entroly-openclaw 1.0.80 → 1.0.82

package/README.md

@@ -22,12 +22,33 @@ Install the Python engine, then install the publicly verifiable OpenClaw plugin
 package from npm:
 
 ```bash
-pip install "entroly>=1.0.80"
+pip install "entroly>=1.0.82"
 openclaw plugins install npm:entroly-openclaw
 openclaw plugins enable entroly
 openclaw gateway restart
 ```
 
+The plugin starts a local Python subprocess for context assembly. That child
+receives only the operating-system paths and Entroly-local settings it needs;
+provider API keys, cloud credentials, registry tokens, and unrelated host
+environment variables are not inherited. OpenClaw remains the sole owner of
+provider authentication.
+
+Local receipts are enabled by default because they make context decisions
+auditable. They contain hashes, counts, estimates, warnings, and decision
+metadata rather than conversation text, and are bounded by file-count and byte
+quotas. To opt out of persistence, set:
+
+```json5
+{
+  plugins: {
+    entries: {
+      entroly: { config: { writeReceipts: false } }
+    }
+  }
+}
+```
+
 ClawHub is an optional registry source. Use it only when
 `openclaw plugins search "entroly"` returns a current public package and its
 install hint. Do not guess a ClawHub slug or treat unpublished metadata as an
@@ -36,7 +57,7 @@ installable release.
 From an Entroly source checkout:
 
 ```bash
-pip install "entroly>=1.0.80"
+pip install "entroly>=1.0.82"
 openclaw plugins install ./integrations/openclaw
 openclaw plugins enable entroly
 openclaw gateway restart
@@ -97,8 +118,10 @@ digest, native window, output reserve, safety reserve, and source.
 
 Context-budget discovery is local and enabled by default. It does not enable
 remote provider discovery or send credentials anywhere. Local Ollama/LM Studio
-and remote OpenRouter discovery remain separate operator opt-ins through
-Entroly's model-registry environment controls. Disable this fallback with
+discovery and a local `ENTROLY_MODEL_REGISTRY` override remain explicit
+operator controls. Remote OpenRouter discovery is deliberately unavailable
+inside the OpenClaw bridge because provider credentials do not cross the
+subprocess boundary. Disable local fallback with
 `autoDiscoverContextBudget: false`.
 
 For a custom model that neither OpenClaw nor trusted registry metadata can
@@ -211,6 +234,8 @@ archive receipts or raise `receiptMaxFiles` / `receiptMaxBytes` explicitly.
 
 ## Safety contract
 
+- Provider API keys and unrelated host secrets are removed from the local
+  Python bridge environment before it starts.
 - System and developer messages are never modified.
 - Signed text, thinking/reasoning, images, tool calls, tool-result metadata,
   opaque provider signatures, and unknown content blocks are never modified.

package/bridge-client.js

@@ -3,6 +3,51 @@ import readline from "node:readline";
 
 export const ENTROLY_BRIDGE_SCHEMA = "entroly.openclaw.bridge.v2";
 
+const BRIDGE_ENVIRONMENT_ALLOWLIST = new Set([
+  "APPDATA",
+  "COMSPEC",
+  "ENTROLY_AIR_GAP",
+  "ENTROLY_DISABLE_TELEMETRY",
+  "ENTROLY_DISCOVER_LOCAL_MODELS",
+  "ENTROLY_LMSTUDIO_BASE",
+  "ENTROLY_MODEL_DISCOVERY_MAX",
+  "ENTROLY_MODEL_DISCOVERY_TIMEOUT",
+  "ENTROLY_MODEL_REGISTRY",
+  "ENTROLY_OLLAMA_BASE",
+  "ENTROLY_OLLAMA_INSPECT_CONTEXT",
+  "ENTROLY_OPENCLAW_RECEIPT_KEY_FILE",
+  "ENTROLY_UNKNOWN_MODEL_CONTEXT",
+  "HOME",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "LOCALAPPDATA",
+  "PATH",
