@lanonasis/recall-forge 1.1.1

package/openclaw.plugin.json

@@ -0,0 +1,315 @@
+{
+  "id": "recall-forge",
+  "kind": "memory",
+  "name": "RecallForge",
+  "version": "1.1.0",
+  "description": "Secret-safe memory and context engine for OpenClaw. Fills both memory and contextEngine slots with tiered semantic recall, credential redaction (30+ patterns), PII masking, and prompt injection protection.",
+  "uiHints": {
+    "apiKey": {
+      "label": "LanOnasis API Key",
+      "sensitive": true,
+      "placeholder": "lan_...",
+      "help": "API key from LanOnasis dashboard (or use ${LANONASIS_API_KEY})"
+    },
+    "baseUrl": {
+      "label": "API Base URL",
+      "advanced": true,
+      "placeholder": "https://api.lanonasis.com"
+    },
+    "projectId": {
+      "label": "Project ID",
+      "help": "Dedicated project per OpenClaw install (or use ${LANONASIS_PROJECT_ID})"
+    },
+    "agentId": {
+      "label": "Agent ID",
+      "help": "Tags memories with this agent_id (default: main)"
+    },
+    "autoRecall": {
+      "label": "Auto-Recall",
+      "help": "Inject relevant memories before each session"
+    },
+    "recallMode": {
+      "label": "Recall Mode",
+      "help": "auto: inject memories automatically on each session start. ondemand: disable auto-injection \u2014 use memory_search manually instead. Recommended for Ollama and small-context models."
+    },
+    "maxRecallChars": {
+      "label": "Max Recall Chars",
+      "advanced": true,
+      "placeholder": "1500",
+      "help": "Hard cap on total injected recall characters. Default: 1500. Ollama / small-context users should set 400\u2013600."
+    },
+    "captureMode": {
+      "label": "Capture Mode",
+      "help": "auto: capture all, hybrid: stricter, explicit: manual only"
+    },
+    "localFallback": {
+      "label": "Local Fallback",
+      "help": "Write Markdown copies to workspace/memory/"
+    },
+    "searchThreshold": {
+      "label": "Search Threshold",
+      "advanced": true,
+      "placeholder": "0.75"
+    },
+    "dedupeThreshold": {
+      "label": "Dedup Threshold",
+      "advanced": true,
+      "placeholder": "0.985",
+      "help": "Similarity threshold used by memory_store duplicate detection"
+    },
+    "maxRecallResults": {
+      "label": "Max Recall Results",
+      "advanced": true,
+      "placeholder": "5"
+    },
+    "memoryMode": {
+      "label": "Memory Mode",
+      "help": "remote: cloud only, local: filesystem only, hybrid: both with cloud primary"
+    },
+    "sharedNamespace": {
+      "label": "Shared Namespace",
+      "help": "Namespace for cross-agent shared memory (leave empty to disable shared recall)"
+    },
+    "syncMode": {
+      "label": "Sync Mode",
+      "advanced": true,
+      "help": "realtime: immediate writes, batch: deferred, manual: explicit only"
+    },
+    "queueOnFailure": {
+      "label": "Queue On Failure",
+      "advanced": true,
+      "help": "Queue writes locally when cloud API is unavailable"
+    },
+    "autoIndexOnFirstUse": {
+      "label": "Auto-Index On First Use",
+      "advanced": true,
+      "help": "Bootstrap agent memory index on first session"
+    },
+    "extractSourceFormats": {
+      "label": "Extract Source Formats",
+      "advanced": true,
+      "help": "Formats accepted by the extract CLI (openclaw-session, markdown, sqlite, etc.)"
+    },
+    "embeddingProvider": {
+      "label": "Embedding Provider",
+      "advanced": true,
+      "help": "Provider for vector embeddings (e.g. openai, ollama, lanonasis)"
+    },
+    "embeddingModel": {
+      "label": "Embedding Model",
+      "advanced": true,
+      "help": "Model name for store-time embeddings (e.g. text-embedding-3-small, nomic-embed-text)"
+    },
+    "queryEmbeddingModel": {
+      "label": "Query Embedding Model",
+      "advanced": true,
+      "help": "Model for query-time embeddings (defaults to embeddingModel if unset)"
+    },
+    "embeddingDimensions": {
+      "label": "Embedding Dimensions",
+      "advanced": true,
+      "help": "Vector dimension count (0 = provider default)"
+    },
+    "embeddingProfileId": {
+      "label": "Embedding Profile ID",
+      "advanced": true,
+      "help": "Stamped into stored metadata for mismatch detection"
+    },
+    "privacyMode": {
+      "label": "Privacy Mode",
+      "help": "off: credentials only, detect: scan PII and tag (no masking), mask: redact credentials + mask PII (default)"
+    },
