clawsec 0.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (361) hide show
  1. package/README.md +560 -0
  2. package/dist/bin/clawsec.d.ts +7 -0
  3. package/dist/bin/clawsec.d.ts.map +1 -0
  4. package/dist/bin/clawsec.js +12 -0
  5. package/dist/bin/clawsec.js.map +1 -0
  6. package/dist/src/actions/block.d.ts +22 -0
  7. package/dist/src/actions/block.d.ts.map +1 -0
  8. package/dist/src/actions/block.js +83 -0
  9. package/dist/src/actions/block.js.map +1 -0
  10. package/dist/src/actions/confirm.d.ts +35 -0
  11. package/dist/src/actions/confirm.d.ts.map +1 -0
  12. package/dist/src/actions/confirm.js +156 -0
  13. package/dist/src/actions/confirm.js.map +1 -0
  14. package/dist/src/actions/executor.d.ts +64 -0
  15. package/dist/src/actions/executor.d.ts.map +1 -0
  16. package/dist/src/actions/executor.js +114 -0
  17. package/dist/src/actions/executor.js.map +1 -0
  18. package/dist/src/actions/index.d.ts +13 -0
  19. package/dist/src/actions/index.d.ts.map +1 -0
  20. package/dist/src/actions/index.js +15 -0
  21. package/dist/src/actions/index.js.map +1 -0
  22. package/dist/src/actions/log.d.ts +19 -0
  23. package/dist/src/actions/log.d.ts.map +1 -0
  24. package/dist/src/actions/log.js +63 -0
  25. package/dist/src/actions/log.js.map +1 -0
  26. package/dist/src/actions/types.d.ts +85 -0
  27. package/dist/src/actions/types.d.ts.map +1 -0
  28. package/dist/src/actions/types.js +78 -0
  29. package/dist/src/actions/types.js.map +1 -0
  30. package/dist/src/actions/warn.d.ts +22 -0
  31. package/dist/src/actions/warn.d.ts.map +1 -0
  32. package/dist/src/actions/warn.js +84 -0
  33. package/dist/src/actions/warn.js.map +1 -0
  34. package/dist/src/approval/agent-confirm.d.ts +104 -0
  35. package/dist/src/approval/agent-confirm.d.ts.map +1 -0
  36. package/dist/src/approval/agent-confirm.js +173 -0
  37. package/dist/src/approval/agent-confirm.js.map +1 -0
  38. package/dist/src/approval/index.d.ts +14 -0
  39. package/dist/src/approval/index.d.ts.map +1 -0
  40. package/dist/src/approval/index.js +9 -0
  41. package/dist/src/approval/index.js.map +1 -0
  42. package/dist/src/approval/native.d.ts +56 -0
  43. package/dist/src/approval/native.d.ts.map +1 -0
  44. package/dist/src/approval/native.js +196 -0
  45. package/dist/src/approval/native.js.map +1 -0
  46. package/dist/src/approval/store.d.ts +88 -0
  47. package/dist/src/approval/store.d.ts.map +1 -0
  48. package/dist/src/approval/store.js +192 -0
  49. package/dist/src/approval/store.js.map +1 -0
  50. package/dist/src/approval/types.d.ts +119 -0
  51. package/dist/src/approval/types.d.ts.map +1 -0
  52. package/dist/src/approval/types.js +6 -0
  53. package/dist/src/approval/types.js.map +1 -0
  54. package/dist/src/approval/webhook.d.ts +170 -0
  55. package/dist/src/approval/webhook.d.ts.map +1 -0
  56. package/dist/src/approval/webhook.js +362 -0
  57. package/dist/src/approval/webhook.js.map +1 -0
  58. package/dist/src/cli/commands/audit.d.ts +43 -0
  59. package/dist/src/cli/commands/audit.d.ts.map +1 -0
  60. package/dist/src/cli/commands/audit.js +115 -0
  61. package/dist/src/cli/commands/audit.js.map +1 -0
  62. package/dist/src/cli/commands/feedback.d.ts +27 -0
  63. package/dist/src/cli/commands/feedback.d.ts.map +1 -0
  64. package/dist/src/cli/commands/feedback.js +228 -0
  65. package/dist/src/cli/commands/feedback.js.map +1 -0
  66. package/dist/src/cli/commands/index.d.ts +11 -0
  67. package/dist/src/cli/commands/index.d.ts.map +1 -0
  68. package/dist/src/cli/commands/index.js +13 -0
  69. package/dist/src/cli/commands/index.js.map +1 -0
  70. package/dist/src/cli/commands/status.d.ts +20 -0
  71. package/dist/src/cli/commands/status.d.ts.map +1 -0
  72. package/dist/src/cli/commands/status.js +122 -0
  73. package/dist/src/cli/commands/status.js.map +1 -0
  74. package/dist/src/cli/commands/test.d.ts +23 -0
  75. package/dist/src/cli/commands/test.d.ts.map +1 -0
  76. package/dist/src/cli/commands/test.js +134 -0
  77. package/dist/src/cli/commands/test.js.map +1 -0
  78. package/dist/src/cli/commands/types.d.ts +81 -0
  79. package/dist/src/cli/commands/types.d.ts.map +1 -0
  80. package/dist/src/cli/commands/types.js +6 -0
  81. package/dist/src/cli/commands/types.js.map +1 -0
  82. package/dist/src/cli/index.d.ts +17 -0
  83. package/dist/src/cli/index.d.ts.map +1 -0
  84. package/dist/src/cli/index.js +267 -0
  85. package/dist/src/cli/index.js.map +1 -0
  86. package/dist/src/config/defaults.d.ts +20 -0
  87. package/dist/src/config/defaults.d.ts.map +1 -0
  88. package/dist/src/config/defaults.js +123 -0
  89. package/dist/src/config/defaults.js.map +1 -0
  90. package/dist/src/config/index.d.ts +8 -0
  91. package/dist/src/config/index.d.ts.map +1 -0
  92. package/dist/src/config/index.js +41 -0
  93. package/dist/src/config/index.js.map +1 -0
  94. package/dist/src/config/loader.d.ts +99 -0
  95. package/dist/src/config/loader.d.ts.map +1 -0
  96. package/dist/src/config/loader.js +242 -0
  97. package/dist/src/config/loader.js.map +1 -0
  98. package/dist/src/config/schema.d.ts +627 -0
  99. package/dist/src/config/schema.d.ts.map +1 -0
  100. package/dist/src/config/schema.js +585 -0
  101. package/dist/src/config/schema.js.map +1 -0
  102. package/dist/src/detectors/destructive/cloud-detector.d.ts +51 -0
