clawarmor 2.2.1 → 3.0.0

package/cli.js

@@ -3,7 +3,7 @@
 
 import { paint } from './lib/output/colors.js';
 
-const VERSION = '2.2.0';
+const VERSION = '3.0.0';
 const GATEWAY_PORT_DEFAULT = 18789;
 
 function isLocalhost(host) {
@@ -51,6 +51,7 @@ function usage() {
   console.log(`    ${paint.cyan('watch')}    Monitor config and skill changes in real time`);
   console.log(`    ${paint.cyan('protect')}  Install/uninstall/status the full guard system`);
   console.log(`    ${paint.cyan('prescan')}  Pre-scan a skill before installing it`);
+  console.log(`    ${paint.cyan('stack')}    Security orchestrator — deploy Invariant + IronCurtain from audit data`);
   console.log(`    ${paint.cyan('log')}      View the audit event log`);
   console.log(`    ${paint.cyan('digest')}   Show weekly security digest`);
   console.log('');
@@ -232,5 +233,11 @@ if (cmd === 'digest') {
   process.exit(await runDigest());
 }
 
+if (cmd === 'stack') {
+  const { runStack } = await import('./lib/stack.js');
+  const stackArgs = args.slice(1);
+  process.exit(await runStack(stackArgs));
+}
+
 console.log(`  ${paint.red('✗')} Unknown command: ${paint.bold(cmd)}`);
 usage(); process.exit(1);

package/lib/stack/index.js

@@ -0,0 +1,91 @@
+// lib/stack/index.js — Stack orchestrator
+// Reads latest audit result from ~/.clawarmor/audit.log (JSONL),
+// maps score + findings to a risk profile, and determines deployment plan.
+
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+
+const HOME = homedir();
+const AUDIT_LOG = join(HOME, '.clawarmor', 'audit.log');
+
+/**
+ * Read the latest scored audit entry from ~/.clawarmor/audit.log (JSONL).
+ * Prefers entries where score !== null (cmd==='audit'), skips scan entries.
+ * Falls back to last-score.json combined with history.json if no scored entry found.
+ */
+function readLatestAudit() {
+  if (existsSync(AUDIT_LOG)) {
+    try {
+      const lines = readFileSync(AUDIT_LOG, 'utf8').split('\n').filter(Boolean);
+      for (let i = lines.length - 1; i >= 0; i--) {
+        try {
+          const entry = JSON.parse(lines[i]);
+          if (entry && entry.score != null) return entry;
+        } catch { /* skip bad lines */ }
+      }
+    } catch { /* non-fatal */ }
+  }
+  // Fallback: last-score.json (minimal — no findings detail)
+  const lastScoreFile = join(HOME, '.clawarmor', 'last-score.json');
+  if (existsSync(lastScoreFile)) {
+    try {
+      const s = JSON.parse(readFileSync(lastScoreFile, 'utf8'));
+      if (s && s.score != null) return { score: s.score, grade: s.grade, findings: [] };
+    } catch { /* non-fatal */ }
+  }
+  return null;
+}
+
+/**
+ * Map audit score + findings to a risk profile.
+ * @param {Object|null} audit
+ * @returns {{ level: string, label: string, score: number|null, findings: Array }}
+ */
+export function getRiskProfile(audit) {
+  if (!audit) return { level: 'unknown', label: 'No audit data', score: null, findings: [] };
+  const score = audit.score ?? null;
+  const findings = audit.findings ?? [];
+  let level, label;
+  if (score == null)    { level = 'unknown';  label = 'Unknown risk'; }
+  else if (score < 50)  { level = 'critical'; label = 'Critical / High risk'; }
+  else if (score < 75)  { level = 'medium';   label = 'Medium risk'; }
+  else                  { level = 'low';       label = 'Low risk'; }
+  return { level, label, score, findings };
+}
+
+/**
+ * Read latest audit + derive risk profile.
+ * @returns {Promise<{ audit: Object|null, profile: Object }>}
+ */
+export async function getStackStatus() {
+  const audit = readLatestAudit();
+  const profile = getRiskProfile(audit);
+  return { audit, profile };
+}
+
+/**
+ * Get recommended deployment plan based on risk profile.
+ * @param {Object} profile - from getRiskProfile()
+ * @returns {{ invariant: boolean, ironcurtain: boolean, reason: string }}
+ */
+export function getPlan(profile) {
+  const { level } = profile;
+  if (level === 'critical') return {
+    invariant: true, ironcurtain: true,
+    reason: 'Critical risk: deploy Invariant flow guardrails + generate IronCurtain constitution',
+  };
+  if (level === 'medium') return {
+    invariant: true, ironcurtain: true,
+    reason: 'Medium risk: deploy Invariant flow guardrails + generate IronCurtain constitution',
+  };
+  if (level === 'low') return {
+    invariant: false, ironcurtain: true,
+    reason: 'Low risk: generate IronCurtain constitution as reference hardening',
+  };
+  // unknown — no audit yet
+  return {
+    invariant: true, ironcurtain: true,
+    reason: 'No audit data: run clawarmor audit first for precise recommendations',
+  };
+}

