chore(deps): refresh toolchains and scanner runtime

[steipete]

Update the Go toolchain to 1.27.0 and npm to 12.0.2. npm 12 returns npm pack --json as an object keyed by package name, which broke package staging. Parse that documented format while retaining the array format used by supported older npm versions, cover both with regression tests, and run the existing CI packaging smoke on npm 12.

Runtime dependency refresh, generated by node scripts/update-runtime-tool-versions.mjs:

Dependency	Before	After
SkillSpector revision	8f37cfa1	539c1150
Cisco scanner	2.0.12	2.0.13
Snyk agent scan	0.5.12	0.6.0
Claude Code	2.1.193	2.1.251
Codex CLI	0.142.3	0.151.0
Socket CLI	1.1.129	1.1.162

Go library requirements are current after go get -u ./... and go mod tidy; the npm wrapper has no package dependencies. Gradio 6.26.0, Hugging Face Hub 1.29.0, AIG 0.2.1, AgentVerus 0.8.1, and all 18 external Actions dependencies are already current. The Go requirement now matches the latest stable toolchain and the contributor documentation. No new library dependencies or lockfiles are introduced.

Migration references: npm 12 release notes, Go 1.27 release notes.

Codex review identified that the CLI summary did not count Snyk 0.6 named risk indicators. Count risk_indexes maps without normalizing or discarding raw evidence, add a representative fixture-backed CLI regression, and document the upstream schema migration for operator-owned gate rules. The adapter already preserves arbitrary valid upstream JSON and its CLI flags remain supported by Snyk 0.6.

Local validation: go test -count=1 ./... passed every package; go build ./..., go vet ./..., go mod verify, actionlint, and git diff --check passed. node --test npm/clawscan/test/*.test.mjs scripts/*.test.mjs passed all 27 tests. make docs-site built seven pages, and make release VERSION=v0.0.0-test built all six local archives.

Built CLI live proof:

$ go build -o .artifacts/deps-refresh-20260830/clawscan ./cmd/clawscan
$ .artifacts/deps-refresh-20260830/clawscan ./README.md --scanner clawscan-static --output .artifacts/deps-refresh-20260830/readme-scan.json
targets: 1
scanner_completed: 1
scanner_failed: 0
scanner_skipped: 0
issues_found: 0
gate: pass
errors: 0
full_results: .artifacts/deps-refresh-20260830/readme-scan.json

The same built CLI completed a live SkillTrustBench fetch/materialization/static scan:

$ .artifacts/deps-refresh-20260830/clawscan benchmark SkillTrustBench --limit 1 --scanner clawscan-static --output .artifacts/deps-refresh-20260830/benchmark-static.json
benchmark: cuhk-zhuque/SkillTrustBench
split: benchmark
cases: 1
scanner_completed: 1
scanner_failed: 0
scanner_skipped: 0
scored: 1
correct: 1
incorrect: 0
abstained: 0
unscorable: 0
accuracy: 1.0000
full_results: .artifacts/deps-refresh-20260830/benchmark-static.json

Packaging proof, including six-platform build, pack, install, version check, and a real scan:

$ node scripts/build-npm-package.mjs --version v0.0.0 --pack --smoke
package version: 0.0.0
binary version: v0.0.0
$ npm exec --yes --package=npm@12.0.2 -- node scripts/build-npm-package.mjs --version v0.0.0 --out .artifacts/deps-refresh-20260830/npm12 --pack --smoke
package version: 0.0.0
binary version: v0.0.0

A separately installed npm 12 tarball reported clawscan v0.0.0 and completed a synthetic benign-skill scan with one completed scanner and zero errors. Black-box input variation produced static.pipe_to_shell for a remote-script-to-shell instruction; an unknown scanner exited 1 with Unknown scanner: nonexistent-scanner.

The repository has no existing changelog; the user-visible Snyk output migration is documented in docs/scanners.md. The unchanged Python requirements resolved successfully. The Gradio app served /config over localhost with HTTP 200 and 12 components, loaded two fixture rows, and validated the 3,368-case upload fixture without publishing.

CI context: default-branch build/test CI is green. The older failed Security Signals publisher is an operational publication workflow, now manual-only, not a current build/test failure. Local reproduction still reports metadata benchmark.dataset must be clawhub-security-signals; the validator requires a recorded revision but fetches the current case set without using it. Historical-data validation needs a separate revision-aware fix before rerunning publication. No assertions, tests, or jobs were weakened, and no production dataset was changed.

Snyk 0.6 fixture proof through the rebuilt CLI (synthetic upstream-shaped evidence, no authenticated API claim):

$ .artifacts/deps-refresh-20260830/clawscan .artifacts/deps-refresh-20260830/benign --scanner snyk --scanner-result snyk=cmd/clawscan/testdata/snyk-0.6.json --output .artifacts/deps-refresh-20260830/snyk-v06.json
targets: 1
scanner_completed: 1
scanner_failed: 0
scanner_skipped: 0
issues_found: 3
gate: pass
errors: 0
full_results: .artifacts/deps-refresh-20260830/snyk-v06.json

Codex autoreview passed after the Snyk summary correction: autoreview clean: no accepted/actionable findings reported. The review verified the unchanged raw-JSON adapter alongside the diff.

The candidate Docker image built locally and all eight installed CLIs passed help checks with networking disabled. Before merging, retain the existing runtime upgrade gate: compare judge-backed SkillTrustBench and Security Signals results for the operator's configured profile. This PR does not claim an authenticated judge-quality comparison. The existing runtime's two-case Security Signals probe preserved evidence but returned no prediction verdict; Cisco 2.0.12 also rejected both samples because their SKILL.md frontmatter lacked the required name field.

Runtime live proof:

docker build -t clawscan-runtime:deps-refresh-20260830 docker/clawscan-runtime
docker run --rm --network none clawscan-runtime:deps-refresh-20260830 sh -ec 'for tool in codex claude aig-skill-scan skillspector snyk-agent-scan socket agentverus-scanner skill-scanner; do "$tool" --help >/dev/null; printf "%s: help OK\n" "$tool"; done'

codex: help OK
claude: help OK
aig-skill-scan: help OK
skillspector: help OK
snyk-agent-scan: help OK
socket: help OK
agentverus-scanner: help OK
skill-scanner: help OK

The help checks emitted expected missing-credential and disabled-network warnings; no credentials were supplied. Initial Docker startup was slow on the shared host, including a timed-out 60-second minimal launch probe; the eight-tool smoke subsequently completed successfully.

env -i HOME="$HOME" PATH="$PATH" .artifacts/deps-refresh-20260830/clawscan benchmark SkillTrustBench --limit 2 --scanner skillspector --scanner cisco --sandbox-image clawscan-runtime:deps-refresh-20260830 --output .artifacts/deps-refresh-20260830/benchmark-candidate.json

benchmark: cuhk-zhuque/SkillTrustBench
split: benchmark
cases: 2
scanner_completed: 4
scanner_failed: 0
scanner_skipped: 0
scored: 0
correct: 0
incorrect: 0
abstained: 2
unscorable: 0
accuracy: 0.0000
full_results: .artifacts/deps-refresh-20260830/benchmark-candidate.json

The identical command with --sandbox-image ghcr.io/openclaw/clawscan-runtime:latest and benchmark-baseline.json produced four completed scans, zero failures, and two abstentions. These are scanner-evidence comparisons; no judge was configured, so aggregate accuracy is not a quality measurement.

Case	Scanner	Baseline → candidate
SkillTrustBench case_04866 (malicious)	SkillSpector	100/CRITICAL/DO_NOT_INSTALL → 82/CRITICAL/DO_NOT_INSTALL; complete coverage
SkillTrustBench case_01984 (clean)	SkillSpector	0/LOW/SAFE → 0/LOW/CAUTION; partial coverage due to reference_unresolved
Both SkillTrustBench cases	Cisco	Unchanged: MEDIUM with 4 findings; INFO with 1 finding
Security Signals 98dca0ef…	SkillSpector	0/LOW/SAFE → 0/LOW/CAUTION; partial coverage due to manifest_parse_error
Security Signals 42d41782…	SkillSpector	45/MEDIUM/CAUTION → 48/MEDIUM/CAUTION; partial coverage due to malformed manifest, unresolved references, and syntax errors

The Security Signals candidate command was:

env -i HOME="$HOME" PATH="$PATH" .artifacts/deps-refresh-20260830/clawscan benchmark clawhub-security-signals --limit 2 --scanner skillspector --sandbox-image clawscan-runtime:deps-refresh-20260830 --output .artifacts/deps-refresh-20260830/signals-candidate.json

Both SkillSpector scans completed and their artifact was preserved, but the command exited 1 with case 98dca0efb3f965c2246b192320cb9526e55a850d23c4ca95e769c97e8ca5bb66 has no prediction verdict. This is not a passing judged benchmark. Before merge, review the new incomplete-coverage recommendations and run the configured judge-backed runtime comparison. Also migrate any operator-owned Snyk gate paths that depend on the 0.5 JSON schema.

