fastgrc-openclaw 1.0.29 → 1.0.32

package/dist/bin.js

@@ -95,26 +95,9 @@ args: ${JSON.stringify(args)}`;
 
 // src/plugin.ts
 var net = __toESM(require("net"));
-var crypto = __toESM(require("crypto"));
 var fs2 = __toESM(require("fs"));
 var os2 = __toESM(require("os"));
 var path2 = __toESM(require("path"));
-function sign(payload, token) {
-  const nonce = crypto.randomBytes(16).toString("hex");
-  const ts = Math.floor(Date.now() / 1e3).toString();
-  const body = JSON.stringify(payload);
-  const mac = crypto.createHmac("sha256", Buffer.from(token, "base64")).update(`${nonce}:${ts}:${body}`).digest("hex");
-  return { ...payload, nonce, timestamp: ts, hmac: mac };
-}
-function verifyHmac(req, token) {
-  try {
-    const { nonce, timestamp, hmac, ...rest } = req;
-    const expected = crypto.createHmac("sha256", Buffer.from(token, "base64")).update(`${nonce}:${timestamp}:${JSON.stringify(rest)}`).digest("hex");
-    return hmac === expected;
-  } catch {
-    return false;
-  }
-}
 function readExecApprovalsConfig() {
   const cfgPath = path2.join(os2.homedir(), ".openclaw", "exec-approvals.json");
   try {
@@ -123,53 +106,80 @@ function readExecApprovalsConfig() {
     return null;
   }
 }
-function startExecApprovalsClient(apiKey, policyId, baseUrl) {
+function startExecApprovalsServer(apiKey, policyId, baseUrl) {
   const cfg = readExecApprovalsConfig();
-  if (!cfg?.socket?.path || !cfg?.socket?.token) return;
-  const { path: sockPath, token } = cfg.socket;
-  function connect() {
-    const client = net.createConnection(sockPath);
+  if (!cfg?.socket?.path || !cfg?.socket?.token) {
+    console.warn("[fastgrc] exec-approvals: no socket config found \u2014 webchat execs will not be evaluated");
+    return;
+  }
+  const { path: sockPath, token: configToken } = cfg.socket;
+  try {
+    fs2.unlinkSync(sockPath);
+  } catch {
+  }
+  const server = net.createServer((conn) => {
     let buffer = "";
-    client.on("connect", () => {
-      console.log("[fastgrc] exec-approvals socket connected");
-    });
-    client.on("data", async (buf) => {
-      buffer += buf.toString();
-      let req;
+    conn.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const idx = buffer.indexOf("\n");
+      if (idx === -1) return;
+      const line = buffer.slice(0, idx).trim();
+      buffer = "";
+      if (!line) {
+        conn.end();
+        return;
+      }
+      let msg;
       try {
-        req = JSON.parse(buffer);
+        msg = JSON.parse(line);
       } catch {
+        conn.end();
         return;
       }
-      buffer = "";
-      if (!verifyHmac(req, token)) {
-        console.warn("[fastgrc] exec-approvals: HMAC verification failed \u2014 ignoring request");
+      if (msg.type !== "request") {
+        conn.end();
         return;
       }
-      let decision = "allow-once";
-      try {
-        const result = await evaluate({
-          toolName: "Exec",
-          args: { command: req.command, rawCommand: req.rawCommand, cwd: req.cwd },
-          agentId: req.agentId,
-          apiKey,
-          policyId,
-          baseUrl
-        });
+      if (msg.token !== configToken) {
+        console.warn("[fastgrc] exec-approvals: token mismatch \u2014 failing open. Restart fastgrc-approvals service if this persists.");
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
+        return;
+      }
+      const req = msg.request ?? {};
+      const command = String(req.command ?? req.commandPreview ?? "unknown");
+      const agentId = req.agentId || void 0;
+      evaluate({
+        toolName: "Exec",
+        args: { command, cwd: req.cwd },
+        agentId,
+        apiKey,
+        policyId,
+        baseUrl
+      }).then((result) => {
+        let decision = "allow-once";
         if (result && (result.decision === "block" || result.decision === "require_approval")) {
           decision = "deny";
-          const msg = result.policyContext?.matchedRule ? `[fastgrc] exec blocked: [${result.policyContext.matchedRule}] ${result.reasoning}` : `[fastgrc] exec blocked: ${result.reasoning}`;
-          console.warn(msg);
+          const rule = result.policyContext?.matchedRule;
+          console.warn(rule ? `[fastgrc] exec blocked: [${rule}] ${result.reasoning}` : `[fastgrc] exec blocked: ${result.reasoning}`);
         }
-      } catch {
-      }
-      const response = sign({ approvalId: req.approvalId, decision }, token);
-      client.write(JSON.stringify(response));
+        conn.end(JSON.stringify({ type: "decision", decision }) + "\n");
+      }).catch(() => {
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
+      });
     });
-    client.on("error", () => setTimeout(connect, 5e3));
-    client.on("close", () => setTimeout(connect, 5e3));
-  }
-  connect();
+    conn.on("error", () => {
+    });
+  });
+  server.listen(sockPath, () => {
+    try {
+      fs2.chmodSync(sockPath, 384);
+    } catch {
+    }
+    console.log(`[fastgrc] exec-approvals server listening on ${sockPath}`);
+  });
+  server.on("error", (err) => {
+    console.warn(`[fastgrc] exec-approvals server error: ${err.message}`);
+  });
 }
 
