@datafog/fogclaw 0.1.0 → 0.1.3

package/README.md

@@ -29,6 +29,22 @@ npm run build
 
 ## Quick Start
 
+### GLiNER first-run setup (no extra steps)
+
+FogClaw automatically downloads the GLiNER ONNX model on first run if it is not already cached locally, then reuses it for all later starts.
+
+What happens on first scan:
+
+1. Tokenizers are downloaded (if needed).
+2. The first available ONNX file from Hugging Face is downloaded to the plugin's local model cache:
+   - `.../node_modules/@xenova/transformers/.cache/<model-repo>/onnx/<selected-model>.onnx`
+   - (This download can take a moment depending on network and selected model size.)
+3. GLiNER starts using local files, so later runs stay fast and offline-friendly.
+
+If the download cannot be performed (network/firewall/auth), FogClaw safely falls back to regex-only mode and continues to protect common structured PII.
+
+If your network requires Hugging Face authentication, export `HF_TOKEN` or `HF_ACCESS_TOKEN` before starting OpenClaw so model files can download.
+
 1. Copy the example config:
 
 ```bash
@@ -144,7 +160,7 @@ Plus any labels you add via `custom_entities` in the config.
 | `enabled` | `boolean` | `true` | Enable/disable the plugin |
 | `guardrail_mode` | `string` | `"redact"` | Default action: `"redact"`, `"block"`, or `"warn"` |
 | `redactStrategy` | `string` | `"token"` | How to redact: `"token"`, `"mask"`, or `"hash"` |
-| `model` | `string` | `"onnx-community/gliner_large-v2.1"` | HuggingFace model path for GLiNER |
+| `model` | `string` | `"onnx-community/gliner_large-v2.1"` | HuggingFace model path for GLiNER (or a local `.onnx` path for advanced setups). |
 | `confidence_threshold` | `number` | `0.5` | Minimum confidence for GLiNER detections (0-1) |
 | `custom_entities` | `string[]` | `[]` | Custom entity labels for zero-shot detection |
 | `entityActions` | `object` | `{}` | Per-entity-type action overrides |

package/dist/engines/gliner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gliner.d.ts","sourceRoot":"","sources":["../../src/engines/gliner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAc1C,qBAAa,YAAY;IACvB,OAAO,CAAC,KAAK,CAAa;IAC1B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,WAAW,CAAS;gBAEhB,SAAS,EAAE,MAAM,EAAE,SAAS,GAAE,MAAY;IAKhD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAuBjC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI;IAIjC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA+BnE,IAAI,aAAa,IAAI,OAAO,CAE3B;CACF"}
+{"version":3,"file":"gliner.d.ts","sourceRoot":"","sources":["../../src/engines/gliner.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAmJ1C,qBAAa,YAAY;IACvB,OAAO,CAAC,KAAK,CAAa;IAC1B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,WAAW,CAAS;gBAEhB,SAAS,EAAE,MAAM,EAAE,SAAS,GAAE,MAAY;IAKhD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBjC,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI;IAIjC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IA+BnE,IAAI,aAAa,IAAI,OAAO,CAE3B;CACF"}

package/dist/engines/gliner.js

@@ -1,3 +1,6 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { env } from "@xenova/transformers";
 import { canonicalType } from "../types.js";
 const DEFAULT_NER_LABELS = [
     "person",
@@ -9,6 +12,114 @@ const DEFAULT_NER_LABELS = [
     "account number",
     "passport number",
 ];
+const GLINER_MODEL_FILES = [
+    "onnx/model_q4f16.onnx",
+    "onnx/model_q4.onnx",
+    "onnx/model_bnb4.onnx",
+    "onnx/model_int8.onnx",
+    "onnx/model_uint8.onnx",
+    "onnx/model_quantized.onnx",
+    "onnx/model_fp16.onnx",
+    "onnx/model.onnx",
+];
+const MODEL_DOWNLOAD_TIMEOUT_MS = 120_000;
+function isLikelyLocalPath(modelPath) {
+    const trimmed = modelPath.trim();
+    if (!trimmed) {
+        return false;
+    }
+    const lower = trimmed.toLowerCase();
+    const hasExtension = [".onnx", ".ort", ".bin"].some((ext) => lower.endsWith(ext));
+    if (hasExtension) {
+        return true;
+    }
+    if (trimmed.startsWith(".") || path.isAbsolute(trimmed)) {
+        return true;
+    }
+    return false;
+}
+function toAbsolutePath(value) {
+    return path.isAbsolute(value) ? value : path.resolve(process.cwd(), value);
+}
+function getModelCacheDir() {
+    return env.localModelPath ?? path.join(process.cwd(), ".cache");
+}
