From 3aa72ccac82b456af3845eb19c789a1839b71c18 Mon Sep 17 00:00:00 2001 From: Ivan Kuznetsov Date: Wed, 22 Jul 2026 22:25:11 +0100 Subject: [PATCH] fix(llm-wiki): restrict refreshes to configured providers --- .claude-plugin/marketplace.json | 2 +- docs/agent-compatibility.md | 2 +- plugin-surfaces.json | 2 +- plugin-surfaces.lock.json | 4 ++-- plugins/llm-wiki/.claude-plugin/plugin.json | 2 +- plugins/llm-wiki/.codex-plugin/plugin.json | 2 +- plugins/llm-wiki/CHANGELOG.md | 11 +++++++++++ plugins/llm-wiki/openclaw.plugin.json | 2 +- plugins/llm-wiki/package.json | 2 +- .../llm-wiki/templates/post-commit-refresh.sh | 6 ------ tests/test_llm_wiki_openclaw.py | 1 + wiki/architecture.md | 2 ++ wiki/gaps.md | 6 +++--- ...22T211700Z-llm-wiki-provider-only-dispatch.md | 16 ++++++++++++++++ wiki/plugins.md | 8 +++++--- 15 files changed, 47 insertions(+), 21 deletions(-) create mode 100644 wiki/log.d/20260722T211700Z-llm-wiki-provider-only-dispatch.md diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index e5909aa..5a64eeb 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -13,7 +13,7 @@ "name": "llm-wiki", "source": "./plugins/llm-wiki", "description": "Create and query project wikis with optional maintenance automation.", - "version": "0.3.4", + "version": "0.3.5", "author": { "name": "ivankuznetsov", "url": "https://github.com/ivankuznetsov" diff --git a/docs/agent-compatibility.md b/docs/agent-compatibility.md index c4424cc..f4d8156 100644 --- a/docs/agent-compatibility.md +++ b/docs/agent-compatibility.md @@ -35,7 +35,7 @@ plugin directory so a copied package does not depend on the repository root. | Agent Reviewer | `0.3.1` | Stable | `skills/agent-reviewer/SKILL.md` | agents, references, scripts, eval harness | | Agent SEO | `2.0.1` | Stable | `skills/seo/SKILL.md` | agents, context, data sources, hooks, scripts | | Agent Writing | `0.5.2` | Stable | `skills/writing/SKILL.md` | agents, voice/style context | -| LLM Wiki | `0.3.4` | Stable | five files under `skills/` | assets, consent-gated maintenance templates | +| LLM Wiki | `0.3.5` | Stable | five files under `skills/` | assets, consent-gated maintenance templates | | Screenote | `3.0.1` | Stable | `skills/{screenote,snapshot,feedback}/SKILL.md` | CLI launcher, references, evals | ## Plugin invocations diff --git a/plugin-surfaces.json b/plugin-surfaces.json index 66d0218..a1c4814 100644 --- a/plugin-surfaces.json +++ b/plugin-surfaces.json @@ -174,7 +174,7 @@ { "name": "llm-wiki", "path": "plugins/llm-wiki", - "version": "0.3.4", + "version": "0.3.5", "stability": "stable", "metadata": { "display_name": "LLM Wiki", diff --git a/plugin-surfaces.lock.json b/plugin-surfaces.lock.json index 39809db..2d5276e 100644 --- a/plugin-surfaces.lock.json +++ b/plugin-surfaces.lock.json @@ -636,7 +636,7 @@ } }, "llm-wiki": { - "version": "0.3.4", + "version": "0.3.5", "canonical": { "skills/bootstrap/SKILL.md": { "sha256": "6e446e783ac32d2f605f036891fcee29651aca14696065f2753cec13eab58a16", @@ -722,7 +722,7 @@ }, "templates": { "exists": true, - "sha256": "eadb377a0defb2c14f3abb3a63bbf9ce836e8035045f96a2f25a4836540df411", + "sha256": "5bfdb6df0bbfc2d23df12e05f47bdab4c99845385ffb3f1528498812dcc9dece", "files": [ "templates/compile-log.sh", "templates/install-systemd-scheduler.sh", diff --git a/plugins/llm-wiki/.claude-plugin/plugin.json b/plugins/llm-wiki/.claude-plugin/plugin.json index 2ab1283..45fdd1e 100644 --- a/plugins/llm-wiki/.claude-plugin/plugin.json +++ b/plugins/llm-wiki/.claude-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "llm-wiki", - "version": "0.3.4", + "version": "0.3.5", "description": "Create and query project wikis with optional maintenance automation.", "author": { "name": "ivankuznetsov", diff --git a/plugins/llm-wiki/.codex-plugin/plugin.json b/plugins/llm-wiki/.codex-plugin/plugin.json index 50318ab..c5005e0 100644 --- a/plugins/llm-wiki/.codex-plugin/plugin.json +++ b/plugins/llm-wiki/.codex-plugin/plugin.json @@ -1,6 +1,6 @@ { "name": "llm-wiki", - "version": "0.3.4", + "version": "0.3.5", "description": "Create and query project wikis with optional maintenance automation.", "author": { "name": "ivankuznetsov", diff --git a/plugins/llm-wiki/CHANGELOG.md b/plugins/llm-wiki/CHANGELOG.md index 5bc14d2..9cda161 100644 --- a/plugins/llm-wiki/CHANGELOG.md +++ b/plugins/llm-wiki/CHANGELOG.md @@ -4,6 +4,17 @@ All notable changes to **llm-wiki** are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/), and the project adheres to [Semantic Versioning](https://semver.org/). +## [0.3.5] - 2026-07-22 + +### Security + +- Remove the undocumented `LLM_WIKI_REFRESH_CMD` arbitrary executable + override from the shipped worker. Headless refreshes now dispatch only to + the explicitly configured Codex, Claude Code, Pi, or validated OpenClaw + owner through fixed, bounded command shapes. +- Vendor the standalone llm-wiki 0.1.19 provider-only dispatch fix while + retaining the marketplace consent gate and OpenClaw owner adaptation. + ## [0.3.4] - 2026-07-22 ### Fixed diff --git a/plugins/llm-wiki/openclaw.plugin.json b/plugins/llm-wiki/openclaw.plugin.json index 539df93..e00d757 100644 --- a/plugins/llm-wiki/openclaw.plugin.json +++ b/plugins/llm-wiki/openclaw.plugin.json @@ -2,7 +2,7 @@ "id": "llm-wiki", "name": "LLM Wiki", "description": "Create and query project wikis with optional maintenance automation.", - "version": "0.3.4", + "version": "0.3.5", "skills": [ "./openclaw/skills" ], diff --git a/plugins/llm-wiki/package.json b/plugins/llm-wiki/package.json index 1d0c75c..9318757 100644 --- a/plugins/llm-wiki/package.json +++ b/plugins/llm-wiki/package.json @@ -1,6 +1,6 @@ { "name": "llm-wiki", - "version": "0.3.4", + "version": "0.3.5", "type": "module", "description": "Create and query project wikis with optional maintenance automation.", "homepage": "https://github.com/ivankuznetsov/llm-wiki", diff --git a/plugins/llm-wiki/templates/post-commit-refresh.sh b/plugins/llm-wiki/templates/post-commit-refresh.sh index 8eb0876..b7a0995 100755 --- a/plugins/llm-wiki/templates/post-commit-refresh.sh +++ b/plugins/llm-wiki/templates/post-commit-refresh.sh @@ -800,12 +800,6 @@ wiki_only_changes() { run_refresh_agent() { local prompt="$1" - if [ -n "${LLM_WIKI_REFRESH_CMD:-}" ]; then - run_with_timeout "${LLM_WIKI_REFRESH_TIMEOUT:-1800}" \ - "$LLM_WIKI_REFRESH_CMD" "$refresh_root" "$prompt" >>"$log_file" 2>&1 - return $? - fi - local headless_agent timeout_seconds owner_config openclaw_agent_id owner_config="$canonical_config" [ -f "$owner_config" ] || owner_config="$committing_tree/.llm-wiki/config.json" diff --git a/tests/test_llm_wiki_openclaw.py b/tests/test_llm_wiki_openclaw.py index 5cb5dd6..725fa90 100644 --- a/tests/test_llm_wiki_openclaw.py +++ b/tests/test_llm_wiki_openclaw.py @@ -116,6 +116,7 @@ def test_post_commit_runtime_bounds_recovery_and_publishes_only_refresh_branch(s self.assertIn('refresh_branch="${LLM_WIKI_REFRESH_BRANCH:-llm-wiki/refresh}"', template) self.assertIn('push "$refresh_remote" "HEAD:refs/heads/$refresh_branch"', template) self.assertNotIn('push "$refresh_remote" "HEAD:refs/heads/$base_branch"', template) + self.assertNotIn("LLM_WIKI_REFRESH_CMD", template) def test_compiled_log_only_commit_does_not_queue_or_launch_refresh(self): with tempfile.TemporaryDirectory() as directory: diff --git a/wiki/architecture.md b/wiki/architecture.md index affb70e..2440bb0 100644 --- a/wiki/architecture.md +++ b/wiki/architecture.md @@ -46,6 +46,8 @@ variables from the standard socket and retain the installed service marker after a transient signal failure. Compiled-`wiki/log.md`-only commits do not enter the queue. Successful wiki-only batches are merged with and pushed only to `origin/llm-wiki/refresh`, never the protected default branch. +The runtime has no arbitrary command override: provider dispatch is limited to +fixed Codex, Claude Code, Pi, and validated OpenClaw command shapes. Large queued-source pin sets are processed in bounded Git