@clawdreyhepburn/carapace 1.0.4 → 1.0.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +58 -166
- package/dist/cedar-engine-cedarling.js +19 -65
- package/dist/cedar-engine-cedarling.js.map +1 -1
- package/dist/gui/html.js +14 -0
- package/dist/gui/html.js.map +1 -1
- package/dist/gui/server.d.ts +2 -0
- package/dist/gui/server.js +6 -14
- package/dist/gui/server.js.map +1 -1
- package/dist/index.d.ts +20 -5
- package/dist/index.js +230 -337
- package/dist/index.js.map +1 -1
- package/dist/llm-proxy.d.ts +1 -2
- package/dist/llm-proxy.js +6 -10
- package/dist/llm-proxy.js.map +1 -1
- package/dist/policy-source.d.ts +13 -0
- package/dist/policy-source.js +23 -0
- package/dist/policy-source.js.map +1 -1
- package/dist/types.d.ts +4 -1
- package/docs/RECOMMENDED-POLICIES.md +2 -2
- package/docs/SECURITY.md +36 -136
- package/openclaw.plugin.json +1 -1
- package/package.json +1 -1
- package/policies/00-schema.cedar +30 -0
- package/policies/10-shell-deny.cedar +51 -0
- package/policies/20-shell-permit.cedar +60 -0
- package/policies/30-shell-path-guards.cedar +86 -0
- package/policies/40-api-policy.cedar +70 -0
- package/policies/50-tool-policy.cedar +38 -0
- package/policies/schema.json +88 -0
- package/src/index.ts +8 -3
- package/src/llm-proxy.ts +13 -0
- package/src/policy-source.ts +22 -0
package/dist/gui/server.js
CHANGED
|
@@ -12,11 +12,13 @@ export class ControlGui {
|
|
|
12
12
|
cedar;
|
|
13
13
|
logger;
|
|
14
14
|
server = null;
|
|
15
|
+
proxyEnabled;
|
|
15
16
|
constructor(opts) {
|
|
16
17
|
this.port = opts.port;
|
|
17
18
|
this.aggregator = opts.aggregator;
|
|
18
19
|
this.cedar = opts.cedar;
|
|
19
20
|
this.logger = opts.logger;
|
|
21
|
+
this.proxyEnabled = opts.proxyEnabled ?? false;
|
|
20
22
|
}
|
|
21
23
|
async start() {
|
|
22
24
|
this.server = createServer((req, res) => this.handleRequest(req, res));
|
|
@@ -45,13 +47,16 @@ export class ControlGui {
|
|
|
45
47
|
if (url.pathname === "/api/status" && req.method === "GET") {
|
|
46
48
|
const servers = this.aggregator.getServerStatus();
|
|
47
49
|
const tools = this.aggregator.listTools();
|
|
50
|
+
const enabledCount = tools.filter((t) => t.enabled).length;
|
|
48
51
|
this.json(res, {
|
|
49
52
|
servers,
|
|
50
53
|
tools,
|
|
51
54
|
policies: this.cedar.getPolicies(),
|
|
52
55
|
toolCount: tools.length,
|
|
53
|
-
enabledCount
|
|
56
|
+
enabledCount,
|
|
54
57
|
defaultPolicy: this.cedar.getDefaultPolicy?.() ?? "allow-all",
|
|
58
|
+
proxyEnabled: this.proxyEnabled,
|
|
59
|
+
notEnforcing: !this.proxyEnabled && enabledCount === 0,
|
|
55
60
|
});
|
|
56
61
|
return;
|
|
57
62
|
}
|
|
@@ -111,19 +116,6 @@ export class ControlGui {
|
|
|
111
116
|
this.json(res, { ok: true });
|
|
112
117
|
return;
|
|
113
118
|
}
|
|
114
|
-
if (url.pathname === "/api/agents" && req.method === "GET") {
|
|
115
|
-
// Agent hierarchy removed — see @clawdreyhepburn/ovid-me for per-agent mandates
|
|
116
|
-
this.json(res, []);
|
|
117
|
-
return;
|
|
118
|
-
}
|
|
119
|
-
if (url.pathname === "/api/policy-source" && req.method === "GET") {
|
|
120
|
-
// Return all Cedar policies (deployment-wide ceiling)
|
|
121
|
-
const policies = this.cedar.getPolicies();
|
|
122
|
-
const policyText = policies.map(p => p.raw).join("\n\n");
|
|
123
|
-
res.writeHead(200, { "Content-Type": "text/plain; charset=utf-8" });
|
|
124
|
-
res.end(policyText || "# No policies defined\n");
|
|
125
|
-
return;
|
|
126
|
-
}
|
|
127
119
|
// --- GUI ---
|
|
128
120
|
if (url.pathname === "/" || url.pathname === "/index.html") {
|
|
129
121
|
res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });
|
package/dist/gui/server.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/gui/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAGjG,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;
|
|
1
|
+
{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/gui/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AAGjG,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAUpC,MAAM,OAAO,UAAU;IACb,IAAI,CAAS;IACb,UAAU,CAAgB;IAC1B,KAAK,CAAuB;IAC5B,MAAM,CAAS;IACf,MAAM,GAAkB,IAAI,CAAC;IAC7B,YAAY,CAAU;IAE9B,YAAY,IAAa;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;QACvE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;gBAC/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;gBACnE,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,MAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,GAAoB,EAAE,GAAmB;QACnE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAErE,IAAI,CAAC;YACH,qBAAqB;YACrB,