  103. package/dist/src/detectors/destructive/cloud-detector.d.ts.map +1 -0
  104. package/dist/src/detectors/destructive/cloud-detector.js +556 -0
  105. package/dist/src/detectors/destructive/cloud-detector.js.map +1 -0
  106. package/dist/src/detectors/destructive/code-detector.d.ts +59 -0
  107. package/dist/src/detectors/destructive/code-detector.d.ts.map +1 -0
  108. package/dist/src/detectors/destructive/code-detector.js +558 -0
  109. package/dist/src/detectors/destructive/code-detector.js.map +1 -0
  110. package/dist/src/detectors/destructive/index.d.ts +54 -0
  111. package/dist/src/detectors/destructive/index.d.ts.map +1 -0
  112. package/dist/src/detectors/destructive/index.js +168 -0
  113. package/dist/src/detectors/destructive/index.js.map +1 -0
  114. package/dist/src/detectors/destructive/shell-detector.d.ts +43 -0
  115. package/dist/src/detectors/destructive/shell-detector.d.ts.map +1 -0
  116. package/dist/src/detectors/destructive/shell-detector.js +302 -0
  117. package/dist/src/detectors/destructive/shell-detector.js.map +1 -0
  118. package/dist/src/detectors/destructive/types.d.ts +143 -0
  119. package/dist/src/detectors/destructive/types.d.ts.map +1 -0
  120. package/dist/src/detectors/destructive/types.js +6 -0
  121. package/dist/src/detectors/destructive/types.js.map +1 -0
  122. package/dist/src/detectors/exfiltration/cloud-detector.d.ts +51 -0
  123. package/dist/src/detectors/exfiltration/cloud-detector.d.ts.map +1 -0
  124. package/dist/src/detectors/exfiltration/cloud-detector.js +427 -0
  125. package/dist/src/detectors/exfiltration/cloud-detector.js.map +1 -0
  126. package/dist/src/detectors/exfiltration/http-detector.d.ts +47 -0
  127. package/dist/src/detectors/exfiltration/http-detector.d.ts.map +1 -0
  128. package/dist/src/detectors/exfiltration/http-detector.js +429 -0
  129. package/dist/src/detectors/exfiltration/http-detector.js.map +1 -0
  130. package/dist/src/detectors/exfiltration/index.d.ts +44 -0
  131. package/dist/src/detectors/exfiltration/index.d.ts.map +1 -0
  132. package/dist/src/detectors/exfiltration/index.js +118 -0
  133. package/dist/src/detectors/exfiltration/index.js.map +1 -0
  134. package/dist/src/detectors/exfiltration/network-detector.d.ts +55 -0
  135. package/dist/src/detectors/exfiltration/network-detector.d.ts.map +1 -0
  136. package/dist/src/detectors/exfiltration/network-detector.js +504 -0
  137. package/dist/src/detectors/exfiltration/network-detector.js.map +1 -0
  138. package/dist/src/detectors/exfiltration/types.d.ts +139 -0
  139. package/dist/src/detectors/exfiltration/types.d.ts.map +1 -0
  140. package/dist/src/detectors/exfiltration/types.js +6 -0
  141. package/dist/src/detectors/exfiltration/types.js.map +1 -0
  142. package/dist/src/detectors/purchase/domain-detector.d.ts +44 -0
  143. package/dist/src/detectors/purchase/domain-detector.d.ts.map +1 -0
  144. package/dist/src/detectors/purchase/domain-detector.js +296 -0
  145. package/dist/src/detectors/purchase/domain-detector.js.map +1 -0
  146. package/dist/src/detectors/purchase/form-detector.d.ts +27 -0
  147. package/dist/src/detectors/purchase/form-detector.d.ts.map +1 -0
  148. package/dist/src/detectors/purchase/form-detector.js +344 -0
  149. package/dist/src/detectors/purchase/form-detector.js.map +1 -0
  150. package/dist/src/detectors/purchase/index.d.ts +65 -0
  151. package/dist/src/detectors/purchase/index.d.ts.map +1 -0
  152. package/dist/src/detectors/purchase/index.js +216 -0
  153. package/dist/src/detectors/purchase/index.js.map +1 -0
  154. package/dist/src/detectors/purchase/spend-tracker.d.ts +132 -0
  155. package/dist/src/detectors/purchase/spend-tracker.d.ts.map +1 -0
  156. package/dist/src/detectors/purchase/spend-tracker.js +313 -0
  157. package/dist/src/detectors/purchase/spend-tracker.js.map +1 -0
  158. package/dist/src/detectors/purchase/types.d.ts +139 -0
  159. package/dist/src/detectors/purchase/types.d.ts.map +1 -0
  160. package/dist/src/detectors/purchase/types.js +6 -0
  161. package/dist/src/detectors/purchase/types.js.map +1 -0
  162. package/dist/src/detectors/purchase/url-detector.d.ts +31 -0
  163. package/dist/src/detectors/purchase/url-detector.d.ts.map +1 -0
  164. package/dist/src/detectors/purchase/url-detector.js +292 -0
  165. package/dist/src/detectors/purchase/url-detector.js.map +1 -0
  166. package/dist/src/detectors/secrets/api-key-detector.d.ts +30 -0
  167. package/dist/src/detectors/secrets/api-key-detector.d.ts.map +1 -0
  168. package/dist/src/detectors/secrets/api-key-detector.js +297 -0
  169. package/dist/src/detectors/secrets/api-key-detector.js.map +1 -0
  170. package/dist/src/detectors/secrets/index.d.ts +43 -0
  171. package/dist/src/detectors/secrets/index.d.ts.map +1 -0
  172. package/dist/src/detectors/secrets/index.js +261 -0
  173. package/dist/src/detectors/secrets/index.js.map +1 -0
  174. package/dist/src/detectors/secrets/pii-detector.d.ts +54 -0
  175. package/dist/src/detectors/secrets/pii-detector.d.ts.map +1 -0
  176. package/dist/src/detectors/secrets/pii-detector.js +286 -0
  177. package/dist/src/detectors/secrets/pii-detector.js.map +1 -0
  178. package/dist/src/detectors/secrets/token-detector.d.ts +51 -0
  179. package/dist/src/detectors/secrets/token-detector.d.ts.map +1 -0
  180. package/dist/src/detectors/secrets/token-detector.js +233 -0