transactions, and recoverable interrupted queue files are rebuilt from their source commits. diff --git a/wiki/gaps.md b/wiki/gaps.md index f85d3b3..9549542 100644 --- a/wiki/gaps.md +++ b/wiki/gaps.md @@ -13,9 +13,9 @@ separate version lines (`0.1.x` upstream runtime and `0.3.x` consent-gated marketplace package). A marketplace release must preserve the consent and OpenClaw adaptations while vendoring the released runtime. Marketplace - 0.3.3 vendors the released standalone 0.1.17 headless scheduler fix; public - ClawHub scan and catalog visibility remain release-time evidence rather than - source-tree facts. + 0.3.5 vendors the released standalone 0.1.19 provider-only dispatch fix; + public ClawHub scan and catalog visibility remain release-time evidence + rather than source-tree facts. - Compatibility with OpenClaw releases older than `2026.7.1-beta.2` remains unverified. ClawHub packages therefore declare that tested version as their conservative plugin API floor while leaving the broader host minimum diff --git a/wiki/log.d/20260722T211700Z-llm-wiki-provider-only-dispatch.md b/wiki/log.d/20260722T211700Z-llm-wiki-provider-only-dispatch.md new file mode 100644 index 0000000..d33c239 --- /dev/null +++ b/wiki/log.d/20260722T211700Z-llm-wiki-provider-only-dispatch.md @@ -0,0 +1,16 @@ +--- +title: Restrict LLM Wiki refreshes to configured providers +date: 2026-07-22T21:17:00Z +tags: [llm-wiki, security, providers, clawhub] +--- + +Marketplace LLM Wiki 0.3.5 vendors standalone runtime 0.1.19 and removes the +undocumented `LLM_WIKI_REFRESH_CMD` arbitrary executable override. The worker +retains its separate automation and provider-access consent gate, but once +enabled it can dispatch only to the configured Codex, Claude Code, Pi, or +validated OpenClaw owner through fixed command shapes and existing timeouts. + +This closes the one unexpected issue from ClawHub's delayed semantic scan of +0.3.4. Findings about durable hooks, timers, wiki writes, and refresh-branch +publication describe the package's disclosed opt-in purpose and remain subject +to the existing consent, path, lock, memory, and wiki-only publication guards. diff --git a/wiki/plugins.md b/wiki/plugins.md index c0660b7..3208c4d 100644 --- a/wiki/plugins.md +++ b/wiki/plugins.md @@ -8,7 +8,7 @@ OpenClaw. | `agent-reviewer` | `0.3.0` | `agent-reviewer` | agents, references, scripts, eval | | `agent-seo` | `2.0.0` | `seo` | agents, context, data sources, hooks, scripts | | `agent-writing` | `0.5.1` | `writing` | agents, context | -| `llm-wiki` | `0.3.3` | `bootstrap`, `upgrade`, `research`, `wiki-plan`, `wiki-status` | assets, consent-gated templates | +| `llm-wiki` | `0.3.5` | `bootstrap`, `upgrade`, `research`, `wiki-plan`, `wiki-status` | assets, consent-gated templates | | `screenote` | `3.0.0` | `screenote`, `snapshot`, `feedback` | CLI launcher, references, evals | Claude and Codex install through their root marketplaces. Pi and OpenClaw @@ -25,9 +25,11 @@ Version 2.0 makes the removed mutation contract explicit and documents the LLM Wiki bootstrap creates the requested project wiki. Scheduler, managed-hook, shared-Git, and provider-backed maintenance are a separate opt-in; 0.2.x configs without both consent flags are automation-disabled under the 0.3 -runtime. Version 0.3.3 reconciles linked checkouts to one non-persistent, +runtime. Version 0.3.5 reconciles linked checkouts to one non-persistent, memory-bounded timer per repository, serializes providers across repositories, publishes wiki-only output to `origin/llm-wiki/refresh`, and bounds source-ref recovery transactions. Headless hooks reconstruct the standard user bus, retain the scheduler marker after transient signal failure, and ignore commits -that only rewrite compiled `wiki/log.md`. +that only rewrite compiled `wiki/log.md`. The worker accepts only its configured +Codex, Claude Code, Pi, or validated OpenClaw owner; it no longer exposes an +arbitrary refresh-command environment override.