@alfe.ai/openclaw-identity 0.0.3 → 0.0.5

package/dist/plugin.cjs

@@ -1,4 +1,5 @@
 let _alfe_ai_config = require("@alfe.ai/config");
+let _alfe_ai_agent_api_client = require("@alfe.ai/agent-api-client");
 let _sinclair_typebox = require("@sinclair/typebox");
 //#region src/plugin.ts
 /**
@@ -12,27 +13,9 @@ let _sinclair_typebox = require("@sinclair/typebox");
 *   - before_tool_call  → enforce permissions from cached policy
 *   - after_tool_call   → log tool execution audit
 *
-* All data access via HTTP to the Identity service internal API.
+* All data access via AgentApiClient (/agent/identity/* routes).
 * Uses the agent's own API key (from ~/.alfe/config.toml) for authentication.
 */
-function createHttpClient(apiUrl, apiKey) {
-	async function request(method, path, body) {
-		const res = await fetch(`${apiUrl}${path}`, {
-			method,
-			headers: {
-				Authorization: `Bearer ${apiKey}`,
-				"Content-Type": "application/json"
-			},
-			...body ? { body: JSON.stringify(body) } : {}
-		});
-		if (!res.ok) {
-			const text = await res.text().catch(() => "");
-			throw new Error(`Identity API ${method} ${path}: ${String(res.status)} ${text}`);
-		}
-		return (await res.json()).data;
-	}
-	return { request };
-}
 const CACHE_TTL_MS = 6e4;
 const sessionCache = /* @__PURE__ */ new Map();
 function getCached(key) {
@@ -90,18 +73,27 @@ const plugin = {
 	version: "0.0.1",
 	activate(api) {
 		const log = api.logger;
+		if (api.registrationMode && api.registrationMode !== "full") return;
 		log.info("Alfe Identity plugin activating...");
-		let apiUrl;
-		let apiKey;
+		let client;
 		try {
 			const config = (0, _alfe_ai_config.resolveConfig)();
-			apiUrl = config.apiUrl;
-			apiKey = config.apiKey;
+			client = new _alfe_ai_agent_api_client.AgentApiClient({
+				apiKey: config.apiKey,
+				apiUrl: config.apiUrl
+			});
 		} catch (err) {
 			log.error(`Identity plugin: failed to resolve config — ${err instanceof Error ? err.message : String(err)}`);
 			return;
 		}
-		const http = createHttpClient(apiUrl, apiKey);
+		let failureMode = "open";
+		client.getIntegrationConfig("alfe").then((alfeConfig) => {
+			const mode = alfeConfig.config.identity_failure_mode;
+			if (mode === "open" || mode === "closed" || mode === "permissive") failureMode = mode;
+			log.info(`Identity failure mode: ${failureMode}`);
+		}).catch(() => {
+			log.info(`Identity failure mode: ${failureMode} (default — config fetch failed)`);
+		});
 		const identityToolNames = /* @__PURE__ */ new Set();
 		const tools = [
 			defineTool({
@@ -109,54 +101,45 @@ const plugin = {
 				description: "Look up full identity context by platform and ID — returns profile, notes, tags, platforms, and recent changelog",
 				parameters: _sinclair_typebox.Type.Object({
 					platform: _sinclair_typebox.Type.String({ description: "Platform name (discord, slack, chat, sms, whatsapp, etc.)" }),
-					platformId: _sinclair_typebox.Type.String({ description: "Platform-specific user identifier" }),
-					tenantId: _sinclair_typebox.Type.String()
+					platformId: _sinclair_typebox.Type.String({ description: "Platform-specific user identifier" })
 				}),
 				handler: async (params) => {
-					const result = await http.request("POST", "/internal/identity/resolve", {
+					const result = await client.resolveIdentity({
 						platform: params.platform,
-						platformId: params.platformId,
-						tenantId: params.tenantId,
-						agentId: "plugin"
+						platformId: params.platformId
 					});
 					if (!result.identityId) return { found: false };
-					return http.request("GET", `/internal/identity/${encodeURIComponent(result.identityId)}/context?tenantId=${encodeURIComponent(params.tenantId)}`);
+					return client.getIdentityContext(result.identityId);
