@id-wispera/core 0.1.0

package/dist/providers/openclaw.js

@@ -0,0 +1,712 @@
+/**
+ * ID Wispera OpenClaw Provider
+ * Specialized scanner for OpenClaw credential locations
+ */
+import { homedir } from 'os';
+import { join } from 'path';
+import { sortByRisk, getRiskEmoji, getRiskLabel, } from '../locations.js';
+// ============================================================================
+// OpenClaw Path Constants
+// ============================================================================
+export const OPENCLAW_BASE_PATH = join(homedir(), '.openclaw');
+export const OPENCLAW_PATHS = {
+    /** Base OpenClaw directory */
+    base: OPENCLAW_BASE_PATH,
+    /** WhatsApp credentials directory */
+    whatsapp: join(OPENCLAW_BASE_PATH, 'credentials', 'whatsapp'),
+    /** Main credentials directory */
+    credentials: join(OPENCLAW_BASE_PATH, 'credentials'),
+    /** Agents directory */
+    agents: join(OPENCLAW_BASE_PATH, 'agents'),
+    /** Main config file */
+    config: join(OPENCLAW_BASE_PATH, 'openclaw.json'),
+    /** OAuth tokens */
+    oauth: join(OPENCLAW_BASE_PATH, 'credentials', 'oauth.json'),
+};
+// ============================================================================
+// OpenClaw Detection
+// ============================================================================
+/**
+ * Check if OpenClaw is installed
+ */
+export async function isOpenClawInstalled() {
+    const fs = await import('fs/promises');
+    try {
+        await fs.access(OPENCLAW_BASE_PATH);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Check file permissions and return warning if insecure
+ */
+export async function checkFilePermissions(filePath) {
+    const fs = await import('fs/promises');
+    try {
+        const stats = await fs.stat(filePath);
+        const mode = stats.mode;
+        // Check if world or group readable (not 600 or 700)
+        const worldReadable = (mode & 0o004) !== 0;
+        const groupReadable = (mode & 0o040) !== 0;
+        if (worldReadable) {
+            return `File is world-readable (mode: ${(mode & 0o777).toString(8)}). Run: chmod 600 "${filePath}"`;
+        }
+        if (groupReadable) {
+            return `File is group-readable (mode: ${(mode & 0o777).toString(8)}). Run: chmod 600 "${filePath}"`;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Check directory permissions
+ */
+export async function checkDirectoryPermissions(dirPath) {
+    const fs = await import('fs/promises');
+    try {
+        const stats = await fs.stat(dirPath);
+        const mode = stats.mode;
+        const worldReadable = (mode & 0o004) !== 0;
+        const groupReadable = (mode & 0o040) !== 0;
+        if (worldReadable || groupReadable) {
+            return `Directory has insecure permissions (mode: ${(mode & 0o777).toString(8)}). Run: chmod 700 "${dirPath}"`;
+        }
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Scan all OpenClaw credential locations
+ */
+export async function scanOpenClaw() {
+    const fs = await import('fs/promises');
+    const result = {
+        installed: false,
+        installPath: OPENCLAW_BASE_PATH,
+        credentials: [],
+        locationResults: [],
+        summary: {
+            total: 0,
+            governed: 0,
+            criticalCount: 0,
+            highCount: 0,
+            mediumCount: 0,
+            lowCount: 0,
+        },
+        permissionWarnings: [],
+        unreadablePaths: [],
+    };
+    // Check if OpenClaw is installed
+    result.installed = await isOpenClawInstalled();
+    if (!result.installed) {
+        return result;
+    }
+    // Check base directory permissions
+    const baseDirWarning = await checkDirectoryPermissions(OPENCLAW_BASE_PATH);
+    if (baseDirWarning) {
+        result.permissionWarnings.push(baseDirWarning);
+    }
+    // Scan each location
+    await Promise.all([
+        scanWhatsAppCredentials(result, fs),
+        scanChannelAllowlists(result, fs),
+        scanAuthProfiles(result, fs),
+        scanOAuthTokens(result, fs),
+        scanOpenClawConfig(result, fs),
+    ]);
+    // Calculate summary
+    for (const cred of result.credentials) {
+        result.summary.total++;
+        switch (cred.classification.riskLevel) {
+            case 'critical':
+                result.summary.criticalCount++;
+                break;
+            case 'high':
+                result.summary.highCount++;
+                break;
