@contextfort-ai/openclaw-secure 0.1.11 → 0.1.12

package/monitor/dashboard/public/index.html

@@ -48,7 +48,7 @@
     .card-sub { font-size: 12px; color: #a1a1aa; margin-top: 4px; }
 
     /* Guard summary cards on home */
-    .guard-cards { display: grid; grid-template-columns: repeat(5, 1fr); gap: 16px; }
+    .guard-cards { display: grid; grid-template-columns: repeat(3, 1fr); gap: 16px; }
     .guard-card { border: 1px solid rgba(255,255,255,0.1); border-radius: 8px; padding: 16px; background: rgba(255,255,255,0.02); cursor: pointer; transition: all 0.15s; }
     .guard-card:hover { background: rgba(255,255,255,0.05); border-color: rgba(255,255,255,0.2); }
     .guard-card-header { display: flex; align-items: center; gap: 8px; margin-bottom: 10px; }
@@ -157,7 +157,7 @@
 
         <button class="sidebar-btn" data-page="skill" onclick="switchPage('skill')">
           <svg fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
-          Skill Scanner
+          Skill &amp; Plugin Scanner
           <span class="dot dot-green" id="sb-skill-dot" style="margin-left:auto"></span>
         </button>
         <button class="sidebar-btn" data-page="bash" onclick="switchPage('bash')">
@@ -180,6 +180,11 @@
           Secrets Exfil Monitor
           <span class="dot dot-green" id="sb-exfil-dot" style="margin-left:auto"></span>
         </button>
+        <button class="sidebar-btn" data-page="sandbox" onclick="switchPage('sandbox')">
+          <svg fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24"><rect x="2" y="2" width="20" height="20" rx="2"/><path d="M12 2v20"/><path d="M2 12h20"/></svg>
+          Plugin Sandbox
+          <span class="dot dot-green" id="sb-sandbox-dot" style="margin-left:auto"></span>
+        </button>
       </div>
     </aside>
 
@@ -235,7 +240,7 @@
           <div class="guard-card" onclick="switchPage('skill')">
             <div class="guard-card-header">
               <svg fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24"><path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/></svg>
-              <span>Skill Scanner</span>
+              <span>Skill &amp; Plugin Scanner</span>
               <span class="dot dot-green" id="g-skill-dot" style="margin-left:auto"></span>
             </div>
             <div class="guard-stat"><b id="g-skill-blocks">0</b> blocks</div>
@@ -272,6 +277,14 @@
             </div>
             <div class="guard-stat"><b id="g-exfil-detections">0</b> detections</div>
           </div>
+          <div class="guard-card" onclick="switchPage('sandbox')">
+            <div class="guard-card-header">
+              <svg fill="none" stroke="currentColor" stroke-width="2" viewBox="0 0 24 24"><rect x="2" y="2" width="20" height="20" rx="2"/><path d="M12 2v20"/><path d="M2 12h20"/></svg>
+              <span>Plugin Sandbox</span>
+              <span class="dot dot-green" id="g-sandbox-dot" style="margin-left:auto"></span>
+            </div>
+            <div class="guard-stat"><b id="g-sandbox-scrubs">0</b> env scrubs &middot; <b id="g-sandbox-fs">0</b> FS blocks &middot; <b id="g-sandbox-net">0</b> net logs</div>
+          </div>
         </div>
 
         <!-- Secret Scanner Summary -->
@@ -348,8 +361,8 @@
       <!-- SKILL SCANNER PAGE -->
       <div id="page-skill" style="display:none">
         <div class="page-header">
-          <h1>Skill Scanner</h1>
-          <p>Skills cross-indexed and scanned for prompt injection patterns via Haiku.</p>
+          <h1>Skill &amp; Plugin Scanner</h1>
+          <p>Skills and plugin code cross-indexed and scanned for prompt injection patterns via Haiku.</p>
         </div>
 
         <!-- Skills Status (top section) -->
@@ -480,6 +493,36 @@
         </div>
       </div>
 
+      <!-- PLUGIN SANDBOX PAGE -->
+      <div id="page-sandbox" style="display:none">
+        <div class="page-header">
+          <h1>Plugin Sandbox</h1>
+          <p>Runtime isolation for MCP plugin processes: env scrubbing, FS blocklist, and network logging.</p>
+        </div>
+
+        <div class="cards" style="margin-bottom:24px">
+          <div class="card"><div class="card-label">Env Scrubs</div><div class="card-value" id="sandbox-scrubs-count" style="color:#60a5fa">0</div><div class="card-sub">plugin spawns with env stripped</div></div>
+          <div class="card"><div class="card-label">FS Blocks</div><div class="card-value" id="sandbox-fs-count" style="color:#f87171">0</div><div class="card-sub">blocked reads to sensitive dirs</div></div>
+          <div class="card"><div class="card-label">Network Requests</div><div class="card-value" id="sandbox-net-count">0</div><div class="card-sub">outbound connections logged</div></div>
+          <div class="card"><div class="card-label">Sandbox Active</div><div class="card-value" id="sandbox-active-status" style="font-size:16px;color:#4ade80">Ready</div><div class="card-sub">activates on plugin spawn</div></div>
+        </div>
+
+        <div class="table-wrap">
+          <div class="table-header">
+            <h3>Events</h3>
+            <div class="filter-row">
+              <select id="sandbox-filter" onchange="renderSandboxPage()">
+                <option value="all">All events</option>
+                <option value="env_scrubbed">Env Scrubs</option>
+                <option value="fs_blocked">FS Blocks</option>
+                <option value="network_logged">Network Requests</option>
+              </select>
+            </div>
+          </div>
+          <div class="table-body" id="sandbox-table-body"></div>
+        </div>
+      </div>
+
     </main>
   </div>
 
@@ -525,7 +568,7 @@ function setDays(d) {
 function switchPage(page) {
   currentPage = page;
   document.querySelectorAll('.sidebar-btn').forEach(b => b.classList.toggle('active', b.dataset.page === page));
-  ['home','scan','skill','bash','pi','secrets','exfil'].forEach(p => {
+  ['home','scan','skill','bash','pi','secrets','exfil','sandbox'].forEach(p => {
     document.getElementById('page-' + p).style.display = p === page ? '' : 'none';
   });
   if (page === 'scan') loadScanStatus();
@@ -533,6 +576,7 @@ function switchPage(page) {
   else if (page === 'pi') renderPiPage();
   else if (page === 'secrets') renderSecretsPage();
   else if (page === 'exfil') { loadExfilAllowlist(); renderGuardPage('exfil'); }
+  else if (page === 'sandbox') renderSandboxPage();
   else if (page !== 'home') renderGuardPage(page);
 }
 
