@atbash/atbash-openclaw 0.1.17-dev.0 → 0.1.17-dev.1

package/dist/context-mapper.js

@@ -1,32 +1,3 @@
-// Mirrors the server-side redact-secrets patterns. The server refuses signed
-// payloads that contain secrets because it cannot modify signed bytes — so we
-// must scrub them client-side before building the signed context string.
-const SECRET_PATTERNS = [
-    /\bsk-ant-[A-Za-z0-9_-]{20,}/g,
-    /\bsk-proj-[A-Za-z0-9_-]{20,}/g,
-    /\bsk-[A-Za-z0-9]{20,}/g,
-    /\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{30,}/g,
-    /\bAIza[0-9A-Za-z_-]{35}/g,
-    /\bya29\.[0-9A-Za-z_-]{20,}/g,
-    /\b(?:AKIA|ASIA|AGPA|AROA|ANPA|ANVA|ASCA|AIDA|AIPA)[0-9A-Z]{16}\b/g,
-    /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g,
-    /\bxox[abprseo]-[A-Za-z0-9-]{10,}/g,
-    /\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g,
-    /\bnpm_[A-Za-z0-9]{36,}\b/g,
-    /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
-    // Generic high-entropy token (32+ chars, mixed alpha+digit, not UUID, not 0x addr, not pure hex)
-    /\b(?!0x[0-9a-fA-F])(?![0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b)(?=[A-Za-z0-9_-]*[0-9])(?=[A-Za-z0-9_-]*[A-Za-z])(?![0-9a-fA-F]+$)[A-Za-z0-9_-]{32,}\b/g,
-    // Base64-encoded secrets (40+ chars with + or /)
-    /(?<![A-Za-z0-9+/])(?=[A-Za-z0-9+/]*[+/])(?=[A-Za-z0-9+/]*[0-9])(?=[A-Za-z0-9+/]*[A-Za-z])[A-Za-z0-9+/]{40,}={0,2}(?![A-Za-z0-9+/=])/g,
-];
-function redactValue(s) {
-    let out = s;
-    for (const re of SECRET_PATTERNS) {
-        re.lastIndex = 0;
-        out = out.replace(re, "[REDACTED]");
-    }
-    return out;
-}
 const ASSET_BY_CONTRACT = {
     "0xdac17f958d2ee523a2206206994597c13d831ec7": "USDT",
     "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48": "USDC",
@@ -114,16 +85,12 @@ export function mapEventToInput(event, ctx) {
         ctx.name ??
         "unknown";
     const args = ev.params ?? ctx.params ?? ev.args ?? ctx.args ?? ev.arguments ?? ctx.arguments;
-    // sessionKey is an auth credential (not a correlation ID) — never include it
-    // in signed bytes the server inspects. The remaining fields are redacted
-    // defensively in case the installed SDK binary has older patterns than the
-    // server's TypeScript containsSecret gate.
-    const context = JSON.stringify({
-        tool_name: toolName,
-        run_id: redactValue(ctx.runId ?? ""),
-        agent_id: redactValue(ctx.agentId ?? ""),
-        channel_id: redactValue(ctx.channelId ?? ""),
-        account_id: redactValue(ctx.accountId ?? ""),
-    });
+    // Only tool_name is safe to include in signed bytes — it's always a short
+    // tool name string, never a secret. The other context fields (run_id,
+    // agent_id, channel_id, account_id) come from openclaw internals and may
+    // contain high-entropy values that trigger the server's containsSecret gate,
+    // even after client-side redaction (pattern mismatch between SDK NAPI binary
+    // and server TypeScript).
+    const context = JSON.stringify({ tool_name: toolName });
     return { toolName, args, context, resolved: canonicalizeFinancial(toolName, args) };
 }

package/dist/event-normalizer.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Normalize openclaw tool events into the shape the SDK's memory classifier
+ * expects, so patch-style tools like `apply_patch` route through the memory
+ * guard instead of the generic tool-call audit.
+ *
+ * The SDK classifier reads:
+ *   - `event.toolName` in ["write", "edit", "multiedit"] (case-insensitive)
+ *   - `event.params.file_path` (or `.path`, `.filename`, `.target`, `.file`)
+ *   - `event.params.new_string` (or `.newText`, `.replacement`, `.content`)
+ *
+ * `apply_patch` events use `params.input` holding a raw OpenAI-style patch:
+ *
+ *   *** Begin Patch
+ *   *** Update File: /Users/…/MEMORY.md
+ *   @@
+ *   - old line
+ *   + new line
+ *   *** End Patch
+ *
+ * Which the classifier cannot introspect. This module parses the patch header,
+ * extracts the target file, and emits a synthetic `edit` (or `write` for
+ * `*** Add File`) event with the standard fields populated. Multi-file patches
+ * scan ALL file headers and normalize to the FIRST memory-shaped file found —
+ * so a non-memory file appearing before MEMORY.md in the patch doesn't hide it.
+ *
+ * Events the normalizer doesn't recognize are returned unchanged.
+ */
+interface OpenClawEvent {
+    toolName?: string;
+    tool_name?: string;
+    params?: Record<string, unknown>;
+    args?: Record<string, unknown>;
+    arguments?: Record<string, unknown>;
+    [k: string]: unknown;
+}
+/**
+ * If `event` is a patch-style tool call that touches a memory-shaped file,
+ * return a synthetic event the classifier can read. Otherwise return null.
+ *
+ * Multi-file patches are scanned in order; the first memory-shaped file
+ * encountered is used — a non-memory file appearing first does not hide a
+ * MEMORY.md that follows it.
+ */
+export declare function normalizeApplyPatch(event: unknown): OpenClawEvent | null;
+export declare function normalizeShellExec(event: unknown): OpenClawEvent | null;
+/**
+ * Apply every event normalizer in sequence. Returns the input unchanged when
+ * no normalizer matches. Pass the result to `handleBeforeToolCall` so the
+ * memory classifier sees a canonical shape. For the judge path, pass the
+ * original (un-normalized) event to `mapEventToInput` — the judge should log
+ * the real tool name and args, not the synthetic shape.
+ */
+export declare function normalizeEvent(event: unknown): unknown;
+export {};

package/dist/event-normalizer.js

@@ -0,0 +1,253 @@
+/**
+ * Normalize openclaw tool events into the shape the SDK's memory classifier
+ * expects, so patch-style tools like `apply_patch` route through the memory
+ * guard instead of the generic tool-call audit.
