@atbash/atbash-openclaw 0.1.16 → 0.1.17-dev.1

package/LICENSE

@@ -0,0 +1,28 @@
+Atbash CLI — Proprietary Software License
+
+Copyright (c) 2026 Atbash,
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+The views and conclusions contained in the software and documentation are those
+of the authors and should not be interpreted as representing official policies,
+either expressed or implied, Atbash.

package/README.md

@@ -7,9 +7,12 @@ If you're not using OpenClaw and want to use ATBASH from your own code, install
 ## Install
 
 ```bash
-openclaw plugins install @atbash/atbash-openclaw
+openclaw plugins install @atbash/atbash-openclaw        # production
+openclaw plugins install @atbash/atbash-openclaw@dev    # development
 ```
 
+**The judge endpoint and chain ids are compiled into the build**, so the npm tag selects the environment. Install the plain tag if your agent was onboarded on production, the `@dev` tag if it was onboarded on development; `openclaw plugins list` shows which you have (a `-dev.N` version is the development build). No configuration repoints a build afterwards — the wrong one loads cleanly, fires its hook, and then fails every judge call because the agent does not exist on the chain that build targets. Organization names are not unique across environments, so a resolving org name is not proof the build is right.
+
 The plugin signs audit transactions locally with your agent's secp256k1 private key. The key never leaves your machine; only signed bytes plus the corresponding public key are transmitted.
 
 ## Get an agent key
@@ -34,37 +37,40 @@ Contact the ATBASH team to register an agent and obtain a key pair.
 
 ## Configure it in OpenClaw
 
-Open `~/.openclaw/openclaw.json` and add:
+`openclaw plugins install` already recorded where the plugin lives, enabled it, and — if you keep a
+`plugins.allow` list — added `atbash-openclaw` to it. Never hand-write the install directory: OpenClaw has
+moved it between releases and records whichever it used, which is what it loads from. `openclaw plugins list`
+shows the current state.
+
+All that is left is your configuration. Open `~/.openclaw/openclaw.json` and add, keeping the plugins
+already there:
 
 ```json
 {
   "plugins": {
-      "allow": [
-      "openclaw"
-    ],
-    "load": {
-      "paths": [
-        "/Users/<your-username>/.openclaw/extensions/openclaw"
-      ]
-    },
     "entries": {
-      "openclaw": {
+      "atbash-openclaw": {
         "enabled": true,
         "config": {
           "enabled": true,
           "enforceDecision": true,
-          "chromiaSecretPath": "~/.config/atbash/guard-client-key"
+          "chromiaSecretPath": "~/.config/atbash/guard-client-key",
+          "orgName": "<your org name>"
         },
         "hooks": {
           "allowConversationAccess": true,
           "allowPromptInjection": true
-      }
+        }
       }
     }
   }
 }
 ```
 
+The plugin id is `atbash-openclaw` — it comes from the `id` field in this package's `openclaw.plugin.json`,
+not from the npm package name. A `plugins.entries` key that does not match the id is not an error: the
+plugin loads unconfigured and audits nothing.
+
 ### Config fields
 
 | Field | Type | Default | What it does |
@@ -72,18 +78,19 @@ Open `~/.openclaw/openclaw.json` and add:
 | `enabled` | bool | `true` | Master switch. `false` = plugin returns immediately. |
 | `enforceDecision` | bool | `true` | Surfaced to logs. The plugin always blocks on `BLOCK`. |
 | `chromiaSecretPath` | string | `~/.config/atbash/guard-client-key` | Path to the agent key file. Supports `~/`. |
+| `orgName` | string | — | Organization the agent was onboarded under, spelled as the dashboard shows it. The plugin resolves which chain to query from this, so it is required when the org is on a private chain. |
 | `debug` | bool | `false` | When `true`, logs a one-line probe for every `before_tool_call` showing `toolName`, top-level event/ctx/args keys, and whether the call was classified as a memory write. Useful for verifying memory-write classifier coverage against real traffic. Logs shape only — argument values are never printed. |
 
 ## Updating
 
 ```bash
-openclaw plugins update @atbash/atbash-openclaw
+openclaw plugins update atbash-openclaw
 ```
 
 ## Uninstalling
 
 ```bash
-openclaw plugins uninstall @atbash/atbash-openclaw
+openclaw plugins uninstall atbash-openclaw
 ```
 
 The agent key file at `~/.config/atbash/guard-client-key` is **not** removed — delete it manually if you want to retire the agent identity.
@@ -111,11 +118,19 @@ The agent's own tool execution is unaffected — only the data sent to the judge
 ## Troubleshooting
 
 **Tool calls aren't being audited.**
-Check `enabled: true` is set both on the entry (`plugins.entries.openclaw.enabled`) and inside `config` (`config.enabled`).
+Check `enabled: true` is set both on the entry (`plugins.entries["atbash-openclaw"].enabled`) and inside `config` (`config.enabled`).
 
 **Every tool call is blocked, even safe ones.**
 The plugin is fail-closed: any pipeline error blocks. Look for `[atbash] …` warnings in the OpenClaw log. Most often: missing key, expired key, or restricted egress.
 
+## Maintainer release contract
+
+Development packages are released only through the protected **Publish development package** GitHub workflow. The workflow requires the `npm` environment, the exact `PUBLISH` confirmation, and npm trusted-publisher configuration for this repository and workflow. It never accepts a registry token from package source.
+
+The release guard refuses a dirty checkout, reads the live package and SDK tags, chooses a collision-free prerelease, copies only Git-tracked files into a temporary staging tree, pins the exact SDK version there, installs and tests from the staged lockfile, cleans and rebuilds `dist`, validates the tarball, rechecks registry state, publishes, and verifies the resulting `dev` tag. The tracked source manifest is never rewritten by a release.
+
+Because this repository is private, npm provenance statements are not supported. Trusted publishing still removes long-lived npm tokens; configure the protected npm environment and trusted publisher before enabling the workflow.
+
 ## License
 
 Proprietary — all rights reserved. See [LICENSE](https://atbash.ai/license). Commercial licensing inquiries: contact the Atbash team.

package/dist/config.js

@@ -1,5 +1,33 @@
 const PLUGIN_ID = "atbash-openclaw";
+/**
+ * Ids this plugin shipped under before it was renamed. OpenClaw matches
+ * `plugins.entries` keys against the manifest id, so an entry left under one of
+ * these is inert — no error, no config, and the plugin runs on defaults. That
+ * silence is what makes the rename expensive, so we say something instead.
+ */
+const FORMER_PLUGIN_IDS = ["openclaw", "atbash-plugin"];
 /** @internal */
 export function readPluginConfig(api) {
     return api.config?.plugins?.entries?.[PLUGIN_ID]?.config ?? {};
 }
+/**
+ * Warn when configuration is found under a former plugin id.
+ *
+ * @internal
+ */
+export function warnOnFormerIdConfig(api) {
+    const plugins = api.config?.plugins;
+    const entries = plugins?.entries ?? {};
+    const allow = Array.isArray(plugins?.allow) ? plugins.allow : [];
+    const stale = FORMER_PLUGIN_IDS.filter((id) => entries[id] !== undefined || allow.includes(id));
+    if (stale.length === 0)
+        return;
+    const configured = entries[PLUGIN_ID]?.config !== undefined;
+    api.logger?.warn?.(`[atbash] found config under former plugin id${stale.length > 1 ? "s" : ""} ` +
+        `${stale.map((id) => `"${id}"`).join(", ")} — this plugin's id is "${PLUGIN_ID}" ` +
+        `and those entries are ignored` +
+        (configured
+            ? ". Remove them to avoid confusion."
+            : `. No "${PLUGIN_ID}" config found, so the plugin is running on defaults — ` +
+                `move your settings under "${PLUGIN_ID}".`), { formerIds: stale, configured });
+}