@@ -555,6 +599,7 @@ async function refresh() {
     else if (currentPage === 'pi') renderPiPage();
     else if (currentPage === 'secrets') renderSecretsPage();
     else if (currentPage === 'exfil') { loadExfilAllowlist(); renderGuardPage('exfil'); }
+    else if (currentPage === 'sandbox') renderSandboxPage();
     else if (currentPage !== 'home') renderGuardPage(currentPage);
     loadScanStatus(); // always update home scan summary
     document.getElementById('lastUpdated').textContent = 'Updated ' + new Date().toLocaleTimeString();
@@ -577,6 +622,9 @@ function renderOverview(ov) {
   document.getElementById('g-sec-blocks').textContent = gs.secrets_guard?.blocks || 0;
   document.getElementById('g-sec-redactions').textContent = gs.secrets_guard?.redactions || 0;
   document.getElementById('g-exfil-detections').textContent = gs.exfil_monitor?.detections || 0;
+  document.getElementById('g-sandbox-scrubs').textContent = gs.plugin_sandbox?.scrubs || 0;
+  document.getElementById('g-sandbox-fs').textContent = gs.plugin_sandbox?.fs_blocks || 0;
+  document.getElementById('g-sandbox-net').textContent = gs.plugin_sandbox?.net_logs || 0;
 
   const hasData = ov.total > 0;
   setDot('g-skill-dot', hasData, gs.skill_scanner?.blocks > 0);
@@ -584,6 +632,7 @@ function renderOverview(ov) {
   setDot('g-pi-dot', hasData, gs.prompt_injection?.blocks > 0);
   setDot('g-sec-dot', hasData, (gs.secrets_guard?.blocks > 0) || (gs.secrets_guard?.redactions > 0));
   setDot('g-exfil-dot', hasData, gs.exfil_monitor?.detections > 0, 'dot-yellow');
+  setDot('g-sandbox-dot', hasData, (gs.plugin_sandbox?.fs_blocks > 0), 'dot-yellow');
 }
 
 function renderSidebarDots(ov) {
@@ -594,6 +643,7 @@ function renderSidebarDots(ov) {
   setDot('sb-pi-dot', hasData, gs.prompt_injection?.blocks > 0);
   setDot('sb-sec-dot', hasData, (gs.secrets_guard?.blocks > 0) || (gs.secrets_guard?.redactions > 0));
   setDot('sb-exfil-dot', hasData, gs.exfil_monitor?.detections > 0, 'dot-yellow');
+  setDot('sb-sandbox-dot', hasData, (gs.plugin_sandbox?.fs_blocks > 0), 'dot-yellow');
 }
 
 function setDot(id, hasData, hasBlocks, activeClass) {
@@ -629,7 +679,7 @@ function renderBlockBanner() {
   }
 
   banner.style.display = '';
-  const guard = blockEvent.guard === 'skill' ? 'Skill Scanner' : 'Prompt Injection';
+  const guard = blockEvent.guard === 'skill' ? 'Skill & Plugin Scanner' : 'Prompt Injection';
   const guardPage = blockEvent.guard === 'skill' ? 'skill' : 'pi';
   document.getElementById('home-block-title').textContent = `Agent Blocked — ${guard}`;
   document.getElementById('home-block-reason').textContent = blockEvent.reason || 'A security threat was detected. All commands are blocked.';
@@ -716,14 +766,16 @@ function renderSkillStatus() {
     if (!sp) continue;
     const name = e.detail?.skill_name || sp.split('/').pop();
     if (!skillMap.has(sp)) {
-      skillMap.set(sp, { name, path: sp, dir: e.detail?.skill_dir || '', status: 'clean', reason: '', fileCount: 0, fileNames: [], binaryFiles: [], fileContents: [], ts: e.ts, decision: e.decision });
+      skillMap.set(sp, { name, path: sp, dir: e.detail?.skill_dir || '', status: 'clean', reason: '', fileCount: 0, fileNames: [], binaryFiles: [], skippedFiles: [], fileContents: [], ts: e.ts, decision: e.decision, type: e.detail?.type || 'skill' });
     }
     const skill = skillMap.get(sp);
     skill.ts = e.ts; // update to latest timestamp
     skill.decision = e.decision;
+    if (e.detail?.type) skill.type = e.detail.type;
     if (e.detail?.file_count !== undefined) skill.fileCount = e.detail.file_count;
     if (e.detail?.file_names) skill.fileNames = e.detail.file_names;
     if (e.detail?.binary_files) skill.binaryFiles = e.detail.binary_files;
+    if (e.detail?.skipped_files) skill.skippedFiles = e.detail.skipped_files;
     if (e.detail?.file_contents) skill.fileContents = e.detail.file_contents;
     // Determine status
     if (e.decision === 'scan_flagged') { skill.status = 'malicious'; skill.reason = e.reason || ''; }
@@ -741,13 +793,14 @@ function renderSkillStatus() {
   const skills = Array.from(skillMap.values()).filter(s => s.status !== 'removed');
 
   if (skills.length === 0) {
-    container.innerHTML = '<div class="empty">No skills discovered yet. Skills appear when openclaw-secure is active.</div>';
+    container.innerHTML = '<div class="empty">No skills or plugins discovered yet. They appear when openclaw-secure is active.</div>';
     return;
   }
 