+ *
+ * The SDK classifier reads:
+ *   - `event.toolName` in ["write", "edit", "multiedit"] (case-insensitive)
+ *   - `event.params.file_path` (or `.path`, `.filename`, `.target`, `.file`)
+ *   - `event.params.new_string` (or `.newText`, `.replacement`, `.content`)
+ *
+ * `apply_patch` events use `params.input` holding a raw OpenAI-style patch:
+ *
+ *   *** Begin Patch
+ *   *** Update File: /Users/…/MEMORY.md
+ *   @@
+ *   - old line
+ *   + new line
+ *   *** End Patch
+ *
+ * Which the classifier cannot introspect. This module parses the patch header,
+ * extracts the target file, and emits a synthetic `edit` (or `write` for
+ * `*** Add File`) event with the standard fields populated. Multi-file patches
+ * scan ALL file headers and normalize to the FIRST memory-shaped file found —
+ * so a non-memory file appearing before MEMORY.md in the patch doesn't hide it.
+ *
+ * Events the normalizer doesn't recognize are returned unchanged.
+ */
+/* ── shared memory-path detection ─────────────────────────────────────── */
+/**
+ * File-path substrings that mark a memory-shaped target. Kept independent of
+ * the SDK classifier's list because the normalizers run BEFORE the classifier —
+ * if we synthesize a read/write event for a non-memory path, the guard would
+ * see the wrong tool name. Only synthesize when we can confirm the path is
+ * memory-shaped; otherwise pass the event through unchanged.
+ */
+const MEMORY_PATH_TOKENS = [
+    "memory.md",
+    "dreams.md",
+    "claude.md",
+    "agents.md",
+    "/.openclaw/",
+    "/.claude/projects/",
+    "/memory/",
+];
+function pathLooksLikeMemory(path) {
+    const lower = path.replace(/\\/g, "/").toLowerCase();
+    return MEMORY_PATH_TOKENS.some((tok) => lower.includes(tok));
+}
+/* ── apply_patch normalization ─────────────────────────────────────────── */
+const PATCH_FILE_HEADER_RE = /^\*\*\* (Update|Add|Delete) File:\s*(.+?)\s*$/mg;
+/**
+ * Extract `+` lines from the section of a multi-file patch that belongs to
+ * `filePath`, stopping at the next file header. Returns joined new content.
+ */
+function extractNewContentForFile(input, filePath) {
+    const lines = input.split("\n");
+    let collecting = false;
+    const newLines = [];
+    for (const line of lines) {
+        const headerMatch = /^\*\*\* (?:Update|Add|Delete) File:\s*(.+?)\s*$/.exec(line);
+        if (headerMatch) {
+            collecting = headerMatch[1] === filePath;
+            continue;
+        }
+        if (!collecting)
+            continue;
+        if (line.startsWith("*** ") || line.startsWith("@@"))
+            continue;
+        if (line.startsWith("+"))
+            newLines.push(line.slice(1));
+    }
+    return newLines.join("\n");
+}
+/**
+ * If `event` is a patch-style tool call that touches a memory-shaped file,
+ * return a synthetic event the classifier can read. Otherwise return null.
+ *
+ * Multi-file patches are scanned in order; the first memory-shaped file
+ * encountered is used — a non-memory file appearing first does not hide a
+ * MEMORY.md that follows it.
+ */
+export function normalizeApplyPatch(event) {
+    if (!event || typeof event !== "object")
+        return null;
+    const ev = event;
+    const toolName = (ev.toolName ?? ev.tool_name ?? "").toString().toLowerCase();
+    if (toolName !== "apply_patch")
+        return null;
+    const params = ev.params ?? ev.args ?? ev.arguments ?? {};
+    const input = params.input;
+    if (typeof input !== "string" || input.length === 0)
+        return null;
+    // Normalize CRLF so path extraction and content splitting work on all platforms.
+    const normalized = input.replace(/\r\n/g, "\n");
+    // Scan all file headers; find the first memory-shaped non-delete target.
+    const re = new RegExp(PATCH_FILE_HEADER_RE.source, "mg");
+    let verb;
+    let filePath;
+    let match;
+    while ((match = re.exec(normalized)) !== null) {
+        const [, v, fp] = match;
+        if (v === "Delete")
+            continue;
+        if (pathLooksLikeMemory(fp)) {
+            verb = v;
+            filePath = fp;
+            break;
+        }
+    }
+    if (!verb || !filePath)
+        return null;
+    const newContent = extractNewContentForFile(normalized, filePath);
+    const synthesizedTool = verb === "Add" ? "write" : "edit";
+    return {
+        ...ev,
+        toolName: synthesizedTool,
+        params: {
+            ...params,
+            file_path: filePath,
+            // "write" reads `content`; "edit" reads `new_string`. Populate both so
+            // whichever key the classifier picks first finds the content.
+            content: newContent,
+            new_string: newContent,
+        },
+    };
+}
+/* ── shell-exec normalization ──────────────────────────────────────────── */
+/** Strip surrounding single or double quotes; return the raw string otherwise. */
+function unquote(s) {
+    const t = s.trim();
+    if ((t.startsWith('"') && t.endsWith('"')) || (t.startsWith("'") && t.endsWith("'"))) {
+        return t.slice(1, -1);
+    }
+    return t;
+}
+/** Any shell metachar that turns a "simple command + file" into something we
+ * can't reliably parse: pipes, redirects (other than the write shape we
+ * handle explicitly), command chaining, subshells, backgrounding, expansion.
