@datafog/fogclaw 0.1.5 → 0.2.0

package/dist/index.js

@@ -1,15 +1,65 @@
 import { Scanner } from "./scanner.js";
 import { redact } from "./redactor.js";
 import { loadConfig } from "./config.js";
+import { RegexEngine } from "./engines/regex.js";
+import { createToolResultHandler } from "./tool-result-handler.js";
+import { createMessageSendingHandler } from "./message-sending-handler.js";
+import { resolveAction } from "./types.js";
 export { Scanner } from "./scanner.js";
 export { redact } from "./redactor.js";
 export { loadConfig, DEFAULT_CONFIG } from "./config.js";
+function buildGuardrailPlan(entities, config) {
+    const blocked = [];
+    const warned = [];
+    const redacted = [];
+    for (const entity of entities) {
+        const action = resolveAction(entity, config);
+        if (action === "block")
+            blocked.push(entity);
+        else if (action === "warn")
+            warned.push(entity);
+        else
+            redacted.push(entity);
+    }
+    return { blocked, warned, redacted };
+}
+function planToSummary(plan) {
+    return {
+        total: plan.blocked.length + plan.warned.length + plan.redacted.length,
+        blocked: plan.blocked.length,
+        warned: plan.warned.length,
+        redacted: plan.redacted.length,
+        labels: {
+            blocked: [...new Set(plan.blocked.map((entity) => entity.label))],
+            warned: [...new Set(plan.warned.map((entity) => entity.label))],
+            redacted: [...new Set(plan.redacted.map((entity) => entity.label))],
+        },
+    };
+}
+function buildGuardrailContext(plan, config) {
+    const contextParts = [];
+    if (plan.blocked.length > 0) {
+        const types = [...new Set(plan.blocked.map((entity) => entity.label))].join(", ");
+        contextParts.push(`[FOGCLAW GUARDRAIL — BLOCKED] The user's message contains sensitive information (${types}). ` +
+            `Do NOT process or repeat this information. Ask the user to rephrase without sensitive data.`);
+    }
+    if (plan.warned.length > 0) {
+        const types = [...new Set(plan.warned.map((entity) => entity.label))].join(", ");
+        contextParts.push(`[FOGCLAW NOTICE] PII detected in user message: ${types}. Handle with care.`);
+    }
+    if (plan.redacted.length > 0) {
+        const labels = [...new Set(plan.redacted.map((entity) => entity.label))].join(", ");
+        contextParts.push(`[FOGCLAW REDACTED] ${plan.redacted.length} entity(ies) prepared for ${config.redactStrategy} redaction (${labels}).`);
+    }
+    return contextParts;
+}
 /**
  * OpenClaw plugin definition.
  *
  * Registers:
  * - `before_agent_start` hook for automatic PII guardrail
  * - `fogclaw_scan` tool for on-demand entity detection
+ * - `fogclaw_preview` tool for dry-run policy simulation
  * - `fogclaw_redact` tool for on-demand redaction
  */
 const fogclaw = {
@@ -36,40 +86,35 @@ const fogclaw = {
             const result = await scanner.scan(message);
             if (result.entities.length === 0)
                 return;
-            // Classify entities by their configured action
-            const blocked = [];
-            const warned = [];
-            const toRedact = [];
-            for (const entity of result.entities) {
-                const action = config.entityActions[entity.label] ?? config.guardrail_mode;
-                if (action === "block")
-                    blocked.push(entity);
-                else if (action === "warn")
-                    warned.push(entity);
-                else if (action === "redact")
-                    toRedact.push(entity);
+            const plan = buildGuardrailPlan(result.entities, config);
+            const contextParts = buildGuardrailContext(plan, config);
+            if (config.auditEnabled) {
+                const summary = planToSummary(plan);
+                api.logger?.info(`[FOGCLAW AUDIT] guardrail_scan ${JSON.stringify({
+                    totalEntities: summary.total,
+                    blocked: summary.blocked,
+                    warned: summary.warned,
+                    redacted: summary.redacted,
+                    blockedLabels: summary.labels.blocked,
+                    warnedLabels: summary.labels.warned,
+                    redactedLabels: summary.labels.redacted,
+                })}`);
             }
-            const contextParts = [];
-            // "block" — inject a strong instruction to refuse
-            if (blocked.length > 0) {
-                const types = [...new Set(blocked.map((e) => e.label))].join(", ");
-                contextParts.push(`[FOGCLAW GUARDRAIL — BLOCKED] The user's message contains sensitive information (${types}). ` +
-                    `Do NOT process or repeat this information. Ask the user to rephrase without sensitive data.`);
