clawsec 0.0.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +560 -0
- package/dist/bin/clawsec.d.ts +7 -0
- package/dist/bin/clawsec.d.ts.map +1 -0
- package/dist/bin/clawsec.js +12 -0
- package/dist/bin/clawsec.js.map +1 -0
- package/dist/src/actions/block.d.ts +22 -0
- package/dist/src/actions/block.d.ts.map +1 -0
- package/dist/src/actions/block.js +83 -0
- package/dist/src/actions/block.js.map +1 -0
- package/dist/src/actions/confirm.d.ts +35 -0
- package/dist/src/actions/confirm.d.ts.map +1 -0
- package/dist/src/actions/confirm.js +156 -0
- package/dist/src/actions/confirm.js.map +1 -0
- package/dist/src/actions/executor.d.ts +64 -0
- package/dist/src/actions/executor.d.ts.map +1 -0
- package/dist/src/actions/executor.js +114 -0
- package/dist/src/actions/executor.js.map +1 -0
- package/dist/src/actions/index.d.ts +13 -0
- package/dist/src/actions/index.d.ts.map +1 -0
- package/dist/src/actions/index.js +15 -0
- package/dist/src/actions/index.js.map +1 -0
- package/dist/src/actions/log.d.ts +19 -0
- package/dist/src/actions/log.d.ts.map +1 -0
- package/dist/src/actions/log.js +63 -0
- package/dist/src/actions/log.js.map +1 -0
- package/dist/src/actions/types.d.ts +85 -0
- package/dist/src/actions/types.d.ts.map +1 -0
- package/dist/src/actions/types.js +78 -0
- package/dist/src/actions/types.js.map +1 -0
- package/dist/src/actions/warn.d.ts +22 -0
- package/dist/src/actions/warn.d.ts.map +1 -0
- package/dist/src/actions/warn.js +84 -0
- package/dist/src/actions/warn.js.map +1 -0
- package/dist/src/approval/agent-confirm.d.ts +104 -0
- package/dist/src/approval/agent-confirm.d.ts.map +1 -0
- package/dist/src/approval/agent-confirm.js +173 -0
- package/dist/src/approval/agent-confirm.js.map +1 -0
- package/dist/src/approval/index.d.ts +14 -0
- package/dist/src/approval/index.d.ts.map +1 -0
- package/dist/src/approval/index.js +9 -0
- package/dist/src/approval/index.js.map +1 -0
- package/dist/src/approval/native.d.ts +56 -0
- package/dist/src/approval/native.d.ts.map +1 -0
- package/dist/src/approval/native.js +196 -0
- package/dist/src/approval/native.js.map +1 -0
- package/dist/src/approval/store.d.ts +88 -0
- package/dist/src/approval/store.d.ts.map +1 -0
- package/dist/src/approval/store.js +192 -0
- package/dist/src/approval/store.js.map +1 -0
- package/dist/src/approval/types.d.ts +119 -0
- package/dist/src/approval/types.d.ts.map +1 -0
- package/dist/src/approval/types.js +6 -0
- package/dist/src/approval/types.js.map +1 -0
- package/dist/src/approval/webhook.d.ts +170 -0
- package/dist/src/approval/webhook.d.ts.map +1 -0
- package/dist/src/approval/webhook.js +362 -0
- package/dist/src/approval/webhook.js.map +1 -0
- package/dist/src/cli/commands/audit.d.ts +43 -0
- package/dist/src/cli/commands/audit.d.ts.map +1 -0
- package/dist/src/cli/commands/audit.js +115 -0
- package/dist/src/cli/commands/audit.js.map +1 -0
- package/dist/src/cli/commands/feedback.d.ts +27 -0
- package/dist/src/cli/commands/feedback.d.ts.map +1 -0
- package/dist/src/cli/commands/feedback.js +228 -0
- package/dist/src/cli/commands/feedback.js.map +1 -0
- package/dist/src/cli/commands/index.d.ts +11 -0
- package/dist/src/cli/commands/index.d.ts.map +1 -0
- package/dist/src/cli/commands/index.js +13 -0
- package/dist/src/cli/commands/index.js.map +1 -0
- package/dist/src/cli/commands/status.d.ts +20 -0
- package/dist/src/cli/commands/status.d.ts.map +1 -0
- package/dist/src/cli/commands/status.js +122 -0
- package/dist/src/cli/commands/status.js.map +1 -0
- package/dist/src/cli/commands/test.d.ts +23 -0
- package/dist/src/cli/commands/test.d.ts.map +1 -0
- package/dist/src/cli/commands/test.js +134 -0
- package/dist/src/cli/commands/test.js.map +1 -0
- package/dist/src/cli/commands/types.d.ts +81 -0
- package/dist/src/cli/commands/types.d.ts.map +1 -0
- package/dist/src/cli/commands/types.js +6 -0
- package/dist/src/cli/commands/types.js.map +1 -0
- package/dist/src/cli/index.d.ts +17 -0
- package/dist/src/cli/index.d.ts.map +1 -0
- package/dist/src/cli/index.js +267 -0
- package/dist/src/cli/index.js.map +1 -0
- package/dist/src/config/defaults.d.ts +20 -0
- package/dist/src/config/defaults.d.ts.map +1 -0
- package/dist/src/config/defaults.js +123 -0
- package/dist/src/config/defaults.js.map +1 -0
- package/dist/src/config/index.d.ts +8 -0
- package/dist/src/config/index.d.ts.map +1 -0
- package/dist/src/config/index.js +41 -0
- package/dist/src/config/index.js.map +1 -0
- package/dist/src/config/loader.d.ts +99 -0
- package/dist/src/config/loader.d.ts.map +1 -0
- package/dist/src/config/loader.js +242 -0
- package/dist/src/config/loader.js.map +1 -0
- package/dist/src/config/schema.d.ts +627 -0
- package/dist/src/config/schema.d.ts.map +1 -0
- package/dist/src/config/schema.js +585 -0
- package/dist/src/config/schema.js.map +1 -0
- package/dist/src/detectors/destructive/cloud-detector.d.ts +51 -0
- package/dist/src/detectors/destructive/cloud-detector.d.ts.map +1 -0
- package/dist/src/detectors/destructive/cloud-detector.js +556 -0
- package/dist/src/detectors/destructive/cloud-detector.js.map +1 -0
- package/dist/src/detectors/destructive/code-detector.d.ts +59 -0
- package/dist/src/detectors/destructive/code-detector.d.ts.map +1 -0
- package/dist/src/detectors/destructive/code-detector.js +558 -0
- package/dist/src/detectors/destructive/code-detector.js.map +1 -0
- package/dist/src/detectors/destructive/index.d.ts +54 -0
- package/dist/src/detectors/destructive/index.d.ts.map +1 -0
- package/dist/src/detectors/destructive/index.js +168 -0
- package/dist/src/detectors/destructive/index.js.map +1 -0
