@termix-it/cryptoclaw 1.0.0

package/extensions/blockchain/src/evm/tools/tx-tools.ts

@@ -0,0 +1,73 @@
+import type { OpenClawPluginApi } from "cryptoclaw/plugin-sdk";
+import type { WalletManager } from "../../wallet/wallet-manager.js";
+import { DEFAULT_CHAIN_ID, resolveChainId } from "../chains.js";
+import { estimateGas, getTransaction, getTransactionReceipt } from "../services/transactions.js";
+import { formatJson } from "../services/utils.js";
+
+export function registerTxTools(api: OpenClawPluginApi, _walletManager: WalletManager) {
+  api.registerTool({
+    name: "get_transaction",
+    description: "Get details of a transaction by its hash",
+    parameters: {
+      type: "object",
+      properties: {
+        txHash: { type: "string", description: "Transaction hash (0x-prefixed)" },
+        network: { type: "string", description: 'Network name or chain ID (default: "bsc")' },
+      },
+      required: ["txHash"],
+    },
+    async execute(_toolCallId: string, params: { txHash: string; network?: string }) {
+      const chainId = params.network ? resolveChainId(params.network) : DEFAULT_CHAIN_ID;
+      const tx = await getTransaction(params.txHash as `0x${string}`, chainId);
+      return { content: [{ type: "text", text: formatJson(tx) }] };
+    },
+  });
+
+  api.registerTool({
+    name: "get_transaction_receipt",
+    description: "Get the receipt (status, gas used, logs) of a transaction",
+    parameters: {
+      type: "object",
+      properties: {
+        txHash: { type: "string", description: "Transaction hash (0x-prefixed)" },
+        network: { type: "string", description: 'Network name or chain ID (default: "bsc")' },
+      },
+      required: ["txHash"],
+    },
+    async execute(_toolCallId: string, params: { txHash: string; network?: string }) {
+      const chainId = params.network ? resolveChainId(params.network) : DEFAULT_CHAIN_ID;
+      const receipt = await getTransactionReceipt(params.txHash as `0x${string}`, chainId);
+      return { content: [{ type: "text", text: formatJson(receipt) }] };
+    },
+  });
+
+  api.registerTool({
+    name: "estimate_gas",
+    description: "Estimate gas cost for a transaction",
+    parameters: {
+      type: "object",
+      properties: {
+        to: { type: "string", description: "Destination address" },
+        value: { type: "string", description: "Value in wei (optional)" },
+        data: { type: "string", description: "Transaction data (hex, optional)" },
+        network: { type: "string", description: 'Network name or chain ID (default: "bsc")' },
+      },
+      required: ["to"],
+    },
+    async execute(
+      _toolCallId: string,
+      params: { to: string; value?: string; data?: string; network?: string },
+    ) {
+      const chainId = params.network ? resolveChainId(params.network) : DEFAULT_CHAIN_ID;
+      const result = await estimateGas(
+        {
+          to: params.to,
+          value: params.value ? BigInt(params.value) : undefined,
+          data: params.data as `0x${string}` | undefined,
+        },
+        chainId,
+      );
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
+    },
+  });
+}

