@plusplus7/clawclamp 0.1.0 → 0.1.1

package/assets/app.js

@@ -44,6 +44,31 @@ async function fetchJson(path, opts = {}) {
   return payload;
 }
 
+function showAlert(message) {
+  window.alert(message);
+}
+
+function assertOperationOk(payload, fallbackMessage) {
+  if (payload && Object.prototype.hasOwnProperty.call(payload, "ok") && payload.ok === false) {
+    throw new Error(fallbackMessage);
+  }
+  return payload;
+}
+
+async function runAction(action, successMessage, failurePrefix) {
+  try {
+    const result = await action();
+    if (successMessage) {
+      showAlert(successMessage);
+    }
+    return result;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    showAlert(`${failurePrefix}${message}`);
+    throw error;
+  }
+}
+
 function formatTime(iso) {
   if (!iso) return "-";
   const date = new Date(iso);
@@ -79,8 +104,15 @@ function renderGrants(grants) {
       <button class="btn ghost" data-id="${grant.id}">撤销</button>
     `;
     item.querySelector("button").addEventListener("click", async () => {
-      await fetchJson(`${API_BASE}/grants/${grant.id}`, { method: "DELETE" });
-      await refreshAll();
+      try {
+        await runAction(async () => {
+          const result = await fetchJson(`${API_BASE}/grants/${encodeURIComponent(grant.id)}`, {
+            method: "DELETE",
+          });
+          assertOperationOk(result, "撤销授权失败");
+          await refreshAll();
+        }, "已撤销短期授权。", "撤销短期授权失败：");
+      } catch {}
     });
     grantsEl.appendChild(item);
   });
@@ -154,15 +186,23 @@ function renderAudit(entries) {
     const allowBtn = row.querySelector("button[data-action=\"allow\"]");
     if (allowBtn) {
       allowBtn.addEventListener("click", async () => {
-        await applyPolicyChange("permit", entry.toolName);
-        await refreshAll();
+        try {
+          await runAction(async () => {
+            await applyPolicyChange("permit", entry.toolName);
+            await refreshAll();
+          }, "已添加允许策略。", "添加允许策略失败：");
+        } catch {}
       });
     }
     const denyBtn = row.querySelector("button[data-action=\"deny\"]");
     if (denyBtn) {
       denyBtn.addEventListener("click", async () => {
-        await applyPolicyChange("forbid", entry.toolName);
-        await refreshAll();
+        try {
+          await runAction(async () => {
+            await applyPolicyChange("forbid", entry.toolName);
+            await refreshAll();
+          }, "已添加拒绝策略。", "添加拒绝策略失败：");
+        } catch {}
       });
     }
     auditEl.appendChild(row);
@@ -226,19 +266,27 @@ refreshBtn.addEventListener("click", () => {
 });
 
 enforceBtn.addEventListener("click", async () => {
-  await fetchJson(`${API_BASE}/mode`, {
-    method: "POST",
-    body: JSON.stringify({ mode: "enforce" }),
-  });
-  await refreshAll();
+  try {
+    await runAction(async () => {
+      await fetchJson(`${API_BASE}/mode`, {
+        method: "POST",
+        body: JSON.stringify({ mode: "enforce" }),
+      });
+      await refreshAll();
+    }, "已切换到强制模式。", "切换模式失败：");
+  } catch {}
 });
 
 grayBtn.addEventListener("click", async () => {
-  await fetchJson(`${API_BASE}/mode`, {
-    method: "POST",
-    body: JSON.stringify({ mode: "gray" }),
-  });
-  await refreshAll();
+  try {
+    await runAction(async () => {
+      await fetchJson(`${API_BASE}/mode`, {
+        method: "POST",
+        body: JSON.stringify({ mode: "gray" }),
+      });
+      await refreshAll();
+    }, "已切换到灰度模式。", "切换模式失败：");
+  } catch {}
 });
 