+function sanitizeModelReference(modelPath) {
+    return modelPath.trim();
+}
+async function fileExists(filePath) {
+    try {
+        await fs.access(filePath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function downloadModelIfNeeded(modelRepo, filename) {
+    const cacheDir = getModelCacheDir();
+    const localPath = path.join(cacheDir, modelRepo, filename);
+    if (await fileExists(localPath)) {
+        return localPath;
+    }
+    const url = `https://huggingface.co/${modelRepo}/resolve/main/${filename}`;
+    const headers = new Headers();
+    const token = process.env.HF_TOKEN ?? process.env.HF_ACCESS_TOKEN;
+    if (token) {
+        headers.set("Authorization", `Bearer ${token}`);
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), MODEL_DOWNLOAD_TIMEOUT_MS);
+    try {
+        const response = await fetch(url, { headers, signal: controller.signal });
+        if (!response.ok) {
+            throw new Error(`Unable to download model artifact: ${response.status}`);
+        }
+        const bytes = new Uint8Array(await response.arrayBuffer());
+        await fs.mkdir(path.dirname(localPath), { recursive: true });
+        await fs.writeFile(localPath, bytes);
+        return localPath;
+    }
+    catch (err) {
+        if (err instanceof Error && err.name === "AbortError") {
+            throw new Error(`Model download timed out after ${MODEL_DOWNLOAD_TIMEOUT_MS}ms`);
+        }
+        throw err;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+async function resolveModelPath(modelPath) {
+    const sanitized = sanitizeModelReference(modelPath);
+    if (!sanitized) {
+        throw new Error("Model path is empty");
+    }
+    if (isLikelyLocalPath(sanitized)) {
+        const absolutePath = toAbsolutePath(sanitized);
+        if (!(await fileExists(absolutePath))) {
+            throw new Error(`Local GLiNER model file not found at: ${absolutePath}`);
+        }
+        return absolutePath;
+    }
+    const candidates = GLINER_MODEL_FILES;
+    let lastError;
+    for (const filename of candidates) {
+        const localPath = path.join(getModelCacheDir(), sanitized, filename);
+        if (await fileExists(localPath)) {
+            return localPath;
+        }
+    }
+    for (const filename of candidates) {
+        try {
+            return await downloadModelIfNeeded(sanitized, filename);
+        }
+        catch (err) {
+            lastError = err instanceof Error ? err : new Error(String(err));
+        }
+    }
+    throw new Error(`Failed to resolve GLiNER model "${sanitized}". Tried ${candidates.join(", ")}: ${lastError?.message ?? "unknown"}`);
+}
 export class GlinerEngine {
     model = null;
     modelPath;
@@ -23,11 +134,13 @@ export class GlinerEngine {
         if (this.initialized)
             return;
         try {
-            const { Gliner } = await import("gliner");
+            const resolvedModelPath = await resolveModelPath(this.modelPath);
+            const glinerModule = await import("gliner/node").catch(async () => import("gliner"));
+            const { Gliner } = glinerModule;
             this.model = new Gliner({
                 tokenizerPath: this.modelPath,
                 onnxSettings: {
-                    modelPath: this.modelPath,
+                    modelPath: resolvedModelPath,
                     executionProvider: "cpu",
                 },
                 maxWidth: 12,

package/dist/engines/gliner.js.map

@@ -1 +1 @@
-{"version":3,"file":"gliner.js","sourceRoot":"","sources":["../../src/engines/gliner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,cAAc;IACd,UAAU;IACV,SAAS;IACT,eAAe;IACf,uBAAuB;IACvB,gBAAgB;IAChB,iBAAiB;CAClB,CAAC;AAEF,MAAM,OAAO,YAAY;IACf,KAAK,GAAQ,IAAI,CAAC;IAClB,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,YAAY,GAAa,EAAE,CAAC;IAC5B,WAAW,GAAG,KAAK,CAAC;IAE5B,YAAY,SAAiB,EAAE,YAAoB,GAAG;QACpD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC;gBACtB,aAAa,EAAE,IAAI,CAAC,SAAS;gBAC7B,YAAY,EAAE;oBACZ,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,iBAAiB,EAAE,KAAK;iBACzB;gBACD,QAAQ,EAAE,EAAE;gBACZ,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,CAAC,SAAS,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,eAAe,CAAC,MAAgB;QAC9B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,WAAsB;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAG;YACb,GAAG,kBAAkB;YACrB,GAAG,IAAI,CAAC,YAAY;YACpB,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;SACvB,CAAC;QAEF,qBAAqB;QACrB,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE;YAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,CAA6E,EAAE,EAAE,CAAC,CAAC;YAClF,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC;YAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,UAAU,EAAE,CAAC,CAAC,KAAK;YACnB,MAAM,EAAE,QAAiB;SAC1B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF"}