 // src/bin.ts
@@ -279,6 +289,24 @@ function doUninstallHook(targetDir) {
 `);
   }
 }
+async function validatePolicy(apiKey, policyId, baseUrl = "https://app.fastgrc.ai") {
+  try {
+    const controller = new AbortController();
+    setTimeout(() => controller.abort(), 5e3);
+    const res = await fetch(`${baseUrl.replace(/\/$/, "")}/api/v1/policy-router/policies/${encodeURIComponent(policyId)}`, {
+      headers: { "Authorization": `Bearer ${apiKey}` },
+      signal: controller.signal
+    });
+    if (res.status === 404) return { valid: false, error: "Policy not found \u2014 check the ID belongs to your account." };
+    if (res.status === 401) return { valid: false, error: "Invalid API key." };
+    if (!res.ok) return { valid: false, error: `API returned ${res.status}` };
+    const policy = await res.json();
+    return { valid: true, name: policy.name };
+  } catch (err) {
+    const reason = err instanceof Error && err.name === "AbortError" ? "timeout" : String(err);
+    return { valid: false, error: `Could not reach FastGRC API (${reason}) \u2014 skipping validation.` };
+  }
+}
 function doConfigureExecApprovals() {
   const cfgPath = path3.join(os3.homedir(), ".openclaw", "exec-approvals.json");
   if (!fs3.existsSync(cfgPath)) {
@@ -294,9 +322,9 @@ function doConfigureExecApprovals() {
   const updated = {
     ...existing,
     defaults: {
-      security: "deny",
+      security: "ask",
       ask: "always",
-      askFallback: "deny",
+      askFallback: "allow",
       autoAllowSkills: false
     }
   };
@@ -338,11 +366,29 @@ if (cmd === "set-policy") {
     process.stderr.write("Usage: fastgrc-hook set-policy <policy-id>\n");
     process.exit(1);
   }
-  writeConfig({ ...readConfig(), policyId: arg });
-  process.stdout.write(`\u2713 FastGRC policy ID saved to ${CONFIG_PATH}
+  (async () => {
+    const apiKey = readConfig().apiKey ?? process.env.FASTGRC_API_KEY;
+    const baseUrl = process.env.FASTGRC_BASE_URL ?? "https://app.fastgrc.ai";
+    if (apiKey) {
+      process.stdout.write(`Verifying policy ${arg}\u2026
 `);
-  process.stdout.write('  Run "fastgrc-hook get-policy" to verify.\n');
-  process.exit(0);
+      const check = await validatePolicy(apiKey, arg, baseUrl);
+      if (!check.valid) {
+        process.stderr.write(`\u2717 ${check.error}
+`);
+        process.exit(1);
+      }
+      process.stdout.write(`\u2713 Policy verified: ${check.name}
+`);
+    } else {
+      process.stdout.write("\u26A0  No API key set \u2014 skipping policy verification.\n");
+    }
+    writeConfig({ ...readConfig(), policyId: arg });
+    process.stdout.write(`\u2713 FastGRC policy ID saved to ${CONFIG_PATH}
+`);
+    process.stdout.write('  Run "fastgrc-hook get-policy" to verify.\n');
+    process.exit(0);
+  })();
 }
 if (cmd === "get-policy") {
   const id = readConfig().policyId;
@@ -389,19 +435,33 @@ if (cmd === "setup") {
     process.stderr.write("Usage: fastgrc-hook setup --api-key <key> [--policy-id <id>]\n");
     process.exit(1);
   }
-  writeConfig({ ...readConfig(), apiKey: apiKeyArg });
-  process.stdout.write("\u2713 API key saved to ~/.fastgrc.json\n");
-  if (policyIdArg) {
-    writeConfig({ ...readConfig(), policyId: policyIdArg });
-    process.stdout.write("\u2713 Policy ID saved to ~/.fastgrc.json\n");
-  } else {
-    process.stdout.write("  (no policy ID \u2014 org-wide default will be used)\n");
-  }
-  doInstallHook(process.cwd());
-  doConfigureExecApprovals();
-  process.stdout.write("\n\u2713 Config, HOOK.md, and exec-approvals done.\n");
-  process.stdout.write('Restart OpenClaw, then run "fastgrc-hook test" to verify.\n');
-  process.exit(0);
+  (async () => {
+    const baseUrl = process.env.FASTGRC_BASE_URL ?? "https://app.fastgrc.ai";
+    writeConfig({ ...readConfig(), apiKey: apiKeyArg });
+    process.stdout.write("\u2713 API key saved to ~/.fastgrc.json\n");
+    if (policyIdArg) {
+      process.stdout.write(`Verifying policy ${policyIdArg}\u2026
+`);
+      const check = await validatePolicy(apiKeyArg, policyIdArg, baseUrl);
+      if (!check.valid) {
+        process.stderr.write(`\u2717 Policy not found: ${check.error}
+`);
+        process.stderr.write("  Pass a valid policy ID from your dashboard, or omit --policy-id to use the org default.\n");
+        process.exit(1);
+      }
+      process.stdout.write(`\u2713 Policy verified: ${check.name}
+`);
+      writeConfig({ ...readConfig(), policyId: policyIdArg });
+      process.stdout.write("\u2713 Policy ID saved to ~/.fastgrc.json\n");
+    } else {
+      process.stdout.write("  (no policy ID \u2014 org-wide default will be used)\n");
+    }
+    doInstallHook(process.cwd());
+    doConfigureExecApprovals();
+    process.stdout.write("\n\u2713 Config, HOOK.md, and exec-approvals done.\n");
+    process.stdout.write('Restart OpenClaw, then run "fastgrc-hook test" to verify.\n');
+    process.exit(0);
+  })();
 }
 if (cmd === "serve-approvals") {
   const apiKey = resolveApiKey();
@@ -420,7 +480,7 @@ if (cmd === "serve-approvals") {
   const baseUrl = process.env.FASTGRC_BASE_URL ?? "https://app.fastgrc.ai";
   process.stdout.write(`[fastgrc] serve-approvals running \u2014 listening on ${cfg.socket.path}
 `);
-  startExecApprovalsClient(apiKey, policyId, baseUrl);
+  startExecApprovalsServer(apiKey, policyId, baseUrl);
 }
 if (cmd === "uninstall") {
   const targetDir = arg || process.cwd();

