@axonflow/openclaw 0.2.0 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +32 -1
- package/README.md +40 -18
- package/dist/axonflow-client.d.ts +19 -2
- package/dist/axonflow-client.d.ts.map +1 -1
- package/dist/axonflow-client.js +59 -13
- package/dist/axonflow-client.js.map +1 -1
- package/dist/config.d.ts +8 -2
- package/dist/config.d.ts.map +1 -1
- package/dist/config.js +15 -7
- package/dist/config.js.map +1 -1
- package/dist/index.d.ts +1 -1
- package/dist/index.js +1 -1
- package/dist/telemetry.d.ts.map +1 -1
- package/dist/telemetry.js +1 -22
- package/dist/telemetry.js.map +1 -1
- package/openclaw.plugin.json +10 -0
- package/package.json +5 -1
- package/policies/README.md +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,36 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## [1.1.0] - 2026-04-06
|
|
4
|
+
|
|
5
|
+
### Added
|
|
6
|
+
|
|
7
|
+
- `requestTimeoutMs` plugin config for tuning AxonFlow HTTP request timeouts on remote or high-latency deployments.
|
|
8
|
+
- Plugin logo for marketplace and directory listings.
|
|
9
|
+
- `SECURITY.md` with plugin-specific vulnerability reporting guidance.
|
|
10
|
+
|
|
11
|
+
### Changed
|
|
12
|
+
|
|
13
|
+
- Anonymous telemetry is enabled by default for all endpoints, including localhost/self-hosted evaluation. Opt out with `DO_NOT_TRACK=1` or `AXONFLOW_TELEMETRY=off`.
|
|
14
|
+
|
|
15
|
+
## [1.0.0] - 2026-04-05
|
|
16
|
+
|
|
17
|
+
### BREAKING CHANGES
|
|
18
|
+
|
|
19
|
+
- **`X-Tenant-ID` header removed.** The plugin no longer sends `X-Tenant-ID`. The server derives tenant from OAuth2 Client Credentials (Basic auth). Requires platform v6.0.0+.
|
|
20
|
+
- **`tenantId` config removed.** Both `clientId` and `clientSecret` default to `"community"` when not configured. The `tenantId` field is removed — tenant is derived server-side.
|
|
21
|
+
|
|
22
|
+
### Added
|
|
23
|
+
|
|
24
|
+
- `searchAuditEvents()` method on `AxonFlowClient` for individual audit event inspection. Enables debugging why something was blocked, generating compliance reports, and answering "what did the agent do in the last hour?"
|
|
25
|
+
- Hardened E2E test suite: 24 tests covering dangerous command blocking (reverse shell, rm -rf, SSRF, path traversal, credential access), PII detection with redaction assertions, and audit search.
|
|
26
|
+
|
|
27
|
+
### Security
|
|
28
|
+
|
|
29
|
+
- Bumped `@anthropic-ai/sdk` transitive dependency from 0.80.0 to 0.82.0 (fixes CVE-2026-34451: memory tool path validation sandbox escape).
|
|
30
|
+
- Replaced polynomial regex in endpoint URL normalization with iterative loop (ReDoS mitigation).
|
|
31
|
+
- Added explicit `permissions: contents: read` to CI workflow (least privilege).
|
|
32
|
+
- Removed hardcoded Base64 auth string from test file (secret scanning false positive).
|
|
33
|
+
|
|
3
34
|
## [0.2.0] - 2026-04-01 (initial public release)
|
|
4
35
|
|
|
5
36
|
### Added
|
|
@@ -14,7 +45,7 @@
|
|
|
14
45
|
- Fail-open/fail-closed: `onError` config controls behavior when AxonFlow is unreachable.
|
|
15
46
|
- **Startup health check**: Verifies AxonFlow connectivity on plugin initialization. Logs a warning if unreachable, indicating whether the plugin will fail-open or fail-closed.
|
|
16
47
|
- **Governance metrics**: In-process counters for tool calls (evaluated, blocked, approved, allowed), messages (scanned, cancelled, redacted), audit events, and errors. Accessible via `getMetrics()` for debugging and monitoring.
|
|
17
|
-
- **Usage telemetry**: Anonymous checkpoint ping on initialization reporting SDK version, platform info, and hook configuration. Respects `DO_NOT_TRACK=1` and `AXONFLOW_TELEMETRY=off`.
|
|
48
|
+
- **Usage telemetry**: Anonymous checkpoint ping on initialization reporting SDK version, platform info, and hook configuration. Respects `DO_NOT_TRACK=1` and `AXONFLOW_TELEMETRY=off`.
|
|
18
49
|
- Starter policy documentation with SQL setup for OpenClaw production baseline.
|
|
19
50
|
|
|
20
51
|
### Not Yet Supported
|
package/README.md
CHANGED
|
@@ -2,15 +2,18 @@
|
|
|
2
2
|
|
|
3
3
|
**Policy enforcement, approval gates, and audit trails for [OpenClaw](https://github.com/openclaw/openclaw).**
|
|
4
4
|
|
|
5
|
-
|
|
5
|
+
## Why
|
|
6
6
|
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
- prevent PII or secrets from being sent to users
|
|
11
|
-
- keep an audit trail of agent activity with policy context
|
|
7
|
+
OpenClaw is widely deployed with [13+ CVEs disclosed in 2026](https://github.com/jgamblin/OpenClawCVEs/) (multiple CVSS 9.8+), [135,000+ publicly exposed instances](https://www.bitsight.com/blog/openclaw-ai-security-risks-exposed-instances), and [1,184 malicious skills](https://cyberpress.org/clawhavoc-poisons-openclaws-clawhub-with-1184-malicious-skills/) poisoned in ClawHub via the ClawHavoc supply chain attack. OpenClaw provides agent runtime and tool execution but no centralized policy enforcement, no PII scanning, and no compliance-grade audit trails.