package/dist/context-mapper.js

@@ -1,32 +1,3 @@
-// Mirrors the server-side redact-secrets patterns. The server refuses signed
-// payloads that contain secrets because it cannot modify signed bytes — so we
-// must scrub them client-side before building the signed context string.
-const SECRET_PATTERNS = [
-    /\bsk-ant-[A-Za-z0-9_-]{20,}/g,
-    /\bsk-proj-[A-Za-z0-9_-]{20,}/g,
-    /\bsk-[A-Za-z0-9]{20,}/g,
-    /\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{30,}/g,
-    /\bAIza[0-9A-Za-z_-]{35}/g,
-    /\bya29\.[0-9A-Za-z_-]{20,}/g,
-    /\b(?:AKIA|ASIA|AGPA|AROA|ANPA|ANVA|ASCA|AIDA|AIPA)[0-9A-Z]{16}\b/g,
-    /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g,
-    /\bxox[abprseo]-[A-Za-z0-9-]{10,}/g,
-    /\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g,
-    /\bnpm_[A-Za-z0-9]{36,}\b/g,
-    /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
-    // Generic high-entropy token (32+ chars, mixed alpha+digit, not UUID, not 0x addr, not pure hex)
-    /\b(?!0x[0-9a-fA-F])(?![0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b)(?=[A-Za-z0-9_-]*[0-9])(?=[A-Za-z0-9_-]*[A-Za-z])(?![0-9a-fA-F]+$)[A-Za-z0-9_-]{32,}\b/g,
-    // Base64-encoded secrets (40+ chars with + or /)
-    /(?<![A-Za-z0-9+/])(?=[A-Za-z0-9+/]*[+/])(?=[A-Za-z0-9+/]*[0-9])(?=[A-Za-z0-9+/]*[A-Za-z])[A-Za-z0-9+/]{40,}={0,2}(?![A-Za-z0-9+/=])/g,
-];
-function redactValue(s) {
-    let out = s;
-    for (const re of SECRET_PATTERNS) {
-        re.lastIndex = 0;
-        out = out.replace(re, "[REDACTED]");
-    }
-    return out;
-}
 const ASSET_BY_CONTRACT = {
     "0xdac17f958d2ee523a2206206994597c13d831ec7": "USDT",
     "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48": "USDC",
@@ -114,13 +85,12 @@ export function mapEventToInput(event, ctx) {
         ctx.name ??
         "unknown";
     const args = ev.params ?? ctx.params ?? ev.args ?? ctx.args ?? ev.arguments ?? ctx.arguments;
-    const context = JSON.stringify({
-        tool_name: toolName,
-        session_id: redactValue(ctx.sessionKey ?? ""),
-        run_id: redactValue(ctx.runId ?? ""),
-        agent_id: redactValue(ctx.agentId ?? ""),
-        channel_id: redactValue(ctx.channelId ?? ""),
-        account_id: redactValue(ctx.accountId ?? ""),
-    });
+    // Only tool_name is safe to include in signed bytes — it's always a short
+    // tool name string, never a secret. The other context fields (run_id,
+    // agent_id, channel_id, account_id) come from openclaw internals and may
+    // contain high-entropy values that trigger the server's containsSecret gate,
+    // even after client-side redaction (pattern mismatch between SDK NAPI binary
+    // and server TypeScript).
+    const context = JSON.stringify({ tool_name: toolName });
     return { toolName, args, context, resolved: canonicalizeFinancial(toolName, args) };
 }

package/dist/event-normalizer.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Normalize openclaw tool events into the shape the SDK's memory classifier
+ * expects, so patch-style tools like `apply_patch` route through the memory
+ * guard instead of the generic tool-call audit.
+ *
+ * The SDK classifier reads:
+ *   - `event.toolName` in ["write", "edit", "multiedit"] (case-insensitive)
+ *   - `event.params.file_path` (or `.path`, `.filename`, `.target`, `.file`)
+ *   - `event.params.new_string` (or `.newText`, `.replacement`, `.content`)
+ *
+ * `apply_patch` events use `params.input` holding a raw OpenAI-style patch:
+ *
+ *   *** Begin Patch
+ *   *** Update File: /Users/…/MEMORY.md
+ *   @@
+ *   - old line
+ *   + new line
+ *   *** End Patch
+ *
+ * Which the classifier cannot introspect. This module parses the patch header,
+ * extracts the target file, and emits a synthetic `edit` (or `write` for
+ * `*** Add File`) event with the standard fields populated. Multi-file patches
+ * scan ALL file headers and normalize to the FIRST memory-shaped file found —
+ * so a non-memory file appearing before MEMORY.md in the patch doesn't hide it.
+ *
+ * Events the normalizer doesn't recognize are returned unchanged.
+ */
+interface OpenClawEvent {
+    toolName?: string;
+    tool_name?: string;
+    params?: Record<string, unknown>;
+    args?: Record<string, unknown>;
+    arguments?: Record<string, unknown>;
+    [k: string]: unknown;
+}
+/**
+ * If `event` is a patch-style tool call that touches a memory-shaped file,
+ * return a synthetic event the classifier can read. Otherwise return null.
+ *
+ * Multi-file patches are scanned in order; the first memory-shaped file
+ * encountered is used — a non-memory file appearing first does not hide a
+ * MEMORY.md that follows it.
+ */
+export declare function normalizeApplyPatch(event: unknown): OpenClawEvent | null;
+export declare function normalizeShellExec(event: unknown): OpenClawEvent | null;
+/**
+ * Apply every event normalizer in sequence. Returns the input unchanged when
+ * no normalizer matches. Pass the result to `handleBeforeToolCall` so the
+ * memory classifier sees a canonical shape. For the judge path, pass the
+ * original (un-normalized) event to `mapEventToInput` — the judge should log
+ * the real tool name and args, not the synthetic shape.
+ */
+export declare function normalizeEvent(event: unknown): unknown;
+export {};