+            case 'medium':
+                result.summary.mediumCount++;
+                break;
+            case 'low':
+                result.summary.lowCount++;
+                break;
+        }
+    }
+    // Sort credentials by risk
+    result.credentials = sortByRisk(result.credentials);
+    return result;
+}
+/**
+ * Scan WhatsApp credentials
+ */
+async function scanWhatsAppCredentials(result, fs) {
+    const locationResult = {
+        path: OPENCLAW_PATHS.whatsapp,
+        exists: false,
+        readable: false,
+        credentials: [],
+    };
+    try {
+        await fs.access(OPENCLAW_PATHS.whatsapp);
+        locationResult.exists = true;
+        const accounts = await fs.readdir(OPENCLAW_PATHS.whatsapp);
+        locationResult.readable = true;
+        for (const accountId of accounts) {
+            const credsPath = join(OPENCLAW_PATHS.whatsapp, accountId, 'creds.json');
+            try {
+                const content = await fs.readFile(credsPath, 'utf-8');
+                const permWarning = await checkFilePermissions(credsPath);
+                const cred = parseWhatsAppCreds(credsPath, content, accountId);
+                if (cred) {
+                    if (permWarning) {
+                        cred.insecurePermissions = true;
+                        result.permissionWarnings.push(permWarning);
+                    }
+                    locationResult.credentials.push(cred);
+                    result.credentials.push(cred);
+                }
+            }
+            catch (err) {
+                if (err.code === 'EACCES') {
+                    result.unreadablePaths.push({ path: credsPath, error: 'Permission denied' });
+                }
+            }
+        }
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            // Directory doesn't exist, that's fine
+        }
+        else if (err.code === 'EACCES') {
+            locationResult.error = 'Permission denied';
+            result.unreadablePaths.push({ path: OPENCLAW_PATHS.whatsapp, error: 'Permission denied' });
+        }
+    }
+    result.locationResults.push(locationResult);
+}
+/**
+ * Parse WhatsApp credentials file
+ */
+function parseWhatsAppCreds(filePath, content, accountId) {
+    try {
+        const data = JSON.parse(content);
+        const phoneNumber = data.me?.id?.split(':')[0] || accountId;
+        const botName = data.me?.name || 'Unknown';
+        return {
+            provider: 'openclaw',
+            filePath,
+            classification: {
+                name: `WhatsApp Session (${accountId})`,
+                credentialType: 'session-keys',
+                visaType: 'access',
+                riskLevel: 'high',
+                platforms: ['openclaw', 'whatsapp'],
+                tags: ['openclaw', 'whatsapp', 'session', 'imported'],
+                issuingAuthority: 'OpenClaw (self-managed)',
+            },
+            rawValue: content,
+            metadata: {
+                accountId,
+                phoneNumber,
+                botName,
+                registrationId: data.registrationId,
+                hasNoiseKey: !!data.noiseKey,
+                hasSignedIdentityKey: !!data.signedIdentityKey,
+            },
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Scan channel allowlists
+ */
+async function scanChannelAllowlists(result, fs) {
+    const locationResult = {
+        path: OPENCLAW_PATHS.credentials,
+        exists: false,
+        readable: false,
+        credentials: [],
+    };
+    try {
+        await fs.access(OPENCLAW_PATHS.credentials);
+        locationResult.exists = true;
+        const files = await fs.readdir(OPENCLAW_PATHS.credentials);
+        locationResult.readable = true;
+        for (const file of files) {
+            if (file.endsWith('-allowFrom.json')) {
+                const filePath = join(OPENCLAW_PATHS.credentials, file);
+                try {
+                    const content = await fs.readFile(filePath, 'utf-8');
+                    const channel = file.replace('-allowFrom.json', '');
+                    const cred = parseAllowlist(filePath, content, channel);
+                    if (cred) {
+                        const permWarning = await checkFilePermissions(filePath);
+                        if (permWarning) {
+                            cred.insecurePermissions = true;
+                            result.permissionWarnings.push(permWarning);
