@congzhen/changewayguard 6.8.12

package/dist/agent/config-sync.js

@@ -0,0 +1,133 @@
+/**
+ * ConfigSync - Periodically pulls team-level configuration from Core.
+ *
+ * Only active when the agent's account is on the "business" plan.
+ * Pulls policies and gateway config every 5 minutes from
+ * GET /api/v1/business/config and applies them locally.
+ */
+import { buildSignedAuthHeadersForUrl, withChangewayOpenPrefix } from "./auth.js";
+// =============================================================================
+// Constants
+// =============================================================================
+/** Poll interval in ms (5 minutes) */
+const POLL_INTERVAL_MS = 5 * 60_000;
+/** Timeout for Core API calls */
+const API_TIMEOUT_MS = 5_000;
+// =============================================================================
+// ConfigSync Class
+// =============================================================================
+export class ConfigSync {
+    enabled = false;
+    options;
+    log;
+    credentials = null;
+    pollInterval = null;
+    /** Last fetched config (for change detection) */
+    lastConfigHash = "";
+    /** Last successfully fetched config */
+    currentConfig = null;
+    constructor(options, log) {
+        this.options = options;
+        this.log = log;
+    }
+    // ─── Lifecycle ───────────────────────────────────────────────────
+    /**
+     * Initialize config sync. Only enables if plan is "business".
+     */
+    async initialize(plan) {
+        if (plan !== "business") {
+            this.log.debug?.(`ConfigSync: plan is "${plan}", not enabling`);
+            return;
+        }
+        this.enabled = true;
+        // Pull immediately on startup
+        await this.pull();
+        // Start periodic polling
+        this.startPolling();
+        this.log.info("ConfigSync: enabled, polling every 5 minutes");
+    }
+    /** Set Core credentials */
+    setCredentials(credentials) {
+        this.credentials = credentials;
+    }
+    /** Get current config (may be null if not yet fetched) */
+    getConfig() {
+        return this.currentConfig;
+    }
+    /** Whether sync is active */
+    isEnabled() {
+        return this.enabled;
+    }
+    /** Stop polling */
+    stop() {
+        if (this.pollInterval) {
+            clearInterval(this.pollInterval);
+            this.pollInterval = null;
+        }
+        this.enabled = false;
+    }
+    // ─── Polling ───────────────────────────────────────────────────
+    startPolling() {
+        if (this.pollInterval)
+            return;
+        this.pollInterval = setInterval(() => {
+            this.pull().catch((err) => {
+                this.log.debug?.(`ConfigSync: poll error: ${err}`);
+            });
+        }, POLL_INTERVAL_MS);
+        this.pollInterval.unref();
+    }
+    /** Pull config from Core */
+    async pull() {
+        if (!this.enabled || !this.credentials)
+            return null;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), API_TIMEOUT_MS);
+        try {
+            const url = withChangewayOpenPrefix(`${this.options.coreUrl}/api/v1/business/config`);
+            const response = await fetch(url, {
+                headers: buildSignedAuthHeadersForUrl({
+                    method: "GET",
+                    url,
+                }),
+                signal: controller.signal,
+            });
+            if (!response.ok) {
+                this.log.debug?.(`ConfigSync: pull failed with ${response.status}`);
+                return null;
+            }
+            const json = (await response.json());
+            if (!json.success || !json.data) {
+                return null;
+            }
+            const config = json.data;
+            // Check if config changed (simple JSON hash)
+            const hash = JSON.stringify(config);
+            if (hash !== this.lastConfigHash) {
+                this.lastConfigHash = hash;
+                this.currentConfig = config;
+                // Notify callback
+                if (this.options.onUpdate) {
+                    try {
+                        this.options.onUpdate(config);
+                    }
+                    catch (err) {
+                        this.log.error(`ConfigSync: onUpdate callback error: ${err}`);
+                    }
+                }
+                this.log.debug?.(`ConfigSync: config updated (${config.policies.length} policies)`);
+            }
+            return config;
+        }
+        catch (err) {
+            if (err.name !== "AbortError") {
+                this.log.debug?.(`ConfigSync: pull error: ${err}`);
+            }
+            return null;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+}
+//# sourceMappingURL=config-sync.js.map