+ * When present we bail out so the normal judge sees the raw exec. */
+const SHELL_UNSAFE = /[|;&`$]|<\(|\)/;
+function hasUnsafeShellMetachars(command) {
+    return SHELL_UNSAFE.test(command);
+}
+/** Shell-read shapes: `cat|head|tail|less|more|grep [args] <path>` and
+ * `sed <expr> <path>` (no `-i`). Returns the extracted path or null. */
+function extractShellReadPath(command) {
+    if (hasUnsafeShellMetachars(command))
+        return null;
+    const trimmed = command.trim();
+    // grep <pattern> <path> — path is the last unquoted arg
+    const grep = /^grep\b(?:\s+-\S+)*\s+\S+\s+(.+)$/.exec(trimmed);
+    if (grep)
+        return unquote(grep[1]);
+    // sed WITHOUT -i is a read
+    const sed = /^sed\b(?!\s+-i\b)(?:\s+-\S+)*\s+\S+\s+(.+)$/.exec(trimmed);
+    if (sed)
+        return unquote(sed[1]);
+    // cat / less / more / head [-n N] / tail [-n N] — path is the last arg
+    const simpleRead = /^(?:cat|less|more|head|tail)\b(?:\s+-\S+(?:\s+\S+)?)*\s+(.+)$/.exec(trimmed);
+    if (simpleRead)
+        return unquote(simpleRead[1]);
+    return null;
+}
+/** Shell-write shapes. Returns {path, content} or null. */
+function extractShellWrite(command) {
+    // Writes explicitly use `>`/`>>`, so a metachar-guard that rejects `>` would
+    // also reject every real write. Instead reject only the metachars that mean
+    // "there's more than one command here": pipes, `;`, `&&`, `||`, subshells.
+    if (/[|;&`$]|<\(|\)/.test(command))
+        return null;
+    const trimmed = command.trim();
+    // echo/printf "..." > path (or >> path)
+    const redirect = /^(?:echo|printf)\s+(.+?)\s*>>?\s*(\S+)\s*$/.exec(trimmed);
+    if (redirect) {
+        return { content: unquote(redirect[1]), path: unquote(redirect[2]) };
+    }
+    // tee [-a] path — content arrives on stdin, unknown; scanner gets empty content
+    const tee = /^tee\b(?:\s+-\S+)*\s+(\S+)\s*$/.exec(trimmed);
+    if (tee)
+        return { content: "", path: unquote(tee[1]) };
+    // sed -i '<expr>' path — in-place edit; the expression is the intent
+    const sedInplace = /^sed\s+-i(?:\s+-\S+)*\s+(\S+)\s+(\S+)\s*$/.exec(trimmed);
+    if (sedInplace)
+        return { content: unquote(sedInplace[1]), path: unquote(sedInplace[2]) };
+    // awk -i inplace ... path — same shape
+    const awkInplace = /^awk\s+-i\s+inplace\b.*\s+(\S+)\s*$/.exec(trimmed);
+    if (awkInplace)
+        return { content: "", path: unquote(awkInplace[1]) };
+    // cp/mv src dest — source content is unknown; scanner gets empty content so
+    // the classifier routes it through the memory guard for policy gating even
+    // though we can't scan the incoming content.
+    const cpMv = /^(?:cp|mv)\b(?:\s+-\S+)*\s+\S+\s+(\S+)\s*$/.exec(trimmed);
+    if (cpMv)
+        return { content: "", path: unquote(cpMv[1]) };
+    return null;
+}
+/**
+ * If `event` is a shell-exec running an unambiguous read or write against a
+ * memory-shaped path, return a synthetic `read`/`write` event so the memory
+ * classifier can route it. Otherwise return null.
+ *
+ * Deliberately narrow: pipes, subshells, here-docs, multi-line scripts, and
+ * commands whose path can't be lifted out are left as `exec` for the normal
+ * judge to evaluate. Better to miss a rare shape than to misclassify a
+ * non-memory command as memory.
+ */
+const SHELL_EXEC_TOOL_NAMES = new Set(["exec", "bash", "shell", "run_command", "run_bash"]);
+export function normalizeShellExec(event) {
+    if (!event || typeof event !== "object")
+        return null;
+    const ev = event;
+    const toolName = (ev.toolName ?? ev.tool_name ?? "").toString().toLowerCase();
+    if (!SHELL_EXEC_TOOL_NAMES.has(toolName))
+        return null;
+    const params = ev.params ?? ev.args ?? ev.arguments ?? {};
+    const p = params;
+    // Different runtimes use different key names for the shell command.
+    const rawCommand = p.command ?? p.cmd ?? p.script;
+    const command = typeof rawCommand === "string" ? rawCommand : null;
+    if (!command || command.length === 0)
+        return null;
+    const write = extractShellWrite(command);
+    if (write && pathLooksLikeMemory(write.path)) {
+        return {
+            ...ev,
+            toolName: "write",
+            params: {
+                ...p,
+                file_path: write.path,
+                content: write.content,
+            },
+        };
+    }
+    const readPath = extractShellReadPath(command);
+    if (readPath && pathLooksLikeMemory(readPath)) {
+        return {
+            ...ev,
+            toolName: "read",
+            params: { ...p, path: readPath },
+        };
+    }
+    return null;
+}
+/**
+ * Apply every event normalizer in sequence. Returns the input unchanged when
+ * no normalizer matches. Pass the result to `handleBeforeToolCall` so the
+ * memory classifier sees a canonical shape. For the judge path, pass the
+ * original (un-normalized) event to `mapEventToInput` — the judge should log
+ * the real tool name and args, not the synthetic shape.
