@clawdreyhepburn/carapace 1.0.4 → 1.0.6

package/dist/index.js

@@ -1,16 +1,46 @@
 /**
  * Carapace — OpenClaw Plugin
  *
- * Aggregates upstream MCP servers, enforces Cedar policies on tool access,
- * and serves a local GUI for human oversight.
+ * Enforces Cedar policies on tool access via OpenClaw's before_tool_call hook.
+ * No proxy, no baseUrl redirect, no models.json patching.
  */
 import { CedarlingEngine } from "./cedar-engine-cedarling.js";
 import { McpAggregator } from "./mcp-aggregator.js";
 import { ControlGui } from "./gui/server.js";
-import { LlmProxy } from "./llm-proxy.js";
-export { CarapacePolicySource } from "./policy-source.js";
 export const id = "carapace";
 export const name = "Carapace";
+/**
+ * @deprecated Kept for backward compatibility. No longer used.
+ */
+function buildUpstreamConfig(proxyConfig) {
+    const upstream = proxyConfig.upstream;
+    if (!upstream)
+        return {};
+    if (typeof upstream === "string") {
+        const apiKey = proxyConfig.apiKey ?? "";
+        if (upstream.includes("anthropic"))
+            return { anthropic: { url: upstream, apiKey } };
+        if (upstream.includes("openai"))
+            return { openai: { url: upstream, apiKey } };
+        return { anthropic: { url: upstream, apiKey } };
+    }
+    return {
+        anthropic: upstream.anthropic ? { url: upstream.anthropic.url ?? "https://api.anthropic.com", apiKey: upstream.anthropic.apiKey } : undefined,
+        openai: upstream.openai ? { url: upstream.openai.url ?? "https://api.openai.com", apiKey: upstream.openai.apiKey } : undefined,
+    };
+}
+// Audit log
+function appendAuditLog(entry) {
+    try {
+        const { appendFileSync, mkdirSync } = require("node:fs");
+        const { join } = require("node:path");
+        const { homedir } = require("node:os");
+        const logDir = join(homedir(), ".openclaw", "mcp-policies", "logs");
+        mkdirSync(logDir, { recursive: true });
+        appendFileSync(join(logDir, "audit.log"), JSON.stringify(entry) + "\n", "utf-8");
+    }
+    catch { }
+}
 export default function register(api) {
     const config = api.pluginConfig ?? {};
     const logger = api.logger;
@@ -30,103 +60,97 @@ export default function register(api) {
         aggregator,
         cedar,
         logger,
+        proxyEnabled: false, // proxy no longer used
     });
-    // --- LLM Proxy: intercept tool calls at the API level ---
-    const proxyConfig = config.proxy;
-    const proxy = proxyConfig?.enabled ? new LlmProxy({
-        port: proxyConfig.port ?? 19821,
-        upstream: {
-            anthropic: proxyConfig.upstream?.anthropic ? {
-                url: proxyConfig.upstream.anthropic.url ?? "https://api.anthropic.com",
-                apiKey: proxyConfig.upstream.anthropic.apiKey,
-            } : undefined,
-            openai: proxyConfig.upstream?.openai ? {
-                url: proxyConfig.upstream.openai.url ?? "https://api.openai.com",
-                apiKey: proxyConfig.upstream.openai.apiKey,
-            } : undefined,
-        },
-        cedar,
-        logger,
-    }) : null;
-    // --- Bypass detection: warn if built-in tools aren't denied ---
-    const BYPASS_TOOLS = ["exec", "web_fetch", "web_search"];
-    function checkForBypasses() {
-        // Read OpenClaw config to check tools.deny
-        try {
-            const { readFileSync, existsSync } = require("node:fs");
-            const { join } = require("node:path");
-            const { homedir } = require("node:os");
-            const configPath = join(homedir(), ".openclaw", "openclaw.json");
-            if (!existsSync(configPath))
-                return BYPASS_TOOLS;
-            const cfg = JSON.parse(readFileSync(configPath, "utf-8"));
-            const denied = cfg.tools?.deny ?? [];
-            return BYPASS_TOOLS.filter((t) => !denied.includes(t));
-        }
-        catch {
-            return BYPASS_TOOLS;
-        }
-    }
-    function patchConfigDenyTools() {
-        const { readFileSync, writeFileSync, existsSync } = require("node:fs");
-        const { join } = require("node:path");
-        const { homedir } = require("node:os");
-        const configPath = join(homedir(), ".openclaw", "openclaw.json");
-        let cfg = {};
-        if (existsSync(configPath)) {
-            cfg = JSON.parse(readFileSync(configPath, "utf-8"));
-        }
-        if (!cfg.tools)
-            cfg.tools = {};
-        if (!cfg.tools.deny)
-            cfg.tools.deny = [];
-        const alreadyDenied = BYPASS_TOOLS.filter((t) => cfg.tools.deny.includes(t));
-        const toAdd = BYPASS_TOOLS.filter((t) => !cfg.tools.deny.includes(t));
