@datagusto/cli 0.0.0-stage → 0.2.0

package/vendor/claude_code/.claude-plugin/plugin.json

@@ -0,0 +1,55 @@
+{
+  "name": "datagusto-safety-plugin",
+  "description": "Integrates Datagusto safety validation API with Claude Code's hook lifecycle (PreToolUse / PermissionRequest / PostToolUse / PostToolUseFailure / UserPromptSubmit / SessionStart / SessionEnd).",
+  "version": "1.0.0",
+  "author": { "name": "Datagusto" },
+  "userConfig": {
+    "server_url": {
+      "type": "string",
+      "title": "Datagusto server URL",
+      "description": "Datagusto server base URL, e.g. https://datagusto.example.com. Leave empty if you connected with `dg setup claude-code`, which writes it to claude-code.json."
+    },
+    "api_key": {
+      "type": "string",
+      "title": "Datagusto API key",
+      "description": "Bearer auth key for the Datagusto API. Leave empty if you connected with `dg setup claude-code`, which writes it to claude-code.json.",
+      "sensitive": true
+    },
+    "timeout_ms": {
+      "type": "number",
+      "title": "Request timeout (ms)",
+      "description": "Per-request timeout for Datagusto API calls.",
+      "default": 30000
+    },
+    "fail_closed": {
+      "type": "boolean",
+      "title": "Fail closed on API errors",
+      "description": "Deny/block tool execution when the API is unreachable or errors.",
+      "default": true
+    },
+    "verbose": {
+      "type": "boolean",
+      "title": "Verbose logging",
+      "description": "Per-hook debug logging to stderr.",
+      "default": false
+    },
+    "monitor_only": {
+      "type": "boolean",
+      "title": "Monitor-only mode",
+      "description": "Log decisions without enforcing them.",
+      "default": false
+    },
+    "auto_approve_vetted_permissions": {
+      "type": "boolean",
+      "title": "Auto-approve vetted permissions",
+      "description": "When Datagusto's PreToolUse check already allowed a call, auto-resolve Claude Code's own native permission dialog instead of prompting the user again. Never overrides an explicit Datagusto ask/deny. Off by default — opt in to reduce double-prompting.",
+      "default": false
+    },
+    "allow_uncategorized_tools": {
+      "type": "boolean",
+      "title": "Allow uncategorized tools",
+      "description": "The alignment layer default-denies tools its intent-judge didn't predict from the prompt. When true, that specific deny is downgraded to allow if the assigned guardrail rules also allowed the call. Intent violations and assigned-rule blocks are never downgraded.",
+      "default": true
+    }
+  }
+}

package/vendor/claude_code/README.md

@@ -0,0 +1,267 @@
+# Datagusto Safety Plugin for Claude Code
+
+A Claude Code plugin that calls [Datagusto](https://datagusto.com) safety validation APIs to enforce guardrails on agent tool execution.
+
+This is the Claude Code port of the [OpenClaw plugin](../openclaw). Both plugins talk to the same Datagusto backend (the meta harness) and implement the same business semantics — proceed/block/ask/inject driven by the `/sessions/validate` response — but each maps that contract onto its own host framework's native hook vocabulary independently. See [Architecture](#architecture) and [Differences from the OpenClaw plugin](#differences-from-the-openclaw-plugin) for where the two diverge structurally.
+
+## Prerequisites
+
+- Claude Code (or the Claude Agent SDK) with plugin support
+- A running Datagusto server with a valid API key
+- Node.js (to run the compiled hook script)
+
+## Installation
+
+**With the `dg` CLI (recommended):** `dg setup claude-code` copies this plugin to `~/.datagusto/claude-code/`, writes `claude-code.json` there with your agent key, and adds the hooks to `~/.claude/settings.json` so every session runs them. See [`../cli`](../cli/README.md). The rest of this section is for developing the plugin itself.
+
+**From source:**
+
+```sh
+cd claude_code
+npm install
+npm run build
+```
+
+This produces `dist/index.js`, the single compiled entrypoint every hook below invokes.
