@dcrays/mobook-security-plugin 2.0.14 → 2.0.15

package/index.js

@@ -749,6 +749,53 @@ export default function register(api) {
       }
     }
 
+    // ============================================================
+    // 禁止 OpenClaw 自动更新
+    // ============================================================
+
+    // 路径1：gateway 工具 update.run
+    if (toolName === "gateway" && params?.action === "update.run") {
+      alert(`BLOCKED: 尝试通过 gateway 更新 OpenClaw`);
+      return {
+        block: true,
+        blockReason: "🛡️ 安全插件拦截：禁止自动更新 OpenClaw，需人工确认后手动执行"
+      };
+    }
+
+    // 路径2：gateway config 修改自动更新相关配置
+    if (toolName === "gateway" && ["config.patch", "config.apply"].includes(params?.action)) {
+      const raw = params?.raw || JSON.stringify(params);
+      if (/auto.?update|"updates?"/i.test(raw)) {
+        alert(`BLOCKED: 尝试通过配置修改 OpenClaw 自动更新设置 | action=${params.action}`);
+        return {
+          block: true,
+          blockReason: "🛡️ 安全插件拦截：禁止修改 OpenClaw 自动更新配置，需人工确认"
+        };
+      }
+    }
+
+    // 路径3：exec 命令安装/更新 OpenClaw
+    if (toolName === "exec") {
+      const cmd = params.command || "";
+      const openclawUpdatePatterns = [
+        /npm\s+(i|install|update|up|upgrade)\s+.*\bopenclaw\b/i,
+        /yarn\s+(global\s+)?add\s+.*\bopenclaw\b/i,
+        /yarn\s+(global\s+)?upgrade\s+.*\bopenclaw\b/i,
+        /pnpm\s+(add|update|install|upgrade)\s+.*\bopenclaw\b/i,
+        /npx\s+.*\bopenclaw\b.*update/i,
+        /brew\s+(upgrade|reinstall)\s+.*\bopenclaw\b/i,
+        /\bopenclaw\s+update\b/i,
+        /\bopenclaw\s+gateway\s+update\b/i,
+      ];
+      if (openclawUpdatePatterns.some(p => p.test(cmd))) {
+        alert(`BLOCKED: 尝试通过命令行更新 OpenClaw | cmd: ${cmd.slice(0, 200)}`);
+        return {
+          block: true,
+          blockReason: "🛡️ 安全插件拦截：禁止通过包管理器更新 OpenClaw，需人工确认后手动执行"
+        };
+      }
+    }
+
     return {};
   });
 

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "mobook-security-plugin",
   "name": "MoBook 安全防护插件",
-  "version": "2.0.14",
+  "version": "2.0.15",
   "description": "MoBook 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
   "entry": "./index.js",
   "type": "plugin",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dcrays/mobook-security-plugin",
-  "version": "2.0.14",
+  "version": "2.0.15",
   "type": "module",
   "description": "MoBook 企业级安全插件 - 危险命令分级拦截、敏感信息全渠道脱敏（身份证GB11643/银行卡Luhn校验）、LLM响应拦截、操作审计",
   "main": "index.js",