@clawdreyhepburn/carapace 0.2.1 → 0.3.1

package/src/index.ts

@@ -8,6 +8,7 @@
 import { CedarlingEngine } from "./cedar-engine-cedarling.js";
 import { McpAggregator } from "./mcp-aggregator.js";
 import { ControlGui } from "./gui/server.js";
+import { LlmProxy } from "./llm-proxy.js";
 import type { PluginConfig } from "./types.js";
 
 export const id = "carapace";
@@ -64,6 +65,24 @@ export default function register(api: OpenClawPluginApi) {
     logger,
   });
 
+  // --- LLM Proxy: intercept tool calls at the API level ---
+  const proxyConfig = config.proxy;
+  const proxy = proxyConfig?.enabled ? new LlmProxy({
+    port: proxyConfig.port ?? 19821,
+    upstream: {
+      anthropic: proxyConfig.upstream?.anthropic ? {
+        url: proxyConfig.upstream.anthropic.url ?? "https://api.anthropic.com",
+        apiKey: proxyConfig.upstream.anthropic.apiKey,
+      } : undefined,
+      openai: proxyConfig.upstream?.openai ? {
+        url: proxyConfig.upstream.openai.url ?? "https://api.openai.com",
+        apiKey: proxyConfig.upstream.openai.apiKey,
+      } : undefined,
+    },
+    cedar,
+    logger,
+  }) : null;
+
   // --- Bypass detection: warn if built-in tools aren't denied ---
   const BYPASS_TOOLS = ["exec", "web_fetch", "web_search"];
 
@@ -111,6 +130,46 @@ export default function register(api: OpenClawPluginApi) {
     return { patched: toAdd, alreadyDenied };
   }
 
+  function patchConfigProxyBaseUrl(): { patched: string[]; alreadySet: string[] } {
+    const { readFileSync, writeFileSync, existsSync } = require("node:fs");
+    const { join } = require("node:path");
+    const { homedir } = require("node:os");
+    const configPath = join(homedir(), ".openclaw", "openclaw.json");
+
+    if (!existsSync(configPath)) return { patched: [], alreadySet: [] };
+    const cfg = JSON.parse(readFileSync(configPath, "utf-8"));
+
+    const port = config.proxy?.port ?? 19821;
+    const proxyUrl = `http://127.0.0.1:${port}`;
+
+    // Figure out which providers have upstream keys configured
+    const providers: string[] = [];
+    if (config.proxy?.upstream?.anthropic) providers.push("anthropic");
+    if (config.proxy?.upstream?.openai) providers.push("openai");
+
+    const patched: string[] = [];
+    const alreadySet: string[] = [];
+
+    if (!cfg.models) cfg.models = {};
+    if (!cfg.models.providers) cfg.models.providers = {};
+
+    for (const provider of providers) {
+      if (!cfg.models.providers[provider]) cfg.models.providers[provider] = {};
+      if (cfg.models.providers[provider].baseUrl === proxyUrl) {
+        alreadySet.push(provider);
+      } else {
+        cfg.models.providers[provider].baseUrl = proxyUrl;
+        patched.push(provider);
+      }
+    }
+
+    if (patched.length > 0) {
+      writeFileSync(configPath, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
+    }
+
+    return { patched, alreadySet };
+  }
+
   // --- Background service: connect to MCP servers and serve GUI ---
   api.registerService({
     id: "carapace",
@@ -121,17 +180,26 @@ export default function register(api: OpenClawPluginApi) {
       await gui.start();
       logger.info(`Control GUI at http://localhost:${config.guiPort ?? 19820}`);
 