package/lib/stack/invariant.js

@@ -0,0 +1,224 @@
+// lib/stack/invariant.js — Invariant Guardrails integration
+// Invariant is a Python guardrailing library (invariantlabs-ai/invariant).
+// Rules are plain Invariant DSL strings generated from audit findings.
+
+import { existsSync, readFileSync, writeFileSync, mkdirSync, statSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { execSync, spawnSync } from 'child_process';
+
+const HOME = homedir();
+const CLAWARMOR_DIR = join(HOME, '.clawarmor');
+const RULES_PATH = join(CLAWARMOR_DIR, 'invariant-rules.inv');
+
+/** Check if invariant-ai Python package is installed. */
+export function checkInstalled() {
+  try {
+    const r = spawnSync('pip3', ['show', 'invariant-ai'], { encoding: 'utf8', timeout: 10000 });
+    return r.status === 0 && !!(r.stdout && r.stdout.includes('Name:'));
+  } catch { return false; }
+}
+
+/**
+ * Install invariant-ai via pip3.
+ * @returns {{ ok: boolean, err?: string }}
+ */
+export function install() {
+  try {
+    execSync('pip3 install invariant-ai', { stdio: 'pipe', timeout: 120000 });
+    return { ok: true };
+  } catch (e) {
+    return { ok: false, err: e.message?.split('\n')[0] || 'pip3 install failed' };
+  }
+}
+
+/**
+ * Generate Invariant DSL rules from audit findings.
+ *
+ * Key mappings (from research):
+ *   exec.security=full + exec.ask=off  → flag unrestricted exec tool calls
+ *   channels with no allowFrom         → flag ungated message sends
+ *   credential files world-readable    → block reads on sensitive paths
+ *   skill supply chain findings        → block tool calls from unverified skill sources
+ *   elevated.allowFrom empty           → flag escalated calls from non-allowlisted sources
+ *
+ * @param {Array} findings - array of { id, severity, title, detail }
+ * @returns {string} Invariant policy (.inv) text
+ */
+export function generateRules(findings) {
+  const now = new Date().toISOString().slice(0, 10);
+  const lines = [
+    `# ClawArmor-Generated Invariant Policy`,
+    `# Generated: ${now} by clawarmor stack`,
+    `# Source: clawarmor stack deploy --invariant`,
+    '',
+  ];
+
+  if (!findings || !findings.length) {
+    lines.push('# No findings from latest audit — no findings-specific rules generated.');
+    lines.push('# Run: clawarmor audit, then: clawarmor stack sync');
+    lines.push('');
+    lines.push('# Generic fallback: prompt injection via web tool → send_message');
+    lines.push('raise "Possible prompt injection via tool output" if:');
+    lines.push('    (output: ToolOutput) -> (call2: ToolCall)');
+    lines.push('    output is tool:get_website');
+    lines.push('    prompt_injection(output.content, threshold=0.7)');
+    lines.push('    call2 is tool:send_message');
+    lines.push('');
+    return lines.join('\n');
+  }
+
+  const generated = new Set();
+
+  for (const finding of findings) {
+    const id = (finding.id || '').toLowerCase();
+    const detail = (finding.detail || '').toLowerCase();
+    const title = (finding.title || '').toLowerCase();
+    // label shown in rule comment — id is always present; title/severity optional
+    const label = finding.title || finding.severity || finding.id;
+
+    // exec.ask=off / exec unrestricted → flag bare exec tool calls
+    // Matches: exec.approval, exec.ask, tools.exec.*
+    if (
+      !generated.has('exec.unrestricted') &&
+      (id.includes('exec') || title.includes('exec')) &&
+      (id.includes('ask') || id.includes('approval') || id.includes('exec') ||
+       detail.includes('ask') || title.includes('approval') || title.includes('unrestricted') ||
+       detail.includes('unrestricted'))
+    ) {
+      generated.add('exec.unrestricted');
+      lines.push(`# Finding: ${finding.id} — ${label}`);
+      lines.push(`raise "Unrestricted exec tool call detected (no approval gate)" if:`);
+      lines.push(`    (call: ToolCall)`);
+      lines.push(`    call is tool:exec`);
+      lines.push('');
+    }
+
+    // channels with no allowFrom / open group policy → ungated message sends
+    // Matches: channel.groupPolicy, channel.allowFrom, channels.*
+    if (
+      !generated.has('channel.ungated') &&
+      (id.includes('channel') || title.includes('channel')) &&
+      (id.includes('allow') || id.includes('group') || id.includes('policy') ||
+       detail.includes('allowfrom') || title.includes('restriction') ||
+       title.includes('gate') || title.includes('group') || detail.includes('open'))
+    ) {
+      generated.add('channel.ungated');
+      lines.push(`# Finding: ${finding.id} — ${label}`);
+      lines.push(`raise "Message sent via ungated channel (no allowFrom restriction)" if:`);
+      lines.push(`    (call: ToolCall) -> (call2: ToolCall)`);
+      lines.push(`    call is tool:read_file`);