|
|
8
|
+
|
|
9
|
+
This plugin adds the governance layer. AxonFlow governs, OpenClaw orchestrates. No LLM provider keys needed — OpenClaw handles all LLM calls, AxonFlow only enforces policies and records audit trails. Your data stays on your infrastructure.
|
|
12
10
|
|
|
13
|
-
|
|
11
|
+
This plugin is useful when you want to:
|
|
12
|
+
- block dangerous tool calls (reverse shells, SSRF, destructive commands) before they run
|
|
13
|
+
- detect and redact PII and secrets in outbound messages before delivery
|
|
14
|
+
- require human approval for high-risk tools (exec, web_fetch, message)
|
|
15
|
+
- keep a compliance-grade audit trail of every tool call and LLM interaction
|
|
16
|
+
- gain visibility into token usage and LLM activity across agents via audit trails
|
|
14
17
|
|
|
15
18
|
## What It Does
|
|
16
19
|
|
|
@@ -40,6 +43,19 @@ What is not protected yet:
|
|
|
40
43
|
|
|
41
44
|
If OpenClaw adds async support for `tool_result_persist`, AxonFlow can add transcript/result scanning immediately. Upstream issue: [openclaw/openclaw#58558](https://github.com/openclaw/openclaw/issues/58558).
|
|
42
45
|
|
|
46
|
+
## Prerequisites
|
|
47
|
+
|
|
48
|
+
This plugin connects to [AxonFlow](https://github.com/getaxonflow/axonflow), a self-hosted governance platform, for policy evaluation and audit logging. AxonFlow must be running before you use the plugin. Your data stays on your infrastructure.
|
|
49
|
+
|
|
50
|
+
```bash
|
|
51
|
+
# Start AxonFlow (Docker — runs entirely on your machine)
|
|
52
|
+
git clone https://github.com/getaxonflow/axonflow.git
|
|
53
|
+
cd axonflow
|
|
54
|
+
docker compose up -d
|
|
55
|
+
```
|
|
56
|
+
|
|
57
|
+
See [Getting Started](https://docs.getaxonflow.com/docs/getting-started/) for full setup options.
|
|
58
|
+
|
|
43
59
|
## Install
|
|
44
60
|
|
|
45
61
|
```bash
|
|
@@ -54,8 +70,12 @@ In your OpenClaw config:
|
|
|
54
70
|
plugins:
|
|
55
71
|
@axonflow/openclaw:
|
|
56
72
|
endpoint: http://localhost:8080
|
|
57
|
-
clientId
|
|
58
|
-
clientSecret
|
|
73
|
+
# In community mode, clientId defaults to "community"
|
|
74
|
+
# and clientSecret can be left unset.
|
|
75
|
+
# Set both only for evaluation/enterprise credentials.
|
|
76
|
+
# clientId: your-client-id
|
|
77
|
+
# clientSecret: your-client-secret
|
|
78
|
+
# requestTimeoutMs: 8000
|
|
59
79
|
highRiskTools:
|
|
60
80
|
- web_fetch
|
|
61
81
|
- message
|
|
@@ -66,13 +86,20 @@ plugins:
|
|
|
66
86
|
| Option | Required | Default | Description |
|
|
67
87
|
|--------|----------|---------|-------------|
|
|
68
88
|
| `endpoint` | Yes | — | AxonFlow agent gateway URL |
|
|
69
|
-
| `clientId` |
|
|
70
|
-
| `clientSecret` |
|
|
89
|
+
| `clientId` | No | `"community"` | Tenant identity for data isolation. Override for evaluation/enterprise. |
|
|
90
|
+
| `clientSecret` | No | `""` | License key for evaluation/enterprise features. Requires `clientId` to be set. |
|
|
71
91
|
| `highRiskTools` | No | `[]` | Tools that require human approval even when policy allows |
|
|
72
92
|
| `governedTools` | No | `[]` (all) | Tools to govern. Empty = all tools. |
|
|
73
93
|
| `excludedTools` | No | `[]` | Tools to exclude from governance |
|
|
74
94
|
| `defaultOperation` | No | `"execute"` | Operation type for mcp_check_input (`"execute"` or `"query"`) |
|
|
75
95
|
| `onError` | No | `"block"` | Behavior when AxonFlow is unreachable: `"block"` (fail-closed) or `"allow"` (fail-open) |
|
|
96
|
+
| `requestTimeoutMs` | No | `8000` | Timeout for policy checks, output scans, audit writes, and health checks. Increase for remote AxonFlow deployments. |
|
|
97
|
+
|
|
98
|
+
**Valid configurations:**
|
|
99
|
+
- Both omitted → community mode (`clientId` defaults to `"community"`)
|
|
100
|
+
- `clientId` only → community mode with custom tenant identity
|
|
101
|
+
- Both set → licensed mode (evaluation/enterprise)
|
|
102
|
+
- `clientSecret` only → **error** (licensed mode requires explicit tenant identity to prevent data going to the wrong tenant)
|
|
76
103
|
|
|
77
104
|
## How It Works
|
|
78
105
|
|
|
@@ -127,18 +154,13 @@ Message delivered to user channel
|
|
|
127
154
|
|
|
128
155
|
## Telemetry
|
|
129
156
|
|
|
130
|
-
This plugin sends an anonymous telemetry ping on initialization to help us understand usage patterns. The ping includes: plugin version, platform info (OS, architecture, Node.js version), AxonFlow platform version, and hook configuration (count, onError mode). No PII, no tool arguments, no policy data.