- package/dist/src/detectors/destructive/shell-detector.d.ts +43 -0
- package/dist/src/detectors/destructive/shell-detector.d.ts.map +1 -0
- package/dist/src/detectors/destructive/shell-detector.js +302 -0
- package/dist/src/detectors/destructive/shell-detector.js.map +1 -0
- package/dist/src/detectors/destructive/types.d.ts +143 -0
- package/dist/src/detectors/destructive/types.d.ts.map +1 -0
- package/dist/src/detectors/destructive/types.js +6 -0
- package/dist/src/detectors/destructive/types.js.map +1 -0
- package/dist/src/detectors/exfiltration/cloud-detector.d.ts +51 -0
- package/dist/src/detectors/exfiltration/cloud-detector.d.ts.map +1 -0
- package/dist/src/detectors/exfiltration/cloud-detector.js +427 -0
- package/dist/src/detectors/exfiltration/cloud-detector.js.map +1 -0
- package/dist/src/detectors/exfiltration/http-detector.d.ts +47 -0
- package/dist/src/detectors/exfiltration/http-detector.d.ts.map +1 -0
- package/dist/src/detectors/exfiltration/http-detector.js +429 -0
- package/dist/src/detectors/exfiltration/http-detector.js.map +1 -0
- package/dist/src/detectors/exfiltration/index.d.ts +44 -0
- package/dist/src/detectors/exfiltration/index.d.ts.map +1 -0
- package/dist/src/detectors/exfiltration/index.js +118 -0
- package/dist/src/detectors/exfiltration/index.js.map +1 -0
- package/dist/src/detectors/exfiltration/network-detector.d.ts +55 -0
- package/dist/src/detectors/exfiltration/network-detector.d.ts.map +1 -0
- package/dist/src/detectors/exfiltration/network-detector.js +504 -0
- package/dist/src/detectors/exfiltration/network-detector.js.map +1 -0
- package/dist/src/detectors/exfiltration/types.d.ts +139 -0
- package/dist/src/detectors/exfiltration/types.d.ts.map +1 -0
- package/dist/src/detectors/exfiltration/types.js +6 -0
- package/dist/src/detectors/exfiltration/types.js.map +1 -0
- package/dist/src/detectors/purchase/domain-detector.d.ts +44 -0
- package/dist/src/detectors/purchase/domain-detector.d.ts.map +1 -0
- package/dist/src/detectors/purchase/domain-detector.js +296 -0
- package/dist/src/detectors/purchase/domain-detector.js.map +1 -0
- package/dist/src/detectors/purchase/form-detector.d.ts +27 -0
- package/dist/src/detectors/purchase/form-detector.d.ts.map +1 -0
- package/dist/src/detectors/purchase/form-detector.js +344 -0
- package/dist/src/detectors/purchase/form-detector.js.map +1 -0
- package/dist/src/detectors/purchase/index.d.ts +65 -0
- package/dist/src/detectors/purchase/index.d.ts.map +1 -0
- package/dist/src/detectors/purchase/index.js +216 -0
- package/dist/src/detectors/purchase/index.js.map +1 -0
- package/dist/src/detectors/purchase/spend-tracker.d.ts +132 -0
- package/dist/src/detectors/purchase/spend-tracker.d.ts.map +1 -0
- package/dist/src/detectors/purchase/spend-tracker.js +313 -0
- package/dist/src/detectors/purchase/spend-tracker.js.map +1 -0
- package/dist/src/detectors/purchase/types.d.ts +139 -0
- package/dist/src/detectors/purchase/types.d.ts.map +1 -0
- package/dist/src/detectors/purchase/types.js +6 -0
- package/dist/src/detectors/purchase/types.js.map +1 -0
- package/dist/src/detectors/purchase/url-detector.d.ts +31 -0
- package/dist/src/detectors/purchase/url-detector.d.ts.map +1 -0
- package/dist/src/detectors/purchase/url-detector.js +292 -0
- package/dist/src/detectors/purchase/url-detector.js.map +1 -0
- package/dist/src/detectors/secrets/api-key-detector.d.ts +30 -0
- package/dist/src/detectors/secrets/api-key-detector.d.ts.map +1 -0
- package/dist/src/detectors/secrets/api-key-detector.js +297 -0
- package/dist/src/detectors/secrets/api-key-detector.js.map +1 -0
- package/dist/src/detectors/secrets/index.d.ts +43 -0
- package/dist/src/detectors/secrets/index.d.ts.map +1 -0
- package/dist/src/detectors/secrets/index.js +261 -0
- package/dist/src/detectors/secrets/index.js.map +1 -0
- package/dist/src/detectors/secrets/pii-detector.d.ts +54 -0
- package/dist/src/detectors/secrets/pii-detector.d.ts.map +1 -0
- package/dist/src/detectors/secrets/pii-detector.js +286 -0
- package/dist/src/detectors/secrets/pii-detector.js.map +1 -0
- package/dist/src/detectors/secrets/token-detector.d.ts +51 -0
- package/dist/src/detectors/secrets/token-detector.d.ts.map +1 -0
- package/dist/src/detectors/secrets/token-detector.js +233 -0
- package/dist/src/detectors/secrets/token-detector.js.map +1 -0
- package/dist/src/detectors/secrets/types.d.ts +157 -0
- package/dist/src/detectors/secrets/types.d.ts.map +1 -0
- package/dist/src/detectors/secrets/types.js +6 -0
- package/dist/src/detectors/secrets/types.js.map +1 -0
- package/dist/src/detectors/website/category-detector.d.ts +22 -0
- package/dist/src/detectors/website/category-detector.d.ts.map +1 -0
- package/dist/src/detectors/website/category-detector.js +162 -0
- package/dist/src/detectors/website/category-detector.js.map +1 -0
- package/dist/src/detectors/website/index.d.ts +53 -0
- package/dist/src/detectors/website/index.d.ts.map +1 -0
- package/dist/src/detectors/website/index.js +232 -0
- package/dist/src/detectors/website/index.js.map +1 -0
- package/dist/src/detectors/website/pattern-matcher.d.ts +33 -0
- package/dist/src/detectors/website/pattern-matcher.d.ts.map +1 -0
- package/dist/src/detectors/website/pattern-matcher.js +121 -0
- package/dist/src/detectors/website/pattern-matcher.js.map +1 -0
- package/dist/src/detectors/website/types.d.ts +105 -0
- package/dist/src/detectors/website/types.d.ts.map +1 -0
- package/dist/src/detectors/website/types.js +6 -0
- package/dist/src/detectors/website/types.js.map +1 -0