package/dist/agent/config-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-sync.js","sourceRoot":"","sources":["../../agent/config-sync.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAGlF,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,sCAAsC;AACtC,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;AAEpC,iCAAiC;AACjC,MAAM,cAAc,GAAG,KAAK,CAAC;AA4C7B,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,MAAM,OAAO,UAAU;IACb,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,CAAoB;IAC3B,GAAG,CAAS;IACZ,WAAW,GAA2B,IAAI,CAAC;IAC3C,YAAY,GAA0B,IAAI,CAAC;IAEnD,iDAAiD;IACzC,cAAc,GAAG,EAAE,CAAC;IAE5B,uCAAuC;IAC/B,aAAa,GAA0B,IAAI,CAAC;IAEpD,YAAY,OAA0B,EAAE,GAAW;QACjD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,oEAAoE;IAEpE;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAY;QAC3B,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,wBAAwB,IAAI,iBAAiB,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QAEpB,8BAA8B;QAC9B,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAElB,yBAAyB;QACzB,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAChE,CAAC;IAED,2BAA2B;IAC3B,cAAc,CAAC,WAAmC;QAChD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,0DAA0D;IAC1D,SAAS;QACP,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,6BAA6B;IAC7B,SAAS;QACP,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,mBAAmB;IACnB,IAAI;QACF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;IACvB,CAAC;IAED,kEAAkE;IAE1D,YAAY;QAClB,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO;QAC9B,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;YACrD,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrB,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;IAED,4BAA4B;IAC5B,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QAEpD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,cAAc,CAAC,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,uBAAuB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,yBAAyB,CAAC,CAAC;YACtF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,OAAO,EAAE,4BAA4B,CAAC;oBACpC,MAAM,EAAE,KAAK;oBACb,GAAG;iBACJ,CAAC;gBACF,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,gCAAgC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;YAEF,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC;YAEzB,6CAA6C;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACpC,IAAI,IAAI,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;gBACjC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;gBAC3B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;gBAE5B,kBAAkB;gBAClB,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;oBAC1B,IAAI,CAAC;wBACH,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oBAChC,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,wCAAwC,GAAG,EAAE,CAAC,CAAC;oBAChE,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,+BAA+B,MAAM,CAAC,QAAQ,CAAC,MAAM,YAAY,CAAC,CAAC;YACtF,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAAa,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACzC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;YACrD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;CACF"}

package/dist/agent/config.d.ts

@@ -0,0 +1,97 @@
+/**
+ * OpenGuardrails plugin configuration and credential management
+ */
+import type { OpenClawGuardConfig } from "./types.js";
+export declare const DEFAULT_CORE_URL: string;
+export type CoreCredentials = {
+    apiKey: string;
+    agentId: string;
+    claimUrl: string;
+    verificationCode: string;
+    email?: string;
+    /** The Core URL these credentials were issued by */
+    coreUrl?: string;
+};
+/**
+ * Load credentials from disk.
+ * If the credentials were issued by a different Core URL, returns null
+ * (credentials from production won't work in dev and vice versa).
+ *
+ * @param configuredCoreUrl - The Core URL from plugin config (openclaw.json).
+ *   When provided, credentials are validated against this URL instead of DEFAULT_CORE_URL.
+ */
+export declare function loadCoreCredentials(configuredCoreUrl?: string): CoreCredentials | null;
+export declare function saveCoreCredentials(creds: CoreCredentials, coreUrl?: string): void;
+export declare function deleteCoreCredentials(): boolean;
+/** @deprecated Use loadCoreCredentials().apiKey instead */
+export declare function loadApiKey(): string | null;
+export type RegisterResult = {
+    credentials: CoreCredentials;
+    activateUrl: string;
+    loginUrl: string;
+};
+export declare function registerWithCore(name: string, description: string, coreUrl?: string): Promise<RegisterResult>;
+/**
+ * Polls Core `/api/v1/account` to learn the agent's verified email.
+ * Returns `{ email, status }` if the agent is active, null otherwise.
+ */
+export declare function pollAccountEmail(_apiKey: string, coreUrl?: string): Promise<{
+    email: string;
+    status: string;
+} | null>;
+export type ResolvedGuardConfig = Required<Omit<OpenClawGuardConfig, "plan">> & Pick<OpenClawGuardConfig, "plan">;
+export declare const DEFAULT_CONFIG: ResolvedGuardConfig;
+export type AgentProfile = {
+    emoji: string;
+    creature: string;
+    vibe: string;
+    model: string;
+    provider: string;
+    ownerName: string;
+    skills: {
+        name: string;
+        description?: string;
+    }[];
+    plugins: {
+        name: string;
+        enabled: boolean;
+    }[];
+    hooks: {
+        name: string;
+        enabled: boolean;
+    }[];
+    connectedSystems: string[];
+    channels: string[];
+    sessionCount: number;
+    lastActive: string | null;
+    workspaceFiles: {
+        soul: string;
+        identity: string;
+        user: string;
+        agents: string;
+        tools: string;
+        heartbeat: string;
+    };
+    bootstrapExists: boolean;
+    cronJobs: Array<{
+        id?: string;
+        schedule?: string;
+        task?: string;
+        enabled?: boolean;
+    }>;
+};
+/** @deprecated use readAgentProfile() */
+export type AgentInfo = AgentProfile;
+/**
+ * Reads the full OpenClaw workspace profile from ~/.openclaw/ to report to the dashboard.