  181. package/dist/src/detectors/secrets/token-detector.js.map +1 -0
  182. package/dist/src/detectors/secrets/types.d.ts +157 -0
  183. package/dist/src/detectors/secrets/types.d.ts.map +1 -0
  184. package/dist/src/detectors/secrets/types.js +6 -0
  185. package/dist/src/detectors/secrets/types.js.map +1 -0
  186. package/dist/src/detectors/website/category-detector.d.ts +22 -0
  187. package/dist/src/detectors/website/category-detector.d.ts.map +1 -0
  188. package/dist/src/detectors/website/category-detector.js +162 -0
  189. package/dist/src/detectors/website/category-detector.js.map +1 -0
  190. package/dist/src/detectors/website/index.d.ts +53 -0
  191. package/dist/src/detectors/website/index.d.ts.map +1 -0
  192. package/dist/src/detectors/website/index.js +232 -0
  193. package/dist/src/detectors/website/index.js.map +1 -0
  194. package/dist/src/detectors/website/pattern-matcher.d.ts +33 -0
  195. package/dist/src/detectors/website/pattern-matcher.d.ts.map +1 -0
  196. package/dist/src/detectors/website/pattern-matcher.js +121 -0
  197. package/dist/src/detectors/website/pattern-matcher.js.map +1 -0
  198. package/dist/src/detectors/website/types.d.ts +105 -0
  199. package/dist/src/detectors/website/types.d.ts.map +1 -0
  200. package/dist/src/detectors/website/types.js +6 -0
  201. package/dist/src/detectors/website/types.js.map +1 -0
  202. package/dist/src/engine/analyzer.d.ts +87 -0
  203. package/dist/src/engine/analyzer.d.ts.map +1 -0
  204. package/dist/src/engine/analyzer.js +427 -0
  205. package/dist/src/engine/analyzer.js.map +1 -0
  206. package/dist/src/engine/cache.d.ts +80 -0
  207. package/dist/src/engine/cache.d.ts.map +1 -0
  208. package/dist/src/engine/cache.js +167 -0
  209. package/dist/src/engine/cache.js.map +1 -0
  210. package/dist/src/engine/index.d.ts +11 -0
  211. package/dist/src/engine/index.d.ts.map +1 -0
  212. package/dist/src/engine/index.js +11 -0
  213. package/dist/src/engine/index.js.map +1 -0
  214. package/dist/src/engine/llm-client.d.ts +210 -0
  215. package/dist/src/engine/llm-client.d.ts.map +1 -0
  216. package/dist/src/engine/llm-client.js +506 -0
  217. package/dist/src/engine/llm-client.js.map +1 -0
  218. package/dist/src/engine/types.d.ts +163 -0
  219. package/dist/src/engine/types.d.ts.map +1 -0
  220. package/dist/src/engine/types.js +21 -0
  221. package/dist/src/engine/types.js.map +1 -0
  222. package/dist/src/feedback/index.d.ts +9 -0
  223. package/dist/src/feedback/index.d.ts.map +1 -0
  224. package/dist/src/feedback/index.js +8 -0
  225. package/dist/src/feedback/index.js.map +1 -0
  226. package/dist/src/feedback/learner.d.ts +222 -0
  227. package/dist/src/feedback/learner.d.ts.map +1 -0
  228. package/dist/src/feedback/learner.js +401 -0
  229. package/dist/src/feedback/learner.js.map +1 -0
  230. package/dist/src/feedback/store.d.ts +113 -0
  231. package/dist/src/feedback/store.d.ts.map +1 -0
  232. package/dist/src/feedback/store.js +228 -0
  233. package/dist/src/feedback/store.js.map +1 -0
  234. package/dist/src/feedback/types.d.ts +126 -0
  235. package/dist/src/feedback/types.d.ts.map +1 -0
  236. package/dist/src/feedback/types.js +6 -0
  237. package/dist/src/feedback/types.js.map +1 -0
  238. package/dist/src/hooks/before-agent-start/handler.d.ts +37 -0
  239. package/dist/src/hooks/before-agent-start/handler.d.ts.map +1 -0
  240. package/dist/src/hooks/before-agent-start/handler.js +109 -0
  241. package/dist/src/hooks/before-agent-start/handler.js.map +1 -0
  242. package/dist/src/hooks/before-agent-start/index.d.ts +8 -0
  243. package/dist/src/hooks/before-agent-start/index.d.ts.map +1 -0
  244. package/dist/src/hooks/before-agent-start/index.js +7 -0
  245. package/dist/src/hooks/before-agent-start/index.js.map +1 -0
  246. package/dist/src/hooks/before-agent-start/prompts.d.ts +48 -0
  247. package/dist/src/hooks/before-agent-start/prompts.d.ts.map +1 -0
  248. package/dist/src/hooks/before-agent-start/prompts.js +103 -0
  249. package/dist/src/hooks/before-agent-start/prompts.js.map +1 -0
  250. package/dist/src/hooks/before-tool-call/handler.d.ts +42 -0
  251. package/dist/src/hooks/before-tool-call/handler.d.ts.map +1 -0
  252. package/dist/src/hooks/before-tool-call/handler.js +226 -0
  253. package/dist/src/hooks/before-tool-call/handler.js.map +1 -0
  254. package/dist/src/hooks/before-tool-call/index.d.ts +7 -0
  255. package/dist/src/hooks/before-tool-call/index.d.ts.map +1 -0
  256. package/dist/src/hooks/before-tool-call/index.js +6 -0
  257. package/dist/src/hooks/before-tool-call/index.js.map +1 -0
  258. package/dist/src/hooks/tool-result-persist/filter.d.ts +72 -0
  259. package/dist/src/hooks/tool-result-persist/filter.d.ts.map +1 -0
  260. package/dist/src/hooks/tool-result-persist/filter.js +305 -0
  261. package/dist/src/hooks/tool-result-persist/filter.js.map +1 -0
  262. package/dist/src/hooks/tool-result-persist/handler.d.ts +49 -0
  263. package/dist/src/hooks/tool-result-persist/handler.d.ts.map +1 -0
  264. package/dist/src/hooks/tool-result-persist/handler.js +217 -0
  265. package/dist/src/hooks/tool-result-persist/handler.js.map +1 -0
  266. package/dist/src/hooks/tool-result-persist/index.d.ts +11 -0
  267. package/dist/src/hooks/tool-result-persist/index.d.ts.map +1 -0
