fastgrc-openclaw 1.0.4 → 1.0.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bin.js +69 -2
- package/dist/bin.mjs +47 -2
- package/dist/index.d.mts +7 -3
- package/dist/index.d.ts +7 -3
- package/dist/index.js +32 -6
- package/dist/index.mjs +20 -5
- package/dist/plugin.d.mts +22 -0
- package/dist/plugin.d.ts +22 -0
- package/dist/plugin.js +147 -0
- package/dist/plugin.mjs +114 -0
- package/openclaw.plugin.json +6 -0
- package/package.json +11 -2
package/dist/bin.js
CHANGED
|
@@ -1,5 +1,32 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
"use strict";
|
|
3
|
+
var __create = Object.create;
|
|
4
|
+
var __defProp = Object.defineProperty;
|
|
5
|
+
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
|
|
6
|
+
var __getOwnPropNames = Object.getOwnPropertyNames;
|
|
7
|
+
var __getProtoOf = Object.getPrototypeOf;
|
|
8
|
+
var __hasOwnProp = Object.prototype.hasOwnProperty;
|
|
9
|
+
var __copyProps = (to, from, except, desc) => {
|
|
10
|
+
if (from && typeof from === "object" || typeof from === "function") {
|
|
11
|
+
for (let key of __getOwnPropNames(from))
|
|
12
|
+
if (!__hasOwnProp.call(to, key) && key !== except)
|
|
13
|
+
__defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
|
|
14
|
+
}
|
|
15
|
+
return to;
|
|
16
|
+
};
|
|
17
|
+
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
|
|
18
|
+
// If the importer is in node compatibility mode or this is not an ESM
|
|
19
|
+
// file that has been converted to a CommonJS file using a Babel-
|
|
20
|
+
// compatible transform (i.e. "__esModule" has not been set), then set
|
|
21
|
+
// "default" to the CommonJS "module.exports" for node compatibility.
|
|
22
|
+
isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
|
|
23
|
+
mod
|
|
24
|
+
));
|
|
25
|
+
|
|
26
|
+
// src/bin.ts
|
|
27
|
+
var fs = __toESM(require("fs"));
|
|
28
|
+
var os = __toESM(require("os"));
|
|
29
|
+
var path = __toESM(require("path"));
|
|
3
30
|
|
|
4
31
|
// src/index.ts
|
|
5
32
|
var DEFAULT_BASE_URL = "https://app.fastgrc.ai";
|
|
@@ -53,9 +80,49 @@ args: ${JSON.stringify(args)}`;
|
|
|
53
80
|
}
|
|
54
81
|
|
|
55
82
|
// src/bin.ts
|
|
56
|
-
var
|
|
83
|
+
var CONFIG_PATH = path.join(os.homedir(), ".fastgrc.json");
|
|
84
|
+
function readConfig() {
|
|
85
|
+
try {
|
|
86
|
+
return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8"));
|
|
87
|
+
} catch {
|
|
88
|
+
return {};
|
|
89
|
+
}
|
|
90
|
+
}
|
|
91
|
+
function writeConfig(data) {
|
|
92
|
+
fs.writeFileSync(CONFIG_PATH, JSON.stringify(data, null, 2), { mode: 384 });
|
|
93
|
+
}
|
|
94
|
+
var [, , cmd, arg] = process.argv;
|
|
95
|
+
if (cmd === "set-key") {
|
|
