@karmaniverous/jeeves-watcher-openclaw 0.16.1 → 0.17.0

package/dist/src/apiTool.d.ts

@@ -1,6 +1,6 @@
 /**
  * @module plugin/apiTool
- * Generic HTTP-backed watcher tool registration: config shape, request helpers, and ok/connectionFail wrapping.
+ * Generic HTTP-backed watcher tool registration: config shape, request helpers, and ok/connectionFail wrapping. Requests carry the bearer key (if configured) via `requestJson`.
  */
 import { type PluginApi, type ToolDescriptor } from '@karmaniverous/jeeves';
 /**
@@ -29,8 +29,16 @@ export interface ApiToolConfig {
     /** Build the request: return [endpoint, body?]. No body = GET. */
     buildRequest: (params: Record<string, unknown>) => [string, unknown?];
 }
-/** Register a single API tool with standard try/catch + ok/connectionFail. */
-export declare function registerApiTool(api: PluginApi, baseUrl: string, config: ApiToolConfig): void;
+/** API base URL, or a resolver evaluated on every call. */
+export type BaseUrlSource = string | (() => string);
+/**
+ * Register a single API tool with standard try/catch + ok/connectionFail.
+ *
+ * @remarks
+ * The bearer key is resolved from `api` ({@link getApiKey}) on every call,
+ * so a key set after registration takes effect without re-registering.
+ */
+export declare function registerApiTool(api: PluginApi, baseUrlSource: BaseUrlSource, config: ApiToolConfig): void;
 /** Build a query string from defined params. */
 export declare function buildQuery(params: Record<string, unknown>, keys: string[]): string;
 /** Pick defined keys from params into a body object. */

package/dist/src/auth.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * @module plugin/auth.test
+ * Plugin-level bearer-key tests through the real entry point: every HTTP tool sends the key when configured and none when unset; the key never reaches logs or tool results.
+ */
+export {};

package/dist/src/configTools.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @module plugin/configTools
+ * Watcher-owned `watcher_config` and `watcher_config_apply` tools: same names, parameters and requests as the core toolset's, but sent through the plugin HTTP helper so they carry the bearer key.
+ *
+ * @remarks
+ * Core's `createPluginToolset` cannot attach request headers, so its two
+ * authenticated HTTP tools are replaced by these (see {@link CORE_TOOLS_REPLACED}).
+ * `watcher_status` stays with core: `GET /status` is always open.
+ */
+import type { ApiToolConfig } from './apiTool.js';
+/** Core toolset tools that this module replaces. */
+export declare const CORE_TOOLS_REPLACED: ReadonlySet<string>;
+/** `watcher_config` and `watcher_config_apply`, as API tool configs. */
+export declare const configToolConfigs: ApiToolConfig[];

package/dist/src/configTools.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * @module plugin/configTools.test
+ * watcher_config and watcher_config_apply build the same requests as the core tools: GET /config (optional URL-encoded JSONPath) and POST /config/apply with the config wrapped as `patch`; a missing config is rejected before any request.
+ */
+export {};

package/dist/src/constants.d.ts

@@ -2,7 +2,7 @@
  * @module plugin/constants
  * Shared constants for the OpenClaw plugin package.
  */
-export { COMPONENT_NAME, DEFAULT_PORT, PLUGIN_PACKAGE, SERVICE_PACKAGE, } from '@karmaniverous/jeeves-watcher-core';
+export { API_KEY_ENV_VAR, COMPONENT_NAME, DEFAULT_PORT, PLUGIN_PACKAGE, SERVICE_PACKAGE, } from '@karmaniverous/jeeves-watcher-core';
 /** Plugin identifier used in OpenClaw config (`plugins.entries.<id>`). */
 export declare const PLUGIN_ID = "jeeves-watcher-openclaw";
 /** Default watcher API base URL. */

package/dist/src/helpers.d.ts

@@ -2,9 +2,10 @@
  * Watcher-specific convenience wrappers over `@karmaniverous/jeeves` core SDK.
  *
  * @remarks
- * Only watcher-specific resolution logic lives here. Core SDK types and
- * utilities (`PluginApi`, `ToolResult`, `ok`, `connectionFail`, `fetchJson`,
- * `postJson`) should be imported directly from `@karmaniverous/jeeves`.
+ * Only watcher-specific resolution logic (API URL, API key, config root)
+ * lives here. Core SDK types and utilities (`PluginApi`, `ToolResult`, `ok`,
+ * `connectionFail`) should be imported directly from `@karmaniverous/jeeves`;
+ * watcher API requests go through `requestJson` (`./http.js`).
  *
  * @module plugin/helpers
  */
@@ -18,6 +19,17 @@ import { type PluginApi } from '@karmaniverous/jeeves';
  * `DEFAULT_API_URL`. Safe to call per tool invocation.
  */
 export declare function getApiUrl(api: PluginApi): string;
+/**
+ * Resolve the watcher API bearer key, if configured.
+ *
+ * @remarks
+ * Resolution order: plugin-scoped config (`api.pluginConfig.apiKey`), then
+ * `plugins.entries.<id>.config.apiKey`, then `JEEVES_WATCHER_API_KEY`. Blank
+ * values count as unset. Resolved per request; never logged.
+ *
+ * @returns The key, or `undefined` when unset (requests carry no header).
+ */
+export declare function getApiKey(api: PluginApi): string | undefined;
 /**
  * Resolve the platform config root path, if configured.
  *