-        for (const tool of toAdd) {
-            cfg.tools.deny.push(tool);
-        }
-        if (toAdd.length > 0) {
-            writeFileSync(configPath, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
-        }
-        return { patched: toAdd, alreadyDenied };
-    }
-    function patchConfigProxyBaseUrl() {
-        const { readFileSync, writeFileSync, existsSync } = require("node:fs");
-        const { join } = require("node:path");
-        const { homedir } = require("node:os");
-        const configPath = join(homedir(), ".openclaw", "openclaw.json");
-        if (!existsSync(configPath))
-            return { patched: [], alreadySet: [] };
-        const cfg = JSON.parse(readFileSync(configPath, "utf-8"));
-        const port = config.proxy?.port ?? 19821;
-        const proxyUrl = `http://127.0.0.1:${port}`;
-        // Figure out which providers have upstream keys configured
-        const providers = [];
-        if (config.proxy?.upstream?.anthropic)
-            providers.push("anthropic");
-        if (config.proxy?.upstream?.openai)
-            providers.push("openai");
-        const patched = [];
-        const alreadySet = [];
-        if (!cfg.models)
-            cfg.models = {};
-        if (!cfg.models.providers)
-            cfg.models.providers = {};
-        for (const provider of providers) {
-            if (!cfg.models.providers[provider])
-                cfg.models.providers[provider] = {};
-            if (cfg.models.providers[provider].baseUrl === proxyUrl) {
-                alreadySet.push(provider);
+    // --- Hook stats ---
+    const stats = {
+        toolCallsEvaluated: 0,
+        toolCallsDenied: 0,
+    };
+    // --- Register before_tool_call hook ---
+    if (api.on) {
+        api.on("before_tool_call", async (event) => {
+            const toolName = event.toolName ?? event.tool ?? event.name ?? "";
+            const params = event.params ?? event.arguments ?? event.input ?? {};
+            if (!toolName)
+                return {};
+            stats.toolCallsEvaluated++;
+            // Map tool call to Cedar authorization request
+            let resourceType = "Tool";
+            let action = "call_tool";
+            let resourceId = toolName;
+            let context = {};
+            // Map known OpenClaw built-in tools to resource types
+            if (toolName === "exec" || toolName === "process") {
+                resourceType = "Shell";
+                action = "exec_command";
+                const cmd = params.command ?? "";
+                resourceId = cmd.trim().split(/\s+/)[0]?.replace(/^.*\//, "") || toolName;
+                context = { args: cmd, workdir: params.workdir ?? "" };
+            }
+            else if (toolName === "web_fetch" || toolName === "web_search") {
+                resourceType = "API";
+                action = "call_api";
+                const url = params.url ?? params.query ?? "";
+                try {
+                    resourceId = url.startsWith("http") ? new URL(url).hostname : toolName;
+                }
+                catch {
+                    resourceId = toolName;
+                }
+                context = { url, method: params.method ?? "GET", body: params.body ?? "" };
+            }
+            else if (toolName === "browser") {
+                resourceType = "Tool";
+                action = "call_tool";
+                resourceId = "browser";
+                context = { action: params.action ?? "" };
             }
             else {
-                cfg.models.providers[provider].baseUrl = proxyUrl;
-                patched.push(provider);
+                // MCP or other tools
+                context = params ? { arguments: params } : {};
             }
-        }
-        if (patched.length > 0) {
-            writeFileSync(configPath, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
-        }
-        return { patched, alreadySet };
+            // Short-circuit: if default policy is allow-all and no Cedar policies are loaded,
+            // skip Cedar evaluation entirely (Cedar is deny-by-default with no policies)
+            const effectiveDefault = config.defaultPolicy ?? "allow-all";
+            const policies = cedar.getPolicies?.() ?? [];
+            if (effectiveDefault === "allow-all" && policies.length === 0) {
+                logger.info(`✅ [Carapace] ALLOW (no policies, default allow-all): ${toolName}`);
+                return {};
+            }
+            const decision = await cedar.authorize({
+                principal: `Agent::"openclaw"`,
+                action: `Action::"${action}"`,
