fix(devbox): remove app env checks from dotfiles

Author: altaywtf

docs/security-audits.md

@@ -199,10 +199,6 @@ It checks:
   excluded from the default local secret scan when they are known runtime
   stores; backups and rollback files are scanned because they are common
   stale-secret locations.
-- OpenClaw runtime drift is bounded: `/private/tmp` remains a safe sticky temp
-  directory, OpenClaw/npm/mise-owned state is not root-owned, Gateway service
-  files do not point at Homebrew Node, and any Tailscale Serve route for the
-  Gateway port requires OpenClaw `resetOnExit=true`.
 - Codex trusted project paths do not cross into another Unix user's home, point
   at missing paths, or trust broad home-root directories
 - the home root does not contain stray project artifacts such as `node_modules`

scripts/audit/devbox.sh

@@ -58,24 +58,8 @@ print_json_summary() {
   printf ',"secret_scan_count":%s}\n' "$secret_scan_count"
 }
 
-emit_app_runtime_boundary_files() {
-  find_matching_files "$HOME/.openclaw" \
-    \( -path "$HOME/.openclaw/agents" \
-      -o -path "$HOME/.openclaw/browser" \
-      -o -path "$HOME/.openclaw/credentials" \
-      -o -path "$HOME/.openclaw/devices" \
-      -o -path "$HOME/.openclaw/identity" \
-      -o -path "$HOME/.openclaw/plugin-runtime-deps" \
-      -o -path "$HOME/.openclaw/plugin-runtime-deps.*" \
-      -o -path "$HOME/.openclaw/service-env" \
-      -o -path '*/node_modules' \
-      -o -path '*/.tmp' \) -prune \
-    -o -type f \( -name '*.bak' -o -name '*.last-good' -o -name '*.env.*' \)
-}
-
 emit_devbox_secret_scan_paths() {
   emit_home_dotfiles
-  emit_app_runtime_boundary_files
   emit_path_if_exists "$HOME/.aws"
   emit_path_if_exists "$HOME/.config/process-compose"
   emit_path_if_exists "$HOME/.docker"
@@ -129,213 +113,6 @@ system_resolves_host() {
   fi
 }
 