package/dist/bin.mjs

@@ -72,26 +72,9 @@ args: ${JSON.stringify(args)}`;
 
 // src/plugin.ts
 import * as net from "net";
-import * as crypto from "crypto";
 import * as fs2 from "fs";
 import * as os2 from "os";
 import * as path2 from "path";
-function sign(payload, token) {
-  const nonce = crypto.randomBytes(16).toString("hex");
-  const ts = Math.floor(Date.now() / 1e3).toString();
-  const body = JSON.stringify(payload);
-  const mac = crypto.createHmac("sha256", Buffer.from(token, "base64")).update(`${nonce}:${ts}:${body}`).digest("hex");
-  return { ...payload, nonce, timestamp: ts, hmac: mac };
-}
-function verifyHmac(req, token) {
-  try {
-    const { nonce, timestamp, hmac, ...rest } = req;
-    const expected = crypto.createHmac("sha256", Buffer.from(token, "base64")).update(`${nonce}:${timestamp}:${JSON.stringify(rest)}`).digest("hex");
-    return hmac === expected;
-  } catch {
-    return false;
-  }
-}
 function readExecApprovalsConfig() {
   const cfgPath = path2.join(os2.homedir(), ".openclaw", "exec-approvals.json");
   try {
@@ -100,53 +83,80 @@ function readExecApprovalsConfig() {
     return null;
   }
 }
-function startExecApprovalsClient(apiKey, policyId, baseUrl) {
+function startExecApprovalsServer(apiKey, policyId, baseUrl) {
   const cfg = readExecApprovalsConfig();
-  if (!cfg?.socket?.path || !cfg?.socket?.token) return;
-  const { path: sockPath, token } = cfg.socket;
-  function connect() {
-    const client = net.createConnection(sockPath);
+  if (!cfg?.socket?.path || !cfg?.socket?.token) {
+    console.warn("[fastgrc] exec-approvals: no socket config found \u2014 webchat execs will not be evaluated");
+    return;
+  }
+  const { path: sockPath, token: configToken } = cfg.socket;
+  try {
+    fs2.unlinkSync(sockPath);
+  } catch {
+  }
+  const server = net.createServer((conn) => {
     let buffer = "";
-    client.on("connect", () => {
-      console.log("[fastgrc] exec-approvals socket connected");
-    });
-    client.on("data", async (buf) => {
-      buffer += buf.toString();
-      let req;
+    conn.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const idx = buffer.indexOf("\n");
+      if (idx === -1) return;
+      const line = buffer.slice(0, idx).trim();
+      buffer = "";
+      if (!line) {
+        conn.end();
+        return;
+      }
+      let msg;
       try {
-        req = JSON.parse(buffer);
+        msg = JSON.parse(line);
       } catch {
+        conn.end();
         return;
       }
-      buffer = "";
-      if (!verifyHmac(req, token)) {
-        console.warn("[fastgrc] exec-approvals: HMAC verification failed \u2014 ignoring request");
+      if (msg.type !== "request") {
+        conn.end();
         return;
       }
-      let decision = "allow-once";
-      try {
-        const result = await evaluate({
-          toolName: "Exec",
-          args: { command: req.command, rawCommand: req.rawCommand, cwd: req.cwd },
-          agentId: req.agentId,
-          apiKey,
-          policyId,
-          baseUrl
-        });
+      if (msg.token !== configToken) {
+        console.warn("[fastgrc] exec-approvals: token mismatch \u2014 failing open. Restart fastgrc-approvals service if this persists.");
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
+        return;
+      }
+      const req = msg.request ?? {};
+      const command = String(req.command ?? req.commandPreview ?? "unknown");
+      const agentId = req.agentId || void 0;
+      evaluate({
+        toolName: "Exec",
+        args: { command, cwd: req.cwd },
+        agentId,
+        apiKey,
+        policyId,
+        baseUrl
+      }).then((result) => {
+        let decision = "allow-once";
         if (result && (result.decision === "block" || result.decision === "require_approval")) {
           decision = "deny";
-          const msg = result.policyContext?.matchedRule ? `[fastgrc] exec blocked: [${result.policyContext.matchedRule}] ${result.reasoning}` : `[fastgrc] exec blocked: ${result.reasoning}`;
-          console.warn(msg);
+          const rule = result.policyContext?.matchedRule;
+          console.warn(rule ? `[fastgrc] exec blocked: [${rule}] ${result.reasoning}` : `[fastgrc] exec blocked: ${result.reasoning}`);
         }
-      } catch {
-      }
-      const response = sign({ approvalId: req.approvalId, decision }, token);
-      client.write(JSON.stringify(response));
+        conn.end(JSON.stringify({ type: "decision", decision }) + "\n");
+      }).catch(() => {
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
+      });
     });
-    client.on("error", () => setTimeout(connect, 5e3));
-    client.on("close", () => setTimeout(connect, 5e3));
-  }
-  connect();
+    conn.on("error", () => {
+    });
+  });
+  server.listen(sockPath, () => {
+    try {
+      fs2.chmodSync(sockPath, 384);
+    } catch {
+    }
+    console.log(`[fastgrc] exec-approvals server listening on ${sockPath}`);
+  });
+  server.on("error", (err) => {
+    console.warn(`[fastgrc] exec-approvals server error: ${err.message}`);
+  });
 }
 