   container.innerHTML = `<table><thead><tr>
     <th style="width:40px"></th>
-    <th>Skill</th>
+    <th>Name</th>
+    <th>Type</th>
     <th>Path</th>
     <th>Status</th>
     <th>Reason</th>
@@ -762,19 +815,26 @@ function renderSkillStatus() {
         : s.status === 'scanning'
         ? '<span class="badge badge-blue">Scanning</span>'
         : '<span class="badge badge-green">Clean</span>';
+      const typeBadge = s.type === 'plugin'
+        ? '<span class="badge badge-blue">Plugin</span>'
+        : '<span class="badge" style="background:rgba(255,255,255,0.06);color:#a1a1aa">Skill</span>';
       const deleteBtn = (s.status === 'malicious' || s.status === 'binary')
         ? `<button class="btn btn-sm" style="color:#f87171;border-color:rgba(239,68,68,0.3)" onclick="deleteSkill('${esc(s.path.replace(/'/g, "\\'"))}')">Delete</button>`
         : '';
       const viewFiles = s.fileNames.length > 0 || s.fileContents.length > 0
         ? `<span class="payload-toggle" onclick="openSkillFiles(${i})">${s.fileCount || s.fileNames.length}</span>`
         : `<span style="color:#a1a1aa">${s.fileCount || 0}</span>`;
+      const skippedWarning = s.skippedFiles && s.skippedFiles.length > 0
+        ? `<span title="${esc(s.skippedFiles.map(f => f.file + ': ' + f.reason).join('\n'))}" style="color:#eab308;cursor:help;margin-left:4px">&#9888; ${s.skippedFiles.length} skipped</span>`
+        : '';
       return `<tr>
         <td>${deleteBtn}</td>
         <td style="font-weight:500;font-family:ui-monospace,monospace;font-size:13px">${esc(s.name)}</td>
+        <td>${typeBadge}</td>
         <td style="font-size:12px;color:#a1a1aa;max-width:250px;word-break:break-all">${esc(s.path)}</td>
         <td>${statusBadge}</td>
         <td style="font-size:12px;color:#a1a1aa;max-width:300px">${esc(s.reason)}</td>
-        <td style="text-align:center">${viewFiles}</td>
+        <td style="text-align:center">${viewFiles}${skippedWarning}</td>
         <td style="white-space:nowrap;color:#a1a1aa;font-size:12px">${formatTime(s.ts)}</td>
       </tr>`;
     }).join('') + '</tbody></table>';
@@ -855,7 +915,7 @@ function renderSkillActivityLog() {
       }).join('') + '</tbody></table>';
   } else {
     // Show all skill-specific events (not "allow" per-command checks)
-    const skillDecisions = new Set(['init', 'init_skill', 'scanning', 'scan_clean', 'scan_flagged', 'binary_detected', 'removed', 'modified', 'deleted']);
+    const skillDecisions = new Set(['init', 'init_skill', 'scanning', 'scan_clean', 'scan_flagged', 'binary_detected', 'files_skipped', 'removed', 'modified', 'deleted']);
     let filtered = localEvents.filter(e => e.guard === 'skill' && skillDecisions.has(e.decision));
     if (blockedOnly) {
       filtered = filtered.filter(e => e.decision === 'scan_flagged' || e.decision === 'binary_detected');
@@ -867,18 +927,23 @@ function renderSkillActivityLog() {
     container.innerHTML = `<table><thead><tr>
       <th>Time</th>
       <th>Event</th>
-      <th>Skill</th>
+      <th>Name</th>
+      <th>Type</th>
       <th>Path</th>
       <th>Files</th>
       <th>Detail</th>
     </tr></thead><tbody>` +
       filtered.map((e, i) => {
-        const badgeMap = { init: 'badge-gray', init_skill: 'badge-gray', scanning: 'badge-blue', scan_clean: 'badge-green', scan_flagged: 'badge-red', binary_detected: 'badge-red', removed: 'badge-yellow', modified: 'badge-blue', deleted: 'badge-yellow' };
-        const labelMap = { init: 'Init', init_skill: 'Discovered', scanning: 'Scanning', scan_clean: 'Clean', scan_flagged: 'Flagged', binary_detected: 'Binary', removed: 'Removed', modified: 'Modified', deleted: 'Deleted' };
+        const badgeMap = { init: 'badge-gray', init_skill: 'badge-gray', scanning: 'badge-blue', scan_clean: 'badge-green', scan_flagged: 'badge-red', binary_detected: 'badge-red', files_skipped: 'badge-yellow', removed: 'badge-yellow', modified: 'badge-blue', deleted: 'badge-yellow' };
+        const labelMap = { init: 'Init', init_skill: 'Discovered', scanning: 'Scanning', scan_clean: 'Clean', scan_flagged: 'Flagged', binary_detected: 'Binary', files_skipped: 'Skipped', removed: 'Removed', modified: 'Modified', deleted: 'Deleted' };
         const badge = badgeMap[e.decision] || 'badge-gray';
         const label = labelMap[e.decision] || e.decision;
         const skillName = e.detail?.skill_name || '-';
         const skillPath = e.detail?.skill_path || '';
+        const entryType = e.detail?.type || 'skill';
+        const typeBadge = entryType === 'plugin'
+          ? '<span class="badge badge-blue">Plugin</span>'
+          : '<span class="badge" style="background:rgba(255,255,255,0.06);color:#a1a1aa">Skill</span>';
         const fileCount = e.detail?.file_count ?? e.detail?.file_names?.length ?? '';
         const fileNames = e.detail?.file_names || [];
         const binaryFiles = e.detail?.binary_files || [];
@@ -891,6 +956,8 @@ function renderSkillActivityLog() {
           const detailObj = {};
           if (fileNames.length > 0) detailObj.files = fileNames;
           if (binaryFiles.length > 0) detailObj.binary_files = binaryFiles;
+          if (e.detail?.skipped_files?.length > 0) detailObj.skipped_files = e.detail.skipped_files;
+          if (e.detail?.total_size_bytes) detailObj.total_size = (e.detail.total_size_bytes / 1024).toFixed(1) + ' KB';
           if (e.detail?.directories) detailObj.directories = e.detail.directories;
           if (e.detail?.cached !== undefined) detailObj.cached = e.detail.cached;
           if (Object.keys(detailObj).length > 0) {
@@ -901,6 +968,7 @@ function renderSkillActivityLog() {
           <td style="white-space:nowrap;color:#a1a1aa">${formatTime(e.ts)}</td>
           <td><span class="badge ${badge}">${label}</span></td>
           <td style="font-family:ui-monospace,monospace;font-size:13px">${esc(skillName)}</td>
+          <td>${typeBadge}</td>
           <td style="font-size:12px;color:#a1a1aa;max-width:200px;word-break:break-all">${esc(skillPath)}</td>
           <td style="text-align:center;color:#a1a1aa">${fileCount}</td>
           <td style="font-size:12px;color:#a1a1aa;max-width:350px">${detailParts.join('') + detailExtra}</td>
@@ -1153,6 +1221,60 @@ async function toggleExfilAllowlist() {
   } catch (e) { alert('Failed: ' + e.message); }
 }
 