- package/dist/src/engine/analyzer.d.ts +87 -0
- package/dist/src/engine/analyzer.d.ts.map +1 -0
- package/dist/src/engine/analyzer.js +427 -0
- package/dist/src/engine/analyzer.js.map +1 -0
- package/dist/src/engine/cache.d.ts +80 -0
- package/dist/src/engine/cache.d.ts.map +1 -0
- package/dist/src/engine/cache.js +167 -0
- package/dist/src/engine/cache.js.map +1 -0
- package/dist/src/engine/index.d.ts +11 -0
- package/dist/src/engine/index.d.ts.map +1 -0
- package/dist/src/engine/index.js +11 -0
- package/dist/src/engine/index.js.map +1 -0
- package/dist/src/engine/llm-client.d.ts +210 -0
- package/dist/src/engine/llm-client.d.ts.map +1 -0
- package/dist/src/engine/llm-client.js +506 -0
- package/dist/src/engine/llm-client.js.map +1 -0
- package/dist/src/engine/types.d.ts +163 -0
- package/dist/src/engine/types.d.ts.map +1 -0
- package/dist/src/engine/types.js +21 -0
- package/dist/src/engine/types.js.map +1 -0
- package/dist/src/feedback/index.d.ts +9 -0
- package/dist/src/feedback/index.d.ts.map +1 -0
- package/dist/src/feedback/index.js +8 -0
- package/dist/src/feedback/index.js.map +1 -0
- package/dist/src/feedback/learner.d.ts +222 -0
- package/dist/src/feedback/learner.d.ts.map +1 -0
- package/dist/src/feedback/learner.js +401 -0
- package/dist/src/feedback/learner.js.map +1 -0
- package/dist/src/feedback/store.d.ts +113 -0
- package/dist/src/feedback/store.d.ts.map +1 -0
- package/dist/src/feedback/store.js +228 -0
- package/dist/src/feedback/store.js.map +1 -0
- package/dist/src/feedback/types.d.ts +126 -0
- package/dist/src/feedback/types.d.ts.map +1 -0
- package/dist/src/feedback/types.js +6 -0
- package/dist/src/feedback/types.js.map +1 -0
- package/dist/src/hooks/before-agent-start/handler.d.ts +37 -0
- package/dist/src/hooks/before-agent-start/handler.d.ts.map +1 -0
- package/dist/src/hooks/before-agent-start/handler.js +109 -0
- package/dist/src/hooks/before-agent-start/handler.js.map +1 -0
- package/dist/src/hooks/before-agent-start/index.d.ts +8 -0
- package/dist/src/hooks/before-agent-start/index.d.ts.map +1 -0
- package/dist/src/hooks/before-agent-start/index.js +7 -0
- package/dist/src/hooks/before-agent-start/index.js.map +1 -0
- package/dist/src/hooks/before-agent-start/prompts.d.ts +48 -0
- package/dist/src/hooks/before-agent-start/prompts.d.ts.map +1 -0
- package/dist/src/hooks/before-agent-start/prompts.js +103 -0
- package/dist/src/hooks/before-agent-start/prompts.js.map +1 -0
- package/dist/src/hooks/before-tool-call/handler.d.ts +42 -0
- package/dist/src/hooks/before-tool-call/handler.d.ts.map +1 -0
- package/dist/src/hooks/before-tool-call/handler.js +226 -0
- package/dist/src/hooks/before-tool-call/handler.js.map +1 -0
- package/dist/src/hooks/before-tool-call/index.d.ts +7 -0
- package/dist/src/hooks/before-tool-call/index.d.ts.map +1 -0
- package/dist/src/hooks/before-tool-call/index.js +6 -0
- package/dist/src/hooks/before-tool-call/index.js.map +1 -0
- package/dist/src/hooks/tool-result-persist/filter.d.ts +72 -0
- package/dist/src/hooks/tool-result-persist/filter.d.ts.map +1 -0
- package/dist/src/hooks/tool-result-persist/filter.js +305 -0
- package/dist/src/hooks/tool-result-persist/filter.js.map +1 -0
- package/dist/src/hooks/tool-result-persist/handler.d.ts +49 -0
- package/dist/src/hooks/tool-result-persist/handler.d.ts.map +1 -0
- package/dist/src/hooks/tool-result-persist/handler.js +217 -0
- package/dist/src/hooks/tool-result-persist/handler.js.map +1 -0
- package/dist/src/hooks/tool-result-persist/index.d.ts +11 -0
- package/dist/src/hooks/tool-result-persist/index.d.ts.map +1 -0
- package/dist/src/hooks/tool-result-persist/index.js +11 -0
- package/dist/src/hooks/tool-result-persist/index.js.map +1 -0
- package/dist/src/index.d.ts +256 -0
- package/dist/src/index.d.ts.map +1 -0
- package/dist/src/index.js +222 -0
- package/dist/src/index.js.map +1 -0
- package/dist/src/notifications/discord.d.ts +10 -0
- package/dist/src/notifications/discord.d.ts.map +1 -0
- package/dist/src/notifications/discord.js +218 -0
- package/dist/src/notifications/discord.js.map +1 -0
- package/dist/src/notifications/index.d.ts +37 -0
- package/dist/src/notifications/index.d.ts.map +1 -0
- package/dist/src/notifications/index.js +68 -0
- package/dist/src/notifications/index.js.map +1 -0
- package/dist/src/notifications/slack.d.ts +10 -0
- package/dist/src/notifications/slack.d.ts.map +1 -0
- package/dist/src/notifications/slack.js +218 -0
- package/dist/src/notifications/slack.js.map +1 -0
- package/dist/src/notifications/telegram.d.ts +10 -0
- package/dist/src/notifications/telegram.d.ts.map +1 -0
- package/dist/src/notifications/telegram.js +242 -0
- package/dist/src/notifications/telegram.js.map +1 -0
- package/dist/src/notifications/types.d.ts +119 -0
- package/dist/src/notifications/types.d.ts.map +1 -0
- package/dist/src/notifications/types.js +6 -0
- package/dist/src/notifications/types.js.map +1 -0
- package/dist/src/proxy/index.d.ts +8 -0
- package/dist/src/proxy/index.d.ts.map +1 -0
- package/dist/src/proxy/index.js +9 -0
- package/dist/src/proxy/index.js.map +1 -0
- package/dist/src/proxy/middleware.d.ts +55 -0
- package/dist/src/proxy/middleware.d.ts.map +1 -0
- package/dist/src/proxy/middleware.js +215 -0
- package/dist/src/proxy/middleware.js.map +1 -0
- package/dist/src/proxy/server.d.ts +57 -0
- package/dist/src/proxy/server.d.ts.map +1 -0
- package/dist/src/proxy/server.js +298 -0
- package/dist/src/proxy/server.js.map +1 -0
- package/dist/src/proxy/types.d.ts +136 -0
- package/dist/src/proxy/types.d.ts.map +1 -0
- package/dist/src/proxy/types.js +6 -0
- package/dist/src/proxy/types.js.map +1 -0
- package/dist/src/sanitization/index.d.ts +10 -0
- package/dist/src/sanitization/index.d.ts.map +1 -0
- package/dist/src/sanitization/index.js +9 -0
- package/dist/src/sanitization/index.js.map +1 -0
- package/dist/src/sanitization/patterns.d.ts +51 -0
- package/dist/src/sanitization/patterns.d.ts.map +1 -0
- package/dist/src/sanitization/patterns.js +266 -0
- package/dist/src/sanitization/patterns.js.map +1 -0
- package/dist/src/sanitization/scanner.d.ts +29 -0
- package/dist/src/sanitization/scanner.d.ts.map +1 -0
- package/dist/src/sanitization/scanner.js +328 -0
- package/dist/src/sanitization/scanner.js.map +1 -0
- package/dist/src/sanitization/types.d.ts +57 -0
- package/dist/src/sanitization/types.d.ts.map +1 -0
- package/dist/src/sanitization/types.js +5 -0
- package/dist/src/sanitization/types.js.map +1 -0
- package/openclaw.plugin.json +114 -0
- package/package.json +63 -0
- package/rules/builtin/README.md +139 -0
- package/rules/builtin/ai-services.yaml +70 -0
- package/rules/builtin/api-keys.yaml +64 -0
- package/rules/builtin/authentication.yaml +56 -0
- package/rules/builtin/aws-security.yaml +57 -0
- package/rules/builtin/azure-security.yaml +58 -0
- package/rules/builtin/cicd-security.yaml +64 -0
- package/rules/builtin/cloud-storage.yaml +64 -0
- package/rules/builtin/container-registry.yaml +55 -0
- package/rules/builtin/crypto-wallets.yaml +71 -0
- package/rules/builtin/database-nosql.yaml +58 -0
- package/rules/builtin/database-sql.yaml +62 -0
- package/rules/builtin/development-env.yaml +67 -0
- package/rules/builtin/docker.yaml +57 -0
- package/rules/builtin/filesystem.yaml +71 -0
- package/rules/builtin/financial-pci.yaml +61 -0
- package/rules/builtin/gcp-security.yaml +57 -0
- package/rules/builtin/git-operations.yaml +68 -0
- package/rules/builtin/healthcare-hipaa.yaml +64 -0
- package/rules/builtin/kubernetes.yaml +60 -0
- package/rules/builtin/messaging-services.yaml +53 -0
- package/rules/builtin/minimal.yaml +47 -0
- package/rules/builtin/mobile-development.yaml +61 -0
- package/rules/builtin/monitoring.yaml +63 -0
- package/rules/builtin/network-security.yaml +57 -0
- package/rules/builtin/package-managers.yaml +74 -0
- package/rules/builtin/payment-processing.yaml +66 -0
- package/rules/builtin/pii-protection.yaml +48 -0
- package/rules/builtin/production-strict.yaml +55 -0
- package/rules/builtin/secrets-management.yaml +63 -0
- package/rules/builtin/serverless.yaml +74 -0
- package/rules/builtin/ssh-security.yaml +66 -0
- package/rules/builtin/terraform.yaml +51 -0
- package/rules/builtin/web-security.yaml +62 -0
|
@@ -0,0 +1,256 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Clawsec - Security plugin for OpenClaw.ai
|
|
3
|
+
* Prevents AI agents from taking dangerous actions
|
|
4
|
+
*/
|
|
5
|
+
export declare const VERSION = "0.0.1";
|
|
6
|
+
export declare const PLUGIN_ID = "clawsec";
|
|
7
|
+
export declare const PLUGIN_NAME = "Clawsec Security Plugin";
|
|
8
|
+
/**
|
|
9
|
+
* Severity levels for security detections
|
|
10
|
+
*/
|
|
11
|
+
export type Severity = 'critical' | 'high' | 'medium' | 'low';
|
|
12
|
+
/**
|
|
13
|
+
* Actions that can be taken when a threat is detected
|
|
14
|
+
*/
|
|
15
|
+
export type Action = 'block' | 'confirm' | 'agent-confirm' | 'warn' | 'log';
|
|
16
|
+
/**
|
|
17
|
+
* Categories of security threats
|
|
18
|
+
*/
|
|
19
|
+
export type ThreatCategory = 'purchase' | 'website' | 'destructive' | 'secrets' | 'exfiltration';
|
|
20
|
+
/**
|
|
21
|
+
* Base context provided to all hooks
|
|
22
|
+
*/
|
|
23
|
+
export interface HookContext {
|
|
24
|
+
sessionId: string;
|
|
25
|
+
userId?: string;
|
|
26
|
+
timestamp: number;
|
|
27
|
+
}
|
|
28
|
+
/**
|
|
29
|
+
* Tool call information passed to before-tool-call hook
|
|
30
|
+
*/
|
|
31
|
+
export interface ToolCallContext extends HookContext {
|
|
32
|
+
toolName: string;
|
|
33
|
+
toolInput: Record<string, unknown>;
|
|
34
|
+
conversationHistory?: Array<{
|
|
35
|
+
role: 'user' | 'assistant';
|
|
36
|
+
content: string;
|
|
37
|
+
}>;
|
|
38
|
+
}
|
|
39
|
+
/**
|
|
40
|
+
* Result from before-tool-call hook
|
|
41
|
+
*/
|
|
42
|
+
export interface BeforeToolCallResult {
|
|
43
|
+
/** Whether to allow the tool call to proceed */
|
|
44
|
+
allow: boolean;
|
|
45
|
+
/** Modified tool input (if transformed) */
|
|
46
|
+
modifiedInput?: Record<string, unknown>;
|
|
47
|
+
/** Message to display when blocked */
|
|
48
|
+
blockMessage?: string;
|
|
49
|
+
/** Metadata about the detection */
|
|
50
|
+
metadata?: {
|
|
51
|
+
category?: ThreatCategory;
|
|
52
|
+
severity?: Severity;
|
|
53
|
+
rule?: string;
|
|
54
|
+
reason?: string;
|
|
55
|
+
};
|
|
56
|
+
}
|
|
57
|
+
/**
|
|
58
|
+
* Handler type for before-tool-call hook
|
|
59
|
+
*/
|
|
60
|
+
export type BeforeToolCallHandler = (context: ToolCallContext) => Promise<BeforeToolCallResult>;
|
|
61
|
+
/**
|
|
62
|
+
* Agent start context passed to before-agent-start hook
|
|
63
|
+
*/
|
|
64
|
+
export interface AgentStartContext extends HookContext {
|
|
65
|
+
systemPrompt?: string;
|
|
66
|
+
agentConfig?: Record<string, unknown>;
|
|
67
|
+
}
|
|
68
|
+
/**
|
|
69
|
+
* Result from before-agent-start hook
|
|
70
|
+
*/
|
|
71
|
+
export interface BeforeAgentStartResult {
|
|
72
|
+
/** Modified or injected system prompt content */
|
|
73
|
+
systemPromptAddition?: string;
|
|
74
|
+
/** Modified agent configuration */
|
|
75
|
+
modifiedConfig?: Record<string, unknown>;
|
|
76
|
+
}
|
|
77
|
+
/**
|
|