 				}
 			}),
 			defineTool({
 				name: "lookup_identity",
 				description: "Search identities by name, email, phone, tag, or platform. Returns multiple matches.",
 				parameters: _sinclair_typebox.Type.Object({
-					tenantId: _sinclair_typebox.Type.String(),
 					query: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "Text search query" })),
 					status: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String()),
 					tag: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String()),
 					platform: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String())
 				}),
-				handler: async (params) => {
-					const qs = new URLSearchParams({ tenantId: params.tenantId });
-					if (params.query) qs.set("q", params.query);
-					if (params.status) qs.set("status", params.status);
-					if (params.tag) qs.set("tag", params.tag);
-					if (params.platform) qs.set("platform", params.platform);
-					return http.request("GET", `/internal/identity/search?${qs.toString()}`);
-				}
+				handler: (params) => client.searchIdentities({
+					q: params.query,
+					status: params.status,
+					tag: params.tag,
+					platform: params.platform
+				})
 			}),
 			defineTool({
 				name: "create_identity",
 				description: "Create a new identity record with profile fields",
 				parameters: _sinclair_typebox.Type.Object({
-					tenantId: _sinclair_typebox.Type.String(),
 					platform: _sinclair_typebox.Type.String(),
 					platformId: _sinclair_typebox.Type.String(),
 					displayName: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String())
 				}),
-				handler: (params) => http.request("POST", "/internal/identity/resolve", {
+				handler: (params) => client.resolveIdentity({
 					platform: params.platform,
 					platformId: params.platformId,
-					displayName: params.displayName,
-					tenantId: params.tenantId,
-					agentId: "plugin"
+					displayName: params.displayName
 				})
 			}),
 			defineTool({
@@ -164,11 +147,9 @@ const plugin = {
 				description: "Merge two identity records — transfers notes, tags, aliases, platforms to survivor",
 				parameters: _sinclair_typebox.Type.Object({
 					survivorId: _sinclair_typebox.Type.String({ description: "Identity to keep" }),
-					mergedId: _sinclair_typebox.Type.String({ description: "Identity to merge into survivor" }),
-					tenantId: _sinclair_typebox.Type.String()
+					mergedId: _sinclair_typebox.Type.String({ description: "Identity to merge into survivor" })
 				}),
-				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.survivorId)}/merge`, {
-					tenantId: params.tenantId,
+				handler: (params) => client.mergeIdentities(params.survivorId, {
 					mergedId: params.mergedId,
 					changedBy: {
 						type: "agent",
@@ -179,17 +160,11 @@ const plugin = {
 			defineTool({
 				name: "unmerge_identities",
 				description: "Reverse a merge — restore previously merged identity",
-				parameters: _sinclair_typebox.Type.Object({
-					mergedId: _sinclair_typebox.Type.String({ description: "Identity that was merged (has mergedInto pointer)" }),
-					tenantId: _sinclair_typebox.Type.String()
-				}),
-				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.mergedId)}/unmerge`, {
-					tenantId: params.tenantId,
-					changedBy: {
-						type: "agent",
-						id: "plugin"
-					}
-				})
+				parameters: _sinclair_typebox.Type.Object({ mergedId: _sinclair_typebox.Type.String({ description: "Identity that was merged (has mergedInto pointer)" }) }),
+				handler: (params) => client.unmergeIdentity(params.mergedId, { changedBy: {
+					type: "agent",
+					id: "plugin"
+				} })
 			}),
 			defineTool({
 				name: "link_platform",
@@ -197,14 +172,11 @@ const plugin = {
 				parameters: _sinclair_typebox.Type.Object({
