Skip to content

Commit 7d2148b

Browse files
authored
Merge pull request #28 from initializ/skills/code-agent
docs: sync documentation, fix tests, and update branding
2 parents 1095f34 + 3607b88 commit 7d2148b

5 files changed

Lines changed: 125 additions & 4 deletions

File tree

README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Forge — Secure, Portable AI Agent Runtime
1+
# Forge — OpenClaw for Enterprise: A Secure, Portable AI Agent Runtime
22

33
Build, run, and deploy AI agents from a single `SKILL.md` file.
44
Secure by default. Runs anywhere — local, container, cloud, air-gapped.

docs/channels.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,16 @@ When the Slack adapter receives a message:
103103

104104
This gives users visual feedback that their message is being processed, especially for long-running research queries.
105105

106+
### Telegram Processing Indicators
107+
108+
The Telegram adapter mirrors Slack's processing feedback:
109+
110+
1. A typing indicator ("typing...") is sent immediately and refreshed every 4 seconds
111+
2. If the handler takes longer than 15 seconds, an interim message is posted: _"Working on it — I'll send the result when ready."_
112+
3. The typing indicator stops when the response is ready
113+
114+
**Context isolation:** Each handler goroutine runs with an independent context (10-minute timeout), detached from the polling loop. This prevents in-flight tasks from being cancelled if the polling context is interrupted during server restarts or errors.
115+
106116
## Configuration
107117

108118
### Slack (`slack-config.yaml`)

docs/security/guardrails.md

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,17 +9,32 @@ The guardrail engine checks inbound and outbound messages against configurable p
99
| Guardrail | Direction | Description |
1010
|-----------|-----------|-------------|
1111
| `content_filter` | Inbound + Outbound | Blocks messages containing configured blocked words |
12-
| `no_pii` | Outbound | Detects email addresses, phone numbers, and SSNs via regex |
12+
| `no_pii` | Outbound | Detects email, phone, SSNs (with structural validation), and credit cards (with Luhn check) |
1313
| `jailbreak_protection` | Inbound | Detects common jailbreak phrases ("ignore previous instructions", etc.) |
1414
| `no_secrets` | Outbound | Detects API keys, tokens, and private keys (OpenAI, Anthropic, AWS, GitHub, Slack, Telegram, etc.) |
1515

1616
## Modes
1717

1818
| Mode | Behavior |
1919
|------|----------|
20-
| `enforce` | Blocks violating messages, returns error to caller |
20+
| `enforce` | Blocks violating inbound messages; **redacts** outbound messages (see below) |
2121
| `warn` | Logs violation, allows message to pass |
2222

23+
### Outbound Redaction
24+
25+
Outbound messages (from the agent to the user) are always **redacted** rather than blocked, even in `enforce` mode. Blocking would discard a potentially useful agent response (e.g., code analysis) over a false positive from broad PII/secret patterns matching source code. Matched content is replaced with `[REDACTED]` and a warning is logged.
26+
27+
### PII Validators
28+
29+
To reduce false positives, PII patterns use structural validators beyond simple regex:
30+
31+
| Pattern | Validator | What it checks |
32+
|---------|-----------|---------------|
33+
| SSN | `validateSSN` | Rejects area=000/666/900+, group=00, serial=0000, all-same digits, known test SSNs |
34+
| Credit card | `validateLuhn` | Luhn checksum validation, 13-19 digit length check |
35+
| Email || Regex only |
36+
| Phone || Regex only (area code 2-9, separators required) |
37+
2338
## Configuration
2439

2540
Guardrails are defined in the policy scaffold, loaded from `policy-scaffold.json` or generated during `forge build`.

docs/skills.md

Lines changed: 52 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,8 @@ forge skills list --tags kubernetes,incident-response
163163

164164
| Skill | Icon | Category | Description | Scripts |
165165
|-------|------|----------|-------------|---------|
166-
| `github` | 🐙 | developer | Create issues, PRs, and query repositories | — (binary-backed) |
166+
| `github` | 🐙 | developer | Clone repos, create issues/PRs, and manage git workflows | `github-clone.sh`, `github-checkout.sh`, `github-commit.sh`, `github-push.sh`, `github-create-pr.sh`, `github-status.sh` |
167+
| `code-agent` | 🤖 | developer | Autonomous code generation, modification, and project scaffolding | — (builtin tools) |
167168
| `weather` | 🌤️ | utilities | Get weather data for a location | — (binary-backed) |
168169
| `tavily-search` | 🔍 | research | Search the web using Tavily AI search API | `tavily-search.sh` |
169170
| `tavily-research` | 🔬 | research | Deep multi-source research via Tavily API | `tavily-research.sh`, `tavily-research-poll.sh` |
@@ -356,6 +357,56 @@ This registers three tools:
356357

