@atbash/atbash-openclaw 0.1.17 → 0.1.19-dev.0

package/dist/context-mapper.js

@@ -1,32 +1,3 @@
-// Mirrors the server-side redact-secrets patterns. The server refuses signed
-// payloads that contain secrets because it cannot modify signed bytes — so we
-// must scrub them client-side before building the signed context string.
-const SECRET_PATTERNS = [
-    /\bsk-ant-[A-Za-z0-9_-]{20,}/g,
-    /\bsk-proj-[A-Za-z0-9_-]{20,}/g,
-    /\bsk-[A-Za-z0-9]{20,}/g,
-    /\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{30,}/g,
-    /\bAIza[0-9A-Za-z_-]{35}/g,
-    /\bya29\.[0-9A-Za-z_-]{20,}/g,
-    /\b(?:AKIA|ASIA|AGPA|AROA|ANPA|ANVA|ASCA|AIDA|AIPA)[0-9A-Z]{16}\b/g,
-    /\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g,
-    /\bxox[abprseo]-[A-Za-z0-9-]{10,}/g,
-    /\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g,
-    /\bnpm_[A-Za-z0-9]{36,}\b/g,
-    /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,
-    // Generic high-entropy token (32+ chars, mixed alpha+digit, not UUID, not 0x addr, not pure hex)
-    /\b(?!0x[0-9a-fA-F])(?![0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b)(?=[A-Za-z0-9_-]*[0-9])(?=[A-Za-z0-9_-]*[A-Za-z])(?![0-9a-fA-F]+$)[A-Za-z0-9_-]{32,}\b/g,
-    // Base64-encoded secrets (40+ chars with + or /)
-    /(?<![A-Za-z0-9+/])(?=[A-Za-z0-9+/]*[+/])(?=[A-Za-z0-9+/]*[0-9])(?=[A-Za-z0-9+/]*[A-Za-z])[A-Za-z0-9+/]{40,}={0,2}(?![A-Za-z0-9+/=])/g,
-];
-function redactValue(s) {
-    let out = s;
-    for (const re of SECRET_PATTERNS) {
-        re.lastIndex = 0;
-        out = out.replace(re, "[REDACTED]");
-    }
-    return out;
-}
 const ASSET_BY_CONTRACT = {
     "0xdac17f958d2ee523a2206206994597c13d831ec7": "USDT",
     "0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48": "USDC",
@@ -114,16 +85,12 @@ export function mapEventToInput(event, ctx) {
         ctx.name ??
         "unknown";
     const args = ev.params ?? ctx.params ?? ev.args ?? ctx.args ?? ev.arguments ?? ctx.arguments;
-    // sessionKey is an auth credential (not a correlation ID) — never include it
-    // in signed bytes the server inspects. The remaining fields are redacted
-    // defensively in case the installed SDK binary has older patterns than the
-    // server's TypeScript containsSecret gate.
-    const context = JSON.stringify({
-        tool_name: toolName,
-        run_id: redactValue(ctx.runId ?? ""),
-        agent_id: redactValue(ctx.agentId ?? ""),
-        channel_id: redactValue(ctx.channelId ?? ""),
-        account_id: redactValue(ctx.accountId ?? ""),
-    });
+    // Only tool_name is safe to include in signed bytes — it's always a short
+    // tool name string, never a secret. The other context fields (run_id,
+    // agent_id, channel_id, account_id) come from openclaw internals and may
+    // contain high-entropy values that trigger the server's containsSecret gate,
+    // even after client-side redaction (pattern mismatch between SDK NAPI binary
+    // and server TypeScript).