 					identityId: _sinclair_typebox.Type.String(),
 					platform: _sinclair_typebox.Type.String(),
-					platformId: _sinclair_typebox.Type.String(),
-					tenantId: _sinclair_typebox.Type.String()
+					platformId: _sinclair_typebox.Type.String()
 				}),
-				handler: (params) => http.request("POST", "/internal/identity/resolve", {
+				handler: (params) => client.resolveIdentity({
 					platform: params.platform,
-					platformId: params.platformId,
-					tenantId: params.tenantId,
-					agentId: "plugin"
+					platformId: params.platformId
 				})
 			}),
 			defineTool({
@@ -212,12 +184,10 @@ const plugin = {
 				description: "Add an observation or note about a contact",
 				parameters: _sinclair_typebox.Type.Object({
 					identityId: _sinclair_typebox.Type.String(),
-					tenantId: _sinclair_typebox.Type.String(),
 					content: _sinclair_typebox.Type.String(),
 					category: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "observation, preference, relationship, context, or warning" }))
 				}),
-				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.identityId)}/notes`, {
-					tenantId: params.tenantId,
+				handler: (params) => client.addIdentityNote(params.identityId, {
 					content: params.content,
 					category: params.category,
 					changedBy: {
@@ -231,12 +201,10 @@ const plugin = {
 				description: "Add or remove a tag on an identity",
 				parameters: _sinclair_typebox.Type.Object({
 					identityId: _sinclair_typebox.Type.String(),
-					tenantId: _sinclair_typebox.Type.String(),
 					tag: _sinclair_typebox.Type.String(),
 					action: _sinclair_typebox.Type.String({ description: "'add' or 'remove'" })
 				}),
-				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.identityId)}/tags`, {
-					tenantId: params.tenantId,
+				handler: (params) => client.tagIdentity(params.identityId, {
 					tag: params.tag,
 					action: params.action,
 					changedBy: {
@@ -250,25 +218,18 @@ const plugin = {
 				description: "Get full changelog for an identity — all versions, diffs, who changed what",
 				parameters: _sinclair_typebox.Type.Object({
 					identityId: _sinclair_typebox.Type.String(),
-					tenantId: _sinclair_typebox.Type.String(),
 					limit: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.Number())
 				}),
-				handler: async (params) => {
-					const qs = new URLSearchParams({ tenantId: params.tenantId });
-					if (params.limit) qs.set("limit", String(Number(params.limit)));
-					return http.request("GET", `/internal/identity/${encodeURIComponent(params.identityId)}/changelog?${qs.toString()}`);
-				}
+				handler: (params) => client.getIdentityChangelog(params.identityId, { limit: params.limit })
 			}),
 			defineTool({
 				name: "rollback_identity",
 				description: "Revert an identity to a previous version",
 				parameters: _sinclair_typebox.Type.Object({
 					identityId: _sinclair_typebox.Type.String(),
-					tenantId: _sinclair_typebox.Type.String(),
 					targetVersion: _sinclair_typebox.Type.Number()
 				}),
-				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.identityId)}/rollback`, {
-					tenantId: params.tenantId,
+				handler: (params) => client.rollbackIdentity(params.identityId, {
 					targetVersion: params.targetVersion,
 					changedBy: {
 						type: "agent",
@@ -282,14 +243,12 @@ const plugin = {
 				parameters: _sinclair_typebox.Type.Object({
 					platform: _sinclair_typebox.Type.String(),
 					senderId: _sinclair_typebox.Type.String(),
-					channelId: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String()),
-					tenantId: _sinclair_typebox.Type.String()
+					channelId: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String())
 				}),
-				handler: (params) => http.request("POST", "/internal/identity/enforce", {