  268. package/dist/src/hooks/tool-result-persist/index.js +11 -0
  269. package/dist/src/hooks/tool-result-persist/index.js.map +1 -0
  270. package/dist/src/index.d.ts +256 -0
  271. package/dist/src/index.d.ts.map +1 -0
  272. package/dist/src/index.js +222 -0
  273. package/dist/src/index.js.map +1 -0
  274. package/dist/src/notifications/discord.d.ts +10 -0
  275. package/dist/src/notifications/discord.d.ts.map +1 -0
  276. package/dist/src/notifications/discord.js +218 -0
  277. package/dist/src/notifications/discord.js.map +1 -0
  278. package/dist/src/notifications/index.d.ts +37 -0
  279. package/dist/src/notifications/index.d.ts.map +1 -0
  280. package/dist/src/notifications/index.js +68 -0
  281. package/dist/src/notifications/index.js.map +1 -0
  282. package/dist/src/notifications/slack.d.ts +10 -0
  283. package/dist/src/notifications/slack.d.ts.map +1 -0
  284. package/dist/src/notifications/slack.js +218 -0
  285. package/dist/src/notifications/slack.js.map +1 -0
  286. package/dist/src/notifications/telegram.d.ts +10 -0
  287. package/dist/src/notifications/telegram.d.ts.map +1 -0
  288. package/dist/src/notifications/telegram.js +242 -0
  289. package/dist/src/notifications/telegram.js.map +1 -0
  290. package/dist/src/notifications/types.d.ts +119 -0
  291. package/dist/src/notifications/types.d.ts.map +1 -0
  292. package/dist/src/notifications/types.js +6 -0
  293. package/dist/src/notifications/types.js.map +1 -0
  294. package/dist/src/proxy/index.d.ts +8 -0
  295. package/dist/src/proxy/index.d.ts.map +1 -0
  296. package/dist/src/proxy/index.js +9 -0
  297. package/dist/src/proxy/index.js.map +1 -0
  298. package/dist/src/proxy/middleware.d.ts +55 -0
  299. package/dist/src/proxy/middleware.d.ts.map +1 -0
  300. package/dist/src/proxy/middleware.js +215 -0
  301. package/dist/src/proxy/middleware.js.map +1 -0
  302. package/dist/src/proxy/server.d.ts +57 -0
  303. package/dist/src/proxy/server.d.ts.map +1 -0
  304. package/dist/src/proxy/server.js +298 -0
  305. package/dist/src/proxy/server.js.map +1 -0
  306. package/dist/src/proxy/types.d.ts +136 -0
  307. package/dist/src/proxy/types.d.ts.map +1 -0
  308. package/dist/src/proxy/types.js +6 -0
  309. package/dist/src/proxy/types.js.map +1 -0
  310. package/dist/src/sanitization/index.d.ts +10 -0
  311. package/dist/src/sanitization/index.d.ts.map +1 -0
  312. package/dist/src/sanitization/index.js +9 -0
  313. package/dist/src/sanitization/index.js.map +1 -0
  314. package/dist/src/sanitization/patterns.d.ts +51 -0
  315. package/dist/src/sanitization/patterns.d.ts.map +1 -0
  316. package/dist/src/sanitization/patterns.js +266 -0
  317. package/dist/src/sanitization/patterns.js.map +1 -0
  318. package/dist/src/sanitization/scanner.d.ts +29 -0
  319. package/dist/src/sanitization/scanner.d.ts.map +1 -0
  320. package/dist/src/sanitization/scanner.js +328 -0
  321. package/dist/src/sanitization/scanner.js.map +1 -0
  322. package/dist/src/sanitization/types.d.ts +57 -0
  323. package/dist/src/sanitization/types.d.ts.map +1 -0
  324. package/dist/src/sanitization/types.js +5 -0
  325. package/dist/src/sanitization/types.js.map +1 -0
  326. package/openclaw.plugin.json +114 -0
  327. package/package.json +63 -0
  328. package/rules/builtin/README.md +139 -0
  329. package/rules/builtin/ai-services.yaml +70 -0
  330. package/rules/builtin/api-keys.yaml +64 -0
  331. package/rules/builtin/authentication.yaml +56 -0
  332. package/rules/builtin/aws-security.yaml +57 -0
  333. package/rules/builtin/azure-security.yaml +58 -0
  334. package/rules/builtin/cicd-security.yaml +64 -0
  335. package/rules/builtin/cloud-storage.yaml +64 -0
  336. package/rules/builtin/container-registry.yaml +55 -0
  337. package/rules/builtin/crypto-wallets.yaml +71 -0
  338. package/rules/builtin/database-nosql.yaml +58 -0
  339. package/rules/builtin/database-sql.yaml +62 -0
  340. package/rules/builtin/development-env.yaml +67 -0
  341. package/rules/builtin/docker.yaml +57 -0
  342. package/rules/builtin/filesystem.yaml +71 -0
  343. package/rules/builtin/financial-pci.yaml +61 -0
  344. package/rules/builtin/gcp-security.yaml +57 -0
  345. package/rules/builtin/git-operations.yaml +68 -0
  346. package/rules/builtin/healthcare-hipaa.yaml +64 -0
  347. package/rules/builtin/kubernetes.yaml +60 -0
  348. package/rules/builtin/messaging-services.yaml +53 -0
  349. package/rules/builtin/minimal.yaml +47 -0
  350. package/rules/builtin/mobile-development.yaml +61 -0
  351. package/rules/builtin/monitoring.yaml +63 -0
  352. package/rules/builtin/network-security.yaml +57 -0
  353. package/rules/builtin/package-managers.yaml +74 -0
  354. package/rules/builtin/payment-processing.yaml +66 -0
  355. package/rules/builtin/pii-protection.yaml +48 -0
  356. package/rules/builtin/production-strict.yaml +55 -0
  357. package/rules/builtin/secrets-management.yaml +63 -0
  358. package/rules/builtin/serverless.yaml +74 -0
  359. package/rules/builtin/ssh-security.yaml +66 -0
  360. package/rules/builtin/terraform.yaml +51 -0
  361. package/rules/builtin/web-security.yaml +62 -0
@@ -0,0 +1,256 @@
1
+ /**
2
+ * Clawsec - Security plugin for OpenClaw.ai
3
+ * Prevents AI agents from taking dangerous actions
4
+ */
5
+ export declare const VERSION = "0.0.1";
6
+ export declare const PLUGIN_ID = "clawsec";