+ * All fields degrade gracefully — missing files produce empty strings/arrays.
+ */
+export declare function readAgentProfile(): AgentProfile;
+/** @deprecated use readAgentProfile() */
+export declare function readAgentInfo(): AgentProfile;
+/**
+ * Returns file paths that should be watched for changes to trigger a profile re-upload.
+ */
+export declare function getProfileWatchPaths(openclawDir?: string): string[];
+export declare function resolveConfig(config?: Partial<OpenClawGuardConfig>): ResolvedGuardConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/agent/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../agent/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAYtD,eAAO,MAAM,gBAAgB,QAAiB,CAAC;AAU/C,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAAC,iBAAiB,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAmBtF;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAOlF;AAED,wBAAgB,qBAAqB,IAAI,OAAO,CAU/C;AAED,2DAA2D;AAC3D,wBAAgB,UAAU,IAAI,MAAM,GAAG,IAAI,CAE1C;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,WAAW,EAAE,eAAe,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,wBAAsB,gBAAgB,CACpC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,MAAyB,GACjC,OAAO,CAAC,cAAc,CAAC,CAuDzB;AAMD;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,MAAyB,GACjC,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CAuBnD;AAMD,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;AAElH,eAAO,MAAM,cAAc,EAAE,mBAO5B,CAAC;AAqDF,MAAM,MAAM,YAAY,GAAG;IAEzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAElB,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACjD,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC9C,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,EAAE,CAAC;IAC5C,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,EAAE,MAAM,EAAE,CAAC;IAEnB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,cAAc,EAAE;QACd,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,MAAM,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,MAAM,EAAE,MAAM,CAAC;QACf,KAAK,EAAE,MAAM,CAAC;QACd,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,eAAe,EAAE,OAAO,CAAC;IAEzB,QAAQ,EAAE,KAAK,CAAC;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACvF,CAAC;AAEF,yCAAyC;AACzC,MAAM,MAAM,SAAS,GAAG,YAAY,CAAC;AAGrC;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,CAyH/C;AAED,yCAAyC;AACzC,wBAAgB,aAAa,IAAI,YAAY,CAE5C;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAgBnE;AAED,wBAAgB,aAAa,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,mBAAmB,CAiBxF"}

package/dist/agent/config.js

@@ -0,0 +1,359 @@
+/**
+ * OpenGuardrails plugin configuration and credential management
+ */
+import os from "node:os";
+import path from "node:path";
+import { existsSync, mkdirSync, writeFileSync, unlinkSync, readdirSync } from "node:fs";
+import { defaultCoreUrl, envApiKey } from "./env.js";
+import { buildSignedAuthHeadersForUrl, withChangewayOpenPrefix } from "./auth.js";
+import { loadTextSync, loadTextSafe, loadJsonSafe } from "./fs-utils.js";
+// =============================================================================
+// Constants
+// =============================================================================
+export const DEFAULT_CORE_URL = defaultCoreUrl;
+const LEGACY_OFFICIAL_CORE_URL = "https://www.openguardrails.com/core";
+const CREDENTIALS_DIR = path.join(os.homedir(), ".openclaw/credentials/changewayguard");
+const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, "credentials.json");
+/**
+ * Load credentials from disk.
+ * If the credentials were issued by a different Core URL, returns null
+ * (credentials from production won't work in dev and vice versa).
+ *
+ * @param configuredCoreUrl - The Core URL from plugin config (openclaw.json).
+ *   When provided, credentials are validated against this URL instead of DEFAULT_CORE_URL.
