2 Commits

Author	SHA1	Message	Date
orbisai0security	2b21908fab	fix: sanitize subprocess call in run_eval.py (#14842) ... ## Summary Fix critical severity security issue in `resources/skills/skill-creator/scripts/run_eval.py`. ## Vulnerability | Field | Value | |-------|-------| | **ID** | V-001 | | **Severity** | CRITICAL | | **Scanner** | multi_agent_ai | | **Rule** | `V-001` | | **File** | `resources/skills/skill-creator/scripts/run_eval.py:85` | | **CWE** | CWE-78 | **Description**: Three Python scripts in the skill-creator pipeline invoke subprocess.Popen/run with shell=True and incorporate user-supplied CLI arguments into the command string without sanitization. When shell=True is used, the operating system shell interprets special characters (semicolons, pipes, backticks, dollar signs) as command separators and substitution operators, enabling an attacker to append arbitrary OS commands to any legitimate argument. ## Changes - `resources/skills/skill-creator/scripts/run_eval.py` - `resources/skills/skill-creator/scripts/improve_description.py` - `resources/skills/skill-creator/eval-viewer/generate_review.py` ## Verification - [x] Build passes - [x] Scanner re-scan confirms fix - [x] LLM code review passed --- *Automated security fix by [OrbisAI Security](https://orbisappsec.com)* Signed-off-by: orbisai0security <mediratta01.pally@gmail.com>	2026-05-09 14:46:47 +08:00
LiuVaayne	a4f5191e42	feat(agents): add CherryClaw autonomous agent type (#13359) ... ### What this PR does Before this PR: Cherry Studio only supports `claude-code` as an agent type. Agents have no autonomous scheduling, no IM channel integration, and no soul/personality system. After this PR: Introduces **CherryClaw** — a new autonomous agent type with: - **Soul-driven personality**: Markdown-based soul files with mtime-cached reading - **Task-based scheduler**: Poll-loop scheduler with drift-resistant interval computation, tasks as first-class DB entities (nanoclaw-inspired) - **Internal claw MCP server**: `cron` tool (add/list/remove) auto-injected into CherryClaw sessions for autonomous task management - **Channel abstraction layer**: Pluggable adapter pattern with Telegram as the first implementation (grammY, long polling, streaming drafts, typing indicators) - **Headless message persistence**: Channel and scheduler messages now persist to the agent SQLite DB - **Basic sandbox mode**: PreToolUse hook path enforcement + OS-level sandbox toggle - **Full UI**: Agent creation modal with type selector, settings tabs (soul, tasks, channels, advanced), task management CRUD, channel catalog with inline config - **53 unit tests** across 8 test files covering all new services <!-- Fixes # --> ### Why we need it and why it was done in this way CherryClaw enables Cherry Studio agents to operate autonomously — executing scheduled tasks and responding to IM messages without user interaction. This is the foundation for "always-on" AI assistants. The following tradeoffs were made: - **Poll-loop scheduler over timer-based**: DB is the source of truth; no timer state to restore on restart. Simpler, more robust at the cost of up to 60s latency. - **AgentServiceRegistry pattern**: Replaced hardcoded `ClaudeCodeService` in `SessionMessageService` with a registry mapping `AgentType` → service. Extensible for future agent types. - **Internal MCP server for cron**: Rather than extending the SDK's tool system, the `cron` tool is served as a standard MCP server at `/v1/claw/:agentId/claw-mcp`. This lets the agent discover and use it naturally. - **Channel abstraction over direct Telegram integration**: `ChannelAdapter` + factory registration enables future Discord/Slack adapters without touching core routing logic. - **Basic sandbox (not security boundary)**: PreToolUse hook + OS sandbox provides best-effort restriction for well-behaved agents. Known bypass vectors documented; hardening deferred. The following alternatives were considered: - cron-based OS scheduling (rejected: harder to manage lifecycle, no DB integration) - Direct Telegram bot API calls (rejected: grammY provides typed API, connection management, and middleware) - Modifying SDK builtin tools (rejected: internal MCP server is cleaner separation) ### Breaking changes None. This is a new agent type (`cherry-claw`) alongside the existing `claude-code` type. No existing behavior is modified. ### Special notes for your reviewer - **New DB migration**: `0003_wise_meltdown.sql` adds `scheduled_tasks` and `task_run_logs` tables (agents DB only, not IndexedDB) - **New dependencies**: `cron-parser` ^5.5.0, `grammy` ^1.41 - **Placeholder avatar**: `cherry-claw.png` is currently a copy of `claude.png` — needs a proper distinct image - **74 files changed, ~7400 lines added** — large PR, recommend reviewing by phase (type system → backend services → MCP → channels → UI → tests) - **Sandbox is basic only**: The PreToolUse path checking has known bypasses (relative paths, variable expansion). Documented in handoff.md. Hardening is follow-up work. - The `handoff.md` file in the repo root contains full architectural context and decisions ### Checklist - [x] PR: The PR description is expressive enough and will help future contributors - [x] Code: [Write code that humans can understand](https://en.wikiquote.org/wiki/Martin_Fowler#code-for-humans) and [Keep it simple](https://en.wikipedia.org/wiki/KISS_principle) - [x] Refactor: You have [left the code cleaner than you found it (Boy Scout Rule)](https://learning.oreilly.com/library/view/97-things-every/9780596809515/ch08.html) - [ ] Upgrade: Impact of this change on upgrade flows was considered and addressed if required - [ ] Documentation: A [user-guide update](https://docs.cherry-ai.com) was considered and is present (link) or not required. Check this only when the PR introduces or changes a user-facing feature or behavior. - [ ] Self-review: I have reviewed my own code (e.g., via [`/gh-pr-review`](/.claude/skills/gh-pr-review/SKILL.md), `gh pr diff`, or GitHub UI) before requesting review from others ### Release note ```release-note New CherryClaw agent type: autonomous agents with soul-driven personality, task-based scheduling (cron/interval/one-time), internal cron MCP tool for self-managed tasks, Telegram channel integration with streaming responses, and basic sandbox mode for filesystem restriction. ``` --------- Signed-off-by: Vaayne <liu.vaayne@gmail.com> Signed-off-by: suyao <sy20010504@gmail.com> Signed-off-by: Siin Xu <31815270+SiinXu@users.noreply.github.com> Signed-off-by: zhangjiadi225 <625013594@qq.com> Signed-off-by: greycheng255 <greycheng255@gmail.com> Co-authored-by: kangfenmao <kangfenmao@qq.com> Co-authored-by: suyao <sy20010504@gmail.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Siin Xu <31815270+SiinXu@users.noreply.github.com> Co-authored-by: fullex <106392080+0xfullex@users.noreply.github.com> Co-authored-by: zhangjiadi225 <625013594@qq.com>	2026-04-03 14:18:02 +08:00