package/dist/event-normalizer.js

@@ -0,0 +1,253 @@
+/**
+ * Normalize openclaw tool events into the shape the SDK's memory classifier
+ * expects, so patch-style tools like `apply_patch` route through the memory
+ * guard instead of the generic tool-call audit.
+ *
+ * The SDK classifier reads:
+ *   - `event.toolName` in ["write", "edit", "multiedit"] (case-insensitive)
+ *   - `event.params.file_path` (or `.path`, `.filename`, `.target`, `.file`)
+ *   - `event.params.new_string` (or `.newText`, `.replacement`, `.content`)
+ *
+ * `apply_patch` events use `params.input` holding a raw OpenAI-style patch:
+ *
+ *   *** Begin Patch
+ *   *** Update File: /Users/…/MEMORY.md
+ *   @@
+ *   - old line
+ *   + new line
+ *   *** End Patch
+ *
+ * Which the classifier cannot introspect. This module parses the patch header,
+ * extracts the target file, and emits a synthetic `edit` (or `write` for
+ * `*** Add File`) event with the standard fields populated. Multi-file patches
+ * scan ALL file headers and normalize to the FIRST memory-shaped file found —
+ * so a non-memory file appearing before MEMORY.md in the patch doesn't hide it.
+ *
+ * Events the normalizer doesn't recognize are returned unchanged.
+ */
+/* ── shared memory-path detection ─────────────────────────────────────── */
+/**
+ * File-path substrings that mark a memory-shaped target. Kept independent of
+ * the SDK classifier's list because the normalizers run BEFORE the classifier —
+ * if we synthesize a read/write event for a non-memory path, the guard would
+ * see the wrong tool name. Only synthesize when we can confirm the path is
+ * memory-shaped; otherwise pass the event through unchanged.
+ */
+const MEMORY_PATH_TOKENS = [
+    "memory.md",
+    "dreams.md",
+    "claude.md",
+    "agents.md",
+    "/.openclaw/",
+    "/.claude/projects/",
+    "/memory/",
+];
+function pathLooksLikeMemory(path) {
+    const lower = path.replace(/\\/g, "/").toLowerCase();
+    return MEMORY_PATH_TOKENS.some((tok) => lower.includes(tok));
+}
+/* ── apply_patch normalization ─────────────────────────────────────────── */
+const PATCH_FILE_HEADER_RE = /^\*\*\* (Update|Add|Delete) File:\s*(.+?)\s*$/mg;
+/**
+ * Extract `+` lines from the section of a multi-file patch that belongs to
+ * `filePath`, stopping at the next file header. Returns joined new content.
+ */
+function extractNewContentForFile(input, filePath) {
+    const lines = input.split("\n");
+    let collecting = false;
+    const newLines = [];
+    for (const line of lines) {
+        const headerMatch = /^\*\*\* (?:Update|Add|Delete) File:\s*(.+?)\s*$/.exec(line);
+        if (headerMatch) {
+            collecting = headerMatch[1] === filePath;
+            continue;
+        }
+        if (!collecting)
+            continue;
+        if (line.startsWith("*** ") || line.startsWith("@@"))
+            continue;
+        if (line.startsWith("+"))
+            newLines.push(line.slice(1));
+    }
+    return newLines.join("\n");
+}
+/**
+ * If `event` is a patch-style tool call that touches a memory-shaped file,
+ * return a synthetic event the classifier can read. Otherwise return null.
+ *
+ * Multi-file patches are scanned in order; the first memory-shaped file
+ * encountered is used — a non-memory file appearing first does not hide a
+ * MEMORY.md that follows it.
+ */
+export function normalizeApplyPatch(event) {
+    if (!event || typeof event !== "object")
+        return null;
+    const ev = event;
+    const toolName = (ev.toolName ?? ev.tool_name ?? "").toString().toLowerCase();
+    if (toolName !== "apply_patch")
+        return null;
+    const params = ev.params ?? ev.args ?? ev.arguments ?? {};
+    const input = params.input;
+    if (typeof input !== "string" || input.length === 0)
+        return null;
+    // Normalize CRLF so path extraction and content splitting work on all platforms.
+    const normalized = input.replace(/\r\n/g, "\n");
+    // Scan all file headers; find the first memory-shaped non-delete target.
+    const re = new RegExp(PATCH_FILE_HEADER_RE.source, "mg");
+    let verb;
+    let filePath;
+    let match;
+    while ((match = re.exec(normalized)) !== null) {
+        const [, v, fp] = match;
+        if (v === "Delete")
+            continue;
+        if (pathLooksLikeMemory(fp)) {
+            verb = v;
+            filePath = fp;
+            break;
+        }
+    }
+    if (!verb || !filePath)
+        return null;
+    const newContent = extractNewContentForFile(normalized, filePath);
+    const synthesizedTool = verb === "Add" ? "write" : "edit";
+    return {
+        ...ev,
+        toolName: synthesizedTool,
+        params: {
+            ...params,
+            file_path: filePath,
+            // "write" reads `content`; "edit" reads `new_string`. Populate both so
+            // whichever key the classifier picks first finds the content.
+            content: newContent,
+            new_string: newContent,
+        },
+    };
+}
+/* ── shell-exec normalization ──────────────────────────────────────────── */
+/** Strip surrounding single or double quotes; return the raw string otherwise. */
+function unquote(s) {
+    const t = s.trim();
+    if ((t.startsWith('"') && t.endsWith('"')) || (t.startsWith("'") && t.endsWith("'"))) {
+        return t.slice(1, -1);
+    }
+    return t;
+}