 // src/bin.ts
@@ -256,6 +266,24 @@ function doUninstallHook(targetDir) {
 `);
   }
 }
+async function validatePolicy(apiKey, policyId, baseUrl = "https://app.fastgrc.ai") {
+  try {
+    const controller = new AbortController();
+    setTimeout(() => controller.abort(), 5e3);
+    const res = await fetch(`${baseUrl.replace(/\/$/, "")}/api/v1/policy-router/policies/${encodeURIComponent(policyId)}`, {
+      headers: { "Authorization": `Bearer ${apiKey}` },
+      signal: controller.signal
+    });
+    if (res.status === 404) return { valid: false, error: "Policy not found \u2014 check the ID belongs to your account." };
+    if (res.status === 401) return { valid: false, error: "Invalid API key." };
+    if (!res.ok) return { valid: false, error: `API returned ${res.status}` };
+    const policy = await res.json();
+    return { valid: true, name: policy.name };
+  } catch (err) {
+    const reason = err instanceof Error && err.name === "AbortError" ? "timeout" : String(err);
+    return { valid: false, error: `Could not reach FastGRC API (${reason}) \u2014 skipping validation.` };
+  }
+}
 function doConfigureExecApprovals() {
   const cfgPath = path3.join(os3.homedir(), ".openclaw", "exec-approvals.json");
   if (!fs3.existsSync(cfgPath)) {
@@ -271,9 +299,9 @@ function doConfigureExecApprovals() {
   const updated = {
     ...existing,
     defaults: {
-      security: "deny",
+      security: "ask",
       ask: "always",
-      askFallback: "deny",
+      askFallback: "allow",
       autoAllowSkills: false
     }
   };
@@ -315,11 +343,29 @@ if (cmd === "set-policy") {
     process.stderr.write("Usage: fastgrc-hook set-policy <policy-id>\n");
     process.exit(1);
   }
-  writeConfig({ ...readConfig(), policyId: arg });
-  process.stdout.write(`\u2713 FastGRC policy ID saved to ${CONFIG_PATH}
+  (async () => {
+    const apiKey = readConfig().apiKey ?? process.env.FASTGRC_API_KEY;
+    const baseUrl = process.env.FASTGRC_BASE_URL ?? "https://app.fastgrc.ai";
+    if (apiKey) {
+      process.stdout.write(`Verifying policy ${arg}\u2026
 `);
-  process.stdout.write('  Run "fastgrc-hook get-policy" to verify.\n');
-  process.exit(0);
+      const check = await validatePolicy(apiKey, arg, baseUrl);
+      if (!check.valid) {
+        process.stderr.write(`\u2717 ${check.error}
+`);
+        process.exit(1);
+      }
+      process.stdout.write(`\u2713 Policy verified: ${check.name}
+`);
+    } else {
+      process.stdout.write("\u26A0  No API key set \u2014 skipping policy verification.\n");
+    }
+    writeConfig({ ...readConfig(), policyId: arg });
+    process.stdout.write(`\u2713 FastGRC policy ID saved to ${CONFIG_PATH}
+`);
+    process.stdout.write('  Run "fastgrc-hook get-policy" to verify.\n');
+    process.exit(0);
+  })();
 }
 if (cmd === "get-policy") {
   const id = readConfig().policyId;
@@ -366,19 +412,33 @@ if (cmd === "setup") {
     process.stderr.write("Usage: fastgrc-hook setup --api-key <key> [--policy-id <id>]\n");
