@opencompress/opencompress 1.1.0 → 1.3.0

package/dist/index.js

@@ -34,12 +34,18 @@ var OPENCOMPRESS_MODELS = [
   // Mistral
   { id: "mistralai/mistral-large-2411", name: "Mistral Large (Compressed)", reasoning: false, input: ["text"], cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 }, contextWindow: 131072, maxTokens: 8192 }
 ];
-function buildProviderModels(baseUrl) {
-  return {
+function buildProviderModels(baseUrl, upstreamKey, upstreamBaseUrl) {
+  const config = {
     baseUrl: `${baseUrl}/v1`,
     api: "openai-completions",
     models: OPENCOMPRESS_MODELS
   };
+  if (upstreamKey || upstreamBaseUrl) {
+    config.headers = {};
+    if (upstreamKey) config.headers["X-Upstream-Key"] = upstreamKey;
+    if (upstreamBaseUrl) config.headers["X-Upstream-Base-Url"] = upstreamBaseUrl;
+  }
+  return config;
 }
 var opencompressProvider = {
   id: "opencompress",
@@ -53,18 +59,41 @@ var opencompressProvider = {
     {
       id: "api-key",
       label: "OpenCompress",
-      hint: "One-click setup \u2014 no API key needed",
+      hint: "Connect your LLM key \u2014 compress every call, save 40-70%",
       kind: "custom",
       run: async (ctx) => {
         ctx.prompter.note(
-          "OpenCompress compresses all LLM prompts automatically.\n53% fewer tokens, 62% faster, 96% quality preserved.\nWe'll create your account now \u2014 $1 free credit included."
+          "OpenCompress compresses all LLM prompts automatically.\n53% fewer tokens, 62% faster, 96% quality preserved.\n\nConnect your existing LLM API key to get started.\nSupported: OpenAI, Anthropic, OpenRouter, Google"
         );
+        const llmKey = await ctx.prompter.text({
+          message: "Enter your LLM API key (OpenAI/Anthropic/OpenRouter):",
+          validate: (val) => {
+            if (!val || val.length < 10) return "Please enter a valid API key";
+            if (val.startsWith("sk-occ-")) return "Enter your LLM provider key, not an OpenCompress key";
+            return void 0;
+          }
+        });
+        if (typeof llmKey === "symbol") {
+          throw new Error("Setup cancelled");
+        }
+        let provider = "openrouter";
+        let upstreamBaseUrl = "https://openrouter.ai/api/v1";
+        if (llmKey.startsWith("sk-proj-") || llmKey.startsWith("sk-") && !llmKey.startsWith("sk-ant-") && !llmKey.startsWith("sk-or-")) {
+          provider = "openai";
+          upstreamBaseUrl = "https://api.openai.com/v1";
+        } else if (llmKey.startsWith("sk-ant-")) {
+          provider = "anthropic";
+          upstreamBaseUrl = "https://api.anthropic.com/v1";
+        } else if (llmKey.startsWith("AIza")) {
+          provider = "google";
+          upstreamBaseUrl = "https://generativelanguage.googleapis.com/v1beta/openai";
+        }
         const spinner = ctx.prompter.progress("Creating account...");
         try {
           const res = await fetch(`${DEFAULT_BASE_URL}/v1/provision`, {
             method: "POST",
             headers: { "Content-Type": "application/json" },
-            body: "{}"
+            body: JSON.stringify({ upstreamApiKey: llmKey })
           });
           if (!res.ok) {
             const err = await res.json().catch(() => ({ error: { message: "Unknown error" } }));
@@ -75,6 +104,17 @@ var opencompressProvider = {
           }
           const data = await res.json();
           spinner.stop("Account created");
+          try {
+            await fetch(`${DEFAULT_BASE_URL}/v1/byok`, {
+              method: "POST",
+              headers: {
+                Authorization: `Bearer ${data.apiKey}`,
+                "Content-Type": "application/json"
+              },
+              body: JSON.stringify({ provider, passthrough: true })
+            });
+          } catch {
+          }
           return {
             profiles: [
               {
@@ -82,10 +122,18 @@ var opencompressProvider = {
                 credential: { apiKey: data.apiKey }
               }
             ],
+            configPatch: {
+              models: {
+                providers: {
+                  opencompress: buildProviderModels(DEFAULT_BASE_URL, llmKey, upstreamBaseUrl)
+                }
+              }
+            },
             defaultModel: "gpt-4o-mini",
             notes: [
-              "OpenCompress is ready! All LLM calls are now compressed automatically.",
-              `Free credit: ${data.freeCredit}. Add more: POST /api/v1/topup or visit opencompress.ai/dashboard`
+              `OpenCompress is ready! Connected to ${provider}.`,
+              "Your LLM key is stored locally only \u2014 never on our server.",
+              `Free credit: ${data.freeCredit}. Dashboard: opencompress.ai/dashboard`
             ]
           };
         } catch (err) {
@@ -103,9 +151,11 @@ var plugin = {
   version: VERSION,
   async register(api) {
     const baseUrl = api.pluginConfig?.baseUrl || DEFAULT_BASE_URL;
-    if (baseUrl !== DEFAULT_BASE_URL) {
-      opencompressProvider.models = buildProviderModels(baseUrl);
-    }
+    const existingHeaders = api.config.models?.providers?.opencompress?.headers;
+    const existingUpstreamKey = existingHeaders?.["X-Upstream-Key"];
+    const existingUpstreamBaseUrl = existingHeaders?.["X-Upstream-Base-Url"];
+    const providerModels = buildProviderModels(baseUrl, existingUpstreamKey, existingUpstreamBaseUrl);
+    opencompressProvider.models = providerModels;
     api.registerProvider(opencompressProvider);
     if (!api.config.models) {
       api.config.models = { providers: {} };
@@ -113,7 +163,7 @@ var plugin = {
     if (!api.config.models.providers) {
       api.config.models.providers = {};
     }
-    api.config.models.providers.opencompress = buildProviderModels(baseUrl);
+    api.config.models.providers.opencompress = providerModels;
     api.logger.info("OpenCompress provider registered (20 models, 5-layer compression)");
     api.registerCommand({
       name: "compress-stats",
@@ -175,10 +225,10 @@ var plugin = {
         }
         const upstreamKey = ctx.args?.trim();
         if (!upstreamKey) {
-          const res2 = await fetch(`${baseUrl}/v1/topup`, {
+          const res = await fetch(`${baseUrl}/v1/topup`, {
             headers: { Authorization: `Bearer ${apiKey}` }
           });
-          const data2 = res2.ok ? await res2.json() : null;
+          const data = res.ok ? await res.json() : null;
           return {
             text: [
               "**BYOK (Bring Your Own Key)**",
@@ -191,19 +241,23 @@ var plugin = {
               "  `/compress-byok sk-or-xxx`    \u2014 Connect OpenRouter key",
               "  `/compress-byok off`          \u2014 Switch back to router mode",
               "",
-              data2 ? `**Balance:** $${data2.balance.toFixed(2)}` : ""
+              data ? `**Balance:** $${data.balance.toFixed(2)}` : ""
             ].join("\n")
           };
         }
         if (upstreamKey === "off" || upstreamKey === "disable" || upstreamKey === "router") {
-          const res2 = await fetch(`${baseUrl}/v1/byok`, {
-            method: "DELETE",
-            headers: { Authorization: `Bearer ${apiKey}` }
-          });
-          if (!res2.ok) {
-            return { text: `Failed to switch: HTTP ${res2.status}` };
+          const cleanModels = buildProviderModels(baseUrl);
+          if (api.config.models?.providers) {
+            api.config.models.providers.opencompress = cleanModels;
+          }
+          try {
+            await fetch(`${baseUrl}/v1/byok`, {
+              method: "DELETE",
+              headers: { Authorization: `Bearer ${apiKey}` }
+            });
+          } catch {
           }
-          return { text: "Switched back to **router mode**. We handle LLM routing via OpenRouter." };
+          return { text: "Switched back to **router mode**. Your upstream key has been removed from local config." };
         }
         if (upstreamKey.startsWith("sk-occ-")) {
           return { text: "That's an OpenCompress key. Provide your LLM provider key (OpenAI, Anthropic, etc.)." };
@@ -211,24 +265,42 @@ var plugin = {
         if (upstreamKey.length < 10) {
           return { text: "Key looks too short. Provide your full LLM API key." };
         }
-        const res = await fetch(`${baseUrl}/v1/byok`, {
-          method: "POST",
-          headers: {
-            Authorization: `Bearer ${apiKey}`,
-            "Content-Type": "application/json"
-          },
-          body: JSON.stringify({ upstreamApiKey: upstreamKey })
-        });
-        if (!res.ok) {
-          const err = await res.json().catch(() => ({ error: { message: "Unknown error" } }));
-          return { text: `Failed: ${err.error?.message || res.statusText}` };
+        let provider = "unknown";
+        let upstreamBaseUrl = "";
+        if (upstreamKey.startsWith("sk-proj-") || upstreamKey.startsWith("sk-") && !upstreamKey.startsWith("sk-ant-") && !upstreamKey.startsWith("sk-or-")) {
+          provider = "openai";
+          upstreamBaseUrl = "https://api.openai.com/v1";
+        } else if (upstreamKey.startsWith("sk-ant-")) {
+          provider = "anthropic";
+          upstreamBaseUrl = "https://api.anthropic.com/v1";
+        } else if (upstreamKey.startsWith("sk-or-")) {
+          provider = "openrouter";
+          upstreamBaseUrl = "https://openrouter.ai/api/v1";
+        } else if (upstreamKey.startsWith("AIza")) {
+          provider = "google";