|
|
157
|
+
This plugin sends an anonymous telemetry ping on initialization to help us understand usage patterns, including local and self-hosted evaluations. The ping includes: plugin version, platform info (OS, architecture, Node.js version), AxonFlow platform version, and hook configuration (count, onError mode). No PII, no tool arguments, no policy data.
|
|
131
158
|
|
|
132
159
|
Opt out:
|
|
133
160
|
- `DO_NOT_TRACK=1` (standard)
|
|
134
161
|
- `AXONFLOW_TELEMETRY=off`
|
|
135
162
|
|
|
136
|
-
|
|
137
|
-
|
|
138
|
-
## Prerequisites
|
|
139
|
-
|
|
140
|
-
- [AxonFlow](https://github.com/getaxonflow/axonflow) running (Docker or production)
|
|
141
|
-
- OpenClaw 1.0+
|
|
163
|
+
The startup ping is enabled by default for local, self-hosted, and remote deployments. Opt-out controls always win.
|
|
142
164
|
|
|
143
165
|
## Starter Policies
|
|
144
166
|
|
|
@@ -19,14 +19,15 @@ export interface MCPCheckOutputResponse {
|
|
|
19
19
|
export declare class AxonFlowClient {
|
|
20
20
|
private readonly endpoint;
|
|
21
21
|
private readonly authHeader;
|
|
22
|
-
private readonly
|
|
22
|
+
private readonly requestTimeoutMs;
|
|
23
23
|
constructor(config: AxonFlowPluginConfig);
|
|
24
24
|
private baseHeaders;
|
|
25
|
+
private fetchWithTimeout;
|
|
25
26
|
mcpCheckInput(connectorType: string, statement: string, operation?: string): Promise<MCPCheckInputResponse>;
|
|
26
27
|
mcpCheckOutput(connectorType: string, message: string): Promise<MCPCheckOutputResponse>;
|
|
27
28
|
/**
|
|
28
29
|
* Log a tool execution to the audit trail.
|
|
29
|
-
* Uses POST /api/v1/audit/tool-call (
|
|
30
|
+
* Uses POST /api/v1/audit/tool-call (tenant derived from Basic auth).
|
|
30
31
|
*/
|
|
31
32
|
auditToolCall(toolName: string, params: Record<string, unknown>, result?: unknown, error?: string, durationMs?: number): Promise<void>;
|
|
32
33
|
/**
|
|
@@ -42,6 +43,22 @@ export declare class AxonFlowClient {
|
|
|
42
43
|
completion_tokens: number;
|
|
43
44
|
total_tokens: number;
|
|
44
45
|
}, latencyMs: number): Promise<void>;
|
|
46
|
+
/**
|
|
47
|
+
* Search individual audit event records.
|
|
48
|
+
*
|
|
49
|
+
* Returns tool call details, policy evaluations, and timestamps
|
|
50
|
+
* for compliance evidence and debugging.
|
|
51
|
+
*/
|
|
52
|
+
searchAuditEvents(options?: {
|
|
53
|
+
startTime?: string;
|
|
54
|
+
endTime?: string;
|
|
55
|
+
requestType?: string;
|
|
56
|
+
limit?: number;
|
|
57
|
+
}): Promise<{
|
|
58
|
+
entries: unknown[];
|
|
59
|
+
total: number;
|
|
60
|
+
error?: string;
|
|
61
|
+
}>;
|
|
45
62
|
healthCheck(): Promise<boolean>;
|
|
46
63
|
}
|
|
47
64
|
//# sourceMappingURL=axonflow-client.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"axonflow-client.d.ts","sourceRoot":"","sources":["../src/axonflow-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAyBD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,
|
|
1
|
+
{"version":3,"file":"axonflow-client.d.ts","sourceRoot":"","sources":["../src/axonflow-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAExD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAyBD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;gBAC9B,MAAM,EAAE,oBAAoB;IAYxC,OAAO,CAAC,WAAW;YASL,gBAAgB;IAiBxB,aAAa,CACjB,aAAa,EAAE,MAAM,EACrB,SAAS,EAAE,MAAM,EACjB,SAAS,GAAE,MAAkB,GAC5B,OAAO,CAAC,qBAAqB,CAAC;IA2C3B,cAAc,CAClB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,sBAAsB,CAAC;IA2ClC;;;OAGG;IACG,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,MAAM,CAAC,EAAE,OAAO,EAChB,KAAK,CAAC,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC;IAqBhB;;;;;;;OAOG;IACG,YAAY,CAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,eAAe,EAAE,MAAM,EACvB,UAAU,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,EACtF,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC;IAoBhB;;;;;OAKG;IACG,iBAAiB,CAAC,OAAO,CAAC,EAAE;QAChC,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IA2B5D,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;CAQtC"}
|
package/dist/axonflow-client.js
CHANGED
|
@@ -29,26 +29,41 @@ function extractPoliciesEvaluated(data) {
|
|
|
29
29
|
export class AxonFlowClient {
|
|
30
30
|
endpoint;
|
|
31
31
|
authHeader;
|
|
32
|
-
|
|
32
|
+
requestTimeoutMs;
|
|
33
33
|
constructor(config) {
|
|
34
|
-
|
|
34
|
+
// Strip trailing slashes without regex (avoids ReDoS on polynomial patterns)
|
|
35
|
+
let ep = config.endpoint;
|
|
36
|
+
while (ep.endsWith("/"))
|
|
37
|
+
ep = ep.slice(0, -1);
|
|
38
|
+
this.endpoint = ep;
|
|
39
|
+
this.requestTimeoutMs = config.requestTimeoutMs ?? 8000;
|
|
35
40
|
const credentials = Buffer.from(`${config.clientId}:${config.clientSecret}`).toString("base64");
|
|
36
41
|
this.authHeader = `Basic ${credentials}`;
|
|
37
|
-
// clientId serves as tenantId for single-tenant setups.