+ */
+export function loadCoreCredentials(configuredCoreUrl) {
+    try {
+        if (!existsSync(CREDENTIALS_FILE))
+            return null;
+        const data = JSON.parse(loadTextSync(CREDENTIALS_FILE));
+        if (typeof data.apiKey === "string" && typeof data.agentId === "string") {
+            const creds = data;
+            const expectedUrl = configuredCoreUrl ?? DEFAULT_CORE_URL;
+            // Check if credentials match current environment
+            if (creds.coreUrl && creds.coreUrl !== expectedUrl) {
+                // Credentials from a different Core instance - don't use them
+                // Credentials from a different Core instance - skip
+                return null;
+            }
+            return creds;
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export function saveCoreCredentials(creds, coreUrl) {
+    if (!existsSync(CREDENTIALS_DIR)) {
+        mkdirSync(CREDENTIALS_DIR, { recursive: true });
+    }
+    // Save the Core URL with credentials so we know which instance issued them
+    const toSave = { ...creds, coreUrl: coreUrl ?? DEFAULT_CORE_URL };
+    writeFileSync(CREDENTIALS_FILE, JSON.stringify(toSave, null, 2), "utf-8");
+}
+export function deleteCoreCredentials() {
+    try {
+        if (existsSync(CREDENTIALS_FILE)) {
+            unlinkSync(CREDENTIALS_FILE);
+            return true;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+/** @deprecated Use loadCoreCredentials().apiKey instead */
+export function loadApiKey() {
+    return loadCoreCredentials()?.apiKey ?? null;
+}
+export async function registerWithCore(name, description, coreUrl = DEFAULT_CORE_URL) {
+    const url = coreUrl.replace(/\/+$/, "");
+    const registerUrl = withChangewayOpenPrefix(`${url}/api/v1/agents/register`);
+    const registerBody = { name, description };
+    const response = await fetch(registerUrl, {
+        method: "POST",
+        headers: {
+            "Content-Type": "application/json",
+            ...buildSignedAuthHeadersForUrl({
+                method: "POST",
+                url: registerUrl,
+                body: registerBody,
+                authorization: null,
+            }),
+        },
+        body: JSON.stringify(registerBody),
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        throw new Error(`Registration failed: ${response.status} ${response.statusText}${text ? ` — ${text}` : ""}`);
+    }
+    const json = (await response.json());
+    if (!json.success || !json.agent) {
+        throw new Error(`Registration error: ${json.error ?? "unknown"}`);
+    }
+    const creds = {
+        apiKey: json.agent.api_key,
+        agentId: json.agent.id,
+        claimUrl: json.activate_url ?? "",
+        verificationCode: "", // No longer used
+        coreUrl: url,
+    };
+    saveCoreCredentials(creds, url);
+    return {
+        credentials: creds,
+        activateUrl: json.activate_url ?? "",
+        loginUrl: json.login_url ?? `${url}/login`,
+    };
+}
+// =============================================================================
+// Account Email Polling
+// =============================================================================
+/**
+ * Polls Core `/api/v1/account` to learn the agent's verified email.
+ * Returns `{ email, status }` if the agent is active, null otherwise.
+ */
+export async function pollAccountEmail(_apiKey, coreUrl = DEFAULT_CORE_URL) {
+    try {
+        const url = coreUrl.replace(/\/+$/, "");
+        const accountUrl = withChangewayOpenPrefix(`${url}/api/v1/account`);
+        const res = await fetch(accountUrl, {
+            headers: buildSignedAuthHeadersForUrl({
+                method: "GET",
+                url: accountUrl,
+            }),
+        });
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        if (data.success && data.email && data.status === "active") {
+            return { email: data.email, status: data.status };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+export const DEFAULT_CONFIG = {
+    enabled: true,
+    blockOnRisk: true,
+    apiKey: envApiKey,
+    timeoutMs: 60000,
+    coreUrl: DEFAULT_CORE_URL,
+    agentName: "OpenClaw Agent",
+};
+// =============================================================================
+// Configuration Helpers
+// =============================================================================
+function normalizeIdentityValue(value) {
+    return value
+        .replace(/\s+/g, " ")
+        .trim()
+        .replace(/^[`*_~\s]+/, "")
+        .replace(/[`*_~\s]+$/, "")
+        .replace(/^\((.*)\)$/, "$1")
+        .trim();
+}
+function isIdentityTemplatePlaceholder(value) {
+    const lower = value.toLowerCase();
+    return /(pick something|your signature|fill this in|make it yours|workspace-relative|something weirder|ghost in the machine|how do you come across)/i.test(lower);
+}
+function parseIdentityField(content, field) {
+    const prefix = `- **${field}:**`;
+    const lines = content.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i].trim();
+        if (trimmed.startsWith(prefix)) {
+            const inline = normalizeIdentityValue(trimmed.slice(prefix.length).trim());
+            if (inline && !isIdentityTemplatePlaceholder(inline))
+                return inline;
+            // value on next line
+            const next = normalizeIdentityValue(lines[i + 1]?.trim() ?? "");
+            if (next && !next.startsWith("-") && !next.startsWith("#") && !isIdentityTemplatePlaceholder(next)) {
+                return next;
+            }
+        }
+    }
+    return "";
+}
+/**
+ * Reads the agent's name from ~/.openclaw/workspace/IDENTITY.md.