+          upstreamBaseUrl = "https://generativelanguage.googleapis.com/v1beta/openai";
+        }
+        const updatedModels = buildProviderModels(baseUrl, upstreamKey, upstreamBaseUrl);
+        if (api.config.models?.providers) {
+          api.config.models.providers.opencompress = updatedModels;
+        }
+        try {
+          await fetch(`${baseUrl}/v1/byok`, {
+            method: "POST",
+            headers: {
+              Authorization: `Bearer ${apiKey}`,
+              "Content-Type": "application/json"
+            },
+            body: JSON.stringify({ provider, passthrough: true })
+          });
+        } catch {
         }
-        const data = await res.json();
         return {
           text: [
-            `Switched to **BYOK mode** (${data.provider}).`,
+            `Switched to **BYOK mode** (${provider}).`,
             "",
-            data.billing,
+            "Your key is stored **locally only** \u2014 never sent to our server for storage.",
+            "It's passed through on each request via header and discarded immediately.",
             "",
             "To switch back: `/compress-byok off`"
           ].join("\n")

package/openclaw.security.json

@@ -0,0 +1,72 @@
+{
+  "id": "opencompress",
+  "version": "1.0.0",
+  "securityProfile": {
+    "dataHandling": {
+      "promptContent": "pass-through",
+      "promptStorage": "none",
+      "responseContent": "pass-through",
+      "responseStorage": "none",
+      "upstreamApiKeys": "local-only",
+      "upstreamApiKeyStorage": "never-server-side"
+    },
+    "networkAccess": {
+      "outbound": [
+        {
+          "host": "www.opencompress.ai",
+          "port": 443,
+          "protocol": "https",
+          "purpose": "API proxy — compress prompts and forward to upstream LLM provider"
+        }
+      ],
+      "inbound": []
+    },
+    "localStorage": {
+      "authProfiles": {
+        "path": "~/.openclaw/agents/*/agent/auth-profiles.json",
+        "content": "OpenCompress API key (sk-occ-*)",
+        "sensitive": true
+      },
+      "providerConfig": {
+        "path": "~/.openclaw/openclaw.json",
+        "content": "Provider config, optional upstream key in headers (BYOK pass-through)",
+        "sensitive": true
+      }
+    },
+    "secrets": {
+      "required": [
+        {
+          "name": "OpenCompress API Key",
+          "format": "sk-occ-*",
+          "purpose": "Authentication and billing for compression service",
+          "serverSideStorage": "hashed (SHA-256), never plaintext"
+        }
+      ],
+      "optional": [
+        {
+          "name": "Upstream LLM API Key",
+          "format": "sk-proj-* / sk-ant-* / sk-or-* / AIza*",
+          "purpose": "BYOK mode — forwarded to user's LLM provider",
+          "serverSideStorage": "NEVER stored. Passed via X-Upstream-Key header per-request, discarded after forwarding."
+        }
+      ]
+    },
+    "permissions": {
+      "fileSystem": "read/write ~/.openclaw/ config files only",
+      "environment": ["OPENCOMPRESS_API_KEY", "OPENCOMPRESS_LLM_KEY"],
+      "shell": "none",
+      "network": "outbound HTTPS to www.opencompress.ai only"
+    }
+  },
+  "privacyPolicy": {
+    "promptsAndResponses": "OpenCompress compresses prompts in-memory and forwards to the upstream LLM provider. Prompt and response content is NEVER stored, logged, or used for training. Only token counts are recorded for billing.",
+    "apiKeys": "Your upstream LLM API key (OpenAI, Anthropic, etc.) is stored ONLY on your local machine. It is sent to our server as a per-request header (X-Upstream-Key) and discarded immediately after forwarding. We never persist your upstream keys.",
+    "billing": "We record: timestamp, model, original token count, compressed token count, cost. We do NOT record prompt content.",
+    "thirdParties": "We do not share any data with third parties. Your requests are forwarded only to the LLM provider you specify."
+  },
+  "auditability": {
+    "pluginSource": "Open source — https://github.com/claw-compactor/openclaw-plugin",
+    "serverSource": "Forwarding logic documented in security docs. Core proxy is open for audit.",
+    "verification": "Users can inspect all network requests via OpenClaw's diagnostics plugin or standard proxy tools."
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opencompress/opencompress",
-  "version": "1.1.0",
+  "version": "1.3.0",
   "description": "OpenCompress plugin for OpenClaw — automatic 5-layer prompt compression for any LLM",
   "type": "module",
   "main": "dist/index.js",
@@ -18,7 +18,8 @@
   },
   "files": [
     "dist",
-    "openclaw.plugin.json"
+    "openclaw.plugin.json",
+    "openclaw.security.json"
   ],
   "keywords": [
     "openclaw",