7
+ export declare const PLUGIN_NAME = "Clawsec Security Plugin";
8
+ /**
9
+ * Severity levels for security detections
10
+ */
11
+ export type Severity = 'critical' | 'high' | 'medium' | 'low';
12
+ /**
13
+ * Actions that can be taken when a threat is detected
14
+ */
15
+ export type Action = 'block' | 'confirm' | 'agent-confirm' | 'warn' | 'log';
16
+ /**
17
+ * Categories of security threats
18
+ */
19
+ export type ThreatCategory = 'purchase' | 'website' | 'destructive' | 'secrets' | 'exfiltration';
20
+ /**
21
+ * Base context provided to all hooks
22
+ */
23
+ export interface HookContext {
24
+ sessionId: string;
25
+ userId?: string;
26
+ timestamp: number;
27
+ }
28
+ /**
29
+ * Tool call information passed to before-tool-call hook
30
+ */
31
+ export interface ToolCallContext extends HookContext {
32
+ toolName: string;
33
+ toolInput: Record<string, unknown>;
34
+ conversationHistory?: Array<{
35
+ role: 'user' | 'assistant';
36
+ content: string;
37
+ }>;
38
+ }
39
+ /**
40
+ * Result from before-tool-call hook
41
+ */
42
+ export interface BeforeToolCallResult {
43
+ /** Whether to allow the tool call to proceed */
44
+ allow: boolean;
45
+ /** Modified tool input (if transformed) */
46
+ modifiedInput?: Record<string, unknown>;
47
+ /** Message to display when blocked */
48
+ blockMessage?: string;
49
+ /** Metadata about the detection */
50
+ metadata?: {
51
+ category?: ThreatCategory;
52
+ severity?: Severity;
53
+ rule?: string;
54
+ reason?: string;
55
+ };
56
+ }
57
+ /**
58
+ * Handler type for before-tool-call hook
59
+ */
60
+ export type BeforeToolCallHandler = (context: ToolCallContext) => Promise<BeforeToolCallResult>;
61
+ /**
62
+ * Agent start context passed to before-agent-start hook
63
+ */
64
+ export interface AgentStartContext extends HookContext {
65
+ systemPrompt?: string;
66
+ agentConfig?: Record<string, unknown>;
67
+ }
68
+ /**
69
+ * Result from before-agent-start hook
70
+ */
71
+ export interface BeforeAgentStartResult {
72
+ /** Modified or injected system prompt content */
73
+ systemPromptAddition?: string;
74
+ /** Modified agent configuration */
75
+ modifiedConfig?: Record<string, unknown>;
76
+ }
77
+ /**
78
+ * Handler type for before-agent-start hook
79
+ */
80
+ export type BeforeAgentStartHandler = (context: AgentStartContext) => Promise<BeforeAgentStartResult>;
81
+ /**
82
+ * Tool result context passed to tool-result-persist hook
83
+ */
84
+ export interface ToolResultContext extends HookContext {
85
+ toolName: string;
86
+ toolInput: Record<string, unknown>;
87
+ toolOutput: unknown;
88
+ }
89
+ /**
90
+ * Result from tool-result-persist hook
91
+ */
92
+ export interface ToolResultPersistResult {
93
+ /** Whether to allow the result to be persisted */
94
+ allow: boolean;
95
+ /** Filtered/redacted output */
96
+ filteredOutput?: unknown;
97
+ /** Metadata about any redactions */
98
+ redactions?: Array<{
99
+ type: string;
100
+ description: string;
101
+ }>;
102
+ }
103
+ /**
104
+ * Handler type for tool-result-persist hook
105
+ */
106
+ export type ToolResultPersistHandler = (context: ToolResultContext) => Promise<ToolResultPersistResult>;
107
+ /**
108
+ * OpenClaw plugin API interface
109
+ */
110
+ export interface OpenClawPluginAPI {
111
+ /** Register a hook handler */
112
+ registerHook: (hookName: string, handler: unknown, options?: HookOptions) => void;
113
+ /** Unregister a hook handler */
114
+ unregisterHook: (hookName: string, handlerId: string) => void;
115
+ /** Get plugin configuration */
116
+ getConfig: () => PluginConfig;
117
+ /** Log a message */
118
+ log: (level: 'debug' | 'info' | 'warn' | 'error', message: string, data?: unknown) => void;
119
+ /** Request user approval */
120
+ requestApproval: (request: ApprovalRequest) => Promise<ApprovalResponse>;
121
+ }
122
+ /**
123
+ * Hook registration options
124
+ */
125
+ export interface HookOptions {
126
+ /** Unique identifier for this handler */
127
+ id?: string;
128
+ /** Priority (lower runs first) */
129
+ priority?: number;
130
+ /** Whether this hook is enabled */
131
+ enabled?: boolean;
132
+ }
133
+ /**
134
+ * Plugin configuration from OpenClaw
135
+ */
136
+ export interface PluginConfig {
137
+ /** Path to clawsec.yaml config file */
138
+ configPath?: string;
139
+ /** Whether the plugin is enabled */
140
+ enabled?: boolean;
141
+ /** Log level */
142
+ logLevel?: 'debug' | 'info' | 'warn' | 'error';
143
+ }
144
+ /**
145
+ * Approval request structure
146
+ */
147
+ export interface ApprovalRequest {
148
+ id: string;
149
+ category: ThreatCategory;
150
+ severity: Severity;
151
+ reason: string;
152
+ toolName: string;
153
+ toolInput: Record<string, unknown>;
154
+ timeout?: number;
155
+ }
156
+ /**
157
+ * Approval response structure
158
+ */
159
+ export interface ApprovalResponse {
160
+ approved: boolean;
161
+ approvedBy?: string;
162
+ timestamp: number;
163
+ }
164
+ interface PluginState {
165
+ api: OpenClawPluginAPI | null;
166
+ config: PluginConfig | null;
167
+ initialized: boolean;
168
+ handlers: {
169
+ beforeToolCall: BeforeToolCallHandler | null;
170
+ beforeAgentStart: BeforeAgentStartHandler | null;
171
+ toolResultPersist: ToolResultPersistHandler | null;
172
+ };
173
+ }
174
+ /**
175
+ * Activates the Clawsec security plugin and registers all hooks.
