@stroq/cli 0.5.1 → 0.11.0

package/dist/scope.json

@@ -0,0 +1,426 @@
+{
+  "atlasRelease": "2026.08",
+  "inScope": [
+    {
+      "id": "AML.T0010",
+      "limitation": "Stroq sees the agent’s own install or load of a supply-chain artifact (a package, model, container image, or tool); compromise introduced before the agent ever touches the artifact (e.g. at the origin registry) is addressed under supply-chain staging, not here."
+    },
+    {
+      "id": "AML.T0010.001",
+      "limitation": "Covers the package-install and load commands the agent runs; a compromised dependency pulled in transitively by another tool without the agent’s own visible install step is not separately detected."
+    },
+    {
+      "id": "AML.T0010.003",
+      "limitation": "Covers the agent’s own download and load of a model file; whether the loaded weights are themselves poisoned is a model-attack-surface question this file cannot answer, only that the load and any embedded executable payload are visible."
+    },
+    {
+      "id": "AML.T0010.004",
+      "limitation": "Covers a `docker pull` or equivalent the agent runs; an image pulled by a CI/CD pipeline outside the agent’s own tool calls is invisible."
+    },
+    {
+      "id": "AML.T0010.005",
+      "limitation": "Covers installing or connecting a poisoned tool through the agent’s own tool calls; a tool added directly through an IDE or platform UI outside those calls is not seen."
+    },
+    {
+      "id": "AML.T0011",
+      "limitation": "Covers execution the agent itself triggers via a tool call; execution a human user triggers directly, outside the agent, is not this product’s surface."
+    },
+    {
+      "id": "AML.T0011.000",
+      "limitation": "Covers the agent loading or executing the artifact via a tool call; a runtime that deserializes the artifact internally, with no distinct tool call for the load, is invisible."
+    },
+    {
+      "id": "AML.T0011.001",
+      "limitation": "Covers the install and any immediate execution the agent’s tool calls perform; a package that behaves maliciously only long after install, with no further agent-visible action, is not caught at install time."
+    },
+    {
+      "id": "AML.T0011.002",
+      "limitation": "Covers invocation of the poisoned tool through the agent’s own tool-call channel; a tool that behaves normally when called but corrupts state elsewhere with no reflected content is not distinguishable from a benign one."
+    },
+    {
+      "id": "AML.T0050",
+      "limitation": "Covers commands submitted through the agent’s own shell or interpreter tool call; a command an interpreter runs internally, without a distinct tool-call boundary, is invisible."
+    },
+    {
+      "id": "AML.T0051",
+      "limitation": "Covers injected instructions in content the agent reads back through a tool call; instructions injected purely in a user’s own conversational turn, never touching a tool, are not this surface."
+    },
+    {
+      "id": "AML.T0051.000",
+      "limitation": "Direct injection happens in the user’s own prompt to the model, a channel Stroq’s hooks do not see; Stroq can only act once the injected instruction drives a subsequent tool call."
+    },
+    {
+      "id": "AML.T0051.001",
+      "limitation": null
+    },
+    {
+      "id": "AML.T0051.002",
+      "limitation": "Covers the triggering event when it arrives as tool-call content (a file change, an incoming message ingested via a tool); an event source entirely outside any tool call is invisible."
+    },
+    {
+      "id": "AML.T0068",
+      "limitation": "Stroq’s normalization pipeline targets the known obfuscation classes (hidden text, encoding, confusables); its own mutation fuzzer has already demonstrated encodings that evade it, so this is a claim of intent to detect, not of catching every encoding."
+    },
+    {
+      "id": "AML.T0078",
+      "limitation": "Covers the case where the malicious page is fetched by the agent as ordinary web content and its prompt injection is evaluated like any other; a browser exploit unrelated to AI content, or a page visited by the human directly, is outside this product’s surface."
+    },
+    {
+      "id": "AML.T0093",
+      "limitation": "Covers the moment the planted content is later read back by the agent through a tool call; the initial planting on the public-facing application itself is not something a developer’s local hook observes."
