@opencompress/opencompress 1.1.0 → 1.2.0

package/dist/index.js

@@ -34,12 +34,18 @@ var OPENCOMPRESS_MODELS = [
   // Mistral
   { id: "mistralai/mistral-large-2411", name: "Mistral Large (Compressed)", reasoning: false, input: ["text"], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, contextWindow: 131072, maxTokens: 8192 }
 ];
-function buildProviderModels(baseUrl) {
-  return {
+function buildProviderModels(baseUrl, upstreamKey, upstreamBaseUrl) {
+  const config = {
     baseUrl: `${baseUrl}/v1`,
     api: "openai-completions",
     models: OPENCOMPRESS_MODELS
   };
+  if (upstreamKey || upstreamBaseUrl) {
+    config.headers = {};
+    if (upstreamKey) config.headers["X-Upstream-Key"] = upstreamKey;
+    if (upstreamBaseUrl) config.headers["X-Upstream-Base-Url"] = upstreamBaseUrl;
+  }
+  return config;
 }
 var opencompressProvider = {
   id: "opencompress",
@@ -103,9 +109,11 @@ var plugin = {
   version: VERSION,
   async register(api) {
     const baseUrl = api.pluginConfig?.baseUrl || DEFAULT_BASE_URL;
-    if (baseUrl !== DEFAULT_BASE_URL) {
-      opencompressProvider.models = buildProviderModels(baseUrl);
-    }
+    const existingHeaders = api.config.models?.providers?.opencompress?.headers;
+    const existingUpstreamKey = existingHeaders?.["X-Upstream-Key"];
+    const existingUpstreamBaseUrl = existingHeaders?.["X-Upstream-Base-Url"];
+    const providerModels = buildProviderModels(baseUrl, existingUpstreamKey, existingUpstreamBaseUrl);
+    opencompressProvider.models = providerModels;
     api.registerProvider(opencompressProvider);
     if (!api.config.models) {
       api.config.models = { providers: {} };
@@ -113,7 +121,7 @@ var plugin = {
     if (!api.config.models.providers) {
       api.config.models.providers = {};
     }
-    api.config.models.providers.opencompress = buildProviderModels(baseUrl);
+    api.config.models.providers.opencompress = providerModels;
     api.logger.info("OpenCompress provider registered (20 models, 5-layer compression)");
     api.registerCommand({
       name: "compress-stats",
@@ -175,10 +183,10 @@ var plugin = {
         }
         const upstreamKey = ctx.args?.trim();
         if (!upstreamKey) {
-          const res2 = await fetch(`${baseUrl}/v1/topup`, {
+          const res = await fetch(`${baseUrl}/v1/topup`, {
             headers: { Authorization: `Bearer ${apiKey}` }
           });
-          const data2 = res2.ok ? await res2.json() : null;
+          const data = res.ok ? await res.json() : null;
           return {
             text: [
               "**BYOK (Bring Your Own Key)**",
@@ -191,19 +199,23 @@ var plugin = {
               "  `/compress-byok sk-or-xxx`    \u2014 Connect OpenRouter key",
               "  `/compress-byok off`          \u2014 Switch back to router mode",
               "",
-              data2 ? `**Balance:** $${data2.balance.toFixed(2)}` : ""
+              data ? `**Balance:** $${data.balance.toFixed(2)}` : ""
             ].join("\n")
           };
         }
         if (upstreamKey === "off" || upstreamKey === "disable" || upstreamKey === "router") {
-          const res2 = await fetch(`${baseUrl}/v1/byok`, {
-            method: "DELETE",
-            headers: { Authorization: `Bearer ${apiKey}` }
-          });
-          if (!res2.ok) {
-            return { text: `Failed to switch: HTTP ${res2.status}` };
+          const cleanModels = buildProviderModels(baseUrl);
+          if (api.config.models?.providers) {
+            api.config.models.providers.opencompress = cleanModels;
+          }
+          try {
+            await fetch(`${baseUrl}/v1/byok`, {
+              method: "DELETE",
+              headers: { Authorization: `Bearer ${apiKey}` }
+            });
+          } catch {
           }
-          return { text: "Switched back to **router mode**. We handle LLM routing via OpenRouter." };
+          return { text: "Switched back to **router mode**. Your upstream key has been removed from local config." };
         }
         if (upstreamKey.startsWith("sk-occ-")) {
           return { text: "That's an OpenCompress key. Provide your LLM provider key (OpenAI, Anthropic, etc.)." };
@@ -211,24 +223,42 @@ var plugin = {
         if (upstreamKey.length < 10) {
           return { text: "Key looks too short. Provide your full LLM API key." };
         }
-        const res = await fetch(`${baseUrl}/v1/byok`, {
-          method: "POST",
-          headers: {
-            Authorization: `Bearer ${apiKey}`,
-            "Content-Type": "application/json"
-          },
-          body: JSON.stringify({ upstreamApiKey: upstreamKey })
-        });
-        if (!res.ok) {
-          const err = await res.json().catch(() => ({ error: { message: "Unknown error" } }));
-          return { text: `Failed: ${err.error?.message || res.statusText}` };
+        let provider = "unknown";
+        let upstreamBaseUrl = "";
+        if (upstreamKey.startsWith("sk-proj-") || upstreamKey.startsWith("sk-") && !upstreamKey.startsWith("sk-ant-") && !upstreamKey.startsWith("sk-or-")) {
+          provider = "openai";
+          upstreamBaseUrl = "https://api.openai.com/v1";
+        } else if (upstreamKey.startsWith("sk-ant-")) {
+          provider = "anthropic";
+          upstreamBaseUrl = "https://api.anthropic.com/v1";
+        } else if (upstreamKey.startsWith("sk-or-")) {
+          provider = "openrouter";
+          upstreamBaseUrl = "https://openrouter.ai/api/v1";
+        } else if (upstreamKey.startsWith("AIza")) {
+          provider = "google";
+          upstreamBaseUrl = "https://generativelanguage.googleapis.com/v1beta/openai";
+        }
+        const updatedModels = buildProviderModels(baseUrl, upstreamKey, upstreamBaseUrl);
+        if (api.config.models?.providers) {
+          api.config.models.providers.opencompress = updatedModels;
+        }
+        try {
+          await fetch(`${baseUrl}/v1/byok`, {
+            method: "POST",
+            headers: {
+              Authorization: `Bearer ${apiKey}`,
+              "Content-Type": "application/json"
+            },
+            body: JSON.stringify({ provider, passthrough: true })
+          });
+        } catch {
         }
-        const data = await res.json();
         return {
           text: [
-            `Switched to **BYOK mode** (${data.provider}).`,
+            `Switched to **BYOK mode** (${provider}).`,
             "",
-            data.billing,
+            "Your key is stored **locally only** \u2014 never sent to our server for storage.",
+            "It's passed through on each request via header and discarded immediately.",
             "",
             "To switch back: `/compress-byok off`"
           ].join("\n")