-            }
-            // "warn" — inject a warning notice
-            if (warned.length > 0) {
-                const types = [...new Set(warned.map((e) => e.label))].join(", ");
-                contextParts.push(`[FOGCLAW NOTICE] PII detected in user message: ${types}. Handle with care.`);
-            }
-            // "redact" — replace PII with tokens
-            if (toRedact.length > 0) {
-                const redacted = redact(message, toRedact, config.redactStrategy);
-                contextParts.push(`[FOGCLAW REDACTED] The following is the user's message with PII redacted:\n${redacted.redacted_text}`);
+            if (plan.redacted.length > 0) {
+                const redactedResult = redact(message, plan.redacted, config.redactStrategy);
+                contextParts.push(`[FOGCLAW REDACTED] The following is the user's message with PII redacted:\n${redactedResult.redacted_text}`);
             }
             if (contextParts.length > 0) {
                 return { prependContext: contextParts.join("\n\n") };
             }
         });
+        // --- HOOK: Scan tool results for PII before persistence ---
+        const toolResultRegex = new RegexEngine();
+        const toolResultHandler = createToolResultHandler(config, toolResultRegex, api.logger);
+        api.on("tool_result_persist", toolResultHandler);
+        // --- HOOK: Scan outbound messages for PII before delivery ---
+        const messageSendingHandler = createMessageSendingHandler(config, scanner, api.logger);
+        api.on("message_sending", messageSendingHandler);
         // --- TOOL: On-demand scan ---
         api.registerTool({
             name: "fogclaw_scan",
@@ -100,7 +145,7 @@ const fogclaw = {
                                 entities: result.entities,
                                 count: result.entities.length,
                                 summary: result.entities.length > 0
-                                    ? `Found ${result.entities.length} entities: ${[...new Set(result.entities.map((e) => e.label))].join(", ")}`
+                                    ? `Found ${result.entities.length} entities: ${[...new Set(result.entities.map((entity) => entity.label))].join(", ")}`
                                     : "No entities detected",
                             }, null, 2),
                         },
@@ -108,6 +153,66 @@ const fogclaw = {
                 };
             },
         });
+        // --- TOOL: Policy preview ---
+        api.registerTool({
+            name: "fogclaw_preview",
+            id: "fogclaw_preview",
+            description: "Preview which entities will be blocked, warned, or redacted and the redacted message, without changing runtime behavior.",
+            schema: {
+                type: "object",
+                properties: {
+                    text: {
+                        type: "string",
+                        description: "Text to run through FogClaw policy preview",
+                    },
+                    strategy: {
+                        type: "string",
+                        description: 'Override redaction strategy for the preview: "token" ([EMAIL_1]), "mask" (****), or "hash" ([EMAIL_a1b2c3...]).',
+                        enum: ["token", "mask", "hash"],
+                    },
+                    custom_labels: {
+                        type: "array",
+                        items: { type: "string" },
+                        description: "Additional entity labels for zero-shot detection",
+                    },
+                },
+                required: ["text"],
+            },
+            handler: async ({ text, strategy, custom_labels, }) => {
+                const result = await scanner.scan(text, custom_labels);
+                const plan = buildGuardrailPlan(result.entities, config);
+                const summary = planToSummary(plan);
+                const redacted = redact(text, plan.redacted, strategy ?? config.redactStrategy);
+                return {
+                    content: [
+                        {
+                            type: "text",
+                            text: JSON.stringify({
+                                entities: result.entities,
+                                totalEntities: summary.total,
+                                actionPlan: {
+                                    blocked: {
+                                        count: summary.blocked,
+                                        labels: summary.labels.blocked,
+                                    },
+                                    warned: {
+                                        count: summary.warned,
+                                        labels: summary.labels.warned,
