@xquik/tweetclaw 1.4.1 → 1.4.2

package/openclaw.plugin.json

@@ -1,8 +1,8 @@
 {
   "id": "tweetclaw",
   "name": "TweetClaw",
-  "version": "1.4.0",
-  "description": "Post tweets, reply, like, retweet, follow, DM from your chat - full X/Twitter automation powered by Xquik. 120 endpoints, reads from $0.00015/call.",
+  "version": "1.4.1",
+  "description": "Post tweets, reply, like, retweet, follow, DM from your chat - full X/Twitter automation powered by Xquik. 120 endpoints, reads from $0.00015/call. Requires an Xquik API key or Tempo private key.",
   "configSchema": {
     "type": "object",
     "additionalProperties": false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xquik/tweetclaw",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "description": "Post tweets, reply, like, retweet, follow, DM & more from OpenClaw - full X/Twitter automation via Xquik. 120 endpoints, reads from $0.00015/call.",
   "license": "MIT",
   "type": "module",
@@ -18,7 +18,15 @@
   "openclaw": {
     "extensions": [
       "./src/index.ts"
-    ]
+    ],
+    "compat": {
+      "pluginApi": ">=2026.3.28",
+      "minGatewayVersion": "2026.3.28"
+    },
+    "build": {
+      "openclawVersion": "2026.3.28",
+      "pluginSdkVersion": "2026.3.28"
+    }
   },
   "files": [
     "src/",

package/src/mpp.ts

@@ -1,4 +1,4 @@
-import { resolveAsyncFunctionConstructor } from './tools/sandbox.js';
+import { resolveAsyncFunctionConstructor } from './tools/executor.js';
 
 type ModuleLoader = (name: string) => Promise<Record<string, unknown>>;
 

package/src/tools/executor.ts

@@ -0,0 +1,125 @@
+import vm from 'node:vm';
+import { API_SPEC } from '../api-spec.js';
+import { truncateResponse } from '../truncate.js';
+import type { ToolResult } from '../types.js';
+
+const specEndpoints: ReadonlyArray<Readonly<Record<string, unknown>>> = API_SPEC.map(
+  (endpoint): Readonly<Record<string, unknown>> => ({ ...endpoint }),
+);
+
+function extractErrorMessage(error: unknown): string {
+  if (error instanceof Error) {
+    return `${error.constructor.name}: ${error.message}`;
+  }
+  return String(error);
+}
+
+function isAsyncFunctionConstructor(
+  value: unknown,
+): value is new (...parameters: readonly string[]) => (...parameters: readonly unknown[]) => Promise<unknown> {
+  return typeof value === 'function';
+}
+
+function getConstructorFromPrototype(proto: unknown): unknown {
+  if (typeof proto !== 'object' || proto === null) {
+    return undefined;
+  }
+  return 'constructor' in proto ? proto.constructor : undefined;
+}
+
+function resolveAsyncFunctionConstructor(prototype?: unknown): new (
+  ...parameters: readonly string[]
+) => (...parameters: readonly unknown[]) => Promise<unknown> {
+  const asyncPrototype: unknown = prototype ?? Object.getPrototypeOf(async (): Promise<void> => {});
+  const candidate: unknown = getConstructorFromPrototype(asyncPrototype);
+  if (!isAsyncFunctionConstructor(candidate)) {
+    throw new Error('AsyncFunction constructor not found');
+  }
+  return candidate;
+}
+
+const BLOCKED_PROPS: ReadonlySet<string | symbol> = new Set(['constructor', '__proto__', 'prototype']);
+
+function isBlockedProperty(property: string | symbol): boolean {
+  return BLOCKED_PROPS.has(property);
+}
+
+function wrapValue(value: unknown): unknown {
+  if (value === null || value === undefined) return value;
+  if (typeof value !== 'object' && typeof value !== 'function') return value;
+  return createSafeProxy(value);
+}
+
+async function wrapAsync(promise: Promise<unknown>): Promise<unknown> {
+  const resolved: unknown = await promise;
+  return wrapValue(resolved);
+}
+
+function createCallableProxy(bound: (...a: readonly unknown[]) => unknown): unknown {
+  const handler: ProxyHandler<typeof bound> = {
+    apply(_target: typeof bound, _thisArgument: unknown, argumentsList: unknown[]): unknown {
+      const result: unknown = bound(...argumentsList);
+      if (result instanceof Promise) {
+        return wrapAsync(result);
+      }
+      return wrapValue(result);
+    },
+    get(_target: typeof bound, property: string | symbol): unknown {
+      if (isBlockedProperty(property)) return undefined;
+      return Reflect.get(_target, property);
+    },
+  };
+  return new Proxy(bound, handler);
+}
+
+function createSafeProxy(target: unknown): unknown {
+  if (target === null || target === undefined) return target;
+  if (typeof target !== 'object' && typeof target !== 'function') return target;
+
+  const handler: ProxyHandler<Record<string | symbol, unknown>> = {
+    get(t: Record<string | symbol, unknown>, property: string | symbol): unknown {
+      if (isBlockedProperty(property)) return undefined;
+      const value: unknown = Reflect.get(t, property);
+      if (typeof value === 'function') {
+        const bound: (...a: readonly unknown[]) => unknown = value.bind(t);
+        return createCallableProxy(bound);
+      }
+      return wrapValue(value);
+    },
+  };
+  return new Proxy(target as Record<string | symbol, unknown>, handler);
+}
+
+function runInSandbox(code: string, globals: Readonly<Record<string, unknown>>): unknown {
+  const rawContext: Record<string, unknown> = Object.create(null) as Record<string, unknown>;
+  for (const key of Object.keys(globals)) {
+    const value: unknown = globals[key];
+    const safeValue: unknown = typeof value === 'object' && value !== null
+      ? createSafeProxy(value)
+      : value;
+    Reflect.set(rawContext, key, safeValue);
+  }
+  const context: vm.Context = vm.createContext(rawContext);
+  return vm.runInNewContext(`(${code})()`, context);
+}
+
+function successResult(content: unknown): ToolResult {
+  return { content: [{ text: truncateResponse(content), type: 'text' as const }] };
+}
+
+function errorResult(error: unknown): ToolResult {
+  return { content: [{ text: extractErrorMessage(error), type: 'text' as const }], isError: true };
+}
+
+export {
+  BLOCKED_PROPS,
+  createSafeProxy,
+  errorResult,
+  extractErrorMessage,
+  getConstructorFromPrototype,
+  resolveAsyncFunctionConstructor,
+  runInSandbox,
+  specEndpoints,
+  successResult,
+  wrapValue,
+};