+{"version":3,"file":"gliner.js","sourceRoot":"","sources":["../../src/engines/gliner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,MAAM,sBAAsB,CAAC;AAG3C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,cAAc;IACd,UAAU;IACV,SAAS;IACT,eAAe;IACf,uBAAuB;IACvB,gBAAgB;IAChB,iBAAiB;CAClB,CAAC;AAEF,MAAM,kBAAkB,GAAG;IACzB,uBAAuB;IACvB,oBAAoB;IACpB,sBAAsB;IACtB,sBAAsB;IACtB,uBAAuB;IACvB,2BAA2B;IAC3B,sBAAsB;IACtB,iBAAiB;CAClB,CAAC;AAEF,MAAM,yBAAyB,GAAG,OAAO,CAAC;AAE1C,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,sBAAsB,CAAC,SAAiB;IAC/C,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,SAAiB,EAAE,QAAgB;IACtE,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE3D,IAAI,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,GAAG,GAAG,0BAA0B,SAAS,iBAAiB,QAAQ,EAAE,CAAC;IAC3E,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IAClE,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,yBAAyB,CAAC,CAAC;IAEhF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1E,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,sCAAsC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3D,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAErC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,kCAAkC,yBAAyB,IAAI,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IAC/C,MAAM,SAAS,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,yCAAyC,YAAY,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,MAAM,UAAU,GAAG,kBAAkB,CAAC;IACtC,IAAI,SAA4B,CAAC;IAEjC,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;QACrE,IAAI,MAAM,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,MAAM,qBAAqB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,mCAAmC,SAAS,YAAY,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAC3E,SAAS,EAAE,OAAO,IAAI,SACxB,EAAE,CACH,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,YAAY;IACf,KAAK,GAAQ,IAAI,CAAC;IAClB,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,YAAY,GAAa,EAAE,CAAC;IAC5B,WAAW,GAAG,KAAK,CAAC;IAE5B,YAAY,SAAiB,EAAE,YAAoB,GAAG;QACpD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC3B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAE7B,IAAI,CAAC;YACH,MAAM,iBAAiB,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACjE,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;YACrF,MAAM,EAAE,MAAM,EAAE,GAAG,YAAY,CAAC;YAChC,IAAI,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC;gBACtB,aAAa,EAAE,IAAI,CAAC,SAAS;gBAC7B,YAAY,EAAE;oBACZ,SAAS,EAAE,iBAAiB;oBAC5B,iBAAiB,EAAE,KAAK;iBACzB;gBACD,QAAQ,EAAE,EAAE;gBACZ,SAAS,EAAE,QAAQ;aACpB,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;YAC9B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,sCAAsC,IAAI,CAAC,SAAS,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC7G,CAAC;QACJ,CAAC;IACH,CAAC;IAED,eAAe,CAAC,MAAgB;QAC9B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,WAAsB;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,MAAM,GAAG;YACb,GAAG,kBAAkB;YACrB,GAAG,IAAI,CAAC,YAAY;YACpB,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC;SACvB,CAAC;QAEF,qBAAqB;QACrB,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,YAAY,EAAE;YAC7D,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QAEH,OAAO,OAAO,CAAC,GAAG,CAChB,CAAC,CAA6E,EAAE,EAAE,CAAC,CAAC;YAClF,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC;YAC7B,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,UAAU,EAAE,CAAC,CAAC,KAAK;YACnB,MAAM,EAAE,QAAiB;SAC1B,CAAC,CACH,CAAC;IACJ,CAAC;IAED,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;CACF"}

package/docs/plans/active/2026-02-17-feat-release-fogclaw-via-datafog-package-plan.md

@@ -25,7 +25,10 @@ Users should be able to install and use FogClaw today from a DataFog-owned names
 - [x] (2026-02-17T18:54:00Z) P3 [M1] Updated `package-lock` metadata and refreshed scope for build/release artifacts.