+				handler: (params) => client.enforcePolicy({
 					platform: params.platform,
 					senderId: params.senderId,
-					channelId: params.channelId,
-					tenantId: params.tenantId
+					channelId: params.channelId
 				})
 			}),
 			defineTool({
@@ -298,14 +257,12 @@ const plugin = {
 				parameters: _sinclair_typebox.Type.Object({
 					platform: _sinclair_typebox.Type.String(),
 					senderId: _sinclair_typebox.Type.String(),
-					toolName: _sinclair_typebox.Type.String(),
-					tenantId: _sinclair_typebox.Type.String()
+					toolName: _sinclair_typebox.Type.String()
 				}),
-				handler: (params) => http.request("POST", "/internal/identity/check-tool", {
+				handler: (params) => client.checkToolPermission({
 					platform: params.platform,
 					senderId: params.senderId,
-					toolName: params.toolName,
-					tenantId: params.tenantId
+					toolName: params.toolName
 				})
 			})
 		];
@@ -330,19 +287,14 @@ const plugin = {
 				return;
 			}
 			try {
-				const tenantId = ctx.tenantId ?? "";
-				const agentId = ctx.agentId ?? "";
-				const resolveResult = await http.request("POST", "/internal/identity/resolve", {
+				const resolveResult = await client.resolveIdentity({
 					platform,
-					platformId: senderId,
-					tenantId,
-					agentId
+					platformId: senderId
 				});
 				setCached(cacheKey, {
-					...await http.request("POST", "/internal/identity/enforce", {
+					...await client.enforcePolicy({
 						platform,
-						senderId,
-						tenantId
+						senderId
 					}),
 					accessAllowed: resolveResult.accessAllowed
 				});
@@ -353,6 +305,10 @@ const plugin = {
 				log.info(`Identity resolved: ${senderId} → ${resolveResult.identityId ?? "unknown"} (${resolveResult.status})`);
 			} catch (e) {
 				log.error(`Identity resolution failed for ${senderId}: ${e.message}`);
+				if (failureMode === "closed") return {
+					block: true,
+					blockReason: "Identity: identity service unavailable — access denied (closed mode)"
+				};
 			}
 		}, { priority: 100 });
 		api.on("before_tool_call", async (...args) => {
@@ -362,14 +318,20 @@ const plugin = {
 			const sessionKey = ctx.sessionKey;
 			if (!sessionKey) return;
 			const perms = getCached(sessionKey);
-			if (!perms) return {
-				block: true,
-				blockReason: "Identity: no identity context established — tool access denied"
-			};
-			if (!perms.identified) return {
-				block: true,
-				blockReason: "Identity: unknown sender identity — tool access denied"
-			};
+			if (!perms) {
+				if (failureMode === "permissive") return;
+				return {
+					block: true,
+					blockReason: "Identity: no identity context established — tool access denied"
+				};
+			}
+			if (!perms.identified) {
+				if (failureMode === "permissive") return;
+				return {
+					block: true,
+					blockReason: "Identity: unknown sender identity — tool access denied"
+				};
+			}
 			if (perms.deniedTools.includes("*") || perms.deniedTools.includes(event.toolName)) return {
 				block: true,
 				blockReason: `Identity: tool '${event.toolName}' is denied for your role`
@@ -381,17 +343,15 @@ const plugin = {
 		}, { priority: 100 });
 		api.on("after_tool_call", async (...args) => {
 			const event = args[0];
-			const ctx = args[1];
-			const sessionKey = ctx.sessionKey;
+			const sessionKey = args[1].sessionKey;
 			if (!sessionKey) return;
 			const perms = getCached(sessionKey);
 			if (!perms?.identityId) return;
 			try {
-				await http.request("POST", "/internal/identity/check-tool", {
+				await client.checkToolPermission({
 					platform: "tool_audit",
 					senderId: perms.identityId,
-					toolName: event.toolName,
-					tenantId: ctx.tenantId ?? ""
+					toolName: event.toolName
 				});
