Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug] doctor --deep says no channel security warnings while security audit --deep reports criticals [1 pull requests, 1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#43804•Fetched 2026-04-08 00:17:54
View on GitHub
Comments
0
Participants
1
Timeline
1
Reactions
0
Author
Mdx2025Mdx2025
Participants
Mdx2025Mdx2025
Timeline (top)
cross-referenced ×1

openclaw doctor --deep reports:

Security: No channel security warnings detected. Run: openclaw security audit --deep

But immediately running openclaw security audit --deep on the same config reports multiple severe findings (including channel exposure criticals).

This is misleading during post-upgrade validation because doctor appears green on security while security audit is red.

Error Message

  • 7 critical, 3 warn, 1 info

Root Cause

Operators use doctor as a post-update readiness gate. Contradictory security signals can lead to missed hardening actions.

Fix Action

Fixed

PR fix notes

PR #43845: fix(doctor): clarify lightweight security warning output

Description (problem / solution / changelog)

Summary

Fixes #43804 by clarifying that the doctor's clean security message only reflects the lightweight doctor pass, not a full security audit.

What changed

  • Replace the authoritative-sounding clean message in noteSecurityWarnings() with wording that explicitly says it is a lightweight pass
  • Keep the existing openclaw security audit --deep follow-up hint
  • Update the focused unit test to assert the new wording

What did not change

  • No changes to the underlying security audit logic
  • No new warnings or policy changes
  • No broader doctor/status refactor

Validation

AI-assisted with Codex.

Changed files

  • src/commands/doctor-security.test.ts (modified, +4/-2)
  • src/commands/doctor-security.ts (modified, +7/-1)
RAW_BUFFERClick to expand / collapse

Summary

openclaw doctor --deep reports:

Security: No channel security warnings detected. Run: openclaw security audit --deep

But immediately running openclaw security audit --deep on the same config reports multiple severe findings (including channel exposure criticals).

This is misleading during post-upgrade validation because doctor appears green on security while security audit is red.

Environment

  • OpenClaw: v2026.3.11
  • Command context: same host, same config, back-to-back runs

Repro

  1. Run:
    • openclaw doctor --deep
  2. Run:
    • openclaw security audit --deep

Actual

  • doctor --deep prints "No channel security warnings detected".
  • security audit --deep reports:
    • 7 critical, 3 warn, 1 info
    • including security.exposure.open_groups_with_elevated
    • and security.exposure.open_groups_with_runtime_or_fs

Expected

At minimum, doctor should not show a reassuring security message when security audit has critical findings for the same config.

Either:

  1. doctor reuses the same security checks (or a consistent subset) and surfaces severity summary, or
  2. doctor message is explicitly downgraded to "partial check" (non-authoritative) to avoid false confidence.

Why this matters

Operators use doctor as a post-update readiness gate. Contradictory security signals can lead to missed hardening actions.

extent analysis

Fix Overview

Make openclaw doctor run the same security‑audit checks that openclaw security audit does (or at least a deterministic subset) and change its output logic so it never prints a “no security warnings” message when any critical/warn findings exist.

The fix consists of three parts:

  1. Shared audit library – move the security‑audit rule engine into a reusable package (security/audit).
  2. Doctor integration – call that library from the doctor command, collect the results, and adjust the summary message.
  3. CLI flag – add an optional --skip-security flag for callers that truly want a “quick‑only” health check.

Below are concrete steps and minimal code snippets (the project is written in Go; adapt the language if yours differs).

1. Refactor the security‑audit engine

File: pkg/security/audit/audit.go

package audit

type Finding struct {
    ID       string // e.g. "security.exposure.open_groups_with_elevated"
    Severity string // "critical", "warn", "info"
    Message  string
}

// RunAll runs every registered rule and returns a slice of findings.
func RunAll(cfg *Config) ([]Finding, error) {
    var out []Finding
    for _, rule := range registeredRules {
        f, err := rule.Check(cfg)
        if err != nil {
            return nil, err
        }
        out = append(out, f...)
    }
    return out, nil
}

All existing rule implementations (rule_open_groups.go, …) should already implement the same Check(*Config) ([]Finding, error) signature, so no changes are needed there – just register them in init() as before.

2. Update the security audit command to use the shared lib (no functional change, just wiring)

File: cmd/security_audit.go

func runSecurityAudit(cfgPath string, deep bool) error {
    cfg, err := loadConfig(cfgPath)
    if err != nil { return err }

    findings, err := audit.RunAll(cfg)
    if err != nil { return err }

    // existing pretty‑print logic …
    printFindings(findings)
    return nil
}

3. Integrate the audit into doctor

File: `cmd/doctor.go

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#api#ssr#installation#tensor shape#autograd error#callback error#memory management#API rate limit#retriever error#indexing error

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING