned = options.allowUnsigned === true;
  const verifyChecksumManifest = options.verifyChecksumManifest !== false;

  try {
    const payloadRaw = await fetchText(fetchFn, feedUrl);
    if (!payloadRaw) return null;

  if (!allowUnsigned) {
    const signatureRaw = await fetchText(fetchFn, signatureUrl);
    if (!signatureRaw) return null;

    if (!verifySignedPayload(payloadRaw, signatureRaw, publicKeyPem)) {
      return null;
    }

    // Only verify checksums if explicitly requested AND both checksum files are available.
    // Note: Many upstream workflows (e.g., GitHub raw content) don't publish checksums.json,
    // so we gracefully skip verification when these files are missing.
    if (verifyChecksumManifest) {
      const checksumsRaw = await fetchText(fetchFn, checksumsUrl);
      const checksumsSignatureRaw = await fetchText(fetchFn, checksumsSignatureUrl);

      // Only proceed if BOTH checksum files are present
      if (checksumsRaw && checksumsSignatureRaw) {
        if (!verifySignedPayload(checksumsRaw, checksumsSignatureRaw, checksumsPublicKeyPem)) {
          return null;  // Fail-closed: invalid signature
        }

        const checksumsManifest = parseChecksumsManifest(checksumsRaw);
        // Derive checksum entry names from actual URLs (supports any filename, not just feed.json)
        const checksumFeedEntry = options.checksumFeedEntry ?? safeBasename(feedUrl, "feed.json");
        const checksumSignatureEntry = options.checksumSignatureEntry ?? safeBasename(signatureUrl, "feed.json.sig");
        verifyChecksums(checksumsManifest, {
          [checksumFeedEntry]: payloadRaw,
          [checksumSignatureEntry]: signatureRaw,
        });
      }
      // If checksum files missing: continue without checksum verification
      // (feed signature was already verified above at line 328)
    }
  }

    try {
      const payload = JSON.parse(payloadRaw);
      if (!isValidFeedPayload(payload)) return null;
      return payload;
    } catch {
      return null;
    }
  } catch (error) {
    // Security policy violations (invalid URLs, non-HTTPS, disallowed domains) return null
    // to allow graceful fallback to local feed
    if (error instanceof SecurityPolicyError) {
      return null;
    }
    // Re-throw unexpected errors
    throw error;
  }
}

import fs from "node:fs/promises";

export async function loadTextFile(filePath) {
  return await fs.readFile(filePath, "utf8");
}

import fs from "node:fs/promises";
import path from "node:path";
import { isObject, normalizeSkillName, uniqueStrings } from "./utils.mjs";
import { advisoryAppliesToOpenclaw } from "./advisory_scope.mjs";
import { versionMatches } from "./version.mjs";
import { parseAffectedSpecifier } from "./feed.mjs";
import type { Advisory, FeedPayload, InstalledSkill, AdvisoryMatch } from "./types.ts";

export async function discoverInstalledSkills(installRoot: string): Promise<InstalledSkill[]> {
  let entries: import("node:fs").Dirent[];
  try {
    entries = await fs.readdir(installRoot, { withFileTypes: true });
  } catch {
    return [];
  }

  const skills: InstalledSkill[] = [];
  for (const entry of entries) {
    if (!entry.isDirectory()) continue;

    const fallbackName = entry.name;
    const skillDir = path.join(installRoot, entry.name);
    const skillJsonPath = path.join(skillDir, "skill.json");

    let skillName = fallbackName;
    let version: string | null = "unknown";

    try {
      const rawSkillJson = await fs.readFile(skillJsonPath, "utf8");
      const parsedSkillJson = JSON.parse(rawSkillJson);
      if (isObject(parsedSkillJson) && typeof parsedSkillJson.name === "string" && parsedSkillJson.name.trim()) {
        skillName = parsedSkillJson.name.trim();
      }
      if (
        isObject(parsedSkillJson) &&
        typeof parsedSkillJson.version === "string" &&
        parsedSkillJson.version.trim()
      ) {
        version = parsedSkillJson.version.trim();
      }
    } catch {
      // best-effort scan: keep fallback directory name when skill.json is missing or invalid
    }

    skills.push({ name: skillName, dirName: entry.name, version });
  }

  return skills;
}

export function affectedSpecifierMatchesSkill(rawSpecifier: string, skill: InstalledSkill): boolean {
  const parsed = parseAffectedSpecifier(rawSpecifier);
  if (!parsed) return false;

  const specName = normalizeSkillName(parsed.name);
  const skillName = normalizeSkillName(skill.name);
  if (specName !== skillName) return false;