 grantForm.addEventListener("submit", async (event) => {
@@ -246,14 +294,18 @@ grantForm.addEventListener("submit", async (event) => {
   const toolName = grantToolInput.value.trim();
   const ttlSeconds = grantTtlInput.value ? Number(grantTtlInput.value) : undefined;
   const note = grantNoteInput.value.trim();
-  await fetchJson(`${API_BASE}/grants`, {
-    method: "POST",
-    body: JSON.stringify({ toolName, ttlSeconds, note: note || undefined }),
-  });
-  grantToolInput.value = "";
-  grantTtlInput.value = "";
-  grantNoteInput.value = "";
-  await refreshAll();
+  try {
+    await runAction(async () => {
+      await fetchJson(`${API_BASE}/grants`, {
+        method: "POST",
+        body: JSON.stringify({ toolName, ttlSeconds, note: note || undefined }),
+      });
+      grantToolInput.value = "";
+      grantTtlInput.value = "";
+      grantNoteInput.value = "";
+      await refreshAll();
+    }, "已创建短期授权。", "创建短期授权失败：");
+  } catch {}
 });
 
 auditPageSizeEl.addEventListener("change", async () => {
@@ -294,9 +346,10 @@ function policyBody(effect, toolName) {
 async function removePoliciesByPrefix(prefix) {
   const targets = policies.filter((policy) => policy.id.startsWith(prefix));
   for (const policy of targets) {
-    await fetchJson(`${API_BASE}/policies/${encodeURIComponent(policy.id)}`, {
+    const result = await fetchJson(`${API_BASE}/policies/${encodeURIComponent(policy.id)}`, {
       method: "DELETE",
     });
+    assertOperationOk(result, `删除策略失败: ${policy.id}`);
   }
 }
 
@@ -319,12 +372,16 @@ policyCreateBtn.addEventListener("click", async () => {
     return;
   }
   const body = { content, ...(id ? { id } : {}) };
-  await fetchJson(`${API_BASE}/policies`, {
-    method: "POST",
-    body: JSON.stringify(body),
-  });
-  policyStatusEl.textContent = "已新增策略。";
-  await refreshAll();
+  try {
+    await runAction(async () => {
+      await fetchJson(`${API_BASE}/policies`, {
+        method: "POST",
+        body: JSON.stringify(body),
+      });
+      policyStatusEl.textContent = "已新增策略。";
+      await refreshAll();
+    }, "已新增策略。", "新增策略失败：");
+  } catch {}
 });
 
 policyUpdateBtn.addEventListener("click", async () => {
@@ -338,12 +395,16 @@ policyUpdateBtn.addEventListener("click", async () => {
     policyStatusEl.textContent = "请输入 Policy 内容。";
     return;
   }
-  await fetchJson(`${API_BASE}/policies/${encodeURIComponent(id)}`, {
-    method: "PUT",
-    body: JSON.stringify({ content }),
-  });
-  policyStatusEl.textContent = "已保存策略。";
-  await refreshAll();
+  try {
+    await runAction(async () => {
+      await fetchJson(`${API_BASE}/policies/${encodeURIComponent(id)}`, {
+        method: "PUT",
+        body: JSON.stringify({ content }),
+      });
+      policyStatusEl.textContent = "已保存策略。";
+      await refreshAll();
+    }, "已保存策略。", "保存策略失败：");
+  } catch {}
 });
 
 policyDeleteBtn.addEventListener("click", async () => {
@@ -352,11 +413,16 @@ policyDeleteBtn.addEventListener("click", async () => {
     policyStatusEl.textContent = "请选择或填写 Policy ID。";
     return;
   }
-  await fetchJson(`${API_BASE}/policies/${encodeURIComponent(id)}`, {
-    method: "DELETE",
-  });
-  policyStatusEl.textContent = "已删除策略。";
-  policyIdInput.value = "";
-  policyContentInput.value = "";
-  await refreshAll();
+  try {
+    await runAction(async () => {
+      const result = await fetchJson(`${API_BASE}/policies/${encodeURIComponent(id)}`, {
+        method: "DELETE",
+      });
+      assertOperationOk(result, "删除策略失败");
+      policyStatusEl.textContent = "已删除策略。";
+      policyIdInput.value = "";
+      policyContentInput.value = "";
+      await refreshAll();
+    }, "已删除策略。", "删除策略失败：");
+  } catch {}
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plusplus7/clawclamp",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "OpenClaw Cedar authorization guard with audit UI",
   "type": "module",
   "dependencies": {