+    "privacyLocale": {
+      "label": "Privacy Locale",
+      "advanced": true,
+      "placeholder": "US",
+      "help": "Locale used for PII detection rules (US, GB, EU, etc.)"
+    },
+    "privacyNotifyUrl": {
+      "label": "Privacy Notify URL",
+      "advanced": true,
+      "sensitive": true,
+      "placeholder": "https://...",
+      "help": "Webhook endpoint for privacy intervention events (fire-and-forget). Leave empty to disable."
+    },
+    "defaultChannel": {
+      "label": "Default Channel",
+      "advanced": true,
+      "placeholder": "openclaw",
+      "help": "Channel identifier stored in captured memory metadata (or use ${LANONASIS_DEFAULT_CHANNEL})"
+    },
+    "cacheTtlMs": {
+      "label": "Cache TTL (ms)",
+      "advanced": true,
+      "placeholder": "60000",
+      "help": "Client-side search/list cache TTL in milliseconds (default: 60000)"
+    },
+    "cacheMaxSize": {
+      "label": "Cache Max Size",
+      "advanced": true,
+      "placeholder": "50",
+      "help": "Maximum number of cached responses (default: 50)"
+    },
+    "rateLimitMaxReq": {
+      "label": "Rate Limit Max Requests",
+      "advanced": true,
+      "placeholder": "60",
+      "help": "Maximum API requests per rate limit window (default: 60)"
+    },
+    "rateLimitWindowMs": {
+      "label": "Rate Limit Window (ms)",
+      "advanced": true,
+      "placeholder": "60000",
+      "help": "Rate limit rolling window in milliseconds (default: 60000)"
+    }
+  },
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "apiKey": {
+        "type": "string"
+      },
+      "baseUrl": {
+        "type": "string"
+      },
+      "projectId": {
+        "type": "string"
+      },
+      "agentId": {
+        "type": "string"
+      },
+      "autoRecall": {
+        "type": "boolean"
+      },
+      "recallMode": {
+        "type": "string",
+        "enum": [
+          "auto",
+          "ondemand"
+        ]
+      },
+      "maxRecallChars": {
+        "type": "number",
+        "minimum": 100
+      },
+      "captureMode": {
+        "type": "string",
+        "enum": [
+          "auto",
+          "explicit",
+          "hybrid"
+        ]
+      },
+      "localFallback": {
+        "type": "boolean"
+      },
+      "searchThreshold": {
+        "type": "number",
+        "minimum": 0,
+        "maximum": 1
+      },
+      "dedupeThreshold": {
+        "type": "number",
+        "minimum": 0,
+        "maximum": 1
+      },
+      "maxRecallResults": {
+        "type": "number",
+        "minimum": 1,
+        "maximum": 20
+      },
+      "memoryMode": {
+        "type": "string",
+        "enum": [
+          "remote",
+          "local",
+          "hybrid"
+        ]
+      },
+      "sharedNamespace": {
+        "type": "string"
+      },
+      "syncMode": {
+        "type": "string",
+        "enum": [
+          "realtime",
+          "batch",
+          "manual"
+        ]
+      },
+      "queueOnFailure": {
+        "type": "boolean"
+      },
+      "autoIndexOnFirstUse": {
+        "type": "boolean"
+      },
+      "extractSourceFormats": {
+        "type": "array",
+        "items": {
+          "type": "string"
+        }
+      },
+      "embeddingProvider": {
+        "type": "string"
+      },
+      "embeddingModel": {
+        "type": "string"
+      },
+      "queryEmbeddingModel": {
+        "type": "string"
+      },
+      "embeddingDimensions": {
+        "type": "number",
+        "minimum": 0
+      },
+      "embeddingProfileId": {
+        "type": "string"
+      },
+      "privacyMode": {
+        "type": "string",
+        "enum": ["off", "detect", "mask"]
+      },
+      "privacyLocale": {
+        "type": "string"
+      },
+      "privacyNotifyUrl": {
+        "type": "string"
+      },
+      "defaultChannel": {
+        "type": "string"
+      },
+      "cacheTtlMs": {
+        "type": "number",
+        "minimum": 1000
+      },
+      "cacheMaxSize": {
+        "type": "number",
+        "minimum": 1
+      },
+      "rateLimitMaxReq": {
+        "type": "number",
+        "minimum": 1
+      },
+      "rateLimitWindowMs": {
+        "type": "number",
+        "minimum": 1000
+      }
+    },
+    "required": []
+  },
+  "slots": [
+    "memory",
+    "contextEngine"
+  ],
+  "skills": [
+    ".claw/skills"
+  ],
+  "metadata": {
+    "openclaw": {
+      "requires": {
+        "config": ["apiKey", "projectId"]
+      }
+    }
+  }
+}