+// =============================================
+// Plugin Sandbox Page
+// =============================================
+function renderSandboxPage() {
+  const filter = document.getElementById('sandbox-filter')?.value || 'all';
+  const container = document.getElementById('sandbox-table-body');
+
+  const sandboxEvents = localEvents.filter(e => e.guard === 'sandbox');
+  const scrubs = sandboxEvents.filter(e => e.decision === 'env_scrubbed');
+  const fsBlocks = sandboxEvents.filter(e => e.decision === 'fs_blocked');
+  const netLogs = sandboxEvents.filter(e => e.decision === 'network_logged');
+
+  // Update stat cards
+  const el = (id) => document.getElementById(id);
+  if (el('sandbox-scrubs-count')) el('sandbox-scrubs-count').textContent = scrubs.length;
+  if (el('sandbox-fs-count')) el('sandbox-fs-count').textContent = fsBlocks.length;
+  if (el('sandbox-net-count')) el('sandbox-net-count').textContent = netLogs.length;
+
+  let filtered = sandboxEvents;
+  if (filter === 'env_scrubbed') filtered = scrubs;
+  else if (filter === 'fs_blocked') filtered = fsBlocks;
+  else if (filter === 'network_logged') filtered = netLogs;
+
+  if (filtered.length === 0) {
+    container.innerHTML = '<div class="empty">No sandbox events yet. Events appear when plugin MCP servers are spawned.</div>';
+    return;
+  }
+
+  container.innerHTML = `<table><thead><tr>
+    <th>Time</th>
+    <th>Type</th>
+    <th>Detail</th>
+    <th>Extra</th>
+  </tr></thead><tbody>` +
+    filtered.map((e, i) => {
+      const badgeMap = { env_scrubbed: 'badge-blue', fs_blocked: 'badge-red', network_logged: 'badge-yellow' };
+      const labelMap = { env_scrubbed: 'Env Scrub', fs_blocked: 'FS Block', network_logged: 'Network' };
+      const badge = badgeMap[e.decision] || 'badge-gray';
+      const label = labelMap[e.decision] || e.decision;
+
+      let detail = esc(e.reason || '-');
+      const uid = 'sandbox-lc-' + i;
+      const detailObj = e.detail ? JSON.stringify(e.detail, null, 2) : '';
+      const detailHtml = detailObj ? `<span class="payload-toggle" onclick="document.getElementById('${uid}').classList.toggle('open')">[detail]</span><div class="payload-content" id="${uid}">${esc(detailObj)}</div>` : '';
+
+      return `<tr>
+        <td style="white-space:nowrap;color:#a1a1aa">${formatTime(e.ts)}</td>
+        <td><span class="badge ${badge}">${label}</span></td>
+        <td style="font-size:12px;color:#a1a1aa;max-width:400px">${detail}</td>
+        <td style="font-size:12px;color:#a1a1aa;max-width:300px">${detailHtml}</td>
+      </tr>`;
+    }).join('') + '</tbody></table>';
+}
+
 const SYSTEM_COMMANDS = /^(networksetup|arp|defaults)\b/;
 
 function renderGuardPage(guard) {

package/monitor/dashboard/server.js

@@ -101,12 +101,17 @@ module.exports = function startDashboard({ port = 9009 } = {}) {
     const exfilDetections = events.filter(e => e.event === 'guard_check' && e.guard === 'exfil').length;
     const secretsLeaked = events.filter(e => e.event === 'guard_check' && e.guard === 'secrets_leak').length;
 
+    const sandboxScrubs = events.filter(e => e.guard === 'sandbox' && e.decision === 'env_scrubbed').length;
+    const sandboxFsBlocks = events.filter(e => e.guard === 'sandbox' && e.decision === 'fs_blocked').length;
+    const sandboxNetLogs = events.filter(e => e.guard === 'sandbox' && e.decision === 'network_logged').length;
+
     const guardStatus = {
       skill_scanner: { blocks: byGuard.skill || 0, active: true },
       bash_guard: { blocks: byGuard.tirith || 0, active: true },
       prompt_injection: { blocks: byGuard.prompt_injection || 0, active: true },
       secrets_guard: { blocks: (byGuard.env_var || 0), redactions: redacted, leaks: secretsLeaked, active: true },
       exfil_monitor: { detections: exfilDetections, active: true },
+      plugin_sandbox: { scrubs: sandboxScrubs, fs_blocks: sandboxFsBlocks, net_logs: sandboxNetLogs, active: true },
     };
 
     json(res, { total, blocked, allowed, redacted, byGuard, guardStatus, activeSince });

package/monitor/plugin_guard/index.js

@@ -0,0 +1,194 @@
+'use strict';
+
+const path = require('path');
+const os = require('os');
+
+const HOME = os.homedir();
+const PLUGIN_DIR = path.join(HOME, '.claude', 'plugins');
+
+// Bare minimum for a Node.js process to function
+const SANDBOX_KEEP_VARS = new Set([
+  'PATH', 'HOME', 'USER', 'LOGNAME',
+  'TMPDIR', 'TEMP', 'TMP',
+  'LANG', 'LC_ALL', 'LC_CTYPE',
+  'SHELL', 'TERM',
+  'NODE_OPTIONS',           // so our hook loads in grandchild processes
+  'NODE_PATH',              // module resolution
+  '__CONTEXTFORT_SANDBOX',  // our marker
+]);
+
+const BLOCKED_DIRS = [
+  path.join(HOME, '.ssh'),
+  path.join(HOME, '.aws'),
+  path.join(HOME, '.gnupg'),
+  path.join(HOME, '.config'),
+  path.join(HOME, '.contextfort'),
+  path.join(HOME, '.npmrc'),
+  path.join(HOME, '.netrc'),
+  path.join(HOME, '.env'),
+  path.join(HOME, '.bash_history'),
+  path.join(HOME, '.zsh_history'),
+  path.join(HOME, '.gitconfig'),
+];
+
+// Commands that can launch plugin code
+const NODE_LIKE = new Set(['node', 'npx', 'tsx', 'bun']);
+
+module.exports = function createPluginGuard({ localLogger, analytics }) {
+  const track = analytics ? analytics.track.bind(analytics) : () => {};
+
+  /**
+   * Returns true if we're running inside a sandboxed plugin process.
+   */
+  function isSandboxed() {
+    return !!process.env.__CONTEXTFORT_SANDBOX;
+  }
+
+  /**
+   * Returns true if the spawn target is a plugin under ~/.claude/plugins/
+   */
+  function isPluginSpawn(command, args) {
+    if (!command) return false;
+    const cmd = path.basename(command);
+
+    // Direct path under plugins dir
+    try {
+      const resolved = path.resolve(command);
+      if (resolved.startsWith(PLUGIN_DIR + path.sep)) return true;
+    } catch {}
+
+    // node/npx/tsx/bun launching a file under plugins dir
+    if (NODE_LIKE.has(cmd)) {
+      if (Array.isArray(args)) {
+        for (const arg of args) {
+          if (typeof arg !== 'string') continue;
+          if (arg.startsWith('-')) continue; // skip flags
+          try {
+            const resolved = path.resolve(arg);
+            if (resolved.startsWith(PLUGIN_DIR + path.sep)) return true;
+          } catch {}
+        }
+      }
+    }
+
+    return false;
+  }
+
+  /**
+   * Returns a new env object with only SANDBOX_KEEP_VARS + the sandbox marker.
+   * Logs the stripped variable names.
+   */
+  function scrubEnvForPlugin(originalEnv) {
+    const scrubbed = {};
+    const stripped = [];
+
+    for (const key of Object.keys(originalEnv)) {
+      if (SANDBOX_KEEP_VARS.has(key)) {
+        scrubbed[key] = originalEnv[key];
+      } else {
+        stripped.push(key);
+      }
+    }
+
+    scrubbed.__CONTEXTFORT_SANDBOX = '1';
+
+    if (localLogger) {
+      try {
+        localLogger.logLocal({
+          event: 'guard_check',
+          guard: 'sandbox',
+          decision: 'env_scrubbed',
+          reason: `Scrubbed ${stripped.length} env vars from plugin process`,
+          detail: {
+            kept: Array.from(SANDBOX_KEEP_VARS),
+            stripped_count: stripped.length,
+            stripped_names: stripped,
+          },
+        });
+      } catch {}
+    }
+
+    track('sandbox_env_scrubbed', { stripped_count: stripped.length });
+    return scrubbed;
+  }
+
+  /**
+   * Checks if a file path is blocked under the sandbox.
+   * Returns null if allowed, { blocked: true, reason } if blocked.
+   * Only active when isSandboxed() is true.
+   */
+  function checkFsAccess(filePath) {
+    if (!isSandboxed()) return null;
+    if (!filePath || typeof filePath !== 'string') return null;
+
+    let resolved;
+    try {
+      resolved = path.resolve(String(filePath));
+    } catch {
+      return null;
+    }
+
+    for (const dir of BLOCKED_DIRS) {
+      if (resolved === dir || resolved.startsWith(dir + path.sep)) {
+        if (localLogger) {
+          try {
+            localLogger.logLocal({
+              event: 'guard_check',
+              guard: 'sandbox',
+              decision: 'fs_blocked',
+              reason: `Sandbox blocked read: ${resolved}`,
+              detail: { path: resolved, blocked_dir: dir },
+            });
+          } catch {}
+        }
+        track('sandbox_fs_blocked', { path: resolved, blocked_dir: dir });
+        return {
+          blocked: true,
+          reason: `SANDBOX: Access denied — ${resolved} is blocked for plugin processes`,
+        };
+      }
+    }
+
+    return null;
+  }
+
+  /**
+   * Logs an outbound network request from a sandboxed plugin process.
+   * Only active when isSandboxed() is true.
+   */
+  function logNetworkRequest(details) {
+    if (!isSandboxed()) return;
+
+    if (localLogger) {
+      try {
+        localLogger.logLocal({
+          event: 'guard_check',
+          guard: 'sandbox',
+          decision: 'network_logged',
+          reason: `Plugin network request: ${details.method || 'GET'} ${details.host || ''}${details.path || ''}`,
+          detail: {
+            host: details.host,
+            port: details.port,
+            method: details.method,
+            path: details.path,
+            protocol: details.protocol,
+          },
+        });
+      } catch {}
+    }
+
+    track('sandbox_network', {
+      host: details.host,
+      port: details.port,
+      method: details.method,
+    });
+  }
+
+  return {
+    isSandboxed,
+    isPluginSpawn,
+    scrubEnvForPlugin,
+    checkFsAccess,
+    logNetworkRequest,
+  };
+};