+ */
+export function normalizeEvent(event) {
+    return normalizeApplyPatch(event) ?? normalizeShellExec(event) ?? event;
+}

package/dist/event-normalizer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/event-normalizer.test.js

@@ -0,0 +1,282 @@
+import { describe, expect, it } from "vitest";
+import { normalizeApplyPatch, normalizeEvent, normalizeShellExec } from "./event-normalizer";
+const UPDATE_PATCH = [
+    "*** Begin Patch",
+    "*** Update File: /Users/m4/.openclaw/workspace/MEMORY.md",
+    "@@",
+    "-old line",
+    "+new line",
+    "*** End Patch",
+].join("\n");
+const ADD_PATCH = [
+    "*** Begin Patch",
+    "*** Add File: /Users/m4/.openclaw/workspace/NEW.md",
+    "+first",
+    "+second",
+    "*** End Patch",
+].join("\n");
+const DELETE_PATCH = [
+    "*** Begin Patch",
+    "*** Delete File: /Users/m4/.openclaw/workspace/GONE.md",
+    "*** End Patch",
+].join("\n");
+describe("normalizeApplyPatch", () => {
+    it("turns an Update File patch into an edit event with the target path", () => {
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: UPDATE_PATCH },
+        });
+        expect(out?.toolName).toBe("edit");
+        expect(out?.params?.file_path).toBe("/Users/m4/.openclaw/workspace/MEMORY.md");
+        expect(out?.params?.new_string).toBe("new line");
+    });
+    it("turns an Add File patch into a write event with content", () => {
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: ADD_PATCH },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe("/Users/m4/.openclaw/workspace/NEW.md");
+        expect(out?.params?.content).toBe("first\nsecond");
+    });
+    it("returns null for a Delete File patch (not a memory write)", () => {
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: DELETE_PATCH },
+        });
+        expect(out).toBeNull();
+    });
+    it("returns null for a non-apply_patch tool", () => {
+        expect(normalizeApplyPatch({ toolName: "edit", params: { file_path: "/x" } })).toBeNull();
+    });
+    it("returns null for apply_patch with no parseable header", () => {
+        expect(normalizeApplyPatch({ toolName: "apply_patch", params: { input: "garbage" } })).toBeNull();
+    });
+    it("preserves other event fields on the normalized output", () => {
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: UPDATE_PATCH },
+            runId: "r-1",
+            toolCallId: "tc-1",
+        });
+        expect(out?.runId).toBe("r-1");
+        expect(out?.toolCallId).toBe("tc-1");
+    });
+    it("finds a memory file that is NOT first in a multi-file patch", () => {
+        const multiPatch = [
+            "*** Begin Patch",
+            "*** Update File: /tmp/scratch.txt",
+            "@@",
+            "-old",
+            "+new",
+            "*** Update File: /Users/m4/.openclaw/workspace/MEMORY.md",
+            "@@",
+            "-old memory",
+            "+poisoned memory",
+            "*** End Patch",
+        ].join("\n");
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: multiPatch },
+        });
+        expect(out?.toolName).toBe("edit");
+        expect(out?.params?.file_path).toBe("/Users/m4/.openclaw/workspace/MEMORY.md");
+        expect(out?.params?.new_string).toBe("poisoned memory");
+    });
+    it("returns null when no file in the patch is memory-shaped", () => {
+        const nonMemoryPatch = [
+            "*** Begin Patch",
+            "*** Update File: /tmp/a.txt",
+            "@@",
+            "+line",
+            "*** Update File: /tmp/b.txt",
+            "@@",
+            "+line",
+            "*** End Patch",
+        ].join("\n");
+        expect(normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: nonMemoryPatch },
+        })).toBeNull();
+    });
+    it("handles CRLF line endings in patch input", () => {
+        const crlfPatch = [
+            "*** Begin Patch",
+            "*** Update File: /Users/m4/.openclaw/workspace/MEMORY.md",
+            "@@",
+            "-old line",
+            "+new line",
+            "*** End Patch",
+        ].join("\r\n");
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: crlfPatch },
+        });
+        expect(out?.toolName).toBe("edit");
+        expect(out?.params?.file_path).toBe("/Users/m4/.openclaw/workspace/MEMORY.md");
+        expect(out?.params?.new_string).toBe("new line");
+    });
+    it("extracts content only from the matched memory file section, not the whole patch", () => {
+        const multiPatch = [
+            "*** Begin Patch",
+            "*** Update File: /tmp/scratch.txt",
+            "@@",
+            "+non-memory content",
+            "*** Update File: /Users/m4/.openclaw/workspace/MEMORY.md",
+            "@@",
+            "+memory content",
+            "*** End Patch",
+        ].join("\n");
+        const out = normalizeApplyPatch({
+            toolName: "apply_patch",
+            params: { input: multiPatch },
+        });
+        expect(out?.params?.new_string).toBe("memory content");
+        expect(out?.params?.new_string).not.toContain("non-memory content");
+    });
+});
+describe("normalizeEvent", () => {
+    it("passes unrecognized events through unchanged", () => {
+        const ev = { toolName: "read", params: { path: "/x" } };
+        expect(normalizeEvent(ev)).toBe(ev);
+    });
+    it("applies the apply_patch normalizer when it matches", () => {
+        const out = normalizeEvent({
+            toolName: "apply_patch",
+            params: { input: UPDATE_PATCH },
