@openclaw/diagnostics-prometheus 2026.8.1 → 2026.8.33

package/dist/index.js

@@ -2,6 +2,7 @@ import { isInternalDiagnosticEventMetadata, redactSensitiveText } from "./api.js
 import { definePluginEntry } from "openclaw/plugin-sdk/plugin-entry";
 import { normalizeDiagnosticLane, normalizeDiagnosticValue } from "openclaw/plugin-sdk/diagnostic-runtime";
 import { asNonNegativeFiniteNumber } from "openclaw/plugin-sdk/number-runtime";
+import { getPluginRuntimeGatewayRequestScope } from "openclaw/plugin-sdk/plugin-runtime";
 import { truncateUtf16Safe } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/diagnostics-prometheus/src/service.ts
 const DURATION_BUCKETS_SECONDS = [
@@ -178,7 +179,8 @@ function createPrometheusMetricStore() {
 	};
 }
 function safeErrorMessage(err) {
-	return truncateUtf16Safe(redactSensitiveText(err instanceof Error ? err.message ?? err.name : String(err)).replaceAll("\0", " ").replace(/[\r\n\t\u2028\u2029]/gu, " "), 500);
+	const message = err instanceof Error ? err.message ?? err.name : String(err);
+	return truncateUtf16Safe(redactSensitiveText(message).replaceAll("\0", " ").replace(/[\r\n\t\u2028\u2029]/gu, " "), 500);
 }
 function shouldRecordDiagnosticEvent(metadata) {
 	return metadata.trusted || isInternalDiagnosticEventMetadata(metadata);
@@ -545,11 +547,28 @@ function recordDiagnosticEvent(store, evt, metadata) {
 		case "payload.large":
 			store.counter("openclaw_payload_large_total", "Oversized payload diagnostics by surface and action.", payloadLargeLabels(evt));
 			store.histogram("openclaw_payload_large_bytes", "Oversized payload byte sizes by surface and action.", payloadLargeLabels(evt), asNonNegativeFiniteNumber(evt.bytes), BYTE_BUCKETS);
-		default:
 	}
 }
+const METRICS_READ_SCOPE = "operator.read";
+const METRICS_READ_IMPLYING_SCOPES = [
+	METRICS_READ_SCOPE,
+	"operator.write",
+	"operator.admin"
+];
+function hasMetricsReadScope() {
+	const runtimeScopes = getPluginRuntimeGatewayRequestScope()?.client?.connect?.scopes;
+	const scopes = Array.isArray(runtimeScopes) ? runtimeScopes : [];
+	return METRICS_READ_IMPLYING_SCOPES.some((scope) => scopes.includes(scope));
+}
 function createMetricsHandler(store) {
 	return (req, res) => {
+		if (!hasMetricsReadScope()) {
+			res.statusCode = 403;
+			res.setHeader("Cache-Control", "no-store");
+			res.setHeader("Content-Type", "text/plain; charset=utf-8");
+			res.end(`missing scope: ${METRICS_READ_SCOPE}`);
+			return true;
+		}
 		if (req.method !== "GET" && req.method !== "HEAD") {
 			res.statusCode = 405;
 			res.setHeader("Allow", "GET, HEAD");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openclaw/diagnostics-prometheus",
-  "version": "2026.8.1",
+  "version": "2026.8.33",
   "description": "OpenClaw diagnostics Prometheus exporter for runtime metrics.",
   "repository": {
     "type": "git",
@@ -18,10 +18,10 @@
       "minHostVersion": ">=2026.4.25"
     },
     "compat": {
-      "pluginApi": ">=2026.8.1"
+      "pluginApi": ">=2026.8.33"
     },
     "build": {
-      "openclawVersion": "2026.8.1"
+      "openclawVersion": "2026.8.33"
     },
     "release": {
       "publishToClawHub": true,
@@ -37,7 +37,7 @@
     "README.md"
   ],
   "peerDependencies": {
-    "openclaw": ">=2026.8.1"
+    "openclaw": ">=2026.8.33"
   },
   "peerDependenciesMeta": {
     "openclaw": {