+    },
+    {
+      "id": "AML.T0094",
+      "limitation": "Stroq evaluates each tool call independently and does not track that a delayed instruction seen earlier in a session is about to fire; a rule that would catch the instruction immediately can still miss it once its execution is deferred past the point of first exposure."
+    },
+    {
+      "id": "AML.T0123",
+      "limitation": "Same limitation as prompt obfuscation: Stroq’s normalization and decode-and-rescan logic targets known encodings, and its own fuzzer has shown specific encodings that currently evade it."
+    },
+    {
+      "id": "AML.T0053",
+      "limitation": null
+    },
+    {
+      "id": "AML.T0086",
+      "limitation": null
+    },
+    {
+      "id": "AML.T0101",
+      "limitation": null
+    },
+    {
+      "id": "AML.T0108",
+      "limitation": "Stroq evaluates each tool call the compromised agent makes on its own merits (a fetch, then a destructive or exfiltrating action); it does not itself recognize a fetch-and-execute loop as a C2 beacon pattern across a session."
+    },
+    {
+      "id": "AML.T0080",
+      "limitation": "Covers poisoning delivered through content the agent reads via a tool call; poisoning injected purely through direct conversation with no tool-call boundary is not this surface."
+    },
+    {
+      "id": "AML.T0080.000",
+      "limitation": "Covers a memory write that flows through a tool call Stroq can inspect; a memory feature implemented as an opaque internal model state with no corresponding tool call is invisible."
+    },
+    {
+      "id": "AML.T0080.001",
+      "limitation": "Covers thread content the agent reads back through a tool call; instructions injected purely as user conversation turns are not visible to a hook that only sees tool calls."
+    },
+    {
+      "id": "AML.T0081",
+      "limitation": "Covers the one configuration surface the corpus currently exercises — the `hooks` block of `.claude/settings.json`, overwritten via a `Write` tool call; the technique's own description also spans the system prompt, knowledge sources, and other connected-tool settings, none of which any scenario in the suite currently drives through this technique."
+    },
+    {
+      "id": "AML.T0083",
+      "limitation": "Covers the agent’s own read of its configuration file through a tool call; credentials extracted by a process outside the agent’s tool-call surface (e.g. a separate script reading the same file) are invisible."
+    },
+    {
+      "id": "AML.T0084",
+      "limitation": "Covers configuration discovered by reading a file through a tool call; configuration details volunteered by the model when a user simply asks it questions, with no tool call involved, are not visible."
+    },
+    {
+      "id": "AML.T0084.000",
+      "limitation": "Same limitation as the parent: visible only when discovery happens via a file or tool-call read, not via conversational questioning of the model."
+    },
+    {
+      "id": "AML.T0084.001",
+      "limitation": "Visible when tool definitions are read from a configuration file via a tool call; definitions the model recites from its own loaded context, with no corresponding file read, are not visible."
+    },
+    {
+      "id": "AML.T0084.002",
+      "limitation": "Visible when trigger configuration is read via a tool call; triggers inferred purely by observing agent behavior over time are not something a per-call hook reconstructs."
+    },
+    {
+      "id": "AML.T0084.003",
+      "limitation": "Visible when call-chain information is read from configuration or source files via a tool call; chains inferred by static analysis of code never read through the agent’s own tools are not covered."
+    },
+    {
+      "id": "AML.T0070",
+      "limitation": "Covers the poisoned content once the agent’s tool retrieves and surfaces it for the model to read; the initial placement of that content into the RAG store is a separate action outside the developer’s machine."
+    },
+    {
+      "id": "AML.T0071",
+      "limitation": "Same limitation as RAG Poisoning: Stroq sees the retrieved content when a tool surfaces it, not the injection into the RAG store itself."
+    },
+    {
+      "id": "AML.T0082",
+      "limitation": "Covers the retrieval tool call and the credential-shaped content it returns; credentials mixed into a huge, unremarkable-looking retrieval result may not be distinguishable from ordinary document content by a content rule alone."
+    },
+    {
+      "id": "AML.T0085",
+      "limitation": "Covers data movement visible through the agent’s own tool calls to connected services; data the AI service itself discloses through a channel outside any tool call is not visible."
