@atbash/atbash-openclaw 0.1.13-dev.4 → 0.1.13-dev.6

package/README.md

@@ -72,7 +72,7 @@ Open `~/.openclaw/openclaw.json` and add:
 | `enabled` | bool | `true` | Master switch. `false` = plugin returns immediately. |
 | `enforceDecision` | bool | `true` | Surfaced to logs. The plugin always blocks on `BLOCK`. |
 | `chromiaSecretPath` | string | `~/.config/atbash/guard-client-key` | Path to the agent key file. Supports `~/`. |
-| `debug` | bool | `false` | Reserved. No-op today. |
+| `debug` | bool | `false` | When `true`, logs a one-line probe for every `before_tool_call` showing `toolName`, top-level event/ctx/args keys, and whether the call was classified as a memory write. Useful for verifying memory-write classifier coverage against real traffic. Logs shape only — argument values are never printed. |
 
 ## Updating
 

package/dist/allowlist.d.ts

@@ -0,0 +1,4 @@
+type AllowlistConfig = Record<string, string[]>;
+export declare function loadAllowlist(path: string): AllowlistConfig;
+export declare function checkAllowlist(recipient: string | undefined, asset: string, allowlist: AllowlistConfig): string[];
+export {};

package/dist/allowlist.js

@@ -0,0 +1,22 @@
+import { readFileSync } from "fs";
+export function loadAllowlist(path) {
+    try {
+        const raw = readFileSync(path, "utf8");
+        const parsed = JSON.parse(raw);
+        if (parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)) {
+            return parsed;
+        }
+        return {};
+    }
+    catch {
+        return {};
+    }
+}
+export function checkAllowlist(recipient, asset, allowlist) {
+    if (!recipient)
+        return [];
+    const key = `${asset.toLowerCase()}-recipients`;
+    const list = allowlist[key] ?? [];
+    const r = recipient.toLowerCase();
+    return list.some((entry) => entry.toLowerCase() === r) ? [key] : [];
+}

package/dist/context-mapper.js

@@ -1,3 +1,81 @@
+const ASSET_BY_CONTRACT = {
+    "0xdac17f958d2ee523a2206206994597c13d831ec7": "USDT",
+    "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48": "USDC",
+    "0x6b175474e89094c44da98b954eedeac495271d0f": "DAI",
+    "0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2": "WETH",
+    "0x2260fac5e5542a773aa44fbcfedf7c193bc2c599": "WBTC",
+    "0x1f9840a85d5af5bf1d1762f925bdaddc4201f984": "UNI",
+    "0x514910771af9ca656af840dff83e8264ecf986ca": "LINK",
+    "0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9": "AAVE",
+    "0xb0df6379ba1692841965a0745ac1bd3046d79ba3": "ATBASH",
+    "0xe9c094187219d9a29382c1a36fc43619c9257777": "ATBASH",
+    "0xf8b071428558c657a7a9aa1c43e152e75dd77777": "ATBASH",
+};
+const ERC20_RE = /\b(0x[a-fA-F0-9]{40})\b/;
+const ERC20_ADDR_RE = /(0x[a-fA-F0-9]{40})/;
+const FINANCIAL_OP_RE = /\b(transfer|send|swap|approve|erc20)\b/i;
+function resolveAsset(token) {
+    if (!token)
+        return "ETH";
+    const t = token.toLowerCase();
+    const m = ERC20_ADDR_RE.exec(t);
+    if (m)
+        return ASSET_BY_CONTRACT[m[1].toLowerCase()] ?? "other";
+    if (t === "c60" || t === "eth")
+        return "ETH";
+    if (t === "atbash")
+        return "ATBASH";
+    if (t === "usdt" || t === "tether")
+        return "USDT";
+    if (t === "usdc")
+        return "USDC";
+    return "other";
+}
+function strField(obj, ...keys) {
+    for (const k of keys) {
+        const v = obj[k];
+        if (typeof v === "string" && v.trim())
+            return v.trim();
+    }
+    return undefined;
+}
+function canonicalizeFinancial(toolName, args) {
+    const a = args !== null && typeof args === "object" && !Array.isArray(args)
+        ? args
+        : undefined;
+    const cmdStr = a ? strField(a, "command", "cmd", "shell_command") : undefined;
+    const isFinancialTool = FINANCIAL_OP_RE.test(toolName);
+    const hasFinancialCmd = cmdStr ? FINANCIAL_OP_RE.test(cmdStr) : false;
+    const hasAddress = cmdStr ? ERC20_RE.test(cmdStr) : false;
+    if (!isFinancialTool && !hasFinancialCmd && !hasAddress)
+        return undefined;
+    const flagVal = (flag) => cmdStr ? new RegExp(`--${flag}[= ]+(\\S+)`).exec(cmdStr)?.[1] : undefined;
+    let token = (a ? strField(a, "token", "token_address", "asset", "currency") : undefined) ??
+        flagVal("token");
+    if (!token && cmdStr) {
+        const m = ERC20_RE.exec(cmdStr);
+        if (m)
+            token = m[1];
+    }
+    const to = (a ? strField(a, "to", "recipient", "destination") : undefined) ??
+        flagVal("to") ??
+        flagVal("recipient");
+    const amount = (a ? strField(a, "amount", "value", "qty") : undefined) ?? flagVal("amount");
+    const asset = resolveAsset(token ?? "");
+    const src = cmdStr ?? toolName;
+    const op = /\bswap\b/i.test(src)
+        ? "swap"
+        : /\b(approve|erc20)\b/i.test(src)
+            ? "approve"
+            : "transfer";
+    return {
+        operation: op,
+        asset,
+        amount,
+        recipient_status: to ? "external" : "unspecified",
+        note: "canonicalized pre-judge; raw 0x addresses omitted (redacted upstream)",
+    };
+}
 /** @internal */
 export function mapEventToInput(event, ctx) {
     const ev = (event ?? {});
@@ -15,5 +93,5 @@ export function mapEventToInput(event, ctx) {
         channel_id: ctx.channelId ?? "",
         account_id: ctx.accountId ?? "",
     });
-    return { toolName, args, context };
+    return { toolName, args, context, resolved: canonicalizeFinancial(toolName, args) };
 }