+    const context = JSON.stringify({ tool_name: toolName });
     return { toolName, args, context, resolved: canonicalizeFinancial(toolName, args) };
 }

package/dist/index.js

@@ -1,2 +1,2 @@
-"use strict";var p=Object.defineProperty;var I=Object.getOwnPropertyDescriptor;var z=Object.getOwnPropertyNames;var C=Object.prototype.hasOwnProperty;var S=(r,e)=>{for(var a in e)p(r,a,{get:e[a],enumerable:!0})},R=(r,e,a,o)=>{if(e&&typeof e=="object"||typeof e=="function")for(let n of z(e))!C.call(r,n)&&n!==a&&p(r,n,{get:()=>e[n],enumerable:!(o=I(e,n))||o.enumerable});return r};var Z=r=>R(p({},"__esModule",{value:!0}),r);var O={};S(O,{default:()=>k});module.exports=Z(O);var E=require("os"),i=require("@atbash/sdk");var P="atbash-openclaw";function h(r){return r.config?.plugins?.entries?.[P]?.config??{}}var x=[/\bsk-ant-[A-Za-z0-9_-]{20,}/g,/\bsk-proj-[A-Za-z0-9_-]{20,}/g,/\bsk-[A-Za-z0-9]{20,}/g,/\b(?:gh[pousr]|github_pat)_[A-Za-z0-9_]{30,}/g,/\bAIza[0-9A-Za-z_-]{35}/g,/\bya29\.[0-9A-Za-z_-]{20,}/g,/\b(?:AKIA|ASIA|AGPA|AROA|ANPA|ANVA|ASCA|AIDA|AIPA)[0-9A-Z]{16}\b/g,/\b(?:sk|rk|pk)_(?:live|test)_[A-Za-z0-9]{20,}/g,/\bxox[abprseo]-[A-Za-z0-9-]{10,}/g,/\bSG\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}/g,/\bnpm_[A-Za-z0-9]{36,}\b/g,/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/g,/\b(?!0x[0-9a-fA-F])(?![0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\b)(?=[A-Za-z0-9_-]*[0-9])(?=[A-Za-z0-9_-]*[A-Za-z])(?![0-9a-fA-F]+$)[A-Za-z0-9_-]{32,}\b/g,/(?<![A-Za-z0-9+/])(?=[A-Za-z0-9+/]*[+/])(?=[A-Za-z0-9+/]*[0-9])(?=[A-Za-z0-9+/]*[A-Za-z])[A-Za-z0-9+/]{40,}={0,2}(?![A-Za-z0-9+/=])/g];function A(r){let e=r;for(let a of x)a.lastIndex=0,e=e.replace(a,"[REDACTED]");return e}var D={"0xdac17f958d2ee523a2206206994597c13d831ec7":"USDT","0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48":"USDC","0x6b175474e89094c44da98b954eedeac495271d0f":"DAI","0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2":"WETH","0x2260fac5e5542a773aa44fbcfedf7c193bc2c599":"WBTC","0x1f9840a85d5af5bf1d1762f925bdaddc4201f984":"UNI","0x514910771af9ca656af840dff83e8264ecf986ca":"LINK","0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9":"AAVE","0xb0df6379ba1692841965a0745ac1bd3046d79ba3":"ATBASH","0xe9c094187219d9a29382c1a36fc43619c9257777":"ATBASH","0xf8b071428558c657a7a9aa1c43e152e75dd77777":"ATBASH"},y=/\b(0x[a-fA-F0-9]{40})\b/,v=/(0x[a-fA-F0-9]{40})/,w=/\b(transfer|send|swap|approve|erc20)\b/i;function F(r){if(!r)return"ETH";let e=r.toLowerCase(),a=v.exec(e);return a?D[a[1].toLowerCase()]??"other":e==="c60"||e==="eth"?"ETH":e==="atbash"?"ATBASH":e==="usdt"||e==="tether"?"USDT":e==="usdc"?"USDC":"other"}function m(r,...e){for(let a of e){let o=r[a];if(typeof o=="string"&&o.trim())return o.trim()}}function N(r,e){let a=e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0,o=a?m(a,"command","cmd","shell_command"):void 0,n=w.test(r),g=o?w.test(o):!1,t=o?y.test(o):!1;if(!n&&!g&&!t)return;let d=b=>o?new RegExp(`--${b}[= ]+(\\S+)`).exec(o)?.[1]:void 0,f=(a?m(a,"token","token_address","asset","currency"):void 0)??d("token");if(!f&&o){let b=y.exec(o);b&&(f=b[1])}let u=(a?m(a,"to","recipient","destination"):void 0)??d("to")??d("recipient"),l=(a?m(a,"amount","value","qty"):void 0)??d("amount"),s=F(f??""),c=o??r;return{operation:/\bswap\b/i.test(c)?"swap":/\b(approve|erc20)\b/i.test(c)?"approve":"transfer",asset:s,amount:l,recipient_status:u?"external":"unspecified",note:"canonicalized pre-judge; raw 0x addresses omitted (redacted upstream)"}}function _(r,e){let a=r??