clawclamp 0.1.8 → 0.1.9

package/README.md

@@ -5,7 +5,7 @@ Clawclamp adds Cedar-based authorization to OpenClaw tool calls. It evaluates ev
 ## Features
 
 - Cedar policy enforcement for `before_tool_call`.
-- Long-term authorization via policy (defaults allow low-risk tools).
+- Long-term authorization via policy (default policy denies all unless a grant is active).
 - Short-term authorization via expiring grants.
 - Audit UI for allowed/denied/gray-mode tool calls.
 - Gray mode: denied calls are still executed but logged as overrides.
@@ -40,7 +40,7 @@ plugins:
           includeParams: true
 ```
 
-`policyStoreUri` points to a Cedar policy store JSON (file:// or https://). `policyStoreLocal` can be set to a raw JSON string for the policy store. If omitted, the plugin uses a built-in policy store that permits low-risk tools and requires a grant for other risks.
+`policyStoreUri` points to a Cedar policy store JSON (file:// or https://). `policyStoreLocal` can be set to a raw JSON string for the policy store. If omitted, the plugin uses a built-in policy store that denies all tool calls unless a grant is active or an explicit permit policy exists.
 
 ## UI
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawclamp",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "description": "OpenClaw Cedar authorization guard with audit UI",
   "type": "module",
   "dependencies": {

package/src/cedarling.ts

@@ -1,4 +1,6 @@
 import initWasm, { init } from "@janssenproject/cedarling_wasm";
+import { readFile } from "node:fs/promises";
+import { createRequire } from "node:module";
 
 export type CedarlingConfig = Record<string, string | number | boolean>;
 
@@ -11,7 +13,9 @@ export type CedarlingInstance = {
   pop_logs: () => unknown[];
 };
 
+const require = createRequire(import.meta.url);
 let cedarlingPromise: Promise<CedarlingInstance> | null = null;
+let wasmInitPromise: Promise<void> | null = null;
 
 export async function getCedarling(config: CedarlingConfig): Promise<CedarlingInstance> {
   if (!cedarlingPromise) {
@@ -20,8 +24,19 @@ export async function getCedarling(config: CedarlingConfig): Promise<CedarlingIn
   return cedarlingPromise;
 }
 
+async function ensureWasmInitialized(): Promise<void> {
+  if (!wasmInitPromise) {
+    wasmInitPromise = (async () => {
+      const wasmPath = require.resolve("@janssenproject/cedarling_wasm/cedarling_wasm_bg.wasm");
+      const wasmBytes = await readFile(wasmPath);
+      await initWasm(wasmBytes);
+    })();
+  }
+  return wasmInitPromise;
+}
+
 async function createCedarling(config: CedarlingConfig): Promise<CedarlingInstance> {
-  await initWasm();
+  await ensureWasmInitialized();
   const instance = await init(config);
   return instance as CedarlingInstance;
 }