@agenshield/sandbox 0.7.0 → 0.7.2

package/discovery/index.d.ts

@@ -3,5 +3,5 @@
  */
 export { scanDiscovery } from './scanner';
 export { scanBinaries, classifyDirectory, detectNpmGlobalBin, detectYarnGlobalBin, getProtection, isShieldExecLink, categorize, } from './binary-scanner';
-export { scanSkills, parseSkillMd, extractCommands, extractSkillInfo, getApprovalStatus, } from './skill-scanner';
+export { scanSkills, parseSkillMd, extractCommands, extractSkillInfo, getApprovalStatus, stripEnvFromSkillMd, } from './skill-scanner';
 //# sourceMappingURL=index.d.ts.map

package/discovery/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/discovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/discovery/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,aAAa,EACb,gBAAgB,EAChB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,UAAU,EACV,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,iBAAiB,CAAC"}

package/discovery/skill-scanner.d.ts

@@ -28,4 +28,12 @@ export declare function getApprovalStatus(skillName: string): 'approved' | 'quar
  * Scan the skills directory and return discovered skills
  */
 export declare function scanSkills(options: DiscoveryOptions, binaryLookup: Map<string, DiscoveredBinary>): DiscoveredSkill[];
+/**
+ * Strip env-related fields from SKILL.md frontmatter.
+ *
+ * OpenClaw reads `requires.env` / `metadata.openclaw.requires.env` / `metadata.openclaw.primaryEnv`
+ * from SKILL.md and prompts the user for those env vars. AgenShield handles secrets via its own
+ * vault/broker, so we strip these fields before writing to the agent's skill directory.
+ */
+export declare function stripEnvFromSkillMd(content: string): string;
 //# sourceMappingURL=skill-scanner.d.ts.map

package/discovery/skill-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-scanner.d.ts","sourceRoot":"","sources":["../../src/discovery/skill-scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EACV,aAAa,EACb,kBAAkB,EAClB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,iBAAiB,CAAC;AAkCzB;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,GAAG,kBAAkB,CAUnF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkB9F;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,aAAa,GAAG,IAAI,EAC9B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC1C,uBAAuB,EAAE,CAiE3B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,GAChB,UAAU,GAAG,aAAa,GAAG,SAAS,CAyBxC;AAED;;GAEG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,gBAAgB,EACzB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC1C,eAAe,EAAE,CAiGnB"}
+{"version":3,"file":"skill-scanner.d.ts","sourceRoot":"","sources":["../../src/discovery/skill-scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,KAAK,EACV,aAAa,EAEb,kBAAkB,EAClB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,gBAAgB,EACjB,MAAM,iBAAiB,CAAC;AAkCzB;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,GAAG,kBAAkB,CAWnF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAkB9F;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,aAAa,GAAG,IAAI,EAC9B,IAAI,EAAE,MAAM,EACZ,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC1C,uBAAuB,EAAE,CAiE3B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,GAChB,UAAU,GAAG,aAAa,GAAG,SAAS,CAyBxC;AAED;;GAEG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,gBAAgB,EACzB,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,gBAAgB,CAAC,GAC1C,eAAe,EAAE,CAiGnB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAuB3D"}

package/index.d.ts

@@ -23,6 +23,6 @@ export { WRAPPERS, WRAPPER_DEFINITIONS, installWrapper, installWrappers, install
 export { generateAgentProfile, generateOperationProfile, installProfiles, installSeatbeltProfiles, verifyProfile, getInstalledProfiles, type ProfileResult, } from './seatbelt';
 export { generateBrokerPlist, generateBrokerPlistLegacy, installLaunchDaemon, loadLaunchDaemon, unloadLaunchDaemon, uninstallLaunchDaemon, isDaemonRunning, getDaemonStatus, restartDaemon, fixSocketPermissions, type DaemonResult, } from './launchdaemon';
 export { getPreset, listPresets, listAutoDetectablePresets, autoDetectPreset, formatPresetList, openclawPreset, devHarnessPreset, customPreset, PRESETS, type TargetPreset, type PresetDetectionResult, type MigrationContext, type MigrationDirectories, type PresetMigrationResult, } from './presets';
-export { scanDiscovery, scanBinaries, scanSkills, parseSkillMd, extractSkillInfo, classifyDirectory, } from './discovery';
+export { scanDiscovery, scanBinaries, scanSkills, parseSkillMd, extractSkillInfo, classifyDirectory, stripEnvFromSkillMd, } from './discovery';
 export { injectAgenCoSkill, createAgenCoSymlink, removeInjectedSkills, updateOpenClawMcpConfig, getSkillsDir, getAgenCoSkillPath, type SkillInjectionResult, } from './skill-injector';
 //# sourceMappingURL=index.d.ts.map

