# v3.18.0 Release - Remaining Issues

**Status:** WIP - Ready for release after fixing test failures below

**Branch:** `wip/v3.18.0-semantic-analysis`

**Date:** 2026-03-06

---

## ✅ Completed Work

### Semantic Code Analysis Layer (COMPLETE)
- **Status:** ✅ Fully implemented and tested
- **Files:**
  - `src/semantic-analyzer.js` (1,284 lines) - Core CFG/DFG/CPG engine
  - `src/semantic-integration.js` (283 lines) - Integration layer
  - `rules/semantic-security.yaml` (52 rules) - Semantic patterns
  - `tests/semantic-analysis.test.js` (31 tests) - Full test coverage
  - `docs/semantic-analysis.md` - Complete documentation

- **Features:**
  - Control Flow Graph (CFG) builder
  - Data Flow Graph (DFG) with taint tracking
  - Code Property Graph (CPG) combining CFG + DFG + AST
  - 52 semantic security rules
  - Pattern matching engine

- **Detects:**
  - Unreachable code after return/throw
  - Missing authentication checks
  - Race conditions and TOCTOU vulnerabilities
  - Logic contradictions
  - Dead stores
  - Use-after-free patterns

- **Test Results:** ✅ 31/31 tests passing

### Documentation Cleanup (COMPLETE)
- **Status:** ✅ Fully completed
- Moved `CONTRIBUTING.md`, `SETUP.md`, `mcp-top25.md` to `docs/` folder
- Removed 9 obsolete planning/release documents
- Removed 4 unused logo files
- Updated all references in `.github/` and `clawproof/`

---

## ❌ Blocking Issues for Release

### Test Failures (4 total)

These are **pre-existing bugs** NOT related to the v3.18.0 semantic analysis feature.

#### 1. tests/scan-skill.test.js - 2 failures

**Test:** "returns error for nonexistent path"
- **Location:** `tests/scan-skill.test.js:60`
- **Issue:** Error message doesn't match expected "not found" text
- **Root Cause:** Line 905 in `src/tools/scan-skill.js`:
  ```javascript
  error: "Invalid path, symlink loop, or permission denied"
  ```
  Should check `err.code === 'ENOENT'` and return "not found" message

**Test:** "rejects path outside cwd and ~/.openclaw/skills/"
- **Location:** `tests/scan-skill.test.js:372`
- **Issue:** Path validation not working correctly
- **Root Cause:** Needs investigation - path `../../etc` should be rejected

#### 2. .worktrees/pr-12-fix/tests/scan-skill.test.js - 1 failure

**Test:** "rejects path with .. traversal to escape cwd"
- **Location:** `.worktrees/pr-12-fix/tests/scan-skill.test.js`
- **Issue:** Similar to above - path traversal not being caught
- **Note:** This is in a git worktree, might be stale

#### 3. tests/plugin-integration.test.js - 1 failure

**Test:** "should report error for nonexistent path"
- **Location:** `tests/plugin-integration.test.js`
- **Issue:** Same root cause as scan-skill test #1
- **Fix:** Same as above - check for ENOENT and return proper error

---

## 🔧 Required Fixes

### Fix 1: Update error handling in scan-skill.js

**File:** `src/tools/scan-skill.js`
**Lines:** 899-910

**Current code:**
```javascript
try {
  realPath = realpathSync(resolve(inputPath));
} catch (err) {
  return {
    content: [{ type: "text", text: JSON.stringify({
      error: "Invalid path, symlink loop, or permission denied",
      skill_path: inputPath,
      details: err.message
    }) }]
  };
}
```

**Proposed fix:**
```javascript
try {
  realPath = realpathSync(resolve(inputPath));
} catch (err) {
  // Check for different error types
  let errorMessage;
  if (err.code === 'ENOENT') {
    errorMessage = "Path not found";
  } else if (err.code === 'ELOOP') {
    errorMessage = "Symlink loop detected";
  } else if (err.code === 'EACCES') {
    errorMessage = "Permission denied";
  } else {
    errorMessage = "Invalid path";
  }

  return {
    content: [{ type: "text", text: JSON.stringify({
      error: errorMessage,
      skill_path: inputPath,
      details: err.message
    }) }]
  };
}
```

### Fix 2: Investigate path traversal validation

**File:** `src/tools/scan-skill.js`
**Lines:** 926-937

**Issue:** The path validation using `pathStartsWith()` may not be catching `../../etc` correctly

**Investigation needed:**
1. Test what `realpathSync(resolve('../../etc'))` returns
2. Verify `pathStartsWith()` logic on line 126-128
3. Check if the issue is platform-specific (macOS vs Linux vs Windows)

**Test case to add:**
```javascript
it('should reject relative path traversal', () => {
  const testPath = '../../etc';
  const resolved = resolve(testPath);
  const real = realpathSync(resolved);
  // Should not start with cwd
});
```

---

## 📋 Release Checklist (After Fixes)

Before releasing v3.18.0:

- [ ] Fix error message for ENOENT in scan-skill.js
- [ ] Fix path traversal validation
- [ ] Run full test suite: `npm test`
- [ ] Verify all 420+ tests pass
- [ ] Update CHANGELOG.md with v3.18.0 entry
- [ ] Update package.json version to 3.18.0
- [ ] Run `npm install` to update package-lock.json
- [ ] Create git tag: `git tag -a v3.18.0 -m "Release v3.18.0 - Semantic Code Analysis Layer"`
- [ ] Push to GitHub: `git push origin main && git push origin v3.18.0`
- [ ] Create GitHub release with notes from `docs/plans/2026-03-06-release-v3.18.0.md`
- [ ] Publish to npm: `npm publish`
- [ ] Verify installation: `npm install -g agent-security-scanner-mcp@3.18.0`

---

## 📊 Test Summary

**Total Tests:** 420+ across 32 files

**Passing:** 416+ tests (99%)
**Failing:** 4 tests (1%)

**Failure Breakdown:**
- ✅ Semantic analysis: 31/31 (100%) - NEW FEATURE
- ❌ Scan-skill path validation: 2 failures (pre-existing)
- ❌ Plugin integration: 1 failure (pre-existing)
- ❌ Worktree scan-skill: 1 failure (stale worktree)

---

## 🎯 Impact Assessment

**Release Impact:** LOW RISK
- New feature (semantic analysis) is fully tested and working
- Failures are in path validation (edge cases)
- Core scanning functionality unaffected
- Can release with known limitations documented

**Alternative:** Could release v3.18.0 with path validation tests skipped temporarily, documented as known issues to fix in v3.18.1

---

## 📝 Notes

1. The semantic analysis feature is production-ready
2. Path validation bugs existed before v3.18.0 work began
3. Bugs are in security-critical path validation code - should fix before release
4. Estimated time to fix: 1-2 hours of focused debugging
5. All work committed to `wip/v3.18.0-semantic-analysis` branch

---

## 🔗 Related Files

- Release plan: `docs/plans/2026-03-06-release-v3.18.0.md`
- Semantic docs: `docs/semantic-analysis.md`
- Implementation summary: `docs/plans/SEMANTIC_ANALYSIS_IMPLEMENTATION.md`