176
+ *
177
+ * @param api - The OpenClaw plugin API
178
+ * @returns Cleanup function to deactivate the plugin
179
+ */
180
+ export declare function activate(api: OpenClawPluginAPI): () => void;
181
+ /**
182
+ * Deactivates the Clawsec security plugin and unregisters all hooks.
183
+ */
184
+ export declare function deactivate(): void;
185
+ /**
186
+ * Check if the plugin is currently active
187
+ */
188
+ export declare function isActive(): boolean;
189
+ /**
190
+ * Get the current plugin state (for testing/debugging)
191
+ */
192
+ export declare function getState(): Readonly<PluginState>;
193
+ /**
194
+ * JSON Schema for plugin configuration (matches openclaw.plugin.json)
195
+ */
196
+ export declare const pluginConfigSchema: {
197
+ readonly type: "object";
198
+ readonly properties: {
199
+ readonly configPath: {
200
+ readonly type: "string";
201
+ readonly default: "./clawsec.yaml";
202
+ readonly description: "Path to the Clawsec YAML configuration file";
203
+ };
204
+ readonly enabled: {
205
+ readonly type: "boolean";
206
+ readonly default: true;
207
+ readonly description: "Whether the security plugin is enabled";
208
+ };
209
+ readonly logLevel: {
210
+ readonly type: "string";
211
+ readonly enum: readonly ["debug", "info", "warn", "error"];
212
+ readonly default: "info";
213
+ readonly description: "Logging verbosity level";
214
+ };
215
+ };
216
+ readonly additionalProperties: false;
217
+ };
218
+ /**
219
+ * Register method for OpenClaw plugin system.
220
+ * This is the entry point called by OpenClaw when loading the plugin.
221
+ *
222
+ * @param api - The OpenClaw plugin API
223
+ */
224
+ declare function register(api: OpenClawPluginAPI): void;
225
+ declare const _default: {
226
+ id: string;
227
+ name: string;
228
+ version: string;
229
+ configSchema: {
230
+ readonly type: "object";
231
+ readonly properties: {
232
+ readonly configPath: {
233
+ readonly type: "string";
234
+ readonly default: "./clawsec.yaml";
235
+ readonly description: "Path to the Clawsec YAML configuration file";
236
+ };
237
+ readonly enabled: {
238
+ readonly type: "boolean";
239
+ readonly default: true;
240
+ readonly description: "Whether the security plugin is enabled";
241
+ };
242
+ readonly logLevel: {
243
+ readonly type: "string";
244
+ readonly enum: readonly ["debug", "info", "warn", "error"];
245
+ readonly default: "info";
246
+ readonly description: "Logging verbosity level";
247
+ };
248
+ };
249
+ readonly additionalProperties: false;
250
+ };
251
+ register: typeof register;
252
+ activate: typeof activate;
253
+ deactivate: typeof deactivate;
254
+ };
255
+ export default _default;
256
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,eAAO,MAAM,OAAO,UAAU,CAAC;AAC/B,eAAO,MAAM,SAAS,YAAY,CAAC;AACnC,eAAO,MAAM,WAAW,4BAA4B,CAAC;AAMrD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D;;GAEG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,MAAM,GAAG,KAAK,CAAC;AAE5E;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,cAAc,CAAC;AAEjG;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,mBAAmB,CAAC,EAAE,KAAK,CAAC;QAC1B,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,gDAAgD;IAChD,KAAK,EAAE,OAAO,CAAC;IACf,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mCAAmC;IACnC,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,cAAc,CAAC;QAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,eAAe,KACrB,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAEnC;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mCAAmC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,CACpC,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,kDAAkD;IAClD,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oCAAoC;IACpC,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAEtC;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,IAAI,CAAC;IAClF,gCAAgC;IAChC,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9D,+BAA+B;IAC/B,SAAS,EAAE,MAAM,YAAY,CAAC;IAC9B,oBAAoB;IACpB,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3F,4BAA4B;IAC5B,eAAe,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC1E;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB;IAChB,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,UAAU,WAAW;IACnB,GAAG,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE;QACR,cAAc,EAAE,qBAAqB,GAAG,IAAI,CAAC;QAC7C,gBAAgB,EAAE,uBAAuB,GAAG,IAAI,CAAC;QACjD,iBAAiB,EAAE,wBAAwB,GAAG,IAAI,CAAC;KACpD,CAAC;CACH;AA6FD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAgD3D;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,IAAI,CAwBjC;AAED;;GAEG;AACH,wBAAgB,QAAQ,IAAI,OAAO,CAElC;AAED;;GAEG;AACH,wBAAgB,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,CAEhD;AAMD;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;CAqBrB,CAAC;AAMX;;;;;GAKG;AACH,iBAAS,QAAQ,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,CAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOD,wBASE"}
@@ -0,0 +1,222 @@
1
+ /**
2
+ * Clawsec - Security plugin for OpenClaw.ai
3
+ * Prevents AI agents from taking dangerous actions
4
+ */
5
+ // =============================================================================
6
+ // VERSION & CONSTANTS
7
+ // =============================================================================
8
+ export const VERSION = '0.0.1';
9
+ export const PLUGIN_ID = 'clawsec';
10
+ export const PLUGIN_NAME = 'Clawsec Security Plugin';
11
+ const state = {
12
+ api: null,
13
+ config: null,
14
+ initialized: false,
15
+ handlers: {
16
+ beforeToolCall: null,
17
+ beforeAgentStart: null,
18
+ toolResultPersist: null,
19
+ },
20
+ };
21
+ // =============================================================================
22
+ // PLACEHOLDER HOOK HANDLERS
23
+ // =============================================================================
24
+ /**
25
+ * Placeholder handler for before-tool-call hook.