     process.exit(1);
   }
-  writeConfig({ ...readConfig(), apiKey: apiKeyArg });
-  process.stdout.write("\u2713 API key saved to ~/.fastgrc.json\n");
-  if (policyIdArg) {
-    writeConfig({ ...readConfig(), policyId: policyIdArg });
-    process.stdout.write("\u2713 Policy ID saved to ~/.fastgrc.json\n");
-  } else {
-    process.stdout.write("  (no policy ID \u2014 org-wide default will be used)\n");
-  }
-  doInstallHook(process.cwd());
-  doConfigureExecApprovals();
-  process.stdout.write("\n\u2713 Config, HOOK.md, and exec-approvals done.\n");
-  process.stdout.write('Restart OpenClaw, then run "fastgrc-hook test" to verify.\n');
-  process.exit(0);
+  (async () => {
+    const baseUrl = process.env.FASTGRC_BASE_URL ?? "https://app.fastgrc.ai";
+    writeConfig({ ...readConfig(), apiKey: apiKeyArg });
+    process.stdout.write("\u2713 API key saved to ~/.fastgrc.json\n");
+    if (policyIdArg) {
+      process.stdout.write(`Verifying policy ${policyIdArg}\u2026
+`);
+      const check = await validatePolicy(apiKeyArg, policyIdArg, baseUrl);
+      if (!check.valid) {
+        process.stderr.write(`\u2717 Policy not found: ${check.error}
+`);
+        process.stderr.write("  Pass a valid policy ID from your dashboard, or omit --policy-id to use the org default.\n");
+        process.exit(1);
+      }
+      process.stdout.write(`\u2713 Policy verified: ${check.name}
+`);
+      writeConfig({ ...readConfig(), policyId: policyIdArg });
+      process.stdout.write("\u2713 Policy ID saved to ~/.fastgrc.json\n");
+    } else {
+      process.stdout.write("  (no policy ID \u2014 org-wide default will be used)\n");
+    }
+    doInstallHook(process.cwd());
+    doConfigureExecApprovals();
+    process.stdout.write("\n\u2713 Config, HOOK.md, and exec-approvals done.\n");
+    process.stdout.write('Restart OpenClaw, then run "fastgrc-hook test" to verify.\n');
+    process.exit(0);
+  })();
 }
 if (cmd === "serve-approvals") {
   const apiKey = resolveApiKey();
@@ -397,7 +457,7 @@ if (cmd === "serve-approvals") {
   const baseUrl = process.env.FASTGRC_BASE_URL ?? "https://app.fastgrc.ai";
   process.stdout.write(`[fastgrc] serve-approvals running \u2014 listening on ${cfg.socket.path}
 `);
-  startExecApprovalsClient(apiKey, policyId, baseUrl);
+  startExecApprovalsServer(apiKey, policyId, baseUrl);
 }
 if (cmd === "uninstall") {
   const targetDir = arg || process.cwd();

package/dist/plugin.d.mts

@@ -5,7 +5,7 @@ interface ExecApprovalsConfig {
     };
 }
 declare function readExecApprovalsConfig(): ExecApprovalsConfig | null;
-declare function startExecApprovalsClient(apiKey: string, policyId?: string, baseUrl?: string): void;
+declare function startExecApprovalsServer(apiKey: string, policyId?: string, baseUrl?: string): void;
 declare const pluginEntry: {
     id: string;
     name: string;
@@ -13,4 +13,4 @@ declare const pluginEntry: {
     register(api: any): void;
 };
 
