@upx-us/shield 0.2.12-beta

package/dist/src/events/exec/event.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/events/exec/index.d.ts

@@ -0,0 +1,4 @@
+import { EventSchema } from '../base';
+import { ExecEvent } from './event';
+export type { ExecEvent };
+export declare const ExecSchema: EventSchema<ExecEvent>;

package/dist/src/events/exec/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExecSchema = void 0;
+const enrich_1 = require("./enrich");
+const redactions_1 = require("./redactions");
+const validations_1 = require("./validations");
+exports.ExecSchema = {
+    category: 'exec',
+    match: (tool) => tool.name === 'exec',
+    enrich: enrich_1.enrich,
+    redactions: redactions_1.redactions,
+    validate: validations_1.validate,
+};

package/dist/src/events/exec/redactions.d.ts

@@ -0,0 +1,3 @@
+import { FieldRedaction } from '../base';
+/** Exec-specific redaction rules. Base redactions (principal.hostname, principal.user) are applied automatically. */
+export declare const redactions: FieldRedaction[];

package/dist/src/events/exec/redactions.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactions = void 0;
+/** Exec-specific redaction rules. Base redactions (principal.hostname, principal.user) are applied automatically. */
+exports.redactions = [
+    { path: 'command', strategy: 'command' },
+    { path: 'command', strategy: 'secret-key' },
+    { path: 'workdir', strategy: 'path' },
+    { path: 'target.command_line', strategy: 'command' },
+    { path: 'target.command_line', strategy: 'secret-key' },
+    { path: 'target.hostname', strategy: 'hostname' },
+];

package/dist/src/events/exec/validations.d.ts

@@ -0,0 +1,3 @@
+import { ValidationResult } from '../base';
+import { ExecEvent } from './event';
+export declare function validate(event: ExecEvent): ValidationResult;

package/dist/src/events/exec/validations.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validate = validate;
+function validate(event) {
+    if (!event.command)
+        return { valid: false, field: 'command', error: 'missing command' };
+    if (!event.target?.command_line)
+        return { valid: false, field: 'target.command_line', error: 'missing target.command_line' };
+    if (event.network && !event.network.protocol)
+        return { valid: false, field: 'network.protocol', error: 'network present but missing protocol' };
+    return { valid: true };
+}

package/dist/src/events/file/enrich.d.ts

@@ -0,0 +1,3 @@
+import { RawToolCall, EnrichmentContext } from '../base';
+import { FileEvent } from './event';
+export declare function enrich(tool: RawToolCall, ctx: EnrichmentContext): FileEvent;