+/** Any shell metachar that turns a "simple command + file" into something we
+ * can't reliably parse: pipes, redirects (other than the write shape we
+ * handle explicitly), command chaining, subshells, backgrounding, expansion.
+ * When present we bail out so the normal judge sees the raw exec. */
+const SHELL_UNSAFE = /[|;&`$]|<\(|\)/;
+function hasUnsafeShellMetachars(command) {
+    return SHELL_UNSAFE.test(command);
+}
+/** Shell-read shapes: `cat|head|tail|less|more|grep [args] <path>` and
+ * `sed <expr> <path>` (no `-i`). Returns the extracted path or null. */
+function extractShellReadPath(command) {
+    if (hasUnsafeShellMetachars(command))
+        return null;
+    const trimmed = command.trim();
+    // grep <pattern> <path> — path is the last unquoted arg
+    const grep = /^grep\b(?:\s+-\S+)*\s+\S+\s+(.+)$/.exec(trimmed);
+    if (grep)
+        return unquote(grep[1]);
+    // sed WITHOUT -i is a read
+    const sed = /^sed\b(?!\s+-i\b)(?:\s+-\S+)*\s+\S+\s+(.+)$/.exec(trimmed);
+    if (sed)
+        return unquote(sed[1]);
+    // cat / less / more / head [-n N] / tail [-n N] — path is the last arg
+    const simpleRead = /^(?:cat|less|more|head|tail)\b(?:\s+-\S+(?:\s+\S+)?)*\s+(.+)$/.exec(trimmed);
+    if (simpleRead)
+        return unquote(simpleRead[1]);
+    return null;
+}
+/** Shell-write shapes. Returns {path, content} or null. */
+function extractShellWrite(command) {
+    // Writes explicitly use `>`/`>>`, so a metachar-guard that rejects `>` would
+    // also reject every real write. Instead reject only the metachars that mean
+    // "there's more than one command here": pipes, `;`, `&&`, `||`, subshells.
+    if (/[|;&`$]|<\(|\)/.test(command))
+        return null;
+    const trimmed = command.trim();
+    // echo/printf "..." > path (or >> path)
+    const redirect = /^(?:echo|printf)\s+(.+?)\s*>>?\s*(\S+)\s*$/.exec(trimmed);
+    if (redirect) {
+        return { content: unquote(redirect[1]), path: unquote(redirect[2]) };
+    }
+    // tee [-a] path — content arrives on stdin, unknown; scanner gets empty content
+    const tee = /^tee\b(?:\s+-\S+)*\s+(\S+)\s*$/.exec(trimmed);
+    if (tee)
+        return { content: "", path: unquote(tee[1]) };
+    // sed -i '<expr>' path — in-place edit; the expression is the intent
+    const sedInplace = /^sed\s+-i(?:\s+-\S+)*\s+(\S+)\s+(\S+)\s*$/.exec(trimmed);
+    if (sedInplace)
+        return { content: unquote(sedInplace[1]), path: unquote(sedInplace[2]) };
+    // awk -i inplace ... path — same shape
+    const awkInplace = /^awk\s+-i\s+inplace\b.*\s+(\S+)\s*$/.exec(trimmed);
+    if (awkInplace)
+        return { content: "", path: unquote(awkInplace[1]) };
+    // cp/mv src dest — source content is unknown; scanner gets empty content so
+    // the classifier routes it through the memory guard for policy gating even
+    // though we can't scan the incoming content.
+    const cpMv = /^(?:cp|mv)\b(?:\s+-\S+)*\s+\S+\s+(\S+)\s*$/.exec(trimmed);
+    if (cpMv)
+        return { content: "", path: unquote(cpMv[1]) };
+    return null;
+}
+/**
+ * If `event` is a shell-exec running an unambiguous read or write against a
+ * memory-shaped path, return a synthetic `read`/`write` event so the memory
+ * classifier can route it. Otherwise return null.
+ *
+ * Deliberately narrow: pipes, subshells, here-docs, multi-line scripts, and
+ * commands whose path can't be lifted out are left as `exec` for the normal
+ * judge to evaluate. Better to miss a rare shape than to misclassify a
+ * non-memory command as memory.
+ */
+const SHELL_EXEC_TOOL_NAMES = new Set(["exec", "bash", "shell", "run_command", "run_bash"]);
+export function normalizeShellExec(event) {
+    if (!event || typeof event !== "object")
+        return null;
+    const ev = event;
+    const toolName = (ev.toolName ?? ev.tool_name ?? "").toString().toLowerCase();
+    if (!SHELL_EXEC_TOOL_NAMES.has(toolName))
+        return null;
+    const params = ev.params ?? ev.args ?? ev.arguments ?? {};
+    const p = params;
+    // Different runtimes use different key names for the shell command.
+    const rawCommand = p.command ?? p.cmd ?? p.script;
+    const command = typeof rawCommand === "string" ? rawCommand : null;
+    if (!command || command.length === 0)
+        return null;
+    const write = extractShellWrite(command);
+    if (write && pathLooksLikeMemory(write.path)) {
+        return {
+            ...ev,
+            toolName: "write",
+            params: {
+                ...p,
+                file_path: write.path,
+                content: write.content,
+            },
+        };
+    }
+    const readPath = extractShellReadPath(command);
+    if (readPath && pathLooksLikeMemory(readPath)) {
+        return {
+            ...ev,
+            toolName: "read",
+            params: { ...p, path: readPath },
+        };
+    }
+    return null;
+}
+/**
+ * Apply every event normalizer in sequence. Returns the input unchanged when
+ * no normalizer matches. Pass the result to `handleBeforeToolCall` so the
+ * memory classifier sees a canonical shape. For the judge path, pass the
+ * original (un-normalized) event to `mapEventToInput` — the judge should log
+ * the real tool name and args, not the synthetic shape.
+ */
+export function normalizeEvent(event) {
+    return normalizeApplyPatch(event) ?? normalizeShellExec(event) ?? event;
+}

