@xpr-agents/openclaw 0.3.0 → 0.3.2

package/README.md

@@ -1,6 +1,6 @@
 # @xpr-agents/openclaw
 
-OpenClaw plugin for the XPR Network Trustless Agent Registry — 55 MCP tools for AI assistants to autonomously manage agents, jobs, feedback, validations, and escrow on-chain.
+OpenClaw plugin for the XPR Network Trustless Agent Registry — 72 MCP tools for AI assistants to autonomously manage agents, jobs, feedback, validations, and escrow on-chain.
 
 ## XPR Agents Ecosystem
 
@@ -8,7 +8,7 @@ OpenClaw plugin for the XPR Network Trustless Agent Registry — 55 MCP tools fo
 |---------|-------------|
 | [`create-xpr-agent`](https://www.npmjs.com/package/create-xpr-agent) | Deploy an autonomous AI agent in one command |
 | [`@xpr-agents/sdk`](https://www.npmjs.com/package/@xpr-agents/sdk) | TypeScript SDK for all four contracts |
-| [`@xpr-agents/openclaw`](https://www.npmjs.com/package/@xpr-agents/openclaw) | 55 MCP tools for AI assistants |
+| [`@xpr-agents/openclaw`](https://www.npmjs.com/package/@xpr-agents/openclaw) | 72 MCP tools for AI assistants |
 
 ## Quick Start
 
@@ -42,16 +42,31 @@ cd my-agent
 
 ## Configuration
 
-Set environment variables for server-side signing:
+The plugin signs transactions by shelling out to the [proton CLI](https://www.npmjs.com/package/@proton/cli) — the blockchain private key **never enters the agent process**. Load your key into the CLI's encrypted keychain once, then set only the account name in env:
+
+```bash
+# One-time keychain setup
+npm i -g @proton/cli
+proton chain:set proton                  # or proton-test
+proton key:add                           # paste your PVT_K1_ key; stored encrypted
+# Or for hosted consoles without a real TTY:
+#   echo "no" | proton key:add PVT_K1_yourkey
+```
 
 ```env
 XPR_ACCOUNT=myagent
-XPR_PRIVATE_KEY=PVT_K1_...
-XPR_RPC_ENDPOINT=https://tn1.protonnz.com
-XPR_NETWORK=testnet
-MAX_TRANSFER_AMOUNT=10000000
+XPR_NETWORK=mainnet                       # or testnet
+XPR_RPC_ENDPOINT=https://proton.eosusa.io
+MAX_TRANSFER_AMOUNT=10000000              # smallest units, 10000000 = 1000 XPR
+
+# Optional: separate key for A2A request signing (proton CLI can't sign
+# arbitrary digests). Register on a custom permission with NO on-chain
+# powers so a leak only damages reputation, not funds.
+# A2A_SIGNING_KEY=PVT_K1_a2a_only_key
 ```
 
+> **There is no `XPR_PRIVATE_KEY` env var.** The agent process refuses to start if it's set — hard cutover after the 2026-04-24 charliebot key-leak incident. See [`docs/A2A.md`](https://github.com/XPRNetwork/xpr-agents/blob/main/docs/A2A.md) for the A2A signing key model.
+
 ## License
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xpr-agents/openclaw",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "OpenClaw plugin for XPR Network Trustless Agent Registry - autonomous agent operation, escrow jobs, feedback, and validation",
   "author": "XPR Network",
   "repository": {

