aquaman-plugin 0.5.0 → 0.5.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +36 -68
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -2,40 +2,48 @@
|
|
|
2
2
|
|
|
3
3
|
OpenClaw Gateway plugin for [aquaman](https://github.com/tech4242/aquaman) credential isolation.
|
|
4
4
|
|
|
5
|
-
##
|
|
5
|
+
## How It Works
|
|
6
|
+
|
|
7
|
+
```
|
|
8
|
+
Agent / OpenClaw Gateway Aquaman Proxy
|
|
9
|
+
┌──────────────────────┐ ┌──────────────────────┐
|
|
10
|
+
│ │ │ │
|
|
11
|
+
│ ANTHROPIC_BASE_URL │──request────>│ Keychain / 1Pass / │
|
|
12
|
+
│ = localhost:8081 │ │ Vault / Encrypted │
|
|
13
|
+
│ │<─response────│ │
|
|
14
|
+
│ fetch() interceptor │──channel────>│ + Auth injected: │
|
|
15
|
+
│ redirects channel │ traffic │ header / url-path │
|
|
16
|
+
│ API traffic │ │ basic / oauth │
|
|
17
|
+
│ │ │ │
|
|
18
|
+
│ No credentials. │ │ │
|
|
19
|
+
│ Nothing to steal. │ │ │
|
|
20
|
+
└──────────────────────┘ └───┬──────────┬───────┘
|
|
21
|
+
│ │
|
|
22
|
+
│ ▼
|
|
23
|
+
│ ~/.aquaman/audit/
|
|
24
|
+
│ (hash-chained log)
|
|
25
|
+
▼
|
|
26
|
+
api.anthropic.com
|
|
27
|
+
api.telegram.org
|
|
28
|
+
slack.com/api ...
|
|
29
|
+
```
|
|
6
30
|
|
|
7
|
-
|
|
31
|
+
This plugin makes the left side work. It routes all LLM and channel API traffic through the aquaman proxy so credentials never enter the Gateway process.
|
|
8
32
|
|
|
9
|
-
##
|
|
33
|
+
## Quick Start
|
|
10
34
|
|
|
11
35
|
```bash
|
|
12
|
-
|
|
13
|
-
|
|
36
|
+
npm install -g aquaman-proxy # 1. Install the proxy CLI
|
|
37
|
+
aquaman setup # 2. Store keys, install plugin, configure OpenClaw
|
|
38
|
+
aquaman migrate openclaw --auto # 3. Move existing channel creds to secure store
|
|
39
|
+
openclaw # 4. Proxy starts automatically
|
|
14
40
|
```
|
|
15
41
|
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
Add to `~/.openclaw/openclaw.json`:
|
|
42
|
+
Troubleshooting: `aquaman doctor`
|
|
19
43
|
|
|
20
|
-
|
|
21
|
-
{
|
|
22
|
-
"plugins": {
|
|
23
|
-
"entries": {
|
|
24
|
-
"aquaman-plugin": {
|
|
25
|
-
"enabled": true,
|
|
26
|
-
"config": {
|
|
27
|
-
"mode": "proxy",
|
|
28
|
-
"backend": "keychain",
|
|
29
|
-
"services": ["anthropic", "openai"],
|
|
30
|
-
"proxyPort": 8081
|
|
31
|
-
}
|
|
32
|
-
}
|
|
33
|
-
}
|
|
34
|
-
}
|
|
35
|
-
}
|
|
36
|
-
```
|
|
44
|
+
## Config Options
|
|
37
45
|
|
|
38
|
-
|
|
46
|
+
`aquaman setup` writes these to `~/.openclaw/openclaw.json` automatically:
|
|
39
47
|
|
|
40
48
|
| Key | Type | Default | Description |
|
|
41
49
|
|-----|------|---------|-------------|
|
|
@@ -44,51 +52,11 @@ Add to `~/.openclaw/openclaw.json`:
|
|
|
44
52
|
| `services` | `string[]` | `["anthropic", "openai"]` | Services to proxy |
|
|
45
53
|
| `proxyPort` | `number` | `8081` | Proxy listen port |
|
|
46
54
|
|
|
47
|
-
> Advanced settings (TLS, audit, vault)
|
|
48
|
-
|
|
49
|
-
## Setup
|
|
50
|
-
|
|
51
|
-
**1. Add credentials:**
|
|
52
|
-
|
|
53
|
-
```bash
|
|
54
|
-
aquaman credentials add anthropic api_key
|
|
55
|
-
```
|
|
56
|
-
|
|
57
|
-
**2. Register a placeholder key with OpenClaw:**
|
|
58
|
-
|
|
59
|
-
```bash
|
|
60
|
-
mkdir -p ~/.openclaw/agents/main/agent
|
|
61
|
-
cat > ~/.openclaw/agents/main/agent/auth-profiles.json << 'EOF'
|
|
62
|
-
{
|
|
63
|
-
"version": 1,
|
|
64
|
-
"profiles": {
|
|
65
|
-
"anthropic:default": {
|
|
66
|
-
"type": "api_key",
|
|
67
|
-
"provider": "anthropic",
|
|
68
|
-
"key": "aquaman-proxy-managed"
|
|
69
|
-
}
|
|
70
|
-
},
|
|
71
|
-
"order": { "anthropic": ["anthropic:default"] }
|
|
72
|
-
}
|
|
73
|
-
EOF
|
|
74
|
-
```
|
|
75
|
-
|
|
76
|
-
**3. Launch OpenClaw:**
|
|
77
|
-
|
|
78
|
-
```bash
|
|
79
|
-
openclaw
|
|
80
|
-
```
|
|
81
|
-
|
|
82
|
-
The plugin auto-starts the proxy, sets `ANTHROPIC_BASE_URL` to route through it, and intercepts channel API traffic via `globalThis.fetch`.
|
|
83
|
-
|
|
84
|
-
## How It Works
|
|
85
|
-
|
|
86
|
-
- **Proxy mode** — Spawns aquaman as a child process. Credentials live in a separate OS process. Even if the agent is compromised, it cannot access keys.
|
|
87
|
-
- **Embedded mode** — Credentials loaded in-process. Simpler setup, less isolation. Good for local development.
|
|
55
|
+
> Advanced settings (TLS, audit, vault) go in `~/.aquaman/config.yaml`.
|
|
88
56
|
|
|
89
57
|
## Documentation
|
|
90
58
|
|
|
91
|
-
See the [main README](https://github.com/tech4242/aquaman#readme) for
|
|
59
|
+
See the [main README](https://github.com/tech4242/aquaman#readme) for architecture, Docker deployment, and manual testing.
|
|
92
60
|
|
|
93
61
|
## License
|
|
94
62
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "aquaman-plugin",
|
|
3
|
-
"version": "0.5.
|
|
3
|
+
"version": "0.5.1",
|
|
4
4
|
"description": "Credential isolation plugin for OpenClaw",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"scripts": {
|
|
@@ -24,7 +24,7 @@
|
|
|
24
24
|
"dependencies": {},
|
|
25
25
|
"peerDependencies": {
|
|
26
26
|
"openclaw": ">=2026.1.0",
|
|
27
|
-
"aquaman-proxy": "
|
|
27
|
+
"aquaman-proxy": "0.5.1"
|
|
28
28
|
},
|
|
29
29
|
"peerDependenciesMeta": {
|
|
30
30
|
"aquaman-proxy": {
|