package/monitor/skills_guard/index.js

@@ -72,56 +72,89 @@ module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDi
       const entries = fs.readdirSync(dir, { withFileTypes: true });
       for (const e of entries) {
         if (e.isDirectory()) {
-          skills.push({ skillPath: path.join(dir, e.name), skillName: e.name });
+          skills.push({ skillPath: path.join(dir, e.name), skillName: e.name, type: 'skill' });
         }
       }
       // If there are loose files directly in the skill dir (e.g. SKILL.md), treat as a skill
       const hasLooseFiles = entries.some(e => e.isFile());
       if (hasLooseFiles) {
-        skills.push({ skillPath: dir, skillName: path.basename(dir) });
+        skills.push({ skillPath: dir, skillName: path.basename(dir), type: 'skill' });
       }
     } catch {}
     return skills;
   }
 
+  function getPluginEntries() {
+    const pluginsDir = path.join(HOME, '.claude', 'plugins');
+    const entries = [];
+    try {
+      const dirents = fs.readdirSync(pluginsDir, { withFileTypes: true });
+      for (const e of dirents) {
+        if (e.isDirectory() && !e.name.startsWith('.')) {
+          entries.push({
+            skillPath: path.join(pluginsDir, e.name),
+            skillName: e.name,
+            type: 'plugin',
+          });
+        }
+      }
+    } catch {}
+    return entries;
+  }
+
   function readSkillFiles(skillPath) {
     const files = [];
     const binaryFiles = [];
+    const skippedFiles = []; // { file, reason }
     const MAX_FILE_SIZE = 1 * 1024 * 1024; // 1MB
     const MAX_TOTAL_SIZE = 5 * 1024 * 1024; // 5MB
     let totalSize = 0;
+    let totalSizeExceeded = false;
 
     function walk(dirPath, base) {
       let entries;
       try { entries = fs.readdirSync(dirPath, { withFileTypes: true }); } catch { return; }
       for (const e of entries) {
-        if (e.name.startsWith('.') || e.name === 'node_modules') continue; // skip hidden and node_modules
+        if (e.name.startsWith('.') || e.name === 'node_modules') continue;
         const full = path.join(dirPath, e.name);
+        const rel = path.join(base, e.name);
         if (e.isDirectory()) {
-          walk(full, path.join(base, e.name));
+          walk(full, rel);
         } else if (e.isFile()) {
           try {
             const stat = fs.statSync(full);
-            if (stat.size > MAX_FILE_SIZE || stat.size === 0) continue;
-            if (totalSize + stat.size > MAX_TOTAL_SIZE) continue;
+            if (stat.size === 0) {
+              skippedFiles.push({ file: rel, reason: 'empty file (0 bytes)' });
+              continue;
+            }
+            if (stat.size > MAX_FILE_SIZE) {
+              skippedFiles.push({ file: rel, reason: `exceeds 1MB limit (${(stat.size / 1024 / 1024).toFixed(1)}MB)` });
+              continue;
+            }
+            if (totalSize + stat.size > MAX_TOTAL_SIZE) {
+              if (!totalSizeExceeded) totalSizeExceeded = true;
+              skippedFiles.push({ file: rel, reason: `total size would exceed 5MB limit (already ${(totalSize / 1024 / 1024).toFixed(1)}MB)` });
+              continue;
+            }
             // Check for binaries: read first 512 bytes and check for null bytes
             const buf = Buffer.alloc(Math.min(512, stat.size));
             const fd = fs.openSync(full, 'r');
             try { fs.readSync(fd, buf, 0, buf.length, 0); } finally { fs.closeSync(fd); }
             if (buf.includes(0)) {
-              binaryFiles.push(path.join(base, e.name));
+              binaryFiles.push(rel);
+              skippedFiles.push({ file: rel, reason: 'binary file (contains null bytes)' });
               continue;
             }
 
             const content = readFileSync(full, 'utf8');
             totalSize += stat.size;
-            files.push({ relative_path: path.join(base, e.name), content });
+            files.push({ relative_path: rel, content });
           } catch {}
         }
       }
     }
     walk(skillPath, '');
-    return { files, binaryFiles };
+    return { files, binaryFiles, skippedFiles, totalSize };
   }
 
   function hashSkillFiles(files) {
@@ -165,12 +198,12 @@ module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDi
     } catch {}
   }
 
