Repository navigation
Fix/lru eviction and effective fingerprint - #8
Merged
Merged
Conversation
Every rule read POSIX shell. An agent driving a Windows host — which is what OpenClaw turned out to be — writes `Remove-Item -Recurse -Force C:\` for what `rm -rf /` means, and that scored 0. So did Format-Volume, diskpart clean, and `iwr | iex`. This is not a gap to schedule. The vocabulary mismatch is currently masking it: every OpenClaw call is hard-denied as `tool not allowed`, including the dangerous ones, for the wrong reason. Mapping `exec` to `shell` — the agreed next step — retires the tool gate and hands evaluation to content rules that only understand POSIX. The agent would go from "everything refused" to "PowerShell destruction allowed at risk 0" in one commit, with nothing to signal it. So this lands first. Three properties the POSIX rules did not have to handle: - Cmdlets have aliases, and `rm`, `del` and `rd` are among them. - Parameters abbreviate to any unambiguous prefix: `-Recurse` is also `-rec` and `-r`, so matching the full word misses what an agent actually writes. - The shared normalizer strips backslashes before non-space (it exists to defeat `r''m -rf /`), so `C:\Users\rober` arrives as `c:usersrober` and patterns cannot depend on path separators. Root-target required, exactly as in the POSIX rule. `Remove-Item -Recurse -Force .\build` is the most common thing an agent does; a rule that fires there makes the guard unusable on Windows, which is worse than not having it. Five such cases are in the benign corpus. 15 evasion cases covering alias, abbreviation, flag order and case; the security baseline moves only in the benign count, with allowed == total. Benchmarks unchanged. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Mapping an agent's tools was a regex over audit prose and a squint at the
console. It is also the immediate blocker: the allowlist is written against a
vocabulary nobody has enumerated, and every OpenClaw call is hard-denied for
speaking a language the policy does not know.
The report now lists tool -> count, with the states it landed in and the
parameter names seen with it, most frequent first — which is the order to map
them in. Against the live trail:
exec 14 hard_deny:14 params: command, timeout
write 2 hard_deny:2 params: content, path
edit 2 hard_deny:2 params: edits, path
shell 1 log_only:1 params: command
That is the phase-1 deliverable no synthetic corpus can produce, and it answers
"is the sample complete yet" directly: stop when it stops growing. A thousand
varied decisions map a runtime better than ten thousand repeats of one call.
Only possible because the trail started recording structured actions two commits
ago; events predating that carry no tool and are left out rather than counted as
a nameless entry, which would misrepresent the sample.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.