@alfe.ai/openclaw-identity 0.0.8 → 0.0.10

package/dist/plugin2.js

@@ -0,0 +1,446 @@
+import { createRequire } from "node:module";
+import { resolveConfig } from "@alfe.ai/config";
+import { AgentApiClient } from "@alfe.ai/agent-api-client";
+import { Type } from "@sinclair/typebox";
+//#region src/policy-cache.ts
+const CACHE_TTL_MS = 6e4;
+function createPolicyCache() {
+	const sessionCache = /* @__PURE__ */ new Map();
+	let lastResolvedPolicy = null;
+	function getCached(key) {
+		const entry = sessionCache.get(key);
+		if (!entry) return null;
+		if (Date.now() > entry.expiresAt) {
+			sessionCache.delete(key);
+			return null;
+		}
+		return entry.value;
+	}
+	function setCached(key, value) {
+		sessionCache.set(key, {
+			value,
+			expiresAt: Date.now() + CACHE_TTL_MS
+		});
+	}
+	function setLastResolved(value) {
+		lastResolvedPolicy = {
+			value,
+			expiresAt: Date.now() + CACHE_TTL_MS
+		};
+	}
+	function getLastResolved() {
+		if (!lastResolvedPolicy) return null;
+		if (Date.now() > lastResolvedPolicy.expiresAt) {
+			lastResolvedPolicy = null;
+			return null;
+		}
+		return lastResolvedPolicy.value;
+	}
+	function getPerms(sessionKey) {
+		return getCached(sessionKey) ?? getLastResolved();
+	}
+	function clear() {
+		sessionCache.clear();
+		lastResolvedPolicy = null;
+	}
+	return {
+		getCached,
+		setCached,
+		setLastResolved,
+		getLastResolved,
+		getPerms,
+		clear
+	};
+}
+/**
+* Evaluate whether a tool call should be blocked based on the cached policy
+* and failure mode.
+*/
+function evaluateToolAccess(perms, toolName, failureMode) {
+	if (!perms) {
+		if (failureMode === "permissive") return void 0;
+		return {
+			block: true,
+			blockReason: "Identity: no identity context established — tool access denied"
+		};
+	}
+	if (!perms.identified) {
+		if (failureMode === "permissive") return void 0;
+		return {
+			block: true,
+			blockReason: "Identity: unknown sender identity — tool access denied"
+		};
+	}
+	if (perms.deniedTools.includes("*") || perms.deniedTools.includes(toolName)) return {
+		block: true,
+		blockReason: `Identity: tool '${toolName}' is denied for your role`
+	};
+	if (perms.allowedTools.length > 0 && !perms.allowedTools.includes(toolName)) return {
+		block: true,
+		blockReason: `Identity: tool '${toolName}' is not in your allowed tools`
+	};
+}
+//#endregion
+//#region src/plugin.ts
+/**
+* @alfe.ai/openclaw-identity — OpenClaw native plugin
+*
+* HTTP-based identity resolution, permission enforcement, and CRM tools.
+* Installed as part of the core alfe integration on every agent.
+*
+* Hooks:
+*   - message_received  → resolve sender identity via HTTP, cache, gate access
+*   - before_tool_call  → enforce permissions from cached policy
+*   - after_tool_call   → log tool execution audit
+*
+* All data access via AgentApiClient (/agent/identity/* routes).
+* Uses the agent's own API key (from ~/.alfe/config.toml) for authentication.