78
|
+
* Handler type for before-agent-start hook
|
|
79
|
+
*/
|
|
80
|
+
export type BeforeAgentStartHandler = (context: AgentStartContext) => Promise<BeforeAgentStartResult>;
|
|
81
|
+
/**
|
|
82
|
+
* Tool result context passed to tool-result-persist hook
|
|
83
|
+
*/
|
|
84
|
+
export interface ToolResultContext extends HookContext {
|
|
85
|
+
toolName: string;
|
|
86
|
+
toolInput: Record<string, unknown>;
|
|
87
|
+
toolOutput: unknown;
|
|
88
|
+
}
|
|
89
|
+
/**
|
|
90
|
+
* Result from tool-result-persist hook
|
|
91
|
+
*/
|
|
92
|
+
export interface ToolResultPersistResult {
|
|
93
|
+
/** Whether to allow the result to be persisted */
|
|
94
|
+
allow: boolean;
|
|
95
|
+
/** Filtered/redacted output */
|
|
96
|
+
filteredOutput?: unknown;
|
|
97
|
+
/** Metadata about any redactions */
|
|
98
|
+
redactions?: Array<{
|
|
99
|
+
type: string;
|
|
100
|
+
description: string;
|
|
101
|
+
}>;
|
|
102
|
+
}
|
|
103
|
+
/**
|
|
104
|
+
* Handler type for tool-result-persist hook
|
|
105
|
+
*/
|
|
106
|
+
export type ToolResultPersistHandler = (context: ToolResultContext) => Promise<ToolResultPersistResult>;
|
|
107
|
+
/**
|
|
108
|
+
* OpenClaw plugin API interface
|
|
109
|
+
*/
|
|
110
|
+
export interface OpenClawPluginAPI {
|
|
111
|
+
/** Register a hook handler */
|
|
112
|
+
registerHook: (hookName: string, handler: unknown, options?: HookOptions) => void;
|
|
113
|
+
/** Unregister a hook handler */
|
|
114
|
+
unregisterHook: (hookName: string, handlerId: string) => void;
|
|
115
|
+
/** Get plugin configuration */
|
|
116
|
+
getConfig: () => PluginConfig;
|
|
117
|
+
/** Log a message */
|
|
118
|
+
log: (level: 'debug' | 'info' | 'warn' | 'error', message: string, data?: unknown) => void;
|
|
119
|
+
/** Request user approval */
|
|
120
|
+
requestApproval: (request: ApprovalRequest) => Promise<ApprovalResponse>;
|
|
121
|
+
}
|
|
122
|
+
/**
|
|
123
|
+
* Hook registration options
|
|
124
|
+
*/
|
|
125
|
+
export interface HookOptions {
|
|
126
|
+
/** Unique identifier for this handler */
|
|
127
|
+
id?: string;
|
|
128
|
+
/** Priority (lower runs first) */
|
|
129
|
+
priority?: number;
|
|
130
|
+
/** Whether this hook is enabled */
|
|
131
|
+
enabled?: boolean;
|
|
132
|
+
}
|
|
133
|
+
/**
|
|
134
|
+
* Plugin configuration from OpenClaw
|
|
135
|
+
*/
|
|
136
|
+
export interface PluginConfig {
|
|
137
|
+
/** Path to clawsec.yaml config file */
|
|
138
|
+
configPath?: string;
|
|
139
|
+
/** Whether the plugin is enabled */
|
|
140
|
+
enabled?: boolean;
|
|
141
|
+
/** Log level */
|
|
142
|
+
logLevel?: 'debug' | 'info' | 'warn' | 'error';
|
|
143
|
+
}
|
|
144
|
+
/**
|
|
145
|
+
* Approval request structure
|
|
146
|
+
*/
|
|
147
|
+
export interface ApprovalRequest {
|
|
148
|
+
id: string;
|
|
149
|
+
category: ThreatCategory;
|
|
150
|
+
severity: Severity;
|
|
151
|
+
reason: string;
|
|
152
|
+
toolName: string;
|
|
153
|
+
toolInput: Record<string, unknown>;
|
|
154
|
+
timeout?: number;
|
|
155
|
+
}
|
|
156
|
+
/**
|
|
157
|
+
* Approval response structure
|
|
158
|
+
*/
|
|
159
|
+
export interface ApprovalResponse {
|
|
160
|
+
approved: boolean;
|
|
161
|
+
approvedBy?: string;
|
|
162
|
+
timestamp: number;
|
|
163
|
+
}
|
|
164
|
+
interface PluginState {
|
|
165
|
+
api: OpenClawPluginAPI | null;
|
|
166
|
+
config: PluginConfig | null;
|
|
167
|
+
initialized: boolean;
|
|
168
|
+
handlers: {
|
|
169
|
+
beforeToolCall: BeforeToolCallHandler | null;
|
|
170
|
+
beforeAgentStart: BeforeAgentStartHandler | null;
|
|
171
|
+
toolResultPersist: ToolResultPersistHandler | null;
|
|
172
|
+
};
|
|
173
|
+
}
|
|
174
|
+
/**
|
|
175
|
+
* Activates the Clawsec security plugin and registers all hooks.
|
|
176
|
+
*
|
|
177
|
+
* @param api - The OpenClaw plugin API
|
|
178
|
+
* @returns Cleanup function to deactivate the plugin
|
|
179
|
+
*/
|
|
180
|
+
export declare function activate(api: OpenClawPluginAPI): () => void;
|
|
181
|
+
/**
|
|
182
|
+
* Deactivates the Clawsec security plugin and unregisters all hooks.
|
|
183
|
+
*/
|
|
184
|
+
export declare function deactivate(): void;
|
|
185
|
+
/**
|
|
186
|
+
* Check if the plugin is currently active
|
|
187
|
+
*/
|
|
188
|
+
export declare function isActive(): boolean;
|
|
189
|
+
/**
|
|
190
|
+
* Get the current plugin state (for testing/debugging)
|
|
191
|
+
*/
|
|
192
|
+
export declare function getState(): Readonly<PluginState>;
|
|
193
|
+
/**
|
|
194
|
+
* JSON Schema for plugin configuration (matches openclaw.plugin.json)
|
|
195
|
+
*/
|
|
196
|
+
export declare const pluginConfigSchema: {
|
|
197
|
+
readonly type: "object";
|
|
198
|
+
readonly properties: {
|
|
199
|
+
readonly configPath: {
|
|
200
|
+
readonly type: "string";
|
|
201
|
+
readonly default: "./clawsec.yaml";
|
|
202
|
+
readonly description: "Path to the Clawsec YAML configuration file";
|
|
203
|
+
};
|
|
204
|
+
readonly enabled: {
|
|
205
|
+
readonly type: "boolean";
|
|
206
|
+
readonly default: true;
|
|
207
|
+
readonly description: "Whether the security plugin is enabled";
|
|
208
|
+
};
|
|
209
|
+
readonly logLevel: {
|
|
210
|
+
readonly type: "string";
|
|
211
|
+
readonly enum: readonly ["debug", "info", "warn", "error"];
|
|
212
|
+
readonly default: "info";
|
|
213
|
+
readonly description: "Logging verbosity level";
|
|
214
|
+
};
|
|
215
|
+
};
|
|
216
|
+
readonly additionalProperties: false;
|
|
217
|
+
};
|
|
218
|
+
/**
|
|
219
|
+
* Register method for OpenClaw plugin system.
|
|
220
|
+
* This is the entry point called by OpenClaw when loading the plugin.
