clawdi 0.13.28 → 0.13.30

package/egress-addon/clawdi_egress_addon.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 import json
 import os
 import re
+from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any
 from urllib.parse import parse_qs, urlsplit
@@ -283,6 +284,8 @@ def profile_matches(flow: Any, profile: dict[str, Any], secrets: dict[str, str])
     match = profile.get("match")
     if not isinstance(match, dict):
         return False
+    if not match_time_is_valid(match):
+        return False
     kind = profile.get("kind")
     request_scheme = request_profile_scheme(flow)
     configured_scheme = match.get("scheme")
@@ -318,6 +321,21 @@ def profile_matches(flow: Any, profile: dict[str, Any], secrets: dict[str, str])
     return True
 
 
+def match_time_is_valid(match: dict[str, Any], now: datetime | None = None) -> bool:
+    if "notAfter" not in match:
+        return True
+    not_after = match.get("notAfter")
+    if not isinstance(not_after, str):
+        return False
+    try:
+        parsed = datetime.fromisoformat(not_after.replace("Z", "+00:00"))
+    except ValueError:
+        return False
+    if parsed.tzinfo is None:
+        return False
+    return (now or datetime.now(UTC)) < parsed
+
+
 def host_matches(flow: Any, profile: dict[str, Any]) -> bool:
     match = profile.get("match")
     if not isinstance(match, dict):
@@ -407,9 +425,14 @@ def matcher_matches(value: str | None, matcher: Any, secrets: dict[str, str]) ->
         return False
     if matcher_type == "equals":
         return value == f"{matcher.get('prefix', '')}{matcher.get('value', '')}"
-    if matcher_type == "secretRefEquals":
+    if matcher_type in {"secretRefEquals", "secretRefPrefix"}:
         secret = secrets.get(str(matcher.get("secretRef", "")))
-        return secret is not None and value == f"{matcher.get('prefix', '')}{secret}"
+        if secret is None:
+            return False
+        expected = f"{matcher.get('prefix', '')}{secret}{matcher.get('suffix', '')}"
+        if matcher_type == "secretRefEquals":
+            return value == expected
+        return value.startswith(expected)
     return False
 
 
@@ -456,6 +479,8 @@ def split_authority(authority: str) -> tuple[str, int | None]:
 
 def apply_rewrite_headers(flow: Any, profile: dict[str, Any], secrets: dict[str, str]) -> None:
     rewrite = profile.get("rewrite") if isinstance(profile.get("rewrite"), dict) else {}
+    for name in rewrite.get("removeHeaders", []):
+        header_delete(flow.request.headers, str(name))
     for name, setter in rewrite.get("setHeaders", {}).items():
         resolved = resolve_header_setter(setter, secrets)
         if resolved is not None:
@@ -557,6 +582,18 @@ def header_set(headers: Any, name: str, value: str) -> None:
     headers[name] = value
 
 
+def header_delete(headers: Any, name: str) -> None:
+    lower = name.lower()
+    for key in list(getattr(headers, "keys", lambda: [])()):
+        if str(key).lower() != lower:
+            continue
+        try:
+            del headers[key]
+        except (KeyError, TypeError):
+            pass
+        return
+
+
 def redact_url(url: str, profile: dict[str, Any] | None) -> str:
     redacted = url
     if not profile:

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "clawdi",
-	"version": "0.13.28",
+	"version": "0.13.30",
 	"description": "iCloud for AI Agents — cross-agent sessions, skills, memory, and vault.",
 	"license": "MIT",
 	"type": "module",

package/skills/clawdi/SKILL.md

@@ -77,6 +77,39 @@ MUST call `session_search` when:
 
 When the user's request is **conceptual** ("how do I usually do X"), prefer `memory_search`. When they want to **revisit a specific past conversation** ("the session where..."), use `session_search`. When unsure, try `memory_search` first (cheaper, faster), fall back to `session_search` if empty.
 