package/dist/event-normalizer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/event-normalizer.test.js

@@ -0,0 +1,282 @@
+import { describe, expect, it } from "vitest";
+import { normalizeApplyPatch, normalizeEvent, normalizeShellExec } from "./event-normalizer";
+const UPDATE_PATCH = [
+    "*** Begin Patch",
+    "*** Update File: /Users/m4/.openclaw/workspace/MEMORY.md",
+    "@@",
+    "-old line",
+    "+new line",
+    "*** End Patch",
+].join("\n");
+const ADD_PATCH = [
+    "*** Begin Patch",
+    "*** Add File: /Users/m4/.openclaw/workspace/NEW.md",
+    "+first",
+    "+second",
+    "*** End Patch",
+].join("\n");
+const DELETE_PATCH = [
+    "*** Begin Patch",
+    "*** Delete File: /Users/m4/.openclaw/workspace/GONE.md",
+    "*** End Patch",
+].join("\n");
+describe("normalizeApplyPatch", () => {
+    it("turns an Update File patch into an edit event with the target path", () => {
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: UPDATE_PATCH },
+        });
+        expect(out?.toolName).toBe("edit");
+        expect(out?.params?.file_path).toBe("/Users/m4/.openclaw/workspace/MEMORY.md");
+        expect(out?.params?.new_string).toBe("new line");
+    });
+    it("turns an Add File patch into a write event with content", () => {
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: ADD_PATCH },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe("/Users/m4/.openclaw/workspace/NEW.md");
+        expect(out?.params?.content).toBe("first\nsecond");
+    });
+    it("returns null for a Delete File patch (not a memory write)", () => {
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: DELETE_PATCH },
+        });
+        expect(out).toBeNull();
+    });
+    it("returns null for a non-apply_patch tool", () => {
+        expect(normalizeApplyPatch({ toolName: "edit", params: { file_path: "/x" } })).toBeNull();
+    });
+    it("returns null for apply_patch with no parseable header", () => {
+        expect(normalizeApplyPatch({ toolName: "apply_patch", params: { input: "garbage" } })).toBeNull();
+    });
+    it("preserves other event fields on the normalized output", () => {
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: UPDATE_PATCH },
+            runId: "r-1",
+            toolCallId: "tc-1",
+        });
+        expect(out?.runId).toBe("r-1");
+        expect(out?.toolCallId).toBe("tc-1");
+    });
+    it("finds a memory file that is NOT first in a multi-file patch", () => {
+        const multiPatch = [
+            "*** Begin Patch",
+            "*** Update File: /tmp/scratch.txt",
+            "@@",
+            "-old",
+            "+new",
+            "*** Update File: /Users/m4/.openclaw/workspace/MEMORY.md",
+            "@@",
+            "-old memory",
+            "+poisoned memory",
+            "*** End Patch",
+        ].join("\n");
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: multiPatch },
+        });
+        expect(out?.toolName).toBe("edit");
+        expect(out?.params?.file_path).toBe("/Users/m4/.openclaw/workspace/MEMORY.md");
+        expect(out?.params?.new_string).toBe("poisoned memory");
+    });
+    it("returns null when no file in the patch is memory-shaped", () => {
+        const nonMemoryPatch = [
+            "*** Begin Patch",
+            "*** Update File: /tmp/a.txt",
+            "@@",
+            "+line",
+            "*** Update File: /tmp/b.txt",
+            "@@",
+            "+line",
+            "*** End Patch",
+        ].join("\n");
+        expect(normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: nonMemoryPatch },
+        })).toBeNull();
+    });
+    it("handles CRLF line endings in patch input", () => {
+        const crlfPatch = [
+            "*** Begin Patch",
+            "*** Update File: /Users/m4/.openclaw/workspace/MEMORY.md",
+            "@@",
+            "-old line",
+            "+new line",
+            "*** End Patch",
+        ].join("\r\n");
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: crlfPatch },
+        });
+        expect(out?.toolName).toBe("edit");
+        expect(out?.params?.file_path).toBe("/Users/m4/.openclaw/workspace/MEMORY.md");
+        expect(out?.params?.new_string).toBe("new line");
+    });
+    it("extracts content only from the matched memory file section, not the whole patch", () => {
+        const multiPatch = [
+            "*** Begin Patch",
+            "*** Update File: /tmp/scratch.txt",
+            "@@",
+            "+non-memory content",
+            "*** Update File: /Users/m4/.openclaw/workspace/MEMORY.md",
+            "@@",
+            "+memory content",
+            "*** End Patch",
+        ].join("\n");
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: multiPatch },
+        });
+        expect(out?.params?.new_string).toBe("memory content");
+        expect(out?.params?.new_string).not.toContain("non-memory content");
+    });
+});
+describe("normalizeEvent", () => {
+    it("passes unrecognized events through unchanged", () => {
+        const ev = { toolName: "read", params: { path: "/x" } };
+        expect(normalizeEvent(ev)).toBe(ev);
+    });
+    it("applies the apply_patch normalizer when it matches", () => {
+        const out = normalizeEvent({
+            toolName: "apply_patch",
+            params: { input: UPDATE_PATCH },
+        });
+        expect(out.toolName).toBe("edit");
+        expect(out.params.file_path).toBe("/Users/m4/.openclaw/workspace/MEMORY.md");
+    });
+    it("applies the shell-exec normalizer when it matches", () => {
+        const out = normalizeEvent({
+            toolName: "exec",
+            params: { command: "cat /Users/m4/.openclaw/workspace/MEMORY.md" },
+        });
+        expect(out.toolName).toBe("read");
+        expect(out.params.path).toBe("/Users/m4/.openclaw/workspace/MEMORY.md");
+    });
+});
+describe("normalizeShellExec — reads", () => {
+    const MEM = "/Users/m4/.openclaw/workspace/MEMORY.md";
+    it.each([
+        ["cat", `cat ${MEM}`],
+        ["less", `less ${MEM}`],
+        ["more", `more ${MEM}`],
+        ["head -n 20", `head -n 20 ${MEM}`],
+        ["tail -n 5", `tail -n 5 ${MEM}`],
+        ["grep with pattern", `grep foo ${MEM}`],
+        ["sed without -i", `sed 's/x/y/' ${MEM}`],
+    ])("turns `%s` into a read event", (_label, command) => {
+        const out = normalizeShellExec({ toolName: "exec", params: { command } });
+        expect(out?.toolName).toBe("read");
+        expect(out?.params?.path).toBe(MEM);
+    });
+    it("returns null when the path is not memory-shaped", () => {
+        expect(normalizeShellExec({ toolName: "exec", params: { command: "cat /etc/hosts" } })).toBeNull();
+    });
+    it("returns null for pipes / subshells (unambiguous shapes only)", () => {
+        expect(normalizeShellExec({
+            toolName: "exec",
+            params: { command: `cat ${MEM} | grep foo` },
+        })).toBeNull();
+    });
+});
+describe("normalizeShellExec — writes", () => {
+    const MEM = "/Users/m4/.openclaw/workspace/MEMORY.md";
+    it("turns `echo \"...\" > path` into a write event with content", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { command: `echo "poison" > ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+        expect(out?.params?.content).toBe("poison");
+    });
+    it("turns `echo ... >> path` (append) into a write event", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { command: `echo "more" >> ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+        expect(out?.params?.content).toBe("more");
+    });
+    it("turns `tee path` into a write event with empty content", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { command: `tee ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+        expect(out?.params?.content).toBe("");
+    });
+    it("turns `sed -i ... path` into a write event carrying the sed expression", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { command: `sed -i 's/x/y/' ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+        expect(out?.params?.content).toBe("s/x/y/");
+    });
+    it("returns null when the write path is not memory-shaped", () => {
+        expect(normalizeShellExec({
+            toolName: "exec",
+            params: { command: `echo "x" > /tmp/scratch.txt` },
+        })).toBeNull();
+    });
+    it("returns null for a non-exec tool", () => {
+        expect(normalizeShellExec({
+            toolName: "write",
+            params: { file_path: MEM, content: "x" },
+        })).toBeNull();
+    });
+    it.each(["bash", "shell", "run_command", "run_bash"])("normalizes `%s` tool name as well as exec", (toolName) => {
+        const out = normalizeShellExec({
+            toolName,
+            params: { command: `echo "x" > ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+    });
+    it("reads the command from params.cmd when params.command is absent", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { cmd: `echo "x" > ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+    });
+    it("reads the command from params.script when params.command is absent", () => {
+        const out = normalizeShellExec({
+            toolName: "bash",
+            params: { script: `echo "x" > ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+    });
+    it("turns `cp src MEMORY.md` into a write event with empty content", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { command: `cp /attacker/payload ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+        expect(out?.params?.content).toBe("");
+    });
+    it("turns `mv src MEMORY.md` into a write event with empty content", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { command: `mv /tmp/staged ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+        expect(out?.params?.content).toBe("");
+    });
+    it("returns null for cp/mv to a non-memory path", () => {
+        expect(normalizeShellExec({
+            toolName: "exec",
+            params: { command: "cp /a/b /tmp/c.txt" },
+        })).toBeNull();
+    });
+});

