@upx-us/shield 0.7.0 → 0.7.1

package/CHANGELOG.md

@@ -4,6 +4,16 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.7.1] — 2026-03-13
+
+### Added
+- Case ownership awareness: `shield cases` now shows which cases belong to this instance vs other instances in the org
+- `--mine` flag for `shield cases` and `shield cases list` to filter to locally-owned cases
+- Sibling case detail view: `shield cases show <ID>` notes when a case belongs to another org instance and clarifies that remote investigation requires direct platform access
+- Attribution summary line when listing mixed-ownership cases
+
+---
+
 ## [0.7.0] — 2026-03-13
 
 ### Added

package/dist/src/cli-cases.js

@@ -48,7 +48,7 @@ function registerCasesCli(shieldCommand) {
     const cases = shieldCommand.command('cases')
         .description('List and manage Shield security cases');
     cases.action(async () => {
-        await listCases({ status: 'open', limit: '20', format: 'table' });
+        await listCases({ status: 'open', limit: '20', format: 'table', mine: false });
     });
     cases
         .command('list')
@@ -56,6 +56,7 @@ function registerCasesCli(shieldCommand) {
         .option('--status <status>', 'Filter: open, resolved, all', 'open')
         .option('--limit <n>', 'Max results', '20')
         .option('--format <fmt>', 'Output format: table or json', 'table')
+        .option('--mine', 'Show only cases from this instance')
         .action(listCases);
     cases
         .command('show')
@@ -108,15 +109,37 @@ async function listCases(opts) {
         console.log(JSON.stringify(result, null, 2));
         return;
     }
-    if (result.cases.length === 0) {
+    const own = result.cases.filter((c) => c.ownership === 'own').length;
+    const sibling = result.cases.filter((c) => c.ownership === 'sibling').length;
+    const unknown = result.cases.filter((c) => c.ownership === 'unknown' || c.ownership == null).length;
+    const visible = opts.mine
+        ? result.cases.filter((c) => c.is_mine === true)
+        : result.cases;
+    if (visible.length === 0 && opts.mine && result.cases.length > 0) {
+        console.log('No cases attributed to this instance. Other org instances have open cases \u2014 run without --mine to see them.');
+        return;
+    }
+    if (visible.length === 0) {
         console.log('No open cases. \u2705');
         return;
     }
-    console.log(`Cases (${result.cases.length} of ${result.total}):\n`);
-    for (const c of result.cases) {
+    if (sibling > 0 || (own > 0 && unknown > 0)) {
+        const parts = [];
+        if (own > 0)
+            parts.push(`${own} from this instance`);
+        if (sibling > 0)
+            parts.push(`${sibling} from other instances`);
+        if (unknown > 0)
+            parts.push(`${unknown} unattributed`);
+        console.log(`Attribution: ${parts.join(', ')}  (use --mine to filter)\n`);
+    }
+    console.log(`Cases (${visible.length} of ${result.total}):\n`);
+    for (const c of visible) {
         const sev = (c.severity || '').padEnd(8);
         const time = new Date(c.created_at).toLocaleString();
-        console.log(`  [${sev}] ${c.id}`);
+        const ownershipTag = c.ownership === 'own' ? ' [mine]' :
+            c.ownership === 'sibling' ? ' [sibling]' : '';
+        console.log(`  [${sev}]${ownershipTag} ${c.id}`);
         console.log(`           ${c.rule_title || c.rule_id}`);
         console.log(`           ${c.summary || ''}`);
         console.log(`           Created: ${time}  Events: ${c.event_count || 0}\n`);
@@ -138,6 +161,12 @@ async function showCase(id, opts) {
     }
     console.log(`Case: ${result.id}`);
     console.log(`Status: ${result.status}  Severity: ${result.severity}`);
+    if (result.ownership === 'sibling') {
+        console.log(`Instance: sibling (belongs to another instance in your org \u2014 you can resolve it, but local log access is unavailable)`);
+    }
+    else if (result.ownership === 'own') {
+        console.log(`Instance: this instance`);
+    }
     console.log(`Rule: ${result.rule_title || result.rule_id}`);
     console.log(`Summary: ${result.summary || '\u2014'}`);
     console.log(`Created: ${new Date(result.created_at).toLocaleString()}`);

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "shield",
   "name": "OpenClaw Shield",
   "description": "Real-time security monitoring \u2014 streams enriched, redacted security events to the Shield detection platform.",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "skills": [
     "./skills"
   ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upx-us/shield",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Security monitoring plugin for OpenClaw agents — streams enriched security events to the Shield detection platform",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/skills/shield/SKILL.md

@@ -31,6 +31,8 @@ Shield requires the `@upx-us/shield` plugin and an active subscription.
 | `openclaw shield logs --format json` | JSON output |
 | `openclaw shield vault show` | Agent and workspace inventory, redaction summary (hashed IDs) |
 | `openclaw shield cases` | List open security cases |
+| `openclaw shield cases --mine` | List only cases from this instance |
+| `openclaw shield cases list --mine` | Show only cases from this instance |
 | `openclaw shield cases show <ID>` | Full case detail with events, rule, playbook |
 | `openclaw shield cases resolve <ID>` | Resolve a case (--resolution, --root-cause, --comment) |
 | `openclaw shield monitor` | Case notification cron — status, --on, --off, --interval |
@@ -78,6 +80,8 @@ Proceed normally. No onboarding message needed.
 
 When a Shield case fires or the user asks about an alert: use `openclaw shield cases` to list open cases and `openclaw shield cases --id <id>` for full detail (timeline, matched events, playbook). Severity guidance: **CRITICAL/HIGH** → surface immediately and ask if they want to investigate; **MEDIUM** → present and offer a playbook walkthrough; **LOW/INFO** → mention without interrupting the current task. Always include: rule name, what it detects, when it fired, and the first recommended remediation step. Confirm with the user before resolving — never resolve autonomously.
 
+When listing cases, note how many belong to this instance vs other org instances. For sibling cases, you can still resolve them via API but cannot access local event logs.
+
 ## Case Investigation Workflow
 
 When a Shield case fires, correlate three data sources to determine true positive vs. false positive: