dwc1997 cffae53b43 fix(security): classify broad Windows SIDs as world principals ...

Carry Windows ACL world-principal classification through @openclaw/fs-safe@0.2.2 so Anonymous Logon, Guests, Interactive, Network, and Local SID/principal variants are treated as world-equivalent in filesystem audit findings.

Also add regression coverage, changelog coverage, a narrow lint cleanup, and a UI test isolation fix needed by the current CI shard.

Co-authored-by: dwc <118101032587@njust.edu.cn>

2026-05-13 15:19:02 -05:00

..

audit-channel-account-metadata.test.ts

test: tighten security audit assertions

2026-05-09 23:52:39 +01:00

audit-channel-dm-policy.test.ts

test: tighten security audit assertions

2026-05-09 23:52:39 +01:00

audit-channel-readonly-resolution.test.ts

test: clear weak assertion scan

2026-05-08 21:11:12 +01:00

audit-channel-readonly-setup-fallback.test.ts

test: tighten readonly channel audit assertions

2026-05-10 00:03:32 +01:00

audit-channel-source-config-discord.test.ts

test: tighten security audit source assertions

2026-05-09 23:06:28 +01:00

audit-channel-source-config-slack.test.ts

test: tighten security audit source assertions

2026-05-09 23:06:28 +01:00

audit-channel-test-helpers.ts

…

audit-channel.collect.runtime.ts

…

audit-channel.ts

refactor: centralize channel ingress access

2026-05-10 00:18:36 -04:00

audit-config-basics.test.ts

…

audit-config-include-perms.test.ts

test: tighten security config audit assertions

2026-05-09 23:05:04 +01:00

audit-config-symlink.test.ts

test: tighten security config audit assertions

2026-05-09 23:05:04 +01:00

audit-deep-code-safety.ts

…

audit-deep-probe-findings.ts

…

audit-exec-safe-bins.test.ts

test: clear weak assertion scan

2026-05-08 21:11:12 +01:00

audit-exec-sandbox-host.test.ts

…

audit-exec-surface.test.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

audit-extra.async.test.ts

fix(plugins): scan installed dependency runtime code [AI] (#81066)

2026-05-13 10:26:24 +05:30

audit-extra.async.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

audit-extra.summary.ts

fix(security): honor model tool denies in audit

2026-05-10 07:21:23 +01:00

audit-extra.sync.test.ts

fix(security): honor model tool denies in audit

2026-05-10 07:21:23 +01:00

audit-extra.sync.ts

feat: wire talk handoff into native nodes

2026-05-06 02:39:15 +01:00

audit-filesystem-windows.test.ts

fix(security): classify broad Windows SIDs as world principals

2026-05-13 15:19:02 -05:00

audit-fs.ts

[codex] Extract filesystem safety primitives (#77918)

2026-05-06 02:15:17 +01:00

audit-gateway-auth-selection.test.ts

test: clear weak assertion scan

2026-05-08 21:11:12 +01:00

audit-gateway-config.ts

fix(doctor): warn when OPENCLAW_GATEWAY_TOKEN env overrides gateway.auth.token config (#74433)

2026-05-05 14:54:15 -04:00

audit-gateway-exposure.test.ts

test: tighten gateway exposure assertions

2026-05-10 00:00:43 +01:00

audit-gateway-http-auth.test.ts

test: tighten security audit finding assertions

2026-05-09 23:00:07 +01:00

audit-gateway-tools-http.test.ts

…

audit-gateway.test.ts

fix(gateway): clarify token source conflict warning

2026-05-11 07:56:12 +01:00

audit-hooks-routing.test.ts

…

audit-loopback-logging.test.ts

…

audit-model-hygiene.test.ts

test: clarify security audit assertions

2026-05-08 09:17:15 +01:00

audit-model-refs.ts

fix(security): resolve model aliases before audit classification (#74532)

