@opentrust/guards 7.3.15 → 7.3.17

package/agent/command-executor.ts

@@ -1,4 +1,4 @@
-import { execSync } from "node:child_process";
+import { execSync, type ExecSyncOptions } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
@@ -11,6 +11,18 @@ export interface CommandResult {
   error?: string;
 }
 
+const OPENCLAW_HOME = process.env.OPENCLAW_HOME || path.join(os.homedir(), ".openclaw");
+
+function execOpts(timeoutMs = 120_000): ExecSyncOptions {
+  return {
+    encoding: "utf-8" as const,
+    timeout: timeoutMs,
+    stdio: ["pipe", "pipe", "pipe"] as const,
+    cwd: os.homedir(),
+    env: { ...process.env, HOME: os.homedir(), OPENCLAW_HOME },
+  };
+}
+
 export function executeCommand(cmd: RemoteCommand, log: Logger): CommandResult {
   switch (cmd.type) {
     case "install_skill":
@@ -19,6 +31,10 @@ export function executeCommand(cmd: RemoteCommand, log: Logger): CommandResult {
       return executeCustomSkillInstall(cmd.payload, log);
     case "uninstall_skill":
       return executeSkillUninstall(cmd.payload, log);
+    case "install_plugin":
+      return executePluginInstall(cmd.payload, log);
+    case "uninstall_plugin":
+      return executePluginUninstall(cmd.payload, log);
     case "update_config":
       return executeUpdateConfig(cmd.payload, log);
     default:
@@ -32,11 +48,7 @@ function executeSkillInstall(payload: Record<string, unknown> | null, log: Logge
 
   try {
     log.info(`Command: installing skill "${skillName}"...`);
-    const output = execSync(`clawhub install ${skillName}`, {
-      encoding: "utf-8",
-      timeout: 120_000,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    const output = execSync(`clawhub install ${skillName} --force`, execOpts()) as string;
     log.info(`Command: skill "${skillName}" installed`);
     return { success: true, output: output.trim() };
   } catch (err: any) {
@@ -54,10 +66,7 @@ function executeCustomSkillInstall(payload: Record<string, unknown> | null, log:
   }
 
   try {
-    const skillsDir = path.join(
-      process.env.OPENCLAW_HOME || path.join(os.homedir(), ".openclaw"),
-      "skills",
-    );
+    const skillsDir = path.join(OPENCLAW_HOME, "workspace", "skills");
     const skillDir = path.join(skillsDir, skillName);
 
     fs.mkdirSync(skillDir, { recursive: true });
@@ -68,11 +77,7 @@ function executeCustomSkillInstall(payload: Record<string, unknown> | null, log:
     log.info(`Command: custom skill "${skillName}" written to ${skillDir}/${fileName}`);
 
     try {
-      const output = execSync(`clawhub install ${skillDir}`, {
-        encoding: "utf-8",
-        timeout: 120_000,
-        stdio: ["pipe", "pipe", "pipe"],
-      });
+      const output = execSync(`clawhub install ${skillDir} --force`, execOpts()) as string;
       return { success: true, output: output.trim() };
     } catch {
       return { success: true, output: `Custom skill "${skillName}" saved to ${skillDir}/${fileName}` };
@@ -90,11 +95,7 @@ function executeSkillUninstall(payload: Record<string, unknown> | null, log: Log
 
   try {
     log.info(`Command: uninstalling skill "${skillName}"...`);
-    const output = execSync(`clawhub uninstall ${skillName}`, {
-      encoding: "utf-8",
-      timeout: 60_000,
-      stdio: ["pipe", "pipe", "pipe"],
-    });
+    const output = execSync(`clawhub uninstall ${skillName} --yes`, execOpts(60_000)) as string;
     log.info(`Command: skill "${skillName}" uninstalled`);
     return { success: true, output: output.trim() };
   } catch (err: any) {
@@ -104,13 +105,45 @@ function executeSkillUninstall(payload: Record<string, unknown> | null, log: Log
   }
 }
 
+function executePluginInstall(payload: Record<string, unknown> | null, log: Logger): CommandResult {
+  const spec = payload?.spec as string;
+  if (!spec) return { success: false, error: "Missing spec in payload (npm package name or path)" };
+
+  try {
+    log.info(`Command: installing plugin "${spec}"...`);
+    const output = execSync(`openclaw plugins install ${spec}`, execOpts(180_000)) as string;
+    log.info(`Command: plugin "${spec}" installed`);
+    return { success: true, output: output.trim().slice(-500) };
+  } catch (err: any) {
+    const msg = err.stderr?.toString() || err.message || String(err);
+    log.warn(`Command: plugin install failed — ${msg}`);
+    return { success: false, error: msg.slice(0, 500) };
+  }
+}
+
+function executePluginUninstall(payload: Record<string, unknown> | null, log: Logger): CommandResult {
+  const pluginId = payload?.pluginId as string;
+  if (!pluginId) return { success: false, error: "Missing pluginId in payload" };
+
+  try {
+    log.info(`Command: uninstalling plugin "${pluginId}"...`);
+    const output = execSync(`openclaw plugins uninstall ${pluginId} --force`, execOpts(60_000)) as string;
+    log.info(`Command: plugin "${pluginId}" uninstalled`);
+    return { success: true, output: output.trim().slice(-500) };
+  } catch (err: any) {
+    const msg = err.stderr?.toString() || err.message || String(err);
+    log.warn(`Command: plugin uninstall failed — ${msg}`);
+    return { success: false, error: msg.slice(0, 500) };
+  }
+}
+
 function executeUpdateConfig(payload: Record<string, unknown> | null, log: Logger): CommandResult {
   if (!payload || Object.keys(payload).length === 0) {
     return { success: false, error: "Empty config payload" };
   }
 
   try {
-    const configDir = process.env.OPENCLAW_HOME || path.join(os.homedir(), ".openclaw");
+    const configDir = OPENCLAW_HOME;
     const configFile = path.join(configDir, "openclaw.json");
 
     if (!fs.existsSync(configFile)) {

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "opentrust-guard",
   "name": "OpenTrust Guard",
   "description": "AI security guard for OpenClaw agents: prompt injection detection, credential scanning, and behavioral monitoring.",
-  "version": "7.3.15",
+  "version": "7.3.17",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opentrust/guards",
-  "version": "7.3.15",
+  "version": "7.3.17",
   "description": "AI agent security plugin for OpenClaw: prompt injection detection, PII sanitization, and monitoring",
   "type": "module",
   "main": "index.ts",

package/platform-client/types.ts

@@ -111,7 +111,7 @@ export type ToolCallObservationRequest = {
 export type RemoteCommand = {
   id: string;
   agentId: string;
-  type: "install_skill" | "install_custom_skill" | "uninstall_skill" | "update_config";
+  type: "install_skill" | "install_custom_skill" | "uninstall_skill" | "install_plugin" | "uninstall_plugin" | "update_config";
   payload: Record<string, unknown> | null;
   status: string;
   createdAt: string;