@clawdreyhepburn/carapace 1.0.11 → 1.0.12

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## [1.0.12] - 2026-07-20
+
+### Fixed
+- **Shell-parse false denials from quoted patterns / args.** `extractShellBinaries`
+  no longer treats quote interiors or command arguments as binaries
+  (e.g. grep with a quoted alternation pattern returns only grep;
+  compound destroy commands no longer promote args to binaries).
+  Strips quotes/`$()`/backticks before operator split; stops segment scan
+  after a non-wrapper binary.
+- **Hook schema lockouts from garbage binary tokens.** `before_tool_call` now
+  sanity-filters binary names, skips schema-ish authorize failures, and falls
+  back to first-token authz instead of hard-denying the whole command with a
+  Cedar entity/schema error.
+- **`carapace_exec` compound-command bypass (C7).** Agent-facing shell tool now
+  uses the same multi-binary authorize helper as the hook (was first-token only).
+- **`mcp_call` closed-schema brick.** No longer passes raw nested `arguments`
+  object as Cedar context; uses `params_json` + lifted scalars (same pattern as
+  the generic tool path).
+- **LLM proxy shell path first-token only.** Proxy evaluation now multi-checks
+  compound shell commands via `extractShellBinaries`.
+
+### Changed
+- Eval engine docs: live path is native `@cedar-policy/cedar-wasm` (Cedarling kept
+  as a legacy/test dependency only). Package version **must** be 1.0.12 — local
+  1.0.11 already diverged from npm 1.0.11 (security packaging integrity).
+
+
 ## [1.0.8] - 2026-07-13
 
 ### Fixed

package/README.md

@@ -58,7 +58,7 @@ forbid(
 
 Cedar has one critical property: **forbid always wins.** If any rule says "no," the action is blocked — no matter how many other rules say "yes." This means you can't accidentally create a loophole by adding a new "allow" rule that overrides your safety restrictions.
 
-Carapace uses [Cedarling](https://github.com/JanssenProject/jans/tree/main/jans-cedarling), a high-performance Cedar engine compiled to WebAssembly, so policy checks run in under 6 milliseconds.
+Carapace evaluates policies with the official [`@cedar-policy/cedar-wasm`](https://www.npmjs.com/package/@cedar-policy/cedar-wasm) engine (fail-closed, boot self-test). Policy checks are sub-millisecond for typical agent tool calls.
 
 ### What is OpenClaw?
 
@@ -122,7 +122,7 @@ Open it at [http://localhost:19820](http://localhost:19820) after starting Carap
 |             |        |   every tool call          |------->|  (GitHub)       |
 |             |        |         |                  |        +-----------------+
 |             |        |  +----------------------+  |
-|             |        |  |   Cedarling WASM      |  |
+|             |        |  |   cedar-wasm          |  |
 |             |        |  |   (Cedar 4.4.2)       |  |
 |             |        |  +----------------------+  |
 |             |        |  +----------------------+  |
@@ -139,7 +139,7 @@ Open it at [http://localhost:19820](http://localhost:19820) after starting Carap
 **Key components:**
 
 - **`before_tool_call` hook** — Registered in OpenClaw's plugin system. Every tool call passes through this hook before executing. Denied calls never reach the tool.
-- **Cedarling WASM** — The Cedar policy engine, running as WebAssembly for near-native speed. This is where your policies are evaluated.
+- **Cedar WASM** — Official `@cedar-policy/cedar-wasm` engine. Fail-closed evaluation with a boot self-test that verifies `when`-clause gating.
 - **Control GUI** — A local web dashboard for managing tools and policies. Single HTML file, no build step, dark theme.
 
 ---
@@ -372,7 +372,7 @@ npx tsx test/test-block-myself.mjs    # End-to-end cp block demo
 carapace/
 ├── src/
 │   ├── index.ts                  # OpenClaw plugin entry — registers before_tool_call hook
-│   ├── cedar-engine-cedarling.ts # Cedarling WASM engine — real Cedar 4.4.2 evaluation
+│   ├── cedar-engine-cedarling.ts # Native cedar-wasm engine (class name kept for compat)
 │   ├── cedar-engine.ts           # Fallback engine (string matching, no WASM needed)
 │   ├── policy-source.ts          # PolicySource for OVID-ME integration
 │   ├── types.ts                  # Shared TypeScript types
@@ -411,7 +411,7 @@ More at [clawdrey.com](https://clawdrey.com).
 ### Built with
 