+
+### Loading the plugin
+
+This directory is a real Claude Code plugin (`.claude-plugin/plugin.json` + `hooks/hooks.json`), not just a script you wire into your own `settings.json`. Load it directly off this built local directory:
+
+**CLI (development):**
+```sh
+claude --plugin-dir /absolute/path/to/claude_code
+```
+
+**Agent SDK:**
+```ts
+import { query } from "@anthropic-ai/claude-agent-sdk";
+
+for await (const message of query({
+  prompt: "...",
+  options: { plugins: [{ type: "local", path: "/absolute/path/to/claude_code" }] },
+})) { /* ... */ }
+```
+
+Either path auto-discovers `.claude-plugin/plugin.json` and wires all seven hooks declared in `hooks/hooks.json` — there's nothing else to configure for loading. (Marketplace/npm distribution isn't set up here; both loading paths above work directly off a locally built directory.)
+
+## Testing (quickstart)
+
+For local testing and demos, the most reliable place to put credentials is `claude-code.json` next to `package.json` (gitignored — safe for keys). `loadConfig()` reads it directly, so it works regardless of how the plugin host names its `CLAUDE_PLUGIN_OPTION_*` env vars.
+
+1. **Build:**
+   ```sh
+   npm install && npm run build
+   ```
+2. **Add credentials** — copy the template and fill in your real values:
+   ```sh
+   cp claude-code.json.example claude-code.json
+   # then edit claude-code.json: set serverUrl + apiKey
+   ```
+   ```json
+   {
+     "serverUrl": "http://localhost:8000",
+     "apiKey": "agt_live_your-key-here",
+     "verbose": true
+   }
+   ```
+   > The `apiKey` is the public API key of the **agent** on the Datagusto platform. The agent must exist with the identifier `claude_code` (the value the plugin sends as `agent_type`), under the account that owns this key.
+3. **Verify the connection** (no Claude session needed) — the register call should return `ok=true, status=200`:
+   ```sh
+   echo '{"hook_event_name":"SessionStart","session_id":"verify","source":"startup"}' | node dist/index.js
+   ```
+4. **Rehearse the guardrail behaviors** deterministically against the live backend:
+   ```sh
+   ./scripts/phase2-rehearsal.sh
+   ```
+   This drives synthetic Pre/Post payloads through the plugin and prints the exact decision Claude Code would act on for each scenario (allow / deny / ask / output-suppression / failed-tool). What each scenario produces depends on the guardrails assigned to the `claude_code` agent on the dashboard.
+5. **Launch a real session** from a scratch project:
+   ```sh
+   cd ~/some-scratch-project
+   claude --plugin-dir /absolute/path/to/claude_code
+   ```
+   With `verbose: true`, stderr shows the hook chain firing; the dashboard's Agents/Guardrail-Logs views show the calls landing.
+
+## Configuration
+
+The options declared in `.claude-plugin/plugin.json`'s `userConfig` can be set through Claude Code (the `/plugin` install dialog or `/plugin configure`). `api_key` is marked `sensitive`, so it's stored in the OS keychain (or `~/.claude/.credentials.json`) rather than `settings.json`.
+
+None of them is `required`, so Claude Code never blocks on a prompt for them. `dg setup claude-code` writes `serverUrl` and `apiKey` to `claude-code.json` instead, and that file is all the plugin needs. Values set through `userConfig` still take precedence over the file.