package/extensions/blockchain/src/evm/tools/wallet-tools.ts

@@ -0,0 +1,196 @@
+import type { OpenClawPluginApi } from "cryptoclaw/plugin-sdk";
+import type { WalletManager } from "../../wallet/wallet-manager.js";
+
+/**
+ * Register wallet management tools for the agent.
+ *
+ * Security design:
+ * - wallet_export is CLI-only (not registered here) — private keys never enter agent context
+ * - wallet_import is CLI-only — private keys should never be pasted in chat
+ * - wallet_create / wallet_delete / wallet_unlock accept passphrase as a tool parameter
+ *   so the agent can ask the user in chat (works across gateway/TUI/messaging channels)
+ * - Passphrases are listed in SENSITIVE_PARAM_NAMES and stripped from persisted context
+ * - Only safe metadata operations (list, switch) need no passphrase
+ */
+export function registerWalletTools(api: OpenClawPluginApi, walletManager: WalletManager) {
+  api.registerTool({
+    name: "wallet_create",
+    description:
+      "Create a new blockchain wallet with a random private key. " +
+      "Ask the user for a passphrase in chat, then call this tool with it.",
+    parameters: {
+      type: "object",
+      properties: {
+        label: {
+          type: "string",
+          description: "Human-friendly name for the wallet (e.g. 'Trading', 'Savings')",
+        },
+        passphrase: {
+          type: "string",
+          description: "Passphrase to encrypt the wallet (ask the user in chat first)",
+        },
+      },
+      required: ["label", "passphrase"],
+    },
+    async execute(_toolCallId: string, params: { label: string; passphrase: string }) {
+      try {
+        const wallet = await walletManager.createWallet(params.label, params.passphrase);
+        return {
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                {
+                  message: "Wallet created successfully",
+                  label: wallet.label,
+                  address: wallet.address,
+                  // Intentionally omit: id, privateKey, passphrase
+                },
+                null,
+                2,
+              ),
+            },
+          ],
+        };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error";
+        return {
+          content: [{ type: "text", text: `Failed to create wallet: ${msg}` }],
+        };
+      }
+    },
+  });
+
+  // wallet_import is NOT registered as an agent tool.
+  // Users must use `cryptoclaw wallet import` in the terminal.
+  // This prevents private keys from ever flowing through the agent context.
+
+  api.registerTool({
+    name: "wallet_list",
+    description: "List all wallets with addresses and labels. Does not expose private keys.",
+    parameters: { type: "object", properties: {} },
+    async execute(_toolCallId: string) {
+      const { wallets, activeWalletId } = walletManager.listWallets();
+      return {
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(
+              {
+                wallets: wallets.map((w) => ({
+                  label: w.label,
+                  address: w.address,
+                  isActive: w.id === activeWalletId,
+                  createdAt: w.createdAt,
+                  // Intentionally omit: id (internal detail)
+                })),
+                total: wallets.length,
+              },
+              null,
+              2,
+            ),
+          },
+        ],
+      };
+    },
+  });
+
+  api.registerTool({
+    name: "wallet_switch",
+    description: "Switch the active wallet used for blockchain operations",
+    parameters: {
+      type: "object",
+      properties: {
+        label: { type: "string", description: "Wallet label to switch to" },
+      },
+      required: ["label"],
+    },
+    async execute(_toolCallId: string, params: { label: string }) {
+      try {
+        const wallet = walletManager.switchWallet(params.label);
+        return {
+          content: [
+            {
+              type: "text",
+              text: `Switched to wallet "${wallet.label}" (${wallet.address})`,
+            },
+          ],
+        };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error";
+        return {
+          content: [{ type: "text", text: `Failed to switch wallet: ${msg}` }],
+        };
+      }
+    },
+  });
+
+  api.registerTool({
+    name: "wallet_delete",
+    description:
+      "Delete a wallet permanently. Ask the user for their passphrase in chat to confirm, then call this tool with it.",
+    parameters: {
+      type: "object",
+      properties: {
+        label: { type: "string", description: "Wallet label to delete" },
+        passphrase: {
+          type: "string",
+          description: "Wallet passphrase to confirm deletion (ask the user in chat first)",
+        },
+      },
+      required: ["label", "passphrase"],
+    },
+    async execute(_toolCallId: string, params: { label: string; passphrase: string }) {
+      try {
+        await walletManager.deleteWallet(params.label, params.passphrase);
+        return {
+          content: [{ type: "text", text: `Wallet "${params.label}" deleted successfully.` }],
+        };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error";
+        return {
+          content: [{ type: "text", text: `Failed to delete wallet: ${msg}` }],
+        };
+      }
+    },
+  });
+
+  api.registerTool({
+    name: "wallet_unlock",
+    description:
+      "Unlock the active wallet. Ask the user for their passphrase in chat, then call this tool with it. " +
+      "Call this when a transaction fails with 'Passphrase required to unlock wallet'.",
+    parameters: {
+      type: "object",
+      properties: {
+        passphrase: {
+          type: "string",
+          description: "Wallet passphrase (ask the user in chat first)",
+        },
+      },
+      required: ["passphrase"],
+    },
+    async execute(_toolCallId: string, params: { passphrase: string }) {
+      try {
+        await walletManager.getActivePrivateKey(params.passphrase);
+        return {
+          content: [
+            {
+              type: "text",
+              text: "Wallet unlocked successfully. You can now proceed with the transaction.",
+            },
+          ],
+        };
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : "Unknown error";
+        return {
+          content: [{ type: "text", text: `Failed to unlock wallet: ${msg}` }],
+        };
+      }
+    },
+  });
+
+  // wallet_export is NOT registered as an agent tool.
+  // Users must use `cryptoclaw wallet export <label>` in the terminal.
+  // This is the most critical security boundary — private keys must NEVER enter agent context.
+}