-  function scanSkillAsync(skillPath, files, hash, installId) {
+  function scanSkillAsync(skillPath, files, hash, installId, type, skippedFiles) {
     if (pendingScans.has(skillPath)) return;
     pendingScans.add(skillPath);
-    track('skill_scan_started', { skill_name: path.basename(skillPath), file_count: files.length });
+    track('skill_scan_started', { skill_name: path.basename(skillPath), file_count: files.length, type: type || 'skill' });
     if (localLogger) {
-      try { localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'scanning', reason: `Scanning skill: ${path.basename(skillPath)} (${files.length} files)`, detail: { skill_name: path.basename(skillPath), skill_path: skillPath, file_count: files.length, file_names: files.map(f => f.relative_path), file_contents: files.map(f => ({ path: f.relative_path, content: f.content.slice(0, 2000) })) } }); } catch {}
+      try { localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'scanning', reason: `Scanning ${type || 'skill'}: ${path.basename(skillPath)} (${files.length} files)`, detail: { skill_name: path.basename(skillPath), skill_path: skillPath, file_count: files.length, file_names: files.map(f => f.relative_path), file_contents: files.map(f => ({ path: f.relative_path, content: f.content.slice(0, 2000) })), type: type || 'skill' } }); } catch {}
     }
 
     const payload = JSON.stringify({
@@ -178,6 +211,8 @@ module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDi
       skill_path: skillPath,
       skill_name: path.basename(skillPath),
       files: files,
+      type: type || 'skill',
+      skipped_files: skippedFiles && skippedFiles.length > 0 ? skippedFiles : undefined,
     });
 
     // Log what we're sending to Supabase (omit file contents for privacy)
@@ -217,13 +252,13 @@ module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDi
               } else {
                 flaggedSkills.delete(skillPath);
               }
-              track('skill_scan_result', { skill_name: path.basename(skillPath), suspicious: !!result.suspicious, status_code: 200 });
+              track('skill_scan_result', { skill_name: path.basename(skillPath), suspicious: !!result.suspicious, status_code: 200, type: type || 'skill' });
               if (localLogger) {
                 try {
                   if (result.suspicious) {
-                    localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'scan_flagged', reason: result.reason || 'Suspicious skill detected', detail: { skill_name: path.basename(skillPath), skill_path: skillPath, file_count: files.length, file_names: files.map(f => f.relative_path), file_contents: files.map(f => ({ path: f.relative_path, content: f.content.slice(0, 2000) })) } });
+                    localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'scan_flagged', reason: result.reason || 'Suspicious skill detected', detail: { skill_name: path.basename(skillPath), skill_path: skillPath, file_count: files.length, file_names: files.map(f => f.relative_path), file_contents: files.map(f => ({ path: f.relative_path, content: f.content.slice(0, 2000) })), type: type || 'skill' } });
                   } else {
-                    localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'scan_clean', reason: `Skill scan clean: ${path.basename(skillPath)}`, detail: { skill_name: path.basename(skillPath), skill_path: skillPath, file_count: files.length, file_names: files.map(f => f.relative_path) } });
+                    localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'scan_clean', reason: `Scan clean: ${path.basename(skillPath)}`, detail: { skill_name: path.basename(skillPath), skill_path: skillPath, file_count: files.length, file_names: files.map(f => f.relative_path), type: type || 'skill' } });
                   }
                 } catch {}
               }
@@ -244,10 +279,10 @@ module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDi
     }
   }
 
-  function logSkillRemoved(skillPath, installId) {
-    track('skill_removed', { skill_name: path.basename(skillPath) });
+  function logSkillRemoved(skillPath, installId, type) {
+    track('skill_removed', { skill_name: path.basename(skillPath), type: type || 'skill' });
     if (localLogger) {
-      try { localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'removed', reason: `Skill removed: ${path.basename(skillPath)}`, detail: { skill_name: path.basename(skillPath), skill_path: skillPath } }); } catch {}
+      try { localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'removed', reason: `${(type || 'skill')} removed: ${path.basename(skillPath)}`, detail: { skill_name: path.basename(skillPath), skill_path: skillPath, type: type || 'skill' } }); } catch {}
     }
     const payload = JSON.stringify({
       install_id: installId,
@@ -255,6 +290,7 @@ module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDi
       skill_name: path.basename(skillPath),
       files: [],
       removed: true,
+      type: type || 'skill',
     });
 
     const url = new URL(SKILL_SCAN_API);
@@ -278,8 +314,8 @@ module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDi
     } catch {}
   }
 
-  function scanSkillIfChanged(skillPath) {
-    const { files, binaryFiles } = readSkillFiles(skillPath);
+  function scanSkillIfChanged(skillPath, type) {
+    const { files, binaryFiles, skippedFiles, totalSize } = readSkillFiles(skillPath);
     if (files.length === 0 && binaryFiles.length === 0) {
       // Skill was deleted or is empty — remove from flagged
       flaggedSkills.delete(skillPath);
@@ -288,15 +324,20 @@ module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDi
       return;
     }
 
+    // Log skipped files if any
+    if (skippedFiles.length > 0 && localLogger) {
+      try { localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'files_skipped', reason: `${skippedFiles.length} file(s) skipped in ${type || 'skill'}: ${path.basename(skillPath)}`, detail: { skill_name: path.basename(skillPath), skill_path: skillPath, type: type || 'skill', skipped_files: skippedFiles, total_size_bytes: totalSize, scanned_file_count: files.length } }); } catch {}
+    }
+
     // Flag immediately if binary files found — legitimate skills should not contain binaries
     if (binaryFiles.length > 0) {
       flaggedSkills.set(skillPath, {
         suspicious: true,
-        reason: `Skill contains binary files (${binaryFiles.join(', ')}). Legitimate skills should only contain text files. Please delete these binary files or remove this skill.`,
+        reason: `${(type || 'skill')} contains binary files (${binaryFiles.join(', ')}). Please delete these binary files or remove this ${type || 'skill'}.`,
       });
-      track('skill_binary_detected', { skill_name: path.basename(skillPath), binary_count: binaryFiles.length });
+      track('skill_binary_detected', { skill_name: path.basename(skillPath), binary_count: binaryFiles.length, type: type || 'skill' });
       if (localLogger) {
-        try { localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'binary_detected', reason: `Binary files found in skill: ${path.basename(skillPath)}`, detail: { skill_name: path.basename(skillPath), skill_path: skillPath, binary_files: binaryFiles } }); } catch {}
+        try { localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'binary_detected', reason: `Binary files found in ${type || 'skill'}: ${path.basename(skillPath)}`, detail: { skill_name: path.basename(skillPath), skill_path: skillPath, binary_files: binaryFiles, type: type || 'skill' } }); } catch {}
       }
       saveScanCache();
       return;
@@ -307,14 +348,14 @@ module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDi
     if (skillContentHashes.get(skillPath) === hash) return; // unchanged
 