package/dist/src/events/file/enrich.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enrich = enrich;
+const path_1 = require("path");
+const base_1 = require("../base");
+function enrich(tool, ctx) {
+    const args = tool.arguments;
+    const fp = args.file_path || args.path || args.filePath || '';
+    const ext = (0, path_1.extname)(fp) || null;
+    const isSystem = /^\/(etc|usr|var|sys|proc)(\/|$)/.test(fp);
+    const configExts = ['.json', '.yaml', '.yml', '.toml', '.env', '.conf', '.cfg', '.ini'];
+    // Note: extname('.env') returns '' in Node (dotfiles treated as no extension).
+    // file_is_config uses extension-based detection only. Dotfile detection is a known
+    // limitation (issue #6) — tracked for a future dedicated dotfile enrichment rule.
+    const isMemoryFile = /\/(MEMORY\.md|memory\/.*\.md)$/.test(fp);
+    const toolName = tool.name;
+    const meta = {
+        tool_name: toolName,
+        'openclaw.session_id': ctx.sessionId,
+        'openclaw.agent_id': ctx.agentId,
+        file_is_workspace: fp.includes('.openclaw/workspace'),
+        file_is_system: isSystem,
+        file_is_config: ext ? configExts.includes(ext) : false,
+    };
+    if ((toolName === 'write' || toolName === 'edit') && isMemoryFile) {
+        meta.memory_auto_capture = 'true';
+    }
+    if (toolName === 'edit') {
+        const oldText = args.oldText || args.old_string || '';
+        const newText = args.newText || args.new_string || '';
+        meta.edit_old_length = String(oldText.length);
+        meta.edit_new_length = String(newText.length);
+        meta.edit_size_delta = String(newText.length - oldText.length);
+    }
+    const event = {
+        timestamp: ctx.timestamp,
+        event_type: 'TOOL_CALL',
+        tool_name: toolName,
+        tool_category: 'file',
+        session_id: ctx.sessionId,
+        model: ctx.model,
+        product_name: 'OpenClaw',
+        vendor_name: 'UPX',
+        principal: {
+            hostname: ctx.source.hostname,
+            ip: ctx.source.ip_addresses?.[0] || '',
+            platform: ctx.source.os.platform,
+            user: ctx.agentId,
+        },
+        file_path: fp,
+        target: {
+            file_path: fp,
+            file_name: (0, path_1.basename)(fp),
+            file_extension: ext,
+            file_directory: (0, path_1.dirname)(fp),
+        },
+        tool_metadata: (0, base_1.stringifyMetadata)(meta),
+    };
+    if (isSystem) {
+        event.security_result = { severity: 'HIGH', summary: `System ${toolName} operation`, category: 'system_tampering' };
+    }
+    return event;
+}

package/dist/src/events/file/event.d.ts

@@ -0,0 +1,11 @@
+import { BaseEvent, SecurityResultBlock } from '../base';
+export interface FileEvent extends BaseEvent, Partial<SecurityResultBlock> {
+    tool_category: 'file';
+    file_path: string;
+    target: {
+        file_path: string;
+        file_name: string;
+        file_extension: string | null;
+        file_directory: string;
+    };
+}

package/dist/src/events/file/event.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/events/file/index.d.ts

@@ -0,0 +1,4 @@
+import { EventSchema } from '../base';
+import { FileEvent } from './event';
+export type { FileEvent };
+export declare const FileSchema: EventSchema<FileEvent>;

package/dist/src/events/file/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FileSchema = void 0;
+const enrich_1 = require("./enrich");
+const redactions_1 = require("./redactions");
+const validations_1 = require("./validations");
+exports.FileSchema = {
+    category: 'file',
+    match: (tool) => ['read', 'write', 'edit'].includes(tool.name),
+    enrich: enrich_1.enrich,
+    redactions: redactions_1.redactions,
+    validate: validations_1.validate,
+};

package/dist/src/events/file/redactions.d.ts

@@ -0,0 +1,2 @@
+import { FieldRedaction } from '../base';
+export declare const redactions: FieldRedaction[];

package/dist/src/events/file/redactions.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactions = void 0;
+exports.redactions = [
+    { path: 'file_path', strategy: 'path' },
+    { path: 'target.file_path', strategy: 'path' },
+    { path: 'target.file_directory', strategy: 'path' },
+];

package/dist/src/events/file/validations.d.ts

@@ -0,0 +1,3 @@
+import { ValidationResult } from '../base';
+import { FileEvent } from './event';
+export declare function validate(event: FileEvent): ValidationResult;

package/dist/src/events/file/validations.js

@@ -0,0 +1,10 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validate = validate;
+function validate(event) {
+    if (!event.file_path)
+        return { valid: false, field: 'file_path', error: 'missing file_path' };
+    if (!event.target?.file_name)
+        return { valid: false, field: 'target.file_name', error: 'missing target.file_name' };
+    return { valid: true };
+}

package/dist/src/events/gateway/enrich.d.ts

@@ -0,0 +1,3 @@
+import { RawToolCall, EnrichmentContext } from '../base';
+import { GatewayEvent } from './event';
+export declare function enrich(tool: RawToolCall, ctx: EnrichmentContext): GatewayEvent;