package/dist/index.js

@@ -1,2 +1,2 @@
-"use strict";var d=Object.defineProperty;var b=Object.getOwnPropertyDescriptor;var m=Object.getOwnPropertyNames;var w=Object.prototype.hasOwnProperty;var y=(o,e)=>{for(var n in e)d(o,n,{get:e[n],enumerable:!0})},I=(o,e,n,t)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of m(e))!w.call(o,r)&&r!==n&&d(o,r,{get:()=>e[r],enumerable:!(t=b(e,r))||t.enumerable});return o};var C=o=>I(d({},"__esModule",{value:!0}),o);var k={};y(k,{default:()=>h});module.exports=C(k);var s=require("@atbash/sdk");var E="atbash-openclaw";function f(o){return o.config?.plugins?.entries?.[E]?.config??{}}function p(o,e){let n=o??{},t=n.toolName??e.tool?.name??e.toolName??e.name??"unknown",r=n.params??e.params??n.args??e.args??n.arguments??e.arguments,l=JSON.stringify({tool_name:t,session_id:e.sessionKey??"",run_id:e.runId??"",agent_id:e.agentId??"",channel_id:e.channelId??"",account_id:e.accountId??""});return{toolName:t,args:r,context:l}}function R(o){if(o.judgeEndpoint)return o.judgeEndpointPolicy==="self-hosted"?{policy:"self-hosted",endpoint:o.judgeEndpoint,verifyPubKey:o.judgeVerifyPubKey??""}:{policy:"default",endpoint:o.judgeEndpoint}}function h(o){let e=o,n=f(e);if(n.enabled===!1){e.logger?.info?.("[atbash] plugin disabled via config");return}(0,s.setupTelemetry)({enabled:!0,source:"plugin:openclaw"}),process.once("beforeExit",()=>(0,s.shutdownTelemetry)()),process.once("SIGINT",()=>(0,s.shutdownTelemetry)().finally(()=>process.exit(0))),process.once("SIGTERM",()=>(0,s.shutdownTelemetry)().finally(()=>process.exit(0)));let t;try{t=s.Atbash.fromConfig({judge:R(n),keyPath:n.chromiaSecretPath,orgName:n.orgName,failClosed:n.enforceDecision!==!1,logger:e.logger})}catch(l){let g=l instanceof Error?l.message:String(l);throw e.logger?.warn?.("[atbash] init failed",{error:g}),l}let r=n.enforceDecision!==!1;if(e.logger?.info?.("[atbash] plugin loaded",{enforceDecision:r}),!e.on){e.logger?.warn?.("[atbash] on() API not available");return}e.on("before_tool_call",async(l,g)=>{let i;try{i=await t.auditToolCall(p(l,g))}catch(u){let c=u instanceof Error?u.message:String(u);return e.logger?.warn?.("[atbash] unexpected error",{error:c}),r?{block:!0,blockReason:`Atbash unavailable: ${c}`,allow:!1,reason:`Atbash unavailable: ${c}`}:{allow:!0}}let a=i.reason??"";switch(i.verdict){case"BLOCK":return e.logger?.warn?.("[atbash] BLOCK",{reason:a}),r?{block:!0,blockReason:a,allow:!1,reason:a}:{allow:!0};case"HOLD":{let u=["Action held for operator review. The agent will not be jailed \u2014 please approve or reject this request from the Atbash dashboard, then ask the agent to try again.",`Reason: ${a}`];i.toolCallId&&u.push(`Tool Call ID: ${i.toolCallId}`);let c=u.join(`
-`);return e.logger?.warn?.("[atbash] HOLD",{reason:a,toolCallId:i.toolCallId}),r?{block:!0,blockReason:c,allow:!1,reason:c}:{allow:!0}}case"ERROR":return e.logger?.warn?.("[atbash] ERROR",{reason:a}),r?{block:!0,blockReason:a,allow:!1,reason:a}:{allow:!0};case"ALLOW":default:return e.logger?.info?.("[atbash] ALLOW",{reason:a}),{allow:!0}}})}
