fix(bootable+install): harden persistence script, setup-openclaw, install.sh + add SECURITY.md

- 3-create-persistence.ps1: chain dd && mkfs.ext4 with && (was ;, so dd
  failures still ran mkfs and produced bogus images); fix \wsl$\$wslDistro
  variable expansion ambiguity using \${wslDistro}; mirror docker-desktop
  branch with the same && chaining
- setup-openclaw.sh: guard mktemp failure; ensure partial node tarballs are
  cleaned via EXIT trap; tolerate hosts with no non-loopback NIC under
  pipefail; don't let test-installation.sh failure exit the post-install
- install.sh: add `set -o pipefail`; surface npm install failures (was
  hidden by `| tail -5`); JSON-escape user-provided API_KEY before writing
  to openclaw.json so keys with backslashes/quotes don't break the config
- Add SECURITY.md: private disclosure channel + scope

bootable/3-create-persistence.ps1

@@ -73,10 +73,17 @@ if ($wslDistro) {
     $sizeMB = $sizeGB * 1024
     $tmpFile = "/tmp/uclaw_persistence.dat"
 
-    wsl -d $wslDistro -- sh -c "rm -f $tmpFile; dd if=/dev/zero of=$tmpFile bs=1M count=0 seek=$sizeMB 2>/dev/null; mkfs.ext4 -F -L casper-rw $tmpFile 2>/dev/null; echo DONE"
+    # Chain with && so a failed dd aborts before mkfs; capture marker on success only.
+    $wslOutput = wsl -d $wslDistro -- sh -c "rm -f $tmpFile && dd if=/dev/zero of=$tmpFile bs=1M count=0 seek=$sizeMB 2>/dev/null && mkfs.ext4 -F -L casper-rw $tmpFile >/dev/null 2>&1 && echo DONE"
+    if ($wslOutput -notmatch "DONE") {
+        Write-Host "[ERROR] WSL failed to create/format ext4 image (dd or mkfs.ext4 returned non-zero)." -ForegroundColor Red
+        wsl -d $wslDistro -- rm -f $tmpFile 2>$null
+        Read-Host "Press Enter to exit"
+        exit 1
+    }
 
-    # Copy out via \\wsl$
-    $wslNetPath = "\\wsl$\$wslDistro\tmp\uclaw_persistence.dat"
+    # Copy out via \\wsl$ — use ${wslDistro} so PowerShell does not greedily extend the variable name into the path segment.
+    $wslNetPath = "\\wsl`$\${wslDistro}\tmp\uclaw_persistence.dat"
     if (Test-Path $wslNetPath) {
         Write-Host "[INFO] Copying from WSL to cache..." -ForegroundColor Yellow
         Copy-Item -Path $wslNetPath -Destination $PersistencePath -Force
@@ -132,15 +139,11 @@ if ($wslDistro) {
         Write-Host "[INFO] Found docker-desktop WSL with mkfs.ext4, creating ext4 image..." -ForegroundColor Green
         $tmpFile = "/tmp/uclaw_persistence.dat"
 
-        # Create sparse file and format in docker-desktop WSL
-        wsl -d $dockerWSL -- dd if=/dev/zero of=$tmpFile bs=1M count=0 seek=$sizeMB 2>$null
-        wsl -d $dockerWSL -- /sbin/mkfs.ext4 -F -L casper-rw $tmpFile 2>$null
+        # Create sparse file and format in docker-desktop WSL — chain with && so a dd failure aborts before mkfs/cp.
+        $dockerOutput = wsl -d $dockerWSL -- sh -c "rm -f $tmpFile && dd if=/dev/zero of=$tmpFile bs=1M count=0 seek=$sizeMB 2>/dev/null && /sbin/mkfs.ext4 -F -L casper-rw $tmpFile >/dev/null 2>&1 && cp $tmpFile /mnt/host/c/uclaw_persistence_tmp.dat && echo DONE"
 