package/openclaw.security.json

@@ -0,0 +1,72 @@
+{
+  "id": "opencompress",
+  "version": "1.0.0",
+  "securityProfile": {
+    "dataHandling": {
+      "promptContent": "pass-through",
+      "promptStorage": "none",
+      "responseContent": "pass-through",
+      "responseStorage": "none",
+      "upstreamApiKeys": "local-only",
+      "upstreamApiKeyStorage": "never-server-side"
+    },
+    "networkAccess": {
+      "outbound": [
+        {
+          "host": "www.opencompress.ai",
+          "port": 443,
+          "protocol": "https",
+          "purpose": "API proxy — compress prompts and forward to upstream LLM provider"
+        }
+      ],
+      "inbound": []
+    },
+    "localStorage": {
+      "authProfiles": {
+        "path": "~/.openclaw/agents/*/agent/auth-profiles.json",
+        "content": "OpenCompress API key (sk-occ-*)",
+        "sensitive": true
+      },
+      "providerConfig": {
+        "path": "~/.openclaw/openclaw.json",
+        "content": "Provider config, optional upstream key in headers (BYOK pass-through)",
+        "sensitive": true
+      }
+    },
+    "secrets": {
+      "required": [
+        {
+          "name": "OpenCompress API Key",
+          "format": "sk-occ-*",
+          "purpose": "Authentication and billing for compression service",
+          "serverSideStorage": "hashed (SHA-256), never plaintext"
+        }
+      ],
+      "optional": [
+        {
+          "name": "Upstream LLM API Key",
+          "format": "sk-proj-* / sk-ant-* / sk-or-* / AIza*",
+          "purpose": "BYOK mode — forwarded to user's LLM provider",
+          "serverSideStorage": "NEVER stored. Passed via X-Upstream-Key header per-request, discarded after forwarding."
+        }
+      ]
+    },
+    "permissions": {
+      "fileSystem": "read/write ~/.openclaw/ config files only",
+      "environment": ["OPENCOMPRESS_API_KEY", "OPENCOMPRESS_LLM_KEY"],
+      "shell": "none",
+      "network": "outbound HTTPS to www.opencompress.ai only"
+    }
+  },
+  "privacyPolicy": {
+    "promptsAndResponses": "OpenCompress compresses prompts in-memory and forwards to the upstream LLM provider. Prompt and response content is NEVER stored, logged, or used for training. Only token counts are recorded for billing.",
+    "apiKeys": "Your upstream LLM API key (OpenAI, Anthropic, etc.) is stored ONLY on your local machine. It is sent to our server as a per-request header (X-Upstream-Key) and discarded immediately after forwarding. We never persist your upstream keys.",
+    "billing": "We record: timestamp, model, original token count, compressed token count, cost. We do NOT record prompt content.",
+    "thirdParties": "We do not share any data with third parties. Your requests are forwarded only to the LLM provider you specify."
+  },
+  "auditability": {
+    "pluginSource": "Open source — https://github.com/claw-compactor/openclaw-plugin",
+    "serverSource": "Forwarding logic documented in security docs. Core proxy is open for audit.",
+    "verification": "Users can inspect all network requests via OpenClaw's diagnostics plugin or standard proxy tools."
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opencompress/opencompress",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "OpenCompress plugin for OpenClaw — automatic 5-layer prompt compression for any LLM",
   "type": "module",
   "main": "dist/index.js",
@@ -18,7 +18,8 @@
   },
   "files": [
     "dist",
-    "openclaw.plugin.json"
+    "openclaw.plugin.json",
+    "openclaw.security.json"
   ],
   "keywords": [
     "openclaw",