     if (!isNew && localLogger) {
-      try { localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'modified', reason: `Skill modified: ${path.basename(skillPath)}`, detail: { skill_name: path.basename(skillPath), skill_path: skillPath, file_count: files.length, file_names: files.map(f => f.relative_path) } }); } catch {}
+      try { localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'modified', reason: `${(type || 'skill')} modified: ${path.basename(skillPath)}`, detail: { skill_name: path.basename(skillPath), skill_path: skillPath, file_count: files.length, file_names: files.map(f => f.relative_path), type: type || 'skill' } }); } catch {}
     }
 
     const installId = getInstallId();
-    scanSkillAsync(skillPath, files, hash, installId);
+    scanSkillAsync(skillPath, files, hash, installId, type, skippedFiles);
   }
 
-  function watchSkillDirectory(dir) {
+  function watchSkillDirectory(dir, type) {
     const debounceTimers = new Map();
     try {
       const watcher = fs.watch(dir, { recursive: true }, (eventType, filename) => {
@@ -323,19 +364,19 @@ module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDi
         if (debounceTimers.has(skillDir)) clearTimeout(debounceTimers.get(skillDir));
         debounceTimers.set(skillDir, setTimeout(() => {
           debounceTimers.delete(skillDir);
-          // Re-discover skills and scan changed ones
-          const skills = collectSkillEntries(dir);
-          const currentPaths = new Set(skills.map(s => s.skillPath));
-          for (const { skillPath } of skills) {
-            scanSkillIfChanged(skillPath);
+          // Re-discover entries and scan changed ones
+          const entries = type === 'plugin' ? getPluginEntries() : collectSkillEntries(dir);
+          const currentPaths = new Set(entries.map(s => s.skillPath));
+          for (const { skillPath, type: entryType } of entries) {
+            scanSkillIfChanged(skillPath, entryType || type);
           }
-          // Detect deleted skills: any known skill in this dir that no longer exists
+          // Detect deleted entries: any known path in this dir that no longer exists
           for (const knownPath of skillContentHashes.keys()) {
             if (knownPath.startsWith(dir) && !currentPaths.has(knownPath)) {
               flaggedSkills.delete(knownPath);
               skillContentHashes.delete(knownPath);
               const installId = getInstallId();
-              logSkillRemoved(knownPath, installId);
+              logSkillRemoved(knownPath, installId, type);
               saveScanCache();
             }
           }
@@ -388,22 +429,33 @@ module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDi
     for (const dir of dirs) {
       const skills = collectSkillEntries(dir);
       totalSkills += skills.length;
-      for (const { skillPath } of skills) {
-        scanSkillIfChanged(skillPath);
+      for (const { skillPath, type } of skills) {
+        scanSkillIfChanged(skillPath, type);
       }
       watchSkillDirectory(dir);
     }
+
+    // Scan plugins (entire plugin directories, not just skills/)
+    const pluginEntries = getPluginEntries();
+    totalSkills += pluginEntries.length;
+    for (const { skillPath, type } of pluginEntries) {
+      scanSkillIfChanged(skillPath, type);
+    }
+    // Watch the plugins directory itself for new/changed plugins
+    const pluginsDir = path.join(HOME, '.claude', 'plugins');
+    try { if (fs.statSync(pluginsDir).isDirectory()) watchSkillDirectory(pluginsDir, 'plugin'); } catch {}
+
     // Always register session so install_id → user_id mapping exists in Supabase
     registerSession(installId, totalSkills);
-    track('skill_scanner_init', { skill_dir_count: dirs.length, total_skills: totalSkills });
+    track('skill_scanner_init', { skill_dir_count: dirs.length, total_skills: totalSkills, plugin_count: pluginEntries.length });
     if (localLogger) {
-      try { localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'init', reason: `Skill scanner initialized: ${totalSkills} skills in ${dirs.length} directories`, detail: { skill_dir_count: dirs.length, total_skills: totalSkills, directories: dirs } }); } catch {}
+      try { localLogger.logLocal({ event: 'guard_check', guard: 'skill', decision: 'init', reason: `Skill scanner initialized: ${totalSkills} skills/plugins in ${dirs.length} directories`, detail: { skill_dir_count: dirs.length, total_skills: totalSkills, plugin_count: pluginEntries.length, directories: dirs } }); } catch {}
       // Log each skill individually so dashboard can show per-skill status
       for (const dir of dirs) {
         const skills = collectSkillEntries(dir);
-        for (const { skillPath, skillName } of skills) {
+        for (const { skillPath, skillName, type } of skills) {
           try {
-            const { files, binaryFiles } = readSkillFiles(skillPath);
+            const { files, binaryFiles, skippedFiles, totalSize } = readSkillFiles(skillPath);
             const cached = skillContentHashes.has(skillPath);
             const flagged = flaggedSkills.get(skillPath);
             localLogger.logLocal({
@@ -417,14 +469,44 @@ module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDi
                 binary_count: binaryFiles.length,
                 file_names: files.map(f => f.relative_path),
                 binary_files: binaryFiles,
+                skipped_files: skippedFiles.length > 0 ? skippedFiles : undefined,
+                total_size_bytes: totalSize,
                 cached,
                 status: flagged?.suspicious ? 'malicious' : (binaryFiles.length > 0 ? 'binary' : 'clean'),
                 flagged_reason: flagged?.reason || null,
+                type: type || 'skill',
               },
             });
           } catch {}
         }
       }
+      // Log each plugin individually
+      for (const { skillPath, skillName, type } of pluginEntries) {
+        try {
+          const { files, binaryFiles, skippedFiles, totalSize } = readSkillFiles(skillPath);
+          const cached = skillContentHashes.has(skillPath);
+          const flagged = flaggedSkills.get(skillPath);
+          localLogger.logLocal({
+            event: 'guard_check', guard: 'skill', decision: 'init_skill',
+            reason: `Plugin discovered: ${skillName}`,
+            detail: {
+              skill_name: skillName,
+              skill_path: skillPath,
+              skill_dir: pluginsDir,
+              file_count: files.length,
+              binary_count: binaryFiles.length,
+              file_names: files.map(f => f.relative_path),
+              binary_files: binaryFiles,
+              skipped_files: skippedFiles.length > 0 ? skippedFiles : undefined,
+              total_size_bytes: totalSize,
+              cached,
+              status: flagged?.suspicious ? 'malicious' : (binaryFiles.length > 0 ? 'binary' : 'clean'),
+              flagged_reason: flagged?.reason || null,
+              type: 'plugin',
+            },
+          });
+        } catch {}
+      }
     }
   }
 

package/openclaw-secure.js

@@ -79,6 +79,12 @@ const exfilGuard = require('./monitor/exfil_guard')({
   readFileSync: _originalReadFileSync,
 });
 