 - [x] (2026-02-17T18:55:00Z) P4 [M2] Re-ran build/test/smoke + `npm pack --json` + `npm publish --dry-run` validations.
 - [x] (2026-02-17T18:56:00Z) P5 [M2] Verified `openclaw plugins install` against the built `datafog-fogclaw-0.1.0.tgz` in a clean runtime; plugin now loads as `fogclaw` with status `loaded` and tools `fogclaw_scan, fogclaw_redact`.
-- [ ] (2026-02-17T18:56:00Z) P5 [M2] Verify `openclaw plugins install @datafog/fogclaw` with live npm resolution (blocked until package is published).
+- [ ] (2026-02-17T19:34:00Z) P5 [M2] Verify `openclaw plugins install @datafog/fogclaw` with live npm resolution (blocked until package is published).
+- [x] (2026-02-17T19:27:00Z) P6 [M2] Fixed GLiNER startup blocker in Node by pinning `onnxruntime-web` to `1.21.0`, preventing `./webgpu` export resolution errors from `gliner` in OpenClaw install paths.
+- [x] (2026-02-17T19:34:00Z) P6 [M2] Added direct `sharp` dependency `0.34.5` with an override to prevent optional sharp native install failure (`sharp-darwin-arm64v8.node` missing) during OpenClaw install-time dependency bootstrap.
+- [ ] (2026-02-17T19:34:00Z) P6 [M3] Publish/ship this startup hardening update under `@datafog/fogclaw@0.1.2` after npm publish/auth is completed.
 - [ ] (2026-02-17T18:56:00Z) P6 [M3] Prepare and execute V1 publish/release of `@datafog/fogclaw` (publishing blocked by org access/2FA status in current environment).
 - [x] (2026-02-17T18:57:00Z) P7 [M3] Capture release artifacts and update evidence notes; add follow-up for dependency install blocker in OpenClaw install path.
 
@@ -47,8 +50,10 @@ Users should be able to install and use FogClaw today from a DataFog-owned names
 - Observation: `openclaw plugins install @datafog/fogclaw` still fails in this environment with `404 Not Found - GET https://registry.npmjs.org/@datafog%2ffogclaw` because the scoped package is not yet published to npm.
   Evidence: CLI output from `openclaw plugins install @datafog/fogclaw` in current machine state.
 
-- Observation: plugin loads with runtime warning about optional `sharp` optional dependency for GLiNER image ops; warning does not prevent plugin load.
-  Evidence: repeat `Cannot find module '../build/Release/sharp-darwin-arm64v8.node'` messages from `openclaw plugins install` run on clean state.
+- Observation: GLiNER startup now avoids the `onnxruntime-web/webgpu` exports failure by pinning `onnxruntime-web` to 1.21.0, which has a Node-compatible `./webgpu` export path in this runtime.
+  Evidence: local `import('onnxruntime-web/webgpu')` succeeds after dependency pin, and OpenClaw install logs no longer show the subpath exports error.
+- Observation: optional sharp runtime failures are now mitigated in clean install flows by pinning direct `sharp` 0.34.5; this removes the previously recurrent `Cannot find module '../build/Release/sharp-darwin-arm64v8.node'` warning in OpenClaw plugin install logs.
