fastgrc-openclaw 1.0.30 → 1.0.32

package/dist/bin.js

@@ -126,18 +126,23 @@ function startExecApprovalsServer(apiKey, policyId, baseUrl) {
       const line = buffer.slice(0, idx).trim();
       buffer = "";
       if (!line) {
-        conn.destroy();
+        conn.end();
         return;
       }
       let msg;
       try {
         msg = JSON.parse(line);
       } catch {
-        conn.destroy();
+        conn.end();
         return;
       }
-      if (msg.type !== "request" || msg.token !== configToken) {
-        conn.destroy();
+      if (msg.type !== "request") {
+        conn.end();
+        return;
+      }
+      if (msg.token !== configToken) {
+        console.warn("[fastgrc] exec-approvals: token mismatch \u2014 failing open. Restart fastgrc-approvals service if this persists.");
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
         return;
       }
       const req = msg.request ?? {};
@@ -157,11 +162,9 @@ function startExecApprovalsServer(apiKey, policyId, baseUrl) {
           const rule = result.policyContext?.matchedRule;
           console.warn(rule ? `[fastgrc] exec blocked: [${rule}] ${result.reasoning}` : `[fastgrc] exec blocked: ${result.reasoning}`);
         }
-        conn.write(JSON.stringify({ type: "decision", decision }) + "\n");
-        conn.destroy();
+        conn.end(JSON.stringify({ type: "decision", decision }) + "\n");
       }).catch(() => {
-        conn.write(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
-        conn.destroy();
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
       });
     });
     conn.on("error", () => {
@@ -286,6 +289,24 @@ function doUninstallHook(targetDir) {
 `);
   }
 }
+async function validatePolicy(apiKey, policyId, baseUrl = "https://app.fastgrc.ai") {
+  try {
+    const controller = new AbortController();
+    setTimeout(() => controller.abort(), 5e3);
+    const res = await fetch(`${baseUrl.replace(/\/$/, "")}/api/v1/policy-router/policies/${encodeURIComponent(policyId)}`, {
+      headers: { "Authorization": `Bearer ${apiKey}` },
+      signal: controller.signal
+    });
+    if (res.status === 404) return { valid: false, error: "Policy not found \u2014 check the ID belongs to your account." };
+    if (res.status === 401) return { valid: false, error: "Invalid API key." };
+    if (!res.ok) return { valid: false, error: `API returned ${res.status}` };
+    const policy = await res.json();
+    return { valid: true, name: policy.name };
+  } catch (err) {
+    const reason = err instanceof Error && err.name === "AbortError" ? "timeout" : String(err);
+    return { valid: false, error: `Could not reach FastGRC API (${reason}) \u2014 skipping validation.` };
+  }
+}
 function doConfigureExecApprovals() {
   const cfgPath = path3.join(os3.homedir(), ".openclaw", "exec-approvals.json");
   if (!fs3.existsSync(cfgPath)) {
@@ -301,9 +322,9 @@ function doConfigureExecApprovals() {
   const updated = {
     ...existing,
     defaults: {
-      security: "deny",
+      security: "ask",
       ask: "always",
-      askFallback: "deny",
+      askFallback: "allow",
       autoAllowSkills: false
     }
   };
@@ -345,11 +366,29 @@ if (cmd === "set-policy") {
     process.stderr.write("Usage: fastgrc-hook set-policy <policy-id>\n");
     process.exit(1);