 			} catch (e) {
 				log.error(`Audit logging failed: ${e.message}`);

package/dist/plugin.d.cts

@@ -23,6 +23,7 @@ interface ToolDef {
 }
 interface PluginApi {
   logger: PluginLogger;
+  registrationMode?: "full" | "setup-only" | "setup-runtime" | "cli-metadata";
   registerTool: (tool: ToolDef) => void;
   on: (event: string, handler: (...args: unknown[]) => Promise<unknown>, options?: {
     priority?: number;

package/dist/plugin.d.ts

@@ -23,6 +23,7 @@ interface ToolDef {
 }
 interface PluginApi {
   logger: PluginLogger;
+  registrationMode?: "full" | "setup-only" | "setup-runtime" | "cli-metadata";
   registerTool: (tool: ToolDef) => void;
   on: (event: string, handler: (...args: unknown[]) => Promise<unknown>, options?: {
     priority?: number;

package/dist/plugin.js

@@ -1,4 +1,5 @@
 import { resolveConfig } from "@alfe.ai/config";
+import { AgentApiClient } from "@alfe.ai/agent-api-client";
 import { Type } from "@sinclair/typebox";
 //#region src/plugin.ts
 /**
@@ -12,27 +13,9 @@ import { Type } from "@sinclair/typebox";
 *   - before_tool_call  → enforce permissions from cached policy
 *   - after_tool_call   → log tool execution audit
 *
-* All data access via HTTP to the Identity service internal API.
+* All data access via AgentApiClient (/agent/identity/* routes).
 * Uses the agent's own API key (from ~/.alfe/config.toml) for authentication.
 */
-function createHttpClient(apiUrl, apiKey) {
-	async function request(method, path, body) {
-		const res = await fetch(`${apiUrl}${path}`, {
-			method,
-			headers: {
-				Authorization: `Bearer ${apiKey}`,
-				"Content-Type": "application/json"
-			},
-			...body ? { body: JSON.stringify(body) } : {}
-		});
-		if (!res.ok) {
-			const text = await res.text().catch(() => "");
-			throw new Error(`Identity API ${method} ${path}: ${String(res.status)} ${text}`);
-		}
-		return (await res.json()).data;
-	}
-	return { request };
-}
 const CACHE_TTL_MS = 6e4;
 const sessionCache = /* @__PURE__ */ new Map();
 function getCached(key) {
@@ -90,18 +73,27 @@ const plugin = {
 	version: "0.0.1",
 	activate(api) {
 		const log = api.logger;
+		if (api.registrationMode && api.registrationMode !== "full") return;
 		log.info("Alfe Identity plugin activating...");
-		let apiUrl;
-		let apiKey;
+		let client;
 		try {
 			const config = resolveConfig();
-			apiUrl = config.apiUrl;
-			apiKey = config.apiKey;
+			client = new AgentApiClient({
+				apiKey: config.apiKey,
+				apiUrl: config.apiUrl
+			});
 		} catch (err) {
 			log.error(`Identity plugin: failed to resolve config — ${err instanceof Error ? err.message : String(err)}`);
 			return;
 		}
-		const http = createHttpClient(apiUrl, apiKey);
+		let failureMode = "open";
+		client.getIntegrationConfig("alfe").then((alfeConfig) => {
+			const mode = alfeConfig.config.identity_failure_mode;
+			if (mode === "open" || mode === "closed" || mode === "permissive") failureMode = mode;
+			log.info(`Identity failure mode: ${failureMode}`);
+		}).catch(() => {
+			log.info(`Identity failure mode: ${failureMode} (default — config fetch failed)`);
+		});
 		const identityToolNames = /* @__PURE__ */ new Set();
 		const tools = [
 			defineTool({
@@ -109,54 +101,45 @@ const plugin = {
 				description: "Look up full identity context by platform and ID — returns profile, notes, tags, platforms, and recent changelog",
 				parameters: Type.Object({
 					platform: Type.String({ description: "Platform name (discord, slack, chat, sms, whatsapp, etc.)" }),
-					platformId: Type.String({ description: "Platform-specific user identifier" }),
-					tenantId: Type.String()
+					platformId: Type.String({ description: "Platform-specific user identifier" })
 				}),
 				handler: async (params) => {