+"use strict";var p=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var I=Object.getOwnPropertyNames;var S=Object.prototype.hasOwnProperty;var R=(o,e)=>{for(var r in e)p(o,r,{get:e[r],enumerable:!0})},P=(o,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let a of I(e))!S.call(o,a)&&a!==r&&p(o,a,{get:()=>e[a],enumerable:!(n=k(e,a))||n.enumerable});return o};var D=o=>P(p({},"__esModule",{value:!0}),o);var O={};R(O,{default:()=>C});module.exports=D(O);var E=require("os"),c=require("@atbash/sdk");var _="atbash-openclaw";function h(o){return o.config?.plugins?.entries?.[_]?.config??{}}var v={"0xdac17f958d2ee523a2206206994597c13d831ec7":"USDT","0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48":"USDC","0x6b175474e89094c44da98b954eedeac495271d0f":"DAI","0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2":"WETH","0x2260fac5e5542a773aa44fbcfedf7c193bc2c599":"WBTC","0x1f9840a85d5af5bf1d1762f925bdaddc4201f984":"UNI","0x514910771af9ca656af840dff83e8264ecf986ca":"LINK","0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9":"AAVE","0xb0df6379ba1692841965a0745ac1bd3046d79ba3":"ATBASH","0xe9c094187219d9a29382c1a36fc43619c9257777":"ATBASH","0xf8b071428558c657a7a9aa1c43e152e75dd77777":"ATBASH"},y=/\b(0x[a-fA-F0-9]{40})\b/,x=/(0x[a-fA-F0-9]{40})/,w=/\b(transfer|send|swap|approve|erc20)\b/i;function j(o){if(!o)return"ETH";let e=o.toLowerCase(),r=x.exec(e);return r?v[r[1].toLowerCase()]??"other":e==="c60"||e==="eth"?"ETH":e==="atbash"?"ATBASH":e==="usdt"||e==="tether"?"USDT":e==="usdc"?"USDC":"other"}function b(o,...e){for(let r of e){let n=o[r];if(typeof n=="string"&&n.trim())return n.trim()}}function L(o,e){let r=e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0,n=r?b(r,"command","cmd","shell_command"):void 0,a=w.test(o),g=n?w.test(n):!1,t=n?y.test(n):!1;if(!a&&!g&&!t)return;let d=m=>n?new RegExp(`--${m}[= ]+(\\S+)`).exec(n)?.[1]:void 0,f=(r?b(r,"token","token_address","asset","currency"):void 0)??d("token");if(!f&&n){let m=y.exec(n);m&&(f=m[1])}let u=(r?b(r,"to","recipient","destination"):void 0)??d("to")??d("recipient"),l=(r?b(r,"amount","value","qty"):void 0)??d("amount"),s=j(f??""),i=n??o;return{operation:/\bswap\b/i.test(i)?"swap":/\b(approve|erc20)\b/i.test(i)?"approve":"transfer",asset:s,amount:l,recipient_status:u?"external":"unspecified",note:"canonicalized pre-judge; raw 0x addresses omitted (redacted upstream)"}}function A(o,e){let r=o??{},n=r.toolName??e.tool?.name??e.toolName??e.name??"unknown",a=r.params??e.params??r.args??e.args??r.arguments??e.arguments,g=JSON.stringify({tool_name:n,session_id:e.sessionKey??"",run_id:e.runId??"",agent_id:e.agentId??"",channel_id:e.channelId??"",account_id:e.accountId??""});return{toolName:n,args:a,context:g,resolved:L(n,a)}}function T(o){return o.replace(/^~(?