PR build/test CI, CodeQL, and the multi-platform Runtime Image build passed. Dependency review and submission validation also passed. The PR remains unmerged.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed August 31, 2026, 5:19 AM ET / 09:19 UTC.

ClawSweeper review

What this changes

Updates Go and npm baselines, fixes npm 12 package tarball parsing, refreshes six sandbox runtime tool pins, and counts Snyk 0.6 named risk indicators in CLI summaries.

Merge readiness

⛔ Blocked until stronger real behavior proof is added - 4 items remain

Keep open pending the repository’s documented runtime-upgrade evidence: the npm 12 packaging repair and Snyk summary change are focused and tested, but the default sandbox scanner updates still lack candidate-versus-current benchmark artifacts.

Priority: P2
Reviewed head: b95d4cde8bffddb35af6c45d4dc725b5be03d92f

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The compatibility repair is focused and covered, while real proof remains incomplete for the default scanner runtime updates.
Proof confidence	🦐 gold shrimp (3/6)	Needs stronger real behavior proof before merge: The supplied terminal traces demonstrate the rebuilt CLI’s npm 12 packaging path and fixture-backed Snyk summary, but not the changed production owner for six tools: the default Docker scanner runtime. No candidate-image execution or candidate-versus-current benchmark artifact demonstrates after-fix scanner behavior through that boundary. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: The supplied terminal traces demonstrate the rebuilt CLI’s npm 12 packaging path and fixture-backed Snyk summary, but not the changed production owner for six tools: the default Docker scanner runtime. No candidate-image execution or candidate-versus-current benchmark artifact demonstrates after-fix scanner behavior through that boundary. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	6 items	npm 12 package parsing repair: The introduced parser accepts both the legacy array response and npm 12’s package-name-keyed response, then returns the emitted tarball filename for the existing packaging flow. Snyk 0.6 summary coverage: The CLI summary now counts entries in risk_indexes maps while preserving raw scanner JSON; the added fixture-backed command test expects three findings and documents the schema transition. Default runtime is a production scanner boundary: Docker is the default sandbox mode and resolves to the published clawscan-runtime image; this PR changes the tool versions baked into that image.
Findings	None	None.
Security	None	None.

How this fits together

ClawScan runs scanners in a default Docker sandbox, preserves their raw JSON, and reports a concise CLI summary. Its npm packaging script builds and smoke-tests distributable CLI binaries, while the runtime image supplies command-backed scanner tools.

flowchart LR
  A[Operators and CI] --> B[ClawScan CLI]
  B --> C[Default Docker sandbox]
  C --> D[Scanner tools]
  D --> E[Raw scanner JSON]
  E --> F[CLI issue summary]
  B --> G[npm package build]
  G --> H[Installed CLI smoke test]

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: The supplied terminal traces demonstrate the rebuilt CLI’s npm 12 packaging path and fixture-backed Snyk summary, but not the changed production owner for six tools: the default Docker scanner runtime. No candidate-image execution or candidate-versus-current benchmark artifact demonstrates after-fix scanner behavior through that boundary. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Resolve merge risk (P1) - The Go 1.27 minimum can interrupt builds in environments pinned to Go 1.26 or using local-only toolchain selection until they upgrade.
• Resolve merge risk (P1) - The default sandbox image executes the updated scanner versions, so unmeasured tool drift could change verdicts or failure rates for security scans.
• Complete next step (P2) - Needs contributor-supplied runtime evidence rather than an automated code repair; the supplied npm and fixture proof does not cover the changed default sandbox tools.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	11 files; 106 added, 17 removed	The patch combines packaging compatibility, CLI reporting, CI toolchain setup, documentation, and sandbox runtime pins.
Production versus test coverage	production +40/-17; tests and fixtures +66	The production changes are accompanied by parser and Snyk-schema regression coverage.
Runtime pins	6 updated	Each changed tool can affect behavior inside the default command-backed scanner sandbox.