|
|
221
|
+
*
|
|
222
|
+
* @param api - The OpenClaw plugin API
|
|
223
|
+
*/
|
|
224
|
+
declare function register(api: OpenClawPluginAPI): void;
|
|
225
|
+
declare const _default: {
|
|
226
|
+
id: string;
|
|
227
|
+
name: string;
|
|
228
|
+
version: string;
|
|
229
|
+
configSchema: {
|
|
230
|
+
readonly type: "object";
|
|
231
|
+
readonly properties: {
|
|
232
|
+
readonly configPath: {
|
|
233
|
+
readonly type: "string";
|
|
234
|
+
readonly default: "./clawsec.yaml";
|
|
235
|
+
readonly description: "Path to the Clawsec YAML configuration file";
|
|
236
|
+
};
|
|
237
|
+
readonly enabled: {
|
|
238
|
+
readonly type: "boolean";
|
|
239
|
+
readonly default: true;
|
|
240
|
+
readonly description: "Whether the security plugin is enabled";
|
|
241
|
+
};
|
|
242
|
+
readonly logLevel: {
|
|
243
|
+
readonly type: "string";
|
|
244
|
+
readonly enum: readonly ["debug", "info", "warn", "error"];
|
|
245
|
+
readonly default: "info";
|
|
246
|
+
readonly description: "Logging verbosity level";
|
|
247
|
+
};
|
|
248
|
+
};
|
|
249
|
+
readonly additionalProperties: false;
|
|
250
|
+
};
|
|
251
|
+
register: typeof register;
|
|
252
|
+
activate: typeof activate;
|
|
253
|
+
deactivate: typeof deactivate;
|
|
254
|
+
};
|
|
255
|
+
export default _default;
|
|
256
|
+
//# sourceMappingURL=index.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,eAAO,MAAM,OAAO,UAAU,CAAC;AAC/B,eAAO,MAAM,SAAS,YAAY,CAAC;AACnC,eAAO,MAAM,WAAW,4BAA4B,CAAC;AAMrD;;GAEG;AACH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D;;GAEG;AACH,MAAM,MAAM,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,eAAe,GAAG,MAAM,GAAG,KAAK,CAAC;AAE5E;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,GAAG,cAAc,CAAC;AAEjG;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAgB,SAAQ,WAAW;IAClD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,mBAAmB,CAAC,EAAE,KAAK,CAAC;QAC1B,IAAI,EAAE,MAAM,GAAG,WAAW,CAAC;QAC3B,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,gDAAgD;IAChD,KAAK,EAAE,OAAO,CAAC;IACf,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACxC,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mCAAmC;IACnC,QAAQ,CAAC,EAAE;QACT,QAAQ,CAAC,EAAE,cAAc,CAAC;QAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC;QACpB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;CACH;AAED;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAAG,CAClC,OAAO,EAAE,eAAe,KACrB,OAAO,CAAC,oBAAoB,CAAC,CAAC;AAEnC;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,iDAAiD;IACjD,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,mCAAmC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,CACpC,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,sBAAsB,CAAC,CAAC;AAErC;;GAEG;AACH,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,kDAAkD;IAClD,KAAK,EAAE,OAAO,CAAC;IACf,+BAA+B;IAC/B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,oCAAoC;IACpC,UAAU,CAAC,EAAE,KAAK,CAAC;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAED;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,CACrC,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,uBAAuB,CAAC,CAAC;AAEtC;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,YAAY,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,WAAW,KAAK,IAAI,CAAC;IAClF,gCAAgC;IAChC,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9D,+BAA+B;IAC/B,SAAS,EAAE,MAAM,YAAY,CAAC;IAC9B,oBAAoB;IACpB,GAAG,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,KAAK,IAAI,CAAC;IAC3F,4BAA4B;IAC5B,eAAe,EAAE,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC1E;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,yCAAyC;IACzC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mCAAmC;IACnC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB;IAChB,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;CAChD;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD,UAAU,WAAW;IACnB,GAAG,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC9B,MAAM,EAAE,YAAY,GAAG,IAAI,CAAC;IAC5B,WAAW,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE;QACR,cAAc,EAAE,qBAAqB,GAAG,IAAI,CAAC;QAC7C,gBAAgB,EAAE,uBAAuB,GAAG,IAAI,CAAC;QACjD,iBAAiB,EAAE,wBAAwB,GAAG,IAAI,CAAC;KACpD,CAAC;CACH;AA6FD;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,IAAI,CAgD3D;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,IAAI,CAwBjC;AAED;;GAEG;AACH,wBAAgB,QAAQ,IAAI,OAAO,CAElC;AAED;;GAEG;AACH,wBAAgB,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,CAEhD;AAMD;;GAEG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;CAqBrB,CAAC;AAMX;;;;;GAKG;AACH,iBAAS,QAAQ,CAAC,GAAG,EAAE,iBAAiB,GAAG,IAAI,CAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOD,wBASE"}
|
|
@@ -0,0 +1,222 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Clawsec - Security plugin for OpenClaw.ai
|
|
3
|
+
* Prevents AI agents from taking dangerous actions
|
|
4
|
+
*/
|
|
5
|
+
// =============================================================================
|
|
6
|
+
// VERSION & CONSTANTS
|
|
7
|
+
// =============================================================================
|
|
8
|
+
export const VERSION = '0.0.1';
|
|
9
|
+
export const PLUGIN_ID = 'clawsec';
|
|
10
|
+
export const PLUGIN_NAME = 'Clawsec Security Plugin';
|
|
11
|
+
const state = {
|
|
12
|
+
api: null,
|
|
13
|
+
config: null,
|
|
14
|
+
initialized: false,
|
|
15
|
+
handlers: {
|
|
16
|
+
beforeToolCall: null,
|
|
17
|
+
beforeAgentStart: null,
|
|
18
|
+
toolResultPersist: null,
|
|
19
|
+
},
|
|
20
|
+
};
|
|
21
|
+
// =============================================================================
|
|
22
|
+
// PLACEHOLDER HOOK HANDLERS
|
|
23
|
+
// =============================================================================
|
|
24
|
+
/**
|
|
25
|
+
* Placeholder handler for before-tool-call hook.
|
|
26
|
+
* Will be replaced with full implementation in Task 2.x
|
|
27
|
+
*/
|
|
28
|
+
const beforeToolCallHandler = async (context) => {
|
|
29
|
+
// Log for debugging during development
|
|
30
|
+
if (state.api && state.config?.logLevel === 'debug') {
|
|
31
|
+
state.api.log('debug', `[clawsec] before-tool-call: ${context.toolName}`, {
|
|
32
|
+
sessionId: context.sessionId,
|
|
33
|
+
toolInput: context.toolInput,
|
|
34
|
+
});
|
|
35
|
+
}
|
|
36
|
+
// Placeholder: Allow all tool calls
|
|
37
|
+
// TODO: Implement actual detection logic in Task 2.x
|
|
38
|
+
return {
|
|
39
|
+
allow: true,
|
|
40
|
+
};
|
|
41
|
+
};
|
|
42
|
+
/**
|
|
43
|
+
* Placeholder handler for before-agent-start hook.
|
|
44
|
+
* Will be replaced with full implementation in Task 2.x
|
|
45
|
+
*/
|
|
46
|
+
const beforeAgentStartHandler = async (context) => {
|
|
47
|
+
// Log for debugging during development
|
|
48
|
+
if (state.api && state.config?.logLevel === 'debug') {
|
|
49
|
+
state.api.log('debug', '[clawsec] before-agent-start', {
|
|
50
|
+
sessionId: context.sessionId,
|
|
51
|
+
});
|
|
52
|
+
}
|
|
53
|
+
// Placeholder: Inject basic security reminder into system prompt
|
|
54
|
+
// TODO: Implement configurable prompts in Task 2.x
|
|
55
|
+
const securityReminder = `
|
|
56
|
+
[CLAWSEC SECURITY CONTEXT]
|
|
57
|
+
This session is protected by Clawsec security plugin.
|
|
58
|
+
- Purchases and financial transactions require approval
|
|
59
|
+
- Destructive commands (rm -rf, DROP TABLE, etc.) are monitored
|
|
60
|
+
- Sensitive data in outputs may be filtered
|
|
61
|
+
`;
|
|
62
|
+
return {
|
|
63
|
+
systemPromptAddition: securityReminder,
|
|
64
|
+
};
|
|
65
|
+
};
|
|
66
|
+
/**
|
|
67
|
+
* Placeholder handler for tool-result-persist hook.