-export { pluginEntry as default, readExecApprovalsConfig, startExecApprovalsClient };
+export { pluginEntry as default, readExecApprovalsConfig, startExecApprovalsServer };

package/dist/plugin.d.ts

@@ -5,7 +5,7 @@ interface ExecApprovalsConfig {
     };
 }
 declare function readExecApprovalsConfig(): ExecApprovalsConfig | null;
-declare function startExecApprovalsClient(apiKey: string, policyId?: string, baseUrl?: string): void;
+declare function startExecApprovalsServer(apiKey: string, policyId?: string, baseUrl?: string): void;
 declare const pluginEntry: {
     id: string;
     name: string;
@@ -13,4 +13,4 @@ declare const pluginEntry: {
     register(api: any): void;
 };
 
-export { pluginEntry as default, readExecApprovalsConfig, startExecApprovalsClient };
+export { pluginEntry as default, readExecApprovalsConfig, startExecApprovalsServer };

package/dist/plugin.js

@@ -32,11 +32,10 @@ var plugin_exports = {};
 __export(plugin_exports, {
   default: () => plugin_default,
   readExecApprovalsConfig: () => readExecApprovalsConfig,
-  startExecApprovalsClient: () => startExecApprovalsClient
+  startExecApprovalsServer: () => startExecApprovalsServer
 });
 module.exports = __toCommonJS(plugin_exports);
 var net = __toESM(require("net"));
-var crypto = __toESM(require("crypto"));
 var fs2 = __toESM(require("fs"));
 var os2 = __toESM(require("os"));
 var path2 = __toESM(require("path"));
@@ -121,22 +120,6 @@ args: ${JSON.stringify(args)}`;
 // src/plugin.ts
 var DEFAULT_BASE_URL2 = "https://app.fastgrc.ai";
 var DEFAULT_TIMEOUT_MS2 = 3e3;
-function sign(payload, token) {
-  const nonce = crypto.randomBytes(16).toString("hex");
-  const ts = Math.floor(Date.now() / 1e3).toString();
-  const body = JSON.stringify(payload);
-  const mac = crypto.createHmac("sha256", Buffer.from(token, "base64")).update(`${nonce}:${ts}:${body}`).digest("hex");
-  return { ...payload, nonce, timestamp: ts, hmac: mac };
-}
-function verifyHmac(req, token) {
-  try {
-    const { nonce, timestamp, hmac, ...rest } = req;
-    const expected = crypto.createHmac("sha256", Buffer.from(token, "base64")).update(`${nonce}:${timestamp}:${JSON.stringify(rest)}`).digest("hex");
-    return hmac === expected;
-  } catch {
-    return false;
-  }
-}
 function readExecApprovalsConfig() {
   const cfgPath = path2.join(os2.homedir(), ".openclaw", "exec-approvals.json");
   try {
@@ -145,53 +128,80 @@ function readExecApprovalsConfig() {
     return null;
   }
 }
-function startExecApprovalsClient(apiKey, policyId, baseUrl) {
+function startExecApprovalsServer(apiKey, policyId, baseUrl) {
   const cfg = readExecApprovalsConfig();
-  if (!cfg?.socket?.path || !cfg?.socket?.token) return;
-  const { path: sockPath, token } = cfg.socket;
-  function connect() {
-    const client = net.createConnection(sockPath);
+  if (!cfg?.socket?.path || !cfg?.socket?.token) {
+    console.warn("[fastgrc] exec-approvals: no socket config found \u2014 webchat execs will not be evaluated");
+    return;
+  }
+  const { path: sockPath, token: configToken } = cfg.socket;
+  try {
+    fs2.unlinkSync(sockPath);
+  } catch {
+  }
+  const server = net.createServer((conn) => {
     let buffer = "";
-    client.on("connect", () => {
-      console.log("[fastgrc] exec-approvals socket connected");
-    });
-    client.on("data", async (buf) => {
-      buffer += buf.toString();
-      let req;
+    conn.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const idx = buffer.indexOf("\n");