+## Projects
+
+Three read-only tools expose the caller's visible Project context:
+
+- `project_current` — Read the current or runtime-bound Project.
+- `project_list` — List visible Projects.
+- `project_get` — Read one visible Project by UUID.
+
+Hosted runtimes see only their bound Project. Treat a not-found response as an
+access boundary as well as a possible unknown UUID; do not try to bypass it
+through another tool.
+
+## Vault Metadata
+
+Two read-only MCP tools expose safe Vault metadata without secret values:
+
+- `vault_list` — List Vault attachments and key counts for visible Projects.
+- `vault_get` — List key names, provenance, and exact `clawdi://` references for one attached Vault.
+
+Use `vault_resolve` only when the current task requires one referenced plaintext value. Pass
+the exact Project-scoped reference. Treat the result as sensitive: never echo it, save it to
+Memory, or include it in logs.
+
+The metadata tools never resolve or return plaintext. Never imply that a returned key name
+is a secret value. Preserve their exact references for `vault_resolve` or when passing them
+to an authorized runtime:
+
+- `clawdi://project/<project-id>/vault/<vault>/field/<field>`
+- `clawdi://project/<project-id>/vault/<vault>/section/<section>/field/<field>`
+
+Use the live schemas from the `clawdi` MCP server as authoritative; the local
+stdio command only transports the protocol.
+
 ## Connectors
 
 Use the Composio Tool Router meta-tools returned by `tools/list` on the `clawdi` MCP server.
@@ -112,30 +145,23 @@ Treat their live names and schemas as authoritative; never assume a fixed meta-t
    fields, and termination signals exactly as exposed. Select an account only when the schema
    supports it, and use additional or future meta-tools only according to their live schemas.
 
-## Vault CLI
-
-When the user asks to migrate secrets into Clawdi Vault or script secret writes, prefer the CLI over raw HTTP calls:
+## Vault Management
 
-- Use `clawdi vault set KEY --prompt` for one-off manual secret entry; it prompts without echoing input.
-- Use `clawdi vault set KEY --stdin` for piped values. Empty stdin is rejected unless `--allow-empty` is passed intentionally.
-- Use `clawdi vault set KEY --value <value>` only when shell history exposure is acceptable.
-- Use service-specific vault slugs such as `api-service/env/KEY`; avoid broad slugs such as `prod/KEY`.
-- Use `clawdi vault import --vault <service-slug> --section <name> --project <project> --yes <file>` for non-interactive `.env` migrations into a section.
-- Keep `.env` import keys as POSIX environment identifiers such as `OPENAI_API_KEY`; section names belong in `--section`, not inside the key name.
-- Use `clawdi vault attach <vault> --project <project>` to make an existing Vault available in another Project.
-- Use `clawdi vault detach <vault> --project <project>` to remove one Project's access without deleting keys.
-- Use `clawdi vault rm <vault>/<section>/<field> --global --yes` only when the key should be deleted from the shared Vault for every attached Project.
-- Prefer exact `clawdi://project/...` references printed by the CLI. Do not print plaintext secret values unless the user explicitly asks for them.
+Vault mutation is intentionally not an Agent MCP capability. Do not use raw HTTP, daemon
+control RPC, or execute foreground Vault CLI commands on the user's behalf. When the user
+asks to write, import, attach, detach, or delete Vault data, explain that a human operator
+must perform it and provide the safest exact foreground command. Prefer `clawdi vault set
+KEY --prompt` for one value and `clawdi vault import ...` for migrations; never place a
+plaintext secret in command arguments or your response.
 
-## AI Provider CLI
+## AI Provider Management
 
-When the user asks to configure model providers, API keys, or Codex OAuth for agents, use `clawdi ai-provider`:
+Provider configuration is also a human operator workflow, not an Agent MCP capability. Do
+not execute provider CLI commands or handle provider credentials on the user's behalf. When
+asked, provide an exact `clawdi ai-provider` command for the operator to run and explain its
+effect; suggest `validate` or a non-live `test` before any explicitly requested live probe.
 
