@guava-parity/guard-scanner 16.0.1 → 16.0.2

package/docs/spec/capabilities.json

@@ -1,12 +1,12 @@
 {
-  "package_version": "16.0.1",
-  "plugin_version": "16.0.1",
-  "static_pattern_count": 358,
+  "package_version": "16.0.2",
+  "plugin_version": "16.0.2",
+  "static_pattern_count": 364,
   "threat_category_count": 35,
   "runtime_check_count": 27,
-  "test_file_count": 28,
+  "test_file_count": 38,
   "dependencies_runtime": 1,
-  "dependencies_dev": 5,
+  "dependencies_dev": 7,
   "mcp_tools": [
     "scan_skill",
     "scan_text",
@@ -40,7 +40,7 @@
     "github",
     "npm"
   ],
-  "benchmark_corpus_version": "2026-03-13.quality-v1",
+  "benchmark_corpus_version": "2026-03-15.quality-v17",
   "benchmark_layers": [
     {
       "id": "layer_a",
@@ -68,6 +68,24 @@
       "recall": 1,
       "false_positive_rate": 0,
       "false_negative_rate": 0
+    },
+    {
+      "id": "layer_protocol",
+      "benign": 4,
+      "malicious": 4,
+      "precision": 1,
+      "recall": 1,
+      "false_positive_rate": 0,
+      "false_negative_rate": 0
+    },
+    {
+      "id": "layer_capability",
+      "benign": 4,
+      "malicious": 4,
+      "precision": 1,
+      "recall": 1,
+      "false_positive_rate": 0,
+      "false_negative_rate": 0
     }
   ],
   "analysis_layers": [

package/guard-scanner

@@ -1,4 +1,2 @@
 #!/usr/bin/env node
-"use strict";
-
-require("./dist/cli.cjs");
+import "./dist/cli.mjs";

package/openclaw-plugin.mts

@@ -2,6 +2,7 @@ import type { OpenClawPluginApi } from "openclaw/plugin-sdk/core";
 import * as runtimeGuard from "./src/index.js";
 
 const runtimeGuardApi = runtimeGuard as {
+    VERSION: string;
     scanToolCall: (
         toolName: string,
         params: Record<string, unknown>,
@@ -90,7 +91,7 @@ function beforeToolCall(
 const plugin = {
     id: "guard-scanner",
     name: "guard-scanner",
-    version: "15.0.0",
+    version: runtimeGuardApi.VERSION,
     description: "Runtime guard for OpenClaw before_tool_call hook execution.",
     register(api: OpenClawPluginApi) {
         api.on(
@@ -99,7 +100,7 @@ const plugin = {
             { priority: 90 },
         );
         api.logger.info(
-            "guard-scanner registered OpenClaw before_tool_call hook (stable: v2026.3.12, regression lane: v2026.3.8).",
+            "guard-scanner registered OpenClaw before_tool_call hook (stable: v2026.3.13, regression lane: v2026.3.8).",
         );
     },
 };

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "guard-scanner",
   "name": "guard-scanner",
   "description": "Runtime guard plugin for OpenClaw before_tool_call enforcement with capability-scoped policy rationale.",
-  "version": "16.0.1",
+  "version": "16.0.2",
   "configSchema": {
     "type": "object",
     "properties": {

