clawclamp 0.1.10 → 0.1.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawclamp",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "OpenClaw Cedar authorization guard with audit UI",
   "type": "module",
   "dependencies": {

package/src/policy-store.ts

@@ -10,12 +10,28 @@ const POLICY_FILE = "policy-store.json";
 
 export type PolicyEntry = { id: string; content: string };
 
+type PolicyRecord = {
+  cedar_version?: string;
+  name?: string;
+  description?: string;
+  policy_content: string;
+};
+
+type PolicyStoreBody = {
+  name?: string;
+  description?: string;
+  schema?: string;
+  trusted_issuers?: Record<string, unknown>;
+  policies?: Record<string, PolicyRecord>;
+};
+
 export type PolicyStoreSnapshot = {
   cedar_version: string;
-  schema: Record<string, string>;
-  policies: Record<string, { policy_content: string }>;
+  policy_stores: Record<string, PolicyStoreBody>;
 };
 
+const POLICY_STORE_ID = "clawclamp";
+
 function resolvePolicyPath(stateDir: string): string {
   return path.join(stateDir, "clawclamp", POLICY_FILE);
 }
@@ -34,7 +50,7 @@ async function readPolicyStore(stateDir: string): Promise<PolicyStoreSnapshot> {
     filePath,
     buildDefaultPolicyStore() as PolicyStoreSnapshot,
   );
-  return value;
+  return normalizePolicyStore(value);
 }
 
 async function writePolicyStore(stateDir: string, store: PolicyStoreSnapshot): Promise<void> {
@@ -43,6 +59,62 @@ async function writePolicyStore(stateDir: string, store: PolicyStoreSnapshot): P
   await writeJsonFileAtomically(filePath, store);
 }
 
+function normalizePolicyStore(raw: unknown): PolicyStoreSnapshot {
+  const fallback = buildDefaultPolicyStore() as PolicyStoreSnapshot;
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+    return fallback;
+  }
+
+  const candidate = raw as Record<string, unknown>;
+  if (candidate.policy_stores && typeof candidate.policy_stores === "object") {
+    return candidate as PolicyStoreSnapshot;
+  }
+
+  const legacyPolicies =
+    candidate.policies && typeof candidate.policies === "object" && !Array.isArray(candidate.policies)
+      ? (candidate.policies as Record<string, PolicyRecord>)
+      : {};
+  const legacySchema =
+    candidate.schema && typeof candidate.schema === "object" && !Array.isArray(candidate.schema)
+      ? ((candidate.schema as Record<string, string>)["schema.json"] ?? "")
+      : "";
+
+  return {
+    cedar_version:
+      typeof candidate.cedar_version === "string" ? candidate.cedar_version : fallback.cedar_version,
+    policy_stores: {
+      [POLICY_STORE_ID]: {
+        name: "Clawclamp Policy Store",
+        description: "Migrated legacy policy store.",
+        schema:
+          legacySchema ||
+          fallback.policy_stores[POLICY_STORE_ID]?.schema ||
+          "",
+        trusted_issuers: {},
+        policies: legacyPolicies,
+      },
+    },
+  };
+}
+
+function getWritableStore(store: PolicyStoreSnapshot): PolicyStoreBody {
+  const existing = store.policy_stores?.[POLICY_STORE_ID];
+  if (existing) {
+    return existing;
+  }
+  const fallback = buildDefaultPolicyStore() as PolicyStoreSnapshot;
+  const created = fallback.policy_stores[POLICY_STORE_ID] ?? {
+    policies: {},
+    schema: "",
+    trusted_issuers: {},
+  };
+  if (!store.policy_stores) {
+    store.policy_stores = {};
+  }
+  store.policy_stores[POLICY_STORE_ID] = created;
+  return created;
+}
+
 export async function ensurePolicyStore(params: {
   stateDir: string;
   config: ClawClampConfig;
@@ -54,7 +126,12 @@ export async function ensurePolicyStore(params: {
     const filePath = resolvePolicyPath(params.stateDir);
     try {
       const raw = await fs.readFile(filePath, "utf8");
-      return { json: raw, readOnly: false };
+      const normalized = normalizePolicyStore(JSON.parse(raw));
+      const json = JSON.stringify(normalized);
+      if (json !== raw) {
+        await writePolicyStore(params.stateDir, normalized);
+      }
+      return { json, readOnly: false };
     } catch (error) {
       const code = (error as { code?: string }).code;
       if (code !== "ENOENT") {
@@ -63,7 +140,7 @@ export async function ensurePolicyStore(params: {
     }
 