-      // Check for bypass vulnerabilities
-      const bypasses = checkForBypasses();
-      if (bypasses.length > 0) {
-        logger.warn(
-          `⚠️  BYPASS RISK: Built-in tools [${bypasses.join(", ")}] are NOT denied. ` +
-          `Agents can use these to bypass Carapace Cedar policies. ` +
-          `Run "openclaw carapace setup" to fix this automatically.`
+      if (proxy) {
+        await proxy.start();
+        logger.info(
+          `🛡️  LLM Proxy active on http://127.0.0.1:${proxyConfig!.port ?? 19821} — ` +
+          `all tool calls go through Cedar`
         );
+      } else {
+        // Check for bypass vulnerabilities only when proxy is disabled
+        const bypasses = checkForBypasses();
+        if (bypasses.length > 0) {
+          logger.warn(
+            `⚠️  BYPASS RISK: Built-in tools [${bypasses.join(", ")}] are NOT denied and LLM proxy is not enabled. ` +
+            `Agents can use these to bypass Carapace Cedar policies. ` +
+            `Enable the LLM proxy (recommended) or run "openclaw carapace setup" to deny built-in tools.`
+          );
+        }
       }
     },
     async stop() {
+      if (proxy) await proxy.stop();
       await gui.stop();
       await aggregator.disconnectAll();
       logger.info("Carapace stopped");
@@ -408,7 +476,16 @@ export default function register(api: OpenClawPluginApi) {
         const tools = aggregator.listTools();
         const enabled = tools.filter((t) => t.enabled).length;
         console.log(`\n  ${enabled}/${tools.length} tools enabled`);
-        console.log(`  GUI: http://localhost:${config.guiPort ?? 19820}\n`);
+        console.log(`  GUI: http://localhost:${config.guiPort ?? 19820}`);
+
+        if (proxy) {
+          const stats = proxy.getStats();
+          console.log(`\n  🛡️  LLM Proxy: http://127.0.0.1:${proxyConfig!.port ?? 19821}`);
+          console.log(`  Requests: ${stats.requests} | Tool calls evaluated: ${stats.toolCallsEvaluated} | Denied: ${stats.toolCallsDenied}`);
+        } else {
+          console.log(`\n  ⚠️  LLM Proxy: disabled`);
+        }
+        console.log();
       });
 
       cmd.command("tools").action(async () => {
@@ -432,37 +509,126 @@ export default function register(api: OpenClawPluginApi) {
       });
 
       cmd.command("setup")
-        .description("Configure OpenClaw to route exec/fetch through Carapace (denies built-in bypass tools)")
+        .description("Configure OpenClaw to route all traffic through Carapace")
         .action(async () => {
           console.log("\n🦞 Carapace Setup\n");
+          let anyChanges = false;
 
+          // 1. Deny built-in bypass tools
           const bypasses = checkForBypasses();
-          if (bypasses.length === 0) {
-            console.log("  ✅ All bypass tools are already denied. No changes needed.\n");
-            return;
+          if (bypasses.length > 0) {
+            console.log("  Denying built-in tools that bypass Cedar:");
+            const { patched, alreadyDenied } = patchConfigDenyTools();
+            if (alreadyDenied.length > 0) {
+              console.log(`    Already denied: ${alreadyDenied.join(", ")}`);
+            }
+            if (patched.length > 0) {
+              console.log(`    ✅ Added to tools.deny: ${patched.join(", ")}`);
+              anyChanges = true;
+            }
+          } else {
+            console.log("  ✅ Built-in bypass tools already denied.");
           }
 
-          console.log("  Built-in tools that bypass Carapace Cedar policies:");
-          for (const tool of bypasses) {
-            console.log(`    ⚠️  ${tool} — agents can use this to skip Cedar authorization`);
+          // 2. Set up LLM proxy baseUrl if proxy is configured
+          if (config.proxy?.enabled) {
+            console.log("\n  Configuring LLM proxy baseUrl:");
+            const { patched, alreadySet } = patchConfigProxyBaseUrl();
+            if (alreadySet.length > 0) {
+              console.log(`    Already set: ${alreadySet.join(", ")}`);
+            }
+            if (patched.length > 0) {
+              console.log(`    ✅ Set models.providers baseUrl for: ${patched.join(", ")}`);
+              anyChanges = true;
+            }
+            if (patched.length === 0 && alreadySet.length === 0) {
+              console.log("    ⚠️  No upstream providers configured in proxy config.");
+              console.log("       Add proxy.upstream.anthropic or proxy.upstream.openai to your plugin config.");
+            }
+          } else {
+            console.log("\n  LLM proxy not enabled — skipping baseUrl setup.");
+            console.log("  To enable, add proxy.enabled: true to your Carapace plugin config.");
           }
 