-check_app_service_env_boundary() {
-  local service_env_dir="$HOME/.openclaw/service-env"
-  local service_env_file
-  local env_owner
-
-  section "application service env boundary"
-
-  if [ ! -e "$service_env_dir" ]; then
-    ok "no optional application service env directory"
-    return
-  fi
-
-  check_mode_any fail "$service_env_dir" 700
-  if [ "$(owner_of "$service_env_dir")" = "$devbox_user" ]; then
-    ok "$service_env_dir owner $devbox_user"
-  else
-    fail_check "$service_env_dir owner is $(owner_of "$service_env_dir"), expected $devbox_user"
-  fi
-
-  while IFS= read -r service_env_file; do
-    [ -n "$service_env_file" ] || continue
-
-    if [ -L "$service_env_file" ]; then
-      fail_check "$service_env_file must not be a symlink"
-      continue
-    fi
-
-    check_mode_any fail "$service_env_file" 600
-    env_owner="$(owner_of "$service_env_file")"
-    if [ "$env_owner" = "$devbox_user" ]; then
-      ok "$service_env_file owner $env_owner"
-    else
-      fail_check "$service_env_file owner is $env_owner, expected $devbox_user"
-    fi
-  done < <(find "$service_env_dir" -maxdepth 1 -type f -name '*.env' -print 2>/dev/null | sort)
-}
-
-check_openclaw_runtime_env_boundary() {
-  local env_file="$HOME/.openclaw/.env"
-  local env_owner
-
-  section "OpenClaw runtime env boundary"
-
-  if [ ! -e "$env_file" ]; then
-    if [ -e "$HOME/.openclaw" ]; then
-      warn "OpenClaw state exists but $env_file is missing"
-    else
-      ok "no optional OpenClaw runtime env file"
-    fi
-    return
-  fi
-
-  if [ -L "$env_file" ]; then
-    fail_check "$env_file must be a direct file, not a symlink"
-    return
-  fi
-
-  check_mode_any fail "$env_file" 600
-  env_owner="$(owner_of "$env_file")"
-  if [ "$env_owner" = "$devbox_user" ]; then
-    ok "$env_file owner $env_owner"
-  else
-    fail_check "$env_file owner is $env_owner, expected $devbox_user"
-  fi
-}
-
-emit_openclaw_owned_paths() {
-  local node_installs_dir="$HOME/.local/share/mise/installs/node"
-
-  emit_path_if_exists "$HOME/.npm"
-  emit_path_if_exists "$HOME/.openclaw"
-
-  if [ -d "$node_installs_dir" ]; then
-    find "$node_installs_dir" \
-      \( -path '*/lib/node_modules/openclaw' -o -path '*/bin/openclaw' \) \
-      -print 2>/dev/null || true
-  fi
-}
-
-check_openclaw_owned_path() {
-  local path="$1"
-  local bad_path
-
-  [ -e "$path" ] || return
-
-  bad_path="$(
-    find "$path" -maxdepth 8 \( -user root -o ! -user "$devbox_user" \) -print -quit 2>/dev/null || true
-  )"
-  if [ -n "$bad_path" ]; then
-    fail_check "OpenClaw path contains root/non-$devbox_user-owned file: $bad_path"
-  else
-    ok "$path ownership stays with $devbox_user"
-  fi
-}
-
-json_config_value() {
-  local path="$1"
-  local key="$2"
-
-  if [ -r "$path" ] && command -v plutil >/dev/null 2>&1; then
-    plutil -extract "$key" raw -o - "$path" 2>/dev/null | tr -d '\n' || true
-  fi
-}
-
-check_openclaw_tmp() {
-  if [ "$(owner_of /private/tmp 2>/dev/null || true)" != "root" ]; then
-    fail_check "/private/tmp owner is $(owner_of /private/tmp 2>/dev/null || echo unknown), expected root"
-  else
-    ok "/private/tmp owner root"
-  fi
-
-  if [ "$(mode_of /private/tmp 2>/dev/null || true)" != "777" ]; then
-    fail_check "/private/tmp mode is $(mode_of /private/tmp 2>/dev/null || echo unknown), expected 777 with sticky bit"
-  else
-    ok "/private/tmp mode 777"
-  fi
-
-  if [ -k /private/tmp ]; then
-    ok "/private/tmp sticky bit set"
-  else
-    fail_check "/private/tmp sticky bit is not set"
-  fi
-}
-
-check_openclaw_service_node() {
-  local plist_path="$HOME/Library/LaunchAgents/ai.openclaw.gateway.plist"
-  local wrapper_path="$HOME/.local/bin/openclaw-gateway-mise-wrapper"
-  local path
-  local checked=0
-
-  if [ ! -e "$HOME/.openclaw" ] && ! command -v openclaw >/dev/null 2>&1; then
-    ok "OpenClaw is not installed for this user"
-    return
-  fi
-
-  if [ ! -e "$plist_path" ]; then
-    warn "OpenClaw state exists but gateway LaunchAgent is not installed"
-    return
-  fi
-
-  check_mode_any fail "$plist_path" 600
-
-  for path in "$plist_path" "$wrapper_path"; do
-    [ -e "$path" ] || continue
-    checked=$((checked + 1))
-
-    if grep -Eq '/opt/homebrew/(opt/)?node.*/bin/node|/opt/homebrew/bin/node' "$path"; then
-      fail_check "$path references Homebrew Node"
-    else
-      ok "$path does not reference Homebrew Node"
-    fi
-
-    if grep -Eq "$HOME/.local/share/mise/installs/node|mise" "$path"; then
-      ok "$path references mise"
-    fi
-  done
-
-  if [ "$checked" -eq 1 ]; then
-    warn "OpenClaw gateway wrapper is missing; checked LaunchAgent only"
-  fi
-}
-
-check_openclaw_tailscale_serve() {
-  local config_path="$HOME/.openclaw/openclaw.json"
-  local gateway_port
-  local tailscale_reset_on_exit
-  local serve_status
-
-  if [ ! -e "$config_path" ]; then
-    ok "no OpenClaw config for Tailscale check"
-    return
-  fi
-
-  gateway_port="$(json_config_value "$config_path" "gateway.port")"
-  gateway_port="${gateway_port:-18789}"
-  tailscale_reset_on_exit="$(json_config_value "$config_path" "gateway.tailscale.resetOnExit")"
-
-  if ! command -v tailscale >/dev/null 2>&1; then
-    warn "tailscale is missing for OpenClaw Serve drift check"
-    return
-  fi
-
-  serve_status="$(tailscale serve status 2>/dev/null || true)"
-  if ! grep -Fq "http://127.0.0.1:$gateway_port" <<< "$serve_status"; then
-    ok "no Tailscale Serve route for OpenClaw port $gateway_port"
-  elif [ "$tailscale_reset_on_exit" = "true" ]; then
-    ok "OpenClaw resets Tailscale Serve for gateway port $gateway_port"
-  else
-    fail_check "Tailscale Serve proxies OpenClaw port $gateway_port but OpenClaw resetOnExit is not enabled"
-  fi
-}
-
-check_openclaw_drift() {
-  local path
-
-  section "OpenClaw runtime drift"
-
-  check_openclaw_tmp
-  while IFS= read -r path; do
-    [ -n "$path" ] || continue
-    check_openclaw_owned_path "$path"
-  done < <(emit_openclaw_owned_paths | sort -u)
-
-  check_openclaw_service_node
-  check_openclaw_tailscale_serve
-}
-
 while [ "$#" -gt 0 ]; do
   case "$1" in
     --config)
@@ -467,10 +244,6 @@ if [ -e "$HOME/.docker/config.json" ]; then
   scan_file_for_secret_pattern "$HOME/.docker/config.json" '"auth"[[:space:]]*:' "inline Docker auth material"
 fi
 
-check_app_service_env_boundary
-check_openclaw_runtime_env_boundary
-check_openclaw_drift
-
 section "Codex trust boundaries"
 
 codex_config="$HOME/.codex/config.toml"

scripts/verify/devbox-services.sh

@@ -201,24 +201,6 @@ check_infisical() {
   printf 'ok Infisical machine identity can read %s\n' "$infisical_secret_path"
 }
 
-check_openclaw_runtime_env() {
-  local env_file="$HOME/.openclaw/.env"
-  local env_owner
-
-  section "OpenClaw runtime env boundary"
-
-  if [ ! -e "$env_file" ]; then
-    printf 'warn missing optional %s\n' "$env_file"
-    return
-  fi
-
-  [ ! -L "$env_file" ] || fail "$env_file must be a direct file, not a symlink"
-  check_mode "$env_file" 600
-  env_owner="$(owner_of "$env_file")"
-  [ "$env_owner" = "$devbox_user" ] || fail "$env_file owner is $env_owner, expected $devbox_user"
-  printf 'ok %s owner %s\n' "$env_file" "$env_owner"
-}
-
 check_process_compose() {
   section "process-compose"
 
@@ -246,7 +228,6 @@ check_process_compose() {
 check_config
 check_no_default_secret_exports
 check_infisical
-check_openclaw_runtime_env
 check_process_compose
 
 printf '\ndevbox verification ok\n'