 - **[Cedar](https://www.cedarpolicy.com/)** — Policy language by AWS. Human-readable rules with formal guarantees.
-- **[Cedarling](https://github.com/JanssenProject/jans/tree/main/jans-cedarling)** — Cedar engine by [Gluu](https://gluu.org/), compiled to WebAssembly for speed.
+- **[@cedar-policy/cedar-wasm](https://www.npmjs.com/package/@cedar-policy/cedar-wasm)** — Official Cedar WASM engine. (Legacy Cedarling dependency retained only for older test harnesses.)
 - **[MCP](https://modelcontextprotocol.io/)** — Open protocol for connecting AI agents to tools.
 - **[OpenClaw](https://github.com/openclaw/openclaw)** — Open-source AI agent platform.
 - **[OVID](https://github.com/clawdreyhepburn/ovid)** — Cryptographic identity + Cedar mandates for sub-agents (JWTs with EdDSA/Ed25519).

package/dist/cedar-engine-cedarling.d.ts

@@ -1,9 +1,24 @@
 /**
- * Cedarling-powered Cedar engine for MCP tool authorization.
+ * Native Cedar engine for MCP tool authorization.
  *
- * Uses Gluu's Cedarling WASM module for proper Cedar evaluation,
- * JWT validation, and the Policy Store format. Falls back to the
- * homebrew engine if WASM loading fails.
+ * Uses the official `@cedar-policy/cedar-wasm` build of the AWS/cedar-policy
+ * Rust engine — the same crate family as the `cedar` CLI. It exposes
+ * `isAuthorized(call)` directly, so we no longer need Gluu's Cedarling policy
+ * store, JWT/OIDC machinery, JSONLogic principal-boolean-op, two-phase init,
+ * or the fragile `import.meta.resolve` WASM-path lookup.
+ *
+ * SECURITY MODEL (see carapace-engine-review-fable.md, MUST-FIX):
+ *   1. FAIL CLOSED on any evaluation error — never degrade to a string matcher
+ *      that ignores `when { ... }` clauses.
+ *   2. HARD ERROR at startup if the engine cannot load or self-test — never
+ *      boot into a degraded mode that prints "active".
+ *   3. BOOT SELF-TEST: evaluate a known `when`-gated deny against a matching
+ *      context (expect DENY) and a non-matching context (expect ALLOW) and
+ *      refuse to serve if the gate misbehaves.
+ *
+ * The class name `CedarlingEngine` is retained for drop-in compatibility with
+ * `src/index.ts` and the existing test suite; internally it is a native Cedar
+ * evaluator with no Cedarling dependency.
  */
 import type { Logger, AuthzRequest, CedarDecision, VerifyResult, CedarSchemaInfo } from "./types.js";
 export interface CedarlingEngineOpts {
@@ -21,46 +36,66 @@ export declare class CedarlingEngine {
     private logger;
     private namespace;
     private agentEntityType;
-    private cedarling;
-    private wasmModule;
     private policies;
     private schemaJson;
     private schemaRaw;
-    private lastPolicyMtimeMs;
+    private lastPolicySignature;
     private reloadInFlight;
     private initialized;
+    private initInFlight;
+    private engineReady;
     constructor(opts: CedarlingEngineOpts);
     init(): Promise<void>;
     /**
-     * Idempotently ensure policies are loaded from disk.
-     *
-     * The background service calls init() at startup, but read-only callers
-     * (the `carapace status`/`check`/`verify` CLI commands) run in a process
-     * where the service never started. Without this, getPolicies() returns an
-     * empty map and the CLI falsely reports "0 policies loaded" even though the
-     * live hook enforces correctly. Safe to call multiple times.
+     * Idempotently ensure policies are loaded from disk. Read-only CLI callers
+     * (status/check/verify) run in a process where the service never started.
      */
     ensureLoaded(): Promise<void>;
     /**
-     * Authorize a request using Cedarling WASM.
+     * Authorize a request with the native Cedar engine.
+     *
+     * FAIL CLOSED: any evaluation error, engine-not-ready, or parse failure
+     * returns a DENY. There is no string-matching fallback — degrading to a
+     * matcher that ignores `when` clauses is what the review flagged as worse
+     * than no guardrail.
      */
     authorize(request: AuthzRequest): Promise<CedarDecision>;
     /**
-     * Enable a resource by adding a permit policy and rebuilding Cedarling.
-     * resourceType: "Tool" | "Shell" | "API"
-     * action: the Cedar action name (e.g., "call_tool", "exec_command", "call_api")
+     * The single evaluation call site. Resolves entity references to the native
+     * engine's {type, id} shape and ALWAYS fully qualifies the type with the
+     * configured namespace (finding a: the hook may send unqualified refs like
+     * `Tool::"write"`; policies use `Jans::Tool::"write"`). Qualifying here — at
+     * the one call site — keeps entity identity consistent.
      */
-    enableResource(qualifiedName: string, resourceType?: string, action?: string): void;
+    private evaluate;
+    /**
+     * Fully qualify an entity {type, id}. If `type` is empty (a bare id) use the
+     * supplied default type. If `type` has no `::` namespace segment, prefix the
+     * configured namespace. Already-qualified types (containing `::`) pass
+     * through unchanged so callers can override the namespace explicitly.
+     */
+    private qualify;
+    /** Build the Record<id, cedarText> static policy set for the native engine. */
+    private buildStaticPolicies;