+      lines.push(`    call2 is tool:send_message({channel: ".*"})`);
+      lines.push('');
+    }
+
+    // credential files / secret exposure → block reads on sensitive paths
+    // Matches: cred.*, credential-file, cred.json_secrets, filesystem.perms
+    if (
+      !generated.has('cred.worldread') &&
+      (id.includes('cred') || id.includes('credential') || id.includes('filesystem') ||
+       id.includes('secret')) &&
+      (id.includes('perm') || id.includes('secret') || id.includes('file') ||
+       detail.includes('world') || detail.includes('readable') || detail.includes('permission') ||
+       title.includes('world') || title.includes('permission') || title.includes('secret'))
+    ) {
+      generated.add('cred.worldread');
+      lines.push(`# Finding: ${finding.id} — ${label}`);
+      lines.push(`raise "File read on sensitive credential path" if:`);
+      lines.push(`    (call: ToolCall)`);
+      lines.push(`    call is tool:read_file`);
+      lines.push(`    any(s in str(call.args.get("path", "")) for s in [".ssh", ".aws", "agent-accounts", ".openclaw"])`);
+      lines.push('');
+    }
+
+    // skill supply chain — block tool calls from unverified sources
+    // Matches: skill.pinning, skill.supplychain, skills.*
+    if (
+      !generated.has('skill.supplychain') &&
+      id.includes('skill') &&
+      (id.includes('pin') || id.includes('supply') || id.includes('md') ||
+       detail.includes('supply') || detail.includes('unverified') ||
+       title.includes('pin') || title.includes('supply'))
+    ) {
+      generated.add('skill.supplychain');
+      lines.push(`# Finding: ${finding.id} — ${label}`);
+      lines.push(`raise "Tool call from unverified skill source (no version pin)" if:`);
+      lines.push(`    (call: ToolCall)`);
+      lines.push(`    not call.metadata.get("skill_verified", False)`);
+      lines.push('');
+    }
+
+    // elevated permissions with no allowFrom restriction
+    // Matches: elevated.allowFrom, tools.elevated.*, allowFrom.*
+    if (
+      !generated.has('elevated.ungated') &&
+      (id.includes('elevated') || id.includes('allowfrom') || title.includes('elevated'))
+    ) {
+      generated.add('elevated.ungated');
+      lines.push(`# Finding: ${finding.id} — ${label}`);
+      lines.push(`raise "Elevated tool call from ungated source" if:`);
+      lines.push(`    (call: ToolCall)`);
+      lines.push(`    call.metadata.get("elevated", False)`);
+      lines.push(`    not call.metadata.get("allowFrom_restricted", False)`);
+      lines.push('');
+    }
+  }
+
+  if (!generated.size) {
+    lines.push('# No specific rule mappings matched. Generic fallback:');
+    lines.push('');
+    lines.push('raise "Possible prompt injection via tool output" if:');
+    lines.push('    (output: ToolOutput) -> (call2: ToolCall)');
+    lines.push('    output is tool:get_website');
+    lines.push('    prompt_injection(output.content, threshold=0.7)');
+    lines.push('    call2 is tool:send_message');
+    lines.push('');
+  }
+
+  return lines.join('\n');
+}
+
+/**
+ * Write rules to ~/.clawarmor/invariant-rules.inv and validate syntax if invariant-ai is installed.
+ * @param {string} rulesContent
+ * @returns {{ ok: boolean, err?: string, rulesPath: string }}
+ */
+export function deploy(rulesContent) {
+  try {
+    if (!existsSync(CLAWARMOR_DIR)) mkdirSync(CLAWARMOR_DIR, { recursive: true });
+    writeFileSync(RULES_PATH, rulesContent, 'utf8');
+
+    // Validate syntax if invariant-ai is available (non-fatal if not)
+    if (checkInstalled()) {
+      const v = spawnSync('python3', [
+        '-c',
+        `from invariant.analyzer import LocalPolicy; LocalPolicy.from_file('${RULES_PATH}'); print('ok')`,
+      ], { encoding: 'utf8', timeout: 30000 });
+      if (v.status !== 0) {
+        const msg = (v.stderr || '').split('\n')[0];
+        return { ok: false, err: `Syntax validation failed: ${msg}`, rulesPath: RULES_PATH };
+      }
+    }
+    return { ok: true, rulesPath: RULES_PATH };
+  } catch (e) {
+    return { ok: false, err: e.message?.split('\n')[0] || 'deploy failed', rulesPath: RULES_PATH };
+  }
+}
+
+/**
+ * Get current status of Invariant integration.
+ * @returns {{ installed: boolean, rulesExist: boolean, rulesPath: string, ruleCount: number, lastDeployed: string|null }}
+ */
+export function getStatus() {
+  const installed = checkInstalled();
+  const rulesExist = existsSync(RULES_PATH);
+  let ruleCount = 0, lastDeployed = null;
+  if (rulesExist) {
+    try {
+      const content = readFileSync(RULES_PATH, 'utf8');
+      ruleCount = (content.match(/^raise /gm) || []).length;
+      lastDeployed = statSync(RULES_PATH).mtime.toISOString();
+    } catch { /* non-fatal */ }
+  }
+  return { installed, rulesExist, rulesPath: RULES_PATH, ruleCount, lastDeployed };
+}