+                resource: `${resourceType}::"${resourceId}"`,
+                context,
+            });
+            // If Cedar returns no definitive decision and default is allow-all, allow
+            if (effectiveDefault === "allow-all" && decision.decision !== "deny") {
+                return {};
+            }
+            const auditEntry = {
+                timestamp: new Date().toISOString(),
+                tool: toolName,
+                decision: decision.decision,
+                reasons: decision.reasons,
+                params: Object.keys(params).length > 0 ? params : undefined,
+            };
+            appendAuditLog(auditEntry);
+            if (decision.decision === "deny") {
+                stats.toolCallsDenied++;
+                const reason = `Cedar policy denied: ${toolName} (${decision.reasons.join(", ") || "default deny"})`;
+                logger.info(`🚫 ${reason}`);
+                return { block: true, blockReason: reason };
+            }
+            return {};
+        }, {
+            name: "carapace.cedar-enforcement",
+            description: "Cedar policy enforcement for all tool calls",
+        });
+        logger.info("Registered before_tool_call hook for Cedar policy enforcement");
+    }
+    else {
+        logger.warn("⚠️  before_tool_call hook not available — Cedar policies will NOT be enforced on built-in tools");
     }
     // --- Background service: connect to MCP servers and serve GUI ---
     api.registerService({
@@ -137,24 +161,16 @@ export default function register(api) {
             await aggregator.connectAll();
             await gui.start();
             logger.info(`Control GUI at http://localhost:${config.guiPort ?? 19820}`);
-            if (proxy) {
-                await proxy.start();
-                logger.info(`🛡️  LLM Proxy active on http://127.0.0.1:${proxyConfig.port ?? 19821} — ` +
-                    `all tool calls go through Cedar`);
-            }
-            else {
-                // Check for bypass vulnerabilities only when proxy is disabled
-                const bypasses = checkForBypasses();
-                if (bypasses.length > 0) {
-                    logger.warn(`⚠️  BYPASS RISK: Built-in tools [${bypasses.join(", ")}] are NOT denied and LLM proxy is not enabled. ` +
-                        `Agents can use these to bypass Carapace Cedar policies. ` +
-                        `Enable the LLM proxy (recommended) or run "openclaw carapace setup" to deny built-in tools.`);
-                }
+            // Warn if no policies are loaded
+            const policies = cedar.getPolicies();
+            if (policies.length === 0) {
+                logger.warn(`⚠️  Carapace is loaded but NOT ENFORCING — no Cedar policies found. ` +
+                    `Add policies to ${config.policyDir ?? "~/.openclaw/mcp-policies/"} or use the GUI at http://localhost:${config.guiPort ?? 19820}`);
             }
+            logger.info(`🛡️  Cedar enforcement active via before_tool_call hook — ` +
+                `${policies.length} policies loaded, default: ${config.defaultPolicy ?? "allow-all"}`);
         },
         async stop() {
-            if (proxy)
-                await proxy.stop();
             await gui.stop();
             await aggregator.disconnectAll();
             logger.info("Carapace stopped");
@@ -177,16 +193,11 @@ export default function register(api) {
         async execute(_toolCallId, params) {
             const tools = aggregator.listTools(params.server);
             return {
-                content: [
-                    {
-                        type: "text",
-                        text: JSON.stringify(tools, null, 2),
-                    },
-                ],
+                content: [{ type: "text", text: JSON.stringify(tools, null, 2) }],
             };
         },
     });
-    // --- Agent tool: invoke an MCP tool through the proxy ---
+    // --- Agent tool: invoke an MCP tool through Cedar ---
     api.registerTool({
         name: "mcp_call",
         label: "MCP Call (Carapace)",
@@ -207,7 +218,6 @@ export default function register(api) {
         },
         async execute(_toolCallId, params) {
             const { tool, arguments: args } = params;
-            // Authorize via Cedar
             const decision = await cedar.authorize({
                 principal: 'Agent::"openclaw"',
                 action: 'Action::"call_tool"',
@@ -216,48 +226,31 @@ export default function register(api) {
             });
             if (decision.decision === "deny") {
                 return {
-                    content: [