+        });
+        expect(out.toolName).toBe("edit");
+        expect(out.params.file_path).toBe("/Users/m4/.openclaw/workspace/MEMORY.md");
+    });
+    it("applies the shell-exec normalizer when it matches", () => {
+        const out = normalizeEvent({
+            toolName: "exec",
+            params: { command: "cat /Users/m4/.openclaw/workspace/MEMORY.md" },
+        });
+        expect(out.toolName).toBe("read");
+        expect(out.params.path).toBe("/Users/m4/.openclaw/workspace/MEMORY.md");
+    });
+});
+describe("normalizeShellExec — reads", () => {
+    const MEM = "/Users/m4/.openclaw/workspace/MEMORY.md";
+    it.each([
+        ["cat", `cat ${MEM}`],
+        ["less", `less ${MEM}`],
+        ["more", `more ${MEM}`],
+        ["head -n 20", `head -n 20 ${MEM}`],
+        ["tail -n 5", `tail -n 5 ${MEM}`],
+        ["grep with pattern", `grep foo ${MEM}`],
+        ["sed without -i", `sed 's/x/y/' ${MEM}`],
+    ])("turns `%s` into a read event", (_label, command) => {
+        const out = normalizeShellExec({ toolName: "exec", params: { command } });
+        expect(out?.toolName).toBe("read");
+        expect(out?.params?.path).toBe(MEM);
+    });
+    it("returns null when the path is not memory-shaped", () => {
+        expect(normalizeShellExec({ toolName: "exec", params: { command: "cat /etc/hosts" } })).toBeNull();
+    });
+    it("returns null for pipes / subshells (unambiguous shapes only)", () => {
+        expect(normalizeShellExec({
+            toolName: "exec",
+            params: { command: `cat ${MEM} | grep foo` },
+        })).toBeNull();
+    });
+});
+describe("normalizeShellExec — writes", () => {
+    const MEM = "/Users/m4/.openclaw/workspace/MEMORY.md";
+    it("turns `echo \"...\" > path` into a write event with content", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { command: `echo "poison" > ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+        expect(out?.params?.content).toBe("poison");
+    });
+    it("turns `echo ... >> path` (append) into a write event", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { command: `echo "more" >> ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+        expect(out?.params?.content).toBe("more");
+    });
+    it("turns `tee path` into a write event with empty content", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { command: `tee ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+        expect(out?.params?.content).toBe("");
+    });
+    it("turns `sed -i ... path` into a write event carrying the sed expression", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { command: `sed -i 's/x/y/' ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+        expect(out?.params?.content).toBe("s/x/y/");
+    });
+    it("returns null when the write path is not memory-shaped", () => {
+        expect(normalizeShellExec({
+            toolName: "exec",
+            params: { command: `echo "x" > /tmp/scratch.txt` },
+        })).toBeNull();
+    });
+    it("returns null for a non-exec tool", () => {
+        expect(normalizeShellExec({
+            toolName: "write",
+            params: { file_path: MEM, content: "x" },
+        })).toBeNull();
+    });
+    it.each(["bash", "shell", "run_command", "run_bash"])("normalizes `%s` tool name as well as exec", (toolName) => {
+        const out = normalizeShellExec({
+            toolName,
+            params: { command: `echo "x" > ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+    });
+    it("reads the command from params.cmd when params.command is absent", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { cmd: `echo "x" > ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+    });
+    it("reads the command from params.script when params.command is absent", () => {
+        const out = normalizeShellExec({
+            toolName: "bash",
+            params: { script: `echo "x" > ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+    });
+    it("turns `cp src MEMORY.md` into a write event with empty content", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { command: `cp /attacker/payload ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+        expect(out?.params?.content).toBe("");
+    });
+    it("turns `mv src MEMORY.md` into a write event with empty content", () => {
+        const out = normalizeShellExec({
+            toolName: "exec",
+            params: { command: `mv /tmp/staged ${MEM}` },
+        });
+        expect(out?.toolName).toBe("write");
+        expect(out?.params?.file_path).toBe(MEM);
+        expect(out?.params?.content).toBe("");
+    });
+    it("returns null for cp/mv to a non-memory path", () => {
+        expect(normalizeShellExec({
+            toolName: "exec",
+            params: { command: "cp /a/b /tmp/c.txt" },
+        })).toBeNull();
+    });
+});

package/dist/index.js

@@ -1,2 +1,5 @@