package/dist/src/events/gateway/enrich.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enrich = enrich;
+const base_1 = require("../base");
+function enrich(tool, ctx) {
+    const args = tool.arguments;
+    const action = args.action || '';
+    const meta = {
+        tool_name: 'gateway',
+        'openclaw.session_id': ctx.sessionId,
+        'openclaw.agent_id': ctx.agentId,
+        sub_action: action,
+        gateway_is_restart: action === 'restart',
+        gateway_is_config_change: action.startsWith('config.'),
+        gateway_is_update: action === 'update.run',
+    };
+    if (action === 'config.apply' || action === 'config.patch') {
+        meta.gateway_config_action = action;
+        if (args.raw) {
+            meta.gateway_config_has_host_change = /\bhost\b.*:/.test(args.raw);
+            meta.gateway_config_has_auth_change = /\b(auth|token|secret|password)\b/i.test(args.raw);
+        }
+    }
+    const event = {
+        timestamp: ctx.timestamp,
+        event_type: 'TOOL_CALL',
+        tool_name: 'gateway',
+        tool_category: 'gateway',
+        session_id: ctx.sessionId,
+        model: ctx.model,
+        product_name: 'OpenClaw',
+        vendor_name: 'UPX',
+        principal: {
+            hostname: ctx.source.hostname,
+            ip: ctx.source.ip_addresses?.[0] || '',
+            platform: ctx.source.os.platform,
+            user: ctx.agentId,
+        },
+        arguments_summary: (0, base_1.truncate)(JSON.stringify(args || {})),
+        tool_metadata: (0, base_1.stringifyMetadata)(meta),
+    };
+    if (meta.gateway_is_config_change || meta.gateway_is_restart || meta.gateway_is_update) {
+        event.security_result = {
+            severity: action === 'config.apply' ? 'HIGH' : 'MEDIUM',
+            summary: `Gateway ${action} operation`,
+            category: 'config_change',
+        };
+    }
+    return event;
+}

package/dist/src/events/gateway/event.d.ts

@@ -0,0 +1,5 @@
+import { BaseEvent, SecurityResultBlock } from '../base';
+export interface GatewayEvent extends BaseEvent, Partial<SecurityResultBlock> {
+    tool_category: 'gateway';
+    arguments_summary?: string;
+}

package/dist/src/events/gateway/event.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/events/gateway/index.d.ts

@@ -0,0 +1,4 @@
+import { EventSchema } from '../base';
+import { GatewayEvent } from './event';
+export type { GatewayEvent };
+export declare const GatewaySchema: EventSchema<GatewayEvent>;

package/dist/src/events/gateway/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GatewaySchema = void 0;
+const enrich_1 = require("./enrich");
+const redactions_1 = require("./redactions");
+const validations_1 = require("./validations");
+exports.GatewaySchema = {
+    category: 'gateway',
+    match: (tool) => tool.name === 'gateway',
+    enrich: enrich_1.enrich,
+    redactions: redactions_1.redactions,
+    validate: validations_1.validate,
+};

package/dist/src/events/gateway/redactions.d.ts

@@ -0,0 +1,2 @@
+import { FieldRedaction } from '../base';
+export declare const redactions: FieldRedaction[];

package/dist/src/events/gateway/redactions.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactions = void 0;
+exports.redactions = [];

package/dist/src/events/gateway/validations.d.ts

@@ -0,0 +1,3 @@
+import { ValidationResult } from '../base';
+import { GatewayEvent } from './event';
+export declare function validate(_event: GatewayEvent): ValidationResult;

package/dist/src/events/gateway/validations.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validate = validate;
+function validate(_event) { return { valid: true }; }

package/dist/src/events/generic/enrich.d.ts

@@ -0,0 +1,3 @@
+import { RawToolCall, EnrichmentContext } from '../base';
+import { GenericEvent } from './event';
+export declare function enrich(tool: RawToolCall, ctx: EnrichmentContext): GenericEvent;

