github/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-05-09 00:08:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(exec): split safe-bin policy modules and dedupe allowlist flow

Browse Source
This commit is contained in:
Peter Steinberger
2026-02-24 03:04:57 +00:00
parent c5ac90ab92
commit 9530c01085
4 changed files with 565 additions and 506 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
src/infra/exec-approvals-allowlist.ts
View File

@@ -178,6 +178,13 @@ function evaluateSegments(
return { satisfied, matches, segmentSatisfiedBy };
}
function resolveAnalysisSegmentGroups(analysis: ExecCommandAnalysis): ExecCommandSegment[][] {
if (analysis.chains) {
return analysis.chains;
}
return [analysis.segments];
}
export function evaluateExecAllowlist(params: {
analysis: ExecCommandAnalysis;
allowlist: ExecAllowlistEntry[];
@@ -195,44 +202,32 @@ export function evaluateExecAllowlist(params: {
return { allowlistSatisfied: false, allowlistMatches, segmentSatisfiedBy };
}
// If the analysis contains chains, evaluate each chain part separately
if (params.analysis.chains) {
for (const chainSegments of params.analysis.chains) {
const result = evaluateSegments(chainSegments, {
allowlist: params.allowlist,
safeBins: params.safeBins,
safeBinProfiles: params.safeBinProfiles,
cwd: params.cwd,
platform: params.platform,
trustedSafeBinDirs: params.trustedSafeBinDirs,
skillBins: params.skillBins,
autoAllowSkills: params.autoAllowSkills,
});
if (!result.satisfied) {
return { allowlistSatisfied: false, allowlistMatches: [], segmentSatisfiedBy: [] };
const hasChains = Boolean(params.analysis.chains);
for (const group of resolveAnalysisSegmentGroups(params.analysis)) {
const result = evaluateSegments(group, {
allowlist: params.allowlist,
safeBins: params.safeBins,
safeBinProfiles: params.safeBinProfiles,
cwd: params.cwd,
platform: params.platform,
trustedSafeBinDirs: params.trustedSafeBinDirs,
skillBins: params.skillBins,
autoAllowSkills: params.autoAllowSkills,
});
if (!result.satisfied) {
if (!hasChains) {
return {
allowlistSatisfied: false,
allowlistMatches: result.matches,
segmentSatisfiedBy: result.segmentSatisfiedBy,
};
}
allowlistMatches.push(...result.matches);
segmentSatisfiedBy.push(...result.segmentSatisfiedBy);
return { allowlistSatisfied: false, allowlistMatches: [], segmentSatisfiedBy: [] };
}
return { allowlistSatisfied: true, allowlistMatches, segmentSatisfiedBy };
allowlistMatches.push(...result.matches);
segmentSatisfiedBy.push(...result.segmentSatisfiedBy);
}
// No chains, evaluate all segments together
const result = evaluateSegments(params.analysis.segments, {
allowlist: params.allowlist,
safeBins: params.safeBins,
safeBinProfiles: params.safeBinProfiles,
cwd: params.cwd,
platform: params.platform,
trustedSafeBinDirs: params.trustedSafeBinDirs,
skillBins: params.skillBins,
autoAllowSkills: params.autoAllowSkills,
});
return {
allowlistSatisfied: result.satisfied,
allowlistMatches: result.matches,
segmentSatisfiedBy: result.segmentSatisfiedBy,
};
return { allowlistSatisfied: true, allowlistMatches, segmentSatisfiedBy };
}
export type ExecAllowlistAnalysis = {