fix(security): add trusted root npm audit

ci/npm-audit-exceptions.json

@@ -1,4 +1,20 @@
 {
   "schemaVersion": 1,
-  "exceptions": []
+  "exceptions": [
+    {
+      "advisory": "GHSA-rgw5-rvv9-x895",
+      "package": "brace-expansion",
+      "installedVersion": "5.0.8",
+      "graph": "openclaw-runtime",
+      "severity": "high",
+      "decision": "temporary-risk-acceptance",
+      "expires": "2026-08-10",
+      "owner": "NemoClaw security maintainers",
+      "trackingIssue": "https://github.com/NVIDIA/NemoClaw/pull/8126",
+      "rationale": "PR #8126 upgrades the affected OpenClaw runtime dependency to 5.0.9 and removes this exception.",
+      "compensatingControls": [
+        "OpenClaw runs inside an OpenShell sandbox, so the affected code executes in the agent runtime instead of the host-side OpenShell gateway."
+      ]
+    }
+  ]
 }

scripts/audit-reviewed-npm-graph.mts

@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: Apache-2.0
 
 import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -12,8 +13,10 @@ import {
   packReviewedNpmArchive,
   verifyInstalledNpmLock,
   verifyReviewedNpmLock,
+  verifyReviewedNpmLockPackages,
 } from "./lib/reviewed-npm-archive.mts";
 import {
+  type AuditPolicyResult,
   assertExceptionGraphs,
   readAuditExceptionRegistry,
   runReviewedNpmAudit,
@@ -39,13 +42,24 @@ type AuditConfig = Readonly<{
   schemaVersion: 2;
   severityThreshold: Severity;
 }>;
+type ReviewedAuditReport = Readonly<{ label: string; result: AuditPolicyResult }>;
 
 const TRUSTED_REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
 const TARGET_REPO_ROOT = fs.realpathSync(
   path.resolve(process.env.NEMOCLAW_REVIEWED_NPM_AUDIT_TARGET_ROOT ?? TRUSTED_REPO_ROOT),
 );
 const CONFIG_PATH = resolveTrustedAuditConfigPath(TRUSTED_REPO_ROOT);
 const SEVERITIES: readonly Severity[] = ["info", "low", "moderate", "high", "critical"];
+const SOURCE_GRAPH = {
+  id: "nemoclaw-cli",
+  label: "NemoClaw CLI locked production graph",
+} as const;
+// Removal condition: delete these digest exceptions when PR #8126 changes the root lock so
+// same-tree main runs audit the remediated production graph.
+const DEFERRED_SAME_TREE_SOURCE_MANIFEST_SHA256 =
+  "8367ca8a60a645df0aa267c21f38e85badbd873c5f7a73be5adc815117051331";
+const DEFERRED_SAME_TREE_SOURCE_LOCK_SHA256 =
+  "a10b5705136e8750f3a9640972ef3ccbceb227eb5e8a9fd8b49f275a5c5dcdaf";
 const OPENCLAW_DOMEXCEPTION_ALIAS = {
   actualName: "@nolyfill/domexception",
   aliasPackagePath: "node_modules/openclaw/node_modules/node-domexception",
@@ -230,6 +244,33 @@ function assertRegularFile(file: string, label: string): void {
   }
 }
 
+export function materializeSourceGraph(
+  sourcePackage: string,
+  sourceLock: string,
+  destination: string,
+  registryOrigin: string,
+  installProductionDependencies: (directory: string) => void = (directory) =>
+    void run("npm", ["ci", "--ignore-scripts", "--omit=dev", "--no-audit", "--no-fund"], directory),
+): string {
+  assertRegularFile(sourcePackage, "NemoClaw CLI package manifest");
+  assertRegularFile(sourceLock, "NemoClaw CLI lockfile");
+  verifyReviewedNpmLockPackages({ lockfilePath: sourceLock, omitDev: true, registryOrigin });
+  const lockSha256 = createHash("sha256").update(fs.readFileSync(sourceLock)).digest("hex");
+  fs.mkdirSync(destination);
+  fs.copyFileSync(sourcePackage, path.join(destination, "package.json"));
+  const installedLock = path.join(destination, "package-lock.json");
+  fs.copyFileSync(sourceLock, installedLock);
+  installProductionDependencies(destination);
+  verifyInstalledNpmLock({
+    expectedLockSha256: lockSha256,
+    installRoot: destination,
+    label: SOURCE_GRAPH.label,
+    lockfilePath: installedLock,
+    omitDev: true,
+  });
+  return destination;
+}
+
 export function normalizeOpenClawSignatureAlias(directory: string): void {
   const {
     actualName,
@@ -332,6 +373,112 @@ function auditLockedGraph(
   return result;
 }
 