26
+ * Will be replaced with full implementation in Task 2.x
27
+ */
28
+ const beforeToolCallHandler = async (context) => {
29
+ // Log for debugging during development
30
+ if (state.api && state.config?.logLevel === 'debug') {
31
+ state.api.log('debug', `[clawsec] before-tool-call: ${context.toolName}`, {
32
+ sessionId: context.sessionId,
33
+ toolInput: context.toolInput,
34
+ });
35
+ }
36
+ // Placeholder: Allow all tool calls
37
+ // TODO: Implement actual detection logic in Task 2.x
38
+ return {
39
+ allow: true,
40
+ };
41
+ };
42
+ /**
43
+ * Placeholder handler for before-agent-start hook.
44
+ * Will be replaced with full implementation in Task 2.x
45
+ */
46
+ const beforeAgentStartHandler = async (context) => {
47
+ // Log for debugging during development
48
+ if (state.api && state.config?.logLevel === 'debug') {
49
+ state.api.log('debug', '[clawsec] before-agent-start', {
50
+ sessionId: context.sessionId,
51
+ });
52
+ }
53
+ // Placeholder: Inject basic security reminder into system prompt
54
+ // TODO: Implement configurable prompts in Task 2.x
55
+ const securityReminder = `
56
+ [CLAWSEC SECURITY CONTEXT]
57
+ This session is protected by Clawsec security plugin.
58
+ - Purchases and financial transactions require approval
59
+ - Destructive commands (rm -rf, DROP TABLE, etc.) are monitored
60
+ - Sensitive data in outputs may be filtered
61
+ `;
62
+ return {
63
+ systemPromptAddition: securityReminder,
64
+ };
65
+ };
66
+ /**
67
+ * Placeholder handler for tool-result-persist hook.
68
+ * Will be replaced with full implementation in Task 2.x
69
+ */
70
+ const toolResultPersistHandler = async (context) => {
71
+ // Log for debugging during development
72
+ if (state.api && state.config?.logLevel === 'debug') {
73
+ state.api.log('debug', `[clawsec] tool-result-persist: ${context.toolName}`, {
74
+ sessionId: context.sessionId,
75
+ });
76
+ }
77
+ // Placeholder: Allow all results to persist
78
+ // TODO: Implement actual filtering logic in Task 2.x
79
+ return {
80
+ allow: true,
81
+ };
82
+ };
83
+ // =============================================================================
84
+ // PLUGIN LIFECYCLE
85
+ // =============================================================================
86
+ /**
87
+ * Activates the Clawsec security plugin and registers all hooks.
88
+ *
89
+ * @param api - The OpenClaw plugin API
90
+ * @returns Cleanup function to deactivate the plugin
91
+ */
92
+ export function activate(api) {
93
+ if (state.initialized) {
94
+ api.log('warn', '[clawsec] Plugin already activated, skipping');
95
+ return () => deactivate();
96
+ }
97
+ // Store API reference and config
98
+ state.api = api;
99
+ state.config = api.getConfig();
100
+ api.log('info', `[clawsec] Activating Clawsec Security Plugin v${VERSION}`);
101
+ // Check if plugin is enabled
102
+ if (state.config?.enabled === false) {
103
+ api.log('info', '[clawsec] Plugin is disabled via configuration');
104
+ state.initialized = true;
105
+ return () => deactivate();
106
+ }
107
+ // Store handler references
108
+ state.handlers.beforeToolCall = beforeToolCallHandler;
109
+ state.handlers.beforeAgentStart = beforeAgentStartHandler;
110
+ state.handlers.toolResultPersist = toolResultPersistHandler;
111
+ // Register hooks with OpenClaw
112
+ api.registerHook('before-tool-call', beforeToolCallHandler, {
113
+ id: 'clawsec-before-tool-call',
114
+ priority: 100,
115
+ enabled: true,
116
+ });
117
+ api.registerHook('before-agent-start', beforeAgentStartHandler, {
118
+ id: 'clawsec-before-agent-start',
119
+ priority: 50,
120
+ enabled: true,
121
+ });
122
+ api.registerHook('tool-result-persist', toolResultPersistHandler, {
123
+ id: 'clawsec-tool-result-persist',
124
+ priority: 100,
125
+ enabled: true,
126
+ });
127
+ state.initialized = true;
128
+ api.log('info', '[clawsec] All hooks registered successfully');
129
+ // Return cleanup function
130
+ return () => deactivate();
131
+ }
132
+ /**
133
+ * Deactivates the Clawsec security plugin and unregisters all hooks.
134
+ */
135
+ export function deactivate() {
136
+ if (!state.initialized) {
137
+ return;
138
+ }
139
+ const api = state.api;
140
+ if (api) {
141
+ api.log('info', '[clawsec] Deactivating Clawsec Security Plugin');
142
+ // Unregister all hooks
143
+ api.unregisterHook('before-tool-call', 'clawsec-before-tool-call');
144
+ api.unregisterHook('before-agent-start', 'clawsec-before-agent-start');
145
+ api.unregisterHook('tool-result-persist', 'clawsec-tool-result-persist');
146
+ api.log('info', '[clawsec] All hooks unregistered');
147
+ }
148
+ // Reset state
149
+ state.api = null;
150
+ state.config = null;
151
+ state.initialized = false;
152
+ state.handlers.beforeToolCall = null;
153
+ state.handlers.beforeAgentStart = null;
154
+ state.handlers.toolResultPersist = null;
155
+ }
156
+ /**
157
+ * Check if the plugin is currently active
158
+ */
159
+ export function isActive() {
160
+ return state.initialized;
161
+ }
162
+ /**
163
+ * Get the current plugin state (for testing/debugging)
164
+ */
165
+ export function getState() {
166
+ return { ...state };
167
+ }
168
+ // =============================================================================
169
+ // CONFIG SCHEMA
170
+ // =============================================================================
171
+ /**
172
+ * JSON Schema for plugin configuration (matches openclaw.plugin.json)
173
+ */
174
+ export const pluginConfigSchema = {
175
+ type: 'object',
176
+ properties: {
177
+ configPath: {
178
+ type: 'string',
179
+ default: './clawsec.yaml',
180
+ description: 'Path to the Clawsec YAML configuration file',
181
+ },
182
+ enabled: {
183
+ type: 'boolean',
184
+ default: true,
185
+ description: 'Whether the security plugin is enabled',
186
+ },
187
+ logLevel: {
188
+ type: 'string',
189
+ enum: ['debug', 'info', 'warn', 'error'],
190
+ default: 'info',
191
+ description: 'Logging verbosity level',
192
+ },
193
+ },
194
+ additionalProperties: false,
195
+ };
196
+ // =============================================================================
197
+ // REGISTER METHOD (OpenClaw Plugin API)
198
+ // =============================================================================
199
+ /**
200
+ * Register method for OpenClaw plugin system.