package/dist/index.js

@@ -1,2 +1,5 @@
-"use strict";var p=Object.defineProperty;var I=Object.getOwnPropertyDescriptor;var z=Object.getOwnPropertyNames;var C=Object.prototype.hasOwnProperty;var S=(r,e)=>{for(var a in e)p(r,a,{get:e[a],enumerable:!0})},R=(r,e,a,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of z(e))!C.call(r,n)&&n!==a&&p(r,n,{get:()=>e[n],enumerable:!(o=I(e,n))||o.enumerable});return r};var Z=r=>R(p({},"__esModule",{value:!0}),r);var O={};S(O,{default:()=>k});module.exports=Z(O);var E=require("os"),c=require("@atbash/sdk");var P="atbash-openclaw";function h(r){return r.config?.plugins?.entries?.[P]?.config??{}}var D=[/\bsk-ant-[A-Za-z0-9_-]{20,}/g,/\bsk-proj-[A-Za-z0-9_-]{20,}/g,/\bsk-[A-Za-z0-9]{20,}/g,/\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{30,}/g,/\bAIza[0-9A-Za-z_-]{35}/g,/\bya29\.[0-9A-Za-z_-]{20,}/g,/\b(?:AKIA|ASIA|AGPA|AROA|ANPA|ANVA|ASCA|AIDA|AIPA)[0-9A-Z]{16}\b/g,/\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g,/\bxox[abprseo]-[A-Za-z0-9-]{10,}/g,/\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g,/\bnpm_[A-Za-z0-9]{36,}\b/g,/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,/\b(?!0x[0-9a-fA-F])(?![0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b)(?=[A-Za-z0-9_-]*[0-9])(?=[A-Za-z0-9_-]*[A-Za-z])(?![0-9a-fA-F]+$)[A-Za-z0-9_-]{32,}\b/g,/(?<![A-Za-z0-9+/])(?=[A-Za-z0-9+/]*[+/])(?=[A-Za-z0-9+/]*[0-9])(?=[A-Za-z0-9+/]*[A-Za-z])[A-Za-z0-9+/]{40,}={0,2}(?![A-Za-z0-9+/=])/g];function b(r){let e=r;for(let a of D)a.lastIndex=0,e=e.replace(a,"[REDACTED]");return e}var x={"0xdac17f958d2ee523a2206206994597c13d831ec7":"USDT","0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48":"USDC","0x6b175474e89094c44da98b954eedeac495271d0f":"DAI","0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2":"WETH","0x2260fac5e5542a773aa44fbcfedf7c193bc2c599":"WBTC","0x1f9840a85d5af5bf1d1762f925bdaddc4201f984":"UNI","0x514910771af9ca656af840dff83e8264ecf986ca":"LINK","0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9":"AAVE","0xb0df6379ba1692841965a0745ac1bd3046d79ba3":"ATBASH","0xe9c094187219d9a29382c1a36fc43619c9257777":"ATBASH","0xf8b071428558c657a7a9aa1c43e152e75dd77777":"ATBASH"},y=/\b(0x[a-fA-F0-9]{40})\b/,v=/(0x[a-fA-F0-9]{40})/,w=/\b(transfer|send|swap|approve|erc20)\b/i;function F(r){if(!r)return"ETH";let e=r.toLowerCase(),a=v.exec(e);return a?x[a[1].toLowerCase()]??"other":e==="c60"||e==="eth"?"ETH":e==="atbash"?"ATBASH":e==="usdt"||e==="tether"?"USDT":e==="usdc"?"USDC":"other"}function m(r,...e){for(let a of e){let o=r[a];if(typeof o=="string"&&o.trim())return o.trim()}}function N(r,e){let a=e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0,o=a?m(a,"command","cmd","shell_command"):void 0,n=w.test(r),g=o?w.test(o):!1,t=o?y.test(o):!1;if(!n&&!g&&!t)return;let d=A=>o?new RegExp(`--${A}[= ]+(\\S+)`).exec(o)?.[1]:void 0,f=(a?m(a,"token","token_address","asset","currency"):void 0)??d("token");if(!f&&o){let A=y.exec(o);A&&(f=A[1])}let u=(a?m(a,"to","recipient","destination"):void 0)??d("to")??d("recipient"),l=(a?m(a,"amount","value","qty"):void 0)??d("amount"),s=F(f??""),i=o??r;return{operation:/\bswap\b/i.test(i)?"swap":/\b(approve|erc20)\b/i.test(i)?"approve":"transfer",asset:s,amount:l,recipient_status:u?"external":"unspecified",note:"canonicalized pre-judge; raw 0x addresses omitted (redacted upstream)"}}function _(r,e){let a=r??{},o=a.toolName??e.tool?.name??e.toolName??e.name??"unknown",n=a.params??e.params??a.args??e.args??a.arguments??e.arguments,g=JSON.stringify({tool_name:o,session_id:b(e.sessionKey??""),run_id:b(e.runId??""),agent_id:b(e.agentId??""),channel_id:b(e.channelId??""),account_id:b(e.accountId??"")});return{toolName:o,args:n,context:g,resolved:N(o,n)}}function T(r){return r.replace(/^~(?=\/|$)/,(0,E.homedir)())}function j(r){return r.memoryWorkspaceDir?T(r.memoryWorkspaceDir):process.cwd()}function L(r){if(r.judgeEndpoint)return r.judgeEndpointPolicy==="self-hosted"?{policy:"self-hosted",endpoint:r.judgeEndpoint,verifyPubKey:r.judgeVerifyPubKey??""}:{policy:"default",endpoint:r.judgeEndpoint}}function k(r){let e=r,a=h(e);if(a.enabled===!1){e.logger?.info?.("[atbash] plugin disabled via config");return}(0,c.setupTelemetry)({enabled:!0,source:"plugin:openclaw"}),process.once("beforeExit",()=>(0,c.shutdownTelemetry)()),process.once("SIGINT",()=>(0,c.shutdownTelemetry)().finally(()=>process.exit(0))),process.once("SIGTERM",()=>(0,c.shutdownTelemetry)().finally(()=>process.exit(0)));let o;try{o=c.Atbash.fromConfig({judge:L(a),keyPath:a.chromiaSecretPath,orgName:a.orgName,failClosed:a.enforceDecision!==!1,logger:e.logger})}catch(t){let d=t instanceof Error?t.message:String(t);throw e.logger?.warn?.("[atbash] init failed",{error:d}),t}let n=a.enforceDecision!==!1;e.logger?.info?.("[atbash] plugin loaded",{enforceDecision:n});let g=(0,c.createMemoryGuardManager)({auth:o.auth,workspaceDir:j(a),memoryFilePath:a.memoryFilePath?T(a.memoryFilePath):void 0,ttlMs:a.memorySyncTTLMs,rollbackMinScore:a.memoryRollbackMinScore,memoryPathPatterns:a.memoryPathPatterns,judgeEndpoint:a.judgeEndpoint,judgeVerifyPubKey:a.judgeVerifyPubKey,orgName:a.orgName,enforce:n,debug:!!a.debug,hostLogger:e.logger});if(g.runBootProbe().catch(t=>{e.logger?.warn?.("[atbash] boot probe failed",{error:t instanceof Error?t.message:String(t)})}),!e.on){e.logger?.warn?.("[atbash] on() API not available");return}e.on("before_tool_call",async(t,d)=>{let f;try{f=await g.handleBeforeToolCall(t,d)}catch(s){let i=s instanceof Error?s.message:String(s);return e.logger?.warn?.("[atbash] memory guard error",{error:i}),s instanceof c.MemoryIntegrityError||n?{block:!0,blockReason:`Memory guard error: ${i}`,allow:!1,reason:`Memory guard error: ${i}`}:{allow:!0}}if(f)return f;let u;try{u=await o.auditToolCall(_(t,d))}catch(s){let i=s instanceof Error?s.message:String(s);return e.logger?.warn?.("[atbash] unexpected error",{error:i}),n?{block:!0,blockReason:`Atbash unavailable: ${i}`,allow:!1,reason:`Atbash unavailable: ${i}`}:{allow:!0}}let l=u.reason??"";switch(u.verdict){case"BLOCK":return e.logger?.warn?.("[atbash] BLOCK",{reason:l}),n?{block:!0,blockReason:l,allow:!1,reason:l}:{allow:!0};case"HOLD":{let s=["Action held for operator review. The agent will not be jailed \u2014 please approve or reject this request from the Atbash dashboard, then ask the agent to try again.",`Reason: ${l}`];u.toolCallId&&s.push(`Tool Call ID: ${u.toolCallId}`);let i=s.join(`