=\/|$)/,(0,E.homedir)())}function N(o){return o.memoryWorkspaceDir?T(o.memoryWorkspaceDir):process.cwd()}function M(o){if(o.judgeEndpoint)return o.judgeEndpointPolicy==="self-hosted"?{policy:"self-hosted",endpoint:o.judgeEndpoint,verifyPubKey:o.judgeVerifyPubKey??""}:{policy:"default",endpoint:o.judgeEndpoint}}function C(o){let e=o,r=h(e);if(r.enabled===!1){e.logger?.info?.("[atbash] plugin disabled via config");return}(0,c.setupTelemetry)({enabled:!0,source:"plugin:openclaw"}),process.once("beforeExit",()=>(0,c.shutdownTelemetry)()),process.once("SIGINT",()=>(0,c.shutdownTelemetry)().finally(()=>process.exit(0))),process.once("SIGTERM",()=>(0,c.shutdownTelemetry)().finally(()=>process.exit(0)));let n;try{n=c.Atbash.fromConfig({judge:M(r),keyPath:r.chromiaSecretPath,orgName:r.orgName,failClosed:r.enforceDecision!==!1,logger:e.logger})}catch(t){let d=t instanceof Error?t.message:String(t);throw e.logger?.warn?.("[atbash] init failed",{error:d}),t}let a=r.enforceDecision!==!1;e.logger?.info?.("[atbash] plugin loaded",{enforceDecision:a});let g=(0,c.createMemoryGuardManager)({auth:n.auth,workspaceDir:N(r),memoryFilePath:r.memoryFilePath?T(r.memoryFilePath):void 0,ttlMs:r.memorySyncTTLMs,rollbackMinScore:r.memoryRollbackMinScore,memoryPathPatterns:r.memoryPathPatterns,judgeEndpoint:r.judgeEndpoint,judgeVerifyPubKey:r.judgeVerifyPubKey,orgName:r.orgName,enforce:a,debug:!!r.debug,hostLogger:e.logger});if(g.runBootProbe().catch(t=>{e.logger?.warn?.("[atbash] boot probe failed",{error:t instanceof Error?t.message:String(t)})}),!e.on){e.logger?.warn?.("[atbash] on() API not available");return}e.on("before_tool_call",async(t,d)=>{let f;try{f=await g.handleBeforeToolCall(t,d)}catch(s){let i=s instanceof Error?s.message:String(s);return e.logger?.warn?.("[atbash] memory guard error",{error:i}),s instanceof c.MemoryIntegrityError||a?{block:!0,blockReason:`Memory guard error: ${i}`,allow:!1,reason:`Memory guard error: ${i}`}:{allow:!0}}if(f)return f;let u;try{u=await n.auditToolCall(A(t,d))}catch(s){let i=s instanceof Error?s.message:String(s);return e.logger?.warn?.("[atbash] unexpected error",{error:i}),a?{block:!0,blockReason:`Atbash unavailable: ${i}`,allow:!1,reason:`Atbash unavailable: ${i}`}:{allow:!0}}let l=u.reason??"";switch(u.verdict){case"BLOCK":return e.logger?.warn?.("[atbash] BLOCK",{reason:l}),a?{block:!0,blockReason:l,allow:!1,reason:l}:{allow:!0};case"HOLD":{let s=["Action held for operator review. The agent will not be jailed \u2014 please approve or reject this request from the Atbash dashboard, then ask the agent to try again.",`Reason: ${l}`];u.toolCallId&&s.push(`Tool Call ID: ${u.toolCallId}`);let i=s.join(`
+`);return e.logger?.warn?.("[atbash] HOLD",{reason:l,toolCallId:u.toolCallId}),a?{block:!0,blockReason:i,allow:!1,reason:i}:{allow:!0}}case"ERROR":return e.logger?.warn?.("[atbash] ERROR",{reason:l}),a?{block:!0,blockReason:l,allow:!1,reason:l}:{allow:!0};case"ALLOW":default:return e.logger?.info?.("[atbash] ALLOW",{reason:l}),{allow:!0}}})}

