mirror of
https://github.com/openclaw/openclaw.git
synced 2026-08-14 08:26:21 +00:00
Val Alexander
fc8ccde542
Add the opt-in Coven ACP runtime bridge as a bundled extension while keeping ACPX as the default path.
Security hardening included before merge:
- fail closed by default instead of silently falling back;
- bounded health/socket requests and daemon response sizes;
- fixed Coven socket trust anchor and symlink/path validation;
- reject untrusted harness/session/event ids before exposing them;
- sanitize daemon-controlled terminal/status/error strings;
- use incremental event polling with bounded dedupe state;
- clean up launched Coven sessions before fallback when daemon ids are invalid.
Validation:
- pnpm test extensions/coven/src/config.test.ts extensions/coven/src/client.test.ts extensions/coven/src/runtime.test.ts
- pnpm check:changed
- GitHub CI green on a64eac20b9
- Greptile Review green
38 lines
1.4 KiB
JSON
38 lines
1.4 KiB
JSON
{
|
|
"id": "coven",
|
|
"enabledByDefault": false,
|
|
"name": "Coven ACP Runtime",
|
|
"description": "Opt-in ACP runtime backend that launches coding tasks through a local Coven daemon.",
|
|
"configSchema": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"covenHome": {
|
|
"type": "string",
|
|
"description": "Path to the Coven daemon state directory. Defaults to ~/.coven; environment variables are not used for this trust anchor."
|
|
},
|
|
"socketPath": {
|
|
"type": "string",
|
|
"description": "Path to the Coven daemon Unix socket. Defaults to <covenHome>/coven.sock; overrides must resolve to that fixed socket filename."
|
|
},
|
|
"allowFallback": {
|
|
"type": "boolean",
|
|
"description": "When true, fall back to fallbackBackend if Coven is unavailable or launch fails. Defaults to false."
|
|
},
|
|
"fallbackBackend": {
|
|
"type": "string",
|
|
"description": "ACP backend to use only when allowFallback is true. Defaults to acpx."
|
|
},
|
|
"pollIntervalMs": {
|
|
"type": "number",
|
|
"description": "Polling interval for Coven session events."
|
|
},
|
|
"harnesses": {
|
|
"type": "object",
|
|
"additionalProperties": { "type": "string" },
|
|
"description": "Explicitly map additional OpenClaw ACP agent ids to authorized Coven harness ids. Unknown agent ids are rejected."
|
|
}
|
|
}
|
|
}
|
|
}
|