+
+### Configuration Options
+
+| `userConfig` key | Type | Default | Description |
+|---|------|---------|-------------|
+| `server_url` | `string` | — | Datagusto server base URL. Needed from here, `claude-code.json` or `DATAGUSTO_SAFETY_SERVER_URL` |
+| `api_key` | `string` | — | API key for Bearer authentication (sensitive — keychain-stored). Needed from here, `claude-code.json` or `DATAGUSTO_SAFETY_API_KEY` |
+| `timeout_ms` | `number` | `30000` | Per-request timeout in milliseconds |
+| `fail_closed` | `boolean` | `true` | Block tool execution when API calls fail |
+| `verbose` | `boolean` | `false` | Enable hook-by-hook logging to stderr |
+| `monitor_only` | `boolean` | `false` | Log deny/ask/block/inject/auto-approve decisions without enforcing them. OR-ed with the platform's per-agent monitoring mode — see [Platform monitoring mode](#platform-monitoring-mode) |
+| `auto_approve_vetted_permissions` | `boolean` | `false` | Auto-resolve Claude Code's native `PermissionRequest` dialog when `PreToolUse` already vetted the same call — see [`PermissionRequest`](#4-permissionrequest--auto-resolving-the-native-dialog) below |
+
+### Dev fallback: running without a plugin host
+
+The same `dist/index.js` also supports the original dev workflow of piping synthetic stdin payloads straight into the script, with no plugin host involved. In that mode, configuration comes from `claude-code.json` (gitignored, lives next to `package.json`) or `DATAGUSTO_SAFETY_*` environment variables — both still fully supported, and checked when no `CLAUDE_PLUGIN_OPTION_*` values are present:
+
+```json
+{
+  "serverUrl": "https://your-datagusto-server.example.com",
+  "apiKey": "your-api-key",
+  "timeoutMs": 30000,
+  "failClosed": true,
+  "verbose": false,
+  "monitorOnly": false,
+  "autoApproveVettedPermissions": false
+}
+```
+
+| Option | Env var override |
+|--------|------------------|
+| `serverUrl` | `DATAGUSTO_SAFETY_SERVER_URL` |
+| `apiKey` | `DATAGUSTO_SAFETY_API_KEY` |
+| `timeoutMs` | `DATAGUSTO_SAFETY_TIMEOUT_MS` |
+| `failClosed` | `DATAGUSTO_SAFETY_FAIL_CLOSED` |
+| `verbose` | `DATAGUSTO_SAFETY_VERBOSE` |
+| `monitorOnly` | `DATAGUSTO_SAFETY_MONITOR_ONLY` |
+| `autoApproveVettedPermissions` | `DATAGUSTO_SAFETY_AUTO_APPROVE_VETTED_PERMISSIONS` |
+
+Precedence, highest first: `CLAUDE_PLUGIN_OPTION_*` (set by the plugin host from `userConfig`) → `DATAGUSTO_SAFETY_*` env vars → `claude-code.json`. Booleans accept `true`/`1`/`yes` or `false`/`0`/`no` (case-insensitive). The `claude-code.json` path can be overridden with `DATAGUSTO_SAFETY_CONFIG_PATH`.
+
+### Manual hook wiring (legacy, optional)
+
+If you'd rather not load this as a plugin, the compiled script can still be wired by hand into `.claude/settings.json`'s `hooks` block — copy the `hooks` object from [`hooks/hooks.json`](hooks/hooks.json), replacing `${CLAUDE_PLUGIN_ROOT}` with the absolute path to this directory. Configuration then falls back to `claude-code.json` / `DATAGUSTO_SAFETY_*`, since there's no plugin host to supply `userConfig` values in this mode.
+
+## How It Works
+
+The plugin handles seven Claude Code hook events. Each invocation is a separate process: it reads one JSON payload from stdin, does its work, writes a decision to stdout, and exits.
+
+### 1. `SessionStart` — Eager Tool Registration
+
+Fires once per session (new, resumed, or post-compact). Sends the bundled built-in tool catalog (see [Built-in tool catalog](#built-in-tool-catalog)) to `POST /api/v1/public/safety/tools/register`, hash-gated so it's a no-op once already registered. Decouples registration from the first user prompt — a session that only ever runs slash commands still gets its tools registered.
+
+### 2. `UserPromptSubmit` — Alignment (+ Registration Fallback)
+
+Fires once per user turn, before the prompt reaches the model:
+
+- **Alignment**: Sends `payload.prompt` — the raw user instruction, no parsing needed — to `POST /api/v1/public/safety/sessions/alignment`. The returned `session_id` is persisted for subsequent validation calls. Prompts that are slash commands (`/compact`) or bash-mode shortcuts (`!ls`) are skipped.
+- **Tool registration**: Repeats the same hash-gated registration `SessionStart` already does, as a cheap defense-in-depth fallback.