+ */
+function readIdentityName() {
+    try {
+        const identityPath = path.join(os.homedir(), ".openclaw/workspace/IDENTITY.md");
+        const content = loadTextSync(identityPath);
+        const name = parseIdentityField(content, "Name");
+        return name || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Reads the full OpenClaw workspace profile from ~/.openclaw/ to report to the dashboard.
+ * All fields degrade gracefully — missing files produce empty strings/arrays.
+ */
+export function readAgentProfile() {
+    const openclawDir = path.join(os.homedir(), ".openclaw");
+    const result = {
+        emoji: "", creature: "", vibe: "", model: "", provider: "", ownerName: "",
+        skills: [], plugins: [], hooks: [], connectedSystems: [], channels: [],
+        sessionCount: 0, lastActive: null,
+        workspaceFiles: { soul: "", identity: "", user: "", agents: "", tools: "", heartbeat: "" },
+        bootstrapExists: false,
+        cronJobs: [],
+    };
+    // ── openclaw.json ──────────────────────────────────────────
+    const config = loadJsonSafe(path.join(openclawDir, "openclaw.json"));
+    let workspacePath = path.join(openclawDir, "workspace");
+    if (config) {
+        const agentsConfig = config.agents;
+        const defaultModel = agentsConfig?.defaults?.model?.primary ?? "";
+        if (defaultModel.includes("/")) {
+            const [provider, model] = defaultModel.split("/", 2);
+            result.provider = provider ?? "";
+            result.model = model ?? "";
+        }
+        else {
+            result.model = defaultModel;
+        }
+        if (agentsConfig?.defaults?.workspace) {
+            workspacePath = agentsConfig.defaults.workspace;
+        }
+        const pluginsConfig = config.plugins;
+        if (pluginsConfig?.entries) {
+            for (const [name, entry] of Object.entries(pluginsConfig.entries)) {
+                result.plugins.push({ name, enabled: entry?.enabled !== false });
+            }
+        }
+        const hooksConfig = config.hooks;
+        if (hooksConfig?.internal?.entries) {
+            for (const [name, entry] of Object.entries(hooksConfig.internal.entries)) {
+                result.hooks.push({ name, enabled: entry?.enabled !== false });
+            }
+        }
+    }
+    // ── Workspace files ─────────────────────────────────────────
+    const identityContent = loadTextSafe(path.join(workspacePath, "IDENTITY.md"));
+    result.workspaceFiles.identity = identityContent;
+    result.workspaceFiles.soul = loadTextSafe(path.join(workspacePath, "SOUL.md"));
+    result.workspaceFiles.user = loadTextSafe(path.join(workspacePath, "USER.md"));
+    result.workspaceFiles.agents = loadTextSafe(path.join(workspacePath, "AGENTS.md"));
+    result.workspaceFiles.tools = loadTextSafe(path.join(workspacePath, "TOOLS.md"));
+    result.workspaceFiles.heartbeat = loadTextSafe(path.join(workspacePath, "HEARTBEAT.md"));
+    result.bootstrapExists = existsSync(path.join(workspacePath, "BOOTSTRAP.md"));
+    // ── Identity fields ─────────────────────────────────────────
+    if (identityContent) {
+        result.emoji = parseIdentityField(identityContent, "Emoji");
+        result.creature = parseIdentityField(identityContent, "Creature");
+        result.vibe = parseIdentityField(identityContent, "Vibe");
+    }
+    if (result.workspaceFiles.user) {
+        result.ownerName = parseIdentityField(result.workspaceFiles.user, "Name")
+            || parseIdentityField(result.workspaceFiles.user, "name");
+    }
+    // ── Skills ──────────────────────────────────────────────────
+    try {
+        const skillsDir = path.join(workspacePath, "skills");
+        if (existsSync(skillsDir)) {
+            result.skills = readdirSync(skillsDir, { withFileTypes: true })
+                .filter((d) => d.isDirectory())
+                .map((d) => {
+                const meta = loadJsonSafe(path.join(skillsDir, d.name, "_meta.json"));
+                return { name: d.name, description: meta?.description };
+            });
+        }
+    }
+    catch { /* ignore */ }
+    // ── Connected systems (credential names) ────────────────────
+    try {
+        const credsDir = path.join(openclawDir, "credentials");
+        if (existsSync(credsDir)) {
+            result.connectedSystems = readdirSync(credsDir)
+                .filter((f) => f.endsWith(".json"))
+                .map((f) => f.slice(0, -5));
+        }
+    }
+    catch { /* ignore */ }
+    // ── Sessions (count, lastActive, channels) ──────────────────
+    try {
+        const agentsDir = path.join(openclawDir, "agents");
+        if (existsSync(agentsDir)) {
+            for (const dir of readdirSync(agentsDir, { withFileTypes: true })) {
+                if (!dir.isDirectory())
+                    continue;
+                const sessionsData = loadJsonSafe(path.join(agentsDir, dir.name, "sessions", "sessions.json"));