   }
-  writeConfig({ ...readConfig(), policyId: arg });
-  process.stdout.write(`\u2713 FastGRC policy ID saved to ${CONFIG_PATH}
+  (async () => {
+    const apiKey = readConfig().apiKey ?? process.env.FASTGRC_API_KEY;
+    const baseUrl = process.env.FASTGRC_BASE_URL ?? "https://app.fastgrc.ai";
+    if (apiKey) {
+      process.stdout.write(`Verifying policy ${arg}\u2026
 `);
-  process.stdout.write('  Run "fastgrc-hook get-policy" to verify.\n');
-  process.exit(0);
+      const check = await validatePolicy(apiKey, arg, baseUrl);
+      if (!check.valid) {
+        process.stderr.write(`\u2717 ${check.error}
+`);
+        process.exit(1);
+      }
+      process.stdout.write(`\u2713 Policy verified: ${check.name}
+`);
+    } else {
+      process.stdout.write("\u26A0  No API key set \u2014 skipping policy verification.\n");
+    }
+    writeConfig({ ...readConfig(), policyId: arg });
+    process.stdout.write(`\u2713 FastGRC policy ID saved to ${CONFIG_PATH}
+`);
+    process.stdout.write('  Run "fastgrc-hook get-policy" to verify.\n');
+    process.exit(0);
+  })();
 }
 if (cmd === "get-policy") {
   const id = readConfig().policyId;
@@ -396,19 +435,33 @@ if (cmd === "setup") {
     process.stderr.write("Usage: fastgrc-hook setup --api-key <key> [--policy-id <id>]\n");
     process.exit(1);
   }
-  writeConfig({ ...readConfig(), apiKey: apiKeyArg });
-  process.stdout.write("\u2713 API key saved to ~/.fastgrc.json\n");
-  if (policyIdArg) {
-    writeConfig({ ...readConfig(), policyId: policyIdArg });
-    process.stdout.write("\u2713 Policy ID saved to ~/.fastgrc.json\n");
-  } else {
-    process.stdout.write("  (no policy ID \u2014 org-wide default will be used)\n");
-  }
-  doInstallHook(process.cwd());
-  doConfigureExecApprovals();
-  process.stdout.write("\n\u2713 Config, HOOK.md, and exec-approvals done.\n");
-  process.stdout.write('Restart OpenClaw, then run "fastgrc-hook test" to verify.\n');
-  process.exit(0);
+  (async () => {
+    const baseUrl = process.env.FASTGRC_BASE_URL ?? "https://app.fastgrc.ai";
+    writeConfig({ ...readConfig(), apiKey: apiKeyArg });
+    process.stdout.write("\u2713 API key saved to ~/.fastgrc.json\n");
+    if (policyIdArg) {
+      process.stdout.write(`Verifying policy ${policyIdArg}\u2026
+`);
+      const check = await validatePolicy(apiKeyArg, policyIdArg, baseUrl);
+      if (!check.valid) {
+        process.stderr.write(`\u2717 Policy not found: ${check.error}
+`);
+        process.stderr.write("  Pass a valid policy ID from your dashboard, or omit --policy-id to use the org default.\n");
+        process.exit(1);
+      }
+      process.stdout.write(`\u2713 Policy verified: ${check.name}
+`);
+      writeConfig({ ...readConfig(), policyId: policyIdArg });
+      process.stdout.write("\u2713 Policy ID saved to ~/.fastgrc.json\n");
+    } else {
+      process.stdout.write("  (no policy ID \u2014 org-wide default will be used)\n");
+    }
+    doInstallHook(process.cwd());
+    doConfigureExecApprovals();
+    process.stdout.write("\n\u2713 Config, HOOK.md, and exec-approvals done.\n");
+    process.stdout.write('Restart OpenClaw, then run "fastgrc-hook test" to verify.\n');
+    process.exit(0);
+  })();
 }
 if (cmd === "serve-approvals") {
   const apiKey = resolveApiKey();