+  Evidence: `openclaw plugins install` from `datafog-fogclaw-0.1.2.tgz` clean runtime no longer emits that missing binary warning.
 
 ## Decision Log
 
@@ -79,7 +84,7 @@ Users should be able to install and use FogClaw today from a DataFog-owned names
 - `npm pack --json` and `npm publish --dry-run` now emit scoped package metadata under `@datafog/fogclaw`.
 - `openclaw plugins install` against a clean temporary state and local `datafog-fogclaw-0.1.0.tgz` now succeeds; `openclaw plugins info fogclaw` shows status `loaded` and tools `fogclaw_scan`, `fogclaw_redact`.
 - `openclaw plugins install @datafog/fogclaw` via npm registry is still blocked in this environment by publish visibility (`404 Not Found`) until release is live.
-- GLiNER/`sharp` warnings are still non-fatal during plugin registration in this environment and do not prevent plugin load.
+- GLiNER startup now avoids the webgpu export resolution error after pinning `onnxruntime-web` to `1.21.0`; remaining startup behavior in this environment is currently a fallback when model backends are unavailable, with no further webgpu/export or sharp-missing warnings after dependency pinning.
 
 
 ## Context and Orientation
@@ -249,7 +254,7 @@ Expect:
 - Scope migration evidence:
 
     package: @datafog/fogclaw
-    version: 0.1.0
+    version: 0.1.2
     `npm pkg get name` output: `"@datafog/fogclaw"`
     `npm pkg get openclaw` output:
     `{"extensions":["./dist/index.js"]}`
@@ -263,7 +268,7 @@ Expect:
     => `function fogclaw FogClaw`
 
 - Reproducibility evidence:
-  - `npm pack --json` output includes `datafog-fogclaw-0.1.0.tgz` and `openclaw.plugin.json`/`dist/index.js` in file list.
+  - `npm pack --json` output includes `datafog-fogclaw-0.1.2.tgz` and `openclaw.plugin.json`/`dist/index.js` in file list.
   - `npm publish --dry-run` succeeded and produced scoped package manifest notice.
 
 - Installability evidence:
@@ -302,7 +307,7 @@ Expect:
 - date: 2026-02-17T19:08:00Z
 - open findings by priority (if any): pending
 - evidence:
-  - installability in clean runtime succeeds for local `datafog-fogclaw-0.1.0.tgz` after tool-name registration fix
+  - installability in clean runtime succeeds for local `datafog-fogclaw-0.1.2.tgz` after tool-name registration and dependency-hardening fixes
   - scoped package install still returns registry 404 (not yet published)
 - rollback: revert to previous working scoped package state (or keep changes in branch) if publish credentials/visibility unavailable
 - post-release checks:
@@ -316,3 +321,4 @@ Expect:
 - 2026-02-17T10:57:00Z: Initialized plan for V1 scoped-release path in `@datafog/fogclaw` and documented zero-logic-change constraints for immediate installability milestone.
 - 2026-02-17T18:57:00Z: Completed namespace migration in package metadata and install/docs (`package.json`, `package-lock.json`, `README.md`, `docs/plugins/fogclaw.md`). Ran full local validation (`npm run build`, `npm run test`, `npm run test:plugin-smoke`, `npm pack --json`, `npm publish --dry-run`) and documented install blocker (package not yet published to npm).
 - 2026-02-17T19:08:00Z: Fixed OpenClaw compatibility in `src/index.ts` by adding explicit `name` fields to `fogclaw_scan` and `fogclaw_redact` tool registrations to avoid undefined `.trim()` during registration; verified clean-runtime install/load succeeds with local tarball (`openclaw plugins install <tgz>`, `plugins info`, `plugins list`).
+- 2026-02-17T19:34:00Z: Added explicit `sharp@0.34.5` dependency with override to avoid missing `sharp-darwin-arm64v8.node` crashes during OpenClaw dependency bootstrap; verified clean-plugin install no longer emits that optional native-module warning. Remaining GLiNER startup warnings are now backend-availability related in this environment, not sharp/webgpu export errors.