+*/
+const pkg = createRequire(import.meta.url)("../package.json");
+const { getCached, setCached, setLastResolved, getPerms } = createPolicyCache();
+function ok(data) {
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify(data)
+		}],
+		details: data
+	};
+}
+function errResult(message) {
+	return {
+		content: [{
+			type: "text",
+			text: JSON.stringify({ error: message })
+		}],
+		details: { error: message }
+	};
+}
+function defineTool(def) {
+	return {
+		name: def.name,
+		description: def.description,
+		label: def.name,
+		parameters: def.parameters,
+		execute: async (_toolCallId, params) => {
+			try {
+				return ok(await def.handler(params));
+			} catch (e) {
+				return errResult(e.message);
+			}
+		}
+	};
+}
+const plugin = {
+	id: "@alfe.ai/openclaw-identity",
+	name: "Alfe Identity",
+	description: "Identity resolution, access gating, and permission enforcement",
+	version: pkg.version,
+	activate(api) {
+		const log = api.logger;
+		log.info("Alfe Identity plugin activating...");
+		let client;
+		try {
+			const config = resolveConfig();
+			client = new AgentApiClient({
+				apiKey: config.apiKey,
+				apiUrl: config.apiUrl
+			});
+		} catch (err) {
+			log.error(`Identity plugin: failed to resolve config — ${err instanceof Error ? err.message : String(err)}`);
+			return;
+		}
+		let failureMode = "open";
+		const configReady = client.getIntegrationConfig("alfe").then((alfeConfig) => {
+			const mode = alfeConfig.config.identity_failure_mode;
+			if (mode === "open" || mode === "closed" || mode === "permissive") failureMode = mode;
+			log.info(`Identity failure mode: ${failureMode}`);
+		}).catch(() => {
+			log.info(`Identity failure mode: ${failureMode} (default — config fetch failed)`);
+		});
+		const identityToolNames = /* @__PURE__ */ new Set();
+		const tools = [
+			defineTool({
+				name: "who_is_this",
+				description: "Look up full identity context by platform and ID — returns profile, notes, tags, platforms, and recent changelog",
+				parameters: Type.Object({
+					platform: Type.String({ description: "Platform name (discord, slack, chat, sms, whatsapp, etc.)" }),
+					platformId: Type.String({ description: "Platform-specific user identifier" })
+				}),
+				handler: async (params) => {
+					const result = await client.resolveIdentity({
+						platform: params.platform,
+						platformId: params.platformId
+					});
+					if (!result.identityId) return { found: false };
+					return client.getIdentityContext(result.identityId);
+				}
+			}),
+			defineTool({
+				name: "lookup_identity",
+				description: "Search identities by name, email, phone, tag, or platform. Returns multiple matches.",
+				parameters: Type.Object({
+					query: Type.Optional(Type.String({ description: "Text search query" })),
+					status: Type.Optional(Type.String()),
+					tag: Type.Optional(Type.String()),
+					platform: Type.Optional(Type.String())
+				}),
+				handler: (params) => client.searchIdentities({
+					q: params.query,
+					status: params.status,
+					tag: params.tag,
+					platform: params.platform
+				})
+			}),
+			defineTool({
+				name: "create_identity",
+				description: "Create a new identity record with profile fields",
+				parameters: Type.Object({
+					platform: Type.String(),
+					platformId: Type.String(),
+					displayName: Type.Optional(Type.String())
+				}),
+				handler: (params) => client.resolveIdentity({
+					platform: params.platform,
+					platformId: params.platformId,
+					displayName: params.displayName
+				})
+			}),
+			defineTool({
+				name: "merge_identities",
+				description: "Merge two identity records — transfers notes, tags, aliases, platforms to survivor",
+				parameters: Type.Object({
+					survivorId: Type.String({ description: "Identity to keep" }),
+					mergedId: Type.String({ description: "Identity to merge into survivor" })
+				}),
+				handler: (params) => client.mergeIdentities(params.survivorId, {
+					mergedId: params.mergedId,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "unmerge_identities",
+				description: "Reverse a merge — restore previously merged identity",
+				parameters: Type.Object({ mergedId: Type.String({ description: "Identity that was merged (has mergedInto pointer)" }) }),
+				handler: (params) => client.unmergeIdentity(params.mergedId, { changedBy: {
+					type: "agent",
+					id: "plugin"
+				} })
+			}),
+			defineTool({
+				name: "link_platform",
+				description: "Link a platform identity to an existing identity record",
+				parameters: Type.Object({
+					identityId: Type.String(),
+					platform: Type.String(),
+					platformId: Type.String()
+				}),
+				handler: (params) => client.resolveIdentity({
+					platform: params.platform,
+					platformId: params.platformId
+				})
+			}),
+			defineTool({
+				name: "add_identity_note",
+				description: "Add an observation or note about a contact",
+				parameters: Type.Object({
+					identityId: Type.String(),
+					content: Type.String(),
+					category: Type.Optional(Type.String({ description: "observation, preference, relationship, context, or warning" }))
+				}),
+				handler: (params) => client.addIdentityNote(params.identityId, {
+					content: params.content,
+					category: params.category,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "tag_identity",
+				description: "Add or remove a tag on an identity",
+				parameters: Type.Object({
+					identityId: Type.String(),
+					tag: Type.String(),
+					action: Type.String({ description: "'add' or 'remove'" })
+				}),
+				handler: (params) => client.tagIdentity(params.identityId, {
+					tag: params.tag,
+					action: params.action,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "get_identity_changelog",
+				description: "Get full changelog for an identity — all versions, diffs, who changed what",
+				parameters: Type.Object({
+					identityId: Type.String(),
+					limit: Type.Optional(Type.Number())
+				}),
+				handler: (params) => client.getIdentityChangelog(params.identityId, { limit: params.limit })
+			}),
+			defineTool({
+				name: "rollback_identity",
+				description: "Revert an identity to a previous version",
+				parameters: Type.Object({
+					identityId: Type.String(),
+					targetVersion: Type.Number()
+				}),
+				handler: (params) => client.rollbackIdentity(params.identityId, {
+					targetVersion: params.targetVersion,
+					changedBy: {
+						type: "agent",
+						id: "plugin"
+					}
+				})
+			}),
+			defineTool({
+				name: "enforce_policy",
+				description: "Resolve sender identity and return their tool policy",
+				parameters: Type.Object({
+					platform: Type.String(),
+					senderId: Type.String(),
+					channelId: Type.Optional(Type.String())
+				}),
+				handler: (params) => client.enforcePolicy({
+					platform: params.platform,
+					senderId: params.senderId,
+					channelId: params.channelId
+				})
+			}),
+			defineTool({
+				name: "check_permission",
+				description: "Check if a specific tool call is allowed for a sender",
+				parameters: Type.Object({
+					platform: Type.String(),
+					senderId: Type.String(),
+					toolName: Type.String()
+				}),
+				handler: (params) => client.checkToolPermission({
+					platform: params.platform,
+					senderId: params.senderId,
+					toolName: params.toolName
+				})
+			}),
+			defineTool({
+				name: "request_identity_verification",
+				description: "Send a verification phrase to the claimed identity's phone (SMS) or email. The person must relay the phrase back to confirm they own that identity.",
+				parameters: Type.Object({
+					claimedIdentityId: Type.String({ description: "Identity being claimed" }),
+					requestingIdentityId: Type.String({ description: "Identity of the person making the claim" }),
+					requestingPlatform: Type.String({ description: "Platform the requester is on (discord, slack, chat, etc.)" }),
+					requestingPlatformId: Type.String({ description: "Requester's platform-specific user ID" }),
+					preferredChannel: Type.Optional(Type.String({ description: "'sms' or 'email'" }))
+				}),
+				handler: (params) => client.requestIdentityVerification({
+					claimedIdentityId: params.claimedIdentityId,
+					requestingIdentityId: params.requestingIdentityId,
+					requestingPlatform: params.requestingPlatform,