package/dist/src/http.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @module plugin/http
+ * The plugin's single HTTP helper for watcher API calls: JSON GET/POST via `fetch` with the core bearer header and the core error mapping (errors carry the server `code`; 401 adds key guidance). Never logs the key.
+ */
+/** Where the plugin reads its API key from (named in 401 guidance). */
+export declare const PLUGIN_KEY_SOURCES = "plugins.entries.jeeves-watcher-openclaw.config.apiKey or the JEEVES_WATCHER_API_KEY env var";
+/**
+ * Call the watcher API and return the parsed JSON body.
+ *
+ * @param url - Full request URL.
+ * @param body - JSON body; `undefined` sends a GET, anything else a POST.
+ * @param apiKey - Bearer key; `undefined` sends no `Authorization` header.
+ * @returns Parsed JSON response body.
+ * @throws On `401` with core `unauthorizedMessage` (naming
+ *   {@link PLUGIN_KEY_SOURCES}); on any other non-OK status with
+ *   `HTTP <status> <code>: <message>` (core `httpError`); network errors
+ *   propagate unchanged.
+ */
+export declare function requestJson(url: string, body: unknown, apiKey: string | undefined): Promise<unknown>;

package/dist/src/http.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * @module plugin/http.test
+ * Unit tests for the plugin HTTP helper: bearer header presence/absence, unchanged unauthenticated request shape, 401 guidance naming the plugin key sources without the key, other errors carrying the server code.
+ */
+export {};

package/dist/src/toolGating.d.ts

@@ -7,16 +7,20 @@
  * error only when its implementation actually reads `configRoot`. Tools
  * that only call the service HTTP API keep working without it.
  *
- * Audit of the core standard toolset (`createPluginToolset`, core 0.6.0-7):
- * - `watcher_status`, `watcher_config`, `watcher_config_apply`: HTTP only
- *   (`{apiUrl}/…`, resolved per call).
- * - `watcher_service`: only `install` reads `configRoot`
- *   (`createServiceManager` → `resolveConfigFilePath` →
+ * Audit of the tools the plugin registers:
+ * - `watcher_status` (core standard toolset, `createPluginToolset`): HTTP
+ *   only (`{apiUrl}/status`, resolved per call).
+ * - `watcher_config`, `watcher_config_apply`: implemented by the plugin
+ *   (`configTools.ts`, replacing the core ones so the request carries the
+ *   `Authorization: Bearer` key); HTTP only.
+ * - `watcher_service` (core standard toolset): only `install` reads
+ *   `configRoot` (`createServiceManager` → `resolveConfigFilePath` →
  *   `getComponentConfigDir`); the other actions query or drive the OS
  *   service manager by service name.
  *
- * The 14 domain tools call `{apiUrl}/…` via `fetchJson`/`postJson` and are
- * never gated.
+ * The 14 domain tools (7 in `watcherTools.ts`, 7 VCS tools in
+ * `vcsTools.ts`) call the service API via `registerApiTool` →
+ * `requestJson` and are never gated.
  */
 /** Decides, per call, whether a tool invocation reads `configRoot`. */
 export type ConfigRootPredicate = (params: Record<string, unknown> | undefined) => boolean;

package/dist/src/watcherComponent.d.ts

@@ -3,8 +3,10 @@
  * Jeeves component descriptor for the watcher OpenClaw plugin.
  *
  * @remarks
- * Feeds `createPluginToolset()` (`watcher_status`, `watcher_config`,
- * `watcher_config_apply`, `watcher_service`). The service descriptor
+ * Feeds `createPluginToolset()`, of which the plugin registers
+ * `watcher_status` and `watcher_service`; its `watcher_config` and
+ * `watcher_config_apply` are replaced by the plugin's own (`configTools.ts`,
+ * which send the API key). The service descriptor
  * (`packages/service/src/descriptor.ts`) is the canonical source for the
  * config schema and CLI commands.
  */

