@alfe.ai/openclaw-identity 0.0.4 → 0.0.6

package/dist/plugin.cjs

@@ -73,6 +73,7 @@ const plugin = {
 	version: "0.0.1",
 	activate(api) {
 		const log = api.logger;
+		if (api.registrationMode && api.registrationMode !== "full") return;
 		log.info("Alfe Identity plugin activating...");
 		let client;
 		try {
@@ -85,6 +86,14 @@ const plugin = {
 			log.error(`Identity plugin: failed to resolve config — ${err instanceof Error ? err.message : String(err)}`);
 			return;
 		}
+		let failureMode = "open";
+		client.getIntegrationConfig("alfe").then((alfeConfig) => {
+			const mode = alfeConfig.config.identity_failure_mode;
+			if (mode === "open" || mode === "closed" || mode === "permissive") failureMode = mode;
+			log.info(`Identity failure mode: ${failureMode}`);
+		}).catch(() => {
+			log.info(`Identity failure mode: ${failureMode} (default — config fetch failed)`);
+		});
 		const identityToolNames = /* @__PURE__ */ new Set();
 		const tools = [
 			defineTool({
@@ -255,6 +264,36 @@ const plugin = {
 					senderId: params.senderId,
 					toolName: params.toolName
 				})
+			}),
+			defineTool({
+				name: "request_identity_verification",
+				description: "Send a verification phrase to the claimed identity's phone (SMS) or email. The person must relay the phrase back to confirm they own that identity.",
+				parameters: _sinclair_typebox.Type.Object({
+					claimedIdentityId: _sinclair_typebox.Type.String({ description: "Identity being claimed" }),
+					requestingIdentityId: _sinclair_typebox.Type.String({ description: "Identity of the person making the claim" }),
+					requestingPlatform: _sinclair_typebox.Type.String({ description: "Platform the requester is on (discord, slack, chat, etc.)" }),
+					requestingPlatformId: _sinclair_typebox.Type.String({ description: "Requester's platform-specific user ID" }),
+					preferredChannel: _sinclair_typebox.Type.Optional(_sinclair_typebox.Type.String({ description: "'sms' or 'email'" }))
+				}),
+				handler: (params) => client.requestIdentityVerification({
+					claimedIdentityId: params.claimedIdentityId,
+					requestingIdentityId: params.requestingIdentityId,
+					requestingPlatform: params.requestingPlatform,
+					requestingPlatformId: params.requestingPlatformId,
+					preferredChannel: params.preferredChannel
+				})
+			}),
+			defineTool({
+				name: "confirm_identity_verification",
+				description: "Confirm a verification by providing the three-word phrase. On success, the requesting identity is merged into the claimed identity.",
+				parameters: _sinclair_typebox.Type.Object({
+					verificationId: _sinclair_typebox.Type.String({ description: "Verification ID returned from request_identity_verification" }),
+					phrase: _sinclair_typebox.Type.String({ description: "Three-word phrase the person received via SMS or email" })
+				}),
+				handler: (params) => client.confirmIdentityVerification({
+					verificationId: params.verificationId,
+					phrase: params.phrase
+				})
 			})
 		];
 		for (const tool of tools) {
@@ -296,6 +335,10 @@ const plugin = {
 				log.info(`Identity resolved: ${senderId} → ${resolveResult.identityId ?? "unknown"} (${resolveResult.status})`);
 			} catch (e) {
 				log.error(`Identity resolution failed for ${senderId}: ${e.message}`);
+				if (failureMode === "closed") return {
+					block: true,
+					blockReason: "Identity: identity service unavailable — access denied (closed mode)"
+				};
 			}
 		}, { priority: 100 });
 		api.on("before_tool_call", async (...args) => {
@@ -305,14 +348,20 @@ const plugin = {
 			const sessionKey = ctx.sessionKey;
 			if (!sessionKey) return;
 			const perms = getCached(sessionKey);
-			if (!perms) return {
-				block: true,
-				blockReason: "Identity: no identity context established — tool access denied"
-			};
-			if (!perms.identified) return {
-				block: true,
-				blockReason: "Identity: unknown sender identity — tool access denied"
-			};
+			if (!perms) {
+				if (failureMode === "permissive") return;
+				return {
+					block: true,
+					blockReason: "Identity: no identity context established — tool access denied"
+				};
+			}
+			if (!perms.identified) {
+				if (failureMode === "permissive") return;
+				return {
+					block: true,
+					blockReason: "Identity: unknown sender identity — tool access denied"
+				};
+			}
 			if (perms.deniedTools.includes("*") || perms.deniedTools.includes(event.toolName)) return {
 				block: true,
 				blockReason: `Identity: tool '${event.toolName}' is denied for your role`

package/dist/plugin.d.cts

@@ -23,6 +23,7 @@ interface ToolDef {
 }
 interface PluginApi {
   logger: PluginLogger;
+  registrationMode?: "full" | "setup-only" | "setup-runtime" | "cli-metadata";
   registerTool: (tool: ToolDef) => void;
   on: (event: string, handler: (...args: unknown[]) => Promise<unknown>, options?: {
     priority?: number;