357358
Requires: `jq`. Egress: `cdn.tailwindcss.com`, `esm.sh`.
358359

360+
### GitHub Skill
361+
362+
The `github` skill provides a complete git + GitHub workflow through script-backed tools:
363+
364+
```bash
365+
forge skills add github
366+
```
367+
368+
This registers eight tools:
369+
370+
| Tool | Purpose |
371+
|------|---------|
372+
| `github_clone` | Clone a repository and create a feature branch |
373+
| `github_checkout` | Switch to or create a branch |
374+
| `github_status` | Show git status for a cloned project |
375+
| `github_commit` | Stage and commit changes |
376+
| `github_push` | Push a feature branch to the remote |
377+
| `github_create_pr` | Create a pull request |
378+
| `github_create_issue` | Create a GitHub issue |
379+
| `github_list_issues` | List open issues for a repository |
380+
381+
**Workflow:** Clone → explore → edit → status → commit → push → create PR. The skill's system prompt enforces this sequence and prevents raw `git` commands via `cli_execute`.
382+
383+
Requires: `gh`, `git`, `jq`. Optional: `GH_TOKEN`. Egress: `api.github.com`, `github.com`.
384+
385+
### Code-Agent Skill
386+
387+
The `code-agent` skill enables autonomous code generation and modification using [builtin code-agent tools](tools.md#code-agent-tools):
388+
389+
```bash
390+
forge skills add code-agent
391+
```
392+
393+
This registers eight tools:
394+
395+
| Tool | Purpose |
396+
|------|---------|
397+
| `code_agent_scaffold` | Bootstrap a new project (Vite, Express, FastAPI, Go, Spring Boot, etc.) |
398+
| `code_agent_write` | Create or update files |
399+
| `code_agent_edit` | Surgical text replacement in existing files |
400+
| `code_agent_read` | Read a file or list directory contents |
401+
| `code_agent_run` | Install dependencies, start a server, open a browser |
402+
| `grep_search` | Search file contents by regex |
403+
| `glob_search` | Find files by name pattern |
404+
| `directory_tree` | Show project directory tree |
405+
406+
The skill uses **denied tools** (`bash_execute`, `file_write`, `file_edit`, `file_patch`, `file_read`, `schedule_*`) to ensure the LLM uses the skill's own tool wrappers instead of raw builtins. All file operations are confined to the agent's working directory via `PathValidator`.
407+
408+
Requires: `bash`, `jq`. Egress: `registry.npmjs.org`, `cdn.tailwindcss.com`, `pypi.org`, `files.pythonhosted.org`, `proxy.golang.org`, `sum.golang.org`, `storage.googleapis.com`, `repo.maven.apache.org`, `repo1.maven.org`.
409+
359410
## Skill Guardrails
360411

361412
Skills can declare domain-specific guardrails in their `SKILL.md` frontmatter to enforce security policies at runtime. These guardrails operate at four interception points in the agent loop, preventing unauthorized commands, data exfiltration, capability enumeration, and binary name disclosure.

docs/tools.md

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,51 @@ Tools are capabilities that an LLM agent can invoke during execution. Forge prov
3636

3737
Register all builtins with `builtins.RegisterAll(registry)`.
3838

39+
## Code-Agent Tools
40+
41+
When the `code-agent` skill is active, Forge registers additional tools for autonomous code generation and modification. These tools are **not** registered by default — they are conditionally added when the skill requires them.
42+
43+
All code-agent tools use a `PathValidator` that confines resolved paths within the agent's working directory, preventing directory traversal attacks.
44+
45+
| Tool | Description |
46+
|------|-------------|
47+
| `bash_execute` | Execute bash commands with pipes, redirection, and shell features |
48+
| `file_read` | Read file contents with optional line offset/limit, or list directory entries |
49+
| `file_write` | Create or overwrite files in the project directory |
50+
| `file_edit` | Edit files by exact string matching with unified diff output |
51+
| `file_patch` | Batch file operations (add, update, delete, move) in a single call |
52+
| `glob_search` | Find files by glob pattern (e.g., `**/*.go`), sorted by modification time |
53+
| `grep_search` | Search file contents with regex; uses `rg` if available, falls back to Go |
54+
| `directory_tree` | Display tree-formatted directory listing (default max depth: 3) |
55+
56+
### Registration Groups
57+
58+
Code-agent tools are registered in layered groups, allowing skills to request only the capabilities they need:
59+
60+
| Group | Tools | Purpose |
61+
|-------|-------|---------|
62+
| `CodeAgentSearchTools` | `grep_search`, `glob_search`, `directory_tree` | Read-only exploration |
63+
| `CodeAgentReadTools` | `file_read` + search tools | Safe reading |
64+
| `CodeAgentWriteTools` | `file_write`, `file_edit`, `file_patch`, `bash_execute` | Modification + execution |
65+
| `CodeAgentTools` | All read + write tools | Full code-agent capability |
66+
67+
### bash_execute Security
68+
69+
| Layer | Detail |
70+
|-------|--------|
71+
| **Dangerous command denylist** | Blocks `rm -rf /`, `mkfs`, `dd`, fork bombs, and similar destructive patterns |
72+
| **sudo/su blocked** | Privilege escalation prefixes are rejected |
73+
| **Timeout** | Default 120s, configurable per invocation |
74+
| **Output cap** | Maximum 1MB output to prevent memory exhaustion |
75+
76+
### Path Validation
77+
78+
All file tools use `PathValidator` (from `pathutil.go`):
79+
80+
- All resolved paths must stay within the configured `workDir`
81+
- Directory traversal via `..` is caught after symlink resolution
82+
- Standard directories are excluded from search: `.git`, `node_modules`, `vendor`, `__pycache__`, `.venv`, `dist`, `build`
83+
3984
## Adapter Tools
4085

4186
| Adapter | Description |

0 commit comments

Comments
 (0)