+                                    },
+                                    redacted: {
+                                        count: summary.redacted,
+                                        labels: summary.labels.redacted,
+                                    },
+                                },
+                                redactedText: redacted.redacted_text,
+                                redactionStrategy: strategy ?? config.redactStrategy,
+                                mapping: redacted.mapping,
+                            }, null, 2),
+                        },
+                    ],
+                };
+            },
+        });
         // --- TOOL: On-demand redact ---
         api.registerTool({
             name: "fogclaw_redact",
@@ -150,7 +255,7 @@ const fogclaw = {
                 };
             },
         });
-        api.logger?.info(`[fogclaw] Plugin registered — guardrail: ${config.guardrail_mode}, model: ${config.model}, custom entities: ${config.custom_entities.length}`);
+        api.logger?.info(`[fogclaw] Plugin registered — guardrail: ${config.guardrail_mode}, model: ${config.model}, custom entities: ${config.custom_entities.length}, audit: ${config.auditEnabled}`);
     },
 };
 export default fogclaw;

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAUzD;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG;IACd,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,SAAS;IAEf,QAAQ,CAAC,GAAQ;QACf,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAErC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,iEAAiE;QACjE,iDAAiD;QACjD,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC1C,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,4CAA4C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QAEH,+CAA+C;QAC/C,GAAG,CAAC,EAAE,CAAC,oBAAoB,EAAE,KAAK,EAAE,KAAU,EAAE,EAAE;YAChD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO;gBAAE,OAAO;YAErB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAE3C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAEzC,+CAA+C;YAC/C,MAAM,OAAO,GAA2B,EAAE,CAAC;YAC3C,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAA2B,EAAE,CAAC;YAE5C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrC,MAAM,MAAM,GACV,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC;gBAC9D,IAAI,MAAM,KAAK,OAAO;oBAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;qBACxC,IAAI,MAAM,KAAK,MAAM;oBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;qBAC3C,IAAI,MAAM,KAAK,QAAQ;oBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtD,CAAC;YAED,MAAM,YAAY,GAAa,EAAE,CAAC;YAElC,kDAAkD;YAClD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnE,YAAY,CAAC,IAAI,CACf,oFAAoF,KAAK,KAAK;oBAC9F,6FAA6F,CAC9F,CAAC;YACJ,CAAC;YAED,mCAAmC;YACnC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAClE,YAAY,CAAC,IAAI,CACf,kDAAkD,KAAK,qBAAqB,CAC7E,CAAC;YACJ,CAAC;YAED,qCAAqC;YACrC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBAClE,YAAY,CAAC,IAAI,CACf,8EAA8E,QAAQ,CAAC,aAAa,EAAE,CACvG,CAAC;YACJ,CAAC;YAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,+BAA+B;QAC/B,GAAG,CAAC,YAAY,CACd;YACE,IAAI,EAAE,cAAc;YACpB,EAAE,EAAE,cAAc;YAClB,WAAW,EACT,gHAAgH;YAClH,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE;wBACJ,IAAI,EAAE,QAAQ;wBACd,WAAW,EAAE,2BAA2B;qBACzC;oBACD,aAAa,EAAE;wBACb,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,WAAW,EACT,kGAAkG;qBACrG;iBACF;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;YACD,OAAO,EAAE,KAAK,EAAE,EACd,IAAI,EACJ,aAAa,GAId,EAAE,EAAE;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBACvD,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;gCACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gCACzB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gCAC7B,OAAO,EACL,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;oCACxB,CAAC,CAAC,SAAS,MAAM,CAAC,QAAQ,CAAC,MAAM,cAAc,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oCAC7G,CAAC,CAAC,sBAAsB;6BAC7B,EACD,IAAI,EACJ,CAAC,CACF;yBACF;qBACF;iBACF,CAAC;YACJ,CAAC;SACF,CACF,CAAC;QAEF,iCAAiC;QACjC,GAAG,CAAC,YAAY,CACd;YACE,IAAI,EAAE,gBAAgB;YACtB,EAAE,EAAE,gBAAgB;YACpB,WAAW,EACT,+FAA+F;YACjG,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE;wBACJ,IAAI,EAAE,QAAQ;wBACd,WAAW,EAAE,yBAAyB;qBACvC;oBACD,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,WAAW,EACT,uFAAuF;wBACzF,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;qBAChC;oBACD,aAAa,EAAE;wBACb,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,WAAW,EAAE,kDAAkD;qBAChE;iBACF;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;YACD,OAAO,EAAE,KAAK,EAAE,EACd,IAAI,EACJ,QAAQ,EACR,aAAa,GAKd,EAAE,EAAE;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBACvD,MAAM,QAAQ,GAAG,MAAM,CACrB,IAAI,EACJ,MAAM,CAAC,QAAQ,EACf,QAAQ,IAAI,MAAM,CAAC,cAAc,CAClC,CAAC;gBACF,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;gCACE,aAAa,EAAE,QAAQ,CAAC,aAAa;gCACrC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gCACtC,OAAO,EAAE,QAAQ,CAAC,OAAO;6BAC1B,EACD,IAAI,EACJ,CAAC,CACF;yBACF;qBACF;iBACF,CAAC;YACJ,CAAC;SACF,CACF,CAAC;QAEF,GAAG,CAAC,MAAM,EAAE,IAAI,CACd,4CAA4C,MAAM,CAAC,cAAc,YAAY,MAAM,CAAC,KAAK,sBAAsB,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,CAC/I,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,OAAO,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAU3C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAUzD,SAAS,kBAAkB,CAAC,QAAkB,EAAE,MAAqB;IACnE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,MAAM,KAAK,OAAO;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;aACxC,IAAI,MAAM,KAAK,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;;YAC3C,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,aAAa,CAAC,IAA2C;IAWhE,OAAO;QACL,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM;QACtE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;QAC5B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;QAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;QAC9B,MAAM,EAAE;YACN,OAAO,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YACjE,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/D,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;SACpE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,IAA2C,EAAE,MAAqB;IAC/F,MAAM,YAAY,GAAa,EAAE,CAAC;IAElC,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClF,YAAY,CAAC,IAAI,CACf,oFAAoF,KAAK,KAAK;YAC5F,6FAA6F,CAChG,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,YAAY,CAAC,IAAI,CACf,kDAAkD,KAAK,qBAAqB,CAC7E,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,YAAY,CAAC,IAAI,CACf,sBAAsB,IAAI,CAAC,QAAQ,CAAC,MAAM,6BAA6B,MAAM,CAAC,cAAc,eAAe,MAAM,IAAI,CACtH,CAAC;IACJ,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG;IACd,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,SAAS;IAEf,QAAQ,CAAC,GAAQ;QACf,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAErC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,sCAAsC,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACpC,iEAAiE;QACjE,iDAAiD;QACjD,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YAC1C,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,4CAA4C,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QAEH,+CAA+C;QAC/C,GAAG,CAAC,EAAE,CAAC,oBAAoB,EAAE,KAAK,EAAE,KAAU,EAAE,EAAE;YAChD,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO;gBAAE,OAAO;YAErB,MAAM,MAAM,GAAe,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YAEzC,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACzD,MAAM,YAAY,GAAG,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAEzD,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;gBACpC,GAAG,CAAC,MAAM,EAAE,IAAI,CACd,kCAAkC,IAAI,CAAC,SAAS,CAAC;oBAC/C,aAAa,EAAE,OAAO,CAAC,KAAK;oBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;oBACrC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;oBACnC,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;iBACxC,CAAC,EAAE,CACL,CAAC;YACJ,CAAC;YAED,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,cAAc,GAAiB,MAAM,CACzC,OAAO,EACP,IAAI,CAAC,QAAQ,EACb,MAAM,CAAC,cAAc,CACtB,CAAC;gBACF,YAAY,CAAC,IAAI,CACf,8EAA8E,cAAc,CAAC,aAAa,EAAE,CAC7G,CAAC;YACJ,CAAC;YAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,EAAE,cAAc,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,6DAA6D;QAC7D,MAAM,eAAe,GAAG,IAAI,WAAW,EAAE,CAAC;QAC1C,MAAM,iBAAiB,GAAG,uBAAuB,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACvF,GAAG,CAAC,EAAE,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,CAAC;QAEjD,+DAA+D;QAC/D,MAAM,qBAAqB,GAAG,2BAA2B,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QACvF,GAAG,CAAC,EAAE,CAAC,iBAAiB,EAAE,qBAAqB,CAAC,CAAC;QAEjD,+BAA+B;QAC/B,GAAG,CAAC,YAAY,CACd;YACE,IAAI,EAAE,cAAc;YACpB,EAAE,EAAE,cAAc;YAClB,WAAW,EACT,gHAAgH;YAClH,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE;wBACJ,IAAI,EAAE,QAAQ;wBACd,WAAW,EAAE,2BAA2B;qBACzC;oBACD,aAAa,EAAE;wBACb,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,WAAW,EACT,kGAAkG;qBACrG;iBACF;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;YACD,OAAO,EAAE,KAAK,EAAE,EACd,IAAI,EACJ,aAAa,GAId,EAAE,EAAE;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBACvD,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;gCACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gCACzB,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gCAC7B,OAAO,EACL,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;oCACxB,CAAC,CAAC,SAAS,MAAM,CAAC,QAAQ,CAAC,MAAM,cAAc,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;oCACvH,CAAC,CAAC,sBAAsB;6BAC7B,EACD,IAAI,EACJ,CAAC,CACF;yBACF;qBACF;iBACF,CAAC;YACJ,CAAC;SACF,CACF,CAAC;QAEF,+BAA+B;QAC/B,GAAG,CAAC,YAAY,CACd;YACE,IAAI,EAAE,iBAAiB;YACvB,EAAE,EAAE,iBAAiB;YACrB,WAAW,EACT,0HAA0H;YAC5H,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE;wBACJ,IAAI,EAAE,QAAQ;wBACd,WAAW,EAAE,4CAA4C;qBAC1D;oBACD,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,WAAW,EACT,iHAAiH;wBACnH,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;qBAChC;oBACD,aAAa,EAAE;wBACb,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,WAAW,EAAE,kDAAkD;qBAChE;iBACF;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;YACD,OAAO,EAAE,KAAK,EAAE,EACd,IAAI,EACJ,QAAQ,EACR,aAAa,GAKd,EAAE,EAAE;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACzD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;gBACpC,MAAM,QAAQ,GAAG,MAAM,CACrB,IAAI,EACJ,IAAI,CAAC,QAAQ,EACb,QAAQ,IAAI,MAAM,CAAC,cAAc,CAClC,CAAC;gBAEF,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;gCACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gCACzB,aAAa,EAAE,OAAO,CAAC,KAAK;gCAC5B,UAAU,EAAE;oCACV,OAAO,EAAE;wCACP,KAAK,EAAE,OAAO,CAAC,OAAO;wCACtB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;qCAC/B;oCACD,MAAM,EAAE;wCACN,KAAK,EAAE,OAAO,CAAC,MAAM;wCACrB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM;qCAC9B;oCACD,QAAQ,EAAE;wCACR,KAAK,EAAE,OAAO,CAAC,QAAQ;wCACvB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ;qCAChC;iCACF;gCACD,YAAY,EAAE,QAAQ,CAAC,aAAa;gCACpC,iBAAiB,EAAE,QAAQ,IAAI,MAAM,CAAC,cAAc;gCACpD,OAAO,EAAE,QAAQ,CAAC,OAAO;6BAC1B,EACD,IAAI,EACJ,CAAC,CACF;yBACF;qBACF;iBACF,CAAC;YACJ,CAAC;SACF,CACF,CAAC;QAEF,iCAAiC;QACjC,GAAG,CAAC,YAAY,CACd;YACE,IAAI,EAAE,gBAAgB;YACtB,EAAE,EAAE,gBAAgB;YACpB,WAAW,EACT,+FAA+F;YACjG,MAAM,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,IAAI,EAAE;wBACJ,IAAI,EAAE,QAAQ;wBACd,WAAW,EAAE,yBAAyB;qBACvC;oBACD,QAAQ,EAAE;wBACR,IAAI,EAAE,QAAQ;wBACd,WAAW,EACT,uFAAuF;wBACzF,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC;qBAChC;oBACD,aAAa,EAAE;wBACb,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;wBACzB,WAAW,EAAE,kDAAkD;qBAChE;iBACF;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;aACnB;YACD,OAAO,EAAE,KAAK,EAAE,EACd,IAAI,EACJ,QAAQ,EACR,aAAa,GAKd,EAAE,EAAE;gBACH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;gBACvD,MAAM,QAAQ,GAAG,MAAM,CACrB,IAAI,EACJ,MAAM,CAAC,QAAQ,EACf,QAAQ,IAAI,MAAM,CAAC,cAAc,CAClC,CAAC;gBACF,OAAO;oBACL,OAAO,EAAE;wBACP;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAClB;gCACE,aAAa,EAAE,QAAQ,CAAC,aAAa;gCACrC,cAAc,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM;gCACtC,OAAO,EAAE,QAAQ,CAAC,OAAO;6BAC1B,EACD,IAAI,EACJ,CAAC,CACF;yBACF;qBACF;iBACF,CAAC;YACJ,CAAC;SACF,CACF,CAAC;QAEF,GAAG,CAAC,MAAM,EAAE,IAAI,CACd,4CAA4C,MAAM,CAAC,cAAc,YAAY,MAAM,CAAC,KAAK,sBAAsB,MAAM,CAAC,eAAe,CAAC,MAAM,YAAY,MAAM,CAAC,YAAY,EAAE,CAC9K,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,eAAe,OAAO,CAAC"}

package/dist/message-sending-handler.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Async message_sending hook handler for FogClaw.
+ *
+ * Scans outbound message text for PII using the full Scanner
+ * (regex + GLiNER), redacts detected entities, and returns
+ * modified content. Never cancels message delivery.
+ *
+ * Note: message_sending is defined in OpenClaw but not yet invoked
+ * upstream. This handler activates automatically when wired.
+ */
+import type { Scanner } from "./scanner.js";
+import type { FogClawConfig } from "./types.js";
+interface Logger {
+    info(msg: string): void;
+    warn(msg: string): void;
+}
+export interface MessageSendingEvent {
+    to: string;
+    content: string;
+    metadata?: Record<string, unknown>;
+}
+export interface MessageSendingContext {
+    channelId: string;
+    accountId?: string;
+    conversationId?: string;
+}
+export interface MessageSendingResult {
+    content?: string;
+    cancel?: boolean;
+}
+/**
+ * Create an async message_sending hook handler.
+ *
+ * Uses the full Scanner (regex + GLiNER) since this hook supports
+ * async handlers. All guardrail modes produce span-level redaction;
+ * cancel is never returned.
+ */
+export declare function createMessageSendingHandler(config: FogClawConfig, scanner: Scanner, logger?: Logger): (event: MessageSendingEvent, ctx: MessageSendingContext) => Promise<MessageSendingResult | void>;
+export {};
+//# sourceMappingURL=message-sending-handler.d.ts.map

package/dist/message-sending-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-sending-handler.d.ts","sourceRoot":"","sources":["../src/message-sending-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAG5C,OAAO,KAAK,EAAU,aAAa,EAAE,MAAM,YAAY,CAAC;AAExD,UAAU,MAAM;IACd,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,MAAM,GACd,CAAC,KAAK,EAAE,mBAAmB,EAAE,GAAG,EAAE,qBAAqB,KAAK,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAqClG"}

package/dist/message-sending-handler.js

@@ -0,0 +1,50 @@
+/**
+ * Async message_sending hook handler for FogClaw.
+ *
+ * Scans outbound message text for PII using the full Scanner
+ * (regex + GLiNER), redacts detected entities, and returns
+ * modified content. Never cancels message delivery.
+ *
+ * Note: message_sending is defined in OpenClaw but not yet invoked
+ * upstream. This handler activates automatically when wired.
+ */
+import { redact } from "./redactor.js";
+import { resolveAction } from "./types.js";
+/**
+ * Create an async message_sending hook handler.
+ *
+ * Uses the full Scanner (regex + GLiNER) since this hook supports
+ * async handlers. All guardrail modes produce span-level redaction;
+ * cancel is never returned.
+ */
+export function createMessageSendingHandler(config, scanner, logger) {
+    return async (event, _ctx) => {
+        const text = event.content;
+        if (!text)
+            return;
+        const result = await scanner.scan(text);
+        if (result.entities.length === 0)
+            return;
+        // All modes produce span-level redaction for outbound messages.
+        const actionableEntities = result.entities.filter((entity) => {
+            const action = resolveAction(entity, config);
+            return action === "redact" || action === "block" || action === "warn";
+        });
+        if (actionableEntities.length === 0)
+            return;
+        const redacted = redact(text, actionableEntities, config.redactStrategy);
+        // Audit logging
+        if (config.auditEnabled && logger) {
+            const labels = [...new Set(actionableEntities.map((e) => e.label))];
+            logger.info(`[FOGCLAW AUDIT] outbound_scan ${JSON.stringify({
+                totalEntities: actionableEntities.length,
+                labels,
+                channelId: _ctx.channelId ?? null,
+                source: "outbound",
+            })}`);
+        }
+        // Never cancel — always deliver the redacted version.
+        return { content: redacted.redacted_text };
+    };
+}
+//# sourceMappingURL=message-sending-handler.js.map

package/dist/message-sending-handler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message-sending-handler.js","sourceRoot":"","sources":["../src/message-sending-handler.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAyB3C;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAqB,EACrB,OAAgB,EAChB,MAAe;IAEf,OAAO,KAAK,EACV,KAA0B,EAC1B,IAA2B,EACW,EAAE;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC;QAC3B,IAAI,CAAC,IAAI;YAAE,OAAO;QAElB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAEzC,gEAAgE;QAChE,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;YAC3D,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,MAAM,CAAC;QACxE,CAAC,CAAC,CAAC;QAEH,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAE5C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAEzE,gBAAgB;QAChB,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;YAClC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACpE,MAAM,CAAC,IAAI,CACT,iCAAiC,IAAI,CAAC,SAAS,CAAC;gBAC9C,aAAa,EAAE,kBAAkB,CAAC,MAAM;gBACxC,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;gBACjC,MAAM,EAAE,UAAU;aACnB,CAAC,EAAE,CACL,CAAC;QACJ,CAAC;QAED,sDAAsD;QACtD,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC7C,CAAC,CAAC;AACJ,CAAC"}

package/dist/scanner.d.ts

@@ -1,11 +1,22 @@
-import type { FogClawConfig, ScanResult } from "./types.js";
+import type { Entity, FogClawConfig } from "./types.js";
 export declare class Scanner {
     private regexEngine;
     private glinerEngine;
     private glinerAvailable;
     private config;
+    private allowlist;
     constructor(config: FogClawConfig);
     initialize(): Promise<void>;
-    scan(text: string, extraLabels?: string[]): Promise<ScanResult>;
+    scan(text: string, extraLabels?: string[]): Promise<{
+        entities: Entity[];
+        text: string;
+    }>;
+    private filterByConfidence;
+    private filterByPolicy;
+    private shouldAllowlistEntity;
+    private getThresholdForLabel;
+    private computeGlinerThreshold;
+    private buildAllowlistCache;
+    get isGlinerAvailable(): boolean;
 }
 //# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAU,aAAa,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAIpE,qBAAa,OAAO;IAClB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,MAAM,CAAgB;gBAElB,MAAM,EAAE,aAAa;IAY3B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAY3B,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;CAqBtE"}
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAuBxD,qBAAa,OAAO;IAClB,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,SAAS,CAAwB;gBAE7B,MAAM,EAAE,aAAa;IAa3B,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAY3B,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IA4B/F,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,qBAAqB;IAmB7B,OAAO,CAAC,oBAAoB;IAK5B,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,mBAAmB;IAuB3B,IAAI,iBAAiB,IAAI,OAAO,CAE/B;CACF"}

package/dist/scanner.js

@@ -1,17 +1,30 @@
+import { canonicalType } from "./types.js";
 import { RegexEngine } from "./engines/regex.js";
 import { GlinerEngine } from "./engines/gliner.js";
+function normalizeAllowlistValue(value) {
+    return value.trim().toLowerCase();
+}
+function buildPatternMaps(value) {
+    if (!value || value.length === 0) {
+        return [];
+    }
+    return value.map((pattern) => new RegExp(pattern, "i"));
+}
 export class Scanner {
     regexEngine;
     glinerEngine;
     glinerAvailable = false;