package/dist/src/events/generic/enrich.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enrich = enrich;
+const base_1 = require("../base");
+function enrich(tool, ctx) {
+    const args = tool.arguments;
+    return {
+        timestamp: ctx.timestamp,
+        event_type: 'TOOL_CALL',
+        tool_name: tool.name,
+        tool_category: 'generic',
+        session_id: ctx.sessionId,
+        model: ctx.model,
+        product_name: 'OpenClaw',
+        vendor_name: 'UPX',
+        principal: {
+            hostname: ctx.source.hostname,
+            ip: ctx.source.ip_addresses?.[0] || '',
+            platform: ctx.source.os.platform,
+            user: ctx.agentId,
+        },
+        arguments_summary: (0, base_1.truncate)(JSON.stringify(args || {})),
+        tool_metadata: (0, base_1.stringifyMetadata)({
+            tool_name: tool.name,
+            'openclaw.session_id': ctx.sessionId,
+            'openclaw.agent_id': ctx.agentId,
+            sub_action: args.action || null,
+        }),
+    };
+}

package/dist/src/events/generic/event.d.ts

@@ -0,0 +1,5 @@
+import { BaseEvent } from '../base';
+export interface GenericEvent extends BaseEvent {
+    tool_category: 'generic';
+    arguments_summary?: string;
+}

package/dist/src/events/generic/event.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/events/generic/index.d.ts

@@ -0,0 +1,5 @@
+import { EventSchema } from '../base';
+import { GenericEvent } from './event';
+export type { GenericEvent };
+/** Fallback schema — always matches. MUST be last in the registry. */
+export declare const GenericSchema: EventSchema<GenericEvent>;

package/dist/src/events/generic/index.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GenericSchema = void 0;
+const enrich_1 = require("./enrich");
+const redactions_1 = require("./redactions");
+const validations_1 = require("./validations");
+/** Fallback schema — always matches. MUST be last in the registry. */
+exports.GenericSchema = {
+    category: 'generic',
+    match: (_tool) => true,
+    enrich: enrich_1.enrich,
+    redactions: redactions_1.redactions,
+    validate: validations_1.validate,
+};

package/dist/src/events/generic/redactions.d.ts

@@ -0,0 +1,2 @@
+import { FieldRedaction } from '../base';
+export declare const redactions: FieldRedaction[];

package/dist/src/events/generic/redactions.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactions = void 0;
+exports.redactions = [];

package/dist/src/events/generic/validations.d.ts

@@ -0,0 +1,3 @@
+import { ValidationResult } from '../base';
+import { GenericEvent } from './event';
+export declare function validate(_event: GenericEvent): ValidationResult;

package/dist/src/events/generic/validations.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validate = validate;
+function validate(_event) { return { valid: true }; }

package/dist/src/events/host-telemetry/enrich.d.ts

@@ -0,0 +1,3 @@
+import { RawToolCall, EnrichmentContext } from '../base';
+import { HostTelemetryEvent } from './event';
+export declare function enrich(_tool: RawToolCall, ctx: EnrichmentContext): HostTelemetryEvent;

package/dist/src/events/host-telemetry/enrich.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enrich = enrich;
+const base_1 = require("../base");
+function enrich(_tool, ctx) {
+    const version = ctx.source.openclaw.version;
+    const versionSortable = version.split('.').map((p, i) => i > 0 ? p.padStart(2, '0') : p).join('.');
+    return {
+        timestamp: ctx.timestamp,
+        event_type: 'TOOL_CALL',
+        tool_name: 'host_telemetry',
+        tool_category: 'host_telemetry',
+        session_id: ctx.sessionId,
+        product_name: 'OpenClaw',
+        vendor_name: 'UPX',
+        principal: {
+            hostname: ctx.source.hostname,
+            ip: ctx.source.ip_addresses?.[0] || '',
+            platform: ctx.source.os.platform,
+            user: ctx.agentId,
+        },
+        tool_metadata: (0, base_1.stringifyMetadata)({
+            tool_name: 'host_telemetry',
+            'openclaw.version': version,
+            'openclaw.version_sortable': versionSortable,
+        }),
+    };
+}

