@contextfort-ai/openclaw-secure 0.1.7 → 0.1.9

package/monitor/skills_guard/index.js

@@ -8,7 +8,7 @@ const os = require('os');
 const SKILL_SCAN_API = 'https://lschqndjjwtyrlcojvly.supabase.co/functions/v1/scan-skill';
 const HOME = os.homedir();
 
-module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDir, apiKey, analytics, enabled = true }) {
+module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDir, apiKey, analytics, enabled = true, localLogger }) {
   // If skill delivery is disabled, return a no-op guard
   if (!enabled) {
     return {
@@ -177,6 +177,11 @@ module.exports = function createSkillsGuard({ readFileSync, httpsRequest, baseDi
       files: files,
     });
 
+    // Log what we're sending to Supabase (omit file contents for privacy)
+    if (localLogger) {
+      try { localLogger.logServerSend({ destination: 'supabase', event: 'skill_scan', payload: { skill_name: path.basename(skillPath), file_count: files.length } }); } catch {}
+    }
+
     const url = new URL(SKILL_SCAN_API);
     const headers = {
       'Content-Type': 'application/json',

package/openclaw-secure.js

@@ -19,12 +19,17 @@ function loadPreferences() {
 const PREFS = loadPreferences();
 const SKILL_DELIVER = PREFS.skillDeliver !== false; // default true
 
+// === Local Audit Logger ===
+const localLogger = require('./monitor/local_logger')({ baseDir: CONFIG_DIR });
+
 // === Analytics ===
 const analytics = require('./monitor/analytics')({
   httpsRequest: _originalHttpsRequest,
   readFileSync: _originalReadFileSync,
   baseDir: __dirname,
+  localLogger,
 });
+localLogger.logLocal({ event: 'hook_loaded' });
 analytics.track('hook_loaded');
 
 function loadApiKey() {
@@ -57,6 +62,20 @@ const skillsGuard = require('./monitor/skills_guard')({
   apiKey: API_KEY,
   analytics,
   enabled: SKILL_DELIVER,
+  localLogger,
+});
+
+// === Secrets Guard (env var leak monitoring) ===
+const secretsGuard = require('./monitor/secrets_guard')({
+  spawnSync: _originalSpawnSync,
+  baseDir: __dirname,
+  analytics,
+});
+
+// === Exfil Guard (logging-only) ===
+const exfilGuard = require('./monitor/exfil_guard')({
+  analytics,
+  localLogger,
 });
 
 // === Prompt Injection Guard (PostToolUse) ===
@@ -115,23 +134,61 @@ function extractShellCommand(command, args) {
 
 function shouldBlockCommand(cmd) {
   if (!cmd || typeof cmd !== 'string') return null;
+  const cmdSlice = cmd.slice(0, 500);
+  const guards = [];
+
   const keyBlock = checkApiKey();
-  if (keyBlock) { analytics.track('command_blocked', { blocker: 'api_key' }); return keyBlock; }
+  if (keyBlock) {
+    analytics.track('command_blocked', { blocker: 'api_key' });
+    localLogger.logLocal({ event: 'command_blocked', command: cmdSlice, guards: ['api_key'], decision: 'block', blocker: 'api_key', reason: 'No API key' });
+    return keyBlock;
+  }
+  guards.push('api_key');
+
   const outputBlock = promptInjectionGuard.checkFlaggedOutput();
   if (outputBlock) {
     analytics.track('command_blocked', { blocker: 'prompt_injection' });
+    localLogger.logLocal({ event: 'command_blocked', command: cmdSlice, guards: [...guards, 'prompt_injection'], decision: 'block', blocker: 'prompt_injection', reason: outputBlock.reason || 'Flagged output' });
     return { blocked: true, reason: promptInjectionGuard.formatOutputBlockError(outputBlock) };
   }
+  guards.push('prompt_injection');
+
   const skillBlock = skillsGuard.checkFlaggedSkills();
   if (skillBlock) {
     analytics.track('command_blocked', { blocker: 'skill' });
+    localLogger.logLocal({ event: 'command_blocked', command: cmdSlice, guards: [...guards, 'skill'], decision: 'block', blocker: 'skill', reason: skillBlock.reason || 'Flagged skill' });
     return { blocked: true, reason: skillsGuard.formatSkillBlockError(skillBlock) };
   }
+  guards.push('skill');
+
+  const envCheck = secretsGuard.checkEnvVarLeak(cmd);
+  if (envCheck && envCheck.blocked) {
+    analytics.track('command_blocked', { blocker: 'env_var_leak', vars: envCheck.vars, type: envCheck.type });
+    localLogger.logLocal({ event: 'command_blocked', command: cmdSlice, guards: [...guards, 'env_var'], decision: 'block', blocker: 'env_var', reason: `Env var leak: ${envCheck.vars.join(', ')}` });
+    return { blocked: true, reason: secretsGuard.formatEnvVarBlockError(envCheck) };
+  }
+  if (envCheck && !envCheck.blocked && envCheck.vars.length > 0) {
+    analytics.track('env_var_used', { vars: envCheck.vars, command_prefix: cmd.slice(0, 100) });
+  }
+  guards.push('env_var');
+
+  const exfilCheck = exfilGuard.checkExfilAttempt(cmd);
+  if (exfilCheck) {
+    analytics.track('exfil_attempt', { tool: exfilCheck.tool, destination: exfilCheck.destination, vars_count: exfilCheck.vars.length });
+    localLogger.logLocal({ event: 'exfil_attempt', command: cmdSlice, guards: [...guards, 'exfil'], decision: 'log', blocker: 'exfil', reason: null, detection: exfilCheck });
+  }
+  guards.push('exfil');
+
   const result = checkCommandWithMonitor(cmd);
   if (result?.blocked) {
     analytics.track('command_blocked', { blocker: 'tirith', reason: result.reason });
+    localLogger.logLocal({ event: 'command_blocked', command: cmdSlice, guards: [...guards, 'tirith'], decision: 'block', blocker: 'tirith', reason: result.reason });
     return result;
   }
+  guards.push('tirith');
+
+  // All guards passed — log the allowed command
+  localLogger.logLocal({ event: 'command_check', command: cmdSlice, guards, decision: 'allow', blocker: null, reason: null });
   return null;
 }
 
