164 lines
6.8 KiB
Markdown
164 lines
6.8 KiB
Markdown
# Security Patterns, Lightweight Monitors & Final 10% Synthesis
|
|
|
|
**Research Date:** 2026-03-01
|
|
**Repositories Analyzed:**
|
|
1. [tugcantopaloglu/openclaw-dashboard](https://github.com/tugcantopaloglu/openclaw-dashboard) — Security-hardened: TOTP MFA, PBKDF2, rate limiting, memory viewer, cron manager
|
|
2. [Temaki-AI/clawd-control](https://github.com/Temaki-AI/clawd-control) — Lightweight fleet monitor, auto-discovery, agent creation wizard
|
|
3. [spleck/claw-dashboard](https://github.com/spleck/claw-dashboard) — Terminal-style monitor, btop-inspired
|
|
4. [23blocks-OS/ai-maestro](https://github.com/23blocks-OS/ai-maestro) — Agent-to-agent messaging, AMP protocol, multi-machine mesh
|
|
|
|
---
|
|
|
|
## 1. Memory/File Viewer (openclaw-dashboard)
|
|
|
|
**How it works:** Reads workspace files directly from filesystem — MEMORY.md, HEARTBEAT.md, memory/YYYY-MM-DD.md. Two API endpoints: `GET /api/memory-files` (list) and `GET /api/memory-file?path=<path>` (read content). Frontend is a simple file browser + markdown viewer. Edits create `.bak` backup files automatically.
|
|
|
|
**Security:** Path traversal protection validates all paths stay within workspace root. Read-only by default; edit requires explicit action.
|
|
|
|
**Simplest implementation for Mosaic Stack:**
|
|
- NestJS controller with 2 endpoints (list files, read file)
|
|
- Path validation middleware (resolve path, check it starts with workspace root)
|
|
- Next.js page: left sidebar file tree + right panel markdown render
|
|
- Use `react-markdown` for rendering (already likely in deps)
|
|
- **Effort: 1-2h**
|
|
|
|
---
|
|
|
|
## 2. Cron Job Management UI (openclaw-dashboard)
|
|
|
|
**How it works:** Reads cron jobs from `$OPENCLAW_DIR/cron/jobs.json`. Three endpoints:
|
|
- `GET /api/crons` — list all jobs with status
|
|
- `POST /api/cron/:id/toggle` — enable/disable
|
|
- `POST /api/cron/:id/run` — manually trigger
|
|
|
|
Frontend: table with Name | Schedule | Status | Last Run | Actions columns. Toggle switches and "Run Now" buttons.
|
|
|
|
**For Mosaic Stack:** Could be a Settings sub-tab ("Automation"). Back-end reads from DB or config file. NestJS `@nestjs/schedule` already supports cron — just need UI visibility into what's scheduled.
|
|
|
|
**Effort: 2-3h**
|
|
|
|
---
|
|
|
|
## 3. Agent Creation Wizard (clawd-control)
|
|
|
|
**How it works:** Guided multi-step form at `create.html`. Agent config fields:
|
|
```json
|
|
{
|
|
"id": "my-agent",
|
|
"gatewayAgentId": "main",
|
|
"name": "My Agent",
|
|
"emoji": "🤖",
|
|
"host": "127.0.0.1",
|
|
"port": 18789,
|
|
"token": "YOUR_GATEWAY_TOKEN",
|
|
"workspace": "/path/to/agent/workspace"
|
|
}
|
|
```
|
|
|
|
Backend provisioning logic in `create-agent.mjs`. Auto-discovery via `discover.mjs` finds local agents automatically.
|
|
|
|
**For Mosaic Stack:** Already has agents table in DB. Add a "Create Agent" dialog/wizard with: name, type/model, emoji, connection details, workspace path. Multi-step or single form — single form is faster to build.
|
|
|
|
**Effort: 2-4h**
|
|
|
|
---
|
|
|
|
## 4. Fleet Overview UX (all dashboards)
|
|
|
|
**What good looks like:**
|
|
|
|
| Dashboard | Approach | Key Insight |
|
|
|-----------|----------|-------------|
|
|
| clawd-control | Grid of agent cards, single-screen | "See all agents at a glance with health indicators" |
|
|
| openclaw-dashboard | Sidebar + tabs, sparklines, heatmaps | Rich metrics: sessions, costs, rate limits |
|
|
| claw-dashboard | Terminal btop-style, 2s refresh | Lightweight, resource-efficient |
|
|
| ai-maestro | Tree view with auto-coloring | `project-backend-api` → 3-level tree |
|
|
|
|
**Key metrics that matter:**
|
|
- Status indicator (online/offline/error) — most important
|
|
- Last activity timestamp
|
|
- Active session count
|
|
- Token usage / cost
|
|
- CPU/RAM (if host-level monitoring)
|
|
- Error count (last 24h)
|
|
|
|
**Recommended for Mosaic Stack:** Card grid layout. Each card: emoji + name, colored status dot, last activity time, token count. Click to expand/detail. Add a "Recent Activity" feed below the grid.