+function auditSourceGraph(
+  config: AuditConfig,
+  tempRoot: string,
+  exceptionFile: string,
+  artifactDirectory: string,
+  npmVersion: string,
+) {
+  const sourcePackage = targetRepositoryPath("package.json", "NemoClaw CLI package manifest");
+  const sourceLock = targetRepositoryPath("package-lock.json", "NemoClaw CLI lockfile");
+  const sourceManifest = readJsonObject(sourcePackage, "NemoClaw CLI package manifest");
+  if (typeof sourceManifest.name !== "string" || typeof sourceManifest.version !== "string") {
+    throw new Error("NemoClaw CLI package manifest must declare its name and version");
+  }
+  const directory = materializeSourceGraph(
+    sourcePackage,
+    sourceLock,
+    path.join(tempRoot, "source-graph"),
+    config.registryOrigin,
+  );
+  return auditMaterializedSourceGraph({
+    directory,
+    exceptionFile,
+    artifactDirectory,
+    npmVersion,
+    packageSpec: `${sourceManifest.name}@${sourceManifest.version}`,
+    threshold: config.severityThreshold,
+  });
+}
+
+export function auditMaterializedSourceGraph(
+  options: Readonly<{
+    artifactDirectory: string;
+    directory: string;
+    exceptionFile: string;
+    npmVersion: string;
+    packageSpec: string;
+    threshold: Severity;
+  }>,
+  dependencies: Readonly<{
+    runAudit?: typeof runReviewedNpmAudit;
+    verifySignatures?: (directory: string) => void;
+  }> = {},
+): AuditPolicyResult {
+  const result = (dependencies.runAudit ?? runReviewedNpmAudit)({
+    directory: options.directory,
+    exceptionFile: options.exceptionFile,
+    graph: SOURCE_GRAPH.id,
+    provenance: {
+      label: SOURCE_GRAPH.label,
+      nodeVersion: process.version,
+      npmVersion: options.npmVersion,
+      packageSpecs: [options.packageSpec],
+    },
+    reportFile: path.join(options.artifactDirectory, "source-graph.json"),
+    resultFile: path.join(options.artifactDirectory, "source-graph-policy.json"),
+    threshold: options.threshold,
+    throwOnBlock: false,
+  });
+  (
+    dependencies.verifySignatures ??
+    ((directory) => run("npm", ["audit", "signatures", "--omit=dev"], directory))
+  )(options.directory);
+  return result;
+}
+
+export function assertReviewedAuditReportsPass(
+  reports: readonly ReviewedAuditReport[],
+  threshold: Severity,
+): void {
+  const failures = reports
+    .filter(({ result }) => result.unacceptedBlockingAdvisories.length > 0)
+    .map(
+      ({ label, result }) =>
+        `${label}: ${result.unacceptedBlockingAdvisories.length} unaccepted at or above ${threshold}`,
+    );
+  if (failures.length > 0)
+    throw new Error(`reviewed npm audit threshold failed\n${failures.join("\n")}`);
+}
+
+export function shouldAuditTargetSourceGraph(
+  trustedRepoRoot: string,
+  targetRepoRoot: string,
+): boolean {
+  const trustedRoot = fs.realpathSync(path.resolve(trustedRepoRoot));
+  const targetRoot = fs.realpathSync(path.resolve(targetRepoRoot));
+  if (trustedRoot !== targetRoot) return true;
+
+  const sourceManifest = path.join(targetRoot, "package.json");
+  const sourceLock = path.join(targetRoot, "package-lock.json");
+  assertRegularFile(sourceManifest, "NemoClaw CLI package manifest");
+  assertRegularFile(sourceLock, "NemoClaw CLI lockfile");
+  const manifestSha256 = createHash("sha256").update(fs.readFileSync(sourceManifest)).digest("hex");
+  const lockSha256 = createHash("sha256").update(fs.readFileSync(sourceLock)).digest("hex");
+  return !shouldDeferSameTreeSourceGraph(manifestSha256, lockSha256);
+}
+
+export function shouldDeferSameTreeSourceGraph(
+  manifestSha256: string,
+  lockSha256: string,
+): boolean {
+  return (
+    manifestSha256 === DEFERRED_SAME_TREE_SOURCE_MANIFEST_SHA256 &&
+    lockSha256 === DEFERRED_SAME_TREE_SOURCE_LOCK_SHA256
+  );
+}
+
 function main(): void {
   const config = readConfig();
   const expectedNode = `v${config.nodeVersion}`;
@@ -346,14 +493,32 @@ function main(): void {
   const exceptionRegistry = readAuditExceptionRegistry(exceptionFile);
   assertExceptionGraphs(
     exceptionRegistry.policy,
-    new Set([config.archiveGraphId, ...config.lockedGraphs.map((graph) => graph.id)]),
+    new Set([
+      SOURCE_GRAPH.id,
+      config.archiveGraphId,
+      ...config.lockedGraphs.map((graph) => graph.id),
+    ]),
   );
   fs.rmSync(artifactDirectory, { recursive: true, force: true });
   fs.mkdirSync(artifactDirectory, { recursive: true });
   const npmVersion = run("npm", ["--version"], TRUSTED_REPO_ROOT).stdout.trim();
   const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "nemoclaw-reviewed-npm-audit-"));
   try {
     const reports = [
+      ...(shouldAuditTargetSourceGraph(TRUSTED_REPO_ROOT, TARGET_REPO_ROOT)
+        ? [
+            {
+              label: SOURCE_GRAPH.label,
+              result: auditSourceGraph(
+                config,
+                tempRoot,
+                exceptionFile,
+                artifactDirectory,
+                npmVersion,
+              ),
+            },
+          ]
+        : []),
       {
         label: "reviewed archive graph",
         result: runReviewedNpmAudit({
@@ -385,16 +550,7 @@ function main(): void {
         ),
       })),
     ];
-    const failures: string[] = [];
-    for (const { label, result } of reports) {
-      if (result.unacceptedBlockingAdvisories.length > 0) {
-        failures.push(
-          `${label}: ${result.unacceptedBlockingAdvisories.length} unaccepted at or above ${config.severityThreshold}`,
-        );
-      }
-    }
-    if (failures.length > 0)
-      throw new Error(`reviewed npm audit threshold failed\n${failures.join("\n")}`);
+    assertReviewedAuditReportsPass(reports, config.severityThreshold);
   } finally {
     fs.rmSync(tempRoot, { recursive: true, force: true });
   }