Merge-risk options

Maintainer options:

1. Finish the candidate runtime comparison (recommended)
   Build the updated sandbox image and attach redacted current-versus-candidate SkillTrustBench artifacts, plus Security Signals evidence when the ClawHub profile is affected.
2. Accept the toolchain upgrade requirement
   Merge with the documented Go 1.27 minimum, accepting that locally pinned Go 1.26 build environments must upgrade.

Technical review

Best possible solution:

Land the backward-compatible npm parser and Snyk summary only after a candidate sandbox image has documented benchmark comparisons against the current runtime and any verdict or failure-rate drift is explained.

Do we have a high-confidence way to reproduce the issue?

Yes—source inspection shows current main only accepts an array from npm pack JSON, while the supplied npm 12 object shape reaches its error path. The PR body also provides a real npm 12 after-fix packaging trace, though this read-only review did not execute it.

Is this the best way to solve the issue?

Yes for the npm 12 compatibility and Snyk summary fixes; retaining both old and new npm shapes is narrow and maintainable. The runtime pin portion still needs the repository-prescribed comparative evidence before it is ready to merge.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 9218ebfaff8c.

Labels

Label changes:

• add P2: This is a bounded packaging and scanner-runtime maintenance change with meaningful but non-urgent operational impact.
• add merge-risk: 🚨 compatibility: The Go directive raises the documented build-toolchain minimum from 1.26.1 to 1.27.0.
• add merge-risk: 🚨 security-boundary: Six updated tools run in ClawScan’s default scanner sandbox and can alter security evidence or scan outcomes.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The supplied terminal traces demonstrate the rebuilt CLI’s npm 12 packaging path and fixture-backed Snyk summary, but not the changed production owner for six tools: the default Docker scanner runtime. No candidate-image execution or candidate-versus-current benchmark artifact demonstrates after-fix scanner behavior through that boundary. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P2: This is a bounded packaging and scanner-runtime maintenance change with meaningful but non-urgent operational impact.
• merge-risk: 🚨 compatibility: The Go directive raises the documented build-toolchain minimum from 1.26.1 to 1.27.0.
• merge-risk: 🚨 security-boundary: Six updated tools run in ClawScan’s default scanner sandbox and can alter security evidence or scan outcomes.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: The supplied terminal traces demonstrate the rebuilt CLI’s npm 12 packaging path and fixture-backed Snyk summary, but not the changed production owner for six tools: the default Docker scanner runtime. No candidate-image execution or candidate-versus-current benchmark artifact demonstrates after-fix scanner behavior through that boundary. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• npm 12 package parsing repair: The introduced parser accepts both the legacy array response and npm 12’s package-name-keyed response, then returns the emitted tarball filename for the existing packaging flow. (scripts/build-npm-package.mjs:170, b95d4cde8bff)
• Snyk 0.6 summary coverage: The CLI summary now counts entries in risk_indexes maps while preserving raw scanner JSON; the added fixture-backed command test expects three findings and documents the schema transition. (cmd/clawscan/main.go:703, b95d4cde8bff)
• Default runtime is a production scanner boundary: Docker is the default sandbox mode and resolves to the published clawscan-runtime image; this PR changes the tool versions baked into that image. (internal/runner/sandbox.go:17, b95d4cde8bff)
• Existing runtime-update policy requires comparative proof: The repository’s runtime update workflow requires candidate-image ClawScan benchmark comparisons, including SkillTrustBench and Security Signals when the ClawHub profile is affected, before merge. (.github/workflows/runtime-tool-updates.yml:81, b95d4cde8bff)
• Available behavior proof is partial: The PR body supplies terminal evidence for npm 12 packaging, an installed-package smoke scan, and a fixture-driven Snyk summary, but expressly says runtime verification is still running and supplies no candidate-versus-current sandbox benchmark comparison. (b95d4cde8bff)
• Recent adjacent ownership: The immediate current-main parent refreshed CI, npm-release, runtime-update workflows, go.mod, and CLI tests under the same author, making that contributor a strong routing candidate for this surface. (.github/workflows/ci.yml:51, 9218ebfaff8c)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach redacted candidate-versus-current SkillTrustBench results from the updated Docker runtime and explain any scanner verdict or failure-rate drift.
• When the ClawHub profile is affected, attach the corresponding Security Signals comparison before merge.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: chore(deps): refresh toolchains and scanner runtime This is item 1/1 in the current shard. Shard 0/1.

This placeholder means the worker is alive and reading the current context. I will edit this same comment with the actual review when the claws are done clicking.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.