  return versionMatches(skill.version, parsed.versionSpec);
}

export function advisoryMatchesSkill(advisory: Advisory, skill: InstalledSkill): string[] {
  const affected = Array.isArray(advisory.affected) ? advisory.affected : [];
  const matches = affected.filter((specifier) => affectedSpecifierMatchesSkill(specifier, skill));
  return uniqueStrings(matches);
}

export function findMatches(feed: FeedPayload, installedSkills: InstalledSkill[]): AdvisoryMatch[] {
  const matches: AdvisoryMatch[] = [];

  for (const advisory of feed.advisories) {
    if (!advisoryAppliesToOpenclaw(advisory)) continue;

    const affected = Array.isArray(advisory.affected) ? advisory.affected : [];
    if (affected.length === 0) continue;

    for (const skill of installedSkills) {
      const matchedAffected = advisoryMatchesSkill(advisory, skill);
      if (matchedAffected.length === 0) continue;
      matches.push({ advisory, skill, matchedAffected });
    }
  }

  return matches;
}

export function matchKey(match: AdvisoryMatch): string {
  const normalizedSkillName = normalizeSkillName(match.skill.name);
  const version = match.skill.version ?? "unknown";
  const advisoryId =
    match.advisory.id ??
    `${match.advisory.title ?? "untitled"}::${match.advisory.published ?? match.advisory.updated ?? "unknown-ts"}`;
  return `${advisoryId}::${normalizedSkillName}@${version}`;
}

export function looksMalicious(advisory: Advisory): boolean {
  const type = String(advisory.type ?? "").toLowerCase();
  const combined = `${advisory.title ?? ""} ${advisory.description ?? ""} ${advisory.action ?? ""}`.toLowerCase();

  if (type === "malicious_skill" || type === "malicious_plugin") return true;
  if (/\b(malicious|exfiltrat(e|ion)|backdoor|trojan|credential theft|stealer)\b/.test(combined)) return true;
  return false;
}

export function looksRemovalRecommended(advisory: Advisory): boolean {
  const combined = `${advisory.action ?? ""} ${advisory.title ?? ""} ${advisory.description ?? ""}`.toLowerCase();
  return /\b(remove|uninstall|delete|disable|do not use|quarantine)\b/.test(combined);
}

export function buildAlertMessage(matches: AdvisoryMatch[], installRoot: string): string {
  const lines: string[] = [];
  lines.push("CLAWSEC ALERT: advisory feed matches installed skill(s).");
  lines.push("Affected skill advisories:");

  const MAX_LISTED = 8;
  for (const match of matches.slice(0, MAX_LISTED)) {
    const severity = String(match.advisory.severity ?? "unknown").toUpperCase();
    const advisoryId = match.advisory.id ?? "unknown-id";
    const version = match.skill.version ?? "unknown";
    const matched = match.matchedAffected.join(", ");
    lines.push(
      `- [${severity}] ${advisoryId} -> ${match.skill.name}@${version}` +
        (matched ? ` (matched: ${matched})` : ""),
    );
    if (match.advisory.action) {
      lines.push(`  Action: ${match.advisory.action}`);
    }
  }

  if (matches.length > MAX_LISTED) {
    lines.push(`- ... ${matches.length - MAX_LISTED} additional match(es) not shown`);
  }

  const removalMatches = matches.filter((entry) => looksMalicious(entry.advisory) || looksRemovalRecommended(entry.advisory));
  if (removalMatches.length > 0) {
    const impactedSkills = uniqueStrings(removalMatches.map((entry) => entry.skill.name));
    const impactedDirs = uniqueStrings(removalMatches.map((entry) => entry.skill.dirName));
    lines.push("");
    lines.push("Recommendation: one or more matches indicate potentially malicious or unsafe skills.");
    lines.push("Best practice: remove or disable affected skills only after explicit user approval.");
    lines.push(
      "Double-confirmation policy: treat the install request as first intent and require an additional explicit confirmation with this advisory context.",
    );
    lines.push(`Approval needed: ask the user to approve removal of: ${impactedSkills.join(", ")}.`);
    lines.push("Candidate removal paths:");
    for (const dir of impactedDirs) {
      lines.push(`- ${path.join(installRoot, dir)}`);
    }
  } else {
    lines.push("");
    lines.push("Recommendation: review advisories and update/remove affected skills as directed.");
  }

  return lines.join("\n");
}

import fs from "node:fs/promises";
import path from "node:path";
import { isObject, uniqueStrings } from "./utils.mjs";
import type { AdvisoryState } from "./types.ts";