-                        {
-                            type: "text",
-                            text: `DENIED by Cedar policy: ${tool}\nReason: ${decision.reasons.join(", ") || "default deny"}`,
-                        },
-                    ],
+                    content: [{ type: "text", text: `DENIED by Cedar policy: ${tool}\nReason: ${decision.reasons.join(", ") || "default deny"}` }],
                     isError: true,
                 };
             }
-            // Forward to upstream MCP server
             const result = await aggregator.callTool(tool, args ?? {});
             return result;
         },
     });
-    // --- Agent tool: execute a shell command through Cedar authorization ---
+    // --- Agent tool: Cedar-gated shell exec ---
     api.registerTool({
         name: "carapace_exec",
         label: "Shell Exec (Carapace)",
-        description: "Execute a shell command through the Carapace Cedar proxy. The command is authorized by Cedar policies before execution. Use this when you want Cedar-gated shell access.",
+        description: "Execute a shell command through the Carapace Cedar proxy. The command is authorized by Cedar policies before execution.",
         parameters: {
             type: "object",
             required: ["command"],
             properties: {
-                command: {
-                    type: "string",
-                    description: "The shell command to execute (e.g., 'git status', 'npm install')",
-                },
-                workdir: {
-                    type: "string",
-                    description: "Working directory for the command (optional)",
-                },
-                timeout: {
-                    type: "number",
-                    description: "Timeout in seconds (default: 30)",
-                },
+                command: { type: "string", description: "The shell command to execute" },
+                workdir: { type: "string", description: "Working directory (optional)" },
+                timeout: { type: "number", description: "Timeout in seconds (default: 30)" },
             },
         },
         async execute(_toolCallId, params) {
             const { command, workdir, timeout = 30 } = params;
-            // Extract the binary name for policy matching
             const binary = command.trim().split(/\s+/)[0].replace(/^.*\//, "");
-            // Authorize via Cedar
             const decision = await cedar.authorize({
                 principal: `Agent::"openclaw"`,
                 action: `Action::"exec_command"`,
@@ -266,16 +259,10 @@ export default function register(api) {
             });
             if (decision.decision === "deny") {
                 return {
-                    content: [
-                        {
-                            type: "text",
-                            text: `DENIED by Cedar policy: shell command "${binary}"\nFull command: ${command}\nReason: ${decision.reasons.join(", ") || "default deny"}`,
-                        },
-                    ],
+                    content: [{ type: "text", text: `DENIED by Cedar policy: shell command "${binary}"\nFull command: ${command}\nReason: ${decision.reasons.join(", ") || "default deny"}` }],
                     isError: true,
                 };
             }
-            // Execute the command
             try {
                 const { execSync } = await import("node:child_process");
                 const result = execSync(command, {
@@ -285,64 +272,41 @@ export default function register(api) {
                     encoding: "utf-8",
                     stdio: ["pipe", "pipe", "pipe"],
                 });
-                return {
-                    content: [{ type: "text", text: result }],
-                };
+                return { content: [{ type: "text", text: result }] };
             }
             catch (err) {
-                const output = err.stdout ?? err.stderr ?? err.message;
                 return {
-                    content: [{ type: "text", text: `Command failed (exit ${err.status ?? "?"}): ${output}` }],
+                    content: [{ type: "text", text: `Command failed (exit ${err.status ?? "?"}): ${err.stdout ?? err.stderr ?? err.message}` }],
                     isError: true,
                 };
             }
         },
     }, { optional: true });
-    // --- Agent tool: make an HTTP API call through Cedar authorization ---
+    // --- Agent tool: Cedar-gated HTTP fetch ---
     api.registerTool({
         name: "carapace_fetch",
         label: "API Fetch (Carapace)",