-`);return e.logger?.warn?.("[atbash] HOLD",{reason:l,toolCallId:u.toolCallId}),n?{block:!0,blockReason:i,allow:!1,reason:i}:{allow:!0}}case"ERROR":return e.logger?.warn?.("[atbash] ERROR",{reason:l}),n?{block:!0,blockReason:l,allow:!1,reason:l}:{allow:!0};case"ALLOW":default:return e.logger?.info?.("[atbash] ALLOW",{reason:l}),{allow:!0}}})}
+"use strict";var y=Object.defineProperty;var N=Object.getOwnPropertyDescriptor;var P=Object.getOwnPropertyNames;var $=Object.prototype.hasOwnProperty;var I=(t,e)=>{for(var n in e)y(t,n,{get:e[n],enumerable:!0})},v=(t,e,n,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of P(e))!$.call(t,r)&&r!==n&&y(t,r,{get:()=>e[r],enumerable:!(o=N(e,r))||o.enumerable});return t};var D=t=>v(y({},"__esModule",{value:!0}),t);var Z={};I(Z,{default:()=>L});module.exports=D(Z);var R=require("os"),m=require("@atbash/sdk");var h="atbash-openclaw",j=["openclaw","atbash-plugin"];function E(t){return t.config?.plugins?.entries?.[h]?.config??{}}function x(t){let e=t.config?.plugins,n=e?.entries??{},o=Array.isArray(e?.allow)?e.allow:[],r=j.filter(a=>n[a]!==void 0||o.includes(a));if(r.length===0)return;let s=n[h]?.config!==void 0;t.logger?.warn?.(`[atbash] found config under former plugin id${r.length>1?"s":""} ${r.map(a=>`"${a}"`).join(", ")} \u2014 this plugin's id is "${h}" and those entries are ignored`+(s?". Remove them to avoid confusion.":`. No "${h}" config found, so the plugin is running on defaults \u2014 move your settings under "${h}".`),{formerIds:r,configured:s})}var F={"0xdac17f958d2ee523a2206206994597c13d831ec7":"USDT","0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48":"USDC","0x6b175474e89094c44da98b954eedeac495271d0f":"DAI","0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2":"WETH","0x2260fac5e5542a773aa44fbcfedf7c193bc2c599":"WBTC","0x1f9840a85d5af5bf1d1762f925bdaddc4201f984":"UNI","0x514910771af9ca656af840dff83e8264ecf986ca":"LINK","0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9":"AAVE","0xb0df6379ba1692841965a0745ac1bd3046d79ba3":"ATBASH","0xe9c094187219d9a29382c1a36fc43619c9257777":"ATBASH","0xf8b071428558c657a7a9aa1c43e152e75dd77777":"ATBASH"},A=/\b(0x[a-fA-F0-9]{40})\b/,M=/(0x[a-fA-F0-9]{40})/,C=/\b(transfer|send|swap|approve|erc20)\b/i;function O(t){if(!t)return"ETH";let e=t.toLowerCase(),n=M.exec(e);return n?F[n[1].toLowerCase()]??"other":e==="c60"||e==="eth"?"ETH":e==="atbash"?"ATBASH":e==="usdt"||e==="tether"?"USDT":e==="usdc"?"USDC":"other"}function w(t,...e){for(let n of e){let o=t[n];if(typeof o=="string"&&o.trim())return o.trim()}}function H(t,e){let n=e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0,o=n?w(n,"command","cmd","shell_command"):void 0,r=C.test(t),s=o?C.test(o):!1,a=o?A.test(o):!1;if(!r&&!s&&!a)return;let c=b=>o?new RegExp(`--${b}[= ]+(\\S+)`).exec(o)?.[1]:void 0,u=(n?w(n,"token","token_address","asset","currency"):void 0)??c("token");if(!u&&o){let b=A.exec(o);b&&(u=b[1])}let g=(n?w(n,"to","recipient","destination"):void 0)??c("to")??c("recipient"),f=(n?w(n,"amount","value","qty"):void 0)??c("amount"),d=O(u??""),i=o??t;return{operation:/\bswap\b/i.test(i)?"swap":/\b(approve|erc20)\b/i.test(i)?"approve":"transfer",asset:d,amount:f,recipient_status:g?"external":"unspecified",note:"canonicalized pre-judge; raw 0x addresses omitted (redacted upstream)"}}function _(t,e){let n=t??{},o=n.toolName??e.tool?.name??e.toolName??e.name??"unknown",r=n.params??e.params??n.args??e.args??n.arguments??e.arguments,s=JSON.stringify({tool_name:o});return{toolName:o,args:r,context:s,resolved:H(o,r)}}var W=["memory.md","dreams.md","claude.md","agents.md","/.openclaw/","/.claude/projects/","/memory/"];function S(t){let e=t.replace(/\\/g,"/").toLowerCase();return W.some(n=>e.includes(n))}var B=/^\*\*\* (Update|Add|Delete) File:\s*(.+?)\s*$/mg;function U(t,e){let n=t.split(`
+`),o=!1,r=[];for(let s of n){let a=/^\*\*\* (?:Update|Add|Delete) File:\s*(.+?)\s*$/.exec(s);if(a){o=a[1]===e;continue}o&&(s.startsWith("*** ")||s.startsWith("@@")||s.startsWith("+")&&r.push(s.slice(1)))}return r.join(`
+`)}function z(t){if(!t||typeof t!="object")return null;let e=t;if((e.toolName??e.tool_name??"").toString().toLowerCase()!=="apply_patch")return null;let o=e.params??e.args??e.arguments??{},r=o.input;if(typeof r!="string"||r.length===0)return null;let s=r.replace(/\r\n/g,`
+`),a=new RegExp(B.source,"mg"),c,u,g;for(;(g=a.exec(s))!==null;){let[,i,l]=g;if(i!=="Delete"&&S(l)){c=i,u=l;break}}if(!c||!u)return null;let f=U(s,u);return{...e,toolName:c==="Add"?"write":"edit",params:{...o,file_path:u,content:f,new_string:f}}}function p(t){let e=t.trim();return e.startsWith('"')&&e.endsWith('"')||e.startsWith("'")&&e.endsWith("'")?e.slice(1,-1):e}var K=/[|;&`$]|<\(|\)/;function G(t){return K.test(t)}function V(t){if(G(t))return null;let e=t.trim(),n=/^grep\b(?:\s+-\S+)*\s+\S+\s+(.+)$/.exec(e);if(n)return p(n[1]);let o=/^sed\b(?!\s+-i\b)(?:\s+-\S+)*\s+\S+\s+(.+)$/.exec(e);if(o)return p(o[1]);let r=/^(?:cat|less|more|head|tail)\b(?:\s+-\S+(?:\s+\S+)?)*\s+(.+)$/.exec(e);return r?p(r[1]):null}function q(t){if(/[|;&`$]|<\(|\)/.test(t))return null;let e=t.trim(),n=/^(?:echo|printf)\s+(.+?)\s*>>?\s*(\S+)\s*$/.exec(e);if(n)return{content:p(n[1]),path:p(n[2])};let o=/^tee\b(?:\s+-\S+)*\s+(\S+)\s*$/.exec(e);if(o)return{content:"",path:p(o[1])};let r=/^sed\s+-i(?:\s+-\S+)*\s+(\S+)\s+(\S+)\s*$/.exec(e);if(r)return{content:p(r[1]),path:p(r[2])};let s=/^awk\s+-i\s+inplace\b.*\s+(\S+)\s*$/.exec(e);if(s)return{content:"",path:p(s[1])};let a=/^(?:cp|mv)\b(?:\s+-\S+)*\s+\S+\s+(\S+)\s*$/.exec(e);return a?{content:"",path:p(a[1])}:null}var J=new Set(["exec","bash","shell","run_command","run_bash"]);function Y(t){if(!t||typeof t!