+
+### 3. `PreToolUse` — Pre-execution Validation
+
+Before each tool call, calls `POST /api/v1/public/safety/sessions/validate` with `timing: "on_start"`. The response is routed by `should_proceed` and `severity`, and the verdict is cached for `PermissionRequest` (below) to consult:
+
+| Verdict | Claude Code response | Behavior |
+|---------|----------------------|----------|
+| `should_proceed: false` (severity high) | `hookSpecificOutput.permissionDecision: "deny"` | Tool execution is blocked outright. |
+| `severity: "medium"` + `injected_instruction` | `hookSpecificOutput.permissionDecision: "ask"` | Claude Code's normal permission prompt is shown with the injected instruction as the reason. |
+| `should_proceed: true` (severity low) | _(no output)_ | Execution proceeds; Claude Code's own permission system (if any) still applies — see `PermissionRequest`. |
+
+### 4. `PermissionRequest` — Auto-Resolving the Native Dialog
+
+Fires after `PreToolUse`, only when Claude Code's own permission settings would still show a dialog (i.e. `PreToolUse` passed the call through with no explicit decision). When `auto_approve_vetted_permissions` is enabled, this reuses the cached `PreToolUse` verdict to answer the dialog automatically — without a second Datagusto round-trip — instead of prompting the user again for a call Datagusto already vetted. It never touches a cached `ask` verdict (severity medium): that case exists specifically so the user sees the dialog with Datagusto's injected context. Off by default; a no-op when disabled.
+
+### 5. `PostToolUse` / `PostToolUseFailure` — Post-execution Validation
+
+After each tool call succeeds (`PostToolUse`) or fails (`PostToolUseFailure` — same payload shape, same handling), calls the validate API with `timing: "on_end"` and the tool's output:
+
+| Verdict | Claude Code response |
+|---------|-----------------------|
+| `should_proceed: false` | `{ "decision": "block", "reason": ... }` **and** `hookSpecificOutput.updatedToolOutput` — the tool's recorded output is replaced with a `[BLOCKED]` notice, not just accompanied by feedback. |
+| `injected_instruction` (without block) | `hookSpecificOutput.additionalContext` — appended as extra context for Claude. |
+| Otherwise | _(no output)_ |
+
+### 6. `SessionEnd` — State Cleanup
+
+Fires once per session, on exit. Deletes the per-session state file so `os.tmpdir()/datagusto-safety-plugin/` doesn't accumulate stale entries indefinitely.
+
+### Monitor-only mode
+
+Set `monitor_only: true` (or `DATAGUSTO_SAFETY_MONITOR_ONLY=true`) to log all deny/ask/block/inject/auto-approve decisions without enforcing them — useful for staging rollouts. `fail_closed` error-handling is intentionally unaffected.
+
+### Platform monitoring mode
+
+Independently of `monitor_only`, the Datagusto platform has a per-agent **monitoring mode** (dashboard: agent settings → monitoring). When it is on, the server still evaluates guardrails, records every verdict and detects incidents, but returns `monitoring_mode_enabled: true` on `/sessions/alignment` and `/sessions/validate` responses and expects the client not to enforce them.
+
+The plugin honours that flag: effective monitoring = `monitor_only` **OR** `monitoring_mode_enabled`. Either switch disables enforcement; there is no way for one to override the other. The platform value is resolved per request:
+
+1. `monitoring_mode_enabled` on the current validate response (follows a settings change mid-session), then
+2. the value most recently reported by any alignment or validate response for this session (kept in the per-session state file, and the only source for `PermissionRequest` and for calls where only `/guardrails/evaluate` ran, since that endpoint carries no flag), then
+3. `false` — servers that omit the field behave exactly as before.
+
+The first time a session sees the platform flag as `true`, one user-facing notice is emitted via the hook output's `systemMessage` field regardless of `verbose` (merged into the deny / ask / block JSON when there is one, or written as a bare `{ "systemMessage": ... }` on allow paths); every skipped verdict is then logged as `[MONITOR] ... skipped (platform monitoring mode)` (vs. `(plugin monitorOnly)`) when `verbose` is on. Fail-closed handling of API errors is governed by `monitor_only` alone; the platform flag never relaxes it, because an errored request carries no verdict.
+
+## Fail-Closed vs Fail-Open
+
+- **`fail_closed: true`** (default): Tool execution is denied when the Datagusto API is unreachable or errors. Safe default for production.
+- **`fail_closed: false`**: Tool execution is allowed to proceed on API errors. Use for development/testing.
+
+Misconfiguration (missing `server_url`/`api_key`) is always fail-**open** regardless of `fail_closed`. Blocking every tool call would leave the user unable to use the agent to troubleshoot. Instead, `SessionStart` shows a warning (via `systemMessage`) that tool calls aren't being checked and suggests `dg setup claude-code`, and every other hook writes the same warning to stderr and exits non-blocking. `fail_closed` still governs API errors once the plugin is configured.