package/dist/bin.mjs

@@ -103,18 +103,23 @@ function startExecApprovalsServer(apiKey, policyId, baseUrl) {
       const line = buffer.slice(0, idx).trim();
       buffer = "";
       if (!line) {
-        conn.destroy();
+        conn.end();
         return;
       }
       let msg;
       try {
         msg = JSON.parse(line);
       } catch {
-        conn.destroy();
+        conn.end();
         return;
       }
-      if (msg.type !== "request" || msg.token !== configToken) {
-        conn.destroy();
+      if (msg.type !== "request") {
+        conn.end();
+        return;
+      }
+      if (msg.token !== configToken) {
+        console.warn("[fastgrc] exec-approvals: token mismatch \u2014 failing open. Restart fastgrc-approvals service if this persists.");
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
         return;
       }
       const req = msg.request ?? {};
@@ -134,11 +139,9 @@ function startExecApprovalsServer(apiKey, policyId, baseUrl) {
           const rule = result.policyContext?.matchedRule;
           console.warn(rule ? `[fastgrc] exec blocked: [${rule}] ${result.reasoning}` : `[fastgrc] exec blocked: ${result.reasoning}`);
         }
-        conn.write(JSON.stringify({ type: "decision", decision }) + "\n");
-        conn.destroy();
+        conn.end(JSON.stringify({ type: "decision", decision }) + "\n");
       }).catch(() => {
-        conn.write(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
-        conn.destroy();
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
       });
     });
     conn.on("error", () => {
@@ -263,6 +266,24 @@ function doUninstallHook(targetDir) {
 `);
   }
 }
+async function validatePolicy(apiKey, policyId, baseUrl = "https://app.fastgrc.ai") {
+  try {
+    const controller = new AbortController();
+    setTimeout(() => controller.abort(), 5e3);
+    const res = await fetch(`${baseUrl.replace(/\/$/, "")}/api/v1/policy-router/policies/${encodeURIComponent(policyId)}`, {
+      headers: { "Authorization": `Bearer ${apiKey}` },
+      signal: controller.signal
+    });
+    if (res.status === 404) return { valid: false, error: "Policy not found \u2014 check the ID belongs to your account." };
+    if (res.status === 401) return { valid: false, error: "Invalid API key." };
+    if (!res.ok) return { valid: false, error: `API returned ${res.status}` };
+    const policy = await res.json();
+    return { valid: true, name: policy.name };
+  } catch (err) {
+    const reason = err instanceof Error && err.name === "AbortError" ? "timeout" : String(err);
+    return { valid: false, error: `Could not reach FastGRC API (${reason}) \u2014 skipping validation.` };
+  }
+}
 function doConfigureExecApprovals() {
   const cfgPath = path3.join(os3.homedir(), ".openclaw", "exec-approvals.json");
   if (!fs3.existsSync(cfgPath)) {
@@ -278,9 +299,9 @@ function doConfigureExecApprovals() {
   const updated = {
     ...existing,
     defaults: {
-      security: "deny",
+      security: "ask",
       ask: "always",
-      askFallback: "deny",
+      askFallback: "allow",
       autoAllowSkills: false
     }
   };
@@ -322,11 +343,29 @@ if (cmd === "set-policy") {
     process.stderr.write("Usage: fastgrc-hook set-policy <policy-id>\n");
     process.exit(1);
   }
-  writeConfig({ ...readConfig(), policyId: arg });
-  process.stdout.write(`\u2713 FastGRC policy ID saved to ${CONFIG_PATH}
+  (async () => {
+    const apiKey = readConfig().apiKey ?? process.env.FASTGRC_API_KEY;
+    const baseUrl = process.env.FASTGRC_BASE_URL ?? "https://app.fastgrc.ai";
+    if (apiKey) {
+      process.stdout.write(`Verifying policy ${arg}\u2026
 `);
-  process.stdout.write('  Run "fastgrc-hook get-policy" to verify.\n');
-  process.exit(0);
+      const check = await validatePolicy(apiKey, arg, baseUrl);
+      if (!check.valid) {
+        process.stderr.write(`\u2717 ${check.error}
+`);
+        process.exit(1);
+      }
+      process.stdout.write(`\u2713 Policy verified: ${check.name}
+`);
+    } else {
+      process.stdout.write("\u26A0  No API key set \u2014 skipping policy verification.\n");
+    }
+    writeConfig({ ...readConfig(), policyId: arg });
+    process.stdout.write(`\u2713 FastGRC policy ID saved to ${CONFIG_PATH}
+`);
+    process.stdout.write('  Run "fastgrc-hook get-policy" to verify.\n');
+    process.exit(0);
+  })();
 }
 if (cmd === "get-policy") {
   const id = readConfig().policyId;
@@ -373,19 +412,33 @@ if (cmd === "setup") {
     process.stderr.write("Usage: fastgrc-hook setup --api-key <key> [--policy-id <id>]\n");
     process.exit(1);
   }
-  writeConfig({ ...readConfig(), apiKey: apiKeyArg });
-  process.stdout.write("\u2713 API key saved to ~/.fastgrc.json\n");
-  if (policyIdArg) {
-    writeConfig({ ...readConfig(), policyId: policyIdArg });
-    process.stdout.write("\u2713 Policy ID saved to ~/.fastgrc.json\n");
-  } else {
-    process.stdout.write("  (no policy ID \u2014 org-wide default will be used)\n");
-  }
-  doInstallHook(process.cwd());
-  doConfigureExecApprovals();
-  process.stdout.write("\n\u2713 Config, HOOK.md, and exec-approvals done.\n");
-  process.stdout.write('Restart OpenClaw, then run "fastgrc-hook test" to verify.\n');
-  process.exit(0);
+  (async () => {
+    const baseUrl = process.env.FASTGRC_BASE_URL ?? "https://app.fastgrc.ai";
+    writeConfig({ ...readConfig(), apiKey: apiKeyArg });
+    process.stdout.write("\u2713 API key saved to ~/.fastgrc.json\n");
+    if (policyIdArg) {
+      process.stdout.write(`Verifying policy ${policyIdArg}\u2026
+`);
+      const check = await validatePolicy(apiKeyArg, policyIdArg, baseUrl);
+      if (!check.valid) {
+        process.stderr.write(`\u2717 Policy not found: ${check.error}
+`);
+        process.stderr.write("  Pass a valid policy ID from your dashboard, or omit --policy-id to use the org default.\n");
+        process.exit(1);
+      }
+      process.stdout.write(`\u2713 Policy verified: ${check.name}
+`);
+      writeConfig({ ...readConfig(), policyId: policyIdArg });
+      process.stdout.write("\u2713 Policy ID saved to ~/.fastgrc.json\n");
+    } else {
+      process.stdout.write("  (no policy ID \u2014 org-wide default will be used)\n");
+    }
+    doInstallHook(process.cwd());
+    doConfigureExecApprovals();
+    process.stdout.write("\n\u2713 Config, HOOK.md, and exec-approvals done.\n");
+    process.stdout.write('Restart OpenClaw, then run "fastgrc-hook test" to verify.\n');
+    process.exit(0);
+  })();
 }
 if (cmd === "serve-approvals") {
   const apiKey = resolveApiKey();