="object")return null;let e=t,n=(e.toolName??e.tool_name??"").toString().toLowerCase();if(!J.has(n))return null;let r=e.params??e.args??e.arguments??{},s=r.command??r.cmd??r.script,a=typeof s=="string"?s:null;if(!a||a.length===0)return null;let c=q(a);if(c&&S(c.path))return{...e,toolName:"write",params:{...r,file_path:c.path,content:c.content}};let u=V(a);return u&&S(u)?{...e,toolName:"read",params:{...r,path:u}}:null}function k(t){return z(t)??Y(t)??t}function T(t){return t.replace(/^~(?=\/|$)/,(0,R.homedir)())}function X(t){return t.memoryWorkspaceDir?T(t.memoryWorkspaceDir):process.cwd()}function Q(t){if(t.judgeEndpoint)return t.judgeEndpointPolicy==="self-hosted"?{policy:"self-hosted",endpoint:t.judgeEndpoint,verifyPubKey:t.judgeVerifyPubKey??""}:{policy:"default",endpoint:t.judgeEndpoint}}function L(t){let e=t,n=E(e);if(x(e),n.enabled===!1){e.logger?.info?.("[atbash] plugin disabled via config");return}(0,m.setupTelemetry)({enabled:!0,source:"plugin:openclaw"}),process.once("beforeExit",()=>(0,m.shutdownTelemetry)()),process.once("SIGINT",()=>(0,m.shutdownTelemetry)().finally(()=>process.exit(0))),process.once("SIGTERM",()=>(0,m.shutdownTelemetry)().finally(()=>process.exit(0)));let o;try{o=m.Atbash.fromConfig({judge:Q(n),keyPath:n.chromiaSecretPath,orgName:n.orgName,failClosed:n.enforceDecision!==!1,logger:e.logger})}catch(a){let c=a instanceof Error?a.message:String(a);throw e.logger?.warn?.("[atbash] init failed",{error:c}),a}let r=n.enforceDecision!==!1;e.logger?.info?.("[atbash] plugin loaded",{enforceDecision:r});let s=(0,m.createMemoryGuardManager)({auth:o.auth,workspaceDir:X(n),memoryFilePath:n.memoryFilePath?T(n.memoryFilePath):void 0,ttlMs:n.memorySyncTTLMs,rollbackMinScore:n.memoryRollbackMinScore,memoryPathPatterns:n.memoryPathPatterns,judgeEndpoint:n.judgeEndpoint,judgeVerifyPubKey:n.judgeVerifyPubKey,orgName:n.orgName,enforce:r,debug:!!n.debug,hostLogger:e.logger});if(s.runBootProbe().catch(a=>{e.logger?.warn?.("[atbash] boot probe failed",{error:a instanceof Error?a.message:String(a)})}),!e.on){e.logger?.warn?.("[atbash] on() API not available");return}e.on("before_tool_call",async(a,c)=>{let u=k(a),g;try{g=await s.handleBeforeToolCall(u,c)}catch(i){let l=i instanceof Error?i.message:String(i);return e.logger?.warn?.("[atbash] memory guard error",{error:l}),i instanceof m.MemoryIntegrityError||r?{block:!0,blockReason:`Memory guard error: ${l}`,allow:!1,reason:`Memory guard error: ${l}`}:{allow:!0}}if(g)return g;let f;try{f=await o.auditToolCall(_(a,c))}catch(i){let l=i instanceof Error?i.message:String(i);return e.logger?.warn?.("[atbash] unexpected error",{error:l}),r?{block:!0,blockReason:`Atbash unavailable: ${l}`,allow:!1,reason:`Atbash unavailable: ${l}`}:{allow:!0}}let d=f.reason??"";switch(f.verdict){case"BLOCK":return e.logger?.warn?.("[atbash] BLOCK",{reason:d}),r?{block:!0,blockReason:d,allow:!1,reason:d}:{allow:!0};case"HOLD":{let i=["Action held for operator review. The agent will not be jailed \u2014 please approve or reject this request from the Atbash dashboard, then ask the agent to try again.",`Reason: ${d}`];f.toolCallId&&i.push(`Tool Call ID: ${f.toolCallId}`);let l=i.join(`
+`);return e.logger?.warn?.("[atbash] HOLD",{reason:d,toolCallId:f.toolCallId}),r?{block:!0,blockReason:l,allow:!1,reason:l}:{allow:!0}}case"ERROR":return e.logger?.warn?.("[atbash] ERROR",{reason:d}),r?{block:!0,blockReason:d,allow:!1,reason:d}:{allow:!0};case"ALLOW":if(f.allow===!0)return e.logger?.info?.("[atbash] ALLOW",{reason:d}),{allow:!0};break}{let i=String(f.verdict);if(e.logger?.warn?.("[atbash] unusable decision",{verdict:i,allow:f.allow,reason:d}),!r)return{allow:!0};let l=`Blocked (unusable Atbash decision ${i}): ${d}`;return{block:!0,blockReason:l,allow:!1,reason:l}}})}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/atbash-openclaw",
-  "version": "0.1.16",
+  "version": "0.1.17-dev.1",
   "description": "OpenClaw ATBASH tool-audit plugin. Thin adapter that maps OpenClaw's before_tool_call hook onto @atbash/sdk.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -11,10 +11,13 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsc && esbuild dist/index.js --bundle --platform=node --external:postchain-client --external:@atbash/sdk --minify --allow-overwrite --outfile=dist/index.js",
+    "build": "node scripts/clean.mjs && tsc && esbuild dist/index.js --bundle --platform=node --external:postchain-client --external:@atbash/sdk --minify --allow-overwrite --outfile=dist/index.js",
     "typecheck": "tsc --noEmit",
-    "release": "npm pkg set \"dependencies[@atbash/sdk]=^$(npm view @atbash/sdk dist-tags.latest)\" && npm version patch --no-git-tag-version && npm run build && npx npm@10 publish --access public",
-    "release:dev": "npm pkg set \"dependencies[@atbash/sdk]=$(npm view @atbash/sdk dist-tags.dev)\" && npm version prerelease --preid=dev --no-git-tag-version && npm run build && npx npm@10 publish --access public --tag dev"
+    "test": "tsc --noEmit && vitest run && node test/build.mjs && node --test test/verdict-handling.test.mjs test/safety-guard-doc.test.mjs",
+    "test:release": "node --test test/release-guard.test.mjs",
+    "verify:package": "node scripts/release.mjs --verify-current",
+    "release": "node scripts/release.mjs --channel latest",
+    "release:dev": "node scripts/release.mjs --channel dev"
   },
   "keywords": [
     "openclaw",
@@ -27,17 +30,24 @@
   ],
   "author": "atbash",
   "license": "LICENSED",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Atbash-Ai/atbash-openclaw-plugin",
+    "directory": "openclaw"
+  },
   "openclaw": {
     "extensions": [
       "./dist/index.js"
     ]
   },
   "dependencies": {
-    "@atbash/sdk": "^0.7.1"
+    "@atbash/sdk": "0.13.0-dev.0"
   },
   "devDependencies": {
     "@types/node": "^25.7.0",
     "esbuild": "^0.24.0",
-    "typescript": "^5.9.3"
+    "semver": "7.8.5",
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.6"
   }
 }