-"use strict";var h=Object.defineProperty;var S=Object.getOwnPropertyDescriptor;var T=Object.getOwnPropertyNames;var z=Object.prototype.hasOwnProperty;var P=(r,e)=>{for(var o in e)h(r,o,{get:e[o],enumerable:!0})},Z=(r,e,o,a)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of T(e))!z.call(r,n)&&n!==o&&h(r,n,{get:()=>e[n],enumerable:!(a=S(e,n))||a.enumerable});return r};var v=r=>Z(h({},"__esModule",{value:!0}),r);var M={};P(M,{default:()=>R});module.exports=v(M);var k=require("os"),c=require("@atbash/sdk");var b="atbash-openclaw",x=["openclaw","atbash-plugin"];function w(r){return r.config?.plugins?.entries?.[b]?.config??{}}function y(r){let e=r.config?.plugins,o=e?.entries??{},a=Array.isArray(e?.allow)?e.allow:[],n=x.filter(t=>o[t]!==void 0||a.includes(t));if(n.length===0)return;let d=o[b]?.config!==void 0;r.logger?.warn?.(`[atbash] found config under former plugin id${n.length>1?"s":""} ${n.map(t=>`"${t}"`).join(", ")} \u2014 this plugin's id is "${b}" and those entries are ignored`+(d?". Remove them to avoid confusion.":`. No "${b}" config found, so the plugin is running on defaults \u2014 move your settings under "${b}".`),{formerIds:n,configured:d})}var D=[/\bsk-ant-[A-Za-z0-9_-]{20,}/g,/\bsk-proj-[A-Za-z0-9_-]{20,}/g,/\bsk-[A-Za-z0-9]{20,}/g,/\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{30,}/g,/\bAIza[0-9A-Za-z_-]{35}/g,/\bya29\.[0-9A-Za-z_-]{20,}/g,/\b(?:AKIA|ASIA|AGPA|AROA|ANPA|ANVA|ASCA|AIDA|AIPA)[0-9A-Z]{16}\b/g,/\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g,/\bxox[abprseo]-[A-Za-z0-9-]{10,}/g,/\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g,/\bnpm_[A-Za-z0-9]{36,}\b/g,/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,/\b(?!0x[0-9a-fA-F])(?![0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b)(?=[A-Za-z0-9_-]*[0-9])(?=[A-Za-z0-9_-]*[A-Za-z])(?![0-9a-fA-F]+$)[A-Za-z0-9_-]{32,}\b/g,/(?<![A-Za-z0-9+/])(?=[A-Za-z0-9+/]*[+/])(?=[A-Za-z0-9+/]*[0-9])(?=[A-Za-z0-9+/]*[A-Za-z])[A-Za-z0-9+/]{40,}={0,2}(?![A-Za-z0-9+/=])/g];function A(r){let e=r;for(let o of D)o.lastIndex=0,e=e.replace(o,"[REDACTED]");return e}var F={"0xdac17f958d2ee523a2206206994597c13d831ec7":"USDT","0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48":"USDC","0x6b175474e89094c44da98b954eedeac495271d0f":"DAI","0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2":"WETH","0x2260fac5e5542a773aa44fbcfedf7c193bc2c599":"WBTC","0x1f9840a85d5af5bf1d1762f925bdaddc4201f984":"UNI","0x514910771af9ca656af840dff83e8264ecf986ca":"LINK","0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9":"AAVE","0xb0df6379ba1692841965a0745ac1bd3046d79ba3":"ATBASH","0xe9c094187219d9a29382c1a36fc43619c9257777":"ATBASH","0xf8b071428558c657a7a9aa1c43e152e75dd77777":"ATBASH"},_=/\b(0x[a-fA-F0-9]{40})\b/,N=/(0x[a-fA-F0-9]{40})/,E=/\b(transfer|send|swap|approve|erc20)\b/i;function j(r){if(!r)return"ETH";let e=r.toLowerCase(),o=N.exec(e);return o?F[o[1].toLowerCase()]??"other":e==="c60"||e==="eth"?"ETH":e==="atbash"?"ATBASH":e==="usdt"||e==="tether"?"USDT":e==="usdc"?"USDC":"other"}function p(r,...e){for(let o of e){let a=r[o];if(typeof a=="string"&&a.trim())return a.trim()}}function $(r,e){let o=e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0,a=o?p(o,"command","cmd","shell_command"):void 0,n=E.test(r),d=a?E.test(a):!1,t=a?_.test(a):!1;if(!n&&!d&&!t)return;let f=m=>a?new RegExp(`--${m}[= ]+(\\S+)`).exec(a)?.[1]:void 0,g=(o?p(o,"token","token_address","asset","currency"):void 0)??f("token");if(!g&&a){let m=_.exec(a);m&&(g=m[1])}let u=(o?p(o,"to","recipient","destination"):void 0)??f("to")??f("recipient"),l=(o?p(o,"amount","value","qty"):void 0)??f("amount"),s=j(g??""),i=a??r;return{operation:/\bswap\b/i.test(i)?"swap":/\b(approve|erc20)\b/i.test(i)?"approve":"transfer",asset:s,amount:l,recipient_status:u?"external":"unspecified",note:"canonicalized pre-judge; raw 0x addresses omitted (redacted upstream)"}}function I(r,e){let o=r??{},a=o.toolName??e.tool?.name??e.toolName??e.name??"unknown",n=o.params??e.params??o.args??e.args??o.arguments??e.arguments,d=JSON.stringify({tool_name:a,run_id:A(e.runId??""),agent_id:A(e.agentId??""),channel_id:A(e.channelId??""),account_id:A(e.accountId??"")});return{toolName:a,args:n,context:d,resolved:$(a,n)}}function C(r){return r.replace(/^~(?=\/|$)/,(0,k.homedir)())}function L(r){return r.memoryWorkspaceDir?C(r.memoryWorkspaceDir):process.cwd()}function O(r){if(r.judgeEndpoint)return r.judgeEndpointPolicy==="self-hosted"?{policy:"self-hosted",endpoint:r.judgeEndpoint,verifyPubKey:r.judgeVerifyPubKey??""}:{policy:"default",endpoint:r.judgeEndpoint}}function R(r){let e=r,o=w(e);if(y(e),o.enabled===!1){e.logger?.info?.("[atbash] plugin disabled via config");return}(0,c.setupTelemetry)({enabled:!0,source:"plugin:openclaw"}),process.once("beforeExit",()=>(0,c.shutdownTelemetry)()),process.once("SIGINT",()=>(0,c.shutdownTelemetry)().finally(()=>process.exit(0))),process.once("SIGTERM",()=>(0,c.shutdownTelemetry)().finally(()=>process.exit(0)));let a;try{a=c.Atbash.fromConfig({judge:O(o),keyPath:o.chromiaSecretPath,orgName:o.orgName,failClosed:o.enforceDecision!==!1,logger:e.logger})}catch(t){let f=t instanceof Error?t.message:String(t);throw e.logger?.warn?.("[atbash] init failed",{error:f}),t}let n=o.enforceDecision!==!1;e.logger?.info?.("[atbash] plugin loaded",{enforceDecision:n});let d=(0,c.createMemoryGuardManager)({auth:a.auth,workspaceDir:L(o),memoryFilePath:o.memoryFilePath?C(o.memoryFilePath):void 0,ttlMs:o.memorySyncTTLMs,rollbackMinScore:o.memoryRollbackMinScore,memoryPathPatterns:o.memoryPathPatterns,judgeEndpoint:o.judgeEndpoint,judgeVerifyPubKey:o.judgeVerifyPubKey,orgName:o.orgName,enforce:n,debug:!!o.debug,hostLogger:e.logger});if(d.runBootProbe().catch(t=>{e.logger?.warn?.("[atbash] boot probe failed",{error:t instanceof Error?t.message:String(t)})}),!e.on){e.logger?.warn?.("[atbash] on() API not available");return}e.on("before_tool_call",async(t,f)=>{let g;try{g=await d.handleBeforeToolCall(t,f)}catch(s){let i=s instanceof Error?s.message:String(s);return e.logger?.warn?.("[atbash] memory guard error",{error:i}),s instanceof c.MemoryIntegrityError||n?