package/docs/plugins/fogclaw.md

@@ -13,6 +13,9 @@ FogClaw is an OpenClaw plugin that protects agent workflows by detecting and han
 
 It provides both proactive guardrail behavior (via the `before_agent_start` hook) and explicit tools:
 
+- GLiNER ONNX artifacts are provisioned automatically on first run (no manual `download` step required).
+- If the model cannot be downloaded (offline or restricted network), FogClaw continues in regex-only mode.
+
 - `fogclaw_scan`: scans text for PII and custom entities.
 - `fogclaw_redact`: scans and redacts sensitive matches.
 
@@ -59,6 +62,7 @@ Set plugin config under `plugins.entries.fogclaw.config`:
           enabled: true,
           guardrail_mode: "redact",
           redactStrategy: "token",
+          model: "onnx-community/gliner_large-v2.1",
           confidence_threshold: 0.5,
           custom_entities: ["project codename", "competitor name"],
           entityActions: {

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "fogclaw",
   "name": "FogClaw",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "PII detection & custom entity redaction powered by DataFog",
   "configSchema": {
     "type": "object",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datafog/fogclaw",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "OpenClaw plugin for PII detection & custom entity redaction powered by DataFog",
   "type": "module",
   "main": "dist/index.js",
@@ -14,7 +14,9 @@
   },
   "dependencies": {
     "gliner": "^0.0.19",
-    "onnxruntime-node": "1.19.2"
+    "onnxruntime-node": "1.19.2",
+    "onnxruntime-web": "1.21.0",
+    "sharp": "0.34.5"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
@@ -32,6 +34,10 @@
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/datafog/fogclaw"
+    "url": "git+https://github.com/datafog/fogclaw.git"
+  },
+  "overrides": {
+    "onnxruntime-web": "1.21.0",
+    "sharp": "0.34.5"
   }
 }

package/src/engines/gliner.ts

@@ -1,3 +1,7 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { env } from "@xenova/transformers";
+
 import type { Entity } from "../types.js";
 import { canonicalType } from "../types.js";
 
@@ -12,6 +16,139 @@ const DEFAULT_NER_LABELS = [
   "passport number",
 ];
 
+const GLINER_MODEL_FILES = [
+  "onnx/model_q4f16.onnx",
+  "onnx/model_q4.onnx",
+  "onnx/model_bnb4.onnx",
+  "onnx/model_int8.onnx",
+  "onnx/model_uint8.onnx",
+  "onnx/model_quantized.onnx",
+  "onnx/model_fp16.onnx",
+  "onnx/model.onnx",
+];
+
+const MODEL_DOWNLOAD_TIMEOUT_MS = 120_000;
+
+function isLikelyLocalPath(modelPath: string): boolean {
+  const trimmed = modelPath.trim();
+  if (!trimmed) {
+    return false;
+  }
+
+  const lower = trimmed.toLowerCase();
+  const hasExtension = [".onnx", ".ort", ".bin"].some((ext) => lower.endsWith(ext));
+  if (hasExtension) {
+    return true;
+  }
+
+  if (trimmed.startsWith(".") || path.isAbsolute(trimmed)) {
+    return true;
+  }
+
+  return false;
+}
+
+function toAbsolutePath(value: string): string {
+  return path.isAbsolute(value) ? value : path.resolve(process.cwd(), value);
+}
+
+function getModelCacheDir(): string {
+  return env.localModelPath ?? path.join(process.cwd(), ".cache");
+}
+
+function sanitizeModelReference(modelPath: string): string {
+  return modelPath.trim();
+}
+
+async function fileExists(filePath: string): Promise<boolean> {
+  try {
+    await fs.access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function downloadModelIfNeeded(modelRepo: string, filename: string): Promise<string> {
+  const cacheDir = getModelCacheDir();
+  const localPath = path.join(cacheDir, modelRepo, filename);
+
+  if (await fileExists(localPath)) {
+    return localPath;
+  }
+
+  const url = `https://huggingface.co/${modelRepo}/resolve/main/${filename}`;
+  const headers = new Headers();
+  const token = process.env.HF_TOKEN ?? process.env.HF_ACCESS_TOKEN;
