@alfe.ai/openclaw-identity 0.0.4 → 0.0.5

package/dist/plugin.cjs

@@ -73,6 +73,7 @@ const plugin = {
 	version: "0.0.1",
 	activate(api) {
 		const log = api.logger;
+		if (api.registrationMode && api.registrationMode !== "full") return;
 		log.info("Alfe Identity plugin activating...");
 		let client;
 		try {
@@ -85,6 +86,14 @@ const plugin = {
 			log.error(`Identity plugin: failed to resolve config — ${err instanceof Error ? err.message : String(err)}`);
 			return;
 		}
+		let failureMode = "open";
+		client.getIntegrationConfig("alfe").then((alfeConfig) => {
+			const mode = alfeConfig.config.identity_failure_mode;
+			if (mode === "open" || mode === "closed" || mode === "permissive") failureMode = mode;
+			log.info(`Identity failure mode: ${failureMode}`);
+		}).catch(() => {
+			log.info(`Identity failure mode: ${failureMode} (default — config fetch failed)`);
+		});
 		const identityToolNames = /* @__PURE__ */ new Set();
 		const tools = [
 			defineTool({
@@ -296,6 +305,10 @@ const plugin = {
 				log.info(`Identity resolved: ${senderId} → ${resolveResult.identityId ?? "unknown"} (${resolveResult.status})`);
 			} catch (e) {
 				log.error(`Identity resolution failed for ${senderId}: ${e.message}`);
+				if (failureMode === "closed") return {
+					block: true,
+					blockReason: "Identity: identity service unavailable — access denied (closed mode)"
+				};
 			}
 		}, { priority: 100 });
 		api.on("before_tool_call", async (...args) => {
@@ -305,14 +318,20 @@ const plugin = {
 			const sessionKey = ctx.sessionKey;
 			if (!sessionKey) return;
 			const perms = getCached(sessionKey);
-			if (!perms) return {
-				block: true,
-				blockReason: "Identity: no identity context established — tool access denied"
-			};
-			if (!perms.identified) return {
-				block: true,
-				blockReason: "Identity: unknown sender identity — tool access denied"
-			};
+			if (!perms) {
+				if (failureMode === "permissive") return;
+				return {
+					block: true,
+					blockReason: "Identity: no identity context established — tool access denied"
+				};
+			}
+			if (!perms.identified) {
+				if (failureMode === "permissive") return;
+				return {
+					block: true,
+					blockReason: "Identity: unknown sender identity — tool access denied"
+				};
+			}
 			if (perms.deniedTools.includes("*") || perms.deniedTools.includes(event.toolName)) return {
 				block: true,
 				blockReason: `Identity: tool '${event.toolName}' is denied for your role`

package/dist/plugin.d.cts

@@ -23,6 +23,7 @@ interface ToolDef {
 }
 interface PluginApi {
   logger: PluginLogger;
+  registrationMode?: "full" | "setup-only" | "setup-runtime" | "cli-metadata";
   registerTool: (tool: ToolDef) => void;
   on: (event: string, handler: (...args: unknown[]) => Promise<unknown>, options?: {
     priority?: number;

package/dist/plugin.d.ts

@@ -23,6 +23,7 @@ interface ToolDef {
 }
 interface PluginApi {
   logger: PluginLogger;
+  registrationMode?: "full" | "setup-only" | "setup-runtime" | "cli-metadata";
   registerTool: (tool: ToolDef) => void;
   on: (event: string, handler: (...args: unknown[]) => Promise<unknown>, options?: {
     priority?: number;

package/dist/plugin.js

@@ -73,6 +73,7 @@ const plugin = {
 	version: "0.0.1",
 	activate(api) {
 		const log = api.logger;
+		if (api.registrationMode && api.registrationMode !== "full") return;
 		log.info("Alfe Identity plugin activating...");
 		let client;
 		try {
@@ -85,6 +86,14 @@ const plugin = {
 			log.error(`Identity plugin: failed to resolve config — ${err instanceof Error ? err.message : String(err)}`);
 			return;
 		}
+		let failureMode = "open";
+		client.getIntegrationConfig("alfe").then((alfeConfig) => {
+			const mode = alfeConfig.config.identity_failure_mode;
+			if (mode === "open" || mode === "closed" || mode === "permissive") failureMode = mode;
+			log.info(`Identity failure mode: ${failureMode}`);
+		}).catch(() => {
+			log.info(`Identity failure mode: ${failureMode} (default — config fetch failed)`);
+		});
 		const identityToolNames = /* @__PURE__ */ new Set();
 		const tools = [
 			defineTool({
@@ -296,6 +305,10 @@ const plugin = {
 				log.info(`Identity resolved: ${senderId} → ${resolveResult.identityId ?? "unknown"} (${resolveResult.status})`);
 			} catch (e) {
 				log.error(`Identity resolution failed for ${senderId}: ${e.message}`);
+				if (failureMode === "closed") return {
+					block: true,
+					blockReason: "Identity: identity service unavailable — access denied (closed mode)"
+				};
 			}
 		}, { priority: 100 });
 		api.on("before_tool_call", async (...args) => {
@@ -305,14 +318,20 @@ const plugin = {
 			const sessionKey = ctx.sessionKey;
 			if (!sessionKey) return;
 			const perms = getCached(sessionKey);
-			if (!perms) return {
-				block: true,
-				blockReason: "Identity: no identity context established — tool access denied"
-			};
-			if (!perms.identified) return {
-				block: true,
-				blockReason: "Identity: unknown sender identity — tool access denied"
-			};
+			if (!perms) {
+				if (failureMode === "permissive") return;
+				return {
+					block: true,
+					blockReason: "Identity: no identity context established — tool access denied"
+				};
+			}
+			if (!perms.identified) {
+				if (failureMode === "permissive") return;
+				return {
+					block: true,
+					blockReason: "Identity: unknown sender identity — tool access denied"
+				};
+			}
 			if (perms.deniedTools.includes("*") || perms.deniedTools.includes(event.toolName)) return {
 				block: true,
 				blockReason: `Identity: tool '${event.toolName}' is denied for your role`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/openclaw-identity",
-  "version": "0.0.4",
+  "version": "0.0.5",
   "description": "OpenClaw identity plugin — identity resolution, access gating, permission enforcement",
   "type": "module",
   "main": "./dist/plugin.js",