package/dist/plugin.d.ts

@@ -23,6 +23,7 @@ interface ToolDef {
 }
 interface PluginApi {
   logger: PluginLogger;
+  registrationMode?: "full" | "setup-only" | "setup-runtime" | "cli-metadata";
   registerTool: (tool: ToolDef) => void;
   on: (event: string, handler: (...args: unknown[]) => Promise<unknown>, options?: {
     priority?: number;

package/dist/plugin.js

@@ -73,6 +73,7 @@ const plugin = {
 	version: "0.0.1",
 	activate(api) {
 		const log = api.logger;
+		if (api.registrationMode && api.registrationMode !== "full") return;
 		log.info("Alfe Identity plugin activating...");
 		let client;
 		try {
@@ -85,6 +86,14 @@ const plugin = {
 			log.error(`Identity plugin: failed to resolve config — ${err instanceof Error ? err.message : String(err)}`);
 			return;
 		}
+		let failureMode = "open";
+		client.getIntegrationConfig("alfe").then((alfeConfig) => {
+			const mode = alfeConfig.config.identity_failure_mode;
+			if (mode === "open" || mode === "closed" || mode === "permissive") failureMode = mode;
+			log.info(`Identity failure mode: ${failureMode}`);
+		}).catch(() => {
+			log.info(`Identity failure mode: ${failureMode} (default — config fetch failed)`);
+		});
 		const identityToolNames = /* @__PURE__ */ new Set();
 		const tools = [
 			defineTool({
@@ -255,6 +264,36 @@ const plugin = {
 					senderId: params.senderId,
 					toolName: params.toolName
 				})
+			}),
+			defineTool({
+				name: "request_identity_verification",
+				description: "Send a verification phrase to the claimed identity's phone (SMS) or email. The person must relay the phrase back to confirm they own that identity.",
+				parameters: Type.Object({
+					claimedIdentityId: Type.String({ description: "Identity being claimed" }),
+					requestingIdentityId: Type.String({ description: "Identity of the person making the claim" }),
+					requestingPlatform: Type.String({ description: "Platform the requester is on (discord, slack, chat, etc.)" }),
+					requestingPlatformId: Type.String({ description: "Requester's platform-specific user ID" }),
+					preferredChannel: Type.Optional(Type.String({ description: "'sms' or 'email'" }))
+				}),
+				handler: (params) => client.requestIdentityVerification({
+					claimedIdentityId: params.claimedIdentityId,
+					requestingIdentityId: params.requestingIdentityId,
+					requestingPlatform: params.requestingPlatform,
+					requestingPlatformId: params.requestingPlatformId,
+					preferredChannel: params.preferredChannel
+				})
+			}),
+			defineTool({
+				name: "confirm_identity_verification",
+				description: "Confirm a verification by providing the three-word phrase. On success, the requesting identity is merged into the claimed identity.",
+				parameters: Type.Object({
+					verificationId: Type.String({ description: "Verification ID returned from request_identity_verification" }),
+					phrase: Type.String({ description: "Three-word phrase the person received via SMS or email" })
+				}),
+				handler: (params) => client.confirmIdentityVerification({
+					verificationId: params.verificationId,
+					phrase: params.phrase
+				})
 			})
 		];
 		for (const tool of tools) {
@@ -296,6 +335,10 @@ const plugin = {
 				log.info(`Identity resolved: ${senderId} → ${resolveResult.identityId ?? "unknown"} (${resolveResult.status})`);
 			} catch (e) {
 				log.error(`Identity resolution failed for ${senderId}: ${e.message}`);
+				if (failureMode === "closed") return {
+					block: true,
+					blockReason: "Identity: identity service unavailable — access denied (closed mode)"
+				};
 			}
 		}, { priority: 100 });
 		api.on("before_tool_call", async (...args) => {
@@ -305,14 +348,20 @@ const plugin = {
 			const sessionKey = ctx.sessionKey;
 			if (!sessionKey) return;
 			const perms = getCached(sessionKey);
-			if (!perms) return {
-				block: true,
-				blockReason: "Identity: no identity context established — tool access denied"
-			};
-			if (!perms.identified) return {
-				block: true,
-				blockReason: "Identity: unknown sender identity — tool access denied"
-			};
+			if (!perms) {
+				if (failureMode === "permissive") return;
+				return {
+					block: true,
+					blockReason: "Identity: no identity context established — tool access denied"
+				};
+			}
+			if (!perms.identified) {
+				if (failureMode === "permissive") return;
+				return {
+					block: true,
+					blockReason: "Identity: unknown sender identity — tool access denied"
+				};
+			}
 			if (perms.deniedTools.includes("*") || perms.deniedTools.includes(event.toolName)) return {
 				block: true,
 				blockReason: `Identity: tool '${event.toolName}' is denied for your role`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/openclaw-identity",
-  "version": "0.0.4",
+  "version": "0.0.6",
   "description": "OpenClaw identity plugin — identity resolution, access gating, permission enforcement",
   "type": "module",
   "main": "./dist/plugin.js",
@@ -28,7 +28,7 @@
   ],
   "dependencies": {
     "@sinclair/typebox": "^0.34.48",
-    "@alfe.ai/agent-api-client": "0.0.9",
+    "@alfe.ai/agent-api-client": "0.0.10",
     "@alfe.ai/config": "0.0.8"
   },
   "license": "UNLICENSED",