Conversation
…SDKs Extract Spider Sense from feature-gated custom guard to a first-class built-in guard with standalone detector classes in Rust, TypeScript, Python, and Go. Rust core: - Extract WASM-safe `spider_sense` detection module (PatternDb, SpiderSenseDetector, cosine_similarity_f32, ScreeningResult) - Add `guards.spider_sense` field to GuardConfigs (feature-gated behind `full`) - Add first-class instantiation in async guard registry with deprecated custom guard fallback - Remove `clawdstrike-spider-sense` cargo feature gate - Ship built-in `spider-sense` ruleset and `s2bench-v1.json` pattern database (36 demo entries) WASM + TypeScript SDK: - Add WasmSpiderSenseDetector export in hush-wasm - Add SpiderSenseDetector class wrapping WASM - Add SpiderSenseGuard implementing Guard interface Python SDK: - Pure Python SpiderSenseDetector and SpiderSenseGuard Go SDK: - Pure Go SpiderSenseGuard with Screen() method - SpiderSenseConfig in policy, wired into engine Adapters: - Add spider_sense toggle to GuardToggles and EventType - Wire through openclaw adapter (config, engine, loader, validator) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Second-pass refinement addressing code review and PR review comments: Rust core: - Fix NaN/Inf fail-closed violation in cosine_similarity_f32 - Add non-finite embedding validation in PatternDb::parse_json - Add deny_unknown_fields to PatternEntry - Remove duplicated truncate_str utility - Add placeholder resolution for first-class guard config path - Add 21 new tests (10 integration, 11 unit) TypeScript: - Add try/catch fail-closed in SpiderSenseGuard.check() - Add 8 edge case tests (dimension mismatch, empty patterns, etc.) Cross-SDK parity: - Align deny severity to Error across Python and Go (was Critical) - Align guard messages to "Spider-Sense" format across all SDKs - Fix Go config zero-value bug: use pointer types for optional fields PR review fixes (Bugbot): - Remove unused Python imports (field, PatternEntry) - Deduplicate s2bench-v1.json embedding for feedback-evasion Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6be73393a5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
- Fix Go/Python cosine similarity NaN/Inf fail-closed (parity with Rust) - Feature-gate spider-sense ruleset behind `full` in RuleSet (P1) - Replace Go json.RawMessage with []PatternEntryConfig for YAML compat (P2) - Make validator accept both boolean and object for spider_sense toggle Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…, and conformance
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1fd707ac33
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed the remaining review findings in commit What was fixed:
Local validation run:
|
|
Follow-up fixes pushed in
Validation:
Also resolved both remaining PR review threads in GitHub. |
|
Additional follow-up in
Also regarding the two
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0a3be2fab2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Addressed the new review threads and CI failures in What changed:
Validation run locally:
Also resolved the 4 open review threads from Cursor/Codex tied to these issues. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e826e7eb18
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
crates/libs/clawdstrike/src/async_guards/threat_intel/spider_sense.rs
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
crates/libs/clawdstrike/src/async_guards/threat_intel/spider_sense.rs
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: df29cfb4e3
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
crates/libs/clawdstrike/src/async_guards/threat_intel/spider_sense.rs
Outdated
Show resolved
Hide resolved
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d9c508bf3e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9e8cc982f5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2321a8fb2a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 2 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 97be444556
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
| // No field-presence metadata available: treat as explicit replacement. | ||
| // Policy inheritance paths call this intentionally to avoid hidden | ||
| // heuristics when source-level field presence is unavailable. | ||
| child.clone() |
There was a problem hiding this comment.
Overly verbose merge implementation duplicates per-field logic
Low Severity
SpiderSensePolicyConfig::merge_with and merge_with_present_fields contain ~300 lines of nearly identical per-field boilerplate for 26 fields. Each field appears in three places: the presence-detection block in merge_with, the conditional assignment in merge_with_present_fields, and the struct definition. Adding a new field requires editing all three locations — a pattern likely to produce silent merge omissions as the config grows.