+      if (idx === -1) return;
+      const line = buffer.slice(0, idx).trim();
+      buffer = "";
+      if (!line) {
+        conn.end();
+        return;
+      }
+      let msg;
       try {
-        req = JSON.parse(buffer);
+        msg = JSON.parse(line);
       } catch {
+        conn.end();
         return;
       }
-      buffer = "";
-      if (!verifyHmac(req, token)) {
-        console.warn("[fastgrc] exec-approvals: HMAC verification failed \u2014 ignoring request");
+      if (msg.type !== "request") {
+        conn.end();
         return;
       }
-      let decision = "allow-once";
-      try {
-        const result = await evaluate({
-          toolName: "Exec",
-          args: { command: req.command, rawCommand: req.rawCommand, cwd: req.cwd },
-          agentId: req.agentId,
-          apiKey,
-          policyId,
-          baseUrl
-        });
+      if (msg.token !== configToken) {
+        console.warn("[fastgrc] exec-approvals: token mismatch \u2014 failing open. Restart fastgrc-approvals service if this persists.");
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
+        return;
+      }
+      const req = msg.request ?? {};
+      const command = String(req.command ?? req.commandPreview ?? "unknown");
+      const agentId = req.agentId || void 0;
+      evaluate({
+        toolName: "Exec",
+        args: { command, cwd: req.cwd },
+        agentId,
+        apiKey,
+        policyId,
+        baseUrl
+      }).then((result) => {
+        let decision = "allow-once";
         if (result && (result.decision === "block" || result.decision === "require_approval")) {
           decision = "deny";
-          const msg = result.policyContext?.matchedRule ? `[fastgrc] exec blocked: [${result.policyContext.matchedRule}] ${result.reasoning}` : `[fastgrc] exec blocked: ${result.reasoning}`;
-          console.warn(msg);
+          const rule = result.policyContext?.matchedRule;
+          console.warn(rule ? `[fastgrc] exec blocked: [${rule}] ${result.reasoning}` : `[fastgrc] exec blocked: ${result.reasoning}`);
         }
-      } catch {
-      }
-      const response = sign({ approvalId: req.approvalId, decision }, token);
-      client.write(JSON.stringify(response));
+        conn.end(JSON.stringify({ type: "decision", decision }) + "\n");
+      }).catch(() => {
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
+      });
     });
-    client.on("error", () => setTimeout(connect, 5e3));
-    client.on("close", () => setTimeout(connect, 5e3));
-  }
-  connect();
+    conn.on("error", () => {
+    });
+  });
+  server.listen(sockPath, () => {
+    try {
+      fs2.chmodSync(sockPath, 384);
+    } catch {
+    }
+    console.log(`[fastgrc] exec-approvals server listening on ${sockPath}`);
+  });
+  server.on("error", (err) => {
+    console.warn(`[fastgrc] exec-approvals server error: ${err.message}`);
+  });
 }
 var pluginEntry = {
   id: "fastgrc",
@@ -237,13 +247,13 @@ var pluginEntry = {
       }
       return void 0;
     });
-    startExecApprovalsClient(apiKey, policyId, DEFAULT_BASE_URL2);
+    startExecApprovalsServer(apiKey, policyId, DEFAULT_BASE_URL2);
   }
 };
 var plugin_default = pluginEntry;
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   readExecApprovalsConfig,
-  startExecApprovalsClient
+  startExecApprovalsServer
 });
 module.exports = module.exports.default ?? module.exports;

