Security/harden shell cicd

.github/workflows/ci.yaml

@@ -22,14 +22,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6.0.2
+        with:
+          # Read-only job: don't leave GITHUB_TOKEN in .git/config.
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@v6.4.0
         with:
           node-version: 22
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
 
       - name: Run jscpd
         # Threshold 7% is the current baseline (see .jscpd.json). The job
@@ -95,14 +98,17 @@ jobs:
           # `git diff origin/<base>...HEAD` to detect touched src/ files.
           # Default shallow checkout (depth=1) produces "no merge base".
           fetch-depth: 0
+          # Read-only job (diff is local once history is fetched): don't leave
+          # GITHUB_TOKEN in .git/config.
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@v6.4.0
         with:
           node-version: 22
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
 
       - name: Build (typecheck + emit bundle artefacts)
         # `build` runs `tsc && esbuild`, which is a strict superset of
@@ -357,6 +363,9 @@ jobs:
       HIVEMIND_STRICT_POSTINSTALL: "1"
     steps:
       - uses: actions/checkout@v6.0.2
+        with:
+          # Read-only job: don't leave GITHUB_TOKEN in .git/config.
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@v6.4.0
@@ -369,7 +378,7 @@ jobs:
         # tree-sitter.mjs exit 1 here, failing the job at the earliest
         # possible step (instead of swallowing the warning and failing
         # later in tsc with a confusing "Cannot find module" error).
-        run: npm install
+        run: npm ci
 
       - name: Build (typecheck + emit bundle artefacts)
         # Second backstop: if the strict-postinstall path somehow doesn't

.github/workflows/release.yaml

@@ -231,6 +231,9 @@ jobs:
           # commit the reviewer never approved.
           ref: ${{ needs.release.outputs.sha }}
           fetch-depth: 1
+          # Publish reads a pinned SHA and never pushes; don't leave
+          # GITHUB_TOKEN in .git/config.
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@v6.4.0
@@ -246,9 +249,10 @@ jobs:
           cache: "npm"
 
       - name: Load secrets from 1Password
+        id: op_secrets
         uses: 1Password/load-secrets-action@v4.0.0
         with:
-          export-env: true
+          export-env: false
         env:
           OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
           CLAWHUB_TOKEN: "op://GitHub Actions/hivemind/CLAWHUB_TOKEN"
@@ -316,13 +320,19 @@ jobs:
           npm publish --provenance --access public
 
       - name: Install ClawHub CLI
-        run: npm install -g clawhub
+        # Pin the CLI version: it runs immediately before `clawhub login --token`
+        # with the real CLAWHUB_TOKEN in env, so a floating `@latest` would let an
+        # unexpected publish read/exfiltrate the token. Bump deliberately.
+        run: npm install -g clawhub@0.18.0
 
       - name: Authenticate ClawHub CLI
         # `clawhub login --token` writes a credential file inside the
         # runner's $HOME, which is ephemeral and discarded when the job
-        # ends. The token only ever appears as ${{ secrets.* }}, which
-        # GitHub auto-masks in logs.
+        # ends. The token is scoped to this step only (not exported to all
+        # steps via export-env) to limit the blast radius if any build step
+        # is compromised.
+        env:
+          CLAWHUB_TOKEN: ${{ steps.op_secrets.outputs.CLAWHUB_TOKEN }}
         run: clawhub login --token "$CLAWHUB_TOKEN" --no-browser
 
       - name: Publish openclaw bundle to ClawHub

src/cli/update.ts

@@ -280,7 +280,7 @@ export async function runUpdate(opts: UpdateOptions = {}): Promise<number> {
   switch (detected.kind) {
     case "npm-global": {
       if (opts.dryRun) {
-        log(`(dry-run) Would run: npm install -g ${PKG_NAME}@latest`);
+        log(`(dry-run) Would run: npm install -g ${PKG_NAME}@${latest}`);
         log(`(dry-run) Would re-run: hivemind install --skip-auth`);
         return 0;
       }
@@ -297,10 +297,14 @@ export async function runUpdate(opts: UpdateOptions = {}): Promise<number> {
       try {
         log(`Upgrading via npm…`);
         try {
-          spawn("npm", ["install", "-g", `${PKG_NAME}@latest`]);
+          // Pin to the exact version fetched from the registry rather than
+          // re-resolving `@latest` at install time — avoids a race where a
+          // new (potentially malicious) publish lands between the version
+          // check and the install.
+          spawn("npm", ["install", "-g", `${PKG_NAME}@${latest}`]);
         } catch (e: any) {
           warn(`npm install failed: ${e.message}`);
-          warn(`Try running it manually: npm install -g ${PKG_NAME}@latest`);
+          warn(`Try running it manually: npm install -g ${PKG_NAME}@${latest}`);
           return 1;
         }
         log(``);
@@ -336,7 +340,7 @@ export async function runUpdate(opts: UpdateOptions = {}): Promise<number> {
       log(``);
       log(`Or install globally so future updates are one command:`);
       log(``);
-      log(`  npm install -g ${PKG_NAME}@latest`);
+      log(`  npm install -g ${PKG_NAME}@${latest}`);
       return 0;
     }
 
@@ -358,7 +362,7 @@ export async function runUpdate(opts: UpdateOptions = {}): Promise<number> {
         return 0;
       }
       warn(`Could not determine how hivemind was installed (path: ${detected.installDir}).`);
-      warn(`Update manually: npm install -g ${PKG_NAME}@latest`);
+      warn(`Update manually: npm install -g ${PKG_NAME}@${latest}`);
       return 1;
     }
   }