{block:!0,blockReason:`Memory guard error: ${i}`,allow:!1,reason:`Memory guard error: ${i}`}:{allow:!0}}if(g)return g;let u;try{u=await a.auditToolCall(I(t,f))}catch(s){let i=s instanceof Error?s.message:String(s);return e.logger?.warn?.("[atbash] unexpected error",{error:i}),n?{block:!0,blockReason:`Atbash unavailable: ${i}`,allow:!1,reason:`Atbash unavailable: ${i}`}:{allow:!0}}let l=u.reason??"";switch(u.verdict){case"BLOCK":return e.logger?.warn?.("[atbash] BLOCK",{reason:l}),n?{block:!0,blockReason:l,allow:!1,reason:l}:{allow:!0};case"HOLD":{let s=["Action held for operator review. The agent will not be jailed \u2014 please approve or reject this request from the Atbash dashboard, then ask the agent to try again.",`Reason: ${l}`];u.toolCallId&&s.push(`Tool Call ID: ${u.toolCallId}`);let i=s.join(`
-`);return e.logger?.warn?.("[atbash] HOLD",{reason:l,toolCallId:u.toolCallId}),n?{block:!0,blockReason:i,allow:!1,reason:i}:{allow:!0}}case"ERROR":return e.logger?.warn?.("[atbash] ERROR",{reason:l}),n?{block:!0,blockReason:l,allow:!1,reason:l}:{allow:!0};case"ALLOW":if(u.allow===!0)return e.logger?.info?.("[atbash] ALLOW",{reason:l}),{allow:!0};break}{let s=String(u.verdict);if(e.logger?.warn?.("[atbash] unusable decision",{verdict:s,allow:u.allow,reason:l}),!n)return{allow:!0};let i=`Blocked (unusable Atbash decision ${s}): ${l}`;return{block:!0,blockReason:i,allow:!1,reason:i}}})}
+"use strict";var y=Object.defineProperty;var N=Object.getOwnPropertyDescriptor;var P=Object.getOwnPropertyNames;var $=Object.prototype.hasOwnProperty;var I=(t,e)=>{for(var n in e)y(t,n,{get:e[n],enumerable:!0})},v=(t,e,n,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let r of P(e))!$.call(t,r)&&r!==n&&y(t,r,{get:()=>e[r],enumerable:!(o=N(e,r))||o.enumerable});return t};var D=t=>v(y({},"__esModule",{value:!0}),t);var Z={};I(Z,{default:()=>L});module.exports=D(Z);var R=require("os"),m=require("@atbash/sdk");var h="atbash-openclaw",j=["openclaw","atbash-plugin"];function E(t){return t.config?.plugins?.entries?.[h]?.config??{}}function x(t){let e=t.config?.plugins,n=e?.entries??{},o=Array.isArray(e?.allow)?e.allow:[],r=j.filter(a=>n[a]!==void 0||o.includes(a));if(r.length===0)return;let s=n[h]?.config!==void 0;t.logger?.warn?.(`[atbash] found config under former plugin id${r.length>1?"s":""} ${r.map(a=>`"${a}"`).join(", ")} \u2014 this plugin's id is "${h}" and those entries are ignored`+(s?". Remove them to avoid confusion.":`. No "${h}" config found, so the plugin is running on defaults \u2014 move your settings under "${h}".`),{formerIds:r,configured:s})}var F={"0xdac17f958d2ee523a2206206994597c13d831ec7":"USDT","0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48":"USDC","0x6b175474e89094c44da98b954eedeac495271d0f":"DAI","0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2":"WETH","0x2260fac5e5542a773aa44fbcfedf7c193bc2c599":"WBTC","0x1f9840a85d5af5bf1d1762f925bdaddc4201f984":"UNI","0x514910771af9ca656af840dff83e8264ecf986ca":"LINK","0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9":"AAVE","0xb0df6379ba1692841965a0745ac1bd3046d79ba3":"ATBASH","0xe9c094187219d9a29382c1a36fc43619c9257777":"ATBASH","0xf8b071428558c657a7a9aa1c43e152e75dd77777":"ATBASH"},A=/\b(0x[a-fA-F0-9]{40})\b/,M=/(0x[a-fA-F0-9]{40})/,C=/\b(transfer|send|swap|approve|erc20)\b/i;function O(t){if(!t)return"ETH";let e=t.toLowerCase(),n=M.exec(e);return n?F[n[1].toLowerCase()]??"other":e==="c60"||e==="eth"?"ETH":e==="atbash"?"ATBASH":e==="usdt"||e==="tether"?"USDT":e==="usdc"?"USDC":"other"}function w(t,...e){for(let n of e){let o=t[n];if(typeof o=="string"&&o.trim())return o.trim()}}function H(t,e){let n=e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0,o=n?w(n,"command","cmd","shell_command"):void 0,r=C.test(t),s=o?C.test(o):!1,a=o?A.test(o):!1;if(!r&&!s&&!a)return;let c=b=>o?new RegExp(`--${b}[= ]+(\\S+)`).exec(o)?.[1]:void 0,u=(n?w(n,"token","token_address","asset","currency"):void 0)??c("token");if(!u&&o){let b=A.exec(o);b&&(u=b[1])}let g=(n?w(n,"to","recipient","destination"):void 0)??c("to")??c("recipient"),f=(n?w(n,"amount","value","qty"):void 0)??c("amount"),d=O(u??""),i=o??t;return{operation:/\bswap\b/i.test(i)?"swap":/\b(approve|erc20)\b/i.test(i)?"approve":"transfer",asset:d,amount:f,recipient_status:g?"external":"unspecified",note:"canonicalized pre-judge; raw 0x addresses omitted (redacted upstream)"}}function _(t,e){let n=t??{},o=n.toolName??e.tool?.name??e.toolName??e.name??"unknown",r=n.params??e.params??n.args??e.args??n.arguments??e.arguments,s=JSON.stringify({tool_name:o});return{toolName:o,args:r,context:s,resolved:H(o,r)}}var W=["memory.md","dreams.md","claude.md","agents.md","/.openclaw/","/.claude/projects/","/memory/"];function S(t){let e=t.replace(/\\/g,"/").toLowerCase();return W.some(n=>e.includes(n))}var B=/^\*\*\* (Update|Add|Delete) File:\s*(.+?)\s*$/mg;function U(t,e){let n=t.split(`
+`),o=!1,r=[];for(let s of n){let a=/^\*\*\* (?:Update|Add|Delete) File:\s*(.+?)\s*$/.exec(s);if(a){o=a[1]===e;continue}o&&(s.startsWith("*** ")||s.startsWith("@@")||s.startsWith("+")&&r.push(s.slice(1)))}return r.join(`
+`)}function z(t){if(!t||typeof t!="object")return null;let e=t;if((e.toolName??e.tool_name??"").toString().toLowerCase()!=="apply_patch")return null;let o=e.params??e.args??e.arguments??{},r=o.input;if(typeof r!="string"||r.length===0)return null;let s=r.replace(/\r\n/g,`
