@volcengine/agent-sentry 1.7.1 → 1.8.1

package/bundle.js

@@ -182149,6 +182149,27 @@ var MessageCache = class {
 init_define_process_env();
 var import_node_https2 = __toESM(require("node:https"), 1);
 init_src();
+
+// src/utils/volcengine-lumen-auth.ts
+init_define_process_env();
+var VOLCENGINE_API_KEY_ENV = "VOLCENGINE_API_KEY";
+function readVolcengineLumenApiKey() {
+  const runtime = globalThis;
+  const apiKey = runtime.process?.env?.[VOLCENGINE_API_KEY_ENV]?.trim();
+  return apiKey || void 0;
+}
+function applyLumenIamAuthorization(headers, apiKey) {
+  if (!apiKey) {
+    return { ...headers };
+  }
+  const result = Object.fromEntries(
+    Object.entries(headers).filter(([name]) => name.toLowerCase() !== "authorization")
+  );
+  result.Authorization = `Bearer ${apiKey}`;
+  return result;
+}
+
+// src/client.ts
 var HttpError = class extends Error {
   constructor(message, status, statusText, body) {
     super(message);
@@ -182229,6 +182250,7 @@ var LLMShieldClient = class _LLMShieldClient {
     this.ctEndpoint = (options.ctEndpoint || "").replace(/\/$/, "");
     this.lmEndpoint = (options.lmEndpoint || "").replace(/\/$/, "");
     this.apiKey = options.apiKey;
+    this.lumenIamApiKey = readVolcengineLumenApiKey();
     this.timeoutMs = options.timeoutMs ?? 3e4;
     this.logger = options.logger;
     this.logRecord = Boolean(options.logRecord);
@@ -182277,10 +182299,13 @@ var LLMShieldClient = class _LLMShieldClient {
     const mergedSignal = signal ? AbortSignal.any([controller.signal, signal]) : controller.signal;
     const startedAt = Date.now();
     try {
-      const headers = {
+      let headers = {
         "Content-Type": "application/json",
         ...extraHeaders
       };
+      if (_LLMShieldClient.LUMEN_PATHS.has(path25)) {
+        headers = applyLumenIamAuthorization(headers, this.lumenIamApiKey);
+      }
       const resp = await this.fetchFn(
         url2,
         this.buildFetchInit(url2, {
@@ -182365,11 +182390,13 @@ var LLMShieldClient = class _LLMShieldClient {
       const path25 = "/OpenTOP/V1/Lumen/Moderate";
       const endpoint = this.getEndpointForPath(path25);
       const url2 = `${endpoint}${path25}`;
+      const headers = applyLumenIamAuthorization({}, this.lumenIamApiKey);
       const resp = await this.fetchFn(
         url2,
         this.buildFetchInit(url2, {
           method: "OPTIONS",
           // Use OPTIONS or a simple GET to check connectivity
+          headers,
           signal: controller.signal
         })
       );
@@ -184981,7 +185008,7 @@ var VOLCENGINE_AICC_MODEL_CATALOG = [
     id: "deepseek-v4-pro",
     name: "DeepSeek V4 Pro (AICC)",
     reasoning: true,
-    input: ["text", "image"],
+    input: ["text"],
     contextWindow: 1e6,
     maxTokens: 8192
   },
@@ -184989,7 +185016,7 @@ var VOLCENGINE_AICC_MODEL_CATALOG = [
     id: "glm-5.1",
     name: "GLM 5.1 (AICC)",
     reasoning: true,
-    input: ["text", "image"],
+    input: ["text"],
     contextWindow: 2e5,
     maxTokens: 8192
   },
@@ -185005,7 +185032,7 @@ var VOLCENGINE_AICC_MODEL_CATALOG = [
     id: "glm-4.7",
     name: "GLM 4.7 (AICC)",
     reasoning: true,
-    input: ["text", "image"],
+    input: ["text"],
     contextWindow: 2e5,
     maxTokens: 8192
   }
@@ -187112,35 +187139,9 @@ function stringifyToolParamsForModeration(params) {
     return String(params ?? "");
   }
 }
-function pickToolParamString(params, keys) {
-  if (!params || typeof params !== "object" || Array.isArray(params)) {
-    return void 0;
-  }
-  const record2 = params;
-  for (const key of keys) {
-    const value = record2[key];
-    if (typeof value === "string" && value.trim()) {
-      return value.trim();
-    }
-  }
-  return void 0;
-}
 function buildBeforeToolCallModerationContent(params) {
   const toolName = String(params.toolName ?? "not_available");
-  if (params.inlineContent) {
-    return `Tool: ${toolName}
-FileContent:
-${params.inlineContent}`;
-  }
-  const command = pickToolParamString(params.toolParams, ["command", "cmd", "script", "input"]);
-  if (!command) {
-    return `Tool: ${toolName}, Params: ${params.toolParamsText}`;
-  }
-  return [
-    `Tool: ${toolName}`,
-    `Command: ${command}`,
-    `Params: ${params.toolParamsText}`
-  ].join("\n");
+  return `Tool: ${toolName}, Params: ${params.toolParamsText}`;
 }
 