package/lib/stack/ironcurtain.js

@@ -0,0 +1,195 @@
+// lib/stack/ironcurtain.js — IronCurtain integration
+// IronCurtain: English constitution → LLM compiles to deterministic rules → runtime enforcement.
+// We generate the Markdown constitution from audit findings. User runs compile-policy themselves.
+
+import { existsSync, writeFileSync, mkdirSync, statSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { spawnSync } from 'child_process';
+
+const HOME = homedir();
+const IRONCURTAIN_DIR = join(HOME, '.ironcurtain');
+const CONSTITUTION_PATH = join(IRONCURTAIN_DIR, 'constitution-clawarmor.md');
+
+/** Check if ironcurtain CLI is available (npm -g). */
+export function checkInstalled() {
+  try {
+    const r = spawnSync('ironcurtain', ['--version'], { encoding: 'utf8', timeout: 5000 });
+    return r.status === 0;
+  } catch { return false; }
+}
+
+/**
+ * Generate an IronCurtain constitution Markdown from audit findings.
+ *
+ * Key mappings (from research):
+ *   exec.ask=off                      → Escalate: All exec tool calls require human approval
+ *   elevated.allowFrom empty          → Forbidden: Elevated operations without allowFrom restrictions
+ *   channels.groupPolicy=open         → Escalate: Messages to external groups require approval
+ *   credential world-readable         → Forbidden: Reading lax-permission credential files
+ *   skill supply chain                → Forbidden: Loading unverified/unpinned skills
+ *
+ * @param {Array} findings - array of { id, severity, title, detail }
+ * @returns {string} Markdown constitution text
+ */
+export function generateConstitution(findings) {
+  const now = new Date().toISOString().slice(0, 10);
+  const lines = [
+    `# ClawArmor-Generated Constitution`,
+    `_Generated: ${now} by clawarmor stack deploy --ironcurtain_`,
+    '',
+  ];
+
+  const allowed = [
+    'Read and write files only within the project workspace directory',
+    'Search the web for public information',
+    'View git status and git log',
+  ];
+  const escalate = [];
+  const forbidden = [
+    'Accessing ~/.ssh, ~/.aws, ~/.openclaw, or other credential files outside the workspace',
+    'Deleting files outside the project workspace directory',
+  ];
+
+  if (!findings || !findings.length) {
+    // Conservative defaults when no audit data
+    escalate.push('All exec tool calls (no audit data — applying conservative defaults)');
+    escalate.push('Any network request to external URLs');
+  } else {
+    const added = new Set();
+    for (const finding of findings) {
+      const id = (finding.id || '').toLowerCase();
+      const detail = (finding.detail || '').toLowerCase();
+      const title = (finding.title || '').toLowerCase();
+      const ref = `(audit: ${finding.id})`; // eslint-disable-line no-unused-vars
+
+      // exec.ask=off → escalate exec
+      if (
+        !added.has('exec') &&
+        (id.includes('exec') || title.includes('exec')) &&
+        (id.includes('ask') || id.includes('approval') || detail.includes('ask') ||
+         title.includes('approval') || title.includes('unrestricted') || detail.includes('unrestricted'))
+      ) {
+        added.add('exec');
+        escalate.push(`All exec tool calls require human approval ${ref}`);
+      }
+
+      // elevated.allowFrom empty → forbidden elevated ops
+      // Matches: elevated.*, tools.elevated.*, allowfrom.*
+      if (
+        !added.has('elevated') &&
+        (id.includes('elevated') || id.includes('allowfrom') || title.includes('elevated'))
+      ) {
+        added.add('elevated');
+        forbidden.push(`Elevated operations without explicit allowFrom restrictions ${ref}`);
+      }
+
+      // channels with no allowFrom / group policy open → escalate external messages
+      // Matches: channel.groupPolicy, channel.allowFrom, channels.*
+      if (
+        !added.has('channel') &&
+        (id.includes('channel') || title.includes('channel')) &&
+        (id.includes('allow') || id.includes('group') || id.includes('policy') ||
+         detail.includes('allowfrom') || detail.includes('open') ||
+         title.includes('restriction') || title.includes('gate') || title.includes('group'))
+      ) {
+        added.add('channel');
+        escalate.push(`Messages sent to external groups or channels require approval ${ref}`);
+      }
+
+      // gateway.host=0.0.0.0 → forbidden external gateway exposure
+      if (
+        !added.has('gateway') &&
+        id.includes('gateway') && (id.includes('host') || detail.includes('0.0.0.0'))
+      ) {
+        added.add('gateway');
+        forbidden.push(`Exposing the gateway to all network interfaces ${ref}`);
+      }
+
+      // credential files world-readable / secret exposure
+      // Matches: cred.*, credential-file, cred.json_secrets, filesystem.perms
+      if (
+        !added.has('cred.perm') &&
+        (id.includes('cred') || id.includes('credential') || id.includes('filesystem') ||
+         id.includes('secret')) &&
+        (id.includes('perm') || id.includes('secret') || id.includes('file') ||
+         detail.includes('world') || detail.includes('readable') || detail.includes('permission') ||
+         title.includes('permission') || title.includes('world') || title.includes('secret'))
+      ) {
+        added.add('cred.perm');
+        forbidden.push(`Reading credential files with overly permissive file modes ${ref}`);
+      }
+
+      // skill supply chain
+      if (
+        !added.has('skill') &&
+        id.includes('skill') &&
+        (id.includes('pin') || id.includes('supply') || detail.includes('supply') ||
+         detail.includes('unverified') || title.includes('pin') || title.includes('supply'))
+      ) {
+        added.add('skill');
+        forbidden.push(`Loading unverified skills or skills without pinned versions ${ref}`);
+      }
+    }
+
+    if (!escalate.length) {
+      escalate.push('Any shell command execution');
+      escalate.push('Any network request to external URLs not required by the task');
+    }
+  }
+
+  lines.push('## Allowed');
+  for (const item of allowed) lines.push(`- ${item}`);
+  lines.push('');
+
+  if (escalate.length) {
+    lines.push('## Escalate (require human approval)');
+    for (const item of escalate) lines.push(`- ${item}`);
+    lines.push('');
+  }
+
+  lines.push('## Forbidden');
+  for (const item of forbidden) lines.push(`- ${item}`);
+  lines.push('');
+
+  lines.push('---');
+  lines.push('_To compile into deterministic rules:_');
+  lines.push('```');
+  lines.push('ironcurtain compile-policy ~/.ironcurtain/constitution-clawarmor.md');
+  lines.push('```');
+  lines.push('_To update after a new audit:_');
+  lines.push('```');
+  lines.push('clawarmor stack sync');
+  lines.push('```');
+
+  return lines.join('\n');
+}
+
+/**
+ * Write constitution to ~/.ironcurtain/constitution-clawarmor.md.
+ * @param {string} content
+ * @returns {{ ok: boolean, err?: string, path: string }}
+ */
+export function writeConstitution(content) {
+  try {
+    if (!existsSync(IRONCURTAIN_DIR)) mkdirSync(IRONCURTAIN_DIR, { recursive: true });
+    writeFileSync(CONSTITUTION_PATH, content, 'utf8');
+    return { ok: true, path: CONSTITUTION_PATH };
+  } catch (e) {
+    return { ok: false, err: e.message?.split('\n')[0] || 'write failed', path: CONSTITUTION_PATH };
+  }
+}
+
+/**
+ * Get current status of IronCurtain integration.
+ * @returns {{ installed: boolean, constitutionExists: boolean, constitutionPath: string, lastGenerated: string|null }}
+ */
+export function getStatus() {
+  const installed = checkInstalled();
+  const constitutionExists = existsSync(CONSTITUTION_PATH);
+  let lastGenerated = null;
+  if (constitutionExists) {
+    try { lastGenerated = statSync(CONSTITUTION_PATH).mtime.toISOString(); } catch { /* non-fatal */ }
+  }
+  return { installed, constitutionExists, constitutionPath: CONSTITUTION_PATH, lastGenerated };
+}