+    },
+    {
+      "id": "AML.T0085.000",
+      "limitation": "Same limitation as the parent: visible through the retrieval tool call and its returned content, not through any other access path to the RAG store."
+    },
+    {
+      "id": "AML.T0085.001",
+      "limitation": "Same limitation as the parent: visible through the tool invocation itself, not through any access path outside the agent’s own tool calls."
+    },
+    {
+      "id": "AML.T0098",
+      "limitation": "Covers credential-shaped content returned by a tool call Stroq inspects; credentials embedded in a format or encoding a content rule does not recognize may pass unflagged."
+    },
+    {
+      "id": "AML.T0099",
+      "limitation": "Covers the poisoned content once an agent tool retrieves it; the poisoning of the underlying data source itself happens outside the developer’s machine and is not directly observed."
+    },
+    {
+      "id": "AML.T0110",
+      "limitation": "Covers a poisoned tool’s effects once it is invoked or its response is read through a tool call; a tool’s static, model-visible description that is never reflected back through a hook-observed call may not be inspected at all."
+    },
+    {
+      "id": "AML.T0110.000",
+      "limitation": "Stroq observes a tool’s invocation and its response, not necessarily the static tool definition or schema loaded into the model’s context at session start; a poisoned description that never causes an anomalous call or response can be invisible."
+    },
+    {
+      "id": "AML.T0110.001",
+      "limitation": "Covers the tool’s actual invocation and response as Stroq sees them; hidden side effects that do not alter the visible request or response content (e.g. a silent blind-copy on an email send that never appears in the response) may not be distinguishable from normal use."
+    },
+    {
+      "id": "AML.T0110.002",
+      "limitation": null
+    },
+    {
+      "id": "AML.T0037",
+      "limitation": null
+    },
+    {
+      "id": "AML.T0055",
+      "limitation": "Covers credentials Stroq’s rules recognize by pattern (keys, tokens, known formats) in content a tool call returns; a credential in a format or location the rule set does not recognize will not be flagged."
+    },
+    {
+      "id": "AML.T0090",
+      "limitation": "Covers credential material read through the agent’s own tool calls (files, command output); dumping performed by a separate process outside the agent, with no reflected content, is invisible."
+    },
+    {
+      "id": "AML.T0035",
+      "limitation": "Covers artifact collection performed through the agent’s own file and tool operations; Stroq cannot distinguish routine, legitimate bulk file handling from adversarial collection except by the content and destination involved."
+    },
+    {
+      "id": "AML.T0126",
+      "limitation": "Same limitation as artifact collection: visible as a sequence of ordinary-looking tool calls, which a per-call hook does not aggregate into a pattern of automated collection on its own."
+    },
+    {
+      "id": "AML.T0025",
+      "limitation": "Covers the one channel the corpus currently exercises — a shell-invoked `gh repo create --push` publishing harvested data to a public repository; 'traditional cyber means' also spans exfiltration by direct HTTP request, DNS, email, or cloud-storage upload, none of which any scenario in the suite currently drives through this technique."
+    },
+    {
+      "id": "AML.T0034.002",
+      "limitation": "Stroq can flag an individual costly tool call but does not implement session-level rate-limiting or a budget; a large number of individually unremarkable calls induced across a long session is not aggregated into a single verdict."
+    },
+    {
+      "id": "AML.T0125",
+      "limitation": "Covers account creation performed through the agent’s own tools (an IAM or platform API call); account creation through a channel outside the agent, such as a compromised admin console, is invisible."
+    },
+    {
+      "id": "AML.T0056",
+      "limitation": "Covers the case where the system prompt is extracted by reading a configuration file through a tool call; extraction induced through prompt injection that the model reveals only in its own conversational response is not visible."
+    },
+    {
+      "id": "AML.T0069",
+      "limitation": "Covers system information discovered by reading a file through a tool call; information volunteered by the model when a user simply asks it questions, with no tool call involved, is not visible."
+    },
+    {
+      "id": "AML.T0069.000",
+      "limitation": "Same limitation as the parent: visible only when discovered via a file or tool-call read, not via conversational probing of the model."
