mirror of
https://github.com/openclaw/openclaw.git
synced 2026-07-09 03:45:19 +08:00
062f88e3e3
* refactor: extract reusable AI runtime package * refactor: complete AI provider relocation * refactor: keep llm core internal * refactor(ai): make @openclaw/ai self-contained with host policy ports Move pure transport helpers (tool projections, strict-schema normalization, prompt-cache boundary, stream guards, anthropic/openai compat, request activity) from src into packages/ai; move utf16-slice into normalization-core. Inject host policy (guarded fetch, redaction, strict-tool defaults, diagnostics logging) through AiTransportHost with inert library defaults installed by src/llm/stream.ts. Narrow the public barrel to instance-scoped createApiRegistry/createLlmRuntime; the process-default runtime moves behind internal/ and registerBuiltInApiProviders takes an explicit registry. Delete the src/llm/api-registry re-export facade. * fix(ai): teach node, jiti, and vite resolvers the @openclaw/ai and utf16-slice subpaths The workspace alias tables in root-alias.cjs, plugin-sdk-native-resolver, sdk-alias, the shared vitest config, and the Control UI vite config only knew @openclaw/llm-core; Node-side plugin loading resolved @openclaw/ai through the pnpm symlink to the unbuilt dist (checks-node-compact CI failures), and the Control UI build broke on the new normalization-core/utf16-slice subpath. * chore(ui): drop leftover service-worker debug logging * build(release): ship @openclaw/ai with its own shrinkwrap and honest dependency set packages/ai declares only its six real runtime deps (kysely, chalk, json5, tslog, zod, fs-safe, and proxyline were never imported); orphaned root deps removed. generate-npm-shrinkwrap now treats publishable packages/* like publishable plugins so the AI tarball pins its transitive tree even though workspace deps are omitted from the root shrinkwrap. knip learns the package entry points; the tsdown dts neverBundle option moves to its documented deps.dts home; the README documents the no-semver internal/* contract and host ports. * docs(ai): add minimal external-consumer example app examples/ai-chat consumes only the public @openclaw/ai surface (built dist via the workspace link): isolated runtime, built-in provider registration, one streamed completion. Supports Anthropic/OpenAI via env keys and a keyless local Ollama target; live-verified against Ollama. * docs(ai): document the @openclaw/ai package and workspace shrinkwrap boundary * chore(check): include examples/ in duplicate-scan targets * fix: emit normalization package subpaths * fix: complete AI package boundary artifacts * fix: align AI package boundary contracts * fix(ci): stabilize package release contracts * test: align documentation contract checks * test: keep cron docs guard aligned * test: align restored docs contract guards * test: follow upstream docs contracts * docs: drop superseded talk wording
58 lines
1.6 KiB
YAML
58 lines
1.6 KiB
YAML
name: openclaw-codeql-mcp-process-tool-boundary-critical-security
|
|
|
|
disable-default-queries: true
|
|
|
|
queries:
|
|
- uses: security-extended
|
|
|
|
query-filters:
|
|
- include:
|
|
precision:
|
|
- high
|
|
- very-high
|
|
tags contain: security
|
|
security-severity: /([7-9]|10)\.(\d)+/
|
|
|
|
paths:
|
|
- src/mcp
|
|
- src/process
|
|
- src/infra/outbound
|
|
- src/agents/bash-tools.exec*.ts
|
|
- src/agents/bash-tools.process*.ts
|
|
- src/agents/exec-*.ts
|
|
- src/agents/execution-contract.ts
|
|
- src/agents/openclaw-plugin-tools.ts
|
|
- src/agents/openclaw-tools.runtime.ts
|
|
- src/agents/openclaw-tools.registration.ts
|
|
- src/agents/agent-tool-definition-adapter.ts
|
|
- src/agents/agent-tools.abort.ts
|
|
- src/agents/agent-tools.before-tool-call*.ts
|
|
- src/agents/agent-tools.read.ts
|
|
- packages/ai/src/providers/agent-tools-parameter-schema.ts
|
|
- src/agents/sessions/tools/**
|
|
- src/agents/embedded-agent-runner/effective-tool-policy.ts
|
|
- src/agents/embedded-agent-runner/tool-name-allowlist.ts
|
|
- src/agents/embedded-agent-runner/tool-schema-runtime.ts
|
|
- src/agents/tools/gateway-tool.ts
|
|
- src/agents/tools/message-tool.ts
|
|
- src/agents/tools/sessions-send-tool.ts
|
|
- src/agents/tools/sessions-spawn-tool.ts
|
|
- src/agents/tools/subagents-tool.ts
|
|
- src/agents/tools/tool-runtime.helpers.ts
|
|
|
|
paths-ignore:
|
|
- "**/node_modules"
|
|
- "**/coverage"
|
|
- "**/*.generated.ts"
|
|
- "**/*.bundle.js"
|
|
- "**/*-runtime.js"
|
|
- "**/*.test.ts"
|
|
- "**/*.test.tsx"
|
|
- "**/*.e2e.test.ts"
|
|
- "**/*.e2e.test.tsx"
|
|
- "**/*test-support*"
|
|
- "**/*test-helper*"
|
|
- "**/*mock*"
|
|
- "**/*fixture*"
|
|
- "**/*bench*"
|