+// === Plugin Sandbox Guard ===
+const pluginGuard = require('./monitor/plugin_guard')({
+  localLogger,
+  analytics,
+});
+
 // === Prompt Injection Guard (PostToolUse) ===
 function loadAnthropicKey() {
   if (process.env.ANTHROPIC_API_KEY) return process.env.ANTHROPIC_API_KEY;
@@ -288,6 +294,15 @@ function hookAllSpawnMethods(cp) {
   if (cp.spawn && !cp.spawn.__hooked) {
     const orig = cp.spawn;
     cp.spawn = function(command, args, options) {
+      // Plugin sandbox: scrub env before spawning plugin processes
+      // Only scrub from the parent (non-sandboxed) process — if we're already
+      // sandboxed, the env is already minimal and the plugin may have added
+      // its own vars (e.g. CAMOFOX_PORT) that must be preserved.
+      if (!pluginGuard.isSandboxed() && pluginGuard.isPluginSpawn(command, args)) {
+        if (!options || typeof options !== 'object') options = {};
+        options.env = pluginGuard.scrubEnvForPlugin(options.env || process.env);
+        arguments[2] = options;
+      }
       const shellCmd = extractShellCommand(command, args);
       if (shellCmd) {
         const block = shouldBlockCommand(shellCmd);
@@ -320,6 +335,12 @@ function hookAllSpawnMethods(cp) {
   if (cp.spawnSync && !cp.spawnSync.__hooked) {
     const orig = cp.spawnSync;
     cp.spawnSync = function(command, args, options) {
+      // Plugin sandbox: scrub env before spawning plugin processes (same guard as spawn)
+      if (!pluginGuard.isSandboxed() && pluginGuard.isPluginSpawn(command, args)) {
+        if (!options || typeof options !== 'object') options = {};
+        options.env = pluginGuard.scrubEnvForPlugin(options.env || process.env);
+        arguments[2] = options;
+      }
       const shellCmd = extractShellCommand(command, args);
       if (shellCmd) {
         const block = shouldBlockCommand(shellCmd);
@@ -488,14 +509,18 @@ function hookAllSpawnMethods(cp) {
 // === fs hooks ===
 
 function hookFsMethods(fsModule) {
-  if (fsModule.readFileSync && !fsModule.readFileSync.__hooked) {
-    const orig = fsModule.readFileSync;
-    fsModule.readFileSync = function(filePath, options) {
-      // Pass-through: blocking here disrupts openclaw's own config/LLM operations.
-      // Agent actions are blocked at child_process level instead.
-      return orig.apply(this, arguments);
-    };
-    fsModule.readFileSync.__hooked = true;
+  // Sandbox FS blocklist — only active in sandboxed plugin processes
+  const fsMethodsToGuard = ['readFileSync', 'readFile', 'existsSync', 'statSync', 'readdirSync', 'accessSync'];
+  for (const method of fsMethodsToGuard) {
+    if (fsModule[method] && !fsModule[method].__hooked) {
+      const orig = fsModule[method];
+      fsModule[method] = function(filePath) {
+        const fsBlock = pluginGuard.checkFsAccess(filePath);
+        if (fsBlock) { const e = new Error(fsBlock.reason); e.code = 'EACCES'; throw e; }
+        return orig.apply(this, arguments);
+      };
+      fsModule[method].__hooked = true;
+    }
   }
 }
 
@@ -505,8 +530,17 @@ function hookHttpModule(mod, protocol) {
   if (mod.request && !mod.request.__hooked) {
     const orig = mod.request;
     mod.request = function(options, callback) {
-      // Pass-through: blocking here kills openclaw's LLM API calls.
-      // Agent actions are blocked at child_process level instead.
+      // Sandbox network logging — log outbound requests from plugin processes
+      try {
+        const opts = typeof options === 'string' ? new URL(options) : options;
+        pluginGuard.logNetworkRequest({
+          host: opts.hostname || opts.host,
+          port: opts.port,
+          method: opts.method || 'GET',
+          path: opts.path || opts.pathname,
+          protocol: protocol || 'https:',
+        });
+      } catch {}
       return orig.apply(this, arguments);
     };
     mod.request.__hooked = true;
@@ -515,6 +549,16 @@ function hookHttpModule(mod, protocol) {
   if (mod.get && !mod.get.__hooked) {
     const orig = mod.get;
     mod.get = function(options, callback) {
+      try {
+        const opts = typeof options === 'string' ? new URL(options) : options;
+        pluginGuard.logNetworkRequest({
+          host: opts.hostname || opts.host,
+          port: opts.port,
+          method: 'GET',
+          path: opts.path || opts.pathname,
+          protocol: protocol || 'https:',
+        });
+      } catch {}
       return orig.apply(this, arguments);
     };
     mod.get.__hooked = true;
@@ -527,8 +571,19 @@ function hookGlobalFetch() {
   if (!globalThis.fetch || globalThis.fetch.__hooked) return;
   const origFetch = globalThis.fetch;
   globalThis.fetch = function(url, options) {
-    // Pass-through: blocking here kills openclaw's LLM API calls.
-    // Agent actions are blocked at child_process level instead.
+    // Sandbox network logging — log outbound fetch from plugin processes
+    try {
+      const u = typeof url === 'string' ? new URL(url) : (url instanceof URL ? url : (url && url.url ? new URL(url.url) : null));
+      if (u) {
+        pluginGuard.logNetworkRequest({
+          host: u.hostname,
+          port: u.port || (u.protocol === 'https:' ? 443 : 80),
+          method: (options && options.method) || 'GET',
+          path: u.pathname + u.search,
+          protocol: u.protocol,
+        });
+      }
+    } catch {}
     return origFetch.apply(this, arguments);
   };
   globalThis.fetch.__hooked = true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contextfort-ai/openclaw-secure",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Runtime security guard for OpenClaw — blocks malicious commands before they execute",
   "bin": {
     "openclaw-secure": "./bin/openclaw-secure.js"