-        # Copy out via /mnt/host/c/ (docker-desktop mounts C: there)
         $tmpHostPath = "C:\uclaw_persistence_tmp.dat"
-        wsl -d $dockerWSL -- cp $tmpFile /mnt/host/c/uclaw_persistence_tmp.dat 2>$null
-
-        if (Test-Path $tmpHostPath) {
+        if (($dockerOutput -match "DONE") -and (Test-Path $tmpHostPath)) {
             Move-Item -Path $tmpHostPath -Destination $PersistencePath -Force
             wsl -d $dockerWSL -- rm -f $tmpFile 2>$null
             $formatted = $true

bootable/linux-setup/setup-openclaw.sh

@@ -62,20 +62,29 @@ if [[ -x "$NODE_DIR/bin/node" ]]; then
 fi
 
 if [[ ! -x "$NODE_DIR/bin/node" ]]; then
-    TMPFILE=$(mktemp /tmp/node-XXXXXX.tar.xz)
-    # Try China mirror first, then official
+    if ! TMPFILE=$(mktemp /tmp/node-XXXXXX.tar.xz); then
+        echo "[ERROR] mktemp failed (cannot create temp file in /tmp). Disk full?"
+        exit 1
+    fi
+    # Ensure partial downloads are cleaned up no matter how the script exits.
+    trap 'rm -f "$TMPFILE"' EXIT
+
+    # Try China mirror first, then official. On failure, drop the partial file before retrying.
     if curl -fSL --connect-timeout 10 -o "$TMPFILE" "${NODE_MIRROR}/${NODE_VERSION}/${NODE_ARCHIVE}" 2>/dev/null; then
         echo "      Downloaded from China mirror."
-    elif curl -fSL --connect-timeout 10 -o "$TMPFILE" "${NODE_OFFICIAL}/${NODE_VERSION}/${NODE_ARCHIVE}" 2>/dev/null; then
-        echo "      Downloaded from official mirror."
     else
-        echo "[ERROR] Failed to download Node.js. Please check your network."
         rm -f "$TMPFILE"
-        exit 1
+        if curl -fSL --connect-timeout 10 -o "$TMPFILE" "${NODE_OFFICIAL}/${NODE_VERSION}/${NODE_ARCHIVE}" 2>/dev/null; then
+            echo "      Downloaded from official mirror."
+        else
+            echo "[ERROR] Failed to download Node.js. Please check your network."
+            exit 1
+        fi
     fi
     mkdir -p "$NODE_DIR"
     tar -xJf "$TMPFILE" --strip-components=1 -C "$NODE_DIR"
     rm -f "$TMPFILE"
+    trap - EXIT
     echo "      Node.js extracted to $NODE_DIR"
 fi
 
@@ -196,7 +205,10 @@ if [[ "$INSTALL_SSH" =~ ^[Yy]$ ]]; then
     echo ""
     echo "      Set a password for SSH login (user: $REAL_USER):"
     passwd "$REAL_USER"
-    LOCAL_IP=$(ip -4 addr show | grep -oP '(?<=inet\s)(?!127\.)\d+\.\d+\.\d+\.\d+' | head -1)
+    # `set -o pipefail` makes the pipeline fail when grep finds no match, which would abort the whole script
+    # on a host with no non-loopback NIC. Tolerate that case and just leave LOCAL_IP empty.
+    LOCAL_IP=$(ip -4 addr show 2>/dev/null | grep -oP '(?<=inet\s)(?!127\.)\d+\.\d+\.\d+\.\d+' | head -1 || true)
+    [[ -z "$LOCAL_IP" ]] && LOCAL_IP="<your-ip>"
     echo ""
     echo "      SSH enabled! Connect from another computer:"
     echo "      ssh ${REAL_USER}@${LOCAL_IP}"
@@ -226,10 +238,10 @@ if [[ -f "$SCRIPT_DIR/test-installation.sh" ]]; then
     echo ""
 fi
 
-# 运行快速测试
+# 运行快速测试 — 主流程已 `set -o pipefail`,test 脚本失败不应让整个 setup 退出 (我们已经走完安装).
 echo "Running quick installation test..."
 if [[ -f "$SCRIPT_DIR/test-installation.sh" ]]; then
-    bash "$SCRIPT_DIR/test-installation.sh" | tail -20
+    bash "$SCRIPT_DIR/test-installation.sh" 2>&1 | tail -20 || true
 fi
 echo "  First time? Configure your AI model in the browser after startup."
 echo "============================================"