+  if (token) {
+    headers.set("Authorization", `Bearer ${token}`);
+  }
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), MODEL_DOWNLOAD_TIMEOUT_MS);
+
+  try {
+    const response = await fetch(url, { headers, signal: controller.signal });
+    if (!response.ok) {
+      throw new Error(`Unable to download model artifact: ${response.status}`);
+    }
+
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    await fs.mkdir(path.dirname(localPath), { recursive: true });
+    await fs.writeFile(localPath, bytes);
+
+    return localPath;
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      throw new Error(`Model download timed out after ${MODEL_DOWNLOAD_TIMEOUT_MS}ms`);
+    }
+
+    throw err;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+async function resolveModelPath(modelPath: string): Promise<string> {
+  const sanitized = sanitizeModelReference(modelPath);
+  if (!sanitized) {
+    throw new Error("Model path is empty");
+  }
+
+  if (isLikelyLocalPath(sanitized)) {
+    const absolutePath = toAbsolutePath(sanitized);
+    if (!(await fileExists(absolutePath))) {
+      throw new Error(`Local GLiNER model file not found at: ${absolutePath}`);
+    }
+
+    return absolutePath;
+  }
+
+  const candidates = GLINER_MODEL_FILES;
+  let lastError: Error | undefined;
+
+  for (const filename of candidates) {
+    const localPath = path.join(getModelCacheDir(), sanitized, filename);
+    if (await fileExists(localPath)) {
+      return localPath;
+    }
+  }
+
+  for (const filename of candidates) {
+    try {
+      return await downloadModelIfNeeded(sanitized, filename);
+    } catch (err) {
+      lastError = err instanceof Error ? err : new Error(String(err));
+    }
+  }
+
+  throw new Error(
+    `Failed to resolve GLiNER model "${sanitized}". Tried ${candidates.join(", ")}: ${
+      lastError?.message ?? "unknown"
+    }`,
+  );
+}
+
 export class GlinerEngine {
   private model: any = null;
   private modelPath: string;
@@ -28,11 +165,13 @@ export class GlinerEngine {
     if (this.initialized) return;
 
     try {
-      const { Gliner } = await import("gliner");
+      const resolvedModelPath = await resolveModelPath(this.modelPath);
+      const glinerModule = await import("gliner/node").catch(async () => import("gliner"));
+      const { Gliner } = glinerModule;
       this.model = new Gliner({
         tokenizerPath: this.modelPath,
         onnxSettings: {
-          modelPath: this.modelPath,
+          modelPath: resolvedModelPath,
           executionProvider: "cpu",
         },
         maxWidth: 12,

package/tests/gliner.test.ts

@@ -1,4 +1,7 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
+import { beforeAll, beforeEach, afterAll, describe, it, expect, vi } from "vitest";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
 
 // Mock the gliner npm package so we don't need the actual 1.4GB model
 vi.mock("gliner", () => {
@@ -63,13 +66,82 @@ vi.mock("gliner", () => {
   return { Gliner: MockGliner };
 });
 
+vi.mock("gliner/node", () => {
+  class MockGliner {
+    private config: any;
+
+    constructor(config: any) {
+      this.config = config;
+    }
+
+    async initialize(): Promise<void> {
+      // No-op in mock
+    }
+
+    async inference(
+      text: string,
+      labels: string[],
+      options: { threshold: number },
+    ): Promise<Array<{ text: string; label: string; score: number; start: number; end: number }>> {
+      const results: Array<{ text: string; label: string; score: number; start: number; end: number }> = [];
+
+      const johnIndex = text.indexOf("John Smith");
+      if (johnIndex !== -1 && labels.includes("person")) {
+        results.push({
+          text: "John Smith",
+          label: "person",
+          score: 0.95,
+          start: johnIndex,
+          end: johnIndex + "John Smith".length,
+        });
+      }
+