+                        }
+                        locationResult.credentials.push(cred);
+                        result.credentials.push(cred);
+                    }
+                }
+                catch (err) {
+                    if (err.code === 'EACCES') {
+                        result.unreadablePaths.push({ path: filePath, error: 'Permission denied' });
+                    }
+                }
+            }
+        }
+    }
+    catch (err) {
+        if (err.code === 'EACCES') {
+            locationResult.error = 'Permission denied';
+            result.unreadablePaths.push({ path: OPENCLAW_PATHS.credentials, error: 'Permission denied' });
+        }
+    }
+    result.locationResults.push(locationResult);
+}
+/**
+ * Parse channel allowlist file
+ */
+function parseAllowlist(filePath, content, channel) {
+    try {
+        const data = JSON.parse(content);
+        const pairedCount = Object.keys(data).length;
+        return {
+            provider: 'openclaw',
+            filePath,
+            classification: {
+                name: `Pairing: ${channel} (${pairedCount} paired users)`,
+                credentialType: 'custom',
+                visaType: 'access',
+                riskLevel: 'low',
+                platforms: ['openclaw', channel],
+                tags: ['openclaw', channel, 'allowlist', 'imported'],
+                issuingAuthority: 'OpenClaw (self-managed)',
+            },
+            rawValue: content,
+            metadata: {
+                channel,
+                pairedCount,
+                pairedUsers: Object.entries(data).map(([id, info]) => ({
+                    id,
+                    name: info.name,
+                    pairedAt: info.pairedAt,
+                })),
+            },
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Scan auth profiles (LLM API keys)
+ */
+async function scanAuthProfiles(result, fs) {
+    const locationResult = {
+        path: OPENCLAW_PATHS.agents,
+        exists: false,
+        readable: false,
+        credentials: [],
+    };
+    try {
+        await fs.access(OPENCLAW_PATHS.agents);
+        locationResult.exists = true;
+        const agents = await fs.readdir(OPENCLAW_PATHS.agents);
+        locationResult.readable = true;
+        for (const agentId of agents) {
+            const authProfilesPath = join(OPENCLAW_PATHS.agents, agentId, 'agent', 'auth-profiles.json');
+            try {
+                const content = await fs.readFile(authProfilesPath, 'utf-8');
+                const creds = parseAuthProfiles(authProfilesPath, content, agentId);
+                for (const cred of creds) {
+                    const permWarning = await checkFilePermissions(authProfilesPath);
+                    if (permWarning) {
+                        cred.insecurePermissions = true;
+                        if (!result.permissionWarnings.includes(permWarning)) {
+                            result.permissionWarnings.push(permWarning);
+                        }
+                    }
+                    locationResult.credentials.push(cred);
+                    result.credentials.push(cred);
+                }
+            }
+            catch (err) {
+                if (err.code === 'EACCES') {
+                    result.unreadablePaths.push({ path: authProfilesPath, error: 'Permission denied' });
+                }
+                // ENOENT is fine - agent may not have auth profiles
+            }
+        }
+    }
+    catch (err) {
+        if (err.code === 'EACCES') {
+            locationResult.error = 'Permission denied';
+            result.unreadablePaths.push({ path: OPENCLAW_PATHS.agents, error: 'Permission denied' });
+        }
+    }
+    result.locationResults.push(locationResult);
+}
+/**
+ * Parse auth profiles file
+ */
+function parseAuthProfiles(filePath, content, agentId) {
+    const credentials = [];
+    try {
+        const data = JSON.parse(content);
+        for (const [provider, profile] of Object.entries(data)) {
+            if (profile.type === 'api-key' && profile.key) {
+                const keyPreview = profile.key.substring(0, 10) + '...' + profile.key.substring(profile.key.length - 4);
+                credentials.push({
+                    provider: 'openclaw',
+                    filePath,
+                    classification: {
+                        name: `${capitalizeFirst(provider)} API Key (${keyPreview})`,