96
|
+
if (!arg) {
|
|
97
|
+
process.stderr.write("Usage: fastgrc-hook set-key fgrc_k1_...\n");
|
|
98
|
+
process.exit(1);
|
|
99
|
+
}
|
|
100
|
+
writeConfig({ ...readConfig(), apiKey: arg });
|
|
101
|
+
process.stdout.write(`\u2713 FastGRC API key saved to ${CONFIG_PATH}
|
|
102
|
+
`);
|
|
103
|
+
process.stdout.write(' Run "fastgrc-hook get-key" to verify.\n');
|
|
104
|
+
process.exit(0);
|
|
105
|
+
}
|
|
106
|
+
if (cmd === "get-key") {
|
|
107
|
+
const key = readConfig().apiKey;
|
|
108
|
+
if (!key) {
|
|
109
|
+
process.stdout.write("No key stored. Run: fastgrc-hook set-key fgrc_k1_...\n");
|
|
110
|
+
} else {
|
|
111
|
+
process.stdout.write(`${key.slice(0, 12)}${"*".repeat(Math.max(0, key.length - 12))}
|
|
112
|
+
`);
|
|
113
|
+
}
|
|
114
|
+
process.exit(0);
|
|
115
|
+
}
|
|
116
|
+
if (cmd === "unset-key") {
|
|
117
|
+
const cfg = readConfig();
|
|
118
|
+
delete cfg.apiKey;
|
|
119
|
+
writeConfig(cfg);
|
|
120
|
+
process.stdout.write("FastGRC API key removed.\n");
|
|
121
|
+
process.exit(0);
|
|
122
|
+
}
|
|
123
|
+
var apiKey = process.env.FASTGRC_API_KEY ?? readConfig().apiKey;
|
|
57
124
|
if (!apiKey) {
|
|
58
|
-
process.stderr.write("[fastgrc-hook]
|
|
125
|
+
process.stderr.write("[fastgrc-hook] No API key configured \u2014 run: fastgrc-hook set-key fgrc_k1_...\n");
|
|
59
126
|
process.exit(0);
|
|
60
127
|
}
|
|
61
128
|
var baseUrl = process.env.FASTGRC_BASE_URL ?? "https://app.fastgrc.ai";
|
package/dist/bin.mjs
CHANGED
|
@@ -1,5 +1,10 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
2
|
|
|
3
|
+
// src/bin.ts
|
|
4
|
+
import * as fs from "fs";
|
|
5
|
+
import * as os from "os";
|
|
6
|
+
import * as path from "path";
|
|
7
|
+
|
|
3
8
|
// src/index.ts
|
|
4
9
|
var DEFAULT_BASE_URL = "https://app.fastgrc.ai";
|
|
5
10
|
var DEFAULT_TIMEOUT_MS = 3e3;
|
|
@@ -52,9 +57,49 @@ args: ${JSON.stringify(args)}`;
|
|
|
52
57
|
}
|
|
53
58
|
|
|
54
59
|
// src/bin.ts
|
|
55
|
-
var
|
|
60
|
+
var CONFIG_PATH = path.join(os.homedir(), ".fastgrc.json");
|
|
61
|
+
function readConfig() {
|
|
62
|
+
try {
|
|
63
|
+
return JSON.parse(fs.readFileSync(CONFIG_PATH, "utf8"));
|
|
64
|
+
} catch {
|
|
65
|
+
return {};
|
|
66
|
+
}
|
|
67
|
+
}
|
|
68
|
+
function writeConfig(data) {
|
|
69
|
+
fs.writeFileSync(CONFIG_PATH, JSON.stringify(data, null, 2), { mode: 384 });
|
|
70
|
+
}
|
|
71
|
+
var [, , cmd, arg] = process.argv;
|
|
72
|
+
if (cmd === "set-key") {
|
|
73
|
+
if (!arg) {
|
|
74
|
+
process.stderr.write("Usage: fastgrc-hook set-key fgrc_k1_...\n");
|
|
75
|
+
process.exit(1);
|
|
76
|
+
}
|
|
77
|
+
writeConfig({ ...readConfig(), apiKey: arg });
|
|
78
|
