@atbash/atbash-openclaw 0.1.19-dev.2 → 0.1.20

package/dist/index.test.js

@@ -6,7 +6,7 @@
 // execution and honors `block: true` is outside what this package (or
 // these tests) can verify — that half depends on the OpenClaw host, which
 // isn't in this repo.
-import { describe, it, expect, vi, beforeEach } from "vitest";
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 const fromConfig = vi.fn();
 const handleBeforeToolCall = vi.fn();
 const runBootProbe = vi.fn().mockResolvedValue(undefined);
@@ -26,12 +26,20 @@ async function registerAndCapture(opts) {
     fromConfig.mockReturnValue({ auth: {}, auditToolCall: opts.auditToolCall });
     handleBeforeToolCall.mockReset().mockResolvedValue(null);
     const on = vi.fn();
+    const hasConfig = opts.enforceDecision !== undefined || opts.judgeTimeoutMs !== undefined;
     const api = {
         config: {
             plugins: {
-                entries: opts.enforceDecision === undefined
-                    ? {}
-                    : { "atbash-openclaw": { config: { enforceDecision: opts.enforceDecision } } },
+                entries: hasConfig
+                    ? {
+                        "atbash-openclaw": {
+                            config: {
+                                ...(opts.enforceDecision !== undefined && { enforceDecision: opts.enforceDecision }),
+                                ...(opts.judgeTimeoutMs !== undefined && { judgeTimeoutMs: opts.judgeTimeoutMs }),
+                            },
+                        },
+                    }
+                    : {},
             },
         },
         logger: { info: vi.fn(), warn: vi.fn() },
@@ -163,4 +171,49 @@ describe("OpenClaw before_tool_call hook", () => {
         expect(result).toMatchObject({ block: true, allow: false });
         expect(auditToolCall).not.toHaveBeenCalled();
     });
+    describe("judgeTimeoutMs", () => {
+        afterEach(() => {
+            vi.useRealTimers();
+        });
+        it("judge timeout fails closed by default", async () => {
+            vi.useFakeTimers();
+            const auditToolCall = vi.fn().mockReturnValue(new Promise(() => { })); // never resolves
+            const handler = await registerAndCapture({ auditToolCall, judgeTimeoutMs: 5000 });
+            const resultPromise = handler({ toolName: "wire_transfer" }, {});
+            await vi.advanceTimersByTimeAsync(5001);
+            const result = (await resultPromise);
+            expect(result).toMatchObject({ block: true, allow: false });
+            expect(result.blockReason).toContain("timed out after 5000ms");
+        });
+        it("judge timeout respects enforceDecision:false and allows through", async () => {
+            vi.useFakeTimers();
+            const auditToolCall = vi.fn().mockReturnValue(new Promise(() => { }));
+            const handler = await registerAndCapture({ auditToolCall, judgeTimeoutMs: 5000, enforceDecision: false });
+            const resultPromise = handler({ toolName: "wire_transfer" }, {});
+            await vi.advanceTimersByTimeAsync(5001);
+            const result = await resultPromise;
+            expect(result).toEqual({ allow: true });
+        });
+        it("memory guard timeout fails closed by default", async () => {
+            vi.useFakeTimers();
+            const auditToolCall = vi.fn();
+            const handler = await registerAndCapture({ auditToolCall, judgeTimeoutMs: 5000 });
+            handleBeforeToolCall.mockReturnValue(new Promise(() => { })); // never resolves
+            const resultPromise = handler({ toolName: "write", params: { path: "CLAUDE.md" } }, {});
+            await vi.advanceTimersByTimeAsync(5001);
+            const result = (await resultPromise);
+            expect(result).toMatchObject({ block: true, allow: false });
+            expect(result.blockReason).toContain("timed out after 5000ms");
+            expect(auditToolCall).not.toHaveBeenCalled();
+        });
+        it("fast judge response is unaffected by the timeout", async () => {
+            vi.useFakeTimers();
+            const auditToolCall = vi.fn().mockResolvedValue({ verdict: "ALLOW", allow: true });
+            const handler = await registerAndCapture({ auditToolCall, judgeTimeoutMs: 5000 });
+            // advance a little but not past the timeout
+            await vi.advanceTimersByTimeAsync(100);
+            const result = await handler({ toolName: "wire_transfer" }, {});
+            expect(result).toEqual({ allow: true });
+        });
+    });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atbash/atbash-openclaw",
-  "version": "0.1.19-dev.2",
+  "version": "0.1.20",
   "description": "OpenClaw ATBASH tool-audit plugin. Thin adapter that maps OpenClaw's before_tool_call hook onto @atbash/sdk.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -41,7 +41,7 @@
     ]
   },
   "dependencies": {
-    "@atbash/sdk": "0.15.1-dev.0"
+    "@atbash/sdk": "0.8.0"
   },
   "devDependencies": {
     "@types/node": "^25.7.0",