package/extensions/blockchain/src/tx-gate/confirmation.ts

@@ -0,0 +1,55 @@
+/** Tool names that require transaction confirmation before execution. */
+export const STATE_CHANGING_TOOLS = new Set([
+  "transfer_native_token",
+  "transfer_erc20",
+  "approve_token_spending",
+  "transfer_nft",
+  "transfer_erc1155",
+  "write_contract",
+  "swap_execute",
+  "wallet_delete",
+  "agent_register",
+  "agent_set_wallet",
+  // wallet_export is CLI-only — not an agent tool, no confirmation needed here
+]);
+
+/**
+ * Check if a tool call requires user confirmation.
+ * Used in the before_tool_call hook to gate state-changing operations.
+ */
+export function requiresConfirmation(toolName: string): boolean {
+  return STATE_CHANGING_TOOLS.has(toolName);
+}
+
+/**
+ * Format a human-readable transaction summary for confirmation.
+ */
+export function formatConfirmationPrompt(
+  toolName: string,
+  params: Record<string, unknown>,
+): string {
+  switch (toolName) {
+    case "transfer_native_token":
+      return `Transfer ${String(params.amount)} native tokens to ${String(params.to)} on ${String(params.network) || "default network"}`;
+    case "transfer_erc20":
+      return `Transfer ${String(params.amount)} of token ${String(params.tokenAddress)} to ${String(params.to)} on ${String(params.network) || "default network"}`;
+    case "approve_token_spending":
+      return `Approve ${String(params.spender)} to spend ${String(params.amount)} of token ${String(params.tokenAddress)}`;
+    case "transfer_nft":
+      return `Transfer NFT #${String(params.tokenId)} from ${String(params.nftAddress)} to ${String(params.to)}`;
+    case "transfer_erc1155":
+      return `Transfer ${String(params.amount)} of token #${String(params.tokenId)} from ${String(params.tokenAddress)} to ${String(params.to)}`;
+    case "write_contract":
+      return `Call ${String(params.functionName)}() on contract ${String(params.contractAddress)}`;
+    case "swap_execute":
+      return `Swap ${String(params.amountIn)} ${params.tokenIn === "native" ? "native token" : String(params.tokenIn)} → ${params.tokenOut === "native" ? "native token" : String(params.tokenOut)} on ${String(params.network) || "bsc"}`;
+    case "wallet_delete":
+      return `Delete wallet "${String(params.label)}"`;
+    case "agent_register":
+      return `Register agent identity on ${String(params.network) || "bsc"} with URI: ${String(params.agentURI)}`;
+    case "agent_set_wallet":
+      return `Set agent #${String(params.agentId) || "stored"} wallet to ${String(params.walletAddress)} on ${String(params.network) || "bsc"}`;
+    default:
+      return `Execute ${toolName} with params: ${JSON.stringify(params)}`;
+  }
+}