+                        credentialType: 'api-key',
+                        visaType: 'privilege',
+                        riskLevel: 'critical',
+                        platforms: ['openclaw', 'mcp', provider],
+                        tags: ['openclaw', provider, 'api-key', 'llm', 'imported'],
+                        issuingAuthority: 'OpenClaw (self-managed)',
+                        context: { agentId, model: profile.model },
+                    },
+                    rawValue: profile.key,
+                    metadata: {
+                        agentId,
+                        provider,
+                        model: profile.model,
+                        keyType: profile.type,
+                    },
+                });
+            }
+        }
+    }
+    catch {
+        // Invalid JSON
+    }
+    return credentials;
+}
+/**
+ * Scan OAuth tokens
+ */
+async function scanOAuthTokens(result, fs) {
+    const locationResult = {
+        path: OPENCLAW_PATHS.oauth,
+        exists: false,
+        readable: false,
+        credentials: [],
+    };
+    try {
+        const content = await fs.readFile(OPENCLAW_PATHS.oauth, 'utf-8');
+        locationResult.exists = true;
+        locationResult.readable = true;
+        const permWarning = await checkFilePermissions(OPENCLAW_PATHS.oauth);
+        const creds = parseOAuthTokens(OPENCLAW_PATHS.oauth, content);
+        for (const cred of creds) {
+            if (permWarning) {
+                cred.insecurePermissions = true;
+                if (!result.permissionWarnings.includes(permWarning)) {
+                    result.permissionWarnings.push(permWarning);
+                }
+            }
+            locationResult.credentials.push(cred);
+            result.credentials.push(cred);
+        }
+    }
+    catch (err) {
+        if (err.code === 'EACCES') {
+            locationResult.error = 'Permission denied';
+            result.unreadablePaths.push({ path: OPENCLAW_PATHS.oauth, error: 'Permission denied' });
+        }
+        // ENOENT is fine
+    }
+    result.locationResults.push(locationResult);
+}
+/**
+ * Parse OAuth tokens file
+ */
+function parseOAuthTokens(filePath, content) {
+    const credentials = [];
+    try {
+        const data = JSON.parse(content);
+        for (const [provider, tokens] of Object.entries(data)) {
+            if (tokens.access_token) {
+                const tokenPreview = tokens.access_token.substring(0, 10) + '...';
+                const expiresAt = tokens.expires_at ? new Date(tokens.expires_at * 1000) : undefined;
+                const isExpired = expiresAt && expiresAt < new Date();
+                credentials.push({
+                    provider: 'openclaw',
+                    filePath,
+                    classification: {
+                        name: `${capitalizeFirst(provider)} OAuth (${tokenPreview}${isExpired ? ' EXPIRED' : ''})`,
+                        credentialType: 'oauth-token',
+                        visaType: 'access',
+                        riskLevel: 'medium',
+                        platforms: ['openclaw', provider],
+                        tags: ['openclaw', provider, 'oauth', 'imported', ...(isExpired ? ['expired'] : [])],
+                        issuingAuthority: 'OpenClaw (self-managed)',
+                    },
+                    rawValue: tokens.access_token,
+                    metadata: {
+                        provider,
+                        hasRefreshToken: !!tokens.refresh_token,
+                        tokenType: tokens.token_type,
+                        expiresAt: expiresAt?.toISOString(),
+                        isExpired,
+                    },
+                    expiresAt,
+                });
+            }
+        }
+    }
+    catch {
+        // Invalid JSON
+    }
+    return credentials;
+}
+/**
+ * Scan OpenClaw config file
+ */
+async function scanOpenClawConfig(result, fs) {
+    const locationResult = {
+        path: OPENCLAW_PATHS.config,
+        exists: false,
+        readable: false,
+        credentials: [],
+    };
+    try {
+        const content = await fs.readFile(OPENCLAW_PATHS.config, 'utf-8');
+        locationResult.exists = true;
+        locationResult.readable = true;
+        const permWarning = await checkFilePermissions(OPENCLAW_PATHS.config);
+        const creds = parseOpenClawConfig(OPENCLAW_PATHS.config, content);
