Merge pull request #14 from Kilo-Org/chore/rebrand-to-shell-security

Chore rebrand to shell security

Author: St0rmz1

.github/workflows/publish.yml

@@ -42,7 +42,7 @@ jobs:
   publish:
     name: Publish to npm
     runs-on: ubuntu-24.04
-    if: github.repository == 'Kilo-Org/openclaw-security-advisor'
+    if: github.repository == 'Kilo-Org/shell-security'
     steps:
       - uses: actions/checkout@v4
         with:
@@ -122,10 +122,10 @@ jobs:
         env:
           VERSION: ${{ steps.version.outputs.version }}
         run: |
-          echo "Probing registry for @kilocode/openclaw-security-advisor@$VERSION..."
+          echo "Probing registry for @kilocode/shell-security@$VERSION..."
           for i in 1 2 3 4 5 6; do
             STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
-              "https://registry.npmjs.org/@kilocode/openclaw-security-advisor/$VERSION")
+              "https://registry.npmjs.org/@kilocode/shell-security/$VERSION")
             if [ "$STATUS" = "200" ]; then
               echo "::notice::Verified $VERSION is live on the registry"
               exit 0
@@ -254,7 +254,7 @@ jobs:
           PARTIAL PUBLISH STATE
           ============================================================
 
-          npm publish for @kilocode/openclaw-security-advisor@$VERSION
+          npm publish for @kilocode/shell-security@$VERSION
           SUCCEEDED, but the post-publish git/GitHub-release operations
           FAILED.
 
@@ -265,12 +265,12 @@ jobs:
 
           To complete the release manually, run from your local checkout:
 
-              cd /path/to/openclaw-security-advisor
+              cd /path/to/shell-security
               git fetch origin --tags
 
               # First check what already exists:
               git ls-remote --tags origin "$TAG"
-              gh release view "$TAG" --repo Kilo-Org/openclaw-security-advisor
+              gh release view "$TAG" --repo Kilo-Org/shell-security
 
           MSG
 
@@ -319,7 +319,7 @@ jobs:
           # If the GH release is missing, create it:
 
               gh release create "$TAG" \\
-                --repo Kilo-Org/openclaw-security-advisor \\
+                --repo Kilo-Org/shell-security \\
                 --title "$TAG" \\
                 --generate-notes${PRERELEASE_FLAG}
 

AGENTS.md

@@ -1,8 +1,9 @@
 # AGENTS.md
 
-`@kilocode/openclaw-security-advisor` is an OpenClaw plugin that runs a local
-`openclaw security audit`, sends it to the KiloCode Security Advisor API, and
-renders the returned markdown report inline in chat.
+`@kilocode/shell-security` (previously `@kilocode/openclaw-security-advisor`)
+is an OpenClaw plugin that runs a local `openclaw security audit`, sends it
+to the KiloCode ShellSecurity API, and renders the returned markdown report
+inline in chat.
 
 - The default branch is `main`.
 - Releases are gated on manual `workflow_dispatch` — never publish from a push trigger.
@@ -53,7 +54,7 @@ Releases are triggered manually from GitHub Actions → `publish` workflow →
 
 - **`latest`** — public stable releases (`X.Y.Z`). Default for `npm install`.
 - **`dev`** — internal dogfood snapshots (`X.Y.Z-dev.N`). Available via
-  `npm install @kilocode/openclaw-security-advisor@dev`.
+  `npm install @kilocode/shell-security@dev`.
 
 There is no `beta`, `rc`, `next`, or `canary`. Two channels, that's it.
 