package/package.json

@@ -0,0 +1,90 @@
+{
+  "name": "@lanonasis/recall-forge",
+  "version": "1.1.1",
+  "description": "RecallForge — secret-safe memory and context engine plugin for OpenClaw. Fills both memory and contextEngine slots with tiered semantic recall, 30+ pattern credential redaction, and prompt injection protection.",
+  "type": "module",
+  "license": "MIT",
+  "engines": {
+    "node": ">=20"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js",
+    "./extraction": "./dist/extraction/index.js"
+  },
+  "files": [
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    "dist/",
+    "openclaw.plugin.json",
+    "SETUP.md",
+    "setup/",
+    ".claw/"
+  ],
+  "dependencies": {
+    "@lanonasis/privacy-sdk": "^1.0.0",
+    "undici": "^7.24.6"
+  },
+  "peerDependencies": {
+    "openclaw": "latest"
+  },
+  "peerDependenciesMeta": {
+    "openclaw": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "typescript": "^5.9.3",
+    "vitest": "^4.1.0"
+  },
+  "scripts": {
+    "clean": "rm -rf dist",
+    "build": "npm run clean && tsc -p tsconfig.build.json",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run typecheck && npm run test",
+    "typecheck": "tsc --noEmit --skipLibCheck",
+    "test": "vitest run",
+    "pack:dry-run": "npm pack --dry-run",
+    "verify:release": "npm run typecheck && npm run test && npm run build && npm run pack:dry-run",
+    "migrate": "node --import tsx migrate.ts"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/thefixer3x/lan-onasis-monorepo.git",
+    "directory": "packages/recall-forge"
+  },
+  "homepage": "https://github.com/lanonasis/lanonasis-maas/tree/main/packages/recall-forge#readme",
+  "bugs": {
+    "url": "https://github.com/lanonasis/lanonasis-maas/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "openclaw",
+    "openclaw-plugin",
+    "memory",
+    "context-engine",
+    "plugin",
+    "lanonasis",
+    "recall-forge",
+    "neuro-forge",
+    "semantic-search",
+    "secret-protection",
+    "credential-redaction",
+    "privacy-first",
+    "memory-safety",
+    "context-protection"
+  ],
+  "openclaw": {
+    "extensions": [
+      "./dist/index.js"
+    ],
+    "slots": [
+      "memory",
+      "contextEngine"
+    ]
+  }
+}