+
+## Troubleshooting
+
+### Enable verbose mode
+
+Set `verbose: true` (via `userConfig` or `claude-code.json`) to see per-hook logs on stderr, including API call results and hash-gate decisions.
+
+### Common errors
+
+| Error | Cause | Solution |
+|-------|-------|----------|
+| `Datagusto safety plugin isn't configured` (tool calls not checked) | Missing `serverUrl` / `apiKey` | Run `dg setup claude-code`, or check the plugin's `userConfig` values, or `claude-code.json` / `DATAGUSTO_SAFETY_*` in dev-fallback mode |
+| `no session_id available` (on every tool call) | `UserPromptSubmit` hook isn't firing, or alignment failed | Confirm the plugin loaded (all 7 hooks should appear in the SDK's `init` message); check `verbose` logs for the alignment API error |
+| `validation API error` | Datagusto server returned non-2xx | Check server health and API key validity |
+| Tool denied unexpectedly | API error with `fail_closed: true` | Set `fail_closed: false` to allow tools during API outages |
+
+## Built-in tool catalog
+
+Like OpenClaw, Claude Code's hook payloads don't expose the active tool catalog (`PreToolUse`/`PostToolUse` only carry the one tool being called). To register tools with Datagusto deterministically, the plugin bundles a snapshot of Claude Code's standard built-in tools (Read, Write, Edit, NotebookEdit, Glob, Grep, Bash, BashOutput, KillShell, WebFetch, WebSearch, Task, TodoWrite, ExitPlanMode, SlashCommand) at [`src/builtin-tools.generated.ts`](src/builtin-tools.generated.ts).
+
+Unlike the OpenClaw plugin's `scripts/generate-builtin-tools.mjs`, there is no generator script here: Claude Code's tool catalog isn't an importable module from an upstream source tree, so this file is hand-curated from [Anthropic's public docs](https://code.claude.com/docs/en/settings) instead of extracted programmatically. MCP-provided tools (`mcp__*`) are dynamic per-installation and intentionally excluded. Review this file by hand when Claude Code's built-in tool list or schemas change.
+
+Output schemas are not exposed by Claude Code either, so they remain as the empty-object placeholder, same as OpenClaw.
+
+## Architecture
+
+```
+Claude Code plugin (.claude-plugin/plugin.json + hooks/hooks.json), per hook event, one process each
+  |
+  |-- SessionStart -------> buildBuiltinToolDefinitions() --> POST /tools/register (hash-gated)
+  |
+  |-- UserPromptSubmit ---> payload.prompt --------------> POST /sessions/alignment
+  |                                                          -> persist session_id to state file
+  |                       -> registration fallback (hash-gated, same as SessionStart)
+  |
+  |-- PreToolUse --------> POST /sessions/validate (on_start)
+  |                          should_proceed=false                 --> permissionDecision: deny
+  |                          severity=medium + injected_instruction --> permissionDecision: ask
+  |                          otherwise                            --> (allow)
+  |                          -> cache verdict for PermissionRequest
+  |
+  |-- PermissionRequest -> (if auto_approve_vetted_permissions) replay cached verdict
+  |                          cached ask (severity=medium)  --> (no-op, never auto-resolved)
+  |                          otherwise                     --> decision.behavior: allow/deny
+  |
+  |-- PostToolUse / -----> POST /sessions/validate (on_end)
+  |   PostToolUseFailure     should_proceed=false      --> decision: block + updatedToolOutput (rewrite)
+  |                          injected_instruction      --> additionalContext (feedback only)
+  |                          otherwise                 --> (no output)
+  |
+  |-- SessionEnd ---------> delete per-session state file
+```
+
+State (`sessionId`, `registeredToolsHash`, `lastUserInstructionHash`, `lastPreToolUseCheck`) is a small JSON file per Claude Code `session_id` under `os.tmpdir()/datagusto-safety-plugin/`, since each hook invocation is a fresh process with no shared memory. `SessionEnd` deletes it; with no `SessionEnd` (e.g. an abnormal exit), it's simply orphaned in the OS tmpdir like any other stale temp file.