@@ -107,19 +108,22 @@ Until then, release commits:
 
 ## Code layout
 
-- `index.ts` — plugin entry point; registers `/security-checkup` command and
-  `kilocode_security_advisor` tool; shared `runSecurityAdvisorFlow` handles
-  all auth paths (env token, saved token, pending device auth, new device auth).
+- `index.ts` — plugin entry point; registers the `kilocode_shell_security`
+  tool and two slash commands (`/shell-security` canonical, `/security-checkup`
+  legacy alias for users migrating from `@kilocode/openclaw-security-advisor`).
+  Both slash commands route to the same handler. Shared `runShellSecurityFlow`
+  handles all auth paths (env token, saved token, pending device auth, new
+  device auth).
 - `src/audit.ts` — runs `openclaw security audit --json`, parses + validates
   output, fetches public IP.
-- `src/client.ts` — HTTP client for the Security Advisor API; throws
+- `src/client.ts` — HTTP client for the ShellSecurity API; throws
   `AuthExpiredError` on 401.
 - `src/platform.ts` — detects `kiloclaw` vs `openclaw`. Kept separate from
   `audit.ts` so the plugin loader's "env read + network send" security
   heuristic doesn't flag the combined file.
 - `src/auth/device-auth.ts` — `startDeviceAuth` + `pollDeviceAuth` helpers.
 - `src/auth/token-store.ts` — persists auth token to
-  `~/.openclaw/secrets/openclaw-security-advisor-auth-token` (mode 600) and
+  `~/.openclaw/secrets/shell-security-auth-token` (mode 600) and
   patches `openclaw.json` with a `SecretRef`. Also manages the pending
   device-auth code file. `patchConfig` is covered by unit tests.
 

CHANGELOG.md

@@ -1,40 +1,101 @@
 # Changelog
 
-All notable changes to `@kilocode/openclaw-security-advisor` are documented here.
+All notable changes to `@kilocode/shell-security` (formerly
+`@kilocode/openclaw-security-advisor`) are documented here.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
-## [0.1.5] - Migration stub
+### Fixed
 
-This release is a migration stub. The plugin has been renamed to `@kilocode/shell-security`. Installing or invoking `@kilocode/openclaw-security-advisor@0.1.5` no longer runs a security checkup. Both the `/security-checkup` slash command and the `kilocode_security_advisor` tool return a notice explaining how to install the new package.
+- `getPublicIp()` now clears its 5-second abort timer on error paths as
+  well as success, so repeated checkups on a flaky network don't leak
+  dangling timeouts.
+- Device-auth poll requests now carry a per-request `AbortController`
+  (10s) so a hung HTTP call can no longer outlive the overall 30s
+  `POLL_TIMEOUT_MS` budget. Sleep interval and request timeout are
+  both clamped to the remaining budget at each iteration, so
+  `pollDeviceAuth()` honors its advertised deadline even when a
+  fetch is started late in the cycle.
+- Expired plugin-managed auth tokens now fall through to the file-based
+  auto re-auth path (Path B) instead of returning the "update your
+  openclaw.json" message. `runShellSecurityFlow` inspects the raw
+  config via `isPluginManagedAuthToken()` and skips Path 0 when the
+  `authToken` is a SecretRef pointing at our own provider — that shape
+  is only ever written by `writeStoredToken()` after device auth, so
+  the plugin (not the user) owns recovery.
+- `pollDeviceAuth()` now `encodeURIComponent()`s the device-auth code
+  before interpolating it into the poll URL. Defense-in-depth against
+  a compromised or MITM-ed server returning a code with URL meta-chars
+  that would silently redirect polling to a different endpoint.
+- `submitAudit()` now validates that `report.markdown` is a string on
+  the success path. A malformed server response previously surfaced as
+  a confusing `TypeError: Cannot read properties of undefined (reading
+'markdown')`; it now throws a clear
+  "unexpected response shape" error.
 
 ### Changed
 
-- `index.ts` rewritten as a two-entry-point stub that returns the migration notice. The previous audit flow, auth flow, platform detection, client, and token-store modules are removed from this release (via `git rm` so the commit can be cleanly reverted on the renamed repo).
-- `openclaw.plugin.json` description and name reflect the deprecation; config schema removed (stub requires no config).
-- `README.md` replaced with a migration page.
+- Removed the unreachable `{ kind: "pending" }` variant from
+  `DeviceAuthPollResult`. `pollDeviceAuth()` loops internally and only
+  returns terminal states or `timeout`, so the `"pending"` branch in
+  `runShellSecurityFlow` was dead code and confused the contract.
+- Renumbered the ordered list in `src/platform.ts`'s module doc
+  comment. Signals 2–5 are now 1–4.
 