package/extensions/blockchain/src/tx-gate/spending-limits.ts

@@ -0,0 +1,94 @@
+import fs from "node:fs";
+import path from "node:path";
+
+export type SpendingLimitsConfig = {
+  maxTxValueUsd: number;
+  dailyLimitUsd: number;
+  confirmAll: boolean;
+};
+
+export const DEFAULT_SPENDING_LIMITS: SpendingLimitsConfig = {
+  maxTxValueUsd: 1000,
+  dailyLimitUsd: 5000,
+  confirmAll: true,
+};
+
+type SpendingLogEntry = {
+  timestamp: string;
+  toolName: string;
+  valueUsd: number;
+  txHash?: string;
+  network: string;
+};
+
+/**
+ * Track daily spending and enforce limits.
+ */
+export class SpendingTracker {
+  private readonly logPath: string;
+
+  constructor(stateDir: string) {
+    const walletsDir = path.join(stateDir, "wallets");
+    if (!fs.existsSync(walletsDir)) {
+      fs.mkdirSync(walletsDir, { recursive: true });
+    }
+    this.logPath = path.join(walletsDir, "spending-log.jsonl");
+  }
+
+  /** Log a spending event. */
+  logSpend(entry: SpendingLogEntry): void {
+    const line = JSON.stringify(entry) + "\n";
+    fs.appendFileSync(this.logPath, line);
+  }
+
+  /** Get total USD spent today. */
+  getDailyTotal(): number {
+    if (!fs.existsSync(this.logPath)) {
+      return 0;
+    }
+
+    const todayStart = new Date();
+    todayStart.setHours(0, 0, 0, 0);
+    const todayMs = todayStart.getTime();
+
+    const lines = fs.readFileSync(this.logPath, "utf8").trim().split("\n");
+    let total = 0;
+    for (const line of lines) {
+      if (!line) {
+        continue;
+      }
+      try {
+        const entry = JSON.parse(line) as SpendingLogEntry;
+        if (new Date(entry.timestamp).getTime() >= todayMs) {
+          total += entry.valueUsd;
+        }
+      } catch {
+        // Skip malformed lines
+      }
+    }
+    return total;
+  }
+
+  /** Check if a transaction would exceed spending limits. */
+  checkLimits(
+    valueUsd: number,
+    limits: SpendingLimitsConfig,
+  ): { allowed: boolean; reason?: string } {
+    if (valueUsd > limits.maxTxValueUsd) {
+      return {
+        allowed: false,
+        reason: `Transaction value ($${valueUsd.toFixed(2)}) exceeds per-transaction limit ($${limits.maxTxValueUsd})`,
+      };
+    }
+
+    const dailyTotal = this.getDailyTotal();
+    if (dailyTotal + valueUsd > limits.dailyLimitUsd) {
+      return {
+        allowed: false,
+        reason: `Transaction would exceed daily limit. Spent today: $${dailyTotal.toFixed(2)}, limit: $${limits.dailyLimitUsd}`,
+      };
+    }
+
+    return { allowed: true };
+  }
+}

package/extensions/blockchain/src/wallet/active-wallet.ts

@@ -0,0 +1,27 @@
+import type { WalletManager } from "./wallet-manager.js";
+
+/**
+ * Resolve the active wallet's private key for tool operations.
+ * This is the bridge between the wallet manager and the EVM tools —
+ * tools call this instead of requiring users to paste private keys.
+ */
+export async function resolveActivePrivateKey(
+  walletManager: WalletManager,
+): Promise<`0x${string}`> {
+  if (!walletManager.hasWallets()) {
+    throw new Error(
+      "No wallets configured. Use `cryptoclaw wallet create` or `cryptoclaw wallet import` first.",
+    );
+  }
+
+  const address = walletManager.getActiveAddress();
+  if (!address) {
+    throw new Error(
+      "No active wallet selected. Use `cryptoclaw wallet switch <id>` to select one.",
+    );
+  }
+
+  // Try cached passphrase first, then throw if not available
+  const key = await walletManager.getActivePrivateKey();
+  return key;
+}