export const DEFAULT_STATE: AdvisoryState = {
  schema_version: "1.1",
  known_advisories: [],
  last_feed_check: null,
  last_feed_updated: null,
  last_hook_scan: null,
  notified_matches: {},
};

export function normalizeState(raw: unknown): AdvisoryState {
  if (!isObject(raw)) {
    return { ...DEFAULT_STATE };
  }

  const knownAdvisories = Array.isArray(raw.known_advisories)
    ? uniqueStrings(raw.known_advisories.filter((value): value is string => typeof value === "string" && value.trim() !== ""))
    : [];

  const notifiedMatches: Record<string, string> = {};
  if (isObject(raw.notified_matches)) {
    for (const [key, value] of Object.entries(raw.notified_matches)) {
      if (typeof value === "string" && value.trim()) {
        notifiedMatches[key] = value;
      }
    }
  }

  return {
    schema_version: "1.1",
    known_advisories: knownAdvisories,
    last_feed_check: typeof raw.last_feed_check === "string" ? raw.last_feed_check : null,
    last_feed_updated: typeof raw.last_feed_updated === "string" ? raw.last_feed_updated : null,
    last_hook_scan: typeof raw.last_hook_scan === "string" ? raw.last_hook_scan : null,
    notified_matches: notifiedMatches,
  };
}

export async function loadState(stateFile: string): Promise<AdvisoryState> {
  try {
    const raw = await fs.readFile(stateFile, "utf8");
    return normalizeState(JSON.parse(raw));
  } catch {
    return { ...DEFAULT_STATE };
  }
}

export async function persistState(stateFile: string, state: AdvisoryState): Promise<void> {
  const normalized = normalizeState(state);
  await fs.mkdir(path.dirname(stateFile), { recursive: true });
  const tmpFile = `${stateFile}.tmp-${process.pid}-${Date.now()}`;
  await fs.writeFile(tmpFile, `${JSON.stringify(normalized, null, 2)}\n`, {
    encoding: "utf8",
    mode: 0o600,
  });
  await fs.rename(tmpFile, stateFile);
  try {
    await fs.chmod(stateFile, 0o600);
  } catch (err: unknown) {
    const code = err instanceof Error && "code" in err ? (err as { code: string }).code : undefined;
    if (code === "ENOTSUP" || code === "EPERM") {
      console.warn(
        `Warning: chmod 0600 failed for ${stateFile} (${code}). ` +
          "File permissions may not be enforced on this platform/filesystem.",
      );
    } else {
      throw err;
    }
  }
}

import fs from "node:fs/promises";
import path from "node:path";
import os from "node:os";
import { isObject, normalizeSkillName, resolveUserPath } from "./utils.mjs";

const DEFAULT_PRIMARY_PATH = path.join(os.homedir(), ".openclaw", "security-audit.json");
const DEFAULT_FALLBACK_PATH = ".clawsec/allowlist.json";

const EMPTY_CONFIG = Object.freeze({
  suppressions: [],
  enabledFor: [],
  source: "none",
});

/**
 * @param {unknown} entry
 * @param {number} index
 * @param {string} source
 * @returns {{ checkId: string, skill: string, reason: string, suppressedAt: string }}
 */
function normalizeRule(entry, index, source) {
  if (!isObject(entry)) {
    throw new Error(`Suppression entry at index ${index} in ${source} must be an object`);
  }

  const checkId = typeof entry.checkId === "string" ? entry.checkId.trim() : "";
  const skill = typeof entry.skill === "string" ? entry.skill.trim() : "";
  const reason = typeof entry.reason === "string" ? entry.reason.trim() : "";
  const suppressedAt = typeof entry.suppressedAt === "string" ? entry.suppressedAt.trim() : "";

  if (!checkId) throw new Error(`Suppression entry at index ${index} in ${source} missing required field: checkId`);
  if (!skill) throw new Error(`Suppression entry at index ${index} in ${source} missing required field: skill`);
  if (!reason) throw new Error(`Suppression entry at index ${index} in ${source} missing required field: reason`);
  if (!suppressedAt) throw new Error(`Suppression entry at index ${index} in ${source} missing required field: suppressedAt`);

  return { checkId, skill, reason, suppressedAt };
}

/**
 * @param {unknown} raw
 * @param {string} source
 * @returns {{ suppressions: Array, enabledFor: string[], source: string }}
 */
function parseConfig(raw, source) {
  if (!isObject(raw)) {
    throw new Error(`Config at ${source} must be a JSON object`);
  }

  if (!Array.isArray(raw.suppressions)) {
    throw new Error(`Config at ${source} missing 'suppressions' array`);
  }