     config;
+    allowlist;
     constructor(config) {
         this.config = config;
         this.regexEngine = new RegexEngine();
-        this.glinerEngine = new GlinerEngine(config.model, config.confidence_threshold);
+        const glinerThreshold = this.computeGlinerThreshold(config);
+        this.glinerEngine = new GlinerEngine(config.model, glinerThreshold);
         if (config.custom_entities.length > 0) {
             this.glinerEngine.setCustomLabels(config.custom_entities);
         }
+        this.allowlist = this.buildAllowlistCache(config.allowlist);
     }
     async initialize() {
         try {
@@ -27,12 +40,14 @@ export class Scanner {
         if (!text)
             return { entities: [], text };
         // Step 1: Regex pass (always runs, synchronous)
-        const regexEntities = this.regexEngine.scan(text);
+        const regexEntities = this.filterByPolicy(this.regexEngine.scan(text));
         // Step 2: GLiNER pass (if available)
         let glinerEntities = [];
         if (this.glinerAvailable) {
             try {
                 glinerEntities = await this.glinerEngine.scan(text, extraLabels);
+                glinerEntities = this.filterByConfidence(glinerEntities);
+                glinerEntities = this.filterByPolicy(glinerEntities);
             }
             catch (err) {
                 console.warn(`[fogclaw] GLiNER scan failed, using regex results only: ${err instanceof Error ? err.message : String(err)}`);
@@ -42,6 +57,65 @@ export class Scanner {
         const merged = deduplicateEntities([...regexEntities, ...glinerEntities]);
         return { entities: merged, text };
     }
+    filterByConfidence(entities) {
+        return entities.filter((entity) => {
+            const threshold = this.getThresholdForLabel(entity.label);
+            return entity.confidence >= threshold;
+        });
+    }
+    filterByPolicy(entities) {
+        if (this.allowlist.values.size === 0 &&
+            this.allowlist.patterns.length === 0 &&
+            this.allowlist.entityValues.size === 0) {
+            return entities;
+        }
+        return entities.filter((entity) => !this.shouldAllowlistEntity(entity));
+    }
+    shouldAllowlistEntity(entity) {
+        const normalizedText = normalizeAllowlistValue(entity.text);
+        if (this.allowlist.values.has(normalizedText)) {
+            return true;
+        }
+        if (this.allowlist.patterns.some((pattern) => pattern.test(entity.text))) {
+            return true;
+        }
+        const entityValues = this.allowlist.entityValues.get(entity.label);
+        if (entityValues && entityValues.has(normalizedText)) {
+            return true;
+        }
+        return false;
+    }
+    getThresholdForLabel(label) {
+        const canonicalLabel = canonicalType(label);
+        return this.config.entityConfidenceThresholds[canonicalLabel] ?? this.config.confidence_threshold;
+    }
+    computeGlinerThreshold(config) {
+        const thresholds = Object.values(config.entityConfidenceThresholds);
+        if (thresholds.length === 0) {
+            return config.confidence_threshold;
+        }
+        return Math.min(config.confidence_threshold, ...thresholds);
+    }
+    buildAllowlistCache(allowlist) {
+        const globalValues = new Set(allowlist.values.map((value) => normalizeAllowlistValue(value)));
+        const globalPatterns = buildPatternMaps(allowlist.patterns);
+        const entityValues = new Map();
+        for (const [entityType, values] of Object.entries(allowlist.entities)) {
+            const canonical = canonicalType(entityType);
+            const uniqueValues = values
+                .map((value) => normalizeAllowlistValue(value))
+                .filter((value) => value.length > 0);
+            entityValues.set(canonical, new Set(uniqueValues));
+        }
+        return {
+            values: globalValues,
+            patterns: globalPatterns,
+            entityValues,
+        };
+    }
+    get isGlinerAvailable() {
+        return this.glinerAvailable;
+    }
 }
 /**
  * Remove overlapping entity spans. When two entities overlap,

package/dist/scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,MAAM,OAAO,OAAO;IACV,WAAW,CAAc;IACzB,YAAY,CAAe;IAC3B,eAAe,GAAG,KAAK,CAAC;IACxB,MAAM,CAAgB;IAE9B,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,MAAM,CAAC,KAAK,EACZ,MAAM,CAAC,oBAAoB,CAC5B,CAAC;QACF,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,2EAA2E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9H,CAAC;YACF,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,WAAsB;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAEzC,gDAAgD;QAChD,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElD,qCAAqC;QACrC,IAAI,cAAc,GAAa,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;YACnE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,2DAA2D,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9H,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;QAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,QAAkB;IAC7C,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1C,wDAAwD;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACzC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAClD,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEvC,oBAAoB;QACpB,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,mEAAmE;YACnE,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;YACtC,CAAC;YACD