|
|
68
|
+
* Will be replaced with full implementation in Task 2.x
|
|
69
|
+
*/
|
|
70
|
+
const toolResultPersistHandler = async (context) => {
|
|
71
|
+
// Log for debugging during development
|
|
72
|
+
if (state.api && state.config?.logLevel === 'debug') {
|
|
73
|
+
state.api.log('debug', `[clawsec] tool-result-persist: ${context.toolName}`, {
|
|
74
|
+
sessionId: context.sessionId,
|
|
75
|
+
});
|
|
76
|
+
}
|
|
77
|
+
// Placeholder: Allow all results to persist
|
|
78
|
+
// TODO: Implement actual filtering logic in Task 2.x
|
|
79
|
+
return {
|
|
80
|
+
allow: true,
|
|
81
|
+
};
|
|
82
|
+
};
|
|
83
|
+
// =============================================================================
|
|
84
|
+
// PLUGIN LIFECYCLE
|
|
85
|
+
// =============================================================================
|
|
86
|
+
/**
|
|
87
|
+
* Activates the Clawsec security plugin and registers all hooks.
|
|
88
|
+
*
|
|
89
|
+
* @param api - The OpenClaw plugin API
|
|
90
|
+
* @returns Cleanup function to deactivate the plugin
|
|
91
|
+
*/
|
|
92
|
+
export function activate(api) {
|
|
93
|
+
if (state.initialized) {
|
|
94
|
+
api.log('warn', '[clawsec] Plugin already activated, skipping');
|
|
95
|
+
return () => deactivate();
|
|
96
|
+
}
|
|
97
|
+
// Store API reference and config
|
|
98
|
+
state.api = api;
|
|
99
|
+
state.config = api.getConfig();
|
|
100
|
+
api.log('info', `[clawsec] Activating Clawsec Security Plugin v${VERSION}`);
|
|
101
|
+
// Check if plugin is enabled
|
|
102
|
+
if (state.config?.enabled === false) {
|
|
103
|
+
api.log('info', '[clawsec] Plugin is disabled via configuration');
|
|
104
|
+
state.initialized = true;
|
|
105
|
+
return () => deactivate();
|
|
106
|
+
}
|
|
107
|
+
// Store handler references
|
|
108
|
+
state.handlers.beforeToolCall = beforeToolCallHandler;
|
|
109
|
+
state.handlers.beforeAgentStart = beforeAgentStartHandler;
|
|
110
|
+
state.handlers.toolResultPersist = toolResultPersistHandler;
|
|
111
|
+
// Register hooks with OpenClaw
|
|
112
|
+
api.registerHook('before-tool-call', beforeToolCallHandler, {
|
|
113
|
+
id: 'clawsec-before-tool-call',
|
|
114
|
+
priority: 100,
|
|
115
|
+
enabled: true,
|
|
116
|
+
});
|
|
117
|
+
api.registerHook('before-agent-start', beforeAgentStartHandler, {
|
|
118
|
+
id: 'clawsec-before-agent-start',
|
|
119
|
+
priority: 50,
|
|
120
|
+
enabled: true,
|
|
121
|
+
});
|
|
122
|
+
api.registerHook('tool-result-persist', toolResultPersistHandler, {
|
|
123
|
+
id: 'clawsec-tool-result-persist',
|
|
124
|
+
priority: 100,
|
|
125
|
+
enabled: true,
|
|
126
|
+
});
|
|
127
|
+
state.initialized = true;
|
|
128
|
+
api.log('info', '[clawsec] All hooks registered successfully');
|
|
129
|
+
// Return cleanup function
|
|
130
|
+
return () => deactivate();
|
|
131
|
+
}
|
|
132
|
+
/**
|
|
133
|
+
* Deactivates the Clawsec security plugin and unregisters all hooks.
|
|
134
|
+
*/
|
|
135
|
+
export function deactivate() {
|
|
136
|
+
if (!state.initialized) {
|
|
137
|
+
return;
|
|
138
|
+
}
|
|
139
|
+
const api = state.api;
|
|
140
|
+
if (api) {
|
|
141
|
+
api.log('info', '[clawsec] Deactivating Clawsec Security Plugin');
|
|
142
|
+
// Unregister all hooks
|
|
143
|
+
api.unregisterHook('before-tool-call', 'clawsec-before-tool-call');
|
|
144
|
+
api.unregisterHook('before-agent-start', 'clawsec-before-agent-start');
|
|
145
|
+
api.unregisterHook('tool-result-persist', 'clawsec-tool-result-persist');
|
|
146
|
+
api.log('info', '[clawsec] All hooks unregistered');
|
|
147
|
+
}
|
|
148
|
+
// Reset state
|
|
149
|
+
state.api = null;
|
|
150
|
+
state.config = null;
|
|
151
|
+
state.initialized = false;
|
|
152
|
+
state.handlers.beforeToolCall = null;
|
|
153
|
+
state.handlers.beforeAgentStart = null;
|
|
154
|
+
state.handlers.toolResultPersist = null;
|
|
155
|
+
}
|
|
156
|
+
/**
|
|
157
|
+
* Check if the plugin is currently active
|
|
158
|
+
*/
|
|
159
|
+
export function isActive() {
|
|
160
|
+
return state.initialized;
|
|
161
|
+
}
|
|
162
|
+
/**
|
|
163
|
+
* Get the current plugin state (for testing/debugging)
|
|
164
|
+
*/
|
|
165
|
+
export function getState() {
|
|
166
|
+
return { ...state };
|
|
167
|
+
}
|
|
168
|
+
// =============================================================================
|
|
169
|
+
// CONFIG SCHEMA
|
|
170
|
+
// =============================================================================
|
|
171
|
+
/**
|
|
172
|
+
* JSON Schema for plugin configuration (matches openclaw.plugin.json)
|
|
173
|
+
*/
|
|
174
|
+
export const pluginConfigSchema = {
|
|
175
|
+
type: 'object',
|
|
176
|
+
properties: {
|
|
177
|
+
configPath: {
|
|
178
|
+
type: 'string',
|
|
179
|
+
default: './clawsec.yaml',
|
|
180
|
+
description: 'Path to the Clawsec YAML configuration file',
|
|
181
|
+
},
|
|
182
|
+
enabled: {
|
|
183
|
+
type: 'boolean',
|
|
184
|
+
default: true,
|
|
185
|
+
description: 'Whether the security plugin is enabled',
|
|
186
|
+
},
|
|
187
|
+
logLevel: {
|
|
188
|
+
type: 'string',
|
|
189
|
+
enum: ['debug', 'info', 'warn', 'error'],
|
|
190
|
+
default: 'info',
|
|
191
|
+
description: 'Logging verbosity level',
|
|
192
|
+
},
|
|
193
|
+
},
|
|
194
|
+
additionalProperties: false,
|
|
195
|
+
};
|
|
196
|
+
// =============================================================================
|
|
197
|
+
// REGISTER METHOD (OpenClaw Plugin API)
|
|
198
|
+
// =============================================================================
|
|
199
|
+
/**
|
|
200
|
+
* Register method for OpenClaw plugin system.
|
|
201
|
+
* This is the entry point called by OpenClaw when loading the plugin.
