feat(security): Import IronClaw leak detection and validation#76
Closed
feat(security): Import IronClaw leak detection and validation#76
Conversation
Adapted from zeroclaw-labs/zeroclaw (MIT OR Apache-2.0 licensed). ## Runtime Subsystem (src/runtime/) RuntimeAdapter trait with platform abstraction for: - Native runtime (Mac/Linux/Windows) - Docker runtime with container isolation Features: - Capability detection (shell, filesystem, long-running) - Memory budget reporting - Configurable Docker isolation (network, memory, CPU, read-only rootfs) - Workspace mount validation and allowlisting ## Observability Subsystem (src/observability/) Observer trait for runtime telemetry with: - Discrete event types (agent lifecycle, tool calls, errors) - Numeric metric types (latency, tokens, sessions) - LogObserver implementation using tracing - CompositeObserver for multi-backend dispatch ## Dependencies - Added: directories = "6.0" ## Attribution ZeroClaw: https://github.com/zeroclaw-labs/zeroclaw License: MIT OR Apache-2.0
Import security enhancements from IronClaw (nearai/ironclaw): - **LeakDetector**: New dedicated module with Aho-Corasick accelerated multi-pattern matching for O(n) secret detection - **HTTP Request Scanning**: scan_http_request() validates URLs, headers, and bodies before outbound requests (prevents exfiltration) - **InputValidator**: Validates input length, encoding, forbidden patterns, and detects padding attacks (excessive whitespace/repetition) - **Extended Patterns**: Added Twilio, SendGrid, Stripe, Google API keys, Bearer tokens (with redaction), and more Key improvements over previous implementation: - Prefix-based fast path using Aho-Corasick before regex validation - Lossy UTF-8 for binary bodies (prevents bypass via non-UTF8 prefix) - Separate severity levels (Low/Medium/High/Critical) with action mapping - Location tracking for precise redaction ranges Attribution: Inspired by IronClaw (Apache-2.0 license). Co-authored-by: IronClaw contributors <nearai/ironclaw>
Owner
Author
|
@copilot Can you look at the CI errors and fix the PR? |
4 tasks
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Owner
Author
|
@copilot Can you fix the merge conflicts? Some of the code has probably fallen behind HEAD. |
…, fix merge conflicts (#84) * Initial plan * feat(security): Fix merge conflicts - port IronClaw security modules to workspace structure Co-authored-by: rexlunae <6726134+rexlunae@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: rexlunae <6726134+rexlunae@users.noreply.github.com>
rexlunae
added a commit
that referenced
this pull request
Feb 27, 2026
…tion Adds enhanced security modules to crates/rustyclaw-core/src/security/: - leak_detector.rs: Aho-Corasick accelerated credential leak detection - Multi-pattern scanning for API keys, tokens, passwords - HTTP request/response boundary scanning - Configurable severity levels and actions (warn/redact/block) - validator.rs: Input validation framework - Length limits, encoding validation, pattern matching - Reusable ValidationResult types - Updated safety_layer.rs to integrate new modules - InputValidator + LeakDetector now wired into SafetyLayer - Cleaner separation of concerns Attribution: HTTP scanning patterns inspired by IronClaw (Apache-2.0). Rebased from PR #76 onto main's crates workspace structure.
Owner
Author
|
Superseded by #86 (rebased onto main's crates workspace structure) |
rexlunae
added a commit
that referenced
this pull request
Feb 27, 2026
…tion (#86) Adds enhanced security modules to crates/rustyclaw-core/src/security/: - leak_detector.rs: Aho-Corasick accelerated credential leak detection - Multi-pattern scanning for API keys, tokens, passwords - HTTP request/response boundary scanning - Configurable severity levels and actions (warn/redact/block) - validator.rs: Input validation framework - Length limits, encoding validation, pattern matching - Reusable ValidationResult types - Updated safety_layer.rs to integrate new modules - InputValidator + LeakDetector now wired into SafetyLayer - Cleaner separation of concerns Attribution: HTTP scanning patterns inspired by IronClaw (Apache-2.0). Rebased from PR #76 onto main's crates workspace structure.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Import security enhancements from IronClaw (Apache-2.0):
New Modules
leak_detector.rs: Dedicated module with Aho-Corasick accelerated multi-pattern matchingvalidator.rs: Input validation for length, encoding, and suspicious patternsKey Features
scan_http_request()validates URLs, headers, and bodies before outbound requestsExtended Patterns
Input Validation
Attribution
Inspired by IronClaw's security module. Attribution included in module docs per Apache-2.0 requirements.
Testing
All new code includes unit tests. Requires
cargo checkverification (no Rust toolchain on VPS).Closes: N/A
Co-authored-by: IronClaw contributors <nearai/ironclaw>