fix: merge PR #1540 #1524 #1523 #1522 #1521#1542
Closed
xuwei-xy wants to merge 11 commits intosipeed:mainfrom
Closed
fix: merge PR #1540 #1524 #1523 #1522 #1521#1542xuwei-xy wants to merge 11 commits intosipeed:mainfrom
xuwei-xy wants to merge 11 commits intosipeed:mainfrom
Conversation
…ygen - pkg/credential: new package with AES-256-GCM enc:// credential format, HKDF-SHA256 key derivation (passphrase + optional SSH key binding), ErrPassphraseRequired / ErrDecryptionFailed sentinel errors, and PassphraseProvider hook for runtime passphrase injection - pkg/credential/store: lock-free SecureStore via atomic.Pointer[string]; passphrase never written to disk or os.Environ - pkg/credential/keygen: ed25519 SSH key generation helper used by onboard - pkg/config: replace os.Getenv(PassphraseEnvVar) with credential.PassphraseProvider() at all three call sites so that LoadConfig and SaveConfig use whatever passphrase source is active - cmd/picoclaw/onboard: prompt for passphrase with echo-off, generate picoclaw-specific SSH key, re-encrypt existing config on re-onboard - docs/credential_encryption.md: design doc for the enc:// format
Replace env-var passphrase forwarding with a SecureStore-backed flow: - web/backend/main.go: seed passphrase from env var into SecureStore at startup, then clear the env var and redirect credential.PassphraseProvider to apiHandler.GetPassphrase so all LoadConfig calls share one source - web/backend/api/passphrase.go: POST /api/credential/passphrase stores passphrase and auto-starts gateway; GET status endpoint - web/backend/api/gateway.go: build child env via filterEnv() (strips PassphraseEnvVar from parent env) then inject only from SecureStore; passphraseState machine (pending/failed/none) tracks gateway start outcome; expose passphrase_state in /api/gateway/status response - web/backend/api/router.go: add passphraseStore, passphraseMu, passphraseLastState fields; SeedPassphrase / GetPassphrase methods - frontend: PassphraseCard component on credentials page; chat-empty-state shows passphrase input when start_reason contains 'passphrase' or passphraseState is failed; i18n keys for en + zh - Makefile: add -buildvcs=false to GOFLAGS
- credential.go: decouple ErrPassphraseRequired from env var name; message is now 'enc:// passphrase required' since PassphraseProvider may come from any source, not just os.Environ - credential.go: Resolver resolves symlinks via EvalSymlinks before the isWithinDir containment check, preventing symlink-based path traversal for file:// credential references - store.go: tighten comment to describe only what SecureStore guarantees (in-memory only); remove claims about how callers transport the value - store_test.go: replace the meaningless GetReturnsCopy test (Go strings are immutable, equality across two calls proves nothing) with TestSecureStore_ConcurrentSetGet that exercises atomic.Pointer under 10-goroutine concurrent Set/Get load - config_test.go: update error-message assertion to match new sentinel text - docs/credential_encryption.md: remove reference to non-existent 'picoclaw encrypt' subcommand; describe the onboard flow instead
|
OpenClaw-User seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account. You have signed the CLA already but the status is still pending? Let us recheck it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Merges fixes from open PRs #1540, #1524, #1523, #1522, #1521.
PR #1540 - SpawnStatusTool
PR #1524 - Skills helpers
PR #1523 - Repo skill examples
PR #1522 - Credential encryption
PR #1521 - Passphrase/gateway