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;gBAC1C,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;oBACb,OAAO;oBACP,KAAK;oBACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;oBAClC,SAAS,EAAE,KAAK,CAAC,MAAM;oBACvB,YAAY;oBACZ,aAAa,EAAE,IAAI,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,IAAI,WAAW;oBAC7D,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,YAAY,EAAE,CAAC,IAAI,CAAC,YAAY,IAAI,YAAY,KAAK,CAAC;iBACvD,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC1D,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;gBAClD,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACtC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3C,IAAI,OAAO,EAAE,CAAC;oBACZ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBAC9B,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBAC/B,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACvB,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC7D,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACtC,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACrC,IAAI,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;oBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;oBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC,CAAC,CAAC;oBAC9D,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC/B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;gBACjC,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACtC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;gBAC5C,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;gBACpC,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;gBAC3D,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACtC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACjC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC7B,OAAO;YACT,CAAC;YAED,cAAc;YACd,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC3D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;gBACnE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YAED,MAAM;YACN,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YAC/C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,GAAmB,EAAE,IAAS;QACzC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;YACjB,cAAc,EAAE,kBAAkB;YAClC,6BAA6B,EAAE,GAAG;SACnC,CAAC,CAAC;QACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;IAEO,QAAQ,CAAC,GAAoB;QACnC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YAC9C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC/D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}
|
package/dist/index.d.ts
CHANGED
|
@@ -1,16 +1,13 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* Carapace — OpenClaw Plugin
|
|
3
3
|
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
4
|
+
* Enforces Cedar policies on tool access via OpenClaw's before_tool_call hook.
|
|
5
|
+
* No proxy, no baseUrl redirect, no models.json patching.
|
|
6
6
|
*/
|
|
7
|
-
export { CarapacePolicySource } from "./policy-source.js";
|
|
8
|
-
export type { PolicySource } from "./policy-source.js";
|
|
9
7
|
export declare const id = "carapace";
|
|
10
8
|
export declare const name = "Carapace";
|
|
11
9
|
/**
|
|
12
10
|
* OpenClaw plugin API shape (matches real runtime).
|
|
13
|
-
* We define it here to avoid depending on OpenClaw types at build time.
|
|
14
11
|
*/
|
|
15
12
|
interface OpenClawPluginApi {
|
|
16
13
|
pluginConfig: any;
|
|
@@ -34,6 +31,23 @@ interface OpenClawPluginApi {
|
|
|
34
31
|
}, opts?: {
|
|
35
32
|
optional?: boolean;
|
|
36
33
|
}): void;
|
|
34
|
+
registerHook?(hookName: string | string[], handler: (event: any) => Promise<any> | any, opts?: {
|
|
35
|
+
name: string;
|
|
36
|
+
description?: string;
|
|
37
|
+
priority?: number;
|
|
38
|
+
}): void;
|
|
39
|
+
/**
|
|
40
|
+
* Typed hook registration. Exposed by the real OpenClaw runtime in full
|
|
41
|
+
* registration mode (see loader `registerTypedHook`). This is the API this
|
|
42
|
+
* plugin actually uses to install the `before_tool_call` hook — declared
|
|
43
|
+
* optional here because some test harnesses construct a stripped-down api
|
|
44
|
+
* shim without it.
|
|
45
|
+
*/
|
|
46
|
+
on?(hookName: string, handler: (event: any, ctx?: any) => Promise<any> | any, opts?: {
|
|
47
|
+
name?: string;
|
|
48
|
+
description?: string;
|
|
49
|
+
priority?: number;
|
|
50
|
+
}): void;
|
|
37
51
|
registerCli?(fn: (ctx: {
|
|
38
52
|
program: any;
|
|
39
53
|
}) => void, opts?: {
|
|
@@ -44,3 +58,4 @@ interface OpenClawPluginApi {
|
|
|
44
58
|
}) => void): void;
|
|
45
59
|
}
|
|
46
60
|
export default function register(api: OpenClawPluginApi): void;
|
|
61
|
+
export {};
|