{},o=a.toolName??e.tool?.name??e.toolName??e.name??"unknown",n=a.params??e.params??a.args??e.args??a.arguments??e.arguments,g=JSON.stringify({tool_name:o,run_id:A(e.runId??""),agent_id:A(e.agentId??""),channel_id:A(e.channelId??""),account_id:A(e.accountId??"")});return{toolName:o,args:n,context:g,resolved:N(o,n)}}function T(r){return r.replace(/^~(?=\/|$)/,(0,E.homedir)())}function j(r){return r.memoryWorkspaceDir?T(r.memoryWorkspaceDir):process.cwd()}function L(r){if(r.judgeEndpoint)return r.judgeEndpointPolicy==="self-hosted"?{policy:"self-hosted",endpoint:r.judgeEndpoint,verifyPubKey:r.judgeVerifyPubKey??""}:{policy:"default",endpoint:r.judgeEndpoint}}function k(r){let e=r,a=h(e);if(a.enabled===!1){e.logger?.info?.("[atbash] plugin disabled via config");return}(0,i.setupTelemetry)({enabled:!0,source:"plugin:openclaw"}),process.once("beforeExit",()=>(0,i.shutdownTelemetry)()),process.once("SIGINT",()=>(0,i.shutdownTelemetry)().finally(()=>process.exit(0))),process.once("SIGTERM",()=>(0,i.shutdownTelemetry)().finally(()=>process.exit(0)));let o;try{o=i.Atbash.fromConfig({judge:L(a),keyPath:a.chromiaSecretPath,orgName:a.orgName,failClosed:a.enforceDecision!==!1,logger:e.logger})}catch(t){let d=t instanceof Error?t.message:String(t);throw e.logger?.warn?.("[atbash] init failed",{error:d}),t}let n=a.enforceDecision!==!1;e.logger?.info?.("[atbash] plugin loaded",{enforceDecision:n});let g=(0,i.createMemoryGuardManager)({auth:o.auth,workspaceDir:j(a),memoryFilePath:a.memoryFilePath?T(a.memoryFilePath):void 0,ttlMs:a.memorySyncTTLMs,rollbackMinScore:a.memoryRollbackMinScore,memoryPathPatterns:a.memoryPathPatterns,judgeEndpoint:a.judgeEndpoint,judgeVerifyPubKey:a.judgeVerifyPubKey,orgName:a.orgName,enforce:n,debug:!!a.debug,hostLogger:e.logger});if(g.runBootProbe().catch(t=>{e.logger?.warn?.("[atbash] boot probe failed",{error:t instanceof Error?t.message:String(t)})}),!e.on){e.logger?.warn?.("[atbash] on() API not available");return}e.on("before_tool_call",async(t,d)=>{let f;try{f=await g.handleBeforeToolCall(t,d)}catch(s){let c=s instanceof Error?s.message:String(s);return e.logger?.warn?.("[atbash] memory guard error",{error:c}),s instanceof i.MemoryIntegrityError||n?{block:!0,blockReason:`Memory guard error: ${c}`,allow:!1,reason:`Memory guard error: ${c}`}:{allow:!0}}if(f)return f;let u;try{u=await o.auditToolCall(_(t,d))}catch(s){let c=s instanceof Error?s.message:String(s);return e.logger?.warn?.("[atbash] unexpected error",{error:c}),n?{block:!0,blockReason:`Atbash unavailable: ${c}`,allow:!1,reason:`Atbash unavailable: ${c}`}:{allow:!0}}let l=u.reason??"";switch(u.verdict){case"BLOCK":return e.logger?.warn?.("[atbash] BLOCK",{reason:l}),n?{block:!0,blockReason:l,allow:!1,reason:l}:{allow:!0};case"HOLD":{let s=["Action held for operator review. The agent will not be jailed \u2014 please approve or reject this request from the Atbash dashboard, then ask the agent to try again.",`Reason: ${l}`];u.toolCallId&&s.push(`Tool Call ID: ${u.toolCallId}`);let c=s.join(`