package/lib/stack.js

@@ -0,0 +1,410 @@
+// lib/stack.js — ClawArmor stack command handler
+// Subcommands: status, plan, deploy [--invariant|--ironcurtain|--all], sync, teardown
+
+import { unlinkSync } from 'fs';
+import { paint } from './output/colors.js';
+import { getStackStatus, getPlan } from './stack/index.js';
+import * as Invariant from './stack/invariant.js';
+import * as IronCurtain from './stack/ironcurtain.js';
+
+const SEP = paint.dim('─'.repeat(52));
+const VERSION = '3.0.0';
+
+function box(title) {
+  const W = 52, pad = W - 2 - title.length, l = Math.floor(pad / 2), r = pad - l;
+  return [
+    paint.dim('╔' + '═'.repeat(W - 2) + '╗'),
+    paint.dim('║') + ' '.repeat(l) + paint.bold(title) + ' '.repeat(r) + paint.dim('║'),
+    paint.dim('╚' + '═'.repeat(W - 2) + '╝'),
+  ].join('\n');
+}
+
+function riskBadge(level) {
+  if (level === 'critical') return paint.critical('⬤ Critical');
+  if (level === 'medium')   return paint.yellow('⬤ Medium');
+  if (level === 'low')      return paint.green('⬤ Low');
+  return paint.dim('⬤ Unknown');
+}
+
+// ── status ────────────────────────────────────────────────────────────────────
+
+async function stackStatus() {
+  console.log(''); console.log(box(`ClawArmor Stack  v${VERSION}`)); console.log('');
+
+  const { audit, profile } = await getStackStatus();
+  const scoreNote = profile.score != null ? `(audit score: ${profile.score}/100)` : '(no audit data)';
+  console.log(`  ${paint.dim('Risk profile')}    ${riskBadge(profile.level)}  ${paint.dim(scoreNote)}`);
+  console.log('');
+  console.log(SEP);
+
+  // Invariant
+  const inv = Invariant.getStatus();
+  const invIcon   = inv.rulesExist ? paint.green('✓') : paint.yellow('○');
+  const invStatus = inv.rulesExist
+    ? `${paint.green('deployed')} ${paint.dim(`(${inv.ruleCount} rule${inv.ruleCount !== 1 ? 's' : ''}, ~/.clawarmor/invariant-rules.inv)`)}`
+    : paint.dim('not deployed');
+  const invPip = inv.installed ? paint.green('pip: installed') : paint.yellow('pip: not installed');
+  console.log(`  ${invIcon} ${paint.bold('Invariant')}     ${invStatus}`);
+  console.log(`      ${paint.dim('Flow guardrails — detects multi-step attack chains')}`);
+  console.log(`      ${paint.dim(invPip)}`);
+  if (!inv.rulesExist) {
+    console.log(`      ${paint.dim('→ run: clawarmor stack deploy --invariant')}`);
+  }
+  console.log('');
+
+  // IronCurtain
+  const ic = IronCurtain.getStatus();
+  const icIcon   = ic.constitutionExists ? paint.green('✓') : paint.yellow('○');
+  const icStatus = ic.constitutionExists
+    ? `${paint.green('constitution exists')} ${paint.dim('(~/.ironcurtain/constitution-clawarmor.md)')}`
+    : paint.dim('not configured');
+  const icCli = ic.installed ? paint.green('cli: installed') : paint.yellow('cli: not installed');
+  console.log(`  ${icIcon} ${paint.bold('IronCurtain')}   ${icStatus}`);
+  console.log(`      ${paint.dim('Runtime constitution — policy-enforced tool call interception')}`);
+  console.log(`      ${paint.dim(icCli)}`);
+  if (!ic.constitutionExists) {
+    console.log(`      ${paint.dim('→ run: clawarmor stack deploy --ironcurtain')}`);
+  } else {
+    console.log(`      ${paint.dim('→ compile: ironcurtain compile-policy ~/.ironcurtain/constitution-clawarmor.md')}`);
+  }
+  console.log('');
+
+  console.log(SEP);
+  const layers = (inv.rulesExist ? 1 : 0) + (ic.constitutionExists ? 1 : 0);
+  const layerColor = layers >= 2 ? paint.green : layers === 1 ? paint.yellow : paint.red;
+  console.log(`  Stack coverage:  ${layerColor(String(layers))} / 2 layers active`);
+  if (layers < 2) {
+    console.log(`  ${paint.dim('→ run: clawarmor stack deploy --all')}`);
+  }
+  console.log('');
+  return 0;
+}
+
+// ── plan ──────────────────────────────────────────────────────────────────────
+
+async function stackPlan() {
+  console.log(''); console.log(box(`ClawArmor Stack  v${VERSION}`)); console.log('');
+  console.log(`  ${paint.cyan('Plan — what would be deployed (no changes made):')}`);
+  console.log('');
+
+  const { audit, profile } = await getStackStatus();
+  const plan = getPlan(profile);
+
+  console.log(`  ${paint.dim('Risk profile')}  ${riskBadge(profile.level)}`);
+  if (profile.score != null) console.log(`  ${paint.dim('Audit score')}   ${profile.score}/100`);
+  if (audit?.findings?.length) console.log(`  ${paint.dim('Findings')}      ${audit.findings.length} total`);
+  console.log('');
+  console.log(`  ${paint.dim('Deployment rationale:')}`);
+  console.log(`    ${plan.reason}`);
+  console.log('');
+  console.log(SEP);
+  console.log(`  ${paint.bold('Components:')}`);
+  console.log('');
+
+  const inv = Invariant.getStatus();
+  const invMark = plan.invariant
+    ? (inv.rulesExist ? paint.dim('○ already deployed') : paint.green('→ would deploy'))
+    : paint.dim('– not recommended for this risk level');
+  console.log(`  Invariant     ${invMark}`);
+  if (plan.invariant && !inv.rulesExist) {
+    console.log(`    ${paint.dim('Would: pip3 install invariant-ai')}`);
+    console.log(`    ${paint.dim('Would: generate rules from ' + (audit?.findings?.length || 0) + ' audit findings')}`);
+    console.log(`    ${paint.dim('Would: write ~/.clawarmor/invariant-rules.inv')}`);
+  }
+  console.log('');
+
+  const ic = IronCurtain.getStatus();
+  const icMark = plan.ironcurtain
+    ? (ic.constitutionExists ? paint.dim('○ already deployed') : paint.green('→ would deploy'))
+    : paint.dim('– not recommended for this risk level');
+  console.log(`  IronCurtain   ${icMark}`);
+  if (plan.ironcurtain && !ic.constitutionExists) {
+    console.log(`    ${paint.dim('Would: generate constitution from audit findings')}`);
+    console.log(`    ${paint.dim('Would: write ~/.ironcurtain/constitution-clawarmor.md')}`);