There was a problem hiding this comment.
💡 Codex Review
Honor llm_fail_mode on deep-path parse failures
When the LLM returns non-JSON content, deep_reasoning always emits GuardResult::warn and never checks cfg.llm_fail_mode, so policies configured with llm_fail_mode: deny (fail-closed) silently degrade to warning behavior in exactly the malformed-response scenarios this knob is meant to control.
Apply llm_timeout_ms to deep-path HTTP policy
The HTTP policy used for deep-path LLM calls hard-codes a 30s timeout, so llm_timeout_ms is validated but never actually enforced; users who set short deep-path time budgets will still block on the fixed timeout, which can materially change guard latency and decision timing in production.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
1 participant
Summary
guards.customwithclawdstrike-spider-sensefeature) to a first-class built-in guard (chore(deps): bump glob from 10.5.0 to 13.0.0 in /packages/clawdstrike-openclaw #13) with standalone detector classes across all 4 SDKsspider_sensedetection module (PatternDb, SpiderSenseDetector, cosine similarity) that always compilesspider-senseruleset ands2bench-v1.jsonpattern database (36 S2Bench taxonomy entries)SpiderSenseDetector+SpiderSenseGuardin TypeScript (WASM-backed), Python (pure), and Go (pure)spider_sensetoggle through adapter core and openclaw adapterChanges by workstream
Rust core (WS-1):
crates/libs/clawdstrike/src/spider_sense.rs— new WASM-safe detection moduleguards.spider_sensefield inGuardConfigs(feature-gated behindfull)tracing::warnclawdstrike-spider-sensecargo featurerulesets/spider-sense.yaml+rulesets/patterns/s2bench-v1.jsonWASM + TypeScript (WS-2):
WasmSpiderSenseDetectorinhush-wasm/src/detect.rsSpiderSenseDetectorclass +SpiderSenseGuardinhush-tsPython (WS-3):
SpiderSenseDetector+SpiderSenseGuardinhush-pyGo (WS-4):
SpiderSenseGuardwithScreen()+SpiderSenseConfiginhush-goAdapters + Docs (WS-5):
spider_sensetoggle inGuardToggles, event types in adapter-coreTest plan
cargo test --workspace— all pass (578+)cargo clippy --workspace -- -D warnings— cleancargo check -p clawdstrike --no-default-features --features policy-event— compilescargo check -p clawdstrike --no-default-features— compiles (WASM path)cargo check -p hush-wasm— compilesnpm test --workspace=packages/sdk/hush-ts— 235 pass🤖 Generated with Claude Code
Note
Medium Risk
Medium risk because it changes policy schema/merging and guard instantiation paths for a security enforcement component, which could alter runtime allow/deny behavior if misconfigured. The changes are fairly contained and add extensive validation/tests, but touch core policy parsing and async guard registry logic.
Overview
Spider-Sense is now a first-class built-in guard configured via
guards.spider_sense(with env placeholder resolution and per-guard async config), while the legacyguards.customclawdstrike-spider-sensepath is kept as deprecated and is ignored when the first-class config is enabled.Adds a new always-compiled, WASM-safe
spider_sensedetection module (PatternDb+SpiderSenseDetector+ fail-closed cosine similarity/screening), exposes it fromclawdstrike, and wires it into the async guard implementation; also adds a built-inspider-senseruleset plus embeddedbuiltin:s2bench-v1pattern DB.Extends policy support to schema
1.3.0, adds Spider-Sense-specific deep-merge semantics using YAML field-presence tracking (and apolicy-eventfallback that preservesspider_senseas raw JSON whenfullisn’t enabled), and exports new WASM bindings (WasmSpiderSenseDetector). Docs/lockfile are updated to reflect the new guard and ruleset, and versions are bumped to0.2.2.Written by Cursor Bugbot for commit 79c13bc. This will update automatically on new commits. Configure here.