-`);return e.logger?.warn?.("[atbash] HOLD",{reason:l,toolCallId:u.toolCallId}),n?{block:!0,blockReason:c,allow:!1,reason:c}:{allow:!0}}case"ERROR":return e.logger?.warn?.("[atbash] ERROR",{reason:l}),n?{block:!0,blockReason:l,allow:!1,reason:l}:{allow:!0};case"ALLOW":default:return e.logger?.info?.("[atbash] ALLOW",{reason:l}),{allow:!0}}})}
+"use strict";var p=Object.defineProperty;var k=Object.getOwnPropertyDescriptor;var S=Object.getOwnPropertyNames;var x=Object.prototype.hasOwnProperty;var R=(o,e)=>{for(var r in e)p(o,r,{get:e[r],enumerable:!0})},P=(o,e,r,a)=>{if(e&&typeof e=="object"||typeof e=="function")for(let t of S(e))!x.call(o,t)&&t!==r&&p(o,t,{get:()=>e[t],enumerable:!(a=k(e,t))||a.enumerable});return o};var D=o=>P(p({},"__esModule",{value:!0}),o);var O={};R(O,{default:()=>C});module.exports=D(O);var E=require("os"),i=require("@atbash/sdk");var I="atbash-openclaw";function h(o){return o.config?.plugins?.entries?.[I]?.config??{}}var v={"0xdac17f958d2ee523a2206206994597c13d831ec7":"USDT","0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48":"USDC","0x6b175474e89094c44da98b954eedeac495271d0f":"DAI","0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2":"WETH","0x2260fac5e5542a773aa44fbcfedf7c193bc2c599":"WBTC","0x1f9840a85d5af5bf1d1762f925bdaddc4201f984":"UNI","0x514910771af9ca656af840dff83e8264ecf986ca":"LINK","0x7fc66500c84a76ad7e9c93437bfc5ac33e2ddae9":"AAVE","0xb0df6379ba1692841965a0745ac1bd3046d79ba3":"ATBASH","0xe9c094187219d9a29382c1a36fc43619c9257777":"ATBASH","0xf8b071428558c657a7a9aa1c43e152e75dd77777":"ATBASH"},y=/\b(0x[a-fA-F0-9]{40})\b/,j=/(0x[a-fA-F0-9]{40})/,w=/\b(transfer|send|swap|approve|erc20)\b/i;function L(o){if(!o)return"ETH";let e=o.toLowerCase(),r=j.exec(e);return r?v[r[1].toLowerCase()]??"other":e==="c60"||e==="eth"?"ETH":e==="atbash"?"ATBASH":e==="usdt"||e==="tether"?"USDT":e==="usdc"?"USDC":"other"}function b(o,...e){for(let r of e){let a=o[r];if(typeof a=="string"&&a.trim())return a.trim()}}function N(o,e){let r=e!==null&&typeof e=="object"&&!Array.isArray(e)?e:void 0,a=r?b(r,"command","cmd","shell_command"):void 0,t=w.test(o),g=a?w.test(a):!1,n=a?y.test(a):!1;if(!t&&!g&&!n)return;let d=m=>a?new RegExp(`--${m}[= ]+(\\S+)`).exec(a)?.[1]:void 0,f=(r?b(r,"token","token_address","asset","currency"):void 0)??d("token");if(!f&&a){let m=y.exec(a);m&&(f=m[1])}let u=(r?b(r,"to","recipient","destination"):void 0)??d("to")??d("recipient"),l=(r?b(r,"amount","value","qty"):void 0)??d("amount"),s=L(f??""),c=a??o;return{operation:/\bswap\b/i.test(c)?"swap":/\b(approve|erc20)\b/i.test(c)?"approve":"transfer",asset:s,amount:l,recipient_status:u?"external":"unspecified",note:"canonicalized pre-judge; raw 0x addresses omitted (redacted upstream)"}}function A(o,e){let r=o??{},a=r.toolName??e.tool?.name??e.toolName??e.name??"unknown",t=r.params??e.params??r.args??e.args??r.arguments??e.arguments,g=JSON.stringify({tool_name:a});return{toolName:a,args:t,context:g,resolved:N(a,t)}}function T(o){return o.replace(/^~(?=\/|$)/,(0,E.homedir)())}function _(o){return o.memoryWorkspaceDir?T(o.memoryWorkspaceDir):process.cwd()}function M(o){if(o.judgeEndpoint)return o.judgeEndpointPolicy==="self-hosted"?{policy:"self-hosted",endpoint:o.judgeEndpoint,verifyPubKey:o.judgeVerifyPubKey??""