+    },
+    {
+      "id": "AML.T0069.001",
+      "limitation": "Same limitation as the parent: visible only when discovered via a file or tool-call read, not via conversational probing of the model."
+    },
+    {
+      "id": "AML.T0069.002",
+      "limitation": "Same limitation as the parent: visible only when the system prompt is read from a configuration file via a tool call, not when extracted through conversation with the model."
+    },
+    {
+      "id": "AML.T0074",
+      "limitation": "Covers file-metadata and type-masquerading content a tool call returns, the same surface as prompt obfuscation; reclaiming a stale, previously-trusted package or model namespace after it is deleted or renamed is adversary-side registry activity outside the developer’s machine and is not covered."
+    }
+  ],
+  "outOfScope": [
+    {
+      "reason": "These techniques interact directly with the model itself — training or querying a proxy, crafting and verifying adversarial or jailbreak inputs, poisoning weights or training data, or inferring and extracting what the model knows via its inference API and conversational responses — and happen through direct model access or the prompt/response channel between a user and the model, not through an agent's tool calls or the content those calls return, which is the only surface a hook observes.",
+      "ids": [
+        "AML.T0005",
+        "AML.T0005.000",
+        "AML.T0005.001",
+        "AML.T0005.002",
+        "AML.T0013",
+        "AML.T0014",
+        "AML.T0015",
+        "AML.T0018",
+        "AML.T0018.000",
+        "AML.T0018.001",
+        "AML.T0018.002",
+        "AML.T0018.003",
+        "AML.T0020",
+        "AML.T0010.002",
+        "AML.T0024",
+        "AML.T0024.000",
+        "AML.T0024.001",
+        "AML.T0024.002",
+        "AML.T0031",
+        "AML.T0040",
+        "AML.T0042",
+        "AML.T0043",
+        "AML.T0043.000",
+        "AML.T0043.001",
+        "AML.T0043.002",
+        "AML.T0043.003",
+        "AML.T0043.004",
+        "AML.T0044",
+        "AML.T0046",
+        "AML.T0047",
+        "AML.T0054",
+        "AML.T0057",
+        "AML.T0059",
+        "AML.T0061",
+        "AML.T0062",
+        "AML.T0063",
+        "AML.T0065",
+        "AML.T0066",
+        "AML.T0067",
+        "AML.T0067.000",
+        "AML.T0076",
+        "AML.T0102"
+      ]
+    },
+    {
+      "reason": "These are open-source reconnaissance and resource-development activities — searching public research and repositories, scanning or profiling a target, and acquiring infrastructure, accounts, hardware, or attack capabilities — that adversaries carry out on their own systems before ever interacting with the victim's agent, producing no tool call or content for a hook to observe.",
+      "ids": [
+        "AML.T0000",
+        "AML.T0000.000",
+        "AML.T0000.001",
+        "AML.T0000.002",
+        "AML.T0001",
+        "AML.T0002",
+        "AML.T0002.000",
+        "AML.T0002.001",
+        "AML.T0002.002",
+        "AML.T0003",
+        "AML.T0004",
+        "AML.T0006",
+        "AML.T0007",
+        "AML.T0008",
+        "AML.T0008.000",
+        "AML.T0008.001",
+        "AML.T0008.002",
+        "AML.T0008.003",
+        "AML.T0008.004",
+        "AML.T0008.005",
+        "AML.T0010.000",
+        "AML.T0016",
+        "AML.T0016.000",
+        "AML.T0016.001",
+        "AML.T0016.002",
+        "AML.T0016.003",
+        "AML.T0016.004",
+        "AML.T0017",
+        "AML.T0017.000",
+        "AML.T0017.001",
+        "AML.T0017.002",
+        "AML.T0021",
+        "AML.T0041",
+        "AML.T0064",
+        "AML.T0095",
+        "AML.T0095.000",
+        "AML.T0128"
+      ]
+    },
+    {
+      "reason": "These describe publishing, rug-pulling, or building fake reputation for a malicious package, model, dataset, or agent tool on public infrastructure the developer's machine has no view of; the moment Stroq can act is when the agent actually installs or invokes the resulting artifact, which is covered separately under AI Supply Chain Compromise and User Execution.",
