@clawrent/openclaw-channel 0.2.4 → 0.2.5

package/docs/approval-modes.md

@@ -71,11 +71,24 @@ The handoff's "约定基线" (convention baseline): / 移交文档的「约定
 
 This gives fast auto-approval **and** message-level safety. Trade-off: the **approval-level** guardrail (task-description check) does **not** run (see known limitation). / 这样既有快速自动批准，又有消息级安全。代价：**批准级**护栏（task 描述检查）**不**运行（见已知限制）。
 
-## Status after R3a (shipped 2026-07-15, prod) / R3a 后的状态（2026-07-15 生产上线）
+## Status after R3b+R1 (shipped 2026-07-16, prod) / R3b+R1 后的状态（2026-07-16 生产上线）
 
-**R3a moves guardrail policy to the platform side for *structured* dangers.** The platform now scans every session's `taskDescription` at creation against a high-precision pattern set (destructive commands like `rm -rf /`/`mkfs`/`dd`, sensitive files like `/etc/shadow`/`.env`/`.ssh`, data destruction like `drop table`). A match forces `pending_approval` + `needsManualReview=true` **regardless of `approvalMode` or end-side `autoApprove`**, and the `POST /:id/approve` endpoint rejects auto-approval without an explicit `manual:true` (SDK `autoApprove` → 403 → 转人工; dashboard `manual:true` → 放行). This is enforced **server-side** — the end-side behavior below (autoApprove=true skipping `onPendingApproval`) **no longer matters for these structured patterns**. / **R3a 把护栏策略移到平台侧（针对*结构化*危险）。** 创建会话时平台扫 `taskDescription` 匹配高精准 pattern（`rm -rf /`/`mkfs`/`dd` 等破坏命令、`/etc/shadow`/`.env`/`.ssh` 等敏感文件、`drop table` 等数据破坏）。命中 → 强制 `pending_approval` + `needsManualReview=true`（**无视 `approvalMode` 与端侧 `autoApprove`**），且 `POST /:id/approve` 无显式 `manual:true` 时拒绝自动批准（SDK `autoApprove` → 403 → 转人工；dashboard `manual:true` → 放行）。纯**服务端强制**——下方端侧行为（autoApprove=true 跳过 `onPendingApproval`）**对这些结构化 pattern 不再有影响**。
+**平台对 taskDescription 跑「结构化 + NL」全集，产统一 `guardrailDecision {verdict, categories, reason}`：**
 
-**Still end-side / future (R3b + R1)**: natural-language danger intent that needs *semantic* classification (payment, data exfil, credential solicitation, guardrail-bypass prompts — categories a regex can't reliably catch) is **not yet** platform-enforced. For those, the end-side `guardrailsFile` + `onMessage` check remain the net, and delivering the platform's verdict to `onPendingApproval` is R1's job. / **仍是端侧 / 待做（R3b + R1）**：需要*语义*判定的自然语言危险意图（付费、数据外发、凭据索取、绕过护栏等 regex 难可靠覆盖的类别）**尚未**由平台强制——这些仍靠端侧 `guardrailsFile` + `onMessage` 兜底；把平台判定下发给 `onPendingApproval` 消费是 R1 的事。
+| 危险类型 | verdict | 平台行为 |
+|---|---|---|
+| 结构化（`rm -rf /`、`/etc/shadow`、`drop table` 等，R3a） | `block` | 强制 `pending_approval` + `needsManualReview`；approve 无 `manual:true` → 403 |
+| NL·credential（索取凭据）/ payment（付费账单） | `block` | 同上（#1 提升为强制转人工） |
+| NL·data_exfil（数据外发）/ bypass（绕过护栏） | `advisory` | **不强制 pending**，按 approvalMode 走；只检测 + 下发 |
+| 干净 | `null` | approvalMode 驱动 |
+
+**R1 下发**：`guardrailDecision` 随会话持久化（`sessions.guardrail_decision` jsonb，session GET 响应可见）+ `session.new` 事件 payload（推给 provider `/ws/agent`）+ SDK `ActiveSession.guardrailDecision`（`@clawrent/provider@0.1.2` 自动填充）。端侧可读平台决策，无需自写规则。
+
+**纯服务端强制**：block 类无视 `approvalMode` 与端侧 `autoApprove`（下方端侧行为 `autoApprove=true` 跳过 `onPendingApproval` 对 block 类不再有影响）。advisory 类**不拦**（设计如此 —— 平台只检测 + 下发，执行权在端侧/操作员）。
+
+**未来增强（不在当前）**：
+- **R3c**：LLM 语义判定（抓 regex 漏的变体/混淆表述）—— 需平台引入模型调用基建。
+- **plugin 消费 advisory**：plugin 读 `ActiveSession.guardrailDecision` 对 advisory 做端侧告警/软拦（目前 plugin 不消费，平台只交付决策）。
 
 ---
 
@@ -86,4 +99,4 @@ This gives fast auto-approval **and** message-level safety. Trade-off: the **app
 - [guardrails.example.md](../guardrails.example.md) — guardrailsFile format + examples. / 护栏文件格式与示例。
 - [docs/openclaw-sdk-notes.md](openclaw-sdk-notes.md) — OpenClaw SDK gotchas. / OpenClaw SDK 踩坑。
 
-*Field-level ground truth verified against `clawrent/apps/platform-api/src/db/schema/agents.ts`, `modules/sessions/sessions.routes.ts`, and `clawrent-agent-toolkit/packages/provider/src/provider-client.ts` (2026-07-15).*
+*Field-level ground truth verified against `clawrent/apps/platform-api/src/db/schema/agents.ts`, `modules/sessions/sessions.routes.ts`, `security/dangerous-patterns.ts`, and `clawrent-agent-toolkit/packages/provider/src/provider-client.ts` (2026-07-16, post-R3b+R1).*

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "clawrent",
   "name": "ClawRent Channel",
   "description": "OpenClaw channel plugin that turns ClawRent rental sessions into native OpenClaw conversations, so a local ClawRent provider agent can answer tenants autonomously with its own model and identity. / OpenClaw 频道插件：把 ClawRent 租赁会话桥接成 OpenClaw 原生对话，让本地 ClawRent provider 智能体用自有模型与身份自动应答租户。",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "channels": ["clawrent"],
   "activation": {
     "onStartup": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@clawrent/openclaw-channel",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "OpenClaw channel plugin that turns ClawRent rental sessions into native OpenClaw conversations, so a local ClawRent provider agent can answer tenants autonomously with its own model and identity. / OpenClaw 频道插件：把 ClawRent 租赁会话桥接成 OpenClaw 原生对话，让本地 ClawRent provider 智能体用自有模型与身份自动应答租户。",
   "license": "ISC",
   "type": "module",