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@guava-parity/guard-scanner",
-  "version": "16.0.1",
+  "version": "16.0.2",
+  "type": "module",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/"
@@ -22,7 +23,7 @@
       "default": "./dist/index.mjs"
     },
     "./plugin": {
-      "types": "./dist/openclaw-plugin.d.mts",
+      "types": "./dist/openclaw-plugin.d.ts",
       "import": "./dist/openclaw-plugin.mjs",
       "require": "./dist/openclaw-plugin.cjs",
       "default": "./dist/openclaw-plugin.mjs"
@@ -57,9 +58,9 @@
     "lint": "tsx scripts/lint.ts",
     "typecheck": "tsc --noEmit -p tsconfig.json",
     "release:gate": "npm run build && npm run benchmark && tsx scripts/generate-capabilities.ts && tsx scripts/release-gate.ts && tsx scripts/validate-tarball.ts",
-    "test": "npm run build && npm run benchmark && tsx scripts/generate-capabilities.ts && tsx scripts/verify-capabilities.ts && tsx scripts/test-quality-gate.ts && tsx --test test/*.test.ts",
-    "test:core": "tsx --test test/scanner.test.ts test/patterns.test.ts",
-    "test:contracts": "npm run build:plugin && tsx scripts/release-gate.ts && tsx --test test/finding-schema.test.ts test/mcp.test.ts test/e2e-mcp.test.ts test/openclaw-plugin-compat.test.ts test/stale-claims.test.ts test/openclaw-upstream-check.test.ts",
+    "test": "npm run build && npm run benchmark && tsx scripts/generate-capabilities.ts && tsx scripts/verify-capabilities.ts && tsx scripts/test-quality-gate.ts && vitest run",
+    "test:core": "vitest run tests/scanner.test.ts tests/patterns.test.ts",
+    "test:contracts": "npm run build:plugin && tsx scripts/release-gate.ts && vitest run tests/finding-schema.test.ts tests/mcp.test.ts tests/e2e-mcp.test.ts tests/openclaw-plugin-compat.test.ts tests/stale-claims.test.ts tests/openclaw-upstream-check.test.ts",
     "test:corpus": "tsx scripts/corpus-metrics.ts --check",
     "test:perf": "tsx scripts/perf-regression.ts",
     "test:quality": "tsx scripts/test-quality-gate.ts",
@@ -109,10 +110,12 @@
   ],
   "devDependencies": {
     "@types/node": "^22.0.0",
-    "openclaw": "2026.3.12",
-    "tsx": "^4.20.5",
+    "@vitest/coverage-v8": "^4.1.0",
+    "openclaw": "2026.3.13",
     "tsup": "^8.5.0",
-    "typescript": "^5.7.0"
+    "tsx": "^4.20.5",
+    "typescript": "^5.7.0",
+    "vitest": "^4.1.0"
   },
   "dependencies": {
     "ws": "^8.19.0"

package/dist/cli.d.mts

@@ -1 +0,0 @@
-#!/usr/bin/env node

package/dist/index.d.mts

@@ -1,17 +0,0 @@
-import { GuardScannerConstructor, ScannerOptions, GuardScannerInstance, RuntimeCheckStats, RuntimeDecision } from './types.mjs';
-export { CapabilityMetrics, CustomRule, Finding, GuardMode, McpRequest, PluginConfig, SarifReport, ScanReport, ScanResult, Severity } from './types.mjs';
-
-declare const GuardScanner: GuardScannerConstructor;
-declare const VERSION: string;
-declare const THRESHOLDS: Record<string, unknown>;
-declare const SEVERITY_WEIGHTS: Record<string, number>;
-declare const scanToolCall: (toolName: string, params: Record<string, unknown> | string, options?: Record<string, unknown>) => RuntimeDecision;
-declare const RUNTIME_CHECKS: Record<string, unknown>[];
-declare const getCheckStats: () => RuntimeCheckStats;
-declare const LAYER_NAMES: Record<number, string>;
-declare const MCPServer: new () => unknown;
-declare const startServer: () => void;
-declare const TOOLS: Record<string, unknown>[];
-declare function createScanner(options?: ScannerOptions): GuardScannerInstance;
-
-export { GuardScanner, GuardScannerConstructor, GuardScannerInstance, LAYER_NAMES, MCPServer, RUNTIME_CHECKS, RuntimeCheckStats, RuntimeDecision, SEVERITY_WEIGHTS, ScannerOptions, THRESHOLDS, TOOLS, VERSION, createScanner, getCheckStats, scanToolCall, startServer };

package/dist/mcp-server.d.mts

@@ -1 +0,0 @@
-#!/usr/bin/env node