  const suppressions = [];
  for (let i = 0; i < raw.suppressions.length; i++) {
    suppressions.push(normalizeRule(raw.suppressions[i], i, source));
  }

  const enabledFor = Array.isArray(raw.enabledFor)
    ? raw.enabledFor
        .filter((v) => typeof v === "string" && v.trim() !== "")
        .map((v) => v.trim().toLowerCase())
    : [];

  return { suppressions, enabledFor, source };
}

/**
 * @param {string} configPath
 * @returns {Promise<{ suppressions: Array, enabledFor: string[], source: string } | null>}
 */
async function loadConfigFromPath(configPath) {
  try {
    const raw = await fs.readFile(configPath, "utf8");
    return parseConfig(JSON.parse(raw), configPath);
  } catch (err) {
    if (err.code === "ENOENT") return null;
    if (err.code === "EACCES") throw new Error(`Permission denied reading config: ${configPath}`, { cause: err });
    if (err instanceof SyntaxError) throw new Error(`Malformed JSON in ${configPath}: ${err.message}`, { cause: err });
    throw err;
  }
}

/**
 * Load advisory suppression config using the same 4-tier path resolution
 * as the audit watchdog config loader.
 *
 * The config file must include "advisory" in its enabledFor sentinel
 * array for advisory suppression to activate. No CLI flag needed -- the
 * sentinel in the config file IS the gate.
 *
 * @param {string} [configPath] - Optional explicit config file path
 * @returns {Promise<{ suppressions: Array, enabledFor: string[], source: string }>}
 */
export async function loadAdvisorySuppression(configPath) {
  // Priority 1: Explicit path
  if (configPath) {
    const resolved = resolveUserPath(configPath, { label: "advisory suppression config path" });
    const config = await loadConfigFromPath(resolved);
    if (!config) throw new Error(`Advisory suppression config not found: ${resolved}`);
    if (!config.enabledFor.includes("advisory")) return { ...EMPTY_CONFIG };
    return config;
  }

  // Priority 2: Environment variable
  const envPath = process.env.OPENCLAW_AUDIT_CONFIG;
  if (typeof envPath === "string" && envPath.trim()) {
    const resolved = resolveUserPath(envPath.trim(), { label: "OPENCLAW_AUDIT_CONFIG" });
    const config = await loadConfigFromPath(resolved);
    if (config && config.enabledFor.includes("advisory")) return config;
    return { ...EMPTY_CONFIG };
  }

  // Priority 3: Primary default path
  const primary = await loadConfigFromPath(DEFAULT_PRIMARY_PATH);
  if (primary && primary.enabledFor.includes("advisory")) return primary;

  // Priority 4: Fallback path
  const fallback = await loadConfigFromPath(DEFAULT_FALLBACK_PATH);
  if (fallback && fallback.enabledFor.includes("advisory")) return fallback;

  return { ...EMPTY_CONFIG };
}

/**
 * Check if an advisory match should be suppressed.
 *
 * Matching requires BOTH:
 *   - advisory.id === rule.checkId (exact)
 *   - normalizeSkillName(skill.name) === normalizeSkillName(rule.skill) (case-insensitive)
 *
 * @param {{ advisory: { id?: string }, skill: { name: string } }} match
 * @param {Array<{ checkId: string, skill: string }>} suppressions
 * @returns {boolean}
 */
export function isAdvisorySuppressed(match, suppressions) {
  if (!Array.isArray(suppressions) || suppressions.length === 0) return false;

  const advisoryId = match.advisory.id ?? "";
  const skillName = normalizeSkillName(match.skill.name);

  return suppressions.some(
    (rule) => rule.checkId === advisoryId && normalizeSkillName(rule.skill) === skillName,
  );
}

export type HookEvent = {
  type?: string;
  action?: string;
  messages?: string[];
};

export type Advisory = {
  id?: string;
  ghsa_id?: string;
  cve_id?: string | null;
  status?: string;
  stale?: boolean;
  source_feed?: string;
  severity?: string;
  type?: string;
  application?: string | string[];
  title?: string;
  description?: string;
  action?: string;
  published?: string;
  updated?: string;
  affected?: string[];
  platforms?: string[];
  references?: string[];
  nvd_url?: string | null;
  github_advisory_url?: string;
};

export type FeedPayload = {
  version: string;
  updated?: string;
  advisories: Advisory[];
};

export type InstalledSkill = {
  name: string;
  dirName: string;
  version: string | null;
};

export type AdvisoryMatch = {
  advisory: Advisory;
  skill: InstalledSkill;
  matchedAffected: string[];
};

export type AdvisoryState = {
  schema_version: string;
  known_advisories: string[];
  last_feed_check: string | null;
  last_feed_updated: string | null;
  last_hook_scan: string | null;
  notified_matches: Record<string, string>;
};

import os from "node:os";
import path from "node:path";