package/dist/src/events/host-telemetry/event.d.ts

@@ -0,0 +1,4 @@
+import { BaseEvent } from '../base';
+export interface HostTelemetryEvent extends BaseEvent {
+    tool_category: 'host_telemetry';
+}

package/dist/src/events/host-telemetry/event.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/events/host-telemetry/index.d.ts

@@ -0,0 +1,4 @@
+import { EventSchema } from '../base';
+import { HostTelemetryEvent } from './event';
+export type { HostTelemetryEvent };
+export declare const HostTelemetrySchema: EventSchema<HostTelemetryEvent>;

package/dist/src/events/host-telemetry/index.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HostTelemetrySchema = void 0;
+const enrich_1 = require("./enrich");
+const redactions_1 = require("./redactions");
+const validations_1 = require("./validations");
+exports.HostTelemetrySchema = {
+    category: 'host_telemetry',
+    match: (tool) => tool.name === 'host_telemetry',
+    enrich: enrich_1.enrich,
+    redactions: redactions_1.redactions,
+    validate: validations_1.validate,
+};

package/dist/src/events/host-telemetry/redactions.d.ts

@@ -0,0 +1,2 @@
+import { FieldRedaction } from '../base';
+export declare const redactions: FieldRedaction[];

package/dist/src/events/host-telemetry/redactions.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactions = void 0;
+exports.redactions = [];

package/dist/src/events/host-telemetry/validations.d.ts

@@ -0,0 +1,3 @@
+import { ValidationResult } from '../base';
+import { HostTelemetryEvent } from './event';
+export declare function validate(_event: HostTelemetryEvent): ValidationResult;

package/dist/src/events/host-telemetry/validations.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validate = validate;
+function validate(_event) { return { valid: true }; }

package/dist/src/events/index.d.ts

@@ -0,0 +1,40 @@
+/**
+ * src/events/index.ts — Shield Event Registry
+ *
+ * Imports all schemas and builds the ordered lookup array.
+ * GenericSchema is always last — it matches everything and acts as the fallback.
+ * First match wins; schemas are evaluated in order.
+ */
+import { EventSchema } from './base';
+export type { ExecEvent } from './exec';
+export type { FileEvent } from './file';
+export type { WebEvent } from './web';
+export type { BrowserEvent } from './browser';
+export type { MessageEvent } from './message';
+export type { SessionsSpawnEvent } from './sessions-spawn';
+export type { CronEvent } from './cron';
+export type { GatewayEvent } from './gateway';
+export type { HostTelemetryEvent } from './host-telemetry';
+export type { ToolResultEvent } from './tool-result';
+export type { GenericEvent } from './generic';
+export type { BaseEvent, EventSchema, SourceInfo } from './base';
+export { buildToolResult } from './tool-result';
+import type { ExecEvent } from './exec';
+import type { FileEvent } from './file';
+import type { WebEvent } from './web';
+import type { BrowserEvent } from './browser';
+import type { MessageEvent } from './message';
+import type { SessionsSpawnEvent } from './sessions-spawn';
+import type { CronEvent } from './cron';
+import type { GatewayEvent } from './gateway';
+import type { HostTelemetryEvent } from './host-telemetry';
+import type { ToolResultEvent } from './tool-result';
+import type { GenericEvent } from './generic';
+/** Discriminated union of all Shield event types */
+export type ShieldEvent = ExecEvent | FileEvent | WebEvent | BrowserEvent | MessageEvent | SessionsSpawnEvent | CronEvent | GatewayEvent | HostTelemetryEvent | ToolResultEvent | GenericEvent;
+/**
+ * Ordered registry of all event schemas.
+ * GenericSchema MUST remain last.
+ * eslint-disable-next-line @typescript-eslint/no-explicit-any
+ */
+export declare const schemas: EventSchema<any>[];