+
+## Differences from the OpenClaw plugin
+
+Both plugins implement the same business semantics against the same Datagusto contract (`/sessions/validate`'s `should_proceed`/`severity`/`injected_instruction` fields), mapped independently onto each host's native hook vocabulary:
+
+- **7 Claude Code hooks vs. OpenClaw's 5.** No Claude Code analogue of `before_agent_start` (state is namespaced by Claude Code's stable `session_id`, so there's nothing to reset) or `tool_result_persist` (folded into `PostToolUse`'s own `updatedToolOutput`, see below). Conversely, Claude Code's `SessionStart`/`SessionEnd`/`PostToolUseFailure`/`PermissionRequest` have no OpenClaw equivalent — they map onto lifecycle concepts (explicit session boundaries, a host-native permission dialog) that don't exist in OpenClaw's single-long-running-process architecture.
+- **No race conditions.** OpenClaw's `before_tool_call` awaits a pending alignment promise because hooks share one process; Claude Code hooks run as separate, sequential processes, so `UserPromptSubmit`/`SessionStart` always finish before the next `PreToolUse`.
+- **`PostToolUse` can rewrite output.** `hookSpecificOutput.updatedToolOutput` replaces the tool's recorded result, the same underlying capability as OpenClaw's `tool_result_persist` rewrite, expressed through Claude Code's own hook field instead.
+- **Simpler instruction extraction.** `payload.prompt` is the raw current instruction; no scanning `historyMessages` and no channel-metadata stripping (only slash-command / bash-mode filtering).
+- **No SDK dependency.** OpenClaw imports `OpenClawPluginApi` from the `openclaw` npm package; this plugin only reads JSON from stdin, so there's no peer dependency on Claude Code at all.
+
+## License
+
+MIT

package/vendor/claude_code/dist/api-client.js

@@ -0,0 +1,82 @@
+// ---------------------------------------------------------------------------
+// Datagusto Safety Plugin - HTTP API Client
+// ---------------------------------------------------------------------------
+const TOOLS_REGISTER_PATH = "/api/v1/public/safety/tools/register";
+const SESSIONS_ALIGNMENT_PATH = "/api/v1/public/safety/sessions/alignment";
+const SESSIONS_VALIDATE_PATH = "/api/v1/public/safety/sessions/validate";
+const GUARDRAILS_EVALUATE_PATH = "/api/v1/public/guardrails/evaluate";
+export class DatagustoApiClient {
+    baseUrl;
+    apiKey;
+    timeoutMs;
+    constructor(baseUrl, apiKey, timeoutMs = 30_000) {
+        this.baseUrl = baseUrl.replace(/\/+$/, "");
+        this.apiKey = apiKey;
+        this.timeoutMs = timeoutMs;
+    }
+    // -- Public API methods ---------------------------------------------------
+    async registerTools(tools) {
+        const body = { tools };
+        return this._post(TOOLS_REGISTER_PATH, body);
+    }
+    async postAlignment(userInstruction, sessionId, agentType) {
+        const body = { user_instruction: userInstruction };
+        if (sessionId) {
+            body.session_id = sessionId;
+        }
+        if (agentType) {
+            body.agent_type = agentType;
+        }
+        return this._post(SESSIONS_ALIGNMENT_PATH, body);
+    }
+    async postValidate(payload) {
+        return this._post(SESSIONS_VALIDATE_PATH, payload);
+    }
+    /**
+     * Evaluate the agent's assigned (dashboard-authored) guardrail rules for a
+     * single tool call. Agent-scoped via the API key — needs no session_id — and
+     * is the only path that evaluates assigned rules and on_end timing. Called
+     * alongside postValidate and merged (block-wins) by the hook handlers.
