@plusplus7/clawclamp 0.1.0

package/src/policy.ts

@@ -0,0 +1,74 @@
+const DEFAULT_SCHEMA = `entity User = {
+  role: String
+};
+
+entity Tool = {
+  name: String,
+  risk: String
+};
+
+action "Invoke" appliesTo {
+  principal: [User],
+  resource: [Tool],
+  context: {
+    now: Long,
+    tool: String,
+    risk: String,
+  }
+};
+`;
+
+const DEFAULT_POLICIES: string[] = [];
+
+const POLICY_STORE_ID = "clawclamp";
+
+type EncodedContent = {
+  encoding: "none" | "base64";
+  content_type: "cedar" | "cedar-json";
+  body: string;
+};
+
+function toBase64(raw: string): string {
+  return Buffer.from(raw, "utf8").toString("base64");
+}
+
+function buildSchemaContent(): EncodedContent {
+  return {
+    encoding: "none",
+    content_type: "cedar",
+    body: DEFAULT_SCHEMA,
+  };
+}
+
+export function buildDefaultPolicyStore(): Record<string, unknown> {
+  const policies: Record<
+    string,
+    {
+      cedar_version: string;
+      name: string;
+      description: string;
+      policy_content: string;
+    }
+  > = {};
+  DEFAULT_POLICIES.forEach((policy, index) => {
+    policies[`openclaw-clawclamp-${index + 1}`] = {
+      cedar_version: "v4.0.0",
+      name: `Clawclamp Default Policy ${index + 1}`,
+      description: "Default grant-based permit policy.",
+      policy_content: toBase64(policy),
+    };
+  });
+
+  return {
+    cedar_version: "v4.0.0",
+    policy_stores: {
+      [POLICY_STORE_ID]: {
+        name: "Clawclamp Policy Store",
+        description: "Local Cedar policies for Clawclamp.",
+        policies,
+        schema: buildSchemaContent(),
+        trusted_issuers: {},
+      },
+    },
+  };
+}

package/src/storage.ts

@@ -0,0 +1,23 @@
+import path from "node:path";
+import type { FileLockOptions } from "openclaw/plugin-sdk";
+import { withFileLock } from "openclaw/plugin-sdk";
+
+export const DEFAULT_LOCK_OPTIONS: FileLockOptions = {
+  retries: {
+    retries: 8,
+    factor: 1.5,
+    minTimeout: 50,
+    maxTimeout: 500,
+    randomize: true,
+  },
+  stale: 10_000,
+};
+
+export async function withStateFileLock<T>(
+  stateDir: string,
+  name: string,
+  fn: () => Promise<T>,
+): Promise<T> {
+  const lockPath = path.join(stateDir, "clawclamp", `${name}.lockfile`);
+  return withFileLock(lockPath, DEFAULT_LOCK_OPTIONS, fn);
+}

package/src/types.ts

@@ -0,0 +1,63 @@
+export type RiskLevel = "low" | "medium" | "high";
+
+export type ClawClampMode = "enforce" | "gray";
+
+export type ClawClampConfig = {
+  enabled: boolean;
+  mode: ClawClampMode;
+  principalId: string;
+  policyStoreUri?: string;
+  policyStoreLocal?: string;
+  uiToken?: string;
+  policyFailOpen: boolean;
+  risk: {
+    default: RiskLevel;
+    overrides: Record<string, RiskLevel>;
+  };
+  grants: {
+    defaultTtlSeconds: number;
+    maxTtlSeconds: number;
+  };
+  audit: {
+    maxEntries: number;
+    includeParams: boolean;
+    maxParamLength: number;
+  };
+};
+
+export type ModeState = {
+  modeOverride?: ClawClampMode;
+  updatedAt?: string;
+};
+
+export type GrantRecord = {
+  id: string;
+  toolName: string;
+  createdAt: string;
+  expiresAt: string;
+  note?: string;
+};
+
+export type AuditDecision = "allow" | "deny" | "allow_grayed" | "error";
+
+export type AuditEntry = {
+  id: string;
+  timestamp: string;
+  toolName: string;
+  toolCallId?: string;
+  runId?: string;
+  sessionId?: string;
+  sessionKey?: string;
+  agentId?: string;
+  risk: RiskLevel;
+  cedarDecision?: "allow" | "deny" | "error";
+  decision: AuditDecision;
+  reason?: string;
+  params?: Record<string, unknown> | string;
+  grantId?: string;
+  grantExpiresAt?: string;
+  grayMode?: boolean;
+  resultStatus?: "ok" | "error" | "pending";
+  error?: string;
+  durationMs?: number;
+};