|
|
38
|
-
// The Agent proxy normally injects X-Tenant-ID after auth, but
|
|
39
|
-
// direct Orchestrator calls (audit/tool-call) require it explicitly.
|
|
40
|
-
this.tenantId = config.clientId;
|
|
41
42
|
}
|
|
42
43
|
baseHeaders() {
|
|
44
|
+
// Tenant is derived from Basic auth credentials on the server side (RFC 6749).
|
|
45
|
+
// X-Tenant-ID header is no longer sent — server knows tenant from auth.
|
|
43
46
|
return {
|
|
44
47
|
"Content-Type": "application/json",
|
|
45
48
|
Authorization: this.authHeader,
|
|
46
|
-
"X-Tenant-ID": this.tenantId,
|
|
47
49
|
};
|
|
48
50
|
}
|
|
51
|
+
async fetchWithTimeout(url, init) {
|
|
52
|
+
const controller = new AbortController();
|
|
53
|
+
const timeoutId = setTimeout(() => controller.abort(), this.requestTimeoutMs);
|
|
54
|
+
try {
|
|
55
|
+
return await fetch(url, {
|
|
56
|
+
...init,
|
|
57
|
+
signal: controller.signal,
|
|
58
|
+
});
|
|
59
|
+
}
|
|
60
|
+
finally {
|
|
61
|
+
clearTimeout(timeoutId);
|
|
62
|
+
}
|
|
63
|
+
}
|
|
49
64
|
async mcpCheckInput(connectorType, statement, operation = "execute") {
|
|
50
65
|
const url = `${this.endpoint}/api/v1/mcp/check-input`;
|
|
51
|
-
const response = await
|
|
66
|
+
const response = await this.fetchWithTimeout(url, {
|
|
52
67
|
method: "POST",
|
|
53
68
|
headers: this.baseHeaders(),
|
|
54
69
|
body: JSON.stringify({
|
|
@@ -82,7 +97,7 @@ export class AxonFlowClient {
|
|
|
82
97
|
}
|
|
83
98
|
async mcpCheckOutput(connectorType, message) {
|
|
84
99
|
const url = `${this.endpoint}/api/v1/mcp/check-output`;
|
|
85
|
-
const response = await
|
|
100
|
+
const response = await this.fetchWithTimeout(url, {
|
|
86
101
|
method: "POST",
|
|
87
102
|
headers: this.baseHeaders(),
|
|
88
103
|
body: JSON.stringify({
|
|
@@ -116,12 +131,12 @@ export class AxonFlowClient {
|
|
|
116
131
|
}
|
|
117
132
|
/**
|
|
118
133
|
* Log a tool execution to the audit trail.
|
|
119
|
-
* Uses POST /api/v1/audit/tool-call (
|
|
134
|
+
* Uses POST /api/v1/audit/tool-call (tenant derived from Basic auth).
|
|
120
135
|
*/
|
|
121
136
|
async auditToolCall(toolName, params, result, error, durationMs) {
|
|
122
137
|
const url = `${this.endpoint}/api/v1/audit/tool-call`;
|
|
123
138
|
try {
|
|
124
|
-
await
|
|
139
|
+
await this.fetchWithTimeout(url, {
|
|
125
140
|
method: "POST",
|
|
126
141
|
headers: this.baseHeaders(),
|
|
127
142
|
body: JSON.stringify({
|
|
@@ -150,7 +165,7 @@ export class AxonFlowClient {
|
|
|
150
165
|
async auditLLMCall(provider, model, query, responseSummary, tokenUsage, latencyMs) {
|
|
151
166
|
const url = `${this.endpoint}/api/v1/audit/tool-call`;
|
|
152
167
|
try {
|
|
153
|
-
await
|
|
168
|
+
await this.fetchWithTimeout(url, {
|
|
154
169
|
method: "POST",
|
|
155
170
|
headers: this.baseHeaders(),
|
|
156
171
|
body: JSON.stringify({
|
|
@@ -167,9 +182,40 @@ export class AxonFlowClient {
|
|
|
167
182
|
// Audit failures are non-fatal
|
|
168
183
|
}
|
|
169
184
|
}
|
|
185
|
+
/**
|
|
186
|
+
* Search individual audit event records.
|
|
187
|
+
*
|
|
188
|
+
* Returns tool call details, policy evaluations, and timestamps
|
|
189
|
+
* for compliance evidence and debugging.