+    /** Convert a native AuthorizationAnswer into Carapace's CedarDecision. */
+    private decisionFromAnswer;
     /**
-     * Disable a resource by adding a forbid policy and rebuilding Cedarling.
+     * BOOT SELF-TEST. Evaluates a known `when`-gated forbid against a matching
+     * and a non-matching context using an in-memory policy+schema (independent
+     * of on-disk policies). If condition evaluation regresses, `matching` would
+     * come back ALLOW (the exact silent-fallback failure) and we refuse to serve.
      */
+    private bootSelfTest;
+    /** Confirm the native engine module is callable; HARD ERROR otherwise. */
+    private loadEngine;
+    enableResource(qualifiedName: string, resourceType?: string, action?: string): void;
     disableResource(qualifiedName: string, resourceType?: string, action?: string): void;
     /** Backwards-compatible aliases */
     enableTool(qualifiedName: string): void;
     disableTool(qualifiedName: string): void;
     /**
      * Check if a tool is enabled (synchronous check against local policy state).
-     * Checks both specific tool policies AND blanket policies (those without a specific tool name).
+     * Checks both specific tool policies AND blanket policies.
      */
     isToolEnabled(qualifiedName: string): boolean;
     savePolicy(id: string, raw: string): void;
@@ -72,56 +107,46 @@ export declare class CedarlingEngine {
         raw: string;
     }>;
     /**
-     * True when the Cedarling WASM engine is loaded and active. When false, the
-     * engine uses the basic string-matching fallback, which cannot evaluate
-     * `when { ... }` condition clauses (path globs etc.). Callers/tests that
-     * rely on condition evaluation should check this.
+     * True when the native Cedar engine is loaded, self-tested, and serving.
+     * With the native engine there is no degraded string-matcher mode: this is
+     * either fully active or the process refused to start. Retained for the
+     * existing test suite / GUI which query engine health.
      */
     isWasmActive(): boolean;
     /**
-     * Compute the newest mtime (ms) across *.cedar files in the policy dir, plus
-     * a count so that deletions are also detected (count change flips the key).
+     * Content hash of the policy dir: sorted (name,size,content-hash) across
+     * *.cedar files. Unlike mtime+count this catches same-tick edits and edits
+     * that don't change file count or byte length.
      */
     private policyDirSignature;
+    /** Recompute + store the signature after an in-process policy mutation. */
+    private refreshSignature;
     /**
-     * Re-scan the policy directory and rebuild the Cedarling instance if the
-     * on-disk policy set changed since the last load. Cheap when nothing
-     * changed (a directory stat + per-file stat). This closes the gap where
-     * policies added/edited after boot were never enforced until a restart.
+     * Re-scan the policy directory and reload if the on-disk policy set changed
+     * since the last load, keyed on a content hash (finding b). No engine
+     * rebuild is needed — the native engine takes policies per call — so this
+     * just refreshes the in-memory policy map.
      */
     reloadIfChanged(): Promise<void>;
     getSchema(): CedarSchemaInfo;
     saveSchema(raw: string): void;
-    verify(): Promise<VerifyResult>;
-    private loadWasm;
-    /**
-     * Rebuild the Cedarling instance from current policies and schema.
-     * Called after any policy or schema change.
-     */
-    private rebuildCedarling;
     /**
-     * Build a Cedarling Policy Store JSON from current policies and schema.
+     * Verify that policies + schema evaluate cleanly. Runs a probe authorize per
+     * resource type; a native evaluation FAILURE (bad policy/schema) surfaces as
+     * an issue. Also re-asserts the boot self-test so `verify` is a full health
+     * gate.
      */
-    private buildPolicyStore;
+    verify(): Promise<VerifyResult>;
     private loadPoliciesFromDisk;
     private writePolicyFile;
     private removePolicyFile;
     private writeDefaultSchema;
     /**
-     * Context attributes shared by tool-call actions.
-     *
-     * The before_tool_call hook cannot know every tool's parameter shape ahead
-     * of time, and Cedar records are CLOSED (an undeclared attribute makes
-     * Cedarling reject the whole context). So instead of surfacing the raw,
-     * open params object, the hook serializes params to a single JSON string
-     * (`params_json`) plus a couple of commonly-matched scalars (`path`,
-     * `action`). Policies match with `like` globs, e.g.
-     *   when { context.path like "*openclaw.json*" }
-     *   when { context.params_json like "*\"secret\"*" }
-     * All optional, so a call with empty context still validates.
+     * Context attributes shared by tool-call actions. Cedar records are CLOSED,
+     * so the hook serializes params to `params_json` plus a couple of commonly
+     * matched scalars (`path`, `action`). Policies match with `like` globs.
      */
     private toolContextAttributes;
     private buildDefaultSchemaJson;
-    private authorizeBasic;
     private parseSchemaForGui;
 }