package/dist/plugin.mjs

@@ -1,6 +1,5 @@
 // src/plugin.ts
 import * as net from "net";
-import * as crypto from "crypto";
 import * as fs2 from "fs";
 import * as os2 from "os";
 import * as path2 from "path";
@@ -85,22 +84,6 @@ args: ${JSON.stringify(args)}`;
 // src/plugin.ts
 var DEFAULT_BASE_URL2 = "https://app.fastgrc.ai";
 var DEFAULT_TIMEOUT_MS2 = 3e3;
-function sign(payload, token) {
-  const nonce = crypto.randomBytes(16).toString("hex");
-  const ts = Math.floor(Date.now() / 1e3).toString();
-  const body = JSON.stringify(payload);
-  const mac = crypto.createHmac("sha256", Buffer.from(token, "base64")).update(`${nonce}:${ts}:${body}`).digest("hex");
-  return { ...payload, nonce, timestamp: ts, hmac: mac };
-}
-function verifyHmac(req, token) {
-  try {
-    const { nonce, timestamp, hmac, ...rest } = req;
-    const expected = crypto.createHmac("sha256", Buffer.from(token, "base64")).update(`${nonce}:${timestamp}:${JSON.stringify(rest)}`).digest("hex");
-    return hmac === expected;
-  } catch {
-    return false;
-  }
-}
 function readExecApprovalsConfig() {
   const cfgPath = path2.join(os2.homedir(), ".openclaw", "exec-approvals.json");
   try {
@@ -109,53 +92,80 @@ function readExecApprovalsConfig() {
     return null;
   }
 }
-function startExecApprovalsClient(apiKey, policyId, baseUrl) {
+function startExecApprovalsServer(apiKey, policyId, baseUrl) {
   const cfg = readExecApprovalsConfig();
-  if (!cfg?.socket?.path || !cfg?.socket?.token) return;
-  const { path: sockPath, token } = cfg.socket;
-  function connect() {
-    const client = net.createConnection(sockPath);
+  if (!cfg?.socket?.path || !cfg?.socket?.token) {
+    console.warn("[fastgrc] exec-approvals: no socket config found \u2014 webchat execs will not be evaluated");
+    return;
+  }
+  const { path: sockPath, token: configToken } = cfg.socket;
+  try {
+    fs2.unlinkSync(sockPath);
+  } catch {
+  }
+  const server = net.createServer((conn) => {
     let buffer = "";
-    client.on("connect", () => {
-      console.log("[fastgrc] exec-approvals socket connected");
-    });
-    client.on("data", async (buf) => {
-      buffer += buf.toString();
-      let req;
+    conn.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      const idx = buffer.indexOf("\n");
+      if (idx === -1) return;
+      const line = buffer.slice(0, idx).trim();
+      buffer = "";
+      if (!line) {
+        conn.end();
+        return;
+      }
+      let msg;
       try {
-        req = JSON.parse(buffer);
+        msg = JSON.parse(line);
       } catch {
+        conn.end();
         return;
       }
-      buffer = "";
-      if (!verifyHmac(req, token)) {
-        console.warn("[fastgrc] exec-approvals: HMAC verification failed \u2014 ignoring request");
+      if (msg.type !== "request") {
+        conn.end();
         return;
       }
-      let decision = "allow-once";
-      try {
-        const result = await evaluate({
-          toolName: "Exec",
-          args: { command: req.command, rawCommand: req.rawCommand, cwd: req.cwd },
-          agentId: req.agentId,
-          apiKey,
-          policyId,
-          baseUrl
-        });
+      if (msg.token !== configToken) {
+        console.warn("[fastgrc] exec-approvals: token mismatch \u2014 failing open. Restart fastgrc-approvals service if this persists.");
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
+        return;
+      }
+      const req = msg.request ?? {};
+      const command = String(req.command ?? req.commandPreview ?? "unknown");
+      const agentId = req.agentId || void 0;
+      evaluate({
+        toolName: "Exec",
+        args: { command, cwd: req.cwd },
+        agentId,
+        apiKey,
+        policyId,
+        baseUrl
+      }).then((result) => {
+        let decision = "allow-once";
         if (result && (result.decision === "block" || result.decision === "require_approval")) {
           decision = "deny";
-          const msg = result.policyContext?.matchedRule ? `[fastgrc] exec blocked: [${result.policyContext.matchedRule}] ${result.reasoning}` : `[fastgrc] exec blocked: ${result.reasoning}`;
-          console.warn(msg);
+          const rule = result.policyContext?.matchedRule;
+          console.warn(rule ? `[fastgrc] exec blocked: [${rule}] ${result.reasoning}` : `[fastgrc] exec blocked: ${result.reasoning}`);
         }
-      } catch {
-      }
-      const response = sign({ approvalId: req.approvalId, decision }, token);
-      client.write(JSON.stringify(response));
+        conn.end(JSON.stringify({ type: "decision", decision }) + "\n");
+      }).catch(() => {
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
+      });
     });
-    client.on("error", () => setTimeout(connect, 5e3));
-    client.on("close", () => setTimeout(connect, 5e3));
-  }
-  connect();
+    conn.on("error", () => {
+    });
+  });
+  server.listen(sockPath, () => {
+    try {
+      fs2.chmodSync(sockPath, 384);
+    } catch {
+    }
+    console.log(`[fastgrc] exec-approvals server listening on ${sockPath}`);
+  });
+  server.on("error", (err) => {
+    console.warn(`[fastgrc] exec-approvals server error: ${err.message}`);
+  });
 }
 var pluginEntry = {
   id: "fastgrc",
@@ -201,12 +211,12 @@ var pluginEntry = {
       }
       return void 0;
     });
-    startExecApprovalsClient(apiKey, policyId, DEFAULT_BASE_URL2);
+    startExecApprovalsServer(apiKey, policyId, DEFAULT_BASE_URL2);
   }
 };
 var plugin_default = pluginEntry;
 export {
   plugin_default as default,
   readExecApprovalsConfig,
-  startExecApprovalsClient
+  startExecApprovalsServer
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastgrc-openclaw",
-  "version": "1.0.29",
+  "version": "1.0.32",
   "description": "FastGRC agent compliance plugin for OpenClaw — evaluates every tool call against your policy before it executes",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",