$ the-wire · showcase
Crabbox hardens secret redaction, redirect guards, and artifact validation
By RepoJournal · Filed · About OpenClaw
2 people shipped this
Crabbox shipped five fixes that close security and correctness gaps across providers, runners, and artifact handling.
Crabbox's provider layer tightened error handling so Freestyle API secrets no longer leak. The client now redacts both raw configured keys and `Bearer` forms before any non-success response escapes, centralizing diagnostics at one boundary [1]. In the same vein, the Cloudflare runner now clones its HTTP client and installs a same-origin redirect guard, comparing scheme, hostname, and effective port before following any redirect [2].
AWS signing now rejects invalid regions earlier and more consistently. Readiness, lease `awsRegion`, and `capacity.regions` inputs are validated against the region set, `EC2SpotClient` re-validates before constructing signed endpoints, and invalid fallback candidates are filtered before regional retries [3]. Artifact handling also got stricter: direct, collection, and delegated scripts now require artifact paths to resolve to regular files, rejecting dangling symlinks and symlinks to directories while preserving symlinks to regular files [4].
Desktop clipboard and launch helpers received more rigorous success verification. `xclip`, `wl-copy`, and `xsel` are now supervised with exact readback checks, and clipboard-manager handoffs verify delivery [5]. Terminal/proof capture now requires a stable new X11 window ID, and macOS `open` waits on the launched app [5].
Across clownfish, worker dispatch and executor timeouts now recover by retrying repository-worker dispatches through workflow dispatch only for GitHub's known `HTTP 422` `links/0/schema` response [6]. The fix preserves dispatch IDs in workflow titles and ledger records, and gives the executor step enough time to honor its 40-minute repair budget [6]. Plan-intake coverage expanded: 20 read-only plan classification jobs were added [7] along with eight more for untracked active members [8], with fix, merge, and replacement actions blocked. OpenClaw cleaned up Windows test infrastructure with `taskkill` on metadata and report tree processes [9][10].
Action items
- → Update Crabbox to include the error redaction, redirect guard, and artifact validation fixes before next release openclaw/crabbox [immediate]
- → Review Cloudflare runner redirect behavior in your deployments openclaw/crabbox [plan]
- → Verify plans with existing artifact configurations after the stricter regular-file requirement openclaw/crabbox [plan]
- → Monitor dispatch retry logs for HTTP 422 responses to confirm the worker recovery works as intended openclaw/clownfish [monitor]
References
- [1] fix: redact Freestyle API error secrets ↗ openclaw/crabbox
- [2] fix: guard Cloudflare runner redirects ↗ openclaw/crabbox
- [3] fix: validate AWS regions before signing ↗ openclaw/crabbox
- [4] fix: reject dangling required artifacts ↗ openclaw/crabbox
- [5] fix: verify desktop helper success ↗ openclaw/crabbox
- [6] fix(worker): recover dispatch and executor timeouts ↗ openclaw/clownfish
- [7] chore: add plan intake batch ↗ openclaw/clownfish
- [8] chore(queue): add plan intake clusters ↗ openclaw/clownfish
- [9] fix(build): kill startup metadata trees on windows ↗ openclaw/openclaw
- [10] fix(testing): force taskkill group report trees on windows ↗ openclaw/openclaw
