Instalador robusto, remote-installer, Control Center (Agentes/Skills) y endurecimiento API #16
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7769c5fe2c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const toggleSkill = (name, enabled) => { | ||
| const source = resolveSkillsList(); | ||
| const skills = source.list.map((skill) => ({ ...skill })); | ||
| const target = skills.find((skill) => skill.name === name); | ||
| if (!target) { | ||
| throw new Error("Skill no encontrada"); | ||
| } | ||
| target.enabled = Boolean(enabled); | ||
| writeSkillsConfig({ skills }); |
There was a problem hiding this comment.
When openclaw.json already contains a skills list, resolveSkillsList() returns that as the active source, but toggleSkill() always writes updates to skills.json. In this scenario, the UI toggle appears to succeed but the source of truth (openclaw.json) is never updated, and subsequent reads still reflect the old state. This breaks toggling for any install that defines skills in openclaw.json (the code explicitly prefers it). Consider writing back to the same source that was read or updating openclaw.json when it owns the skills list.
Useful? React with 👍 / 👎.
| const writeOpenclawConfig = (data) => { | ||
| ensureDir(OPENCLAW_DIR); | ||
| if (fs.existsSync(OPENCLAW_CONFIG_PATH)) { | ||
| const stamp = new Date().toISOString().replace(/[:.]/g, "-"); | ||
| const backup = `${OPENCLAW_CONFIG_PATH}.bak-${stamp}`; | ||
| fs.copyFileSync(OPENCLAW_CONFIG_PATH, backup); | ||
| } | ||
| writeJson(OPENCLAW_CONFIG_PATH, data); |
There was a problem hiding this comment.
writeOpenclawConfig() (and similarly writeSkillsConfig()) always calls ensureDir(OPENCLAW_DIR), even when OPENCLAW_CONFIG_PATH points to a different directory. If a user sets OPENCLAW_CONFIG_PATH (or OPENCLAW_SKILLS_PATH) without also setting OPENCLAW_CONFIG_DIR, the parent directory of the target file may not exist and writeJson() will fail with ENOENT. This makes /config writes or skill toggles fail in custom-path deployments; consider ensuring path.dirname(OPENCLAW_CONFIG_PATH) (or the skills path) instead.
Useful? React with 👍 / 👎.
1 participant
Motivation
security-first: loopback-only por defecto, sanitización de inputs y allowlist de acciones para OpenClaw.Description
install.sh: separación de binds (APP_BINDvsGATEWAY_BIND), defaults visibles a127.0.0.1, normalización si el usuario pulsa Enter, validación y bloqueo de binds inseguros, búsqueda automática de puertos libres, soporte no-interactivo (INSTALL_NONINTERACTIVE) y resumen final + self-test (/api/health).scripts/install-remote.sh: soporteCLAWDESK_CHANNEL=nightly(instala desdemain), soporteCLAWDESK_VERSION=vX.Y.Zdesde Releases con verificación SHA256 estricta y errores claros si faltan assets.server/openclaw/*y rutas seguras paraagents,skills,configydoctor;allowlistpara comandos OpenClaw;runOpenClawsanitiza argumentos y usaexecFilesin shell; rate limiting, CORS/host allowlist y redacción de secretos en respuestas/logs.Agentes,Skills,Configuración,Seguridad,Logs), renders y store ampliados, formularios guiados (validación JSON, backups/restores), toasts y diagnósticos en español;app/js/api.jsexpone nuevos endpoints cliente.package.jsonactualizado (tar→^7.5.7) ypackage-lock.jsonajustado;README.md,docs/yRELEASE_NOTES.mdreescritos para quickstart, canales y recomendaciones de seguridad.Testing
npm installejecutado en el repo: la instalación de dependencias completó OK tras actualizartara^7.5.7, con5 moderate severity vulnerabilitiesreportadas (sin high severity actualmente).node server/index.jsprodujo log de disponibilidad y el endpoint respondió HTTP 200;curl -I http://127.0.0.1:4178devolvió200 OK.curlen/api/healthy el self-test del instalador ahora valida accesibilidad del servicio; en caso de fallo el instalador informa dónde ver logs.net::ERR_EMPTY_RESPONSEdurante la sesión (no bloqueante para la entrega), por lo que no se incluyó una captura funcional en este PR.Codex Task