+     */
+    async evaluateGuardrails(payload) {
+        return this._post(GUARDRAILS_EVALUATE_PATH, payload);
+    }
+    // -- Internal helper ------------------------------------------------------
+    async _post(endpoint, body) {
+        const url = this.baseUrl + endpoint;
+        try {
+            const response = await fetch(url, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${this.apiKey}`,
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify(body),
+                signal: AbortSignal.timeout(this.timeoutMs),
+            });
+            const text = await response.text();
+            let data = null;
+            try {
+                data = text ? JSON.parse(text) : null;
+            }
+            catch {
+                // Non-JSON response — leave data as null
+            }
+            return {
+                ok: response.ok,
+                status: response.status,
+                data,
+                ...(response.ok ? {} : { error: text }),
+            };
+        }
+        catch (err) {
+            return {
+                ok: false,
+                status: null,
+                data: null,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    }
+}
+//# sourceMappingURL=api-client.js.map

package/vendor/claude_code/dist/builtin-tools.generated.js

@@ -0,0 +1,33 @@
+// MANUALLY CURATED — DO NOT TREAT AS AUTO-GENERATED
+// Source: Claude Code's public tool/permissions reference
+//   https://code.claude.com/docs/en/settings
+//   https://code.claude.com/docs/en/hooks
+// Curated at: 2026-06-21
+// Tool count:  15
+//
+// Unlike OpenClaw, Claude Code's built-in tool catalog is not an importable
+// module — there is no upstream source tree to run a generator script
+// against (see openclaw/scripts/generate-builtin-tools.mjs for that
+// approach). This file is hand-maintained from Anthropic's published docs
+// and product knowledge of Claude Code's standard tool set instead. MCP
+// tools (`mcp__*`) are dynamic per-installation and intentionally excluded.
+// Re-review this file whenever Claude Code's built-in tool list or its
+// parameter schemas change.
+export const BUILTIN_TOOLS = [
+    { "id": "Read", "description": "Read file contents", "sectionId": "fs", "sectionLabel": "Files", "inputSchema": { "type": "object", "required": ["file_path"], "properties": { "file_path": { "type": "string", "description": "Absolute path to the file to read" }, "offset": { "type": "number", "description": "Line number to start reading from" }, "limit": { "type": "number", "description": "Maximum number of lines to read" } } }, "inputSchemaSource": "manual" },
+    { "id": "Write", "description": "Create or overwrite a file", "sectionId": "fs", "sectionLabel": "Files", "inputSchema": { "type": "object", "required": ["file_path", "content"], "properties": { "file_path": { "type": "string", "description": "Absolute path to the file to write" }, "content": { "type": "string", "description": "Content to write to the file" } } }, "inputSchemaSource": "manual" },
+    { "id": "Edit", "description": "Make a targeted string replacement in a file", "sectionId": "fs", "sectionLabel": "Files", "inputSchema": { "type": "object", "required": ["file_path", "old_string", "new_string"], "properties": { "file_path": { "type": "string", "description": "Absolute path to the file to edit" }, "old_string": { "type": "string", "description": "Exact text to replace" }, "new_string": { "type": "string", "description": "Replacement text" }, "replace_all": { "type": "boolean", "description": "Replace all occurrences of old_string instead of requiring a unique match" } } }, "inputSchemaSource": "manual" },
+    { "id": "NotebookEdit", "description": "Edit a Jupyter notebook cell", "sectionId": "fs", "sectionLabel": "Files", "inputSchema": { "type": "object", "required": ["notebook_path", "new_source"], "properties": { "notebook_path": { "type": "string", "description": "Absolute path to the .ipynb file" }, "cell_id": { "type": "string", "description": "Target cell id" }, "new_source": { "type": "string", "description": "New cell source" }, "cell_type": { "type": "string", "enum": ["code", "markdown"] }, "edit_mode": { "type": "string", "enum": ["replace", "insert", "delete"] } } }, "inputSchemaSource": "manual" },
+    { "id": "Glob", "description": "Find files by glob pattern", "sectionId": "search", "sectionLabel": "Search", "inputSchema": { "type": "object", "required": ["pattern"], "properties": { "pattern": { "type": "string", "description": "Glob pattern, e.g. \"src/**/*.ts\"" }, "path": { "type": "string", "description": "Directory to search in (defaults to cwd)" } } }, "inputSchemaSource": "manual" },