201
+ * This is the entry point called by OpenClaw when loading the plugin.
202
+ *
203
+ * @param api - The OpenClaw plugin API
204
+ */
205
+ function register(api) {
206
+ activate(api);
207
+ }
208
+ // =============================================================================
209
+ // DEFAULT EXPORT
210
+ // =============================================================================
211
+ // Default export for OpenClaw plugin system
212
+ export default {
213
+ id: PLUGIN_ID,
214
+ name: PLUGIN_NAME,
215
+ version: VERSION,
216
+ configSchema: pluginConfigSchema,
217
+ register,
218
+ // Keep for backward compatibility
219
+ activate,
220
+ deactivate,
221
+ };
222
+ //# sourceMappingURL=index.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAC/B,MAAM,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC;AACnC,MAAM,CAAC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAyMrD,MAAM,KAAK,GAAgB;IACzB,GAAG,EAAE,IAAI;IACT,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,KAAK;IAClB,QAAQ,EAAE;QACR,cAAc,EAAE,IAAI;QACpB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,IAAI;KACxB;CACF,CAAC;AAEF,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,qBAAqB,GAA0B,KAAK,EACxD,OAAwB,EACO,EAAE;IACjC,uCAAuC;IACvC,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,+BAA+B,OAAO,CAAC,QAAQ,EAAE,EAAE;YACxE,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,oCAAoC;IACpC,qDAAqD;IACrD,OAAO;QACL,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,uBAAuB,GAA4B,KAAK,EAC5D,OAA0B,EACO,EAAE;IACnC,uCAAuC;IACvC,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,8BAA8B,EAAE;YACrD,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,mDAAmD;IACnD,MAAM,gBAAgB,GAAG;;;;;;CAM1B,CAAC;IAEA,OAAO;QACL,oBAAoB,EAAE,gBAAgB;KACvC,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,wBAAwB,GAA6B,KAAK,EAC9D,OAA0B,EACQ,EAAE;IACpC,uCAAuC;IACvC,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,kCAAkC,OAAO,CAAC,QAAQ,EAAE,EAAE;YAC3E,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,qDAAqD;IACrD,OAAO;QACL,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC,CAAC;AAEF,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAsB;IAC7C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,8CAA8C,CAAC,CAAC;QAChE,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;IAED,iCAAiC;IACjC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;IAChB,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;IAE/B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,iDAAiD,OAAO,EAAE,CAAC,CAAC;IAE5E,6BAA6B;IAC7B,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;QAClE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;QACzB,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;IAED,2BAA2B;IAC3B,KAAK,CAAC,QAAQ,CAAC,cAAc,GAAG,qBAAqB,CAAC;IACtD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,GAAG,uBAAuB,CAAC;IAC1D,KAAK,CAAC,QAAQ,CAAC,iBAAiB,GAAG,wBAAwB,CAAC;IAE5D,+BAA+B;IAC/B,GAAG,CAAC,YAAY,CAAC,kBAAkB,EAAE,qBAAqB,EAAE;QAC1D,EAAE,EAAE,0BAA0B;QAC9B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,GAAG,CAAC,YAAY,CAAC,oBAAoB,EAAE,uBAAuB,EAAE;QAC9D,EAAE,EAAE,4BAA4B;QAChC,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,GAAG,CAAC,YAAY,CAAC,qBAAqB,EAAE,wBAAwB,EAAE;QAChE,EAAE,EAAE,6BAA6B;QACjC,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;IACzB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAC;IAE/D,0BAA0B;IAC1B,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,GAAG,EAAE,CAAC;QACR,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;QAElE,uBAAuB;QACvB,GAAG,CAAC,cAAc,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC;QACnE,GAAG,CAAC,cAAc,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,CAAC;QACvE,GAAG,CAAC,cAAc,CAAC,qBAAqB,EAAE,6BAA6B,CAAC,CAAC;QAEzE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,cAAc;IACd,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;IACjB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC;IAC1B,KAAK,CAAC,QAAQ,CAAC,cAAc,GAAG,IAAI,CAAC;IACrC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,GAAG,IAAI,CAAC;IACvC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,GAAG,IAAI,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ;IACtB,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ;IACtB,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,6CAA6C;SAC3D;QACD,OAAO,EAAE;YACP,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,wCAAwC;SACtD;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;YACxC,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,yBAAyB;SACvC;KACF;IACD,oBAAoB,EAAE,KAAK;CACnB,CAAC;AAEX,gFAAgF;AAChF,wCAAwC;AACxC,gFAAgF;AAEhF;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,GAAsB;IACtC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,4CAA4C;AAC5C,eAAe;IACb,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,OAAO;IAChB,YAAY,EAAE,kBAAkB;IAChC,QAAQ;IACR,kCAAkC;IAClC,QAAQ;IACR,UAAU;CACX,CAAC"}
@@ -0,0 +1,10 @@
1
+ /**
2
+ * Discord Notification Integration
3
+ * Sends security event notifications to Discord via webhooks
4
+ */
5
+ import type { DiscordConfig, NotificationSender } from './types.js';
6
+ /**
7
+ * Create a Discord notification sender
8
+ */
9
+ export declare function createDiscordSender(config: DiscordConfig): NotificationSender;
10
+ //# sourceMappingURL=discord.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"discord.d.ts","sourceRoot":"","sources":["../../../src/notifications/discord.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,aAAa,EAGb,kBAAkB,EAEnB,MAAM,YAAY,CAAC;AA8IpB;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,kBAAkB,CA+F7E"}