package/setup/agents-memory.md

@@ -0,0 +1,63 @@
+# RecallForge — AGENTS.md Snippet
+
+Paste this section into your workspace AGENTS.md to declare RecallForge memory tools as always-available capabilities. These tools are registered by the `recall-forge` plugin and do NOT require the `optional` flag — they are persistent by default.
+
+---
+
+## Memory Tools (RecallForge / LanOnasis MaaS)
+
+You have access to cloud-backed semantic memory via RecallForge. All content stored or retrieved passes through secret redaction — credentials, tokens, and connection strings are never written to memory storage.
+
+### Available Tools
+
+| Tool | Purpose | When to Use |
+|------|---------|-------------|
+| `memory_search` | Semantic search through stored memories | Before starting work — check what you already know about this topic |
+| `memory_store` | Store a new memory or update an existing one | After discovering insights, decisions, or patterns worth preserving |
+| `memory_get` | Fetch full memory content by ID | When search results show a relevant memory you need in full |
+| `memory_forget` | Delete a memory by ID or semantic query | When a memory is outdated, wrong, or superseded |
+
+### Memory Workflow
+
+1. **Recall before acting** — At session start, `memory_search` for context related to the current workspace and task. This prevents re-learning what was already established.
+2. **Capture during work** — When you make architectural decisions, solve non-obvious bugs, or discover project conventions, use `memory_store` to persist them.
+3. **Deduplicate automatically** — `memory_store` checks for 0.985+ similarity duplicates before creating a new memory. When called with an `id`, it updates that memory directly.
+4. **Forget stale knowledge** — If you discover a stored memory is wrong or outdated, use `memory_forget` to clean it up.
+
+### Memory Types
+
+When storing, the type is auto-detected but you can override:
+- `context` — Session context, current task state
+- `project` — Project-specific conventions, architecture decisions
+- `knowledge` — Reusable technical knowledge
+- `reference` — External references, documentation links
+- `personal` — User preferences, workflow habits
+- `workflow` — Process patterns, command sequences
+
+### Secret Protection
+
+RecallForge redacts 30+ credential patterns before any content is stored or injected into context. You do not need to manually sanitize content before calling `memory_store`. If a stored memory shows `[REDACTED_<TYPE>]`, that value was a detected secret and was intentionally removed.
+
+### Constraints
+
+- Memories are scoped to the configured project ID and agent ID
+- Context engine injects relevant memories into the prompt window on demand
+- Auto-recall also injects memories before each session (configurable via `recallMode`)
+- `maxRecallChars` caps the total injected block size
+
+### Small-Context / Ollama Users — On-Demand Mode
+
+For models with < 8K context, disable automatic recall injection:
+
+**Plugin config:**
+```json
+"recallMode": "ondemand",
+"maxRecallChars": 500,
+"searchThreshold": 0.80,
+"maxRecallResults": 3
+```
+
+**Add to your AGENTS.md session start instruction:**
+> At the start of every session, call `memory_search` with a short query describing the current task before doing anything else. Example: `memory_search("current project conventions and recent decisions")`.
+
+On-demand mode keeps all four tools available — only the automatic pre-session injection is disabled.

package/setup/heartbeat-memory.md

@@ -0,0 +1,53 @@
+# RecallForge — HEARTBEAT.md Snippet
+
+Paste this section into your workspace HEARTBEAT.md to add periodic MaaS health monitoring.
+
+---
+
+## RecallForge Health
+
+Check LanOnasis MaaS connectivity and memory stats:
+
+```
+openclaw recall status
+```
+
+Expected: `Status: ok | v1.0.0 | project: <project-id>`
+
+If status returns an error:
+
+| Error | Cause | Action |
+|-------|-------|--------|
+| `ETIMEDOUT` | Network issue or DNS resolution failure | Plugin forces IPv4 via undici — restart the agent if it persists |
+| `401 Unauthorized` | API key expired or revoked | Regenerate at the LanOnasis dashboard, update `openclaw.json` |
+| `503 Service Unavailable` | MaaS backend down | Local fallback active — memories written to `workspace/memory/YYYY-MM-DD.md` |
+
+### Memory Stats Check
+
+```
+openclaw recall stats
+```
+
+Monitor for:
+- Memory count trending upward (healthy capture)
+- No memories added in 7+ days (capture may be broken or `captureMode` is `explicit`)
+- Type distribution — mostly `context` suggests capture filter is too loose
+
+### Context Engine Check
+
+When the agent loads, confirm both slots appear in the startup log:
+
+```
+[recall-forge] Ready — slots: memory+contextEngine | ...
+```
+
+If `contextEngine` is missing from the log, check that `"contextEngine": "recall-forge"` is declared in your `plugins.slots` config.
+
+### Alert Conditions
+
+| Condition | Severity | Action |
+|-----------|----------|--------|
+| MaaS unreachable for 3+ heartbeats | WARN | Check network, verify API key |
+| Zero memories stored in 7+ days | INFO | Review `captureMode`, check hooks |
+| Memory count > 1000 with no cleanup | INFO | Consider archival or type-based pruning |
+| `[recall-forge]` not in plugin startup log | ERROR | Plugin may not have loaded — check `openclaw.json` and `allow` list |