5 Commits

Include renames

Author	SHA1	Message	Date
Illia PolosukhinandClaude Opus 4.6	9349a3baca	fix: add missing session_manager arg to Agent::new in benchmark runner ... Agent::new gained an 8th parameter (session_manager) but the benchmark runner was not updated, breaking compilation of the bench crate. Co-Authored-By: Claude Opus 4.6 <[email protected]>	2026-02-19 18:32:56 -08:00
Illia PolosukhinandClaude Opus 4.6	913073d83d	fix: prevent release-plz from publishing ironclaw-bench ... The benchmarks crate is an internal tool, not intended for crates.io. Adding `publish = false` fixes the release-plz CI failure caused by the path-only ironclaw dependency lacking a version specifier. Co-Authored-By: Claude Opus 4.6 <[email protected]>	2026-02-18 01:12:02 -08:00
Illia PolosukhinandClaude Opus 4.6	d46ab3a1d7	fix: resolve all clippy warnings in benchmarks crate ... Remove unused fields, methods, and error variants. Allow dead_code on public API types intended for future use. Drop needless Default spread. Co-Authored-By: Claude Opus 4.6 <[email protected]>	2026-02-18 01:05:07 -08:00
3 people	bac2d75713	feat: Secure prompt-based skills system (Phases 1-4) (#51) ... * feat: Add secure prompt-based skills system (Phase 1 MVP) Implement a skills system that extends the agent with prompt-level instructions from local directories. Skills declare activation criteria, tool permissions, and trust tiers that determine authority attenuation. Core security model: the minimum trust level of any active skill determines a tool ceiling -- tools above the ceiling are removed from the LLM's tool list entirely at the API level, preventing prompt-based manipulation. New modules: - skills/mod.rs: Core types (SkillTrust, SkillManifest, LoadedSkill) - skills/scanner.rs: Content scanner for manipulation detection - skills/registry.rs: Filesystem discovery and manifest parsing - skills/selector.rs: Deterministic two-phase prefilter (no LLM) - skills/attenuation.rs: Trust-based tool filtering Integration: - Agent loop selects skills per-turn and applies tool attenuation - Reasoning engine injects skill context with structural isolation - Config supports SKILLS_ENABLED, SKILLS_DIR, SKILLS_MAX_ACTIVE, SKILLS_MAX_CONTEXT_TOKENS environment variables - Disabled by default (SKILLS_ENABLED=false) 41 new tests covering all modules. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: Address all adversarial review findings for skills system Security fixes: - Escape skill name/version in XML attributes to prevent trust spoofing - Escape prompt content to prevent </skill> tag breakout - Require integrity hash for Verified/Community tier skills - Validate skill names against [a-zA-Z0-9][a-zA-Z0-9._-]{0,63} - Add 64 KiB file size limit on prompt.md Bug fixes: - Use actual SkillsConfig from AgentDeps instead of SkillsConfig::default() - Add skills_config field to AgentDeps, wired through from main.rs Performance: - Pre-compile regex patterns at load time (cached on LoadedSkill) - Selector uses pre-compiled patterns instead of recompiling per message - Switch all std::fs to tokio::fs for non-blocking async I/O Hardening: - Cap keyword score at 30 points to prevent keyword stuffing attacks - Enforce max 20 keywords and 5 patterns per skill - Normalize line endings (CRLF/CR to LF) before hashing - Also includes cargo fmt formatting fixes for adjacent code Tests: 54 skills tests pass (up from 41), zero new clippy warnings. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: Address medium/low severity findings from adversarial review Fixes all 18 medium/low severity findings identified by the security review: - mod.rs: Add MAX_TAGS_PER_SKILL cap (10) in enforce_limits(); use RegexBuilder with 64 KiB size_limit to prevent ReDoS; replace case-enumerated escape_skill_content with regex matching all case variants plus whitespace/null byte injection between </ and skill; document allowed_patterns as unenforced until Phase 2; document Marketplace URL validation as Phase 3 concern - registry.rs: Add MAX_MANIFEST_FILE_SIZE (16 KiB) check before reading; add symlink detection via symlink_metadata to reject symlinks in discover_local; add MAX_DISCOVERED_SKILLS (100) cap; validate prompt_hash format (sha256: + 64 hex chars); warn on name collision before overwriting; accept SkillSource parameter in load_skill instead of always using Local; add InvalidHashFormat, ManifestTooLarge, SymlinkDetected error variants - selector.rs: Add MAX_TAG_SCORE (15) cap parallel to keyword cap; warn when declared max_context_tokens diverges >2x from actual prompt size - scanner.rs: Add mixed-script homoglyph detection (Cyrillic, Greek, Armenian unicode ranges); document token-boundary bypass and semantic paraphrasing as known limitations - attenuation.rs: Document READ_ONLY_TOOLS maintenance requirements - agent_loop.rs: Surface scan warnings via structured tracing; add structured audit events for skill activation and tool attenuation 61 tests pass, 0 new clippy warnings. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: Address 12 findings from second adversarial security review HIGH: - Escape opening <skill tags in prompt content (prevents fake skill block injection) - Scan manifest metadata fields (description, author, tags, reasons) not just prompt - Block trust downgrade on name collision (existing Local can't be replaced by Community) MEDIUM: - Eliminate TOCTOU gap: read files then check size instead of metadata-then-read - Reject file-level symlinks in load_skill (prompt.md, skill.toml) - Truncate and filter manifest.skill.tags (prevent unlimited tag scoring) - Cap regex pattern score at 40 (prevent 5x20=100 dominating keyword+tag) - Add doc comment about skill_list tool exposing metadata (sanitization required) - Move Community disclaimer inside <skill> tags (not outside structural boundary) - Filter keywords/tags shorter than 3 chars (prevent broad matching) LOW: - Enforce minimum token_cost of 1 (max_context_tokens=0 can't bypass budget) - Remove redundant try_exists checks in discover_local (let load_skill handle errors) 70 skills tests passing. Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: Add HTTP endpoint scoping for skills (Phase 1) Skills that declare an [http] section in skill.toml now have their HTTP requests constrained to declared endpoints at runtime. This addresses the gap where allowed_patterns was parsed but never enforced -- once the http tool was visible via attenuation, the LLM could reach any URL. Enforcement reuses EndpointPattern/AllowlistValidator from the WASM capability system. Semantics: if no active skill declares [http], all requests pass through (backward compat). If any skill declares [http], URLs must match at least one skill's allowlist (union). Community skills' [http] declarations are silently ignored (defense in depth). Shell commands using curl/wget are also validated against scopes. Scanner gains detection for known exfiltration domains (webhook.site, ngrok.io, etc.), overly broad wildcards, and credential/host mismatches. Closes #38 Co-Authored-By: Claude Opus 4.6 <[email protected]> * style: Apply cargo fmt to http_scoping.rs Co-Authored-By: Claude Opus 4.6 <[email protected]> * style: Apply cargo fmt across codebase Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: Add parameter-level permission enforcement for skills (Phase 2) Activates enforcement of `allowed_patterns` in skill.toml permissions. Previously these patterns were parsed but not enforced -- a Verified skill declaring `permissions.shell` with `allowed_patterns = [{command = "cargo *"}]` could still run any shell command. Now the enforcer validates tool parameters against declared glob patterns before execution. Key changes: - New `enforcer.rs` module with `SkillPermissionEnforcer`, `glob_to_regex()`, and `validate_tool_call()` with union semantics across active skills - Typed pattern enums (`ShellPattern`, `FilePathPattern`, `MemoryTargetPattern`) replace the previous `Vec<serde_json::Value>` in `ToolPermissionDeclaration` - Scanner gains `scan_permission_patterns()` detecting dangerous patterns (rm, sudo, curl, bare wildcards, command chaining, sensitive paths, identity files) - Registry blocks non-Local skills with critical permission pattern warnings - Agent loop threads enforcer into `execute_chat_tool` alongside HTTP scoping Trust interaction: Community patterns ignored, Verified enforced, Local without patterns unrestricted, Local with patterns enforced as guidance. Union semantics across skills -- tool call allowed if ANY skill's patterns permit it. 34 new tests. All 818 library tests pass. Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: Add worker permission enforcement and LLM behavioral analysis (Phase 3+4) Phase 3 - Worker-side permission enforcement: - Add SerializedToolPermission/SerializedPattern DTOs for HTTP boundary crossing - Extend JobDescription, ContainerHandle, and orchestrator API to carry permissions - CreateJobTool snapshots and forwards skill permissions to spawned workers - Worker runtime builds SkillPermissionEnforcer and checks before tool execution - Load-time token budget enforcement rejects prompts exceeding 2x declared budget - Deduplicate enforcer construction: from_active_skills() delegates to from_serialized() Phase 4 - LLM behavioral analysis: - BehavioralAnalyzer with cached, LLM-based semantic content analysis - Structured output parsing (FINDING|CATEGORY|SEVERITY|DESCRIPTION or CLEAN) - Content-hash caching with bounded size (MAX_CACHE_ENTRIES=256) - Graceful degradation when LLM unavailable - Integrated into load_skill() for non-Local skills; critical findings block loading Review fixes: - Real cache tests with CountingLlm mock (test_cache_hit, test_cache_miss, test_cache_bounded) - UTF-8-safe truncate() in worker runtime - Few-shot examples in behavioral analysis prompt - Documented max_context_tokens=0 opt-out and create_job() permission gap 848 tests passing, no new clippy warnings. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: Address review feedback from serrrfirat on skills-phase2 - Fix truncate_cmd UTF-8 panic: use char-boundary-aware slicing - Remove redundant effective_tools branching in reasoning.rs - Document cache eviction as known limitation (arbitrary, not LRU) - Add safety comment on SkillTrust enum ordering (security-critical) - Simplify active_skills selection (prefilter_skills handles empty input) Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address remaining skills review feedback * refactor: replace skills system with OpenClaw SKILL.md format + 2-state trust Replace the 5-gate, 3-tier trust hierarchy (scanner, behavioral analyzer, parameter-level enforcer, HTTP endpoint scoping) with a simplified 3-layer security model: gating -> attenuation -> Docker confinement. Key changes: - SKILL.md format (YAML frontmatter + markdown prompt) replaces skill.toml + prompt.md - 2-state trust (Installed/Trusted) replaces 3-tier (Community/Verified/Local) - New parser.rs for SKILL.md parsing with serde_yaml - New gating.rs for requirements checking (bins/env/config) - Simplified registry with 2-location discovery (workspace + user dirs) - Removed scanner, behavioral_analyzer, enforcer, http_scoping (~4,100 lines) - Removed skill_permissions propagation through job/orchestrator/worker pipeline - Added serde_yaml dependency for YAML frontmatter parsing Net: -5,298 lines, 59 skills tests pass, 907 total tests pass. Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: add in-app skill management tools and ClawHub catalog integration Add 4 chat-callable tools (skill_list, skill_search, skill_install, skill_remove) plus matching web gateway endpoints for managing skills at runtime. The catalog fetches from ClawHub's public registry API at runtime rather than bundling entries at compile time. Key changes: - SkillRegistry gains mutation methods (install_skill, remove_skill, reload, find_by_name) with Arc<RwLock> for concurrent access - New catalog module queries ClawHub /api/v1/search with in-memory caching (5-min TTL, configurable via CLAWHUB_REGISTRY env var) - skill_list and skill_search added to READ_ONLY_TOOLS for safe use under Installed trust ceiling - Web gateway gets /api/skills, /api/skills/search, /api/skills/install, and /api/skills/{name} DELETE endpoints Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address PR #51 review feedback from ilblackdragon Security: - Add SSRF protection to fetch_skill_content: require HTTPS, reject private/loopback/link-local IPs and internal hostnames, disable redirects. Gateway install handler now reuses the same validation. - URL-encode slug in skill_download_url to prevent query injection. - Require X-Confirm-Action header on gateway skill install/remove endpoints (equivalent to chat tool requires_approval gate). Correctness: - Eliminate all block_in_place/block_on usage in skill tools and gateway handlers. Split install into prepare_install_to_disk (static async, no lock) + commit_install (sync, brief write lock). Same pattern for remove: validate_remove + delete_skill_files + commit_remove. - Write normalized content to disk in install_skill (was writing original un-normalized content, causing hash mismatch on re-read). - Fix token estimation from 0.75 to 0.25 tokens/byte (~4 chars per token) in registry.rs, selector.rs, and standalone loader. Dependencies: - Replace deprecated serde_yaml 0.9 with serde_yml 0.0.12. - Remove unused toml dependency. Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>	2026-02-18 00:28:38 +00:00
3 people	8e6e84a08d	feat: Add benchmarking harness with spot suite (#10) ... * feat: Add benchmarking harness for agent evaluation Introduces ironclaw-bench, a Rust-native benchmarking crate that drives the real agent loop headlessly. Supports standard benchmarks (GAIA, Tau-bench, SWE-bench Pro) and custom JSONL task sets with parallel execution, resume support, and incremental JSONL output. Key components: - BenchChannel: headless Channel impl with auto-approval and response capture - InstrumentedLlm: LlmProvider wrapper recording per-call token/cost metrics - BenchRunner: task orchestration with parallel execution and JSONL resume - Scoring utilities: exact match, contains, regex (all with normalization) - CLI: run, results, compare, list subcommands via clap - Four suite adapters: custom, gaia, tau_bench, swe_bench Also fixes a pre-existing missing SseEvent::ToolResult match arm in the web gateway and adds FinishReason to the LLM module's public re-exports. Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: Add spot benchmark suite for end-to-end agent verification Adds a "spot" suite with 13 scenarios across 4 categories (smoke, tool use, multi-tool chaining, robustness) using multi-criterion assertions instead of simple text matching. Also adds an `error` field to TaskSubmission so suites can hard-fail on agent errors. Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address audit findings in benchmarks crate - Fix O(n²) scoring loop by indexing tasks in a HashMap (was re-parsing JSONL per result) - Add UTF-8-safe truncation to prevent panic on multi-byte chars in channel capture - Wire setup_task/teardown_task into both sequential and parallel runner paths - Convert BenchRunner.suite from Box to Arc for parallel task setup/teardown - Add tracing::warn for placeholder scores in custom, swe_bench, tau_bench adapters - Add spot suite to CLI help text - Add doc comment clarifying tools_used HashSet behavior in SpotAssertions - Reorder match arms in create_suite to match KNOWN_SUITES alphabetical order Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: rewrite tasks.jsonl with scored results after scoring The JSONL file was only written during execution (pre-scoring), so the `results` command showed "pending" scores even after scoring completed. Now the runner rewrites the JSONL with final scored results, keeping task-level and aggregate data consistent. Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: prefix benchmark runs with model name and commit hash Run logs and results table now show the base model and short git commit hash, making it easy to correlate results with code versions. The commit hash is also persisted in run.json for historical tracking. Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: add 8 memory benchmark scenarios to spot suite Tests save-and-recall workflows using file tools: - daily tasks, reminders, meeting notes, append logs - detail extraction, todo priorities, multi-file ops - context updates (write-read-rewrite-verify) Total spot scenarios: 13 -> 21 Co-Authored-By: Claude Opus 4.6 <[email protected]> * chore: fmt channel.rs and gitignore bench-results Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address critical and high findings from PR review - Fix race condition: parallel mode now writes JSONL after all tasks complete instead of concurrent unsynchronized appends - Fix UTF-8 panic: use .chars().take(25) instead of byte slicing on task_id which could panic on multi-byte characters - Remove dead code: max_iterations (parsed but never used), tool_whitelist() (declared but never called), MatrixEntry.tools (declared but never applied) - Eliminate double load_tasks(): cache task list on first load and reuse the index for scoring instead of re-reading from disk Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: relax smoke-greeting assertion to not demand parrot greeting The LLM often introduces itself without echoing "hello" back. Use a regex that accepts any reasonable self-introduction (hello, hi, hey, assistant, agent, help) instead of demanding a specific word. Co-Authored-By: Claude Opus 4.6 <[email protected]> * feat: 100% spot baseline (GPT-5.2 @ 2c43b83, 21/21 pass) Relax two brittle assertions: - smoke-greeting: use regex for any reasonable self-intro instead of demanding the model parrot "hello" - memory-update-context: drop response_not_contains PST since the model correctly says "not PST" which triggers the literal check - memory-multifile: lower min_tool_calls from 4 to 3, the model can batch two writes in one LLM turn Baseline results committed to benchmarks/baselines/ for regression tracking. Local runs stay in bench-results/ (gitignored). Results: 100.0% pass, 1.000 avg, $0.31 cost, 111s wall time Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: address remaining PR review comments - Replace .expect("semaphore closed") with proper error handling - Derive PartialEq on BenchScore for cleaner test assertions - Use ToPrimitive::to_f64() instead of string roundtrip in estimated_cost() - Validate SWE-bench inputs: task_id (path traversal), repo (owner/repo format), base_commit (valid git ref) with 5 new tests - Skip "pending" (unscored) entries during resume so they get re-executed - Use run.json mtime for find_latest_run (falls back to tasks.jsonl, then dir) - Move additional_tools() outside parallel loop to share Arc<[Tool]> across tasks - Add doc comments documenting known limitations (single-turn, resources, conversation) Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: reject absolute paths in SWE-bench and validate matrix config - is_safe_path_component now rejects paths starting with '/' - BenchConfig::from_file validates matrix is non-empty - Added tests for both validations Co-Authored-By: Claude Opus 4.6 <[email protected]> * fix: fail tasks on setup_task error and compute git hash once - setup_task failure now records an error TaskResult instead of continuing to run the task (both sequential and parallel paths) - git_short_hash() computed once per run instead of twice Co-Authored-By: Claude Opus 4.6 <[email protected]> --------- Co-authored-by: Claude Opus 4.6 <[email protected]>	2026-02-17 23:34:02 +00:00