package/openclaw.plugin.json

@@ -16,7 +16,15 @@
         "default": "default"
       },
       "judgeVerifyPubKey": { "type": "string" },
-      "orgName": { "type": "string" }
+      "orgName": { "type": "string" },
+      "memoryPathPatterns": {
+        "type": "array",
+        "items": { "type": "string" }
+      },
+      "memoryWorkspaceDir": { "type": "string" },
+      "memoryFilePath": { "type": "string" },
+      "memorySyncTTLMs": { "type": "integer", "minimum": 0, "default": 30000 },
+      "memoryRollbackMinScore": { "type": "integer", "minimum": 1, "maximum": 10, "default": 1 }
     }
   },
   "uiHints": {
@@ -41,6 +49,26 @@
     "orgName": {
       "label": "Organization Name",
       "placeholder": "e.g. ATBASH — set so the SDK queries the right chain (public vs private)"
+    },
+    "memoryPathPatterns": {
+      "label": "Memory Path Patterns (advanced)",
+      "placeholder": "/.openclaw/workspace/, /.openclaw/memory/, /.claude/projects/, /memory/, Memory.md, CLAUDE.md, AGENTS.md"
+    },
+    "memoryWorkspaceDir": {
+      "label": "Openclaw Workspace Directory",
+      "placeholder": "e.g. /Users/me/.openclaw/workspace"
+    },
+    "memoryFilePath": {
+      "label": "MEMORY.md Path (advanced)",
+      "placeholder": "Defaults to <memoryWorkspaceDir>/MEMORY.md"
+    },
+    "memorySyncTTLMs": {
+      "label": "Memory Sync TTL (ms)",
+      "placeholder": "How long to trust the local memory pointer between chain checks. Default 30000."
+    },
+    "memoryRollbackMinScore": {
+      "label": "Rollback Score Threshold",
+      "placeholder": "Block memory reads when a rolled-back version scores below this (1-10). Default 1 = never block."
     }
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/atbash-openclaw",
-  "version": "0.1.13-dev.4",
+  "version": "0.1.13-dev.6",
   "description": "OpenClaw ATBASH tool-audit plugin. Thin adapter that maps OpenClaw's before_tool_call hook onto @atbash/sdk.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,6 +12,7 @@
   ],
   "scripts": {
     "build": "tsc && esbuild dist/index.js --bundle --platform=node --external:postchain-client --external:@atbash/sdk --minify --allow-overwrite --outfile=dist/index.js",
+    "typecheck": "tsc --noEmit",
     "release": "npm pkg set \"dependencies[@atbash/sdk]=^$(npm view @atbash/sdk dist-tags.latest)\" && npm version patch --no-git-tag-version && npm run build && npx npm@10 publish --access public",
     "release:dev": "npm pkg set \"dependencies[@atbash/sdk]=$(npm view @atbash/sdk dist-tags.dev)\" && npm version prerelease --preid=dev --no-git-tag-version && npm run build && npx npm@10 publish --access public --tag dev"
   },
@@ -32,7 +33,7 @@
     ]
   },
   "dependencies": {
-    "@atbash/sdk": "0.5.3-dev.0"
+    "@atbash/sdk": "0.7.1-dev.0"
   },
   "devDependencies": {
     "@types/node": "^25.7.0",