-          console.log("\n  This will add the following to your OpenClaw config:");
-          console.log(`    tools.deny: [${bypasses.map(t => `"${t}"`).join(", ")}]`);
-          console.log("\n  After setup, agents must use carapace_exec and carapace_fetch");
-          console.log("  instead, which enforce Cedar policies on every call.\n");
-
-          const { patched, alreadyDenied } = patchConfigDenyTools();
-
-          if (alreadyDenied.length > 0) {
-            console.log(`  Already denied: ${alreadyDenied.join(", ")}`);
-          }
-          if (patched.length > 0) {
-            console.log(`  ✅ Added to tools.deny: ${patched.join(", ")}`);
+          if (anyChanges) {
             console.log("\n  Restart the gateway for changes to take effect:");
             console.log("    openclaw gateway restart\n");
           } else {
-            console.log("  ✅ No changes needed.\n");
+            console.log("\n  ✅ Everything already configured. No changes needed.\n");
+          }
+        });
+
+      cmd.command("uninstall")
+        .description("Reverse all config changes made by Carapace (restores built-in tools)")
+        .action(async () => {
+          console.log("\n🦞 Carapace Uninstall\n");
+          console.log("  This reverses changes made by 'openclaw carapace setup'.\n");
+
+          try {
+            const { readFileSync, writeFileSync, existsSync } = require("node:fs");
+            const { join } = require("node:path");
+            const { homedir } = require("node:os");
+            const configPath = join(homedir(), ".openclaw", "openclaw.json");
+
+            if (!existsSync(configPath)) {
+              console.log("  No config file found. Nothing to undo.\n");
+              return;
+            }
+
+            const cfg = JSON.parse(readFileSync(configPath, "utf-8"));
+            let changed = false;
+
+            // Remove Carapace-added entries from tools.deny
+            if (cfg.tools?.deny) {
+              const before = cfg.tools.deny.length;
+              cfg.tools.deny = cfg.tools.deny.filter((t: string) => !BYPASS_TOOLS.includes(t));
+              if (cfg.tools.deny.length === 0) delete cfg.tools.deny;
+              if (cfg.tools && Object.keys(cfg.tools).length === 0) delete cfg.tools;
+              if (cfg.tools?.deny?.length !== before) {
+                changed = true;
+                console.log(`  ✅ Removed [${BYPASS_TOOLS.join(", ")}] from tools.deny`);
+                console.log("     Built-in exec, web_fetch, and web_search are restored.");
+              }
+            }
+
+            // Remove models.providers baseUrl override if it points at the proxy
+            const proxyPort = cfg.plugins?.entries?.carapace?.config?.proxy?.port ?? 19821;
+            const proxyUrl = `http://127.0.0.1:${proxyPort}`;
+            if (cfg.models?.providers) {
+              for (const [name, provCfg] of Object.entries(cfg.models.providers)) {
+                if ((provCfg as any)?.baseUrl === proxyUrl) {
+                  delete (provCfg as any).baseUrl;
+                  // Clean up empty objects
+                  if (Object.keys(provCfg as any).length === 0) delete cfg.models.providers[name];
+                  changed = true;
+                  console.log(`  ✅ Removed baseUrl proxy override for ${name}`);
+                  console.log(`     ${name} will connect directly to its API again.`);
+                }
+              }
+              if (Object.keys(cfg.models.providers).length === 0) delete cfg.models.providers;
+              if (cfg.models && Object.keys(cfg.models).length === 0) delete cfg.models;
+            }
+
+            // Disable the plugin entry (don't delete — user might want to re-enable)
+            if (cfg.plugins?.entries?.carapace?.enabled) {
+              cfg.plugins.entries.carapace.enabled = false;
+              changed = true;
+              console.log("  ✅ Disabled carapace plugin in config");
+            }
+
+            if (changed) {
+              writeFileSync(configPath, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
+              console.log("\n  Config updated. Restart the gateway for changes to take effect:");
+              console.log("    openclaw gateway restart\n");
+              console.log("  To fully remove the plugin files:");
+              console.log("    rm -rf ~/.openclaw/extensions/carapace\n");
+            } else {
+              console.log("  No Carapace changes found in config. Nothing to undo.\n");
+            }
+
+
+          } catch (err: any) {
+            console.log(`  ❌ Error: ${err.message}\n`);
           }
         });