package/dist/plugin.js

@@ -148,18 +148,23 @@ function startExecApprovalsServer(apiKey, policyId, baseUrl) {
       const line = buffer.slice(0, idx).trim();
       buffer = "";
       if (!line) {
-        conn.destroy();
+        conn.end();
         return;
       }
       let msg;
       try {
         msg = JSON.parse(line);
       } catch {
-        conn.destroy();
+        conn.end();
         return;
       }
-      if (msg.type !== "request" || msg.token !== configToken) {
-        conn.destroy();
+      if (msg.type !== "request") {
+        conn.end();
+        return;
+      }
+      if (msg.token !== configToken) {
+        console.warn("[fastgrc] exec-approvals: token mismatch \u2014 failing open. Restart fastgrc-approvals service if this persists.");
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
         return;
       }
       const req = msg.request ?? {};
@@ -179,11 +184,9 @@ function startExecApprovalsServer(apiKey, policyId, baseUrl) {
           const rule = result.policyContext?.matchedRule;
           console.warn(rule ? `[fastgrc] exec blocked: [${rule}] ${result.reasoning}` : `[fastgrc] exec blocked: ${result.reasoning}`);
         }
-        conn.write(JSON.stringify({ type: "decision", decision }) + "\n");
-        conn.destroy();
+        conn.end(JSON.stringify({ type: "decision", decision }) + "\n");
       }).catch(() => {
-        conn.write(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
-        conn.destroy();
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
       });
     });
     conn.on("error", () => {

package/dist/plugin.mjs

@@ -112,18 +112,23 @@ function startExecApprovalsServer(apiKey, policyId, baseUrl) {
       const line = buffer.slice(0, idx).trim();
       buffer = "";
       if (!line) {
-        conn.destroy();
+        conn.end();
         return;
       }
       let msg;
       try {
         msg = JSON.parse(line);
       } catch {
-        conn.destroy();
+        conn.end();
         return;
       }
-      if (msg.type !== "request" || msg.token !== configToken) {
-        conn.destroy();
+      if (msg.type !== "request") {
+        conn.end();
+        return;
+      }
+      if (msg.token !== configToken) {
+        console.warn("[fastgrc] exec-approvals: token mismatch \u2014 failing open. Restart fastgrc-approvals service if this persists.");
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
         return;
       }
       const req = msg.request ?? {};
@@ -143,11 +148,9 @@ function startExecApprovalsServer(apiKey, policyId, baseUrl) {
           const rule = result.policyContext?.matchedRule;
           console.warn(rule ? `[fastgrc] exec blocked: [${rule}] ${result.reasoning}` : `[fastgrc] exec blocked: ${result.reasoning}`);
         }
-        conn.write(JSON.stringify({ type: "decision", decision }) + "\n");
-        conn.destroy();
+        conn.end(JSON.stringify({ type: "decision", decision }) + "\n");
       }).catch(() => {
-        conn.write(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
-        conn.destroy();
+        conn.end(JSON.stringify({ type: "decision", decision: "allow-once" }) + "\n");
       });
     });
     conn.on("error", () => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fastgrc-openclaw",
-  "version": "1.0.30",
+  "version": "1.0.32",
   "description": "FastGRC agent compliance plugin for OpenClaw — evaluates every tool call against your policy before it executes",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",