|
|
|
|
**Effort: 3-4h**
|
|
|
|
---
|
|
|
|
## 5. AMP Protocol (ai-maestro)
|
|
|
|
**What it is:** Agent Messaging Protocol — email-like communication between agents. Priority levels, message types, cryptographic signatures, push notifications. Full spec at agentmessaging.org.
|
|
|
|
**Key concept:** "I was the human mailman between 35 agents. AMP removes the human bottleneck."
|
|
|
|
**Worth borrowing for Mosaic Stack:**
|
|
- Simple agent-to-agent message table in PostgreSQL (already have DB)
|
|
- Priority levels (low/normal/high)
|
|
- Message types (task/notification/query)
|
|
- Thread awareness (threadId field)
|
|
|
|
**NOT worth borrowing (yet):**
|
|
- Cryptographic signatures (overkill)
|
|
- Multi-machine mesh (premature)
|
|
- Full AMP protocol compliance (too complex)
|
|
|
|
**Simple alternative:** Add a `messages` table to Prisma schema with fromAgentId, toAgentId, type, priority, subject, body, threadId, readAt. Poll or WebSocket for delivery. **Effort: 4-8h**
|
|
|
|
---
|
|
|
|
## 6. Security Patterns Worth Adopting
|
|
|
|
**From openclaw-dashboard (already mature in Mosaic Stack):**
|
|
|
|
| Pattern | openclaw-dashboard | Mosaic Stack Status | Action |
|
|
|---------|-------------------|-------------------|--------|
|
|
| Password hashing | PBKDF2, 100k iterations | Better Auth handles this | ✅ Done |
|
|
| CSRF protection | N/A (session-based) | Better Auth CSRF | ✅ Done |
|
|
| RBAC | N/A | Full RBAC implemented | ✅ Done |
|
|
| Rate limiting | 5 fail → 15min lockout | Not implemented | Add NestJS throttler |
|
|
| TOTP MFA | Google Auth compatible | Not implemented | P2 — Better Auth plugin exists |
|
|
| Audit logging | All auth events logged | Not implemented | Add NestJS middleware |
|
|
| Security headers | HSTS, CSP, X-Frame | Partial | Add helmet middleware |
|
|
|
|
**Quick wins:**
|
|
- `@nestjs/throttler` for rate limiting (30min)
|
|
- `helmet` middleware for security headers (15min)
|
|
- Audit log table + middleware (1-2h)
|
|
|
|
---
|
|
|
|
## 7. Real-Time Updates Pattern
|
|
|
|
All four dashboards use real-time updates differently:
|
|
- openclaw-dashboard: SSE (`/api/live`)
|
|
- clawd-control: SSE
|
|
- claw-dashboard: Polling (2s interval)
|
|
- ai-maestro: WebSocket
|
|
|
|
**For Mosaic Stack:** Already has WebSocket for terminal. Use SSE for fleet status (simpler than WebSocket, one-directional is fine). Polling for non-critical pages.
|
|
|
|
---
|
|
|
|
## Feature Comparison Matrix
|
|
|
|
| Feature | openclaw-dash | clawd-control | claw-dash | ai-maestro | Mosaic Stack |
|
|
|---------|:---:|:---:|:---:|:---:|:---:|
|
|
| Session mgmt | ✅ | ✅ | ✅ | ✅ | ✅ |
|
|
| Memory viewer | ✅ | ❌ | ❌ | ✅ | ❌ |
|
|
| Cron mgmt | ✅ | ❌ | ❌ | ❌ | ❌ |
|
|
| Agent wizard | ❌ | ✅ | ❌ | ✅ | ❌ |
|
|
| Fleet overview | ✅ | ✅ | ❌ | ✅ | Partial |
|
|
| Multi-machine | ❌ | ❌ | ❌ | ✅ | ❌ |
|
|
| Agent messaging | ❌ | ❌ | ❌ | ✅ | ❌ |
|
|
| Rate limiting | ✅ | ✅ | ❌ | ❌ | ❌ |
|
|
| TOTP MFA | ✅ | ❌ | ❌ | ❌ | ❌ |
|
|
| Real-time | SSE | SSE | Poll | WS | WS (terminal) |
|
|
| Cost tracking | ✅ | ❌ | ❌ | ❌ | ✅ (usage) |
|
|
| Terminal UI | ❌ | ❌ | ✅ | ❌ | ✅ (xterm.js) |
|
|
| Kanban | ❌ | ❌ | ❌ | ✅ | ✅ |
|
|
| Auth | PBKDF2+MFA | Password | None | N/A | Better Auth |
|
|
| RBAC | ❌ | ❌ | ❌ | ❌ | ✅ |
|