@upx-us/shield 0.7.5 → 0.7.6

package/CHANGELOG.md

@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 
 ---
 
+## [0.7.6] — 2026-03-13
+
+### Security
+- **URL enforcement switched to allowlist** — plugin traffic is restricted to the Shield ingest endpoint. Any other URL is rejected and replaced with the default. No infrastructure details are disclosed in source.
+
+---
+
 ## [0.7.5] — 2026-03-13
 
 ### Security

package/dist/src/config.js

@@ -139,18 +139,11 @@ function loadCredentials() {
     };
 }
 const CANONICAL_INGEST_URL = 'https://openclaw-shield.upx.com';
-const BLOCKED_HOST_PATTERNS = [
-    /^https?:\/\/uss\.upx\.com/i,
-    /^https?:\/\/[a-z0-9-]+\.replit\.app/i,
-    /^https?:\/\/egupx-/i,
-];
 function enforceIngestUrl(url) {
-    if (!url)
-        return CANONICAL_INGEST_URL;
-    const isBlocked = BLOCKED_HOST_PATTERNS.some(p => p.test(url));
-    if (isBlocked) {
-        log.warn('config', `SHIELD_API_URL points to a platform backend ("${url}") — this is not permitted. ` +
-            `Overriding with ${CANONICAL_INGEST_URL}. Remove SHIELD_API_URL from your config to fix this permanently.`);
+    if (!url || !url.startsWith(CANONICAL_INGEST_URL)) {
+        if (url && url !== CANONICAL_INGEST_URL) {
+            log.warn('config', `SHIELD_API_URL is not a permitted ingest endpoint — overriding with the default. Remove SHIELD_API_URL from your config to fix this permanently.`);
+        }
         return CANONICAL_INGEST_URL;
     }
     return url;

package/dist/src/rpc/client.js

@@ -57,11 +57,10 @@ async function callPlatformApi(config, path, params, method) {
             error: 'Platform API not configured. This feature requires the Shield platform API which is not yet available for your instance. Check your Shield dashboard for updates.',
         };
     }
-    const BLOCKED = [/^https?:\/\/uss\.upx\.com/i, /^https?:\/\/[a-z0-9-]+\.replit\.app/i, /^https?:\/\/egupx-/i];
-    if (BLOCKED.some(p => p.test(config.apiUrl))) {
+    if (!config.apiUrl.startsWith('https://openclaw-shield.upx.com')) {
         return {
             ok: false,
-            error: 'Shield API URL points to a platform backend — direct access is not permitted. Reconfigure Shield to use the ingest endpoint.',
+            error: 'Shield API URL is not the permitted ingest endpoint. Reconfigure Shield or contact support.',
         };
     }
     const url = new URL(path, config.apiUrl);

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "shield",
   "name": "OpenClaw Shield",
   "description": "Real-time security monitoring \u2014 streams enriched, redacted security events to the Shield detection platform.",
-  "version": "0.7.5",
+  "version": "0.7.6",
   "skills": [
     "./skills"
   ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@upx-us/shield",
-  "version": "0.7.5",
+  "version": "0.7.6",
   "description": "Security monitoring plugin for OpenClaw agents — streams enriched security events to the Shield detection platform",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",