@@ -190,6 +247,26 @@ function hookAllSpawnMethods(cp) {
       const result = orig.apply(this, arguments);
       if (shellCmd) {
         try { promptInjectionGuard.scanOutput(shellCmd, (result.stdout || '').toString(), (result.stderr || '').toString()); } catch {}
+        // Redact secrets from output before LLM sees them
+        try {
+          const stdoutStr = (result.stdout || '').toString();
+          const stderrStr = (result.stderr || '').toString();
+          const stdoutScan = secretsGuard.scanOutputForSecrets(stdoutStr);
+          const stderrScan = secretsGuard.scanOutputForSecrets(stderrStr);
+          if (stdoutScan.found || stderrScan.found) {
+            const allSecrets = [...(stdoutScan.secrets || []), ...(stderrScan.secrets || [])];
+            const notice = secretsGuard.formatRedactionNotice({ secrets: allSecrets });
+            localLogger.logLocal({ event: 'output_redacted', command: shellCmd.slice(0, 500), guards: ['secrets'], decision: 'redact', secrets_count: allSecrets.length });
+            if (stdoutScan.found) {
+              const redacted = stdoutScan.redacted + notice;
+              result.stdout = Buffer.isBuffer(result.stdout) ? Buffer.from(redacted) : redacted;
+            }
+            if (stderrScan.found) {
+              const redacted = stderrScan.redacted + notice;
+              result.stderr = Buffer.isBuffer(result.stderr) ? Buffer.from(redacted) : redacted;
+            }
+          }
+        } catch {}
       }
       return result;
     };
@@ -206,9 +283,21 @@ function hookAllSpawnMethods(cp) {
         if (cb) { process.nextTick(() => cb(e, '', '')); return { kill: () => {} }; }
         throw e;
       }
-      // Wrap callback to capture output for PostToolUse scan
+      // Wrap callback to capture output for PostToolUse scan + redact secrets
       const wrapCb = (origCb) => function(err, stdout, stderr) {
         if (!err) { try { promptInjectionGuard.scanOutput(command, (stdout || '').toString(), (stderr || '').toString()); } catch {} }
+        // Redact secrets from output before callback sees them
+        try {
+          let so = stdout, se = stderr;
+          const stdoutScan = secretsGuard.scanOutputForSecrets((stdout || '').toString());
+          const stderrScan = secretsGuard.scanOutputForSecrets((stderr || '').toString());
+          if (stdoutScan.found || stderrScan.found) {
+            const notice = secretsGuard.formatRedactionNotice({ secrets: [...(stdoutScan.secrets || []), ...(stderrScan.secrets || [])] });
+            if (stdoutScan.found) so = stdoutScan.redacted + notice;
+            if (stderrScan.found) se = stderrScan.redacted + notice;
+            return origCb.call(this, err, so, se);
+          }
+        } catch {}
         return origCb.apply(this, arguments);
       };
       if (typeof options === 'function') {
@@ -228,6 +317,16 @@ function hookAllSpawnMethods(cp) {
       if (block) { const e = new Error(formatBlockError(command, block)); e.code = 'EPERM'; throw e; }
       const result = orig.apply(this, arguments);
       try { promptInjectionGuard.scanOutput(command, (result || '').toString(), ''); } catch {}
+      // Redact secrets from output before LLM sees them
+      try {
+        const str = (result || '').toString();
+        const scan = secretsGuard.scanOutputForSecrets(str);
+        if (scan.found) {
+          localLogger.logLocal({ event: 'output_redacted', command: command.slice(0, 500), guards: ['secrets'], decision: 'redact', secrets_count: scan.secrets.length });
+          const redacted = scan.redacted + secretsGuard.formatRedactionNotice(scan);
+          return Buffer.isBuffer(result) ? Buffer.from(redacted) : redacted;
+        }
+      } catch {}
       return result;
     };
     cp.execSync.__hooked = true;
@@ -246,10 +345,22 @@ function hookAllSpawnMethods(cp) {
           throw e;
         }
       }
-      // Wrap callback for PostToolUse scan
+      // Wrap callback for PostToolUse scan + redact secrets
       if (shellCmd) {
         const wrapCb = (origCb) => function(err, stdout, stderr) {
           if (!err) { try { promptInjectionGuard.scanOutput(shellCmd, (stdout || '').toString(), (stderr || '').toString()); } catch {} }
+          // Redact secrets from output before callback sees them
+          try {
+            let so = stdout, se = stderr;
+            const stdoutScan = secretsGuard.scanOutputForSecrets((stdout || '').toString());
+            const stderrScan = secretsGuard.scanOutputForSecrets((stderr || '').toString());
+            if (stdoutScan.found || stderrScan.found) {
+              const notice = secretsGuard.formatRedactionNotice({ secrets: [...(stdoutScan.secrets || []), ...(stderrScan.secrets || [])] });
+              if (stdoutScan.found) so = stdoutScan.redacted + notice;
+              if (stderrScan.found) se = stderrScan.redacted + notice;
+              return origCb.call(this, err, so, se);
+            }
+          } catch {}
           return origCb.apply(this, arguments);
         };
         if (typeof args === 'function') return orig.call(this, file, wrapCb(args));
@@ -272,6 +383,16 @@ function hookAllSpawnMethods(cp) {
       const result = orig.apply(this, arguments);
       if (shellCmd) {
         try { promptInjectionGuard.scanOutput(shellCmd, (result || '').toString(), ''); } catch {}
+        // Redact secrets from output
+        try {
+          const str = (result || '').toString();
+          const scan = secretsGuard.scanOutputForSecrets(str);
+          if (scan.found) {
+            localLogger.logLocal({ event: 'output_redacted', command: shellCmd.slice(0, 500), guards: ['secrets'], decision: 'redact', secrets_count: scan.secrets.length });
+            const redacted = scan.redacted + secretsGuard.formatRedactionNotice(scan);
+            return Buffer.isBuffer(result) ? Buffer.from(redacted) : redacted;
+          }
+        } catch {}
       }
       return result;
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@contextfort-ai/openclaw-secure",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Runtime security guard for OpenClaw — blocks malicious commands before they execute",
   "bin": {
     "openclaw-secure": "./bin/openclaw-secure.js"