-        description: "Make an HTTP API call through the Carapace Cedar proxy. The request is authorized by Cedar policies before being sent. Use this when you want Cedar-gated outbound API access.",
+        description: "Make an HTTP API call through Carapace Cedar authorization.",
         parameters: {
             type: "object",
             required: ["url"],
             properties: {
-                url: {
-                    type: "string",
-                    description: "The URL to fetch",
-                },
-                method: {
-                    type: "string",
-                    description: "HTTP method (GET, POST, PUT, DELETE, PATCH). Default: GET",
-                },
-                headers: {
-                    type: "object",
-                    description: "HTTP headers to include",
-                },
-                body: {
-                    type: "string",
-                    description: "Request body (for POST/PUT/PATCH)",
-                },
-                timeout: {
-                    type: "number",
-                    description: "Timeout in seconds (default: 30)",
-                },
+                url: { type: "string", description: "The URL to fetch" },
+                method: { type: "string", description: "HTTP method (default: GET)" },
+                headers: { type: "object", description: "HTTP headers" },
+                body: { type: "string", description: "Request body" },
+                timeout: { type: "number", description: "Timeout in seconds (default: 30)" },
             },
         },
         async execute(_toolCallId, params) {
             const { url, method = "GET", headers = {}, body, timeout = 30 } = params;
-            // Extract domain for policy matching
             let domain;
             try {
                 domain = new URL(url).hostname;
             }
             catch {
-                return {
-                    content: [{ type: "text", text: `Invalid URL: ${url}` }],
-                    isError: true,
-                };
+                return { content: [{ type: "text", text: `Invalid URL: ${url}` }], isError: true };
             }
-            // Authorize via Cedar
             const decision = await cedar.authorize({
                 principal: `Agent::"openclaw"`,
                 action: `Action::"call_api"`,
@@ -351,51 +315,27 @@ export default function register(api) {
             });
             if (decision.decision === "deny") {
                 return {
-                    content: [
-                        {
-                            type: "text",
-                            text: `DENIED by Cedar policy: API call to "${domain}"\nURL: ${url}\nMethod: ${method}\nReason: ${decision.reasons.join(", ") || "default deny"}`,
-                        },
-                    ],
+                    content: [{ type: "text", text: `DENIED by Cedar policy: API call to "${domain}"\nURL: ${url}\nReason: ${decision.reasons.join(", ") || "default deny"}` }],
                     isError: true,
                 };
             }
-            // Make the HTTP request
             try {
                 const controller = new AbortController();
                 const timer = setTimeout(() => controller.abort(), timeout * 1000);
-                const response = await fetch(url, {
-                    method,
-                    headers,
-                    body: body ?? undefined,
-                    signal: controller.signal,
-                });
+                const response = await fetch(url, { method, headers, body: body ?? undefined, signal: controller.signal });
                 clearTimeout(timer);
                 const responseText = await response.text();
-                const truncated = responseText.length > 50000
-                    ? responseText.slice(0, 50000) + "\n...[truncated]"
-                    : responseText;
-                return {
-                    content: [
-                        {
-                            type: "text",
-                            text: `HTTP ${response.status} ${response.statusText}\n\n${truncated}`,
-                        },
-                    ],
-                    isError: !response.ok,
-                };
+                const truncated = responseText.length > 50000 ? responseText.slice(0, 50000) + "\n...[truncated]" : responseText;
+                return { content: [{ type: "text", text: `HTTP ${response.status} ${response.statusText}\n\n${truncated}` }], isError: !response.ok };
             }
             catch (err) {
-                return {
-                    content: [{ type: "text", text: `API call failed: ${err.message}` }],
