@blockrun/clawrouter 0.5.8 → 0.5.9

package/README.md

@@ -684,14 +684,17 @@ OpenClaw's security scanner may flag ClawRouter with:
 [env-harvesting] Environment variable access combined with network send
 ```
 
-**This is a false positive.** ClawRouter reads `BLOCKRUN_WALLET_KEY` to sign x402 payment transactions — this is required and intentional:
+**This is a false positive.** The scanner's heuristic (`env variable + network request = suspicious`) flags all payment plugins, but this pattern is inherently required for non-custodial payments.
+
+ClawRouter reads `BLOCKRUN_WALLET_KEY` to sign x402 payment transactions — this is required and intentional:
 
 - The wallet key is used **locally** for cryptographic signing (EIP-712)
 - The **signature** is transmitted, not the private key itself
-- This is standard x402 payment protocol behavior
+- The key **never leaves the machine** — only cryptographic proofs are sent
+- This is standard [x402 payment protocol](https://x402.org) behavior
 - Source code is [MIT licensed and fully auditable](https://github.com/BlockRunAI/ClawRouter)
 
-See [`openclaw.security.json`](openclaw.security.json) for detailed security documentation.
+See [`openclaw.security.json`](openclaw.security.json) for detailed security documentation and [this discussion](https://x.com/bc1beat/status/2020158972561428686) for more context.
 
 ### Port 8402 already in use
 

package/dist/index.js

@@ -2384,6 +2384,28 @@ function isProviderError(status, body) {
   }
   return PROVIDER_ERROR_PATTERNS.some((pattern) => pattern.test(body));
 }
+var VALID_ROLES = /* @__PURE__ */ new Set(["system", "user", "assistant", "tool", "function"]);
+var ROLE_MAPPINGS = {
+  developer: "system",
+  // OpenAI's newer API uses "developer" for system messages
+  model: "assistant"
+  // Some APIs use "model" instead of "assistant"
+};
+function normalizeMessageRoles(messages) {
+  if (!messages || messages.length === 0) return messages;
+  let hasChanges = false;
+  const normalized = messages.map((msg) => {
+    if (VALID_ROLES.has(msg.role)) return msg;
+    const mappedRole = ROLE_MAPPINGS[msg.role];
+    if (mappedRole) {
+      hasChanges = true;
+      return { ...msg, role: mappedRole };
+    }
+    hasChanges = true;
+    return { ...msg, role: "user" };
+  });
+  return hasChanges ? normalized : messages;
+}
 function normalizeMessagesForGoogle(messages) {
   if (!messages || messages.length === 0) return messages;
   let firstNonSystemIdx = -1;
@@ -2614,6 +2636,9 @@ async function tryModelRequest(upstreamUrl, method, headers, body, modelId, maxT
   try {
     const parsed = JSON.parse(body.toString());
     parsed.model = modelId;
+    if (Array.isArray(parsed.messages)) {
+      parsed.messages = normalizeMessageRoles(parsed.messages);
+    }
     if (isGoogleModel(modelId) && Array.isArray(parsed.messages)) {
       parsed.messages = normalizeMessagesForGoogle(parsed.messages);
     }