package/src/tools/explore.ts

@@ -1,5 +1,5 @@
 import { API_SPEC } from '../api-spec.js';
-import { AsyncFunction, errorResult, specEndpoints, successResult } from './sandbox.js';
+import { errorResult, runInSandbox, specEndpoints, successResult } from './executor.js';
 import type { EndpointInfo, ToolResult } from '../types.js';
 
 const categories = [...new Set(API_SPEC.map((endpoint) => endpoint.category))].toSorted((a, b) => a.localeCompare(b)).join(', ');
@@ -47,8 +47,7 @@ async () => {
 
 async function handleExplore(code: string): Promise<ToolResult> {
   try {
-    const executor = new AsyncFunction('spec', `return (${code})()`);
-    const result: unknown = await executor({ endpoints: specEndpoints });
+    const result: unknown = await runInSandbox(code, { spec: { endpoints: specEndpoints } });
     return successResult(result);
   } catch (error: unknown) {
     return errorResult(error);

package/src/tools/tweetclaw.ts

@@ -1,5 +1,5 @@
 import { createProxiedRequest } from '../request.js';
-import { AsyncFunction, errorResult, specEndpoints, successResult } from './sandbox.js';
+import { errorResult, runInSandbox, specEndpoints, successResult } from './executor.js';
 import type { FetchFunction, RequestFunction, ToolResult } from '../types.js';
 
 const EXECUTE_DESCRIPTION = `Execute X (Twitter) API calls: post tweets, reply, like, retweet, follow, DM, update profile, upload media, search tweets, look up users, extract data, run giveaways, monitor accounts, compose tweets, and more. Write an async arrow function.
@@ -325,10 +325,9 @@ async function handleTweetclaw(options: Readonly<TweetclawOptions>): Promise<Too
   const { apiKey, baseUrl, code, fetchFunction, timeoutMs = EXECUTION_TIMEOUT_MS } = options;
   try {
     const request: RequestFunction = createProxiedRequest(baseUrl, apiKey, fetchFunction);
-    const executor = new AsyncFunction('xquik', 'spec', `return (${code})()`);
 
     const result: unknown = await Promise.race([
-      executor({ request }, { endpoints: specEndpoints }),
+      runInSandbox(code, { xquik: { request }, spec: { endpoints: specEndpoints } }),
       new Promise<never>((_resolve, reject) => {
         setTimeout(() => {
           reject(new Error(`Execution timed out after ${String(timeoutMs / MS_PER_SECOND)}s`));

package/src/tools/sandbox.ts

@@ -1,58 +0,0 @@
-import { API_SPEC } from '../api-spec.js';
-import { truncateResponse } from '../truncate.js';
-import type { ToolResult } from '../types.js';
-
-const specEndpoints: ReadonlyArray<Readonly<Record<string, unknown>>> = API_SPEC.map(
-  (endpoint): Readonly<Record<string, unknown>> => ({ ...endpoint }),
-);
-
-function extractErrorMessage(error: unknown): string {
-  if (error instanceof Error) {
-    return `${error.constructor.name}: ${error.message}`;
-  }
-  return String(error);
-}
-
-function isAsyncFunctionConstructor(
-  value: unknown,
-): value is new (...parameters: readonly string[]) => (...parameters: readonly unknown[]) => Promise<unknown> {
-  return typeof value === 'function';
-}
-
-function getConstructorFromPrototype(proto: unknown): unknown {
-  if (typeof proto !== 'object' || proto === null) {
-    return undefined;
-  }
-  return 'constructor' in proto ? proto.constructor : undefined;
-}
-
-function resolveAsyncFunctionConstructor(prototype?: unknown): new (
-  ...parameters: readonly string[]
-) => (...parameters: readonly unknown[]) => Promise<unknown> {
-  const asyncPrototype: unknown = prototype ?? Object.getPrototypeOf(async (): Promise<void> => {});
-  const candidate: unknown = getConstructorFromPrototype(asyncPrototype);
-  if (!isAsyncFunctionConstructor(candidate)) {
-    throw new Error('AsyncFunction constructor not found');
-  }
-  return candidate;
-}
-
-const AsyncFunction = resolveAsyncFunctionConstructor();
-
-function successResult(content: unknown): ToolResult {
-  return { content: [{ text: truncateResponse(content), type: 'text' as const }] };
-}
-
-function errorResult(error: unknown): ToolResult {
-  return { content: [{ text: extractErrorMessage(error), type: 'text' as const }], isError: true };
-}
-
-export {
-  AsyncFunction,
-  errorResult,
-  extractErrorMessage,
-  getConstructorFromPrototype,
-  resolveAsyncFunctionConstructor,
-  specEndpoints,
-  successResult,
-};