-					const result = await http.request("POST", "/internal/identity/resolve", {
+					const result = await client.resolveIdentity({
 						platform: params.platform,
-						platformId: params.platformId,
-						tenantId: params.tenantId,
-						agentId: "plugin"
+						platformId: params.platformId
 					});
 					if (!result.identityId) return { found: false };
-					return http.request("GET", `/internal/identity/${encodeURIComponent(result.identityId)}/context?tenantId=${encodeURIComponent(params.tenantId)}`);
+					return client.getIdentityContext(result.identityId);
 				}
 			}),
 			defineTool({
 				name: "lookup_identity",
 				description: "Search identities by name, email, phone, tag, or platform. Returns multiple matches.",
 				parameters: Type.Object({
-					tenantId: Type.String(),
 					query: Type.Optional(Type.String({ description: "Text search query" })),
 					status: Type.Optional(Type.String()),
 					tag: Type.Optional(Type.String()),
 					platform: Type.Optional(Type.String())
 				}),
-				handler: async (params) => {
-					const qs = new URLSearchParams({ tenantId: params.tenantId });
-					if (params.query) qs.set("q", params.query);
-					if (params.status) qs.set("status", params.status);
-					if (params.tag) qs.set("tag", params.tag);
-					if (params.platform) qs.set("platform", params.platform);
-					return http.request("GET", `/internal/identity/search?${qs.toString()}`);
-				}
+				handler: (params) => client.searchIdentities({
+					q: params.query,
+					status: params.status,
+					tag: params.tag,
+					platform: params.platform
+				})
 			}),
 			defineTool({
 				name: "create_identity",
 				description: "Create a new identity record with profile fields",
 				parameters: Type.Object({
-					tenantId: Type.String(),
 					platform: Type.String(),
 					platformId: Type.String(),
 					displayName: Type.Optional(Type.String())
 				}),
-				handler: (params) => http.request("POST", "/internal/identity/resolve", {
+				handler: (params) => client.resolveIdentity({
 					platform: params.platform,
 					platformId: params.platformId,
-					displayName: params.displayName,
-					tenantId: params.tenantId,
-					agentId: "plugin"
+					displayName: params.displayName
 				})
 			}),
 			defineTool({
@@ -164,11 +147,9 @@ const plugin = {
 				description: "Merge two identity records — transfers notes, tags, aliases, platforms to survivor",
 				parameters: Type.Object({
 					survivorId: Type.String({ description: "Identity to keep" }),
-					mergedId: Type.String({ description: "Identity to merge into survivor" }),
-					tenantId: Type.String()
+					mergedId: Type.String({ description: "Identity to merge into survivor" })
 				}),
-				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.survivorId)}/merge`, {
-					tenantId: params.tenantId,
+				handler: (params) => client.mergeIdentities(params.survivorId, {
 					mergedId: params.mergedId,
 					changedBy: {
 						type: "agent",
@@ -179,17 +160,11 @@ const plugin = {
 			defineTool({
 				name: "unmerge_identities",
 				description: "Reverse a merge — restore previously merged identity",
-				parameters: Type.Object({
-					mergedId: Type.String({ description: "Identity that was merged (has mergedInto pointer)" }),
-					tenantId: Type.String()
-				}),
-				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.mergedId)}/unmerge`, {
-					tenantId: params.tenantId,
-					changedBy: {
-						type: "agent",
-						id: "plugin"
-					}
-				})
+				parameters: Type.Object({ mergedId: Type.String({ description: "Identity that was merged (has mergedInto pointer)" }) }),
+				handler: (params) => client.unmergeIdentity(params.mergedId, { changedBy: {
+					type: "agent",
+					id: "plugin"
+				} })
 			}),