-                    isError: true,
-                };
+                return { content: [{ type: "text", text: `API call failed: ${err.message}` }], isError: true };
             }
         },
     }, { optional: true });
-    // --- CLI command ---
+    // --- CLI commands ---
     api.registerCli?.(({ program }) => {
-        const cmd = program.command("carapace").description("Carapace — MCP tool authorization");
+        const cmd = program.command("carapace").description("Carapace — Cedar policy enforcement for agent tools");
         cmd.command("status").action(async () => {
             const servers = aggregator.getServerStatus();
             console.log("\n🦞 Carapace Status\n");
@@ -407,14 +347,11 @@ export default function register(api) {
             const enabled = tools.filter((t) => t.enabled).length;
             console.log(`\n  ${enabled}/${tools.length} tools enabled`);
             console.log(`  GUI: http://localhost:${config.guiPort ?? 19820}`);
-            if (proxy) {
-                const stats = proxy.getStats();
-                console.log(`\n  🛡️  LLM Proxy: http://127.0.0.1:${proxyConfig.port ?? 19821}`);
-                console.log(`  Requests: ${stats.requests} | Tool calls evaluated: ${stats.toolCallsEvaluated} | Denied: ${stats.toolCallsDenied}`);
-            }
-            else {
-                console.log(`\n  ⚠️  LLM Proxy: disabled`);
-            }
+            const policies = cedar.getPolicies();
+            console.log(`\n  🛡️  Enforcement: before_tool_call hook`);
+            console.log(`  Policies: ${policies.length} loaded`);
+            console.log(`  Default: ${config.defaultPolicy ?? "allow-all"}`);
+            console.log(`  Evaluated: ${stats.toolCallsEvaluated} | Denied: ${stats.toolCallsDenied}`);
             console.log();
         });
         cmd.command("tools").action(async () => {
@@ -431,146 +368,94 @@ export default function register(api) {
             }
             else {
                 console.log("⚠️  Verification issues:");
-                for (const issue of result.issues) {
+                for (const issue of result.issues)
                     console.log(`  - ${issue}`);
-                }
             }
         });
         cmd.command("setup")
-            .description("Configure OpenClaw to route all traffic through Carapace")
+            .description("Enable Carapace plugin in OpenClaw config")
             .action(async () => {
+            const { readFileSync, writeFileSync, existsSync } = require("node:fs");
+            const { join } = require("node:path");
+            const { homedir } = require("node:os");
             console.log("\n🦞 Carapace Setup\n");
-            let anyChanges = false;
-            // 1. Deny built-in bypass tools
-            const bypasses = checkForBypasses();
-            if (bypasses.length > 0) {
-                console.log("  Denying built-in tools that bypass Cedar:");
-                const { patched, alreadyDenied } = patchConfigDenyTools();
-                if (alreadyDenied.length > 0) {
-                    console.log(`    Already denied: ${alreadyDenied.join(", ")}`);
-                }
-                if (patched.length > 0) {
-                    console.log(`    ✅ Added to tools.deny: ${patched.join(", ")}`);
-                    anyChanges = true;
-                }
+            const configPath = join(homedir(), ".openclaw", "openclaw.json");
+            let cfg = {};
+            if (existsSync(configPath)) {
+                cfg = JSON.parse(readFileSync(configPath, "utf-8"));
             }
-            else {
-                console.log("  ✅ Built-in bypass tools already denied.");
+            if (!cfg.plugins)
+                cfg.plugins = {};
+            if (!cfg.plugins.entries)
+                cfg.plugins.entries = {};
+            if (!cfg.plugins.entries.carapace)
+                cfg.plugins.entries.carapace = {};
+            const alreadyEnabled = cfg.plugins.entries.carapace.enabled === true;
+            cfg.plugins.entries.carapace.enabled = true;
+            if (!cfg.plugins.entries.carapace.config) {
+                cfg.plugins.entries.carapace.config = {
+                    defaultPolicy: "allow-all",
+                };
             }
-            // 2. Set up LLM proxy baseUrl if proxy is configured
-            if (config.proxy?.enabled) {
-                console.log("\n  Configuring LLM proxy baseUrl:");
-                const { patched, alreadySet } = patchConfigProxyBaseUrl();
-                if (alreadySet.length > 0) {
-                    console.log(`    Already set: ${alreadySet.join(", ")}`);