-### Removed
+## [0.2.0]
+
+First release under the new `@kilocode/shell-security` name. The plugin
+was renamed from `@kilocode/openclaw-security-advisor` to `ShellSecurity`
+to reflect a broader mission than any single agent-shell runtime.
+Functionally identical to `@kilocode/openclaw-security-advisor@0.1.4`.
+
+### Changed
+
+- npm package: `@kilocode/openclaw-security-advisor` → `@kilocode/shell-security`.
+- GitHub repo: `Kilo-Org/openclaw-security-advisor` → `Kilo-Org/shell-security` (old URLs redirect).
+- OpenClaw plugin id: `openclaw-security-advisor` → `shell-security`.
+- Plugin display name: `OpenClaw Security Advisor` → `ShellSecurity`.
+- Tool name: `kilocode_security_advisor` → `kilocode_shell_security`.
+- Install dir: `~/.openclaw/extensions/openclaw-security-advisor/` → `~/.openclaw/extensions/shell-security/`.
+- Secret file: `~/.openclaw/secrets/openclaw-security-advisor-auth-token` → `~/.openclaw/secrets/shell-security-auth-token`.
+
+### Added
+
+- New `/shell-security` slash command, the canonical name matching the
+  plugin id. The existing `/security-checkup` command is also registered
+  and works identically, so users migrating from the old plugin can keep
+  typing the command they're used to. Both are routed to the same handler.
+
+### Migration
+
+Existing users of `@kilocode/openclaw-security-advisor` should run:
 
-- `src/audit.ts`, `src/client.ts`, `src/platform.ts`, `src/auth/device-auth.ts`, `src/auth/token-store.ts`.
-- Tests that exercised the removed modules (`audit`, `device-auth`, `token-store`, `platform`).
+```
+openclaw plugins install @kilocode/shell-security
+openclaw plugins enable shell-security
+openclaw gateway restart
+openclaw plugins uninstall openclaw-security-advisor
+```
 
-### Migration path for existing users
+Device auth runs fresh on first use of the new plugin. The old plugin
+remains installable from npm (deprecated) but is no longer receiving
+updates.
 
-1. `openclaw plugins install @kilocode/shell-security`
-2. `openclaw plugins enable shell-security`
-3. `openclaw gateway restart`
-4. `openclaw plugins uninstall openclaw-security-advisor`
-5. Run `/security-checkup` and complete device auth once on the new plugin.
+## [0.1.5] - 2026-04-22
 
-The new plugin's runtime behavior is identical to 0.1.4 (including the `source.channel` forwarding added in 0.1.4). The rename is strictly a name change — no feature regressions.
+Migration stub. Final release under `@kilocode/openclaw-security-advisor`.
 
-Published with provenance attestation via npm OIDC trusted publishing; verify with `npm audit signatures`.
+- Replaced the audit flow with a short migration notice directing users to
+  `@kilocode/shell-security`. The `/security-checkup` slash command and
+  the `kilocode_security_advisor` tool both return the notice; no audit
+  runs, no network call, no auth flow.
+- npm package `@kilocode/openclaw-security-advisor` marked deprecated with
+  the same migration message.
 
-## [0.1.4] - 2026-04-21
+## [0.1.4] - 2026-04-20
 
 ### Added
 
@@ -83,5 +144,7 @@ Initial dev release.
 - Audit output validated with a Zod schema at the plugin boundary.
 - Public IP detection via `ifconfig.me` with IPv4/IPv6 validation.
 
-[Unreleased]: https://github.com/Kilo-Org/openclaw-security-advisor/compare/v0.1.0-dev.1...HEAD
-[0.1.0-dev.1]: https://github.com/Kilo-Org/openclaw-security-advisor/releases/tag/v0.1.0-dev.1
+[0.2.0]: https://github.com/Kilo-Org/shell-security/compare/v0.1.5...v0.2.0
+[0.1.5]: https://github.com/Kilo-Org/shell-security/compare/v0.1.4...v0.1.5
+[0.1.4]: https://github.com/Kilo-Org/shell-security/compare/v0.1.0-dev.1...v0.1.4
+[0.1.0-dev.1]: https://github.com/Kilo-Org/shell-security/releases/tag/v0.1.0-dev.1