,0CAA0C;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAQnD,SAAS,uBAAuB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAA2B;IACnD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,OAAO,OAAO;IACV,WAAW,CAAc;IACzB,YAAY,CAAe;IAC3B,eAAe,GAAG,KAAK,CAAC;IACxB,MAAM,CAAgB;IACtB,SAAS,CAAwB;IAEzC,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;QAErC,MAAM,eAAe,GAAG,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,IAAI,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CACV,2EAA2E,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC9H,CAAC;YACF,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,WAAsB;QAC7C,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QAEzC,gDAAgD;QAChD,MAAM,aAAa,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAEvE,qCAAqC;QACrC,IAAI,cAAc,GAAa,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;gBACjE,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBACzD,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CACV,2DACE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CACjD,EAAE,CACH,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gCAAgC;QAChC,MAAM,MAAM,GAAG,mBAAmB,CAAC,CAAC,GAAG,aAAa,EAAE,GAAG,cAAc,CAAC,CAAC,CAAC;QAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACpC,CAAC;IAEO,kBAAkB,CAAC,QAAkB;QAC3C,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;YAChC,MAAM,SAAS,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1D,OAAO,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,QAAkB;QACvC,IACE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;YAChC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YACpC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,EACtC,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,qBAAqB,CAAC,MAAc;QAC1C,MAAM,cAAc,GAAG,uBAAuB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE5D,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,IAAI,YAAY,IAAI,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,oBAAoB,CAAC,KAAa;QACxC,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;IACpG,CAAC;IAEO,sBAAsB,CAAC,MAAqB;QAClD,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACpE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,MAAM,CAAC,oBAAoB,CAAC;QACrC,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,GAAG,UAAU,CAAC,CAAC;IAC9D,CAAC;IAEO,mBAAmB,CAAC,SAAqC;QAC/D,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAChE,CAAC;QAEF,MAAM,cAAc,GAAG,gBAAgB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAE5D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;QACpD,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YACtE,MAAM,SAAS,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;YAC5C,MAAM,YAAY,GAAG,MAAM;iBACxB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;iBAC9C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACvC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;QACrD,CAAC;QAED,OAAO;YACL,MAAM,EAAE,YAAY;YACpB,QAAQ,EAAE,cAAc;YACxB,YAAY;SACb,CAAC;IACJ,CAAC;IAED,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,mBAAmB,CAAC,QAAkB;IAC7C,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1C,wDAAwD;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACzC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAClD,OAAO,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAErC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEvC,oBAAoB;QACpB,IAAI,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC7B,mEAAmE;YACnE,IAAI,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;gBACzC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;YACtC,CAAC;YACD,0CAA0C;QAC5C,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/tool-result-handler.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Synchronous tool_result_persist hook handler for FogClaw.
+ *
+ * Scans tool result text for PII using the regex engine (synchronous),
+ * redacts detected entities, and returns the transformed message.
+ * GLiNER is not used here because tool_result_persist is synchronous-only.
+ */
+import { RegexEngine } from "./engines/regex.js";
+import type { FogClawConfig } from "./types.js";
+interface Logger {
+    info(msg: string): void;
+    warn(msg: string): void;
+}
+export interface ToolResultPersistEvent {
+    toolName?: string;
+    toolCallId?: string;
+    message: unknown;
+    isSynthetic?: boolean;
+}
+export interface ToolResultPersistContext {
+    agentId?: string;
+    sessionKey?: string;
+    toolName?: string;
+    toolCallId?: string;
+}
+/**
+ * Create a synchronous tool_result_persist hook handler.
+ *
+ * The returned function must NOT return a Promise — OpenClaw rejects
+ * async tool_result_persist handlers.
+ */
+export declare function createToolResultHandler(config: FogClawConfig, regexEngine: RegexEngine, logger?: Logger): (event: ToolResultPersistEvent, ctx: ToolResultPersistContext) => {
+    message: unknown;
+} | void;
+export {};
+//# sourceMappingURL=tool-result-handler.d.ts.map

package/dist/tool-result-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-result-handler.d.ts","sourceRoot":"","sources":["../src/tool-result-handler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAIjD,OAAO,KAAK,EAAU,aAAa,EAAE,MAAM,YAAY,CAAC;AAExD,UAAU,MAAM;IACd,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AA6CD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,WAAW,EACxB,MAAM,CAAC,EAAE,MAAM,GACd,CAAC,KAAK,EAAE,sBAAsB,EAAE,GAAG,EAAE,wBAAwB,KAAK;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CA8C/F"}