Vendor OpenClaw source as Adolf fork baseline

Adolf is a fork/vendored clone of github.com/openclaw/openclaw (v2026.6.11),
free to diverge. Tree copied sans upstream .git; upstream remote added for
future syncs. Node pinned to 24 (.nvmrc); engines already require >=22.19.
Preserves docs/ARCHITECTURE.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LeqyaxJF2nbRXJtae2kNB2

test/scripts/dependency-vulnerability-gate.test.ts

@@ -0,0 +1,197 @@
+// Dependency Vulnerability Gate tests cover dependency vulnerability gate script behavior.
+import { spawnSync } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import {
+  classifyVulnerabilityFindings,
+  renderDependencyVulnerabilityGateMarkdownReport,
+  runDependencyVulnerabilityGate,
+} from "../../scripts/dependency-vulnerability-gate.mjs";
+
+function runCli(...args: string[]) {
+  return spawnSync(process.execPath, ["scripts/dependency-vulnerability-gate.mjs", ...args], {
+    cwd: path.resolve("."),
+    encoding: "utf8",
+  });
+}
+
+function expectNoNodeStack(stderr: string) {
+  expect(stderr).not.toContain("Node.js");
+  expect(stderr).not.toContain("\n    at ");
+}
+
+function advisory({
+  id,
+  severity,
+  title,
+  vulnerableVersions = "<=1.0.0",
+}: {
+  id: string;
+  severity: string;
+  title: string;
+  vulnerableVersions?: string;
+}) {
+  return {
+    id,
+    severity,
+    title,
+    vulnerable_versions: vulnerableVersions,
+    url: `https://github.com/advisories/${id}`,
+  };
+}
+
+async function writeLockfile(rootDir: string) {
+  await writeFile(
+    path.join(rootDir, "pnpm-lock.yaml"),
+    `lockfileVersion: '9.0'
+
+importers:
+  .:
+    dependencies:
+      runtime-high:
+        version: 1.0.0
+    devDependencies:
+      dev-high:
+        version: 1.0.0
+
+snapshots:
+  runtime-high@1.0.0: {}
+  dev-high@1.0.0: {}
+  transitive-critical@1.0.0: {}
+`,
+    "utf8",
+  );
+}
+
+describe("dependency-vulnerability-gate", () => {
+  it("reports CLI argument errors without a Node stack trace", () => {
+    const unknownArg = runCli("--wat");
+    expect(unknownArg.status).toBe(1);
+    expect(unknownArg.stdout).toBe("");
+    expect(unknownArg.stderr.trim()).toBe("Unsupported argument: --wat");
+    expectNoNodeStack(unknownArg.stderr);
+  });
+
+  it("blocks critical advisories anywhere and high advisories in the production graph", () => {
+    const result = classifyVulnerabilityFindings({
+      allAdvisories: {
+        "dev-high": [advisory({ id: "GHSA-dev-high", severity: "high", title: "dev high" })],
+        "transitive-critical": [
+          advisory({ id: "GHSA-critical", severity: "critical", title: "critical issue" }),
+        ],
+      },
+      productionAdvisories: {
+        "runtime-high": [
+          advisory({ id: "GHSA-runtime-high", severity: "high", title: "runtime high" }),
+        ],
+      },
+    });
+
+    expect(result.blockers.map((finding) => finding.id)).toEqual([
+      "GHSA-critical",
+      "GHSA-runtime-high",
+    ]);
+    expect(result.findings.map((finding) => finding.id)).toEqual([
+      "GHSA-critical",
+      "GHSA-dev-high",
+      "GHSA-runtime-high",
+    ]);
+  });
+
+  it("blocks malware advisories regardless of severity or graph", () => {
+    const result = classifyVulnerabilityFindings({
+      allAdvisories: {
+        dev: [advisory({ id: "GHSA-malware", severity: "low", title: "Malware in dev" })],
+      },
+      productionAdvisories: {},
+    });
+
+    expect(result.blockers).toMatchObject([
+      {
+        id: "GHSA-malware",
+        malware: true,
+        severity: "low",
+      },
+    ]);
+  });
+
+  it("queries full and production lockfile graphs separately", async () => {
+    const rootDir = await mkdtemp(path.join(tmpdir(), "openclaw-vuln-gate-"));
+    try {
+      await writeLockfile(rootDir);
+      const payloads: Record<string, string[]>[] = [];
+
+      const report = await runDependencyVulnerabilityGate({
+        rootDir,
+        fetchImpl: async (_url, init) => {
+          const payload = JSON.parse(String(init?.body));
+          payloads.push(payload);
+          const packages = Object.keys(payload);
+          const body: Record<string, unknown[]> = {};
+          if (packages.includes("runtime-high")) {
+            body["runtime-high"] = [
+              advisory({ id: "GHSA-runtime-high", severity: "high", title: "runtime high" }),
+            ];
+          }
+          if (packages.includes("dev-high")) {
+            body["dev-high"] = [
+              advisory({ id: "GHSA-dev-high", severity: "high", title: "dev high" }),
+            ];
+          }
+          return new Response(JSON.stringify(body), {
+            status: 200,
+            headers: { "content-type": "application/json" },
+          });
+        },
+      });
+
+      expect(payloads).toHaveLength(2);
+      expect(payloads[0]).toEqual({
+        "dev-high": ["1.0.0"],
+        "runtime-high": ["1.0.0"],
+        "transitive-critical": ["1.0.0"],
+      });
+      expect(payloads[1]).toEqual({
+        "runtime-high": ["1.0.0"],
+      });
+      expect(report.blockers.map((finding) => finding.id)).toEqual(["GHSA-runtime-high"]);
+      expect(report.findings.map((finding) => finding.id)).toEqual([
+        "GHSA-dev-high",
+        "GHSA-runtime-high",
+      ]);
+    } finally {
+      await rm(rootDir, { force: true, recursive: true });
+    }
+  });
+
+  it("documents the resolved transitive dependency graph scope in Markdown", () => {
+    const markdown = renderDependencyVulnerabilityGateMarkdownReport({
+      generatedAt: "2026-05-12T00:00:00.000Z",
+      policy: {
+        blocks: [
+          "known malware advisories anywhere in the installed graph",
+          "critical advisories anywhere in the installed graph",
+          "high advisories in the production/runtime graph",
+        ],
+        reports: [
+          "moderate and lower advisories",
+          "high advisories outside production/runtime graph",
+        ],
+        vulnerabilityExceptions: false,
+      },
+      graphs: {
+        all: { packages: 2, packageVersions: 2 },
+        production: { packages: 1, packageVersions: 1 },
+      },
+      blockers: [],
+      findings: [],
+    });
+
+    expect(markdown).toContain("# npm Advisory Vulnerability Gate: Resolved Dependency Graph");
+    expect(markdown).toContain("## Scope");
+    expect(markdown).toContain("resolved package versions from pnpm-lock.yaml");
+    expect(markdown).toContain("It includes transitive dependencies.");
+  });
+});