openclaw/dist/doctor-config-audit-scrub-CPIeLJSv.mjs

Multi-channel AI gateway with extensible messaging integrations

import { g as scrubConfigAuditLog, m as resolveLegacyConfigAuditLogPath } from "./io.audit-BD1ojDxn.mjs";
import { t as note } from "./note-Bi0VsI6R.mjs";
import os from "node:os";
//#region src/commands/doctor-config-audit-scrub.ts
const NOTE_TITLE = "Config audit";
const CONFIG_AUDIT_SCRUB_CHECK_ID = "core/doctor/config-audit-scrub";
function formatEntryCount(count) {
	return `${count} ${count === 1 ? "entry" : "entries"}`;
}
async function detectConfigAuditScrubIssue(params) {
	const env = params?.env ?? process.env;
	const homedir = params?.homedir ?? os.homedir;
	return {
		...await scrubConfigAuditLog({
			env,
			homedir,
			dryRun: true
		}),
		auditPath: resolveLegacyConfigAuditLogPath(env, homedir)
	};
}
function configAuditScrubToHealthFinding(result) {
	return {
		checkId: CONFIG_AUDIT_SCRUB_CHECK_ID,
		severity: "warning",
		message: `${formatEntryCount(result.rewritten)} in config-audit.jsonl still contain pre-redactor argv values.`,
		path: result.auditPath,
		fixHint: "Run `openclaw doctor --fix` to rewrite argv/execArgv fields through the current redactor."
	};
}
function configAuditScrubToRepairEffect(result) {
	return {
		kind: "file",
		action: "would-scrub-config-audit-log",
		target: result.auditPath,
		dryRunSafe: false
	};
}
/**
* Scrubs pre-redactor config audit records or previews the number of affected entries.
*
* The rewrite aborts if new records are appended while doctor is processing the JSONL file, so
* live gateways do not lose audit entries during cleanup.
*/
async function maybeScrubConfigAuditLog(params) {
	const env = params.env ?? process.env;
	const homedir = params.homedir ?? os.homedir;
	try {
		const result = await scrubConfigAuditLog({
			env,
			homedir,
			...!params.shouldRepair ? { dryRun: true } : {}
		});
		if (params.shouldRepair && result.aborted) {
			note("Config audit scrub was aborted because new entries were appended to config-audit.jsonl during the rewrite. No records were modified. Stop the gateway (or wait until it is idle) and rerun `openclaw doctor --fix`.", NOTE_TITLE);
			return;
		}
		if (result.rewritten > 0) {
			const count = formatEntryCount(result.rewritten);
			const fixCommand = params.doctorFixCommand ?? "openclaw doctor --fix";
			note(params.shouldRepair ? `Scrubbed ${count} in config-audit.jsonl that still contained pre-redactor argv values. Rotate any credentials that may have been written to the log before the forward redactor shipped.` : `${count} in config-audit.jsonl still contain pre-redactor argv values (likely plaintext credentials at rest). Run \`${fixCommand}\` to rewrite the argv/execArgv fields through the same redactor used for new entries.`, NOTE_TITLE);
		}
	} catch (err) {
		note(`Config audit scrub failed: ${err instanceof Error ? err.message : String(err)}`, NOTE_TITLE);
	}
}
//#endregion
export { maybeScrubConfigAuditLog as i, configAuditScrubToRepairEffect as n, detectConfigAuditScrubIssue as r, configAuditScrubToHealthFinding as t };