package/src/grants.ts

@@ -42,12 +42,37 @@ function decodeBase64(value: string): string {
   return Buffer.from(value, "base64").toString("utf8");
 }
 
+function normalizePolicyRecord(
+  id: string,
+  record: PolicyRecord,
+  cedarVersion: string,
+  fallbackDescription: string,
+): PolicyRecord {
+  return {
+    cedar_version: record.cedar_version ?? cedarVersion,
+    name: record.name ?? id,
+    description: record.description ?? fallbackDescription,
+    policy_content: record.policy_content,
+  };
+}
+
 async function readPolicyStore(stateDir: string): Promise<PolicyStoreSnapshot> {
   const filePath = resolvePolicyPath(stateDir);
   const { value } = await readJsonFileWithFallback<PolicyStoreSnapshot>(
     filePath,
     buildDefaultPolicyStore() as PolicyStoreSnapshot,
   );
+  const policyStore = value.policy_stores?.[POLICY_STORE_ID];
+  if (policyStore?.policies) {
+    for (const [id, record] of Object.entries(policyStore.policies)) {
+      policyStore.policies[id] = normalizePolicyRecord(
+        id,
+        record,
+        value.cedar_version,
+        "Managed by Clawclamp.",
+      );
+    }
+  }
   return value;
 }
 
@@ -152,12 +177,16 @@ export async function createGrant(params: {
     );
     const expiresAtMs = nowMs + ttlSeconds * 1000;
     const id = grantPolicyId(nowMs);
-    policyStore.policies![id] = {
-      cedar_version: store.cedar_version,
-      name: `Grant ${params.toolName}`,
-      description: params.note?.trim() || undefined,
-      policy_content: encodeBase64(buildGrantPolicy(params.toolName, expiresAtMs)),
-    };
+    policyStore.policies![id] = normalizePolicyRecord(
+      id,
+      {
+        name: `Grant ${params.toolName}`,
+        description: params.note?.trim() || "Temporary grant policy.",
+        policy_content: encodeBase64(buildGrantPolicy(params.toolName, expiresAtMs)),
+      },
+      store.cedar_version,
+      "Temporary grant policy.",
+    );
     await writePolicyStore(params.stateDir, store);
     return {
       id,

package/src/guard.ts

@@ -151,7 +151,7 @@ async function evaluateCedar(params: {
   const request = {
     principals: [
       {
-        type: "User",
+        type: "Jans::User",
         id: params.config.principalId,
         role: "operator",
       },
@@ -180,7 +180,7 @@ async function evaluateCedar(params: {
       `[clawclamp] cedar response ${JSON.stringify({ request, result: jsonString })}`,
     );
     const parsed = JSON.parse(jsonString) as unknown;
-    return parseCedarDecision(parsed, "User", params.config.principalId);
+    return parseCedarDecision(parsed, "Jans::User", params.config.principalId);
   } catch (error) {
     return { decision: "error", reason: error instanceof Error ? error.message : String(error) };
   }