+    console.log(`    ${paint.dim('Then:  ironcurtain compile-policy (manual step)')}`);
+  }
+  console.log('');
+
+  console.log(SEP);
+  console.log(`  ${paint.dim('To apply: clawarmor stack deploy --all')}`);
+  console.log('');
+  return 0;
+}
+
+// ── deploy ────────────────────────────────────────────────────────────────────
+
+async function stackDeploy(flags) {
+  const doInvariant  = flags.invariant  || flags.all;
+  const doIronCurtain = flags.ironcurtain || flags.all;
+
+  console.log(''); console.log(box(`ClawArmor Stack  v${VERSION}`)); console.log('');
+
+  if (!doInvariant && !doIronCurtain) {
+    console.log(`  ${paint.yellow('!')} Specify a component to deploy:`);
+    console.log(`    ${paint.cyan('clawarmor stack deploy --invariant')}`);
+    console.log(`    ${paint.cyan('clawarmor stack deploy --ironcurtain')}`);
+    console.log(`    ${paint.cyan('clawarmor stack deploy --all')}`);
+    console.log('');
+    return 1;
+  }
+
+  const { audit, profile } = await getStackStatus();
+  const findings = audit?.findings ?? [];
+
+  console.log(`  ${paint.dim('Risk profile')}  ${riskBadge(profile.level)}`);
+  if (findings.length) {
+    console.log(`  ${paint.dim('Findings')}      ${findings.length} — generating configs from audit data`);
+  } else {
+    console.log(`  ${paint.dim('Findings')}      ${paint.dim('none — run clawarmor audit first for best results')}`);
+  }
+  console.log('');
+
+  let exitCode = 0;
+
+  // ── Invariant ──────────────────────────────────────────────────────────────
+  if (doInvariant) {
+    console.log(SEP);
+    console.log(`  ${paint.bold('Invariant')} — flow guardrails`);
+    console.log('');
+
+    const alreadyInstalled = Invariant.checkInstalled();
+    if (!alreadyInstalled) {
+      process.stdout.write(`  ${paint.dim('Installing invariant-ai via pip3...')} `);
+      const result = Invariant.install();
+      if (result.ok) {
+        process.stdout.write(paint.green('✓\n'));
+      } else {
+        process.stdout.write(paint.red('✗\n'));
+        console.log(`  ${paint.red('Error:')} ${result.err}`);
+        console.log(`  ${paint.dim('Try manually: pip3 install invariant-ai')}`);
+        exitCode = 1;
+      }
+    } else {
+      console.log(`  ${paint.green('✓')} invariant-ai already installed`);
+    }
+
+    process.stdout.write(`  ${paint.dim('Generating rules from audit findings...')} `);
+    const rules = Invariant.generateRules(findings);
+    process.stdout.write(paint.green('✓\n'));
+
+    process.stdout.write(`  ${paint.dim('Writing ~/.clawarmor/invariant-rules.inv...')} `);
+    const deployResult = Invariant.deploy(rules);
+    if (deployResult.ok) {
+      process.stdout.write(paint.green('✓\n'));
+      const s = Invariant.getStatus();
+      console.log(`  ${paint.green('✓')} Deployed: ${s.ruleCount} rule${s.ruleCount !== 1 ? 's' : ''}`);
+      console.log(`  ${paint.dim('Path:')} ${deployResult.rulesPath}`);
+    } else {
+      process.stdout.write(paint.red('✗\n'));
+      console.log(`  ${paint.red('Error:')} ${deployResult.err}`);
+      exitCode = 1;
+    }
+    console.log('');
+  }
+
+  // ── IronCurtain ────────────────────────────────────────────────────────────
+  if (doIronCurtain) {
+    console.log(SEP);
+    console.log(`  ${paint.bold('IronCurtain')} — runtime constitution`);
+    console.log('');
+
+    const icInstalled = IronCurtain.checkInstalled();
+    if (icInstalled) {
+      console.log(`  ${paint.green('✓')} ironcurtain CLI installed`);
+    } else {
+      console.log(`  ${paint.yellow('○')} ironcurtain CLI not installed ${paint.dim('(constitution generated regardless)')}`);
+      console.log(`  ${paint.dim('Install: npm install -g ironcurtain')}`);
+    }
+
+    process.stdout.write(`  ${paint.dim('Generating constitution from audit findings...')} `);
+    const constitution = IronCurtain.generateConstitution(findings);
+    process.stdout.write(paint.green('✓\n'));
+
+    process.stdout.write(`  ${paint.dim('Writing ~/.ironcurtain/constitution-clawarmor.md...')} `);
+    const writeResult = IronCurtain.writeConstitution(constitution);
+    if (writeResult.ok) {
+      process.stdout.write(paint.green('✓\n'));
+      console.log(`  ${paint.green('✓')} Constitution written: ${writeResult.path}`);
+    } else {
+      process.stdout.write(paint.red('✗\n'));
+      console.log(`  ${paint.red('Error:')} ${writeResult.err}`);
+      exitCode = 1;
+    }
+
+    console.log('');
+    console.log(`  ${paint.yellow('!')} Next step — compile the constitution into deterministic rules:`);
+    console.log(`    ${paint.dim('ironcurtain compile-policy ~/.ironcurtain/constitution-clawarmor.md')}`);
+    console.log('');
+  }
+
+  console.log(SEP);
+  const invS = Invariant.getStatus();
+  const icS  = IronCurtain.getStatus();
+  const layers = (invS.rulesExist ? 1 : 0) + (icS.constitutionExists ? 1 : 0);
+  const layerColor = layers >= 2 ? paint.green : layers === 1 ? paint.yellow : paint.red;
+  console.log(`  Stack coverage: ${layerColor(String(layers))} / 2 layers active`);
+  if (exitCode === 0) {
+    console.log(`  ${paint.green('✓')} Done. Run ${paint.cyan('clawarmor stack status')} to verify.`);
+  } else {
+    console.log(`  ${paint.yellow('!')} Completed with errors. Check output above.`);
+  }
+  console.log('');
+  return exitCode;
+}
+
+// ── sync ──────────────────────────────────────────────────────────────────────
+
+async function stackSync() {
+  console.log(''); console.log(box(`ClawArmor Stack  v${VERSION}`)); console.log('');
+  console.log(`  ${paint.cyan('Sync — regenerating stack configs from latest audit...')}`);
+  console.log('');
+
+  const { audit, profile } = await getStackStatus();