+`),a=new RegExp(B.source,"mg"),c,u,g;for(;(g=a.exec(s))!==null;){let[,i,l]=g;if(i!=="Delete"&&S(l)){c=i,u=l;break}}if(!c||!u)return null;let f=U(s,u);return{...e,toolName:c==="Add"?"write":"edit",params:{...o,file_path:u,content:f,new_string:f}}}function p(t){let e=t.trim();return e.startsWith('"')&&e.endsWith('"')||e.startsWith("'")&&e.endsWith("'")?e.slice(1,-1):e}var K=/[|;&`$]|<\(|\)/;function G(t){return K.test(t)}function V(t){if(G(t))return null;let e=t.trim(),n=/^grep\b(?:\s+-\S+)*\s+\S+\s+(.+)$/.exec(e);if(n)return p(n[1]);let o=/^sed\b(?!\s+-i\b)(?:\s+-\S+)*\s+\S+\s+(.+)$/.exec(e);if(o)return p(o[1]);let r=/^(?:cat|less|more|head|tail)\b(?:\s+-\S+(?:\s+\S+)?)*\s+(.+)$/.exec(e);return r?p(r[1]):null}function q(t){if(/[|;&`$]|<\(|\)/.test(t))return null;let e=t.trim(),n=/^(?:echo|printf)\s+(.+?)\s*>>?\s*(\S+)\s*$/.exec(e);if(n)return{content:p(n[1]),path:p(n[2])};let o=/^tee\b(?:\s+-\S+)*\s+(\S+)\s*$/.exec(e);if(o)return{content:"",path:p(o[1])};let r=/^sed\s+-i(?:\s+-\S+)*\s+(\S+)\s+(\S+)\s*$/.exec(e);if(r)return{content:p(r[1]),path:p(r[2])};let s=/^awk\s+-i\s+inplace\b.*\s+(\S+)\s*$/.exec(e);if(s)return{content:"",path:p(s[1])};let a=/^(?:cp|mv)\b(?:\s+-\S+)*\s+\S+\s+(\S+)\s*$/.exec(e);return a?{content:"",path:p(a[1])}:null}var J=new Set(["exec","bash","shell","run_command","run_bash"]);function Y(t){if(!t||typeof t!="object")return null;let e=t,n=(e.toolName??e.tool_name??"").toString().toLowerCase();if(!J.has(n))return null;let r=e.params??e.args??e.arguments??{},s=r.command??r.cmd??r.script,a=typeof s=="string"?s:null;if(!a||a.length===0)return null;let c=q(a);if(c&&S(c.path))return{...e,toolName:"write",params:{...r,file_path:c.path,content:c.content}};let u=V(a);return u&&S(u)?{...e,toolName:"read",params:{...r,path:u}}:null}function k(t){return z(t)??Y(t)??t}function T(t){return t.replace(/^~(?=\/|$)/,(0,R.homedir)())}function X(t){return t.memoryWorkspaceDir?T(t.memoryWorkspaceDir):process.cwd()}function Q(t){if(t.judgeEndpoint)return t.judgeEndpointPolicy==="self-hosted"?{policy:"self-hosted",endpoint:t.judgeEndpoint,verifyPubKey:t.judgeVerifyPubKey??""}:{policy:"default",endpoint:t.judgeEndpoint}}function L(t){let e=t,n=E(e);if(x(e),n.enabled===!1){e.logger?.info?.("[atbash] plugin disabled via config");return}(0,m.setupTelemetry)({enabled:!0,source:"plugin:openclaw"}),process.once("beforeExit",()=>(0,m.shutdownTelemetry)()),process.once("SIGINT",()=>(0,m.shutdownTelemetry)().finally(()=>process.exit(0))),process.once("SIGTERM",()=>(0,m.shutdownTelemetry)().finally(()=>process.exit(0)));let o;try{o=m.Atbash.fromConfig({judge:Q(n),keyPath:n.chromiaSecretPath,orgName:n.orgName,failClosed:n.enforceDecision!==!1,logger:e.logger})}catch(a){let c=a instanceof Error?a.message:String(a);throw e.logger?.warn?.("[atbash] init failed",{error:c}),a}let r=n.enforceDecision!==!1;e.logger?.info?.("[atbash] plugin loaded",{enforceDecision:r});let s=(0,m.createMemoryGuardManager)({auth:o.auth,workspaceDir:X(n),memoryFilePath:n.memoryFilePath?T(n.memoryFilePath):void 0,ttlMs:n.memorySyncTTLMs,rollbackMinScore:n.memoryRollbackMinScore,memoryPathPatterns:n.memoryPathPatterns,judgeEndpoint:n.judgeEndpoint,judgeVerifyPubKey:n.judgeVerifyPubKey,orgName:n.orgName,enforce:r,debug:!!n.debug,hostLogger:e.logger});if(s.runBootProbe().catch(a=>{e.logger?.warn?.("[atbash] boot probe failed",{error:a instanceof Error?a.message:String(a)})}),!e.on){e.logger?.warn?.("[atbash] on() API not available");return}e.on("before_tool_call",async(a,c)=>{let u=k(a),g;try{g=await s.handleBeforeToolCall(u,c)}catch(i){let l=i instanceof Error?i.message:String(i);return e.logger?.warn?.("[atbash] memory guard error",{error:l}),i instanceof m.MemoryIntegrityError||r?{block:!0,blockReason:`Memory guard error: ${l}`,allow:!1,reason:`Memory guard error: ${l}`}:{allow:!0}}if(g)return g;let f;try{f=await o.auditToolCall(_(a,c))}catch(i){let l=i instanceof Error?i.message:String(i);return e.logger?.warn?.("[atbash] unexpected error",{error:l}),r?{block:!0,blockReason:`Atbash unavailable: ${l}`,allow:!1,reason:`Atbash unavailable: ${l}`}:{allow:!0}}let d=f.reason??"";switch(f.verdict){case"BLOCK":return e.logger?.warn?.("[atbash] BLOCK",{reason:d}),r?{block:!0,blockReason:d,allow:!1,reason:d}:{allow:!0};case"HOLD":{let i=["Action held for operator review. The agent will not be jailed \u2014 please approve or reject this request from the Atbash dashboard, then ask the agent to try again.",`Reason: ${d}`];f.toolCallId&&i.push(`Tool Call ID: ${f.toolCallId}`);let l=i.join(`
+`);return e.logger?.warn?.("[atbash] HOLD",{reason:d,toolCallId:f.toolCallId}),r?{block:!0,blockReason:l,allow:!1,reason:l}:{allow:!0}}case"ERROR":return e.logger?.warn?.("[atbash] ERROR",{reason:d}),r?{block:!0,blockReason:d,allow:!1,reason:d}:{allow:!0};case"ALLOW":if(f.allow===!0)return e.logger?.info?.("[atbash] ALLOW",{reason:d}),{allow:!0};break}{let i=String(f.verdict);if(e.logger?.warn?.("[atbash] unusable decision",{verdict:i,allow:f.allow,reason:d}),!r)return{allow:!0};let l=`Blocked (unusable Atbash decision ${i}): ${d}`;return{block:!0,blockReason:l,allow:!1,reason:l}}})}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/atbash-openclaw",
-  "version": "0.1.17-dev.0",
+  "version": "0.1.17-dev.1",
   "description": "OpenClaw ATBASH tool-audit plugin. Thin adapter that maps OpenClaw's before_tool_call hook onto @atbash/sdk.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -41,7 +41,7 @@
     ]
   },
   "dependencies": {
-    "@atbash/sdk": "0.10.13-dev.0"
+    "@atbash/sdk": "0.13.0-dev.0"
   },
   "devDependencies": {
     "@types/node": "^25.7.0",