-                }
-                if (patched.length > 0) {
-                    console.log(`    ✅ Set models.providers baseUrl for: ${patched.join(", ")}`);
-                    anyChanges = true;
-                }
-                if (patched.length === 0 && alreadySet.length === 0) {
-                    console.log("    ⚠️  No upstream providers configured in proxy config.");
-                    console.log("       Add proxy.upstream.anthropic or proxy.upstream.openai to your plugin config.");
-                }
+            writeFileSync(configPath, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
+            if (alreadyEnabled) {
+                console.log("  ✅ Carapace already enabled. No changes needed.\n");
             }
             else {
-                console.log("\n  LLM proxy not enabled — skipping baseUrl setup.");
-                console.log("  To enable, add proxy.enabled: true to your Carapace plugin config.");
-            }
-            if (anyChanges) {
+                console.log("  ✅ Enabled carapace plugin in openclaw.json");
+                console.log("  🛡️  Cedar policies enforced via before_tool_call hook");
+                console.log("  📋 No models.json or baseUrl changes needed");
                 console.log("\n  Restart the gateway for changes to take effect:");
                 console.log("    openclaw gateway restart\n");
             }
-            else {
-                console.log("\n  ✅ Everything already configured. No changes needed.\n");
-            }
         });
         cmd.command("uninstall")
-            .description("Reverse all config changes made by Carapace (restores built-in tools)")
+            .description("Disable Carapace plugin")
             .action(async () => {
+            const { readFileSync, writeFileSync, existsSync } = require("node:fs");
+            const { join } = require("node:path");
+            const { homedir } = require("node:os");
             console.log("\n🦞 Carapace Uninstall\n");
-            console.log("  This reverses changes made by 'openclaw carapace setup'.\n");
-            try {
-                const { readFileSync, writeFileSync, existsSync } = require("node:fs");
-                const { join } = require("node:path");
-                const { homedir } = require("node:os");
-                const configPath = join(homedir(), ".openclaw", "openclaw.json");
-                if (!existsSync(configPath)) {
-                    console.log("  No config file found. Nothing to undo.\n");
-                    return;
-                }
-                const cfg = JSON.parse(readFileSync(configPath, "utf-8"));
-                let changed = false;
-                // Remove Carapace-added entries from tools.deny
-                if (cfg.tools?.deny) {
-                    const before = cfg.tools.deny.length;
-                    cfg.tools.deny = cfg.tools.deny.filter((t) => !BYPASS_TOOLS.includes(t));
-                    if (cfg.tools.deny.length === 0)
-                        delete cfg.tools.deny;
-                    if (cfg.tools && Object.keys(cfg.tools).length === 0)
-                        delete cfg.tools;
-                    if (cfg.tools?.deny?.length !== before) {
-                        changed = true;
-                        console.log(`  ✅ Removed [${BYPASS_TOOLS.join(", ")}] from tools.deny`);
-                        console.log("     Built-in exec, web_fetch, and web_search are restored.");
-                    }
-                }
-                // Remove models.providers baseUrl override if it points at the proxy
-                const proxyPort = cfg.plugins?.entries?.carapace?.config?.proxy?.port ?? 19821;
-                const proxyUrl = `http://127.0.0.1:${proxyPort}`;
-                if (cfg.models?.providers) {
-                    for (const [name, provCfg] of Object.entries(cfg.models.providers)) {
-                        if (provCfg?.baseUrl === proxyUrl) {
-                            delete provCfg.baseUrl;
-                            // Clean up empty objects
-                            if (Object.keys(provCfg).length === 0)
-                                delete cfg.models.providers[name];
-                            changed = true;
-                            console.log(`  ✅ Removed baseUrl proxy override for ${name}`);
-                            console.log(`     ${name} will connect directly to its API again.`);
-                        }
-                    }
-                    if (Object.keys(cfg.models.providers).length === 0)
-                        delete cfg.models.providers;