2026-04-29 19:26:02 +01:00

audit-node-command-findings.test.ts

test: tighten security empty array assertions

2026-05-09 05:09:12 +01:00

audit-plugin-code-safety.test.ts

test: tighten security empty array assertions

2026-05-09 05:09:12 +01:00

audit-plugin-readonly-scope.test.ts

test: dedupe security audit mock read

2026-05-13 04:52:25 +01:00

audit-plugins-trust.test.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

audit-plugins-trust.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

audit-probe-failure.test.ts

test: tighten security audit helpers

2026-05-08 21:12:58 +01:00

audit-sandbox-browser.test.ts

test: tighten security plugin helpers

2026-05-08 21:16:33 +01:00

audit-sandbox-docker-config.test.ts

test: tighten sandbox docker audit assertions

2026-05-10 00:04:53 +01:00

audit-small-model-risk.test.ts

fix(security): honor model tool denies in audit

2026-05-10 07:21:23 +01:00

audit-summary.test.ts

test: detail audit surface summary

2026-05-12 18:56:08 +01:00

audit-synced-folder.test.ts

…

audit-tool-policy.ts

…

audit-trust-model.test.ts

test: tighten security trust helpers

2026-05-08 21:14:43 +01:00

audit-workspace-skill-escape.test.ts

test: tighten workspace skill assertion

2026-05-08 21:09:13 +01:00

audit-workspace-skills.ts

test: speed up security audit tests

2026-04-26 02:51:19 +01:00

audit.deep.runtime.ts

…

audit.nondeep.runtime.ts

test: speed up security audit tests

2026-04-26 02:51:19 +01:00

audit.runtime.ts

…

audit.ts

test: remove stale unused imports

2026-05-09 11:26:43 +01:00

audit.types.ts

…

channel-metadata.ts

…

config-regex.ts

…

context-visibility.test.ts

…

context-visibility.ts

…

core-dangerous-config-flags.ts

…

dangerous-config-flags-core.ts

test: move pure hotspots to fast lane

2026-04-28 07:56:40 +01:00

dangerous-config-flags.test.ts

test: tighten security audit source assertions

2026-05-09 23:06:28 +01:00

dangerous-config-flags.ts

refactor: simplify plugin cache boundaries

2026-04-29 04:33:15 +01:00

dangerous-tools.ts

…

dm-policy-shared.ts

refactor: centralize channel ingress access

2026-05-10 00:18:36 -04:00

exec-filesystem-policy.ts

Clarify exec filesystem policy drift (#79153)

2026-05-07 20:05:19 -05:00

external-content-source.ts

…

external-content.test.ts

test: tighten security empty array assertions

2026-05-09 05:09:12 +01:00

external-content.ts

…

fix.test.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

fix.ts

Revert "refactor: move runtime state to SQLite"

2026-05-13 13:33:38 +01:00

installed-plugin-dirs.ts

fix(security): ignore plugin install debris in audits

2026-05-02 13:12:28 +01:00

safe-regex.test.ts

test: tighten safe regex assertions

2026-05-08 21:05:09 +01:00

safe-regex.ts

fix(logging): redact persisted transcript text

2026-04-26 12:12:44 -07:00

scan-paths.test.ts

…

scan-paths.ts

[codex] Extract filesystem safety primitives (#77918)

2026-05-06 02:15:17 +01:00

secret-equal.ts

fix(security): remediate CodeQL alerts

2026-04-30 00:12:50 -07:00

skill-scanner.test.ts

fix(plugins): scan installed dependency runtime code [AI] (#81066)

2026-05-13 10:26:24 +05:30

skill-scanner.ts

fix(plugins): scan installed dependency runtime code [AI] (#81066)

2026-05-13 10:26:24 +05:30

test-temp-cases.ts

…

windows-acl.test.ts

fix(security): classify broad Windows SIDs as world principals

2026-05-13 15:19:02 -05:00

windows-acl.ts

[codex] Extract filesystem safety primitives (#77918)

2026-05-06 02:15:17 +01:00