+  if (!audit) {
+    console.log(`  ${paint.yellow('!')} No audit data found.`);
+    console.log(`  ${paint.dim('Run clawarmor audit first, then clawarmor stack sync.')}`);
+    console.log('');
+    return 1;
+  }
+
+  const findings = audit.findings ?? [];
+  console.log(`  ${paint.dim('Audit score')}   ${profile.score ?? 'n/a'}/100  ${paint.dim('(' + findings.length + ' findings)')}`);
+  console.log('');
+
+  const invStatus = Invariant.getStatus();
+  const icStatus  = IronCurtain.getStatus();
+  let updated = 0;
+
+  if (invStatus.rulesExist) {
+    process.stdout.write(`  ${paint.dim('Invariant: regenerating rules...')} `);
+    const rules  = Invariant.generateRules(findings);
+    const result = Invariant.deploy(rules);
+    if (result.ok) { process.stdout.write(paint.green('✓\n')); updated++; }
+    else           { process.stdout.write(paint.red('✗\n')); console.log(`    ${paint.dim(result.err)}`); }
+  } else {
+    console.log(`  ${paint.dim('Invariant: not deployed — skipping')}`);
+  }
+
+  if (icStatus.constitutionExists) {
+    process.stdout.write(`  ${paint.dim('IronCurtain: regenerating constitution...')} `);
+    const constitution = IronCurtain.generateConstitution(findings);
+    const result = IronCurtain.writeConstitution(constitution);
+    if (result.ok) { process.stdout.write(paint.green('✓\n')); updated++; }
+    else           { process.stdout.write(paint.red('✗\n')); console.log(`    ${paint.dim(result.err)}`); }
+  } else {
+    console.log(`  ${paint.dim('IronCurtain: not deployed — skipping')}`);
+  }
+
+  console.log('');
+  if (updated > 0) {
+    console.log(`  ${paint.green('✓')} Synced ${updated} component${updated !== 1 ? 's' : ''} from latest audit.`);
+    if (icStatus.constitutionExists && IronCurtain.checkInstalled()) {
+      console.log(`  ${paint.yellow('!')} Re-compile IronCurtain constitution to take effect:`);
+      console.log(`    ${paint.dim('ironcurtain compile-policy ~/.ironcurtain/constitution-clawarmor.md')}`);
+    }
+  } else {
+    console.log(`  ${paint.dim('Nothing synced. Run clawarmor stack deploy --all to set up the stack.')}`);
+  }
+  console.log('');
+  return 0;
+}
+
+// ── teardown ──────────────────────────────────────────────────────────────────
+
+async function stackTeardown(flags) {
+  const doInvariant   = flags.invariant   || flags.all;
+  const doIronCurtain = flags.ironcurtain || flags.all;
+
+  console.log(''); console.log(box(`ClawArmor Stack  v${VERSION}`)); console.log('');
+
+  if (!doInvariant && !doIronCurtain) {
+    console.log(`  ${paint.yellow('!')} Specify a component to teardown:`);
+    console.log(`    ${paint.cyan('clawarmor stack teardown --invariant')}`);
+    console.log(`    ${paint.cyan('clawarmor stack teardown --ironcurtain')}`);
+    console.log(`    ${paint.cyan('clawarmor stack teardown --all')}`);
+    console.log('');
+    return 1;
+  }
+
+  console.log(`  ${paint.cyan('Teardown — removing deployed stack components...')}`);
+  console.log('');
+
+  const invStatus = Invariant.getStatus();
+  const icStatus  = IronCurtain.getStatus();
+  let removed = 0;
+
+  if (doInvariant) {
+    if (invStatus.rulesExist) {
+      try {
+        unlinkSync(invStatus.rulesPath);
+        console.log(`  ${paint.green('✓')} Invariant rules removed: ${invStatus.rulesPath}`);
+        removed++;
+      } catch (e) {
+        console.log(`  ${paint.red('✗')} Failed to remove Invariant rules: ${e.message?.split('\n')[0]}`);
+      }
+    } else {
+      console.log(`  ${paint.dim('○')} Invariant rules not found — nothing to remove`);
+    }
+  }
+
+  if (doIronCurtain) {
+    if (icStatus.constitutionExists) {
+      try {
+        unlinkSync(icStatus.constitutionPath);
+        console.log(`  ${paint.green('✓')} IronCurtain constitution removed: ${icStatus.constitutionPath}`);
+        removed++;
+      } catch (e) {
+        console.log(`  ${paint.red('✗')} Failed to remove IronCurtain constitution: ${e.message?.split('\n')[0]}`);
+      }
+    } else {
+      console.log(`  ${paint.dim('○')} IronCurtain constitution not found — nothing to remove`);
+    }
+  }
+
+  console.log('');
+  if (removed > 0) {
+    console.log(`  ${paint.green('✓')} Teardown complete. Removed ${removed} component${removed !== 1 ? 's' : ''}.`);
+  } else {
+    console.log(`  ${paint.dim('Nothing removed.')}`);
+  }
+  console.log('');
+  return 0;
+}
+
+// ── Main export ───────────────────────────────────────────────────────────────
+
+export async function runStack(args = []) {
+  const sub = args[0];
+
+  if (!sub || sub === 'status')  return stackStatus();
+  if (sub === 'plan')            return stackPlan();
+  if (sub === 'sync')            return stackSync();
+
+  if (sub === 'deploy') {
+    return stackDeploy({
+      invariant:   args.includes('--invariant'),
+      ironcurtain: args.includes('--ironcurtain'),
+      all:         args.includes('--all'),
+    });
+  }
+
+  if (sub === 'teardown') {
+    return stackTeardown({
+      invariant:   args.includes('--invariant'),
+      ironcurtain: args.includes('--ironcurtain'),
+      all:         args.includes('--all'),
+    });
+  }
+
+  console.log('');
+  console.log(`  ${paint.red('✗')} Unknown stack subcommand: ${paint.bold(sub)}`);
+  console.log('');
+  console.log(`  ${paint.bold('Stack subcommands:')}`);
+  console.log(`    ${paint.cyan('clawarmor stack status')}`);
+  console.log(`    ${paint.cyan('clawarmor stack plan')}`);
+  console.log(`    ${paint.cyan('clawarmor stack deploy --invariant | --ironcurtain | --all')}`);
+  console.log(`    ${paint.cyan('clawarmor stack sync')}`);
+  console.log(`    ${paint.cyan('clawarmor stack teardown --invariant | --ironcurtain | --all')}`);
+  console.log('');
+  return 1;
+}