+                if (!sessionsData)
+                    continue;
+                for (const session of Object.values(sessionsData)) {
+                    result.sessionCount++;
+                    if (typeof session.updatedAt === "number") {
+                        const iso = new Date(session.updatedAt).toISOString();
+                        if (!result.lastActive || iso > result.lastActive)
+                            result.lastActive = iso;
+                    }
+                    if (typeof session.lastChannel === "string" && !result.channels.includes(session.lastChannel)) {
+                        result.channels.push(session.lastChannel);
+                    }
+                }
+            }
+        }
+    }
+    catch { /* ignore */ }
+    // ── Cron jobs ────────────────────────────────────────────────
+    try {
+        const raw = loadTextSafe(path.join(openclawDir, "cron", "jobs.json"));
+        if (raw) {
+            const parsed = JSON.parse(raw);
+            result.cronJobs = Array.isArray(parsed) ? parsed : (parsed?.jobs ?? []);
+        }
+    }
+    catch { /* ignore */ }
+    return result;
+}
+/** @deprecated use readAgentProfile() */
+export function readAgentInfo() {
+    return readAgentProfile();
+}
+/**
+ * Returns file paths that should be watched for changes to trigger a profile re-upload.
+ */
+export function getProfileWatchPaths(openclawDir) {
+    const dir = openclawDir ?? path.join(os.homedir(), ".openclaw");
+    const config = loadJsonSafe(path.join(dir, "openclaw.json"));
+    const agentsConfig = config?.agents;
+    const workspace = agentsConfig?.defaults?.workspace ?? path.join(dir, "workspace");
+    return [
+        path.join(dir, "openclaw.json"),
+        path.join(workspace, "IDENTITY.md"),
+        path.join(workspace, "SOUL.md"),
+        path.join(workspace, "USER.md"),
+        path.join(workspace, "AGENTS.md"),
+        path.join(workspace, "TOOLS.md"),
+        path.join(workspace, "HEARTBEAT.md"),
+        path.join(dir, "cron", "jobs.json"),
+        path.join(workspace, "skills"),
+    ];
+}
+export function resolveConfig(config) {
+    const plan = config?.plan;
+    const normalizedCoreUrl = (config?.coreUrl ?? DEFAULT_CONFIG.coreUrl).replace(/\/+$/, "");
+    // Backward-compat migration: if user still has the old official default URL in config,
+    // transparently switch to the new default endpoint.
+    const resolvedCoreUrl = normalizedCoreUrl === LEGACY_OFFICIAL_CORE_URL
+        ? DEFAULT_CORE_URL
+        : normalizedCoreUrl;
+    return {
+        enabled: config?.enabled ?? DEFAULT_CONFIG.enabled,
+        blockOnRisk: config?.blockOnRisk ?? DEFAULT_CONFIG.blockOnRisk,
+        apiKey: config?.apiKey ?? DEFAULT_CONFIG.apiKey,
+        timeoutMs: config?.timeoutMs ?? DEFAULT_CONFIG.timeoutMs,
+        coreUrl: resolvedCoreUrl,
+        agentName: config?.agentName ?? readIdentityName() ?? DEFAULT_CONFIG.agentName,
+        plan,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/agent/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../agent/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAAE,4BAA4B,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAEzE,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAC/C,MAAM,wBAAwB,GAAG,qCAAqC,CAAC;AAEvE,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,sCAAsC,CAAC,CAAC;AACxF,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAgBxE;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,iBAA0B;IAC5D,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACxD,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACxE,MAAM,KAAK,GAAG,IAAuB,CAAC;YACtC,MAAM,WAAW,GAAG,iBAAiB,IAAI,gBAAgB,CAAC;YAC1D,iDAAiD;YACjD,IAAI,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;gBACnD,8DAA8D;gBAC9D,oDAAoD;gBACpD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAsB,EAAE,OAAgB;IAC1E,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjC,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,2EAA2E;IAC3E,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,gBAAgB,EAAE,CAAC;IAClE,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,IAAI,CAAC;QACH,IAAI,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACjC,UAAU,CAAC,gBAAgB,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,UAAU;IACxB,OAAO,mBAAmB,EAAE,EAAE,MAAM,IAAI,IAAI,CAAC;AAC/C,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,IAAY,EACZ,WAAmB,EACnB,UAAkB,gBAAgB;IAElC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,uBAAuB,CAAC,GAAG,GAAG,yBAAyB,CAAC,CAAC;IAC7E,MAAM,YAAY,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,kBAAkB;YAClC,GAAG,4BAA4B,CAAC;gBAC9B,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,WAAW;gBAChB,IAAI,EAAE,YAAY;gBAClB,aAAa,EAAE,IAAI;aACpB,CAAC;SACH;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;KACnC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,wBAAwB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC5F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CASlC,CAAC;