+        for (const cred of creds) {
+            if (permWarning) {
+                cred.insecurePermissions = true;
+                if (!result.permissionWarnings.includes(permWarning)) {
+                    result.permissionWarnings.push(permWarning);
+                }
+            }
+            locationResult.credentials.push(cred);
+            result.credentials.push(cred);
+        }
+    }
+    catch (err) {
+        if (err.code === 'EACCES') {
+            locationResult.error = 'Permission denied';
+            result.unreadablePaths.push({ path: OPENCLAW_PATHS.config, error: 'Permission denied' });
+        }
+        // ENOENT is fine
+    }
+    result.locationResults.push(locationResult);
+}
+/**
+ * Parse OpenClaw config file
+ */
+function parseOpenClawConfig(filePath, content) {
+    const credentials = [];
+    try {
+        const data = JSON.parse(content);
+        // Parse channel tokens
+        if (data.channels) {
+            // Telegram
+            if (data.channels.telegram?.token) {
+                const token = data.channels.telegram.token;
+                const tokenPreview = token.substring(0, 7) + '...' + token.substring(token.length - 4);
+                credentials.push({
+                    provider: 'openclaw',
+                    filePath,
+                    classification: {
+                        name: `Telegram Bot Token (${tokenPreview})`,
+                        credentialType: 'bot-token',
+                        visaType: 'access',
+                        riskLevel: 'high',
+                        platforms: ['openclaw', 'telegram'],
+                        tags: ['openclaw', 'telegram', 'bot-token', 'imported'],
+                        issuingAuthority: 'OpenClaw (self-managed)',
+                    },
+                    rawValue: token,
+                    metadata: { channel: 'telegram' },
+                });
+            }
+            // Slack
+            if (data.channels.slack) {
+                if (data.channels.slack.botToken) {
+                    const token = data.channels.slack.botToken;
+                    const tokenPreview = token.substring(0, 10) + '...' + token.substring(token.length - 4);
+                    credentials.push({
+                        provider: 'openclaw',
+                        filePath,
+                        classification: {
+                            name: `Slack Bot Token (${tokenPreview})`,
+                            credentialType: 'bot-token',
+                            visaType: 'access',
+                            riskLevel: 'high',
+                            platforms: ['openclaw', 'slack'],
+                            tags: ['openclaw', 'slack', 'bot-token', 'imported'],
+                            issuingAuthority: 'OpenClaw (self-managed)',
+                        },
+                        rawValue: token,
+                        metadata: { channel: 'slack', tokenType: 'bot' },
+                    });
+                }
+                if (data.channels.slack.appToken) {
+                    const token = data.channels.slack.appToken;
+                    const tokenPreview = token.substring(0, 10) + '...' + token.substring(token.length - 4);
+                    credentials.push({
+                        provider: 'openclaw',
+                        filePath,
+                        classification: {
+                            name: `Slack App Token (${tokenPreview})`,
+                            credentialType: 'bot-token',
+                            visaType: 'access',
+                            riskLevel: 'high',
+                            platforms: ['openclaw', 'slack'],
+                            tags: ['openclaw', 'slack', 'app-token', 'imported'],
+                            issuingAuthority: 'OpenClaw (self-managed)',
+                        },
+                        rawValue: token,
+                        metadata: { channel: 'slack', tokenType: 'app' },
+                    });
+                }
+            }
+            // Discord
+            if (data.channels.discord?.token) {
+                const token = data.channels.discord.token;
+                const tokenPreview = token.substring(0, 10) + '...' + token.substring(token.length - 4);
+                credentials.push({
+                    provider: 'openclaw',
+                    filePath,
+                    classification: {