+					requestingPlatformId: params.requestingPlatformId,
+					preferredChannel: params.preferredChannel
+				})
+			}),
+			defineTool({
+				name: "confirm_identity_verification",
+				description: "Confirm a verification by providing the three-word phrase. On success, the requesting identity is merged into the claimed identity.",
+				parameters: Type.Object({
+					verificationId: Type.String({ description: "Verification ID returned from request_identity_verification" }),
+					phrase: Type.String({ description: "Three-word phrase the person received via SMS or email" })
+				}),
+				handler: (params) => client.confirmIdentityVerification({
+					verificationId: params.verificationId,
+					phrase: params.phrase
+				})
+			})
+		];
+		for (const tool of tools) {
+			api.registerTool(tool);
+			identityToolNames.add(tool.name);
+		}
+		log.info(`Registered ${String(tools.length)} identity tools`);
+		api.on("message_received", async (...args) => {
+			const event = args[0];
+			const ctx = args[1];
+			const platform = ctx.channelId ?? "unknown";
+			const preResolvedIdentityId = event.metadata?.IdentityId;
+			const senderId = event.metadata?.UserId ?? event.from;
+			if (!senderId) return;
+			const cacheKey = ctx.conversationId ?? `${platform}:${senderId}`;
+			const cached = getCached(cacheKey);
+			if (cached) {
+				if (!cached.accessAllowed) return {
+					block: true,
+					blockReason: "Identity: access denied for this sender"
+				};
+				return;
+			}
+			try {
+				let resolveResult;
+				if (preResolvedIdentityId) resolveResult = {
+					identityId: preResolvedIdentityId,
+					accessAllowed: true,
+					status: "pre-resolved"
+				};
+				else resolveResult = await client.resolveIdentity({
+					platform,
+					platformId: senderId
+				});
+				const entry = {
+					...await client.enforcePolicy({
+						platform,
+						senderId
+					}),
+					accessAllowed: resolveResult.accessAllowed
+				};
+				setCached(cacheKey, entry);
+				setLastResolved(entry);
+				if (!resolveResult.accessAllowed) return {
+					block: true,
+					blockReason: "Identity: access denied for this sender"
+				};
+				log.info(`Identity resolved: ${senderId} → ${resolveResult.identityId ?? "unknown"} (${resolveResult.status})`);
+			} catch (e) {
+				log.error(`Identity resolution failed for ${senderId}: ${e.message}`);
+				if (failureMode === "closed") return {
+					block: true,
+					blockReason: "Identity: identity service unavailable — access denied (closed mode)"
+				};
+			}
+		}, { priority: 100 });
+		api.on("before_tool_call", async (...args) => {
+			const event = args[0];
+			const ctx = args[1];
+			if (identityToolNames.has(event.toolName)) return;
+			const sessionKey = ctx.sessionKey;
+			if (!sessionKey) return;
+			await configReady;
+			return evaluateToolAccess(getPerms(sessionKey), event.toolName, failureMode);
+		}, { priority: 100 });
+		api.on("after_tool_call", async (...args) => {
+			const event = args[0];
+			const sessionKey = args[1].sessionKey;
+			if (!sessionKey) return;
+			const perms = getPerms(sessionKey);
+			if (!perms?.identityId) return;
+			try {
+				await client.checkToolPermission({
+					platform: "tool_audit",
+					senderId: perms.identityId,
+					toolName: event.toolName
+				});
+			} catch (e) {
+				log.error(`Audit logging failed: ${e.message}`);
+			}
+		});
+		log.info("Alfe Identity plugin activated");
+	}
+};
+//#endregion
+export { plugin as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alfe.ai/openclaw-identity",
-  "version": "0.0.8",
+  "version": "0.0.10",
   "description": "OpenClaw identity plugin — identity resolution, access gating, permission enforcement",
   "type": "module",
   "main": "./dist/plugin.js",
@@ -28,13 +28,14 @@
   ],
   "dependencies": {
     "@sinclair/typebox": "^0.34.48",
-    "@alfe.ai/agent-api-client": "0.0.11",
+    "@alfe.ai/agent-api-client": "0.0.13",
     "@alfe.ai/config": "0.0.8"
   },
   "license": "UNLICENSED",
   "scripts": {
     "build": "tsdown",
     "dev": "tsdown --watch",
+    "test": "vitest run",
     "typecheck": "tsc --noEmit",
     "lint": "eslint ."
   }