+
process.stdout.write(`\u2713 FastGRC API key saved to ${CONFIG_PATH}
|
|
79
|
+
`);
|
|
80
|
+
process.stdout.write(' Run "fastgrc-hook get-key" to verify.\n');
|
|
81
|
+
process.exit(0);
|
|
82
|
+
}
|
|
83
|
+
if (cmd === "get-key") {
|
|
84
|
+
const key = readConfig().apiKey;
|
|
85
|
+
if (!key) {
|
|
86
|
+
process.stdout.write("No key stored. Run: fastgrc-hook set-key fgrc_k1_...\n");
|
|
87
|
+
} else {
|
|
88
|
+
process.stdout.write(`${key.slice(0, 12)}${"*".repeat(Math.max(0, key.length - 12))}
|
|
89
|
+
`);
|
|
90
|
+
}
|
|
91
|
+
process.exit(0);
|
|
92
|
+
}
|
|
93
|
+
if (cmd === "unset-key") {
|
|
94
|
+
const cfg = readConfig();
|
|
95
|
+
delete cfg.apiKey;
|
|
96
|
+
writeConfig(cfg);
|
|
97
|
+
process.stdout.write("FastGRC API key removed.\n");
|
|
98
|
+
process.exit(0);
|
|
99
|
+
}
|
|
100
|
+
var apiKey = process.env.FASTGRC_API_KEY ?? readConfig().apiKey;
|
|
56
101
|
if (!apiKey) {
|
|
57
|
-
process.stderr.write("[fastgrc-hook]
|
|
102
|
+
process.stderr.write("[fastgrc-hook] No API key configured \u2014 run: fastgrc-hook set-key fgrc_k1_...\n");
|
|
58
103
|
process.exit(0);
|
|
59
104
|
}
|
|
60
105
|
var baseUrl = process.env.FASTGRC_BASE_URL ?? "https://app.fastgrc.ai";
|
package/dist/index.d.mts
CHANGED
|
@@ -1,6 +1,10 @@
|
|
|
1
|
+
declare function resolveApiKey(explicit?: string): string | undefined;
|
|
1
2
|
interface FastGRCPluginOptions {
|
|
2
|
-
/**
|
|
3
|
-
|
|
3
|
+
/**
|
|
4
|
+
* Your FastGRC API key (fgrc_k1_...).
|
|
5
|
+
* Optional — falls back to FASTGRC_API_KEY env var, then ~/.fastgrc.json (set via `fastgrc-hook set-key`).
|
|
6
|
+
*/
|
|
7
|
+
apiKey?: string;
|
|
4
8
|
/** Specific policy ID to evaluate against. Omit to use the org-wide default. */
|
|
5
9
|
policyId?: string;
|
|
6
10
|
/**
|
|
@@ -72,4 +76,4 @@ declare function evaluate(payload: {
|
|
|
72
76
|
}): Promise<EvaluateResponse | null>;
|
|
73
77
|
declare function FastGRCPlugin(options: FastGRCPluginOptions): OpenClawPlugin;
|
|
74
78
|
|
|
75
|
-
export { FastGRCApprovalRequiredError, FastGRCBlockedError, FastGRCPlugin, type FastGRCPluginOptions, evaluate };
|
|
79
|
+
export { FastGRCApprovalRequiredError, FastGRCBlockedError, FastGRCPlugin, type FastGRCPluginOptions, evaluate, resolveApiKey };
|
package/dist/index.d.ts
CHANGED
|
@@ -1,6 +1,10 @@
|
|
|
1
|
+
declare function resolveApiKey(explicit?: string): string | undefined;
|
|
1
2
|
interface FastGRCPluginOptions {
|
|
2
|
-
/**
|
|
3
|
-
|
|
3
|
+
/**
|
|
4
|
+
* Your FastGRC API key (fgrc_k1_...).
|
|
5
|
+
* Optional — falls back to FASTGRC_API_KEY env var, then ~/.fastgrc.json (set via `fastgrc-hook set-key`).