package/dist/src/watcherTools.d.ts

@@ -3,6 +3,7 @@
  * Domain-specific watcher tool registrations (14 tools) for the OpenClaw plugin.
  */
 import { type PluginApi } from '@karmaniverous/jeeves';
+import { type BaseUrlSource } from './apiTool.js';
 /**
  * Register the 14 domain-specific watcher_* tools with the OpenClaw plugin API.
  *
@@ -11,5 +12,10 @@ import { type PluginApi } from '@karmaniverous/jeeves';
  * OpenClaw Tool Search keeps them model-visible: semantic search must be a
  * direct tool or the model reaches for grep first. All other tools remain
  * catalog-eligible.
+ *
+ * @param api - Plugin API.
+ * @param baseUrl - API base URL, or a getter resolved on every call (so a
+ *   changed `apiUrl` takes effect without re-registering, as for the config
+ *   tools).
  */
-export declare function registerWatcherTools(api: PluginApi, baseUrl: string): void;
+export declare function registerWatcherTools(api: PluginApi, baseUrl: BaseUrlSource): void;

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "jeeves-watcher-openclaw",
   "name": "Jeeves Watcher",
   "description": "Semantic search, metadata enrichment, and instance administration for a jeeves-watcher deployment.",
-  "version": "0.16.1",
+  "version": "0.17.0",
   "skills": ["dist/skills/jeeves-watcher"],
   "configSchema": {
     "type": "object",
@@ -13,6 +13,10 @@
         "description": "jeeves-watcher API base URL",
         "default": "http://127.0.0.1:1936"
       },
+      "apiKey": {
+        "type": "string",
+        "description": "Bearer key sent as Authorization: Bearer <key> on every watcher API request; must match the service's api.apiKey. Falls back to the JEEVES_WATCHER_API_KEY env var. Unset: no header."
+      },
       "configRoot": {
         "type": "string",
         "description": "Platform config root path (e.g. /srv/jeeves/config). No default: set it here (jeeves install --config-root) or via the JEEVES_CONFIG_ROOT env var."
@@ -46,6 +50,11 @@
       "label": "Watcher API URL",
       "placeholder": "http://127.0.0.1:1936"
     },
+    "apiKey": {
+      "label": "Watcher API key",
+      "help": "Sent as a bearer token; matches the service's api.apiKey. Leave unset when the API has no key.",
+      "sensitive": true
+    },
     "configRoot": {
       "label": "Config root",
       "placeholder": "/path/to/config"

package/package.json

@@ -4,22 +4,22 @@
     "url": "https://github.com/karmaniverous/jeeves-watcher/issues"
   },
   "dependencies": {
-    "@karmaniverous/jeeves": "0.6.0",
-    "@karmaniverous/jeeves-watcher-core": "^0.3.1"
+    "@karmaniverous/jeeves": "0.7.0",
+    "@karmaniverous/jeeves-watcher-core": "^0.4.0"
   },
   "description": "OpenClaw plugin for jeeves-watcher — semantic search and metadata enrichment tools",
   "devDependencies": {
-    "@dotenvx/dotenvx": "^2.30.0",
+    "@dotenvx/dotenvx": "^2.35.0",
     "@rollup/plugin-commonjs": "^29.0.3",
     "@rollup/plugin-json": "^6.1.0",
     "@rollup/plugin-node-resolve": "^16.0.3",
     "@rollup/plugin-typescript": "^12.3.0",
     "cross-env": "^10.1.0",
-    "knip": "^6.38.0",
-    "release-it": "^21.1.0",
-    "rollup": "^4.63.5",
+    "knip": "^6.41.0",
+    "release-it": "^21.1.1",
+    "rollup": "^4.64.6",
     "tslib": "^2.8.1",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.4"
   },
   "engines": {
     "node": ">=22.13"
@@ -67,7 +67,9 @@
       "tagName": "openclaw/${version}"
     },
     "github": {
-      "release": true
+      "release": true,
+      "releaseName": "${name.split('/').pop()}@${version}",
+      "releaseNotes": "npx git-cliff --tag openclaw/${version} --unreleased --strip header"
     },
     "hooks": {
       "after:bump": [
@@ -88,7 +90,7 @@
         "git switch ${branchName}"
       ],
       "before:npm:release": [
-        "npx git-cliff -o CHANGELOG.md",
+        "npx git-cliff --tag openclaw/${version} -o CHANGELOG.md",
         "git add -A"
       ]
     },
@@ -115,5 +117,5 @@
   },
   "type": "module",
   "types": "dist/index.d.ts",
-  "version": "0.16.1"
+  "version": "0.17.0"
 }