+      "ids": [
+        "AML.T0060",
+        "AML.T0079",
+        "AML.T0109",
+        "AML.T0111",
+        "AML.T0115",
+        "AML.T0115.000",
+        "AML.T0115.001",
+        "AML.T0115.002"
+      ]
+    },
+    {
+      "reason": "These target a human being directly through phishing, impersonation, deepfakes, or a malicious link a person is persuaded to click, using channels such as email, voice, and video that never pass through an agent's tool calls.",
+      "ids": [
+        "AML.T0011.003",
+        "AML.T0052",
+        "AML.T0052.000",
+        "AML.T0052.001",
+        "AML.T0073",
+        "AML.T0087",
+        "AML.T0088"
+      ]
+    },
+    {
+      "reason": "These are conventional network and infrastructure attacks — exploiting an application or remote service, flooding or overloading a hosted AI service, evading sandboxes, escaping a container, generic credential or defense-evasion exploits, and command-and-control relayed through an AI service's API or web interface — that target infrastructure generally rather than the specific tool calls an agent's hook observes, and remain the domain of conventional network and host security tooling.",
+      "ids": [
+        "AML.T0036",
+        "AML.T0049",
+        "AML.T0072",
+        "AML.T0089",
+        "AML.T0096",
+        "AML.T0097",
+        "AML.T0105",
+        "AML.T0106",
+        "AML.T0107",
+        "AML.T0114",
+        "AML.T0119",
+        "AML.T0120",
+        "AML.T0122",
+        "AML.T0127",
+        "AML.T0029",
+        "AML.T0034",
+        "AML.T0034.000",
+        "AML.T0034.001",
+        "AML.T0075"
+      ]
+    },
+    {
+      "reason": "These classify the outcome of a successful attack — financial, reputational, societal, or user harm, intellectual property theft, or full compromise of a machine via its local agent — rather than describing a distinct observable action; the actions that produce these outcomes are addressed separately under their own techniques.",
+      "ids": [
+        "AML.T0048",
+        "AML.T0048.000",
+        "AML.T0048.001",
+        "AML.T0048.002",
+        "AML.T0048.003",
+        "AML.T0048.004",
+        "AML.T0112",
+        "AML.T0112.000",
+        "AML.T0112.001"
+      ]
+    },
+    {
+      "reason": "These exploit a chat client's or webpage's rendering layer — an auto-loaded markdown image that exfiltrates data through its URL, or on-screen content baiting a computer-using agent into clicking or copying something — which a hook inspecting structured tool calls and their text content does not parse.",
+      "ids": [
+        "AML.T0077",
+        "AML.T0100"
+      ]
+    },
+    {
+      "reason": "These use a stolen session cookie or access token directly against the AI service's backend, or edit chat history through that same access, bypassing the coding agent entirely rather than acting through its tool calls.",
+      "ids": [
+        "AML.T0091",
+        "AML.T0091.000",
+        "AML.T0091.001",
+        "AML.T0092",
+        "AML.T0113",
+        "AML.T0012"
+      ]
+    },
+    {
+      "reason": "These describe coordinated behavior across one or many autonomous agent runs — independent reconnaissance, attack-path replanning, inter-agent communication, environment reconstruction, or orchestration — as an emergent property of a whole run rather than any single tool call; Stroq evaluates one action at a time and does not mediate coordination between agents today.",
+      "ids": [
+        "AML.T0103",
+        "AML.T0116",
+        "AML.T0117",
+        "AML.T0118",
+        "AML.T0118.000",
+        "AML.T0118.001",
+        "AML.T0121",
+        "AML.T0124"
+      ]
+    }
+  ]
+}

package/openclaw-plugin/README.md

@@ -0,0 +1,49 @@
+# Stroq plugin for OpenClaw
+
+A thin gate that forwards every tool call to the Stroq CLI and does what it says.