package/src/http.ts

@@ -48,6 +48,14 @@ function parseUrl(rawUrl?: string): URL | null {
   }
 }
 
+function decodePathComponent(value: string): string {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+
 function getHeader(req: IncomingMessage, name: string): string | undefined {
   const raw = req.headers[name.toLowerCase()];
   if (typeof raw === "string") {
@@ -337,7 +345,7 @@ export function createClawClampHttpHandler(params: {
         return true;
       }
       try {
-        const id = apiPath.slice("policies/".length);
+        const id = decodePathComponent(apiPath.slice("policies/".length));
         if (!id) {
           sendJson(res, 400, { error: "policy id required" });
           return true;
@@ -365,7 +373,7 @@ export function createClawClampHttpHandler(params: {
         sendJson(res, 400, { error: "policyStoreUri is read-only" });
         return true;
       }
-      const id = apiPath.slice("policies/".length);
+      const id = decodePathComponent(apiPath.slice("policies/".length));
       if (!id) {
         sendJson(res, 400, { error: "policy id required" });
         return true;
@@ -414,7 +422,7 @@ export function createClawClampHttpHandler(params: {
     }
 
     if (apiPath.startsWith("grants/") && req.method === "DELETE") {
-      const grantId = apiPath.slice("grants/".length);
+      const grantId = decodePathComponent(apiPath.slice("grants/".length));
       if (!grantId) {
         sendJson(res, 400, { error: "grant id required" });
         return true;

package/src/policy-store.ts

@@ -50,12 +50,37 @@ function encodeBase64(value: string): string {
   return Buffer.from(value, "utf8").toString("base64");
 }
 
+function normalizePolicyRecord(
+  id: string,
+  record: PolicyRecord,
+  cedarVersion: string,
+  fallbackDescription: string,
+): PolicyRecord {
+  return {
+    cedar_version: record.cedar_version ?? cedarVersion,
+    name: record.name ?? id,
+    description: record.description ?? fallbackDescription,
+    policy_content: record.policy_content,
+  };
+}
+
 async function readPolicyStore(stateDir: string): Promise<PolicyStoreSnapshot> {
   const filePath = resolvePolicyPath(stateDir);
   const { value } = await readJsonFileWithFallback<PolicyStoreSnapshot>(
     filePath,
     buildDefaultPolicyStore() as PolicyStoreSnapshot,
   );
+  const policyStore = value.policy_stores?.[POLICY_STORE_ID];
+  if (policyStore?.policies) {
+    for (const [id, record] of Object.entries(policyStore.policies)) {
+      policyStore.policies[id] = normalizePolicyRecord(
+        id,
+        record,
+        value.cedar_version,
+        "Managed by Clawclamp.",
+      );
+    }
+  }
   return value;
 }
 
@@ -140,10 +165,12 @@ export async function createPolicy(params: {
       throw new Error("policy id already exists");
     }
     policyStore.policies[id] = {
-      cedar_version: store.cedar_version,
-      name: id,
-      description: "Created from Clawclamp UI.",
-      policy_content: encodeBase64(params.content),
+      ...normalizePolicyRecord(
+        id,
+        { policy_content: encodeBase64(params.content) },
+        store.cedar_version,
+        "Created from Clawclamp UI.",
+      ),
     };
     await writePolicyStore(params.stateDir, store);
     return { id, content: params.content };
@@ -162,10 +189,12 @@ export async function updatePolicy(params: {
       throw new Error("policy id not found");
     }
     policyStore.policies[params.id] = {
-      cedar_version: store.cedar_version,
-      name: params.id,
-      description: "Updated from Clawclamp UI.",
-      policy_content: encodeBase64(params.content),
+      ...normalizePolicyRecord(
+        params.id,
+        { policy_content: encodeBase64(params.content) },
+        store.cedar_version,
+        "Updated from Clawclamp UI.",
+      ),
     };
     await writePolicyStore(params.stateDir, store);
     return { id: params.id, content: params.content };

package/src/policy.ts

@@ -1,6 +1,10 @@
-const DEFAULT_SCHEMA = `entity User = {
+const DEFAULT_SCHEMA = `namespace Jans {
+entity Role;
+
+entity User in [Role] = {
   role: String
 };
+}
 
 entity Tool = {
   name: String,
@@ -8,7 +12,7 @@ entity Tool = {
 };
 
 action "Invoke" appliesTo {
-  principal: [User],
+  principal: [Jans::User],
   resource: [Tool],
   context: {
     now: Long,