+      const acmeIndex = text.indexOf("Acme Corp");
+      if (acmeIndex !== -1 && labels.includes("organization")) {
+        results.push({
+          text: "Acme Corp",
+          label: "organization",
+          score: 0.88,
+          start: acmeIndex,
+          end: acmeIndex + "Acme Corp".length,
+        });
+      }
+
+      const nyIndex = text.indexOf("New York");
+      if (nyIndex !== -1 && labels.includes("location")) {
+        results.push({
+          text: "New York",
+          label: "location",
+          score: 0.91,
+          start: nyIndex,
+          end: nyIndex + "New York".length,
+        });
+      }
+
+      return results;
+    }
+  }
+
+  return { Gliner: MockGliner };
+});
+
 import { GlinerEngine } from "../src/engines/gliner.js";
 
+const TEST_ONNX_MODEL_PATH = path.join(os.tmpdir(), "fogclaw-gliner-model-test.onnx");
+
+beforeAll(async () => {
+  await fs.writeFile(TEST_ONNX_MODEL_PATH, "mock-onnx-model", "utf8");
+});
+
+afterAll(async () => {
+  await fs.unlink(TEST_ONNX_MODEL_PATH).catch(() => undefined);
+});
+
 describe("GlinerEngine", () => {
   let engine: GlinerEngine;
 
   beforeEach(async () => {
-    engine = new GlinerEngine("onnx-community/gliner_small-v2.5", 0.5);
+    engine = new GlinerEngine(TEST_ONNX_MODEL_PATH, 0.5);
     await engine.initialize();
   });
 
@@ -166,7 +238,7 @@ describe("GlinerEngine", () => {
   });
 
   it("reports isInitialized correctly", async () => {
-    const freshEngine = new GlinerEngine("some-model", 0.5);
+    const freshEngine = new GlinerEngine(TEST_ONNX_MODEL_PATH, 0.5);
     expect(freshEngine.isInitialized).toBe(false);
 
     await freshEngine.initialize();

package/tests/scanner.test.ts

@@ -1,4 +1,7 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
+import { beforeAll, beforeEach, afterAll, describe, it, expect, vi } from "vitest";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
 
 // Mock the gliner npm package so we don't need the actual model
 vi.mock("gliner", () => {
@@ -43,12 +46,68 @@ vi.mock("gliner", () => {
   };
 });
 
+vi.mock("gliner/node", () => {
+  return {
+    Gliner: class MockGliner {
+      async initialize() {}
+      async inference(
+        text: string,
+        labels: string[],
+        _opts: { threshold: number },
+      ) {
+        const results: any[] = [];
+
+        // Simulate person detection for "John Smith"
+        if (text.includes("John Smith")) {
+          const idx = text.indexOf("John Smith");
+          results.push({
+            text: "John Smith",
+            label: "person",
+            score: 0.95,
+            start: idx,
+            end: idx + 10,
+          });
+        }
+
+        // Simulate organization detection for "Acme Corp"
+        if (text.includes("Acme Corp")) {
+          const idx = text.indexOf("Acme Corp");
+          results.push({
+            text: "Acme Corp",
+            label: "organization",
+            score: 0.88,
+            start: idx,
+            end: idx + 9,
+          });
+        }
+
+        // Only return results whose labels are requested
+        return results.filter((r) => labels.includes(r.label));
+      }
+    },
+  };
+});
+
 import { Scanner } from "../src/scanner.js";
 import { DEFAULT_CONFIG } from "../src/config.js";
 import type { FogClawConfig } from "../src/types.js";
 
+const TEST_ONNX_MODEL_PATH = path.join(os.tmpdir(), "fogclaw-scanner-gliner-model-test.onnx");
+
+beforeAll(async () => {
+  await fs.writeFile(TEST_ONNX_MODEL_PATH, "mock-onnx-model", "utf8");
+});
+
+afterAll(async () => {
+  await fs.unlink(TEST_ONNX_MODEL_PATH).catch(() => undefined);
+});
+
 function makeConfig(overrides: Partial<FogClawConfig> = {}): FogClawConfig {
-  return { ...DEFAULT_CONFIG, ...overrides };
+  return {
+    ...DEFAULT_CONFIG,
+    model: TEST_ONNX_MODEL_PATH,
+    ...overrides,
+  };
 }
 
 describe("Scanner", () => {