+  "PATHEXT",
+  "SYSTEMDRIVE",
+  "SYSTEMROOT",
+  "TEMP",
+  "TMP",
+  "TMPDIR",
+  "TZ",
+  "USERPROFILE",
+  "WINDIR",
+  "XDG_STATE_HOME",
+]);
+
+export function buildBridgeEnvironment(source = {}) {
+  return Object.fromEntries(
+    Object.entries(source).filter(
+      ([name, value]) =>
+        value !== undefined &&
+        value !== null &&
+        BRIDGE_ENVIRONMENT_ALLOWLIST.has(name.toUpperCase()),
+    ),
+  );
+}
+
 export function validateBridgeHealth(result) {
   if (
     !result ||
@@ -30,7 +75,7 @@ export class EntrolyBridgeClient {
     this.timeoutMs = timeoutMs;
     this.logger = logger;
     this.spawnProcess = spawnProcess;
-    this.environment = environment;
+    this.environment = buildBridgeEnvironment(environment);
     this.nextId = 1;
     this.pending = new Map();
     this.process = undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "entroly-openclaw",
-  "version": "1.0.80",
+  "version": "1.0.82",
   "description": "Provider-independent, auditable context engineering for every OpenClaw model route",
   "type": "module",
   "license": "Apache-2.0",

package/proof-hooks.js

@@ -6,15 +6,50 @@ function sha256(value) {
   return createHash("sha256").update(String(value), "utf8").digest("hex");
 }
 
-function safeDiagnostic(value, limit = 400) {
-  return String(value?.message ?? value ?? "unknown error")
+// Diagnostics can contain provider text, tool names, bridge errors, or recovered
+// material. Treat them as untrusted display data. Canonicalize before redaction
+// so format/control characters cannot be inserted into credential markers to
+// evade secret detection, then escape display syntax and truncate by code point.
+const DISPLAY_WHITESPACE = /[\t\n\r\f\v\u0085\u2028\u2029]+/gu;
+const UNSAFE_FOR_DISPLAY = /[\p{Cc}\p{Cf}\p{Zl}\p{Zp}]/gu;
+const MARKDOWN_DELIMITERS = /([\\`*_[\]{}()<>#+.!|~-])/g;
+const AUTH_SCHEME = /\b(Basic|Bearer)\s+[^\s,;]+/gi;
+const SECRET_FIELD =
+  /["']?\b(api[_-]?key|authorization|password|secret|token)\b["']?\s*[:=]\s*(?:"[^"]*(?:"|$)|'[^']*(?:'|$)|(?:Basic|Bearer)\s+[^\s,;]+|[^\s,;"']+)/gi;
+
+function diagnosticSource(value) {
+  try {
+    const candidate = value?.message ?? value ?? "unknown error";
+    return typeof candidate === "string" ? candidate : String(candidate);
+  } catch {
+    return "unknown error";
+  }
+}
+
+function normalizeDiagnosticText(value) {
+  return diagnosticSource(value)
+    .toWellFormed()
+    .normalize("NFKC")
+    .replace(DISPLAY_WHITESPACE, " ")
+    .replace(UNSAFE_FOR_DISPLAY, "")
     .replace(/\s+/g, " ")
-    .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [REDACTED]")
-    .replace(
-      /\b(api[_-]?key|authorization|password|secret|token)\b\s*[:=]\s*["']?[^\s,;"']+/gi,
-      "$1=[REDACTED]",
-    )
-    .slice(0, limit);
+    .trim();
+}
+
+function sanitizeDisplayText(value, limit = 400) {
+  if (typeof value !== "string" || limit <= 0) return "";
+  const escaped = value.replace(MARKDOWN_DELIMITERS, "\\$1");
+  const codePoints = [...escaped];
+  if (codePoints.length <= limit) return escaped;
+  if (limit === 1) return "…";
+  return `${codePoints.slice(0, limit - 1).join("")}…`;
+}
+
+function safeDiagnostic(value, limit = 400) {
+  const redacted = normalizeDiagnosticText(value)
+    .replace(AUTH_SCHEME, "$1 [REDACTED]")
+    .replace(SECRET_FIELD, "$1=[REDACTED]");
+  return sanitizeDisplayText(redacted, limit);
 }
 
 function positiveInteger(value, fallback, maximum) {