+It is shipped inside `@stroq/cli`; `stroq init --agent openclaw` copies it to
+`$STROQ_HOME/openclaw-plugin/` (default `~/.stroq/openclaw-plugin/`), writes a
+`stroq.json` recording how to start Stroq, and then runs — or prints — these two:
+
+    openclaw plugins install --link ~/.stroq/openclaw-plugin
+    openclaw plugins enable stroq
+
+Restart the Gateway afterwards: plugins are loaded when it starts.
+
+## Hooks
+
+- `before_tool_call` (priority 100, no matcher) runs `stroq hook openclaw pre`.
+  `allow` returns nothing, `deny` blocks with the rule and reason, `ask` raises a
+  `requireApproval` prompt answered with `/approve <id> allow-once|deny`.
+- `after_tool_call` runs `stroq hook openclaw post`, which scans the result, records
+  provenance and taints the session. It is observe-only: the warning is logged, the
+  taint is enforced on the next tool call.
+
+**Fail-closed.** Every one of these blocks the call, which is OpenClaw's own policy
+for this hook: a missing binary, a spawn error, a non-zero exit, a timeout, an aborted
+run, a reply larger than 1 MiB (a hung CLI, not a decision), params that cannot be
+serialised, stdout that is not JSON or is JSON but not an object, and a decision this
+plugin does not know. `after_tool_call` never throws — the tool has already run — and
+a scan that fails there is logged at `warn`, since a failed scan means no taint.
+
+If the `stroq.json` `init` recorded points at an entry that no longer exists (an npx
+cache that has since been pruned), the plugin logs one warning and falls back to
+`stroq` on PATH rather than blocking every call on the same ENOENT. When there is no
+Stroq on PATH either, the call still fails closed.
+
+## Configuration
+
+`plugins.entries.stroq.config` in `openclaw.json`. It is read **once**, when the
+plugin registers, so restart the Gateway after changing any of it:
+
+| Key            | Default                            | What it does                                                                                                                                                                                                                                                                                                                                                                                          |
+| -------------- | ---------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `stroqBin`     | `stroq.json`, else `stroq` on PATH | Path to the Stroq binary to spawn, as one string (never split on spaces, and never existence-checked — a binary you named must fail loudly rather than be silently replaced). `STROQ_BIN` is read before `stroq.json`, and a `stroq.json` whose recorded entry file is gone is skipped in favour of PATH. A launch command needing extra arguments belongs in `stroq.json`'s `command` array instead. |
+| `workspace`    | the Gateway's `process.cwd()`      | The project directory for the secret index and path rules. A tool call's own `params.cwd` is never used for this, for any tool including `exec`: honouring one would let an agent point it at an empty directory and slip past a secret-egress guard.                                                                                                                                                 |
+| `timeoutMs`    | `10000`                            | How long Stroq gets to answer before the call is blocked.                                                                                                                                                                                                                                                                                                                                             |
+| `askTimeoutMs` | `120000`                           | How long an approval prompt stays open, clamped to OpenClaw's documented 1 000–600 000 ms range.                                                                                                                                                                                                                                                                                                      |
+| `logLevel`     | the Gateway's own                  | Declared for the plugin manager's UI; this entry logs at fixed levels (`warn` for a block, a suspect result, a failed post scan or a stale `stroq.json`, `info` for an approval resolution) and lets the Gateway's logger filter them.                                                                                                                                                                |
+
+Set `plugins.entries.stroq.enabled` to `true`, and add `stroq` to `plugins.allow` if
+an allowlist is configured. This directory has no dependencies and is plain ESM
+JavaScript, so nothing is installed or built when it is linked.

package/openclaw-plugin/index.js

@@ -0,0 +1,146 @@
+// Stroq plugin for OpenClaw: turns `before_tool_call` / `after_tool_call` into
+// `stroq hook openclaw pre|post` child-process calls (spawning is in run-stroq.js).
+// Fail-closed by construction — every one of these blocks the call: a missing binary,
+// a spawn error, a non-zero exit, a timeout, an aborted run, a reply larger than
+// 1 MiB, params that cannot be serialised, stdout that is not JSON or is JSON but not
+// an object, and a decision this file does not know.