+    { "id": "Grep", "description": "Search file contents with a regex", "sectionId": "search", "sectionLabel": "Search", "inputSchema": { "type": "object", "required": ["pattern"], "properties": { "pattern": { "type": "string", "description": "Regular expression to search for" }, "path": { "type": "string", "description": "File or directory to search" }, "glob": { "type": "string", "description": "Glob filter for files to search, e.g. \"*.ts\"" }, "type": { "type": "string", "description": "File type filter, e.g. \"js\"" }, "output_mode": { "type": "string", "enum": ["content", "files_with_matches", "count"] }, "-B": { "type": "number", "description": "Lines of context before each match" }, "-A": { "type": "number", "description": "Lines of context after each match" }, "-C": { "type": "number", "description": "Lines of context around each match" }, "-n": { "type": "boolean", "description": "Show line numbers" }, "-i": { "type": "boolean", "description": "Case-insensitive search" }, "multiline": { "type": "boolean", "description": "Allow patterns to span multiple lines" }, "head_limit": { "type": "number", "description": "Limit output to the first N matches/lines" } } }, "inputSchemaSource": "manual" },
+    { "id": "Bash", "description": "Execute a shell command", "sectionId": "runtime", "sectionLabel": "Shell", "inputSchema": { "type": "object", "required": ["command"], "properties": { "command": { "type": "string", "description": "Shell command to execute" }, "description": { "type": "string", "description": "Short human-readable description of the command" }, "timeout": { "type": "number", "description": "Timeout in milliseconds" }, "run_in_background": { "type": "boolean", "description": "Run the command in the background and return immediately" } } }, "inputSchemaSource": "manual" },
+    { "id": "BashOutput", "description": "Read output from a running/background shell", "sectionId": "runtime", "sectionLabel": "Shell", "inputSchema": { "type": "object", "required": ["bash_id"], "properties": { "bash_id": { "type": "string", "description": "Id of the background shell" }, "filter": { "type": "string", "description": "Regex to filter the returned output lines" } } }, "inputSchemaSource": "manual" },
+    { "id": "KillShell", "description": "Terminate a running background shell", "sectionId": "runtime", "sectionLabel": "Shell", "inputSchema": { "type": "object", "required": ["shell_id"], "properties": { "shell_id": { "type": "string", "description": "Id of the background shell to kill" } } }, "inputSchemaSource": "manual" },
+    { "id": "WebFetch", "description": "Fetch a URL and summarize its content", "sectionId": "web", "sectionLabel": "Web", "inputSchema": { "type": "object", "required": ["url", "prompt"], "properties": { "url": { "type": "string", "description": "URL to fetch" }, "prompt": { "type": "string", "description": "What to extract from the fetched content" } } }, "inputSchemaSource": "manual" },
+    { "id": "WebSearch", "description": "Search the web", "sectionId": "web", "sectionLabel": "Web", "inputSchema": { "type": "object", "required": ["query"], "properties": { "query": { "type": "string", "description": "Search query" }, "allowed_domains": { "type": "array", "items": { "type": "string" }, "description": "Only include results from these domains" }, "blocked_domains": { "type": "array", "items": { "type": "string" }, "description": "Exclude results from these domains" } } }, "inputSchemaSource": "manual" },
+    { "id": "Task", "description": "Launch a sub-agent to handle a delegated task", "sectionId": "agents", "sectionLabel": "Agents", "inputSchema": { "type": "object", "required": ["description", "prompt", "subagent_type"], "properties": { "description": { "type": "string", "description": "Short (3-5 word) description of the task" }, "prompt": { "type": "string", "description": "The task for the sub-agent to perform" }, "subagent_type": { "type": "string", "description": "Which agent type to use" } } }, "inputSchemaSource": "manual" },
+    { "id": "TodoWrite", "description": "Create/update the session's structured task list", "sectionId": "agents", "sectionLabel": "Agents", "inputSchema": { "type": "object", "required": ["todos"], "properties": { "todos": { "type": "array", "items": { "type": "object", "required": ["content", "status", "activeForm"], "properties": { "content": { "type": "string", "description": "Imperative task description" }, "status": { "type": "string", "enum": ["pending", "in_progress", "completed"] }, "activeForm": { "type": "string", "description": "Present-continuous form shown while in progress" } } }, "description": "The updated todo list" } } }, "inputSchemaSource": "manual" },
+    { "id": "ExitPlanMode", "description": "Exit plan mode and present a plan for approval", "sectionId": "agents", "sectionLabel": "Agents", "inputSchema": { "type": "object", "required": ["plan"], "properties": { "plan": { "type": "string", "description": "The plan to present to the user, in markdown" } } }, "inputSchemaSource": "manual" },
+    { "id": "SlashCommand", "description": "Execute a custom slash command", "sectionId": "agents", "sectionLabel": "Agents", "inputSchema": { "type": "object", "required": ["command"], "properties": { "command": { "type": "string", "description": "The slash command to execute, including any arguments" } } }, "inputSchemaSource": "manual" },
+];
+//# sourceMappingURL=builtin-tools.generated.js.map