package/extensions/blockchain/src/wallet/key-guard.test.ts

@@ -0,0 +1,156 @@
+import { describe, expect, it } from "vitest";
+import {
+  sanitizeSecrets,
+  containsPrivateKey,
+  CLI_ONLY_TOOLS,
+  SENSITIVE_PARAM_NAMES,
+  KEY_GUARD_SYSTEM_PROMPT,
+} from "./key-guard.js";
+
+describe("key-guard", () => {
+  describe("sanitizeSecrets", () => {
+    it("redacts 0x-prefixed 64-char hex private key", () => {
+      const key = "0x" + "a".repeat(64);
+      const result = sanitizeSecrets(`My key is ${key} done`);
+      expect(result).toBe("My key is [REDACTED_PRIVATE_KEY] done");
+      expect(result).not.toContain(key);
+    });
+
+    it("redacts bare 64-char hex string", () => {
+      const bareKey = "ab".repeat(32);
+      const result = sanitizeSecrets(`Key: ${bareKey}`);
+      expect(result).toContain("[REDACTED_PRIVATE_KEY]");
+      expect(result).not.toContain(bareKey);
+    });
+
+    it("redacts multiple private keys in one string", () => {
+      const key1 = "0x" + "1a".repeat(32);
+      const key2 = "0x" + "2b".repeat(32);
+      const result = sanitizeSecrets(`first: ${key1} second: ${key2}`);
+      expect(result).not.toContain(key1);
+      expect(result).not.toContain(key2);
+      expect(result.match(/\[REDACTED_PRIVATE_KEY\]/g)?.length).toBeGreaterThanOrEqual(2);
+    });
+
+    it("redacts 12-word mnemonic seed phrase", () => {
+      const mnemonic =
+        "abandon ability able about above absent absorb abstract absurd abuse access accident";
+      const result = sanitizeSecrets(`Seed: ${mnemonic}`);
+      expect(result).toContain("[REDACTED_SEED_PHRASE]");
+      expect(result).not.toContain(mnemonic);
+    });
+
+    it("redacts 24-word mnemonic seed phrase", () => {
+      const words =
+        "abandon ability able about above absent absorb abstract absurd abuse access accident " +
+        "abandon ability able about above absent absorb abstract absurd abuse access accident";
+      const result = sanitizeSecrets(`Seed: ${words}`);
+      expect(result).toContain("[REDACTED_SEED_PHRASE]");
+    });
+
+    it("preserves normal text without secrets", () => {
+      const normal = "Hello, this is a normal message about wallet operations.";
+      expect(sanitizeSecrets(normal)).toBe(normal);
+    });
+
+    it("preserves short hex strings (not private keys)", () => {
+      const shortHex = "0x1234abcd";
+      const result = sanitizeSecrets(`Address: ${shortHex}`);
+      expect(result).toContain(shortHex);
+    });
+
+    it("preserves Ethereum addresses (42 chars)", () => {
+      const address = "0xdAC17F958D2ee523a2206206994597C13D831ec7";
+      const result = sanitizeSecrets(`To: ${address}`);
+      expect(result).toContain(address);
+    });
+
+    it("handles empty string", () => {
+      expect(sanitizeSecrets("")).toBe("");
+    });
+
+    it("handles string with mixed content", () => {
+      const key = "0x" + "ff".repeat(32);
+      const result = sanitizeSecrets(
+        `Transfer to 0xdAC17F958D2ee523a2206206994597C13D831ec7 using key ${key}`,
+      );
+      expect(result).toContain("0xdAC17F958D2ee523a2206206994597C13D831ec7");
+      expect(result).not.toContain(key);
+    });
+  });
+
+  describe("containsPrivateKey", () => {
+    it("detects 0x-prefixed private key", () => {
+      const key = "0x" + "ab".repeat(32);
+      expect(containsPrivateKey(`key: ${key}`)).toBe(true);
+    });
+
+    it("detects bare 64-char hex key", () => {
+      const bareKey = "cd".repeat(32);
+      expect(containsPrivateKey(bareKey)).toBe(true);
+    });
+
+    it("rejects short hex strings", () => {
+      expect(containsPrivateKey("0x1234abcd")).toBe(false);
+    });
+
+    it("rejects normal text", () => {
+      expect(containsPrivateKey("Hello world, no keys here")).toBe(false);
+    });
+
+    it("rejects empty string", () => {
+      expect(containsPrivateKey("")).toBe(false);
+    });
+  });
+
+  describe("CLI_ONLY_TOOLS", () => {
+    it("contains wallet_export", () => {
+      expect(CLI_ONLY_TOOLS.has("wallet_export")).toBe(true);
+    });
+
+    it("is a Set", () => {
+      expect(CLI_ONLY_TOOLS).toBeInstanceOf(Set);
+    });
+  });
+
+  describe("SENSITIVE_PARAM_NAMES", () => {
+    it("contains privateKey", () => {
+      expect(SENSITIVE_PARAM_NAMES.has("privateKey")).toBe(true);
+    });
+
+    it("contains passphrase", () => {
+      expect(SENSITIVE_PARAM_NAMES.has("passphrase")).toBe(true);
+    });
+
+    it("contains mnemonic", () => {
+      expect(SENSITIVE_PARAM_NAMES.has("mnemonic")).toBe(true);
+    });
+
+    it("contains password", () => {
+      expect(SENSITIVE_PARAM_NAMES.has("password")).toBe(true);
+    });
+
+    it("contains seedPhrase", () => {
+      expect(SENSITIVE_PARAM_NAMES.has("seedPhrase")).toBe(true);
+    });
+
+    it("contains secret", () => {
+      expect(SENSITIVE_PARAM_NAMES.has("secret")).toBe(true);
+    });
+  });
+
+  describe("KEY_GUARD_SYSTEM_PROMPT", () => {
+    it("is a non-empty string", () => {
+      expect(typeof KEY_GUARD_SYSTEM_PROMPT).toBe("string");
+      expect(KEY_GUARD_SYSTEM_PROMPT.length).toBeGreaterThan(0);
+    });
+
+    it("mentions private key protection", () => {
+      expect(KEY_GUARD_SYSTEM_PROMPT).toContain("PRIVATE KEY");
+    });
+
+    it("mentions CLI-only operations", () => {
+      expect(KEY_GUARD_SYSTEM_PROMPT).toContain("wallet_export");
+    });
+  });
+});