|
|
6
|
+
*/
|
|
7
|
+
apiKey?: string;
|
|
4
8
|
/** Specific policy ID to evaluate against. Omit to use the org-wide default. */
|
|
5
9
|
policyId?: string;
|
|
6
10
|
/**
|
|
@@ -72,4 +76,4 @@ declare function evaluate(payload: {
|
|
|
72
76
|
}): Promise<EvaluateResponse | null>;
|
|
73
77
|
declare function FastGRCPlugin(options: FastGRCPluginOptions): OpenClawPlugin;
|
|
74
78
|
|
|
75
|
-
export { FastGRCApprovalRequiredError, FastGRCBlockedError, FastGRCPlugin, type FastGRCPluginOptions, evaluate };
|
|
79
|
+
export { FastGRCApprovalRequiredError, FastGRCBlockedError, FastGRCPlugin, type FastGRCPluginOptions, evaluate, resolveApiKey };
|
package/dist/index.js
CHANGED
|
@@ -1,7 +1,9 @@
|
|
|
1
1
|
"use strict";
|
|
2
|
+
var __create = Object.create;
|
|
2
3
|
var __defProp = Object.defineProperty;
|
|
3
4
|
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
|
|
4
5
|
var __getOwnPropNames = Object.getOwnPropertyNames;
|
|
6
|
+
var __getProtoOf = Object.getPrototypeOf;
|
|
5
7
|
var __hasOwnProp = Object.prototype.hasOwnProperty;
|
|
6
8
|
var __export = (target, all) => {
|
|
7
9
|
for (var name in all)
|
|
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
|
|
|
15
17
|
}
|
|
16
18
|
return to;
|
|
17
19
|
};
|
|
20
|
+
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
|
|
21
|
+
// If the importer is in node compatibility mode or this is not an ESM
|
|
22
|
+
// file that has been converted to a CommonJS file using a Babel-
|
|
23
|
+
// compatible transform (i.e. "__esModule" has not been set), then set
|
|
24
|
+
// "default" to the CommonJS "module.exports" for node compatibility.
|
|
25
|
+
isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
|
|
26
|
+
mod
|
|
27
|
+
));
|
|
18
28
|
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
|
|
19
29
|
|
|
20
30
|
// src/index.ts
|
|
@@ -23,11 +33,25 @@ __export(index_exports, {
|
|
|
23
33
|
FastGRCApprovalRequiredError: () => FastGRCApprovalRequiredError,
|
|
24
34
|
FastGRCBlockedError: () => FastGRCBlockedError,
|
|
25
35
|
FastGRCPlugin: () => FastGRCPlugin,
|
|
26
|
-
evaluate: () => evaluate
|
|
36
|
+
evaluate: () => evaluate,
|
|
37
|
+
resolveApiKey: () => resolveApiKey
|
|
27
38
|
});
|
|
28
39
|
module.exports = __toCommonJS(index_exports);
|
|
40
|
+
var fs = __toESM(require("fs"));
|
|
41
|
+
var os = __toESM(require("os"));
|
|
42
|
+
var path = __toESM(require("path"));
|
|
29
43
|
var DEFAULT_BASE_URL = "https://app.fastgrc.ai";
|
|
30
44
|
var DEFAULT_TIMEOUT_MS = 3e3;
|
|
45
|
+
function resolveApiKey(explicit) {
|
|
46
|
+
if (explicit) return explicit;
|
|
47
|
+
if (process.env.FASTGRC_API_KEY) return process.env.FASTGRC_API_KEY;
|
|
48
|
+
try {
|
|
49
|
+
const cfg = JSON.parse(fs.readFileSync(path.join(os.homedir(), ".fastgrc.json"), "utf8"));
|
|
50
|
+
if (cfg.apiKey) return cfg.apiKey;