package/lib/status.js

@@ -8,6 +8,8 @@ import { paint } from './output/colors.js';
 import { scoreToGrade, scoreColor, gradeColor } from './output/progress.js';
 import { watchDaemonStatus } from './watch.js';
 import { getMonitorStatus } from './monitor.js';
+import { getStatus as getInvariantStatus } from './stack/invariant.js';
+import { getStatus as getIronCurtainStatus } from './stack/ironcurtain.js';
 
 const HOME = homedir();
 const OC_DIR = join(HOME, '.openclaw');
@@ -21,7 +23,7 @@ const FISH_FUNCTION_FILE = join(HOME, '.config', 'fish', 'functions', 'openclaw.
 const SHELL_MARKER = '# ClawArmor intercept — added by: clawarmor protect --install';
 const CRON_JOBS_FILE = join(OC_DIR, 'cron', 'jobs.json');
 const HOOKS_DIR = join(OC_DIR, 'hooks', 'clawarmor-guard');
-const VERSION = '2.2.0';
+const VERSION = '3.0.0';
 
 const SEP = paint.dim('─'.repeat(52));
 
@@ -256,6 +258,26 @@ export async function runStatus() {
   }
   console.log(`  ${paint.dim('Credentials')}   ${credStr}`);
 
+  // ── Stack protection ──────────────────────────────────────────────────────
+  {
+    const inv = getInvariantStatus();
+    const ic  = getIronCurtainStatus();
+    const layers = (inv.rulesExist ? 1 : 0) + (ic.constitutionExists ? 1 : 0);
+
+    const invStr = inv.rulesExist
+      ? `${paint.green('✓')} ${paint.dim(`Invariant (${inv.ruleCount} rule${inv.ruleCount !== 1 ? 's' : ''})`)}`
+      : `${paint.yellow('○')} ${paint.dim('Invariant: not deployed')}`;
+    const icStr = ic.constitutionExists
+      ? `${paint.green('✓')} ${paint.dim('IronCurtain (constitution exists)')}`
+      : `${paint.yellow('○')} ${paint.dim('IronCurtain: not configured')}`;
+
+    const layerColor = layers >= 2 ? paint.green : layers === 1 ? paint.yellow : paint.red;
+    console.log(`  ${paint.dim('Stack')}         ${layerColor(String(layers) + '/2')} ${paint.dim('layers')}  ${invStr}  ${icStr}`);
+    if (layers < 2) {
+      console.log(`               ${paint.dim('→ run: clawarmor stack deploy --all')}`);
+    }
+  }
+
   console.log('');
   console.log(SEP);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawarmor",
-  "version": "2.2.1",
+  "version": "3.0.0",
   "description": "Security armor for OpenClaw agents — audit, scan, monitor",
   "bin": {
     "clawarmor": "cli.js"