-                    if (cfg.models && Object.keys(cfg.models).length === 0)
-                        delete cfg.models;
-                }
-                // Disable the plugin entry (don't delete — user might want to re-enable)
-                if (cfg.plugins?.entries?.carapace?.enabled) {
-                    cfg.plugins.entries.carapace.enabled = false;
-                    changed = true;
-                    console.log("  ✅ Disabled carapace plugin in config");
-                }
-                if (changed) {
-                    writeFileSync(configPath, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
-                    console.log("\n  Config updated. Restart the gateway for changes to take effect:");
-                    console.log("    openclaw gateway restart\n");
-                    console.log("  To fully remove the plugin files:");
-                    console.log("    rm -rf ~/.openclaw/extensions/carapace\n");
-                }
-                else {
-                    console.log("  No Carapace changes found in config. Nothing to undo.\n");
-                }
+            const configPath = join(homedir(), ".openclaw", "openclaw.json");
+            if (!existsSync(configPath)) {
+                console.log("  No config file found. Nothing to undo.\n");
+                return;
             }
-            catch (err) {
-                console.log(`  ❌ Error: ${err.message}\n`);
+            const cfg = JSON.parse(readFileSync(configPath, "utf-8"));
+            let changed = false;
+            if (cfg.plugins?.entries?.carapace?.enabled) {
+                cfg.plugins.entries.carapace.enabled = false;
+                changed = true;
+                console.log("  ✅ Disabled carapace plugin");
+            }
+            if (changed) {
+                writeFileSync(configPath, JSON.stringify(cfg, null, 2) + "\n", "utf-8");
+                console.log("\n  Restart the gateway for changes to take effect:");
+                console.log("    openclaw gateway restart\n");
+                console.log("  To fully remove the plugin files:");
+                console.log("    rm -rf ~/.openclaw/extensions/carapace\n");
+            }
+            else {
+                console.log("  Carapace already disabled. Nothing to undo.\n");
             }
         });
         cmd.command("check")
-            .description("Check for bypass vulnerabilities (built-in tools that skip Cedar)")
+            .description("Check Cedar policy status")
             .action(async () => {
             console.log("\n🦞 Carapace Security Check\n");
-            const bypasses = checkForBypasses();
-            if (bypasses.length === 0) {
-                console.log("  ✅ No bypass vulnerabilities found.");
-                console.log("  All agent exec/fetch operations go through Cedar.\n");
+            const policies = cedar.getPolicies();
+            if (policies.length === 0) {
+                console.log("  ⚠️  No Cedar policies loaded.");
+                console.log(`  Add policies to ${config.policyDir ?? "~/.openclaw/mcp-policies/"}\n`);
             }
             else {
-                console.log("  ⚠️  Bypass vulnerabilities found:\n");
-                for (const tool of bypasses) {
-                    console.log(`    🔓 ${tool} — agents can bypass Cedar policies via this tool`);
+                console.log(`  ✅ ${policies.length} Cedar policies loaded`);
+                console.log(`  🛡️  Enforcement via before_tool_call hook`);
+                console.log(`  Default: ${config.defaultPolicy ?? "allow-all"}\n`);
+                for (const p of policies) {
+                    console.log(`    ${p.effect === "permit" ? "🟢" : "🔴"} ${p.id}`);
                 }
-                console.log(`\n  Run "openclaw carapace setup" to fix.\n`);
+                console.log();
             }
         });
     }, { commands: ["carapace"] });
@@ -578,7 +463,15 @@ export default function register(api) {
     api.registerGatewayMethod?.("carapace.status", ({ respond }) => {
         const servers = aggregator.getServerStatus();
         const tools = aggregator.listTools();
-        respond(true, { servers, toolCount: tools.length, enabledCount: tools.filter((t) => t.enabled).length });
+        const policies = cedar.getPolicies();
+        respond(true, {
+            servers,
+            toolCount: tools.length,
+            enabledCount: tools.filter((t) => t.enabled).length,
+            policyCount: policies.length,
+            enforcement: "before_tool_call",
+            stats,
+        });
     });
 }
 //# sourceMappingURL=index.js.map