package/dist/src/events/index.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * src/events/index.ts — Shield Event Registry
+ *
+ * Imports all schemas and builds the ordered lookup array.
+ * GenericSchema is always last — it matches everything and acts as the fallback.
+ * First match wins; schemas are evaluated in order.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schemas = exports.buildToolResult = void 0;
+const exec_1 = require("./exec");
+const file_1 = require("./file");
+const web_1 = require("./web");
+const browser_1 = require("./browser");
+const message_1 = require("./message");
+const sessions_spawn_1 = require("./sessions-spawn");
+const cron_1 = require("./cron");
+const gateway_1 = require("./gateway");
+const host_telemetry_1 = require("./host-telemetry");
+const generic_1 = require("./generic");
+var tool_result_1 = require("./tool-result");
+Object.defineProperty(exports, "buildToolResult", { enumerable: true, get: function () { return tool_result_1.buildToolResult; } });
+/**
+ * Ordered registry of all event schemas.
+ * GenericSchema MUST remain last.
+ * eslint-disable-next-line @typescript-eslint/no-explicit-any
+ */
+exports.schemas = [
+    exec_1.ExecSchema,
+    file_1.FileSchema,
+    web_1.WebSchema,
+    browser_1.BrowserSchema,
+    message_1.MessageSchema,
+    sessions_spawn_1.SessionsSpawnSchema,
+    cron_1.CronSchema,
+    gateway_1.GatewaySchema,
+    host_telemetry_1.HostTelemetrySchema,
+    generic_1.GenericSchema, // always last
+];

package/dist/src/events/message/enrich.d.ts

@@ -0,0 +1,3 @@
+import { RawToolCall, EnrichmentContext } from '../base';
+import { MessageEvent } from './event';
+export declare function enrich(tool: RawToolCall, ctx: EnrichmentContext): MessageEvent;

package/dist/src/events/message/enrich.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.enrich = enrich;
+const base_1 = require("../base");
+function enrich(tool, ctx) {
+    const args = tool.arguments;
+    const meta = {
+        tool_name: 'message',
+        'openclaw.session_id': ctx.sessionId,
+        'openclaw.agent_id': ctx.agentId,
+        sub_action: args.action || null,
+    };
+    if (args.buffer) {
+        meta.has_base64_payload = 'true';
+        const raw = typeof args.buffer === 'string' ? args.buffer.replace(/^data:[^;]+;base64,/, '') : '';
+        meta.payload_size_bytes = String(Math.floor(raw.length * 0.75));
+    }
+    return {
+        timestamp: ctx.timestamp,
+        event_type: 'TOOL_CALL',
+        tool_name: 'message',
+        tool_category: 'message',
+        session_id: ctx.sessionId,
+        model: ctx.model,
+        product_name: 'OpenClaw',
+        vendor_name: 'UPX',
+        principal: {
+            hostname: ctx.source.hostname,
+            ip: ctx.source.ip_addresses?.[0] || '',
+            platform: ctx.source.os.platform,
+            user: ctx.agentId,
+        },
+        arguments_summary: (0, base_1.truncate)(JSON.stringify(args || {})),
+        tool_metadata: (0, base_1.stringifyMetadata)(meta),
+    };
+}

package/dist/src/events/message/event.d.ts

@@ -0,0 +1,5 @@
+import { BaseEvent } from '../base';
+export interface MessageEvent extends BaseEvent {
+    tool_category: 'message';
+    arguments_summary?: string;
+}

package/dist/src/events/message/event.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/events/message/index.d.ts

@@ -0,0 +1,4 @@
+import { EventSchema } from '../base';
+import { MessageEvent } from './event';
+export type { MessageEvent };
+export declare const MessageSchema: EventSchema<MessageEvent>;