|
|
51
|
+
} catch {
|
|
52
|
+
}
|
|
53
|
+
return void 0;
|
|
54
|
+
}
|
|
31
55
|
var FastGRCBlockedError = class extends Error {
|
|
32
56
|
constructor(matchedRule, reasoning, policyId) {
|
|
33
57
|
super(
|
|
@@ -101,14 +125,14 @@ args: ${JSON.stringify(args)}`;
|
|
|
101
125
|
}
|
|
102
126
|
function FastGRCPlugin(options) {
|
|
103
127
|
const {
|
|
104
|
-
apiKey,
|
|
105
128
|
policyId,
|
|
106
129
|
timeoutMs = DEFAULT_TIMEOUT_MS,
|
|
107
130
|
baseUrl = DEFAULT_BASE_URL
|
|
108
131
|
} = options;
|
|
109
|
-
|
|
132
|
+
const resolvedKey = resolveApiKey(options.apiKey);
|
|
133
|
+
if (!resolvedKey) {
|
|
110
134
|
console.warn(
|
|
111
|
-
|
|
135
|
+
"[fastgrc] No API key found \u2014 all tool calls will proceed unchecked.\n\n Quick setup (install + set key in one command):\n npm install -g fastgrc-openclaw && fastgrc-hook set-key fgrc_k1_your_key\n\n Already installed? Just run:\n fastgrc-hook set-key fgrc_k1_your_key\n\n Get a key at: https://app.fastgrc.ai/connect\n Manage keys at: https://app.fastgrc.ai/dashboard/settings"
|
|
112
136
|
);
|
|
113
137
|
}
|
|
114
138
|
const dashboardUrl = `${baseUrl.replace(/\/$/, "")}/dashboard/agent-policies`;
|
|
@@ -116,13 +140,14 @@ function FastGRCPlugin(options) {
|
|
|
116
140
|
name: "fastgrc",
|
|
117
141
|
hooks: {
|
|
118
142
|
async before_tool_call(toolName, args, context) {
|
|
143
|
+
if (!resolvedKey) return { block: false };
|
|
119
144
|
const result = await evaluate({
|
|
120
145
|
toolName,
|
|
121
146
|
args,
|
|
122
147
|
agentId: context.id,
|
|
123
148
|
agentType: context.type,
|
|
124
149
|
agentName: context.name,
|
|
125
|
-
apiKey,
|
|
150
|
+
apiKey: resolvedKey,
|
|
126
151
|
policyId,
|
|
127
152
|
baseUrl,
|
|
128
153
|
timeoutMs
|
|
@@ -153,5 +178,6 @@ function FastGRCPlugin(options) {
|
|
|
153
178
|
FastGRCApprovalRequiredError,
|
|
154
179
|
FastGRCBlockedError,
|
|
155
180
|
FastGRCPlugin,
|
|
156
|
-
evaluate
|
|
181
|
+
evaluate,
|
|
182
|
+
resolveApiKey
|
|
157
183
|
});
|
package/dist/index.mjs
CHANGED
|
@@ -1,6 +1,19 @@
|
|
|
1
1
|
// src/index.ts
|
|
2
|
+
import * as fs from "fs";
|
|
3
|
+
import * as os from "os";
|
|
4
|
+
import * as path from "path";
|
|
2
5
|
var DEFAULT_BASE_URL = "https://app.fastgrc.ai";
|
|
3
6
|
var DEFAULT_TIMEOUT_MS = 3e3;
|
|
7
|
+
function resolveApiKey(explicit) {
|
|
8
|
+
if (explicit) return explicit;
|
|
9
|
+
if (process.env.FASTGRC_API_KEY) return process.env.FASTGRC_API_KEY;
|
|
10
|
+
try {
|
|
11
|
+
const cfg = JSON.parse(fs.readFileSync(path.join(os.homedir(), ".fastgrc.json"), "utf8"));
|
|
12
|
+
if (cfg.apiKey) return cfg.apiKey;
|
|
13
|
+
} catch {
|
|
14
|
+
}
|
|
15
|
+
return void 0;
|
|
16
|
+
}
|
|
4
17
|
var FastGRCBlockedError = class extends Error {
|
|
5
18
|
constructor(matchedRule, reasoning, policyId) {
|
|
6
19
|
super(