}:{policy:"default",endpoint:o.judgeEndpoint}}function C(o){let e=o,r=h(e);if(r.enabled===!1){e.logger?.info?.("[atbash] plugin disabled via config");return}(0,i.setupTelemetry)({enabled:!0,source:"plugin:openclaw"}),process.once("beforeExit",()=>(0,i.shutdownTelemetry)()),process.once("SIGINT",()=>(0,i.shutdownTelemetry)().finally(()=>process.exit(0))),process.once("SIGTERM",()=>(0,i.shutdownTelemetry)().finally(()=>process.exit(0)));let a;try{a=i.Atbash.fromConfig({judge:M(r),keyPath:r.chromiaSecretPath,orgName:r.orgName,failClosed:r.enforceDecision!==!1,logger:e.logger})}catch(n){let d=n instanceof Error?n.message:String(n);throw e.logger?.warn?.("[atbash] init failed",{error:d}),n}let t=r.enforceDecision!==!1;e.logger?.info?.("[atbash] plugin loaded",{enforceDecision:t});let g=(0,i.createMemoryGuardManager)({auth:a.auth,workspaceDir:_(r),memoryFilePath:r.memoryFilePath?T(r.memoryFilePath):void 0,ttlMs:r.memorySyncTTLMs,rollbackMinScore:r.memoryRollbackMinScore,memoryPathPatterns:r.memoryPathPatterns,judgeEndpoint:r.judgeEndpoint,judgeVerifyPubKey:r.judgeVerifyPubKey,orgName:r.orgName,enforce:t,debug:!!r.debug,hostLogger:e.logger});if(g.runBootProbe().catch(n=>{e.logger?.warn?.("[atbash] boot probe failed",{error:n instanceof Error?n.message:String(n)})}),!e.on){e.logger?.warn?.("[atbash] on() API not available");return}e.on("before_tool_call",async(n,d)=>{let f;try{f=await g.handleBeforeToolCall(n,d)}catch(s){let c=s instanceof Error?s.message:String(s);return e.logger?.warn?.("[atbash] memory guard error",{error:c}),s instanceof i.MemoryIntegrityError||t?{block:!0,blockReason:`Memory guard error: ${c}`,allow:!1,reason:`Memory guard error: ${c}`}:{allow:!0}}if(f)return f;let u;try{u=await a.auditToolCall(A(n,d))}catch(s){let c=s instanceof Error?s.message:String(s);return e.logger?.warn?.("[atbash] unexpected error",{error:c}),t?{block:!0,blockReason:`Atbash unavailable: ${c}`,allow:!1,reason:`Atbash unavailable: ${c}`}:{allow:!0}}let l=u.reason??"";switch(u.verdict){case"BLOCK":return e.logger?.warn?.("[atbash] BLOCK",{reason:l}),t?{block:!0,blockReason:l,allow:!1,reason:l}:{allow:!0};case"HOLD":{let s=["Action held for operator review. The agent will not be jailed \u2014 please approve or reject this request from the Atbash dashboard, then ask the agent to try again.",`Reason: ${l}`];u.toolCallId&&s.push(`Tool Call ID: ${u.toolCallId}`);let c=s.join(`
+`);return e.logger?.warn?.("[atbash] HOLD",{reason:l,toolCallId:u.toolCallId}),t?{block:!0,blockReason:c,allow:!1,reason:c}:{allow:!0}}case"ERROR":return e.logger?.warn?.("[atbash] ERROR",{reason:l}),t?{block:!0,blockReason:l,allow:!1,reason:l}:{allow:!0};case"ALLOW":default:return e.logger?.info?.("[atbash] ALLOW",{reason:l}),{allow:!0}}})}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/atbash-openclaw",
-  "version": "0.1.17",
+  "version": "0.1.19-dev.0",
   "description": "OpenClaw ATBASH tool-audit plugin. Thin adapter that maps OpenClaw's before_tool_call hook onto @atbash/sdk.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -33,7 +33,7 @@
     ]
   },
   "dependencies": {
-    "@atbash/sdk": "^0.7.1"
+    "@atbash/sdk": "0.10.13-dev.0"
   },
   "devDependencies": {
     "@types/node": "^25.7.0",