|
|
190
|
+
*/
|
|
191
|
+
async searchAuditEvents(options) {
|
|
192
|
+
const url = `${this.endpoint}/api/v1/audit/search`;
|
|
193
|
+
const now = new Date();
|
|
194
|
+
const oneHourAgo = new Date(now.getTime() - 60 * 60 * 1000);
|
|
195
|
+
const body = {
|
|
196
|
+
start_time: options?.startTime ?? oneHourAgo.toISOString(),
|
|
197
|
+
end_time: options?.endTime ?? now.toISOString(),
|
|
198
|
+
limit: Math.min(options?.limit ?? 20, 100),
|
|
199
|
+
...(options?.requestType && { request_type: options.requestType }),
|
|
200
|
+
};
|
|
201
|
+
try {
|
|
202
|
+
const response = await this.fetchWithTimeout(url, {
|
|
203
|
+
method: "POST",
|
|
204
|
+
headers: this.baseHeaders(),
|
|
205
|
+
body: JSON.stringify(body),
|
|
206
|
+
});
|
|
207
|
+
if (!response.ok) {
|
|
208
|
+
return { entries: [], total: 0, error: `HTTP ${response.status}` };
|
|
209
|
+
}
|
|
210
|
+
return (await response.json());
|
|
211
|
+
}
|
|
212
|
+
catch (e) {
|
|
213
|
+
return { entries: [], total: 0, error: e instanceof Error ? e.message : "Unknown error" };
|
|
214
|
+
}
|
|
215
|
+
}
|
|
170
216
|
async healthCheck() {
|
|
171
217
|
try {
|
|
172
|
-
const response = await
|
|
218
|
+
const response = await this.fetchWithTimeout(`${this.endpoint}/health`);
|
|
173
219
|
return response.ok;
|
|
174
220
|
}
|
|
175
221
|
catch {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"axonflow-client.js","sourceRoot":"","sources":["../src/axonflow-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,IAA6B;IAC7D,IAAI,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,UAAqC,CAAC;QACjD,IAAI,OAAO,EAAE,CAAC,oBAAoB,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjD,OAAO,EAAE,CAAC,oBAAoB,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,OAAO,cAAc;IACR,QAAQ,CAAS;IACjB,UAAU,CAAS;IACnB,
|
|
1
|
+
{"version":3,"file":"axonflow-client.js","sourceRoot":"","sources":["../src/axonflow-client.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,IAA6B;IAC7D,IAAI,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACvC,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC1D,MAAM,EAAE,GAAG,UAAqC,CAAC;QACjD,IAAI,OAAO,EAAE,CAAC,oBAAoB,CAAC,KAAK,QAAQ,EAAE,CAAC;YACjD,OAAO,EAAE,CAAC,oBAAoB,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,OAAO,cAAc;IACR,QAAQ,CAAS;IACjB,UAAU,CAAS;IACnB,gBAAgB,CAAS;IAC1C,YAAY,MAA4B;QACtC,6EAA6E;QAC7E,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC;QACzB,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC,gBAAgB,GAAG,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC;QACxD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE,CAC5C,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,SAAS,WAAW,EAAE,CAAC;IAC3C,CAAC;IAEO,WAAW;QACjB,+EAA+E;QAC/E,wEAAwE;QACxE,OAAO;YACL,cAAc,EAAE,kBAAkB;YAClC,aAAa,EAAE,IAAI,CAAC,UAAU;SAC/B,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAC5B,GAAW,EACX,IAAkB;QAElB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAE9E,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE;gBACtB,GAAG,IAAI;gBACP,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,aAAqB,EACrB,SAAiB,EACjB,YAAoB,SAAS;QAE7B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,yBAAyB,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE;YAC3B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,cAAc,EAAE,aAAa;gBAC7B,SAAS;gBACT,SAAS;aACV,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAEhE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,YAAY,EACV,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ;oBACtC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;oBACtB,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ;wBACjC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;wBACf,CAAC,CAAC,mBAAmB;gBAC3B,kBAAkB,EAAE,wBAAwB,CAAC,IAAI,CAAC;aACnD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,gCAAgC,QAAQ,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5G,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI;YACjC,YAAY,EACV,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ;gBACtC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;gBACtB,CAAC,CAAC,SAAS;YACf,kBAAkB,EAAE,wBAAwB,CAAC,IAAI,CAAC;SACnD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,aAAqB,EACrB,OAAe;QAEf,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,0BAA0B,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE;YAC3B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,cAAc,EAAE,aAAa;gBAC7B,OAAO;aACR,CAAC;SACH,CAAC,CAAC;QAEH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;QAEhE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,YAAY,EACV,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ;oBACtC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;oBACtB,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ;wBACjC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;wBACf,CAAC,CAAC,mBAAmB;gBAC3B,kBAAkB,EAAE,wBAAwB,CAAC,IAAI,CAAC;aACnD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,iCAAiC,QAAQ,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7G,CAAC;QACJ,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI;YACjC,YAAY,EACV,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ;gBACtC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC;gBACtB,CAAC,CAAC,SAAS;YACf,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,IAAI,SAAS;YACjD,kBAAkB,EAAE,wBAAwB,CAAC,IAAI,CAAC;SACnD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CACjB,QAAgB,EAChB,MAA+B,EAC/B,MAAgB,EAChB,KAAc,EACd,UAAmB;QAEnB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,yBAAyB,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE;gBAC3B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,QAAQ;oBACnB,SAAS,EAAE,UAAU;oBACrB,KAAK,EAAE,MAAM;oBACb,MAAM,EAAE,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;oBACrF,OAAO,EAAE,KAAK,IAAI,IAAI;oBACtB,aAAa,EAAE,KAAK;oBACpB,WAAW,EAAE,UAAU;iBACxB,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,YAAY,CAChB,QAAgB,EAChB,KAAa,EACb,KAAa,EACb,eAAuB,EACvB,UAAsF,EACtF,SAAiB;QAEjB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,yBAAyB,CAAC;QACtD,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE;gBAC3B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,SAAS,EAAE,GAAG,QAAQ,IAAI,KAAK,EAAE;oBACjC,SAAS,EAAE,UAAU;oBACrB,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;oBACrC,MAAM,EAAE,EAAE,gBAAgB,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE;oBACpF,OAAO,EAAE,IAAI;oBACb,WAAW,EAAE,SAAS;iBACvB,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,+BAA+B;QACjC,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,OAKvB;QACC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,sBAAsB,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAE5D,MAAM,IAAI,GAAG;YACX,UAAU,EAAE,OAAO,EAAE,SAAS,IAAI,UAAU,CAAC,WAAW,EAAE;YAC1D,QAAQ,EAAE,OAAO,EAAE,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE;YAC/C,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC;YAC1C,GAAG,CAAC,OAAO,EAAE,WAAW,IAAI,EAAE,YAAY,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;SACnE,CAAC;QAEF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE;gBAC3B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACrE,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0C,CAAC;QAC1E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;QAC5F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,QAAQ,SAAS,CAAC,CAAC;YACxE,OAAO,QAAQ,CAAC,EAAE,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}
|
package/dist/config.d.ts
CHANGED
|
@@ -7,9 +7,9 @@
|
|
|
7
7
|
export interface AxonFlowPluginConfig {
|
|
8
8
|
/** AxonFlow agent gateway endpoint (e.g., "http://localhost:8080"). */
|
|
9
9
|
endpoint: string;
|
|
10
|
-
/**
|
|
10
|
+
/** Tenant identity for data isolation. Defaults to "community" for community mode. */
|
|
11
11
|
clientId: string;
|
|
12
|
-
/**
|
|
12
|
+
/** License key for evaluation/enterprise features. Empty for community mode. */
|
|
13
13
|
clientSecret: string;
|
|
14
14
|
/**
|
|
15
15
|
* Tools that require human approval even when AxonFlow allows them.