+import { createRequire } from 'node:module';
+import { clip, runStroq, text } from './run-stroq.js';
+
+const DESCRIPTION =
+  'Local action firewall for OpenClaw: scans what the agent reads, taints the session, blocks or asks before dangerous tool calls.';
+const DEFAULT_ASK_TIMEOUT_MS = 120000;
+// OpenClaw's own documented bounds for an approval prompt. A `timeoutMs` past the
+// maximum is not a longer prompt, it is a `requireApproval` the Gateway may reject
+// outright — and a rejected approval is a call nobody was ever asked about.
+const MIN_ASK_TIMEOUT_MS = 1000;
+const MAX_ASK_TIMEOUT_MS = 600000;
+const MAX_TITLE = 80;
+const MAX_DESCRIPTION = 512;
+const load = createRequire(import.meta.url);
+
+/** `definePluginEntry`, from whichever SDK path this Gateway build exposes. */
+function resolveDefinePluginEntry() {
+  for (const id of ['openclaw/plugin-sdk/plugin-entry', 'openclaw/plugin-sdk/core']) {
+    try {
+      const mod = load(id);
+      const fn = mod?.definePluginEntry ?? mod?.default?.definePluginEntry;
+      if (typeof fn === 'function') return fn;
+    } catch {
+      // not exposed by this build; try the next id, then fall back to bare `register`
+    }
+  }
+  return null;
+}
+
+/** Logging never decides anything: an absent logger is skipped and a throwing one is swallowed. */
+function logAt(api, level, message) {
+  const fn = api && api.logger && api.logger[level];
+  try {
+    if (typeof fn === 'function') fn.call(api.logger, message);
+  } catch {}
+}
+
+/**
+ * Both phases' payload. `cwd` is always the plugin's OWN directory — `config.workspace`,
+ * else `process.cwd()` — and never a tool call's `params.cwd`: honouring a
+ * model-supplied `cwd` here would let any tool point the project directory (and so
+ * the secret index) at an empty one and walk straight past a secret-egress guard.
+ * `exec` is no exception: the CLI adapter also never reads `params.cwd` for this
+ * (Task 4.5 review, Critical — it used to, and that was the actual bypass). `params`
+ * is still forwarded whole regardless, `cwd` included, purely for the audit trail.
+ */
+function payloadFor(phase, event, ctx, config) {
+  const params = event.params && typeof event.params === 'object' ? event.params : {};
+  const c = ctx || {};
+  const base = {
+    sessionId: text(c.sessionKey) || text(c.sessionId) || 'openclaw',
+    agentId: c.agentId,
+    runId: c.runId ?? event.runId,
+    toolCallId: c.toolCallId ?? event.toolCallId,
+    toolKind: event.toolKind ?? c.toolKind,
+    requester: c.requester,
+    toolName: text(event.toolName),
+    params,
+    cwd: text(config.workspace) || process.cwd(),
+  };
+  if (phase === 'pre') return base;
+  return { ...base, result: event.result, error: event.error, durationMs: event.durationMs };
+}
+
+/** How long the prompt stays open, clamped to the range OpenClaw documents. */
+function askTimeout(config) {
+  const configured = Number(config.askTimeoutMs);
+  if (!(configured > 0)) return DEFAULT_ASK_TIMEOUT_MS;
+  return Math.min(Math.max(configured, MIN_ASK_TIMEOUT_MS), MAX_ASK_TIMEOUT_MS);
+}
+
+/** `ask` as OpenClaw's approval request, inside its documented 80/512/600 000 caps. */
+function approval(api, event, reply, config) {
+  const ms = askTimeout(config);
+  return {
+    title: clip(`Stroq: ${text(reply.ruleId) || 'policy'}`, MAX_TITLE),
+    description: clip(text(reply.reason) || 'Stroq asks before this action.', MAX_DESCRIPTION),
+    severity: 'warning',
+    // `allow-always` is deliberately not offered: Stroq audits every ask, and a
+    // remembered allow is one it would never be asked about again.