|
|
@@ -74,14 +87,14 @@ args: ${JSON.stringify(args)}`;
|
|
|
74
87
|
}
|
|
75
88
|
function FastGRCPlugin(options) {
|
|
76
89
|
const {
|
|
77
|
-
apiKey,
|
|
78
90
|
policyId,
|
|
79
91
|
timeoutMs = DEFAULT_TIMEOUT_MS,
|
|
80
92
|
baseUrl = DEFAULT_BASE_URL
|
|
81
93
|
} = options;
|
|
82
|
-
|
|
94
|
+
const resolvedKey = resolveApiKey(options.apiKey);
|
|
95
|
+
if (!resolvedKey) {
|
|
83
96
|
console.warn(
|
|
84
|
-
|
|
97
|
+
"[fastgrc] No API key found \u2014 all tool calls will proceed unchecked.\n\n Quick setup (install + set key in one command):\n npm install -g fastgrc-openclaw && fastgrc-hook set-key fgrc_k1_your_key\n\n Already installed? Just run:\n fastgrc-hook set-key fgrc_k1_your_key\n\n Get a key at: https://app.fastgrc.ai/connect\n Manage keys at: https://app.fastgrc.ai/dashboard/settings"
|
|
85
98
|
);
|
|
86
99
|
}
|
|
87
100
|
const dashboardUrl = `${baseUrl.replace(/\/$/, "")}/dashboard/agent-policies`;
|
|
@@ -89,13 +102,14 @@ function FastGRCPlugin(options) {
|
|
|
89
102
|
name: "fastgrc",
|
|
90
103
|
hooks: {
|
|
91
104
|
async before_tool_call(toolName, args, context) {
|
|
105
|
+
if (!resolvedKey) return { block: false };
|
|
92
106
|
const result = await evaluate({
|
|
93
107
|
toolName,
|
|
94
108
|
args,
|
|
95
109
|
agentId: context.id,
|
|
96
110
|
agentType: context.type,
|
|
97
111
|
agentName: context.name,
|
|
98
|
-
apiKey,
|
|
112
|
+
apiKey: resolvedKey,
|
|
99
113
|
policyId,
|
|
100
114
|
baseUrl,
|
|
101
115
|
timeoutMs
|
|
@@ -125,5 +139,6 @@ export {
|
|
|
125
139
|
FastGRCApprovalRequiredError,
|
|
126
140
|
FastGRCBlockedError,
|
|
127
141
|
FastGRCPlugin,
|
|
128
|
-
evaluate
|
|
142
|
+
evaluate,
|
|
143
|
+
resolveApiKey
|
|
129
144
|
};
|
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
interface AgentContext {
|
|
2
|
+
id?: string;
|
|
3
|
+
name?: string;
|
|
4
|
+
type?: string;
|
|
5
|
+
[key: string]: unknown;
|
|
6
|
+
}
|
|
7
|
+
type BeforeToolCallResult = {
|
|
8
|
+
block: true;
|
|
9
|
+
blockReason: string;
|
|
10
|
+
} | {
|
|
11
|
+
requireApproval: {
|
|
12
|
+
timeoutBehavior: 'allow' | 'deny';
|
|
13
|
+
};
|
|
14
|
+
} | undefined;
|
|
15
|
+
declare const plugin: {
|
|
16
|
+
name: string;
|
|
17
|
+
hooks: {
|
|
18
|
+
before_tool_call(toolName: string, args: unknown, context: AgentContext): Promise<BeforeToolCallResult>;
|
|
19
|
+
};
|
|
20
|
+
};
|
|
21
|
+
|
|
22
|
+
export { plugin as default };
|
package/dist/plugin.d.ts
ADDED
|
@@ -0,0 +1,22 @@
|
|
|
1
|
+
interface AgentContext {
|
|
2
|
+
id?: string;
|
|
3
|
+
name?: string;
|
|
4
|
+
type?: string;
|
|
5
|
+
[key: string]: unknown;
|
|
6
|
+
}
|
|
7
|
+
type BeforeToolCallResult = {
|
|
8
|
+
block: true;
|
|
9
|
+
blockReason: string;
|
|
10
|
+
} | {
|
|
11
|
+
requireApproval: {
|
|
12
|
+
timeoutBehavior: 'allow' | 'deny';
|
|
13
|
+
};