|
|
202
|
+
*
|
|
203
|
+
* @param api - The OpenClaw plugin API
|
|
204
|
+
*/
|
|
205
|
+
function register(api) {
|
|
206
|
+
activate(api);
|
|
207
|
+
}
|
|
208
|
+
// =============================================================================
|
|
209
|
+
// DEFAULT EXPORT
|
|
210
|
+
// =============================================================================
|
|
211
|
+
// Default export for OpenClaw plugin system
|
|
212
|
+
export default {
|
|
213
|
+
id: PLUGIN_ID,
|
|
214
|
+
name: PLUGIN_NAME,
|
|
215
|
+
version: VERSION,
|
|
216
|
+
configSchema: pluginConfigSchema,
|
|
217
|
+
register,
|
|
218
|
+
// Keep for backward compatibility
|
|
219
|
+
activate,
|
|
220
|
+
deactivate,
|
|
221
|
+
};
|
|
222
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAC/B,MAAM,CAAC,MAAM,SAAS,GAAG,SAAS,CAAC;AACnC,MAAM,CAAC,MAAM,WAAW,GAAG,yBAAyB,CAAC;AAyMrD,MAAM,KAAK,GAAgB;IACzB,GAAG,EAAE,IAAI;IACT,MAAM,EAAE,IAAI;IACZ,WAAW,EAAE,KAAK;IAClB,QAAQ,EAAE;QACR,cAAc,EAAE,IAAI;QACpB,gBAAgB,EAAE,IAAI;QACtB,iBAAiB,EAAE,IAAI;KACxB;CACF,CAAC;AAEF,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,qBAAqB,GAA0B,KAAK,EACxD,OAAwB,EACO,EAAE;IACjC,uCAAuC;IACvC,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,+BAA+B,OAAO,CAAC,QAAQ,EAAE,EAAE;YACxE,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,oCAAoC;IACpC,qDAAqD;IACrD,OAAO;QACL,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,uBAAuB,GAA4B,KAAK,EAC5D,OAA0B,EACO,EAAE;IACnC,uCAAuC;IACvC,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,8BAA8B,EAAE;YACrD,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,iEAAiE;IACjE,mDAAmD;IACnD,MAAM,gBAAgB,GAAG;;;;;;CAM1B,CAAC;IAEA,OAAO;QACL,oBAAoB,EAAE,gBAAgB;KACvC,CAAC;AACJ,CAAC,CAAC;AAEF;;;GAGG;AACH,MAAM,wBAAwB,GAA6B,KAAK,EAC9D,OAA0B,EACQ,EAAE;IACpC,uCAAuC;IACvC,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,QAAQ,KAAK,OAAO,EAAE,CAAC;QACpD,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,kCAAkC,OAAO,CAAC,QAAQ,EAAE,EAAE;YAC3E,SAAS,EAAE,OAAO,CAAC,SAAS;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,qDAAqD;IACrD,OAAO;QACL,KAAK,EAAE,IAAI;KACZ,CAAC;AACJ,CAAC,CAAC;AAEF,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAsB;IAC7C,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,8CAA8C,CAAC,CAAC;QAChE,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;IAED,iCAAiC;IACjC,KAAK,CAAC,GAAG,GAAG,GAAG,CAAC;IAChB,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,SAAS,EAAE,CAAC;IAE/B,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,iDAAiD,OAAO,EAAE,CAAC,CAAC;IAE5E,6BAA6B;IAC7B,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,EAAE,CAAC;QACpC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;QAClE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;QACzB,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;IAED,2BAA2B;IAC3B,KAAK,CAAC,QAAQ,CAAC,cAAc,GAAG,qBAAqB,CAAC;IACtD,KAAK,CAAC,QAAQ,CAAC,gBAAgB,GAAG,uBAAuB,CAAC;IAC1D,KAAK,CAAC,QAAQ,CAAC,iBAAiB,GAAG,wBAAwB,CAAC;IAE5D,+BAA+B;IAC/B,GAAG,CAAC,YAAY,CAAC,kBAAkB,EAAE,qBAAqB,EAAE;QAC1D,EAAE,EAAE,0BAA0B;QAC9B,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,GAAG,CAAC,YAAY,CAAC,oBAAoB,EAAE,uBAAuB,EAAE;QAC9D,EAAE,EAAE,4BAA4B;QAChC,QAAQ,EAAE,EAAE;QACZ,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,GAAG,CAAC,YAAY,CAAC,qBAAqB,EAAE,wBAAwB,EAAE;QAChE,EAAE,EAAE,6BAA6B;QACjC,QAAQ,EAAE,GAAG;QACb,OAAO,EAAE,IAAI;KACd,CAAC,CAAC;IAEH,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC;IACzB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAC;IAE/D,0BAA0B;IAC1B,OAAO,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QACvB,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,GAAG,EAAE,CAAC;QACR,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,gDAAgD,CAAC,CAAC;QAElE,uBAAuB;QACvB,GAAG,CAAC,cAAc,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,CAAC;QACnE,GAAG,CAAC,cAAc,CAAC,oBAAoB,EAAE,4BAA4B,CAAC,CAAC;QACvE,GAAG,CAAC,cAAc,CAAC,qBAAqB,EAAE,6BAA6B,CAAC,CAAC;QAEzE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,kCAAkC,CAAC,CAAC;IACtD,CAAC;IAED,cAAc;IACd,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;IACjB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,WAAW,GAAG,KAAK,CAAC;IAC1B,KAAK,CAAC,QAAQ,CAAC,cAAc,GAAG,IAAI,CAAC;IACrC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,GAAG,IAAI,CAAC;IACvC,KAAK,CAAC,QAAQ,CAAC,iBAAiB,GAAG,IAAI,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ;IACtB,OAAO,KAAK,CAAC,WAAW,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ;IACtB,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,gFAAgF;AAChF,gBAAgB;AAChB,gFAAgF;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,IAAI,EAAE,QAAQ;IACd,UAAU,EAAE;QACV,UAAU,EAAE;YACV,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,gBAAgB;YACzB,WAAW,EAAE,6CAA6C;SAC3D;QACD,OAAO,EAAE;YACP,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,wCAAwC;SACtD;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;YACxC,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,yBAAyB;SACvC;KACF;IACD,oBAAoB,EAAE,KAAK;CACnB,CAAC;AAEX,gFAAgF;AAChF,wCAAwC;AACxC,gFAAgF;AAEhF;;;;;GAKG;AACH,SAAS,QAAQ,CAAC,GAAsB;IACtC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChB,CAAC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,4CAA4C;AAC5C,eAAe;IACb,EAAE,EAAE,SAAS;IACb,IAAI,EAAE,WAAW;IACjB,OAAO,EAAE,OAAO;IAChB,YAAY,EAAE,kBAAkB;IAChC,QAAQ;IACR,kCAAkC;IAClC,QAAQ;IACR,UAAU;CACX,CAAC"}
|
|
@@ -0,0 +1,10 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Discord Notification Integration
|
|
3
|
+
* Sends security event notifications to Discord via webhooks
|
|
4
|
+
*/
|
|
5
|
+
import type { DiscordConfig, NotificationSender } from './types.js';
|
|
6
|
+
/**
|
|
7
|
+
* Create a Discord notification sender
|
|
8
|
+
*/
|
|
9
|
+
export declare function createDiscordSender(config: DiscordConfig): NotificationSender;
|
|
10
|
+
//# sourceMappingURL=discord.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"discord.d.ts","sourceRoot":"","sources":["../../../src/notifications/discord.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EACV,aAAa,EAGb,kBAAkB,EAEnB,MAAM,YAAY,CAAC;AA8IpB;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,aAAa,GAAG,kBAAkB,CA+F7E"}
|