package/skills/code-sandbox/dist/index.js

@@ -0,0 +1,188 @@
+"use strict";
+/**
+ * Code Sandbox Skill — execute JavaScript in a sandboxed V8 context
+ *
+ * Zero external dependencies — uses Node.js built-in `vm` module.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = codeSandboxSkill;
+const vm_1 = __importDefault(require("vm"));
+// ── Constants ───────────────────────────────────
+const DEFAULT_TIMEOUT = 5000;
+const MAX_TIMEOUT = 30000;
+const MAX_OUTPUT_SIZE = 10 * 1024 * 1024; // 10MB
+// ── Sandbox helpers ─────────────────────────────
+function createSandboxGlobals(input, logs) {
+    // Capture console methods
+    const consoleMock = {
+        log: (...args) => {
+            logs.push(args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' '));
+        },
+        warn: (...args) => {
+            logs.push('[warn] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' '));
+        },
+        error: (...args) => {
+            logs.push('[error] ' + args.map(a => typeof a === 'object' ? JSON.stringify(a) : String(a)).join(' '));
+        },
+    };
+    return {
+        INPUT: input,
+        console: consoleMock,
+        JSON,
+        Math,
+        Date,
+        Array,
+        Object,
+        String,
+        Number,
+        RegExp,
+        Map,
+        Set,
+        parseInt,
+        parseFloat,
+        isNaN,
+        isFinite,
+        encodeURIComponent,
+        decodeURIComponent,
+        atob: (s) => Buffer.from(s, 'base64').toString('binary'),
+        btoa: (s) => Buffer.from(s, 'binary').toString('base64'),
+        // Explicitly undefined — blocked
+        require: undefined,
+        process: undefined,
+        globalThis: undefined,
+        global: undefined,
+    };
+}
+function serializeResult(value) {
+    if (value === undefined)
+        return 'undefined';
+    try {
+        const str = JSON.stringify(value, null, 2);
+        if (str.length > MAX_OUTPUT_SIZE) {
+            return str.slice(0, MAX_OUTPUT_SIZE) + '\n... [truncated at 10MB]';
+        }
+        return str;
+    }
+    catch {
+        return String(value);
+    }
+}
+// ── Skill entry point ───────────────────────────
+function codeSandboxSkill(api) {
+    // ── execute_js ──
+    api.registerTool({
+        name: 'execute_js',
+        description: [
+            'Run JavaScript code in a sandboxed V8 context.',
+            'Pass data via "input" (JSON), access it as INPUT in code.',
+            'console.log/warn/error are captured in the "logs" array.',
+            'Available: JSON, Math, Date, Array, Object, String, Number, RegExp, Map, Set,',
+            'parseInt, parseFloat, isNaN, isFinite, encodeURIComponent, decodeURIComponent, atob, btoa.',
+            'No network, filesystem, require, or import access. Max 30s timeout, 10MB output.',
+        ].join(' '),
+        parameters: {
+            type: 'object',
+            required: ['code'],
+            properties: {
+                code: { type: 'string', description: 'JavaScript code to execute. The last expression value is returned as the result.' },
+                input: { description: 'Optional JSON data available as INPUT in the code.' },
+                timeout: { type: 'number', description: 'Execution timeout in milliseconds (default 5000, max 30000).' },
+            },
+        },
+        handler: async ({ code, input, timeout }) => {
+            if (!code || typeof code !== 'string') {
+                return { error: 'code parameter is required and must be a string' };
+            }
+            const timeoutMs = Math.min(Math.max(timeout || DEFAULT_TIMEOUT, 100), MAX_TIMEOUT);
+            const logs = [];
+            const startTime = Date.now();
+            try {
+                const globals = createSandboxGlobals(input, logs);
+                const context = vm_1.default.createContext(globals, {
+                    codeGeneration: { strings: false, wasm: false },
+                });
+                // Wrap code so the last expression is returned
+                const wrapped = `(function() {\n${code}\n})()`;
+                const script = new vm_1.default.Script(wrapped, { filename: 'sandbox.js' });
+                const result = script.runInContext(context, { timeout: timeoutMs });
+                const durationMs = Date.now() - startTime;
+                const serialized = serializeResult(result);
+                if (serialized.length > MAX_OUTPUT_SIZE) {
+                    return {
+                        result: serialized.slice(0, 1000) + '... [truncated]',
+                        logs,
+                        duration_ms: durationMs,
+                        warning: 'Output exceeded 10MB limit and was truncated',
+                    };
+                }
+                // Parse back to preserve types (arrays, objects)
+                let parsed;
+                try {
+                    parsed = JSON.parse(serialized);
+                }
+                catch {
+                    parsed = serialized === 'undefined' ? undefined : serialized;
+                }
+                return { result: parsed, logs, duration_ms: durationMs };
+            }
+            catch (err) {
+                const durationMs = Date.now() - startTime;
+                const message = err.message || String(err);
+                // Provide helpful error context
+                if (message.includes('Script execution timed out')) {
+                    return { error: `Execution timed out after ${timeoutMs}ms. Keep code efficient or increase timeout (max ${MAX_TIMEOUT}ms).`, logs, duration_ms: durationMs };
+                }
+                if (message.includes('Code generation from strings disallowed')) {
+                    return { error: 'eval() and Function() constructor are blocked in the sandbox. Use direct code instead.', logs, duration_ms: durationMs };
+                }
+                return { error: message, logs, duration_ms: durationMs };
+            }
+        },
+    });
+    // ── eval_expression ──
+    api.registerTool({
+        name: 'eval_expression',
+        description: [
+            'Evaluate a single JavaScript expression and return the result.',
+            'Lightweight alternative to execute_js for quick calculations.',
+            'Examples: "15 * 4500 * 0.01", "new Date().toISOString()", "[1,2,3].map(x => x*x)".',
+        ].join(' '),
+        parameters: {
+            type: 'object',
+            required: ['expression'],
+            properties: {
+                expression: { type: 'string', description: 'A JavaScript expression to evaluate.' },
+            },
+        },
+        handler: async ({ expression }) => {
+            if (!expression || typeof expression !== 'string') {
+                return { error: 'expression parameter is required and must be a string' };
+            }
+            try {
+                const globals = createSandboxGlobals(undefined, []);
+                const context = vm_1.default.createContext(globals, {
+                    codeGeneration: { strings: false, wasm: false },
+                });
+                const script = new vm_1.default.Script(`(${expression})`, { filename: 'expr.js' });
+                const result = script.runInContext(context, { timeout: DEFAULT_TIMEOUT });
+                let serialized;
+                try {
+                    serialized = JSON.parse(JSON.stringify(result));
+                }
+                catch {
+                    serialized = String(result);
+                }
+                return {
+                    result: serialized,
+                    type: result === null ? 'null' : Array.isArray(result) ? 'array' : typeof result,
+                };
+            }
+            catch (err) {
+                return { error: err.message || String(err) };
+            }
+        },
+    });
+}