|
|
@@ -39,6 +39,12 @@ export interface AxonFlowPluginConfig {
|
|
|
39
39
|
* Fail-closed is safer but can cascade AxonFlow failures to the agent.
|
|
40
40
|
*/
|
|
41
41
|
onError?: "block" | "allow";
|
|
42
|
+
/**
|
|
43
|
+
* Timeout for AxonFlow HTTP calls in milliseconds.
|
|
44
|
+
* Applies to policy checks, output scans, audit writes, and health checks.
|
|
45
|
+
* Defaults to 8000ms.
|
|
46
|
+
*/
|
|
47
|
+
requestTimeoutMs?: number;
|
|
42
48
|
}
|
|
43
49
|
/** Validate plugin config and return defaults. */
|
|
44
50
|
export declare function resolveConfig(raw: Record<string, unknown> | undefined): AxonFlowPluginConfig;
|
package/dist/config.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IAEjB,
|
|
1
|
+
{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IAEjB,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IAEjB,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAC;IAErB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAE5B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACvC,oBAAoB,CAsDtB;AAED,0DAA0D;AAC1D,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAWT"}
|
package/dist/config.js
CHANGED
|
@@ -13,14 +13,17 @@ export function resolveConfig(raw) {
|
|
|
13
13
|
if (typeof endpoint !== "string" || !endpoint) {
|
|
14
14
|
throw new Error("AxonFlow plugin: 'endpoint' is required (e.g., 'http://localhost:8080')");
|
|
15
15
|
}
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
if (
|
|
22
|
-
throw new Error("AxonFlow plugin: 'clientSecret' is
|
|
16
|
+
// Defaults match SDK behavior: community mode works out of the box.
|
|
17
|
+
// Override with your evaluation/enterprise license credentials.
|
|
18
|
+
const rawClientId = typeof raw["clientId"] === "string" ? raw["clientId"] : "";
|
|
19
|
+
const rawClientSecret = typeof raw["clientSecret"] === "string" ? raw["clientSecret"] : "";
|
|
20
|
+
// Reject clientSecret without clientId — licensed mode must specify the tenant
|
|
21
|
+
if (!rawClientId && rawClientSecret) {
|
|
22
|
+
throw new Error("AxonFlow plugin: 'clientId' is required when 'clientSecret' is set. " +
|
|
23
|
+
"Set clientId to your tenant identity (e.g., your deployment's AXONFLOW_CLIENT_ID).");
|
|
23
24
|
}
|
|
25
|
+
const clientId = rawClientId || "community";
|
|
26
|
+
const clientSecret = rawClientSecret;
|
|
24
27
|
return {
|
|
25
28
|
endpoint,
|
|
26
29
|
clientId,
|
|
@@ -38,6 +41,11 @@ export function resolveConfig(raw) {
|
|
|
38
41
|
? raw["defaultOperation"]
|
|
39
42
|
: "execute",
|
|
40
43
|
onError: raw["onError"] === "allow" ? "allow" : "block",
|
|
44
|
+
requestTimeoutMs: typeof raw["requestTimeoutMs"] === "number" &&
|
|
45
|
+
Number.isFinite(raw["requestTimeoutMs"]) &&
|
|
46
|
+
raw["requestTimeoutMs"] > 0
|
|
47
|
+
? raw["requestTimeoutMs"]
|
|
48
|
+
: 8000,
|
|
41
49
|
};
|
|
42
50
|
}
|
|
43
51
|
/** Check if a tool should be governed based on config. */
|
package/dist/config.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;
|
|
1
|
+
{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAqDH,kDAAkD;AAClD,MAAM,UAAU,aAAa,CAC3B,GAAwC;IAExC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IAED,oEAAoE;IACpE,gEAAgE;IAChE,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,eAAe,GAAG,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3F,+EAA+E;IAC/E,IAAI,CAAC,WAAW,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,sEAAsE;YACtE,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,IAAI,WAAW,CAAC;IAC5C,MAAM,YAAY,GAAG,eAAe,CAAC;IAErC,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,YAAY;QACZ,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAChD,CAAC,CAAE,GAAG,CAAC,eAAe,CAAc;YACpC,CAAC,CAAC,EAAE;QACN,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAChD,CAAC,CAAE,GAAG,CAAC,eAAe,CAAc;YACpC,CAAC,CAAC,EAAE;QACN,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAChD,CAAC,CAAE,GAAG,CAAC,eAAe,CAAc;YACpC,CAAC,CAAC,EAAE;QACN,gBAAgB,EACd,OAAO,GAAG,CAAC,kBAAkB,CAAC,KAAK,QAAQ;YACzC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACzB,CAAC,CAAC,SAAS;QACf,OAAO,EACL,GAAG,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QAChD,gBAAgB,EACd,OAAO,GAAG,CAAC,kBAAkB,CAAC,KAAK,QAAQ;YAC3C,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACxC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC;YACzB,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACzB,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,MAA4B;IAE5B,iCAAiC;IACjC,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,yDAAyD;IACzD,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IACD,4BAA4B;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -31,7 +31,7 @@
|
|
|
31
31
|
* for async hook support.