package/extensions/blockchain/src/wallet/key-guard.ts

@@ -0,0 +1,80 @@
+/**
+ * Key Guard — multi-layered private key and passphrase leak prevention.
+ *
+ * Defense layers:
+ * 1. Tool design: sensitive ops (export, import) are CLI-only, not agent tools
+ * 2. Parameter stripping: passphrase/privateKey never appear as tool parameters
+ * 3. Result sanitization: all tool results are scrubbed via tool_result_persist
+ * 4. Outbound sanitization: messages to channels are scrubbed via message_sending
+ * 5. System prompt: agent is instructed to never output private keys
+ */
+
+/** Pattern: 0x followed by exactly 64 hex characters (Ethereum private key). */
+const PRIVATE_KEY_RE = /0x[a-fA-F0-9]{64}/g;
+
+/** Pattern: hex strings of 64 chars without 0x prefix that look like keys. */
+const BARE_HEX_KEY_RE = /(?<![a-fA-F0-9])[a-fA-F0-9]{64}(?![a-fA-F0-9])/g;
+
+/** Pattern: common mnemonic seed phrase (12 or 24 lowercase words). */
+const MNEMONIC_RE = /\b([a-z]{3,8}\s+){11,23}[a-z]{3,8}\b/g;
+
+const REDACTED = "[REDACTED_PRIVATE_KEY]";
+const REDACTED_MNEMONIC = "[REDACTED_SEED_PHRASE]";
+
+/**
+ * Scrub private keys and seed phrases from arbitrary text.
+ * Safe to call on any string — returns original if nothing found.
+ */
+export function sanitizeSecrets(text: string): string {
+  let result = text;
+  result = result.replace(PRIVATE_KEY_RE, REDACTED);
+  result = result.replace(BARE_HEX_KEY_RE, (_match) => {
+    // Avoid false positives: only redact if it doesn't look like a tx hash or address
+    // Transaction hashes are 64 hex chars but are typically prefixed by context like "txHash"
+    // We redact standalone 64-char hex to be safe
+    return REDACTED;
+  });
+  result = result.replace(MNEMONIC_RE, REDACTED_MNEMONIC);
+  return result;
+}
+
+/**
+ * Check if text contains anything that looks like a private key.
+ */
+export function containsPrivateKey(text: string): boolean {
+  return PRIVATE_KEY_RE.test(text) || BARE_HEX_KEY_RE.test(text);
+}
+
+/**
+ * List of tool names that should NEVER be available as agent tools.
+ * These operations are restricted to CLI-only access.
+ */
+export const CLI_ONLY_TOOLS = new Set(["wallet_export"]);
+
+/**
+ * List of parameter names that should be stripped from tool_result_persist output
+ * and never appear in persisted agent context.
+ */
+export const SENSITIVE_PARAM_NAMES = new Set([
+  "privateKey",
+  "passphrase",
+  "password",
+  "mnemonic",
+  "seedPhrase",
+  "secret",
+]);
+
+/**
+ * System prompt guard text injected via before_agent_start.
+ * Instructs the agent to never handle or output private keys.
+ */
+export const KEY_GUARD_SYSTEM_PROMPT = `
+[SECURITY — PRIVATE KEY PROTECTION]
+CRITICAL RULES — violating these is a security incident:
+1. NEVER output, display, repeat, or include a private key (0x + 64 hex chars) in ANY message
+2. If the wallet is locked (error: "Passphrase required to unlock wallet"), ask the user for their passphrase in chat, then call wallet_unlock with it. After unlocking, retry the original operation. The wallet stays unlocked for subsequent operations — do NOT ask for the passphrase again unless you get another "Passphrase required" error.
+3. If a user pastes a private key in chat, respond ONLY with: "For security, please use \`cryptoclaw wallet import\` in your terminal. Never share private keys in chat."
+4. wallet_export and wallet_import are CLI-only — do NOT attempt to call them
+5. For wallet creation: call wallet_create with a label and passphrase (ask the user for the passphrase in chat first)
+6. If you see a private key in any tool result, do NOT include it in your response
+`.trim();