/**
 * @param {unknown} value
 * @returns {value is Record<string, unknown>}
 */
export function isObject(value) {
  return typeof value === "object" && value !== null;
}

/**
 * @param {string} value
 * @returns {string}
 */
export function normalizeSkillName(value) {
  return String(value ?? "")
    .trim()
    .toLowerCase();
}

/**
 * @param {string[]} values
 * @returns {string[]}
 */
export function uniqueStrings(values) {
  return Array.from(new Set(values));
}

function detectHomeDirectory(env = process.env) {
  if (typeof env.HOME === "string" && env.HOME.trim()) return env.HOME.trim();
  if (typeof env.USERPROFILE === "string" && env.USERPROFILE.trim()) return env.USERPROFILE.trim();
  if (
    typeof env.HOMEDRIVE === "string" &&
    env.HOMEDRIVE.trim() &&
    typeof env.HOMEPATH === "string" &&
    env.HOMEPATH.trim()
  ) {
    return `${env.HOMEDRIVE.trim()}${env.HOMEPATH.trim()}`;
  }
  return os.homedir();
}

const UNEXPANDED_HOME_TOKEN_PATTERN =
  /(?:^|[\\/])(?:\\?\$HOME|\\?\$\{HOME\}|\\?\$USERPROFILE|\\?\$\{USERPROFILE\}|%HOME%|%USERPROFILE%|\$env:HOME|\$env:USERPROFILE)(?:$|[\\/])/i;

/**
 * @param {string} value
 * @returns {string}
 */
function expandKnownHomeTokens(value) {
  const homeDir = detectHomeDirectory(process.env);
  if (!homeDir) return value;

  let expanded = String(value ?? "");

  if (expanded === "~") {
    expanded = homeDir;
  } else if (expanded.startsWith("~/") || expanded.startsWith("~\\")) {
    expanded = path.join(homeDir, expanded.slice(2));
  }

  expanded = expanded
    .replace(/(?<!\\)\$\{HOME\}/g, homeDir)
    .replace(/(?<!\\)\$HOME(?=$|[\\/])/g, homeDir)
    .replace(/(?<!\\)\$\{USERPROFILE\}/gi, homeDir)
    .replace(/(?<!\\)\$USERPROFILE(?=$|[\\/])/gi, homeDir)
    .replace(/%HOME%/gi, homeDir)
    .replace(/%USERPROFILE%/gi, homeDir)
    .replace(/(?<!\\)\$env:HOME/gi, homeDir)
    .replace(/(?<!\\)\$env:USERPROFILE/gi, homeDir);

  return expanded;
}

/**
 * @param {string} value
 * @returns {boolean}
 */
export function hasUnexpandedHomeToken(value) {
  return UNEXPANDED_HOME_TOKEN_PATTERN.test(String(value ?? "").trim());
}

/**
 * Expand `~` and known home env var patterns in user-provided path-like strings.
 * Also fails fast when unresolved home tokens remain.
 *
 * @param {string} inputPath
 * @param {{label?: string}} [options]
 * @returns {string}
 */
export function resolveUserPath(inputPath, { label = "path" } = {}) {
  const raw = String(inputPath ?? "").trim();
  if (!raw) return raw;

  const expanded = expandKnownHomeTokens(raw);
  const normalized = path.normalize(expanded);

  if (hasUnexpandedHomeToken(normalized)) {
    throw new Error(
      `Unexpanded home token detected in ${label}: ${raw}. ` +
        "Use an absolute path or an unquoted home-path expression.",
    );
  }

  return normalized;
}

/**
 * Resolve an optional explicit path; if invalid, fall back to a default path.
 *
 * @param {string | undefined} explicitPath
 * @param {string} fallbackPath
 * @param {{label?: string, onInvalid?: (error: unknown, rawValue: string) => void}} [options]
 * @returns {string}
 */
export function resolveConfiguredPath(
  explicitPath,
  fallbackPath,
  { label = "path", onInvalid } = {},
) {
  const explicit = typeof explicitPath === "string" ? explicitPath.trim() : "";
  if (!explicit) {
    return resolveUserPath(fallbackPath, { label });
  }

  try {
    return resolveUserPath(explicit, { label });
  } catch (error) {
    if (typeof onInvalid === "function") {
      onInvalid(error, explicit);
    }
    return resolveUserPath(fallbackPath, { label });
  }
}