package/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,kBAAkB,IAAI,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAG7H,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,YAAY,EACZ,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,KAAK,YAAY,GAClB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,cAAc,aAAa,CAAC;AAG5B,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAGxB,cAAc,YAAY,CAAC;AAG3B,cAAc,UAAU,CAAC;AAGzB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAG1B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,mBAAmB,EAExB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAEL,SAAS,EACT,WAAW,EACX,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAEhB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,OAAO,EAEP,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAMrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,EAClB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,kBAAkB,IAAI,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAG7H,cAAc,iBAAiB,CAAC;AAGhC,OAAO,EACL,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,YAAY,EACZ,WAAW,EACX,uBAAuB,EACvB,WAAW,EACX,UAAU,EACV,WAAW,EACX,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,UAAU,EACV,KAAK,YAAY,GAClB,MAAM,SAAS,CAAC;AAGjB,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAC;AAGvB,cAAc,aAAa,CAAC;AAG5B,OAAO,EACL,QAAQ,EACR,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,eAAe,EACf,kBAAkB,EAClB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AAGxB,cAAc,YAAY,CAAC;AAG3B,cAAc,UAAU,CAAC;AAGzB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAG1B,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAGvB,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,cAAc,EACd,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,KAAK,gBAAgB,EACrB,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,KAAK,mBAAmB,EAExB,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,EACpB,aAAa,EACb,KAAK,aAAa,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,eAAe,EACf,uBAAuB,EACvB,aAAa,EACb,oBAAoB,EACpB,KAAK,aAAa,GACnB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,mBAAmB,EACnB,yBAAyB,EACzB,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,qBAAqB,EACrB,eAAe,EACf,eAAe,EACf,aAAa,EACb,oBAAoB,EACpB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAEL,SAAS,EACT,WAAW,EACX,yBAAyB,EACzB,gBAAgB,EAChB,gBAAgB,EAEhB,cAAc,EACd,gBAAgB,EAChB,YAAY,EACZ,OAAO,EAEP,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,GAC3B,MAAM,WAAW,CAAC;AAGnB,OAAO,EACL,aAAa,EACb,YAAY,EACZ,UAAU,EACV,YAAY,EACZ,gBAAgB,EAChB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAMrB,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,oBAAoB,EACpB,uBAAuB,EACvB,YAAY,EACZ,kBAAkB,EAClB,KAAK,oBAAoB,GAC1B,MAAM,kBAAkB,CAAC"}

package/index.js

@@ -2755,7 +2755,8 @@ var VaultContentsSchema = z7.object({
   agenco: AgenCoSecretsSchema.optional(),
   envSecrets: z7.record(z7.string(), z7.string()),
   sensitivePatterns: z7.array(z7.string()),
-  passcode: PasscodeDataSchema.optional()
+  passcode: PasscodeDataSchema.optional(),
+  installationKey: z7.string().optional()
 });
 var COMMAND_CATALOG = {
   // ── Network ────────────────────────────────────────────────
@@ -6222,7 +6223,7 @@ function scanBinaries(options) {
 // libs/shield-sandbox/src/discovery/skill-scanner.ts
 import * as fs16 from "node:fs";
 import * as path13 from "node:path";
-import { parse as parseYaml } from "yaml";
+import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 
 // libs/shield-sandbox/src/skill-injector.ts
 import * as fs15 from "node:fs";
@@ -6489,13 +6490,14 @@ function unique(value, index, self) {
 }
 function extractSkillInfo(metadata) {
   const topReq = metadata?.requires;
-  const oclReq = metadata?.metadata?.openclaw?.requires;
+  const oclMeta = metadata?.metadata?.openclaw ?? metadata?.metadata?.clawdbot;
+  const oclReq = oclMeta?.requires;
   return {
     apiKeys: [...topReq?.env ?? [], ...oclReq?.env ?? []].filter(unique),
     bins: [...topReq?.bins ?? [], ...oclReq?.bins ?? []].filter(unique),
     anyBins: [...topReq?.anyBins ?? [], ...oclReq?.anyBins ?? []].filter(unique),
     configOptions: [...topReq?.config ?? [], ...oclReq?.config ?? []].filter(unique),
-    installSteps: metadata?.metadata?.openclaw?.install
+    installSteps: oclMeta?.install
   };
 }
 function parseSkillMd(content) {
@@ -6670,6 +6672,25 @@ function scanSkills(options, binaryLookup) {
   }
   return results.sort((a, b) => a.name.localeCompare(b.name));
 }
+function stripEnvFromSkillMd(content) {
+  const match = content.match(/^---\s*\n([\s\S]*?)\n---\s*\n?([\s\S]*)$/);
+  if (!match) return content;
+  try {
+    const metadata = parseYaml(match[1]);
+    if (!metadata || typeof metadata !== "object") return content;
+    if (metadata.requires?.env) delete metadata.requires.env;
+    if (metadata.metadata?.openclaw?.requires?.env) delete metadata.metadata.openclaw.requires.env;
+    if (metadata.metadata?.openclaw?.primaryEnv) delete metadata.metadata.openclaw.primaryEnv;
+    if (metadata.metadata?.clawdbot?.requires?.env) delete metadata.metadata.clawdbot.requires.env;
+    if (metadata.metadata?.clawdbot?.primaryEnv) delete metadata.metadata.clawdbot.primaryEnv;
+    return `---
+${stringifyYaml(metadata).trimEnd()}
+---
+${match[2]}`;
+  } catch {
+    return content;
+  }
+}
 
 // libs/shield-sandbox/src/discovery/scanner.ts
 function computeSummary(binaries, directories, skills) {
@@ -6838,6 +6859,7 @@ export {
   scanSkills,
   seedConfigFiles,
   setupSocketDirectory,
+  stripEnvFromSkillMd,
   uninstallLaunchDaemon,
   uninstallWrapper,
   uninstallWrappers,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenshield/sandbox",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "type": "module",
   "description": "User isolation and sandboxing utilities for AgenShield",
   "main": "./index.js",
@@ -15,7 +15,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@agenshield/skills": "0.7.0",
+    "@agenshield/skills": "0.7.2",
     "yaml": "^2.7.1"
   },
   "devDependencies": {