 // src/hooks.ts
@@ -187615,8 +187616,7 @@ async function checkBeforeToolCallAndMaybeBlock({
     let content = buildBeforeToolCallModerationContent({
       toolName: event.toolName,
       toolParamsText,
-      toolParams: event.params,
-      inlineContent: inlineFilePayload.inlineContent
+      toolParams: event.params
     });
     if (thinkingContent) {
       content = `${thinkingContent}
@@ -199488,16 +199488,20 @@ var ProxyRaProvider = class {
   constructor(proxyInfo) {
     this.type = "proxy";
     this.proxyInfo = proxyInfo;
+    this.lumenIamApiKey = readVolcengineLumenApiKey();
   }
   async attest(request) {
     const url2 = new URL(this.proxyInfo.url);
     const body = JSON.stringify(request);
-    const headers = {
-      "Content-Type": "application/json",
-      "X-Ai-Claw-Id": this.proxyInfo.clawId,
-      "X-Ai-Claw-Api-Key": this.proxyInfo.clawApiKey,
-      "X-Ai-Device-Fingerprint": this.proxyInfo.fingerprint
-    };
+    const headers = applyLumenIamAuthorization(
+      {
+        "Content-Type": "application/json",
+        "X-Ai-Claw-Id": this.proxyInfo.clawId,
+        "X-Ai-Claw-Api-Key": this.proxyInfo.clawApiKey,
+        "X-Ai-Device-Fingerprint": this.proxyInfo.fingerprint
+      },
+      this.lumenIamApiKey
+    );
     aiccFileLogger.info(`RA attest (proxy): fetch ${url2}`);
     const response = await httpRequest(url2, "POST", headers, body);
     const responseJson = JSON.parse(response);
@@ -199989,7 +199993,7 @@ function warmupVolcengineAiccAttestation() {
       await sleep6(AICC_WARMUP_MAP_WAIT_INTERVAL_MS);
     }
     if (contexts.length === 0) {
-      log2.warn(`AICC RA WARMUP skipped: ListClawModelRelation map still empty after ${AICC_WARMUP_MAP_WAIT_MAX_ATTEMPTS} attempts (will attest lazily on first request)`);
+      log2.debug(`AICC RA WARMUP skipped: ListClawModelRelation map still empty after ${AICC_WARMUP_MAP_WAIT_MAX_ATTEMPTS} attempts (will attest lazily on first request)`);
       return;
     }
     const context = contexts[0];
@@ -200524,12 +200528,11 @@ async function readErrorBody(response, cryptoContext, rawBody) {
   }
   try {
     const decrypted = await decrypt(rawBody, cryptoContext);
-    if (typeof decrypted === "string") {
-      return `${response.status} decrypted error body redacted`;
-    }
-    return `${response.status} decrypted error body redacted`;
+    const errorBody = typeof decrypted === "string" ? decrypted : JSON.stringify(decrypted);
+    return `${response.status} ${errorBody || response.statusText || "error body unavailable"}`;
   } catch {
-    return `${response.status} ${response.statusText || "error body redacted"}`;
+    const rawErrorBody = new TextDecoder().decode(rawBody).trim();
+    return `${response.status} ${rawErrorBody || response.statusText || "error body unavailable"}`;
   }
 }
 function createVolcengineAiccStreamFn(ctx) {
@@ -201007,6 +201010,7 @@ var ApiClient2 = class {
     this.endpoint = config2.endpoint.replace(/\/$/, "");
     this.apiKey = config2.apiKey;
     this.pluginClawId = config2.pluginClawId;
+    this.lumenIamApiKey = readVolcengineLumenApiKey();
   }
   async reportClawSkill(req) {
     const body = JSON.stringify(req);
@@ -201355,12 +201359,15 @@ var ApiClient2 = class {
   }
   async fetchWithApiKey(path25, method, body, headers = {}) {
     const url2 = `${this.endpoint}${path25.startsWith("/") ? path25 : `/${path25}`}`;
-    const requestHeaders = {
-      ...headers,
-      "X-Ai-Claw-Api-Key": this.apiKey || "",
-      "X-Ai-Claw-Id": this.pluginClawId || "",
-      ...deviceFingerprint ? { "X-Ai-Device-Fingerprint": deviceFingerprint } : {}
-    };
+    const requestHeaders = applyLumenIamAuthorization(
+      {
+        ...headers,
+        "X-Ai-Claw-Api-Key": this.apiKey || "",
+        "X-Ai-Claw-Id": this.pluginClawId || "",
+        ...deviceFingerprint ? { "X-Ai-Device-Fingerprint": deviceFingerprint } : {}
+      },
+      this.lumenIamApiKey
+    );
     return await fetch2(url2, {
       method,
       headers: requestHeaders,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volcengine/agent-sentry",
-  "version": "1.7.1",
+  "version": "1.8.1",
   "type": "module",
   "description": "AI Assistant Security plugin for OpenClaw, to protect your LLM models and Agent lifecycle (including tool calls) from harmful requests.",
   "packageManager": "pnpm@8.15.9",

package/provider-discovery.js

@@ -56,7 +56,7 @@ var VOLCENGINE_AICC_MODEL_CATALOG = [
     id: "deepseek-v4-pro",
     name: "DeepSeek V4 Pro (AICC)",
     reasoning: true,
-    input: ["text", "image"],
+    input: ["text"],
     contextWindow: 1e6,
     maxTokens: 8192
   },
@@ -64,7 +64,7 @@ var VOLCENGINE_AICC_MODEL_CATALOG = [
     id: "glm-5.1",
     name: "GLM 5.1 (AICC)",
     reasoning: true,
-    input: ["text", "image"],
+    input: ["text"],
     contextWindow: 2e5,
     maxTokens: 8192
   },
@@ -80,7 +80,7 @@ var VOLCENGINE_AICC_MODEL_CATALOG = [
     id: "glm-4.7",
     name: "GLM 4.7 (AICC)",
     reasoning: true,
-    input: ["text", "image"],
+    input: ["text"],
     contextWindow: 2e5,
     maxTokens: 8192
   }