|
|
32
32
|
*/
|
|
33
33
|
/** Plugin version — update before each release. */
|
|
34
|
-
export declare const VERSION = "
|
|
34
|
+
export declare const VERSION = "1.1.0";
|
|
35
35
|
export { AxonFlowClient } from "./axonflow-client.js";
|
|
36
36
|
export type { AxonFlowPluginConfig } from "./config.js";
|
|
37
37
|
export { resolveConfig, shouldGovernTool } from "./config.js";
|
package/dist/index.js
CHANGED
|
@@ -39,7 +39,7 @@ import { createLlmInputHandler, createLlmOutputHandler } from "./llm-audit.js";
|
|
|
39
39
|
import { sendTelemetryPing } from "./telemetry.js";
|
|
40
40
|
import { resetMetrics } from "./metrics.js";
|
|
41
41
|
/** Plugin version — update before each release. */
|
|
42
|
-
export const VERSION = "
|
|
42
|
+
export const VERSION = "1.1.0";
|
|
43
43
|
// Re-export for external consumers
|
|
44
44
|
export { AxonFlowClient } from "./axonflow-client.js";
|
|
45
45
|
export { resolveConfig, shouldGovernTool } from "./config.js";
|
package/dist/telemetry.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;
|
|
1
|
+
{"version":3,"file":"telemetry.d.ts","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA+CH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AA2BD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;CACjB,GAAG,IAAI,CA6DP"}
|
package/dist/telemetry.js
CHANGED
|
@@ -37,23 +37,6 @@ function isOptedOut() {
|
|
|
37
37
|
}
|
|
38
38
|
return false;
|
|
39
39
|
}
|
|
40
|
-
/**
|
|
41
|
-
* Check whether the endpoint is a localhost/loopback address.
|
|
42
|
-
* Suppresses telemetry for local development only.
|
|
43
|
-
*/
|
|
44
|
-
function isLocalhostEndpoint(endpoint) {
|
|
45
|
-
try {
|
|
46
|
-
const url = new URL(endpoint);
|
|
47
|
-
const host = url.hostname;
|
|
48
|
-
return (host === "localhost" ||
|
|
49
|
-
host === "127.0.0.1" ||
|
|
50
|
-
host === "[::1]" ||
|
|
51
|
-
host === "::1");
|
|
52
|
-
}
|
|
53
|
-
catch {
|
|
54
|
-
return false;
|
|
55
|
-
}
|
|
56
|
-
}
|
|
57
40
|
function resolveCheckpointUrl() {
|
|
58
41
|
if (typeof process !== "undefined" &&
|
|
59
42
|
process.env &&
|
|
@@ -96,12 +79,8 @@ export function sendTelemetryPing(options) {
|
|
|
96
79
|
if (isOptedOut()) {
|
|
97
80
|
return;
|
|
98
81
|
}
|
|
99
|
-
// Suppress telemetry for localhost endpoints by default
|
|
100
|
-
if (isLocalhostEndpoint(options.endpoint)) {
|
|
101
|
-
return;
|
|
102
|
-
}
|
|
103
82
|
if (typeof console !== "undefined") {
|
|
104
|
-
console.log("[AxonFlow] Anonymous telemetry enabled. Opt out: AXONFLOW_TELEMETRY=off | https://docs.getaxonflow.com/docs/telemetry");
|
|
83
|
+
console.log("[AxonFlow] Anonymous telemetry enabled for local and self-hosted use. Opt out: DO_NOT_TRACK=1 or AXONFLOW_TELEMETRY=off | https://docs.getaxonflow.com/docs/telemetry");
|
|
105
84
|
}
|
|
106
85
|
const checkpointUrl = resolveCheckpointUrl();
|
|
107
86
|
const payload = {
|
package/dist/telemetry.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,cAAc,GAAG,4CAA4C,CAAC;AACpE,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,IACE,OAAO,MAAM,KAAK,WAAW;YAC7B,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,EACvC,CAAC;YACD,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,OAAO,sCAAsC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACnE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;QAC1C,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"telemetry.js","sourceRoot":"","sources":["../src/telemetry.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,cAAc,GAAG,4CAA4C,CAAC;AACpE,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,IACE,OAAO,MAAM,KAAK,WAAW;YAC7B,OAAO,MAAM,CAAC,UAAU,KAAK,UAAU,EACvC,CAAC;YACD,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2BAA2B;IAC7B,CAAC;IACD,OAAO,sCAAsC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACnE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;QAC1C,OAAO,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU;IACjB,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,KAAK,EAAE,CAAC;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB;IAC3B,IACE,OAAO,OAAO,KAAK,WAAW;QAC9B,OAAO,CAAC,GAAG;QACX,OAAO,CAAC,GAAG,CAAC,uBAAuB,EACnC,CAAC;QACD,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC7C,CAAC;IACD,OAAO,cAAc,CAAC;AACxB,CAAC;AAcD;;GAEG;AACH,KAAK,UAAU,qBAAqB,CAClC,QAAgB;IAEhB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,SAAS,EAAE;YAC7C,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QACH,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAA4B,CAAC;QAC5D,OAAO,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO;YACrD,CAAC,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAMjC;IACC,IAAI,UAAU,EAAE,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IAED,IAAI,OAAO,OAAO,KAAK,WAAW,EAAE,CAAC;QACnC,OAAO,CAAC,GAAG,CACT,uKAAuK,CACxK,CAAC;IACJ,CAAC;IAED,MAAM,aAAa,GAAG,oBAAoB,EAAE,CAAC;IAE7C,MAAM,OAAO,GAAqB;QAChC,GAAG,EAAE,iBAAiB;QACtB,WAAW,EAAE,OAAO,CAAC,aAAa;QAClC,gBAAgB,EAAE,IAAI;QACtB,EAAE,EAAE,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACjE,IAAI,EAAE,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAC/D,eAAe,EACb,OAAO,OAAO,KAAK,WAAW;YAC5B,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACnC,CAAC,CAAC,SAAS;QACf,eAAe,EAAE,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa;QAC3E,QAAQ,EAAE;YACR,SAAS,OAAO,CAAC,SAAS,EAAE;YAC5B,mBAAmB,OAAO,CAAC,iBAAiB,EAAE;YAC9C,YAAY,OAAO,CAAC,OAAO,EAAE;SAC9B;QACD,WAAW,EAAE,kBAAkB,EAAE;KAClC,CAAC;IAEF,IAAI,CAAC;QACH,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,CAAC;gBACH,OAAO,CAAC,gBAAgB,GAAG,MAAM,qBAAqB,CACpD,OAAO,CAAC,QAAQ,CACjB,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,yCAAyC;YAC3C,CAAC;YAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,oBAAoB,CAAC,CAAC;YAE7E,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC,aAAa,EAAE;oBACzB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBAC7B,MAAM,EAAE,UAAU,CAAC,MAAM;iBAC1B,CAAC,CAAC;YACL,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,SAAS,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;YACd,iEAAiE;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB;IACnB,CAAC;AACH,CAAC"}
|
package/openclaw.plugin.json
CHANGED
|
@@ -39,6 +39,12 @@
|
|
|
39
39
|
"placeholder": "execute",
|
|
40
40
|
"help": "Operation type for mcp_check_input: 'execute' (default) or 'query' for read-only tools",
|
|
41
41
|
"advanced": true
|
|
42
|
+
},
|
|
43
|
+
"requestTimeoutMs": {
|
|
44
|
+
"label": "Request Timeout (ms)",
|
|
45
|
+
"placeholder": "8000",
|
|
46
|
+
"help": "Timeout for AxonFlow policy checks, output scans, audit writes, and health checks. Increase for remote deployments.",
|
|
47
|
+
"advanced": true
|
|
42
48
|
}
|
|
43
49
|
},
|
|
44
50
|
"configSchema": {
|
|
@@ -85,6 +91,10 @@
|
|
|
85
91
|
"block",
|
|
86
92
|
"allow"
|
|
87
93
|
]
|
|
94
|
+
},
|
|
95
|
+
"requestTimeoutMs": {
|
|
96
|
+
"type": "number",
|
|
97
|
+
"minimum": 1
|
|
88
98
|
}
|
|
89
99
|
},
|
|
90
100
|
"required": [
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@axonflow/openclaw",
|
|
3
|
-
"version": "
|
|
3
|
+
"version": "1.1.0",
|
|
4
4
|
"description": "Policy enforcement, approval gates, and audit trails for OpenClaw — govern tool inputs before execution, scan outbound messages for PII/secrets, and record agent activity for review and compliance",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "dist/index.js",
|
|
@@ -89,6 +89,10 @@
|
|
|
89
89
|
"compat": {
|
|
90
90
|
"pluginApi": ">=2026.3.22",
|
|
91
91
|
"minGatewayVersion": "2026.3.22"
|
|
92
|
+
},
|
|
93
|
+
"build": {
|
|
94
|
+
"openclawVersion": "2026.3.22",
|
|
95
|
+
"pluginSdkVersion": "2026.3.22"
|
|
92
96
|
}
|
|
93
97
|
}
|
|
94
98
|
}
|
package/policies/README.md
CHANGED
|
@@ -4,7 +4,7 @@ Default policy configurations for protecting OpenClaw deployments with AxonFlow.
|
|
|
4
4
|
|
|
5
5
|
## Why These Policies Matter
|
|
6
6
|
|
|
7
|
-
As of March 2026, OpenClaw has 135,000+
|
|
7
|
+
As of March 2026, OpenClaw has 500K+ deployed instances (135,000+ publicly exposed), 13+ CVEs disclosed (including CVE-2026-32922 and CVE-2026-32973 at CVSS 9.8), and the ClawHavoc supply chain attack poisoned 1,184 skills in ClawHub. Microsoft recommends: "It is not appropriate to run on a standard personal or enterprise workstation."
|
|
8
8
|
|
|
9
9
|
AxonFlow adds centralized governance at key data boundaries: tool inputs (before execution), outbound messages (before delivery), and LLM calls (audit). Tool result transcript scanning is pending async hook support in OpenClaw.
|
|
10
10
|
|