-- Add reusable providers with `clawdi ai-provider add <id> --type <openai|anthropic|openrouter|gemini|mistral|custom_openai_compatible> --default-model <model> --auth <env:KEY|clawdi://...|agent:codex/profile|none>`.
-- Validate metadata with `clawdi ai-provider validate [provider-id]`.
-- Check local auth availability with `clawdi ai-provider test <provider-id>`; add `--live` only when the user explicitly wants a real provider API probe.
-- Apply agent config with `clawdi ai-provider apply --engine codex|hermes|openclaw --dry-run` first, then run without `--dry-run` if the diff is acceptable.
-- Connect Codex OAuth with `clawdi ai-provider connect <provider-id> --tool codex`; use `--callback manual` when loopback localhost cannot be reached.
-- Materialize a stored provider auth profile with `clawdi ai-provider materialize-auth <provider-id>`.
+- Treat the local Provider Catalog as multi-record metadata. Do not activate it into local agent config; Core Hosted activation is supplied by the runtime manifest/controller, whose configured runtime binds exactly one provider and whose unmanaged runtime binds none.
+- Keep Codex OAuth ownership singular across Hosted runtimes. Hermes/OpenClaw native refresh, revoke, and ownership state belongs to Hosted convergence, not a local CLI materialization command.
 - Default export/import is metadata-only; `--include-secrets` requires passphrase-encrypted secret export.
 - BYOK model requests go directly from the agent runtime to the configured provider. Clawdi stores metadata and secret references but is not a model proxy.

package/skills/hosted-versions/1/clawdi/SKILL.md

@@ -1,11 +1,27 @@
 ---
 name: clawdi
-description: "Find and read the user's past agent sessions across Claude Code, Codex, OpenClaw, and Hermes; use connected-service tools such as Gmail, GitHub, Notion, Drive, and Calendar; and read Clawdi share URLs (https://cloud.clawdi.ai/s/...) the user pastes."
+description: "Use the user's account-wide long-term memory and past agent sessions; inspect the current Hosted Project and safe Vault metadata; use connected services such as Gmail, GitHub, Notion, Drive, and Calendar; and read Clawdi share URLs."
 ---
 
 # Clawdi Cloud
 
-Use Clawdi Cloud tools through the `clawdi` MCP server.
+Use Clawdi Cloud tools through the `clawdi` MCP server. Treat the live tool schemas as authoritative.
+
+## Memory
+
+Memory is shared across the user's Hosted agents, not isolated to the current agent.
+
+- `memory_search` — Search durable memory by natural-language query.
+- `memory_add` — Save a durable fact, preference, pattern, decision, or project context.
+- `memory_extract` — Prepare memories from the current conversation. Follow its returned
+  review-and-confirm instructions and wait for user approval before calling `memory_add`.
+
+Search before answering questions about the user's preferences, projects, prior decisions,
+recurring workflows, or earlier bugs. Save useful non-obvious outcomes and explicit
+"remember this" requests as standalone statements with enough context for another agent.
+
+Never store plaintext tokens, API keys, bearer credentials, or private keys in memory. Store
+secrets in Vault and remember only an exact `clawdi://` reference when useful.
 
 ## Sessions
 
@@ -16,6 +32,33 @@ Call `session_read` when the user provides a Clawdi share URL. When the user ref
 past conversation without a UUID, call `session_search` first and then read the matching
 session. Do not use a generic web fetcher for Clawdi share URLs.
 
+## Projects
+
+- `project_current` — Read the runtime-bound Project.
+- `project_list` — List Projects visible to the caller.
+- `project_get` — Read one visible Project by UUID.
+
+A Hosted runtime is restricted to its bound Project. Treat not-found as an access boundary
+as well as a possible unknown UUID; do not try to bypass it through another tool.
+
+## Vault Metadata
+
+- `vault_list` — List attached Vaults and key counts for visible Projects.
+- `vault_get` — List key names, provenance, and exact references for an attached Vault.
+
+Use `vault_resolve` only when the current task requires one referenced plaintext value. Pass
+the exact Project-scoped reference. Treat the result as sensitive: never echo it, save it to
+Memory, or include it in logs.
+
+The metadata tools never return plaintext secret values. Preserve exact references for
+`vault_resolve` or when passing them to an authorized runtime:
+
+- `clawdi://project/<project-id>/vault/<vault>/field/<field>`
+- `clawdi://project/<project-id>/vault/<vault>/section/<section>/field/<field>`
+
+Vault mutation is not an Agent MCP capability. Ask the user to manage Vault data through an
+authorized human-facing surface; never call raw HTTP or invent an unavailable tool.
+
 ## Connectors
 
 Use the Composio Tool Router meta-tools returned by `tools/list` on the `clawdi` MCP server.