     const initial = params.config.policyStoreLocal
-      ? (JSON.parse(params.config.policyStoreLocal) as PolicyStoreSnapshot)
+      ? normalizePolicyStore(JSON.parse(params.config.policyStoreLocal))
       : (buildDefaultPolicyStore() as PolicyStoreSnapshot);
     await writePolicyStore(params.stateDir, initial);
     return { json: JSON.stringify(initial), readOnly: false };
@@ -75,11 +152,12 @@ export async function listPolicies(params: {
 }): Promise<{ policies: PolicyEntry[]; schema: string }> {
   return withStateFileLock(params.stateDir, "policy-store", async () => {
     const store = await readPolicyStore(params.stateDir);
-    const policies: PolicyEntry[] = Object.entries(store.policies ?? {}).map(([id, payload]) => ({
+    const policyStore = getWritableStore(store);
+    const policies: PolicyEntry[] = Object.entries(policyStore.policies ?? {}).map(([id, payload]) => ({
       id,
       content: decodeBase64(payload.policy_content ?? ""),
     }));
-    const schemaEncoded = store.schema?.["schema.json"] ?? "";
+    const schemaEncoded = policyStore.schema ?? "";
     return { policies, schema: schemaEncoded ? decodeBase64(schemaEncoded) : "" };
   });
 }
@@ -91,14 +169,20 @@ export async function createPolicy(params: {
 }): Promise<PolicyEntry> {
   return withStateFileLock(params.stateDir, "policy-store", async () => {
     const store = await readPolicyStore(params.stateDir);
+    const policyStore = getWritableStore(store);
     const id = params.id?.trim() || `clawclamp-${randomUUID()}`;
-    if (!store.policies) {
-      store.policies = {};
+    if (!policyStore.policies) {
+      policyStore.policies = {};
     }
-    if (store.policies[id]) {
+    if (policyStore.policies[id]) {
       throw new Error("policy id already exists");
     }
-    store.policies[id] = { policy_content: encodeBase64(params.content) };
+    policyStore.policies[id] = {
+      cedar_version: store.cedar_version,
+      name: id,
+      description: "Created from Clawclamp UI.",
+      policy_content: encodeBase64(params.content),
+    };
     await writePolicyStore(params.stateDir, store);
     return { id, content: params.content };
   });
@@ -111,10 +195,16 @@ export async function updatePolicy(params: {
 }): Promise<PolicyEntry> {
   return withStateFileLock(params.stateDir, "policy-store", async () => {
     const store = await readPolicyStore(params.stateDir);
-    if (!store.policies?.[params.id]) {
+    const policyStore = getWritableStore(store);
+    if (!policyStore.policies?.[params.id]) {
       throw new Error("policy id not found");
     }
-    store.policies[params.id] = { policy_content: encodeBase64(params.content) };
+    policyStore.policies[params.id] = {
+      cedar_version: store.cedar_version,
+      name: params.id,
+      description: "Updated from Clawclamp UI.",
+      policy_content: encodeBase64(params.content),
+    };
     await writePolicyStore(params.stateDir, store);
     return { id: params.id, content: params.content };
   });
@@ -123,10 +213,11 @@ export async function updatePolicy(params: {
 export async function deletePolicy(params: { stateDir: string; id: string }): Promise<boolean> {
   return withStateFileLock(params.stateDir, "policy-store", async () => {
     const store = await readPolicyStore(params.stateDir);
-    if (!store.policies?.[params.id]) {
+    const policyStore = getWritableStore(store);
+    if (!policyStore.policies?.[params.id]) {
       return false;
     }
-    delete store.policies[params.id];
+    delete policyStore.policies[params.id];
     await writePolicyStore(params.stateDir, store);
     return true;
   });

package/src/policy.ts

@@ -31,23 +31,41 @@ when {
 };`,
 ];
 
+const POLICY_STORE_ID = "clawclamp";
+
 function toBase64(raw: string): string {
   return Buffer.from(raw, "utf8").toString("base64");
 }
 
 export function buildDefaultPolicyStore(): Record<string, unknown> {
-  const policies: Record<string, { policy_content: string }> = {};
+  const policies: Record<
+    string,
+    {
+      cedar_version: string;
+      name: string;
+      description: string;
+      policy_content: string;
+    }
+  > = {};
   DEFAULT_POLICIES.forEach((policy, index) => {
     policies[`openclaw-clawclamp-${index + 1}`] = {
+      cedar_version: "v4.0.0",
+      name: `Clawclamp Default Policy ${index + 1}`,
+      description: "Default grant-based permit policy.",
       policy_content: toBase64(policy),
     };
   });
 
   return {
     cedar_version: "v4.0.0",
-    schema: {
-      "schema.json": toBase64(DEFAULT_SCHEMA),
+    policy_stores: {
+      [POLICY_STORE_ID]: {
+        name: "Clawclamp Policy Store",
+        description: "Local Cedar policies for Clawclamp.",
+        policies,
+        schema: toBase64(DEFAULT_SCHEMA),
+        trusted_issuers: {},
+      },
     },
-    policies,
   };
 }