mirror of
https://github.com/rookiestar28/ComfyUI-OpenClaw.git
synced 2026-08-14 00:48:07 +00:00
82 lines
2.4 KiB
Markdown
82 lines
2.4 KiB
Markdown
# Advanced Registry Sync and Constrained Transforms
|
|
|
|
This guide covers optional, high-control features that are disabled by default.
|
|
|
|
## Overview
|
|
|
|
- Remote registry sync uses quarantine and trust policy controls.
|
|
- Constrained transforms execute trusted Python modules with strict runtime limits.
|
|
- Both features are fail-closed when disabled.
|
|
- Optional operational log hygiene: `OPENCLAW_LOG_TRUNCATE_ON_START=1` clears stale `openclaw.log` at backend startup (once per process).
|
|
|
|
## Remote registry sync
|
|
|
|
Enable remote registry sync:
|
|
|
|
```bash
|
|
OPENCLAW_ENABLE_REGISTRY_SYNC=1
|
|
```
|
|
|
|
Trust policy:
|
|
|
|
- `OPENCLAW_REGISTRY_POLICY=audit` (default): records signature/provenance issues for review
|
|
- `OPENCLAW_REGISTRY_POLICY=strict`: rejects non-compliant artifacts
|
|
|
|
Behavior highlights:
|
|
|
|
- Quarantine lifecycle is persisted under the state directory:
|
|
- `registry/quarantine/index.json`
|
|
- Entries are tracked with audit trail records.
|
|
- Anti-abuse controls include bounded dedupe windows and rate limiting.
|
|
- Integrity and policy checks are enforced before activation paths.
|
|
|
|
If registry sync is not enabled, registry operations fail closed.
|
|
|
|
## Constrained transforms
|
|
|
|
Enable constrained transforms:
|
|
|
|
```bash
|
|
OPENCLAW_ENABLE_TRANSFORMS=1
|
|
```
|
|
|
|
Runtime limits:
|
|
|
|
- `OPENCLAW_TRANSFORM_TIMEOUT` (seconds, default `5`)
|
|
- `OPENCLAW_TRANSFORM_MAX_OUTPUT` (bytes, default `65536`)
|
|
- `OPENCLAW_TRANSFORM_MAX_PER_REQUEST` (default `5`)
|
|
|
|
Trusted module paths:
|
|
|
|
- Default trusted directory: `data/transforms`
|
|
- Add extra trusted directories with `OPENCLAW_TRANSFORM_TRUSTED_DIRS`
|
|
- Use OS path separator (`;` on Windows, `:` on Linux/macOS)
|
|
|
|
Security controls:
|
|
|
|
- Only `.py` modules are allowed
|
|
- Module size is capped
|
|
- Module hash is pinned at registration time
|
|
- Integrity is re-checked before execution
|
|
- Execution is bounded by timeout and output budget
|
|
|
|
If transforms are disabled, transform execution is denied and mapping-only behavior continues.
|
|
|
|
## Example hardened operator profile
|
|
|
|
```bash
|
|
OPENCLAW_ENABLE_REGISTRY_SYNC=1
|
|
OPENCLAW_REGISTRY_POLICY=strict
|
|
OPENCLAW_ENABLE_TRANSFORMS=1
|
|
OPENCLAW_TRANSFORM_TIMEOUT=3
|
|
OPENCLAW_TRANSFORM_MAX_OUTPUT=32768
|
|
OPENCLAW_TRANSFORM_MAX_PER_REQUEST=3
|
|
```
|
|
|
|
## Rollout notes
|
|
|
|
1. Enable one feature at a time in a non-production environment.
|
|
2. Review logs and operator diagnostics after startup.
|
|
3. Keep strict policies for public or multi-tenant deployments.
|
|
4. Treat trusted transform directories as code deployment boundaries.
|