IAEF,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,MAAM,KAAK,GAAoB;QAC7B,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO;QAC1B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE;QACtB,QAAQ,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;QACjC,gBAAgB,EAAE,EAAE,EAAE,iBAAiB;QACvC,OAAO,EAAE,GAAG;KACb,CAAC;IAEF,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEhC,OAAO;QACL,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,EAAE;QACpC,QAAQ,EAAE,IAAI,CAAC,SAAS,IAAI,GAAG,GAAG,QAAQ;KAC3C,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,UAAkB,gBAAgB;IAElC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,UAAU,GAAG,uBAAuB,CAAC,GAAG,GAAG,iBAAiB,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,UAAU,EAAE;YAClC,OAAO,EAAE,4BAA4B,CAAC;gBACpC,MAAM,EAAE,KAAK;gBACb,GAAG,EAAE,UAAU;aAChB,CAAC;SACH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAI7B,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC3D,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAQD,MAAM,CAAC,MAAM,cAAc,GAAwB;IACjD,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,KAAK;IAChB,OAAO,EAAE,gBAAgB;IACzB,SAAS,EAAE,gBAAgB;CAC5B,CAAC;AAEF,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,SAAS,sBAAsB,CAAC,KAAa;IAC3C,OAAO,KAAK;SACT,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;SACpB,IAAI,EAAE;SACN,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;SACzB,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC;SAC3B,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,6BAA6B,CAAC,KAAa;IAClD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,OAAO,8IAA8I,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACpK,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAe,EAAE,KAAa;IACxD,MAAM,MAAM,GAAG,OAAO,KAAK,KAAK,CAAC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3E,IAAI,MAAM,IAAI,CAAC,6BAA6B,CAAC,MAAM,CAAC;gBAAE,OAAO,MAAM,CAAC;YACpE,qBAAqB;YACrB,MAAM,IAAI,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnG,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB;IACvB,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAChF,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,IAAI,IAAI,IAAI,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAqCD;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IACzD,MAAM,MAAM,GAAiB;QAC3B,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE;QACzE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE;QACtE,YAAY,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI;QACjC,cAAc,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QAC1F,eAAe,EAAE,KAAK;QACtB,QAAQ,EAAE,EAAE;KACb,CAAC;IAEF,8DAA8D;IAC9D,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;IACrE,IAAI,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAExD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,YAAY,GAAG,MAAM,CAAC,MAAyF,CAAC;QACtH,MAAM,YAAY,GAAG,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;QAClE,IAAI,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrD,MAAM,CAAC,QAAQ,GAAG,QAAQ,IAAI,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,GAAG,KAAK,IAAI,EAAE,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,KAAK,GAAG,YAAY,CAAC;QAC9B,CAAC;QACD,IAAI,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;YACtC,aAAa,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC;QAClD,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,CAAC,OAA0E,CAAC;QACxG,IAAI,aAAa,EAAE,OAAO,EAAE,CAAC;YAC3B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;YACnE,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,CAAC,KAAuF,CAAC;QACnH,IAAI,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;YACnC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBACzE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;IACH,CAAC;IAED,+DAA+D;IAC/D,MAAM,eAAe,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;IAC9E,MAAM,CAAC,cAAc,CAAC,QAAQ,GAAG,eAAe,CAAC;IACjD,MAAM,CAAC,cAAc,CAAC,IAAI,GAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;IACnF,MAAM,CAAC,cAAc,CAAC,IAAI,GAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;IACnF,MAAM,CAAC,cAAc,CAAC,MAAM,GAAK,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC;IACrF,MAAM,CAAC,cAAc,CAAC,KAAK,GAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC,CAAC;IACpF,MAAM,CAAC,cAAc,CAAC,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;IACzF,MAAM,CAAC,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;IAE9E,+DAA+D;IAC/D,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,GAAM,kBAAkB,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC/D,MAAM,CAAC,QAAQ,GAAG,kBAAkB,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAClE,MAAM,CAAC,IAAI,GAAO,kBAAkB,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,CAAC,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC;eACpE,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAED,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACrD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,MAAM,GAAG,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;iBAC5D,