+    allowedDecisions: ['allow-once', 'deny'],
+    timeoutMs: ms,
+    onResolution: (decision) =>
+      logAt(api, 'info', `stroq: approval ${decision} for ${text(event.toolName)}`),
+  };
+}
+
+export function register(api) {
+  const config = (api && api.pluginConfig) || {};
+  // `detail` is clipped like a child's stderr: it is a block reason shown to a user.
+  const block = (event, detail) => {
+    const clipped = clip(String(detail), 300);
+    logAt(api, 'warn', `stroq: ${text(event && event.toolName) || 'tool'}: ${clipped}`);
+    return { block: true, blockReason: `Stroq internal error (fail-closed): ${clipped}` };
+  };
+  // A stale `stroq.json` entry is reported at `warn`: the operator should repair it.
+  const warn = (message) => logAt(api, 'warn', `stroq: ${message}`);
+  // Priority 100 so Stroq answers before ordinary hooks; no matcher, every tool goes through.
+  api.on(
+    'before_tool_call',
+    async (event, ctx) => {
+      let outcome;
+      try {
+        const payload = payloadFor('pre', event, ctx, config);
+        outcome = await runStroq(config, 'pre', payload, ctx?.abortSignal, warn);
+      } catch (err) {
+        return block(event, `cannot read the tool call: ${String(err)}`);
+      }
+      if (outcome.error) return block(event, outcome.error);
+      const reply = outcome.reply;
+      if (reply.decision === 'allow') return undefined;
+      if (reply.decision === 'ask') return { requireApproval: approval(api, event, reply, config) };
+      if (reply.decision === 'deny')
+        return {
+          block: true,
+          blockReason: `Stroq blocked this action (${text(reply.ruleId) || 'policy'}): ${text(reply.reason) || 'no reason given'}`,
+        };
+      return block(event, `unknown decision ${JSON.stringify(reply.decision)}`);
+    },
+    { priority: 100 },
+  );
+  // Observe-only and never throws; the taint it sets is enforced on the NEXT call. The
+  // abort signal is not forwarded: a cancelled run's result must still be scanned.
+  api.on('after_tool_call', async (event, ctx) => {
+    try {
+      const payload = payloadFor('post', event, ctx, config);
+      const outcome = await runStroq(config, 'post', payload, undefined, warn);
+      // `warn`: a scan nobody looked at leaves the session untainted; operators must see it.
+      if (outcome.error) logAt(api, 'warn', `stroq: post scan failed: ${outcome.error}`);
+      else if (text(outcome.reply.warning)) logAt(api, 'warn', `stroq: ${outcome.reply.warning}`);
+    } catch (err) {
+      logAt(api, 'warn', `stroq: post scan failed: ${String(err)}`);
+    }
+  });
+}
+
+const definePluginEntry = resolveDefinePluginEntry();
+export default definePluginEntry
+  ? definePluginEntry({ id: 'stroq', name: 'Stroq', description: DESCRIPTION, register })
+  : register;

package/openclaw-plugin/openclaw.plugin.json

@@ -0,0 +1,27 @@
+{
+  "id": "stroq",
+  "name": "Stroq",
+  "description": "Local action firewall for OpenClaw: scans what the agent reads, taints the session, blocks or asks before dangerous tool calls.",
+  "version": "0.11.0",
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": false,
+    "properties": {
+      "stroqBin": { "type": "string" },
+      "workspace": { "type": "string" },
+      "timeoutMs": { "type": "integer", "minimum": 1000 },
+      "askTimeoutMs": { "type": "integer", "minimum": 1000 },
+      "logLevel": { "type": "string", "enum": ["warn", "info", "debug"] }
+    }
+  },
+  "uiHints": {
+    "stroqBin": {
+      "label": "stroq command",
+      "help": "Path to the stroq binary. Defaults to `stroq` on PATH, then the path recorded by `stroq init --agent openclaw`."
+    },
+    "workspace": {
+      "label": "Project directory",
+      "help": "Used for the secret index and path classification. A tool call's own cwd is never used for this — see the plugin README."
+    }
+  }
+}