feat: upgrade to Aguara v0.9.1 with context-aware scanning#70
Merged
Conversation
Aguara v0.9.0+ moves NFKC normalization, tool exemptions, and scan profiles into the core engine. This delegates those responsibilities from oktsec to Aguara and simplifies the security pipeline. Changes: Engine (internal/engine/scanner.go): - Remove manual NFKC normalization (Aguara handles internally) - Remove golang.org/x/text/unicode/norm dependency - Add ScanContentWithTool() and ScanContentAsWithTool() methods that pass tool name to Aguara via WithToolName option, enabling built-in tool exemptions (TC-005 on Edit, MCPCFG_004 on WebFetch) Verdict (internal/verdict/verdict.go): - Refactor ApplyToolScopedOverrides into shared internal function - Add ApplyToolScopedOverridesPostAguara() that skips built-in exemptions (already applied by Aguara) while preserving ContentTools filtering, NLP_ exemption, and user overrides Pipeline (hooks + gateway): - Hooks handler: ScanContent -> ScanContentWithTool(ctx, content, ev.ToolName) - Gateway tool calls: ScanContent -> ScanContentWithTool(ctx, content, m.OriginalName) - Gateway response scan: same migration - All three switch to PostAguara variant for tool-scoped overrides Gateway API (internal/gateway/gateway.go): - NewGateway signature: variadic ...* audit.Store -> plain *audit.Store Code quality (/simplify): - Merge redundant agent collection loop in trace.go - Replace manual slice reverse with slices.Reverse - Replace manual byte reverse in avatar_test.go with slices.Reverse Fix: auditcheck OpenClaw host scanning - TestRunChecks_SecureConfig was flaky because it scanned real ~/.openclaw/openclaw.json from the host - Add openClawScanFunc hook (same pattern as mcpScanFunc) for test isolation
Aguara v0.9.0+ uses Aho-Corasick for pattern matching, which has a one-time automaton build on first scan. On CI runners this can push the integration test suite past the 120s timeout. Increase to 300s.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ScanContentWithTool()for hooks and gateway tool callsApplyToolScopedOverridesPostAguara()to avoid double-filteringTestRunChecks_SecureConfig(was scanning real host OpenClaw config)slices.Reverse, simplifyNewGatewaysignatureWhat changes
Engine: oktsec no longer does manual NFKC normalization or passes pre-normalized content to Aguara. Two new methods (
ScanContentWithTool,ScanContentAsWithTool) pass tool name viaWithToolName()so Aguara applies its built-in exemption table (TC-005 on Edit, MCPCFG_004 on WebFetch, etc.).Verdict:
ApplyToolScopedOverridessplit into two variants. ThePostAguaravariant skips theBuiltinToolExemptionscheck since Aguara already filtered those findings. ContentTools filtering, DevWorkflowTools/NLP_ exemption, and user overrides still run.Pipeline: Hooks handler and gateway (tool call + response scan) now pass tool name to Aguara and use the PostAguara verdict path. Message scanning (proxy handler, stdio, forward) unchanged - no tool context available.
What oktsec keeps: VerdictQuarantine, BlockedContent per-agent, intent validation, escalation history, ContentTools/DevWorkflowTools filtering.
Files changed (12)
go.mod,go.suminternal/engine/scanner.goScanContentWithToolmethodsinternal/verdict/verdict.goApplyToolScopedOverridesPostAguarainternal/hooks/handler.goScanContentWithTool+ PostAguarainternal/gateway/gateway.goScanContentWithTool+ PostAguara + plain*audit.Storeinternal/audit/trace.goslices.Reverseinternal/auditcheck/checks_openclaw.goopenClawScanFunchookinternal/auditcheck/auditcheck_test.gointernal/dashboard/avatar_test.goslices.Reversecmd/oktsec/commands/gateway.goNewGateway(cfg, logger, nil)internal/gateway/coverage_test.goNewGateway(cfg, logger, nil)Test plan
go test ./...all green (0 FAIL)go build ./...cleanTestRunChecks_SecureConfigfixed withopenClawScanFuncmock