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;iBAC9B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBACT,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,CAAC,CAAoC,CAAC;gBACzG,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAC1D,CAAC,CAAC,CAAC;QACP,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAExB,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACvD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,CAAC,gBAAgB,GAAG,WAAW,CAAC,QAAQ,CAAC;iBAC5C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;iBAClC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAExB,+DAA+D;IAC/D,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1B,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;gBAClE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;oBAAE,SAAS;gBACjC,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,EAAE,UAAU,EAAE,eAAe,CAAC,CACxB,CAAC;gBACtE,IAAI,CAAC,YAAY;oBAAE,SAAS;gBAC5B,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;oBAClD,MAAM,CAAC,YAAY,EAAE,CAAC;oBACtB,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;wBAC1C,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;wBACtD,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,MAAM,CAAC,UAAU;4BAAE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC;oBAC7E,CAAC;oBACD,IAAI,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;wBAC9F,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAExB,gEAAgE;IAChE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC;QACtE,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;YAC1C,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAA+B,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC;IACH,CAAC;IAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;IAExB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,yCAAyC;AACzC,MAAM,UAAU,aAAa;IAC3B,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAoB;IACvD,MAAM,GAAG,GAAG,WAAW,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,MAAM,EAAE,MAA2D,CAAC;IACzF,MAAM,SAAS,GAAG,YAAY,EAAE,QAAQ,EAAE,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACnF,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,MAAqC;IACjE,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC1B,MAAM,iBAAiB,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1F,uFAAuF;IACvF,oDAAoD;IACpD,MAAM,eAAe,GAAG,iBAAiB,KAAK,wBAAwB;QACpE,CAAC,CAAC,gBAAgB;QAClB,CAAC,CAAC,iBAAiB,CAAC;IACtB,OAAO;QACL,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,cAAc,CAAC,OAAO;QAClD,WAAW,EAAE,MAAM,EAAE,WAAW,IAAI,cAAc,CAAC,WAAW;QAC9D,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,cAAc,CAAC,MAAM;QAC/C,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,cAAc,CAAC,SAAS;QACxD,OAAO,EAAE,eAAe;QACxB,SAAS,EAAE,MAAM,EAAE,SAAS,IAAI,gBAAgB,EAAE,IAAI,cAAc,CAAC,SAAS;QAC9E,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/agent/content-injection-scanner.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Content-based prompt injection scanner.
+ *
+ * Pure/sync regex scanner — no network, no dependencies.
+ * Scans tool result text (file contents, web fetches) for injection patterns.
+ *
+ * Two-tier design:
+ *   HIGH confidence — a single match triggers detection
+ *   MEDIUM confidence — requires 2+ distinct categories to trigger
+ */
+import type { DetectionFinding } from "./types.js";
+export type InjectionCategory = "INSTRUCTION_OVERRIDE" | "MODE_SWITCHING" | "FAKE_SYSTEM_MESSAGE" | "CONCEALMENT_DIRECTIVE" | "COMMAND_EXECUTION" | "TASK_HIJACKING" | "ROLE_ASSUMPTION" | "DATA_EXFILTRATION";
+export type InjectionMatch = {
+    pattern: string;
+    category: InjectionCategory;
+    confidence: "high" | "medium";
+    matchedText: string;
+};
+export type InjectionScanResult = {
+    detected: boolean;
+    matches: InjectionMatch[];
+    distinctCategories: InjectionCategory[];
+    summary: string;
+    findings: DetectionFinding[];
+};
+/**
+ * Replace all injection matches in `text` with `__REDACTED_BY_CHANGEWAYGUARD_DUE_TO_{riskType}__`.
+ * Returns the redacted text and structured findings.
+ */
+export declare function redactContent(text: string): {
+    redacted: string;
+    findings: DetectionFinding[];
+};
+export declare function scanForInjection(text: string): InjectionScanResult;
+//# sourceMappingURL=content-injection-scanner.d.ts.map

package/dist/agent/content-injection-scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-injection-scanner.d.ts","sourceRoot":"","sources":["../../agent/content-injection-scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAgC,MAAM,YAAY,CAAC;AAMjF,MAAM,MAAM,iBAAiB,GACzB,sBAAsB,GACtB,gBAAgB,GAChB,qBAAqB,GACrB,uBAAuB,GACvB,mBAAmB,GACnB,gBAAgB,GAChB,iBAAiB,GACjB,mBAAmB,CAAC;AAExB,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,UAAU,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,kBAAkB,EAAE,iBAAiB,EAAE,CAAC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B,CAAC;AAsNF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAwB9F;AAMD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,CAoDlE"}