 			defineTool({
 				name: "link_platform",
@@ -197,14 +172,11 @@ const plugin = {
 				parameters: Type.Object({
 					identityId: Type.String(),
 					platform: Type.String(),
-					platformId: Type.String(),
-					tenantId: Type.String()
+					platformId: Type.String()
 				}),
-				handler: (params) => http.request("POST", "/internal/identity/resolve", {
+				handler: (params) => client.resolveIdentity({
 					platform: params.platform,
-					platformId: params.platformId,
-					tenantId: params.tenantId,
-					agentId: "plugin"
+					platformId: params.platformId
 				})
 			}),
 			defineTool({
@@ -212,12 +184,10 @@ const plugin = {
 				description: "Add an observation or note about a contact",
 				parameters: Type.Object({
 					identityId: Type.String(),
-					tenantId: Type.String(),
 					content: Type.String(),
 					category: Type.Optional(Type.String({ description: "observation, preference, relationship, context, or warning" }))
 				}),
-				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.identityId)}/notes`, {
-					tenantId: params.tenantId,
+				handler: (params) => client.addIdentityNote(params.identityId, {
 					content: params.content,
 					category: params.category,
 					changedBy: {
@@ -231,12 +201,10 @@ const plugin = {
 				description: "Add or remove a tag on an identity",
 				parameters: Type.Object({
 					identityId: Type.String(),
-					tenantId: Type.String(),
 					tag: Type.String(),
 					action: Type.String({ description: "'add' or 'remove'" })
 				}),
-				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.identityId)}/tags`, {
-					tenantId: params.tenantId,
+				handler: (params) => client.tagIdentity(params.identityId, {
 					tag: params.tag,
 					action: params.action,
 					changedBy: {
@@ -250,25 +218,18 @@ const plugin = {
 				description: "Get full changelog for an identity — all versions, diffs, who changed what",
 				parameters: Type.Object({
 					identityId: Type.String(),
-					tenantId: Type.String(),
 					limit: Type.Optional(Type.Number())
 				}),
-				handler: async (params) => {
-					const qs = new URLSearchParams({ tenantId: params.tenantId });
-					if (params.limit) qs.set("limit", String(Number(params.limit)));
-					return http.request("GET", `/internal/identity/${encodeURIComponent(params.identityId)}/changelog?${qs.toString()}`);
-				}
+				handler: (params) => client.getIdentityChangelog(params.identityId, { limit: params.limit })
 			}),
 			defineTool({
 				name: "rollback_identity",
 				description: "Revert an identity to a previous version",
 				parameters: Type.Object({
 					identityId: Type.String(),
-					tenantId: Type.String(),
 					targetVersion: Type.Number()
 				}),
-				handler: (params) => http.request("POST", `/internal/identity/${encodeURIComponent(params.identityId)}/rollback`, {
-					tenantId: params.tenantId,
+				handler: (params) => client.rollbackIdentity(params.identityId, {
 					targetVersion: params.targetVersion,
 					changedBy: {
 						type: "agent",
@@ -282,14 +243,12 @@ const plugin = {
 				parameters: Type.Object({
 					platform: Type.String(),
 					senderId: Type.String(),
-					channelId: Type.Optional(Type.String()),
-					tenantId: Type.String()
+					channelId: Type.Optional(Type.String())
 				}),
-				handler: (params) => http.request("POST", "/internal/identity/enforce", {
+				handler: (params) => client.enforcePolicy({
 					platform: params.platform,
 					senderId: params.senderId,
-					channelId: params.channelId,
-					tenantId: params.tenantId
+					channelId: params.channelId
 				})
 			}),
 			defineTool({
@@ -298,14 +257,12 @@ const plugin = {
 				parameters: Type.Object({
 					platform: Type.String(),
 					senderId: Type.String(),
-					toolName: Type.String(),
-					tenantId: Type.String()
+					toolName: Type.String()
 				}),
-				handler: (params) => http.request("POST", "/internal/identity/check-tool", {
+				handler: (params) => client.checkToolPermission({
 					platform: params.platform,
 					senderId: params.senderId,
-					toolName: params.toolName,
-					tenantId: params.tenantId
+					toolName: params.toolName
 				})
 			})
 		];
@@ -330,19 +287,14 @@ const plugin = {
 				return;
 			}
 			try {
-				const tenantId = ctx.tenantId ?? "";
-				const agentId = ctx.agentId ?? "";
-				const resolveResult = await http.request("POST", "/internal/identity/resolve", {
+				const resolveResult = await client.resolveIdentity({
 					platform,
-					platformId: senderId,
-					tenantId,
-					agentId
+					platformId: senderId
 				});
 				setCached(cacheKey, {
-					...await http.request("POST", "/internal/identity/enforce", {
+					...await client.enforcePolicy({
 						platform,
-						senderId,
-						tenantId
+						senderId
 					}),
 					accessAllowed: resolveResult.accessAllowed
 				});
@@ -353,6 +305,10 @@ const plugin = {
 				log.info(`Identity resolved: ${senderId} → ${resolveResult.identityId ?? "unknown"} (${resolveResult.status})`);
 			} catch (e) {
 				log.error(`Identity resolution failed for ${senderId}: ${e.message}`);
+				if (failureMode === "closed") return {
+					block: true,
+					blockReason: "Identity: identity service unavailable — access denied (closed mode)"
+				};
 			}
 		}, { priority: 100 });
 		api.on("before_tool_call", async (...args) => {
@@ -362,14 +318,20 @@ const plugin = {
 			const sessionKey = ctx.sessionKey;
 			if (!sessionKey) return;
 			const perms = getCached(sessionKey);
-			if (!perms) return {
-				block: true,
-				blockReason: "Identity: no identity context established — tool access denied"
-			};
-			if (!perms.identified) return {
-				block: true,
-				blockReason: "Identity: unknown sender identity — tool access denied"
-			};
+			if (!perms) {
+				if (failureMode === "permissive") return;
+				return {
+					block: true,
+					blockReason: "Identity: no identity context established — tool access denied"
+				};
+			}
+			if (!perms.identified) {
+				if (failureMode === "permissive") return;
+				return {
+					block: true,
+					blockReason: "Identity: unknown sender identity — tool access denied"
+				};
+			}
 			if (perms.deniedTools.includes("*") || perms.deniedTools.includes(event.toolName)) return {
 				block: true,
 				blockReason: `Identity: tool '${event.toolName}' is denied for your role`
@@ -381,17 +343,15 @@ const plugin = {
 		}, { priority: 100 });
 		api.on("after_tool_call", async (...args) => {
 			const event = args[0];
-			const ctx = args[1];
-			const sessionKey = ctx.sessionKey;
+			const sessionKey = args[1].sessionKey;
 			if (!sessionKey) return;
 			const perms = getCached(sessionKey);
 			if (!perms?.identityId) return;
 			try {
-				await http.request("POST", "/internal/identity/check-tool", {
+				await client.checkToolPermission({
 					platform: "tool_audit",
 					senderId: perms.identityId,
-					toolName: event.toolName,
-					tenantId: ctx.tenantId ?? ""
+					toolName: event.toolName
 				});
 			} catch (e) {
 				log.error(`Audit logging failed: ${e.message}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/openclaw-identity",
-  "version": "0.0.3",
+  "version": "0.0.5",
   "description": "OpenClaw identity plugin — identity resolution, access gating, permission enforcement",
   "type": "module",
   "main": "./dist/plugin.js",
@@ -28,6 +28,7 @@
   ],
   "dependencies": {
     "@sinclair/typebox": "^0.34.48",
+    "@alfe.ai/agent-api-client": "0.0.9",
     "@alfe.ai/config": "0.0.8"
   },
   "license": "UNLICENSED",