+                        name: `Discord Bot Token (${tokenPreview})`,
+                        credentialType: 'bot-token',
+                        visaType: 'access',
+                        riskLevel: 'high',
+                        platforms: ['openclaw', 'discord'],
+                        tags: ['openclaw', 'discord', 'bot-token', 'imported'],
+                        issuingAuthority: 'OpenClaw (self-managed)',
+                    },
+                    rawValue: token,
+                    metadata: { channel: 'discord' },
+                });
+            }
+        }
+        // Gateway token
+        if (data.gateway?.token) {
+            const token = data.gateway.token;
+            const tokenPreview = token.substring(0, 6) + '...' + token.substring(token.length - 4);
+            credentials.push({
+                provider: 'openclaw',
+                filePath,
+                classification: {
+                    name: `Gateway Token (${tokenPreview})`,
+                    credentialType: 'api-key',
+                    visaType: 'privilege',
+                    riskLevel: 'high',
+                    platforms: ['openclaw'],
+                    tags: ['openclaw', 'gateway', 'admin', 'imported'],
+                    issuingAuthority: 'OpenClaw (self-managed)',
+                },
+                rawValue: token,
+                metadata: { gatewayPort: data.gateway.port },
+            });
+        }
+    }
+    catch {
+        // Invalid JSON
+    }
+    return credentials;
+}
+/**
+ * Helper to capitalize first letter
+ */
+function capitalizeFirst(str) {
+    return str.charAt(0).toUpperCase() + str.slice(1);
+}
+// ============================================================================
+// Import Helpers
+// ============================================================================
+/**
+ * Convert discovered credential to passport input
+ */
+export function toPassportInput(cred, humanOwner, agentId) {
+    const delegationChain = [
+        {
+            from: humanOwner,
+            to: 'OpenClaw Instance',
+            grantedAt: new Date().toISOString(),
+            scope: ['*'],
+        },
+    ];
+    if (agentId || cred.metadata.agentId) {
+        delegationChain.push({
+            from: 'OpenClaw Instance',
+            to: `Agent: ${agentId || cred.metadata.agentId}`,
+            grantedAt: new Date().toISOString(),
+            scope: ['*'],
+        });
+    }
+    return {
+        name: `OpenClaw - ${cred.classification.name}`,
+        agentId: (agentId || cred.metadata.agentId),
+        credentialType: cred.classification.credentialType,
+        credentialValue: cred.rawValue,
+        visaType: cred.classification.visaType,
+        issuingAuthority: cred.classification.issuingAuthority,
+        scope: ['*'],
+        platforms: cred.classification.platforms,
+        validFrom: new Date().toISOString(),
+        validUntil: cred.expiresAt?.toISOString(),
+        delegationChain,
+        humanOwner,
+        tags: cred.classification.tags,
+        notes: `Imported from OpenClaw: ${cred.filePath}`,
+    };
+}
+// ============================================================================
+// Formatting Helpers (for CLI output)
+// ============================================================================
+/**
+ * Format credential for table display
+ */
+export function formatCredentialRow(cred) {
+    return {
+        credential: cred.classification.name,
+        type: formatCredentialType(cred.classification.credentialType),
+        visaType: formatVisaType(cred.classification.visaType),
+        riskLevel: `${getRiskEmoji(cred.classification.riskLevel)} ${getRiskLabel(cred.classification.riskLevel)}`,
+    };
+}
+function formatCredentialType(type) {
+    const typeMap = {
+        'api-key': 'API Key',
+        'oauth-token': 'OAuth Token',
+        'session-keys': 'Session Keys',
+        'bot-token': 'Bot Token',
+        'private-key': 'Private Key',
+        custom: 'Allowlist',
+        secret: 'Secret',
+    };
+    return typeMap[type] || type;
+}
+function formatVisaType(type) {
+    const typeMap = {
+        access: 'Access Visa',
+        privilege: 'Privilege',
+        data: 'Data',
+        compliance: 'Compliance',
+        ecosystem: 'Ecosystem',
+        custom: 'Custom',
+    };
+    return typeMap[type] || type;
+}
+//# sourceMappingURL=openclaw.js.map