|
|
14
|
+
} | undefined;
|
|
15
|
+
declare const plugin: {
|
|
16
|
+
name: string;
|
|
17
|
+
hooks: {
|
|
18
|
+
before_tool_call(toolName: string, args: unknown, context: AgentContext): Promise<BeforeToolCallResult>;
|
|
19
|
+
};
|
|
20
|
+
};
|
|
21
|
+
|
|
22
|
+
export { plugin as default };
|
package/dist/plugin.js
ADDED
|
@@ -0,0 +1,147 @@
|
|
|
1
|
+
"use strict";
|
|
2
|
+
var __create = Object.create;
|
|
3
|
+
var __defProp = Object.defineProperty;
|
|
4
|
+
var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
|
|
5
|
+
var __getOwnPropNames = Object.getOwnPropertyNames;
|
|
6
|
+
var __getProtoOf = Object.getPrototypeOf;
|
|
7
|
+
var __hasOwnProp = Object.prototype.hasOwnProperty;
|
|
8
|
+
var __export = (target, all) => {
|
|
9
|
+
for (var name in all)
|
|
10
|
+
__defProp(target, name, { get: all[name], enumerable: true });
|
|
11
|
+
};
|
|
12
|
+
var __copyProps = (to, from, except, desc) => {
|
|
13
|
+
if (from && typeof from === "object" || typeof from === "function") {
|
|
14
|
+
for (let key of __getOwnPropNames(from))
|
|
15
|
+
if (!__hasOwnProp.call(to, key) && key !== except)
|
|
16
|
+
__defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
|
|
17
|
+
}
|
|
18
|
+
return to;
|
|
19
|
+
};
|
|
20
|
+
var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
|
|
21
|
+
// If the importer is in node compatibility mode or this is not an ESM
|
|
22
|
+
// file that has been converted to a CommonJS file using a Babel-
|
|
23
|
+
// compatible transform (i.e. "__esModule" has not been set), then set
|
|
24
|
+
// "default" to the CommonJS "module.exports" for node compatibility.
|
|
25
|
+
isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
|
|
26
|
+
mod
|
|
27
|
+
));
|
|
28
|
+
var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
|
|
29
|
+
|
|
30
|
+
// src/plugin.ts
|
|
31
|
+
var plugin_exports = {};
|
|
32
|
+
__export(plugin_exports, {
|
|
33
|
+
default: () => plugin_default
|
|
34
|
+
});
|
|
35
|
+
module.exports = __toCommonJS(plugin_exports);
|
|
36
|
+
|
|
37
|
+
// src/index.ts
|
|
38
|
+
var fs = __toESM(require("fs"));
|
|
39
|
+
var os = __toESM(require("os"));
|
|
40
|
+
var path = __toESM(require("path"));
|
|
41
|
+
var DEFAULT_BASE_URL = "https://app.fastgrc.ai";
|
|
42
|
+
var DEFAULT_TIMEOUT_MS = 3e3;
|
|
43
|
+
function resolveApiKey(explicit) {
|
|
44
|
+
if (explicit) return explicit;
|
|
45
|
+
if (process.env.FASTGRC_API_KEY) return process.env.FASTGRC_API_KEY;
|
|
46
|
+
try {
|
|
47
|
+
const cfg = JSON.parse(fs.readFileSync(path.join(os.homedir(), ".fastgrc.json"), "utf8"));
|
|
48
|
+
if (cfg.apiKey) return cfg.apiKey;
|
|
49
|
+
} catch {
|
|
50
|
+
}
|
|
51
|
+
return void 0;
|
|
52
|
+
}
|
|
53
|
+
async function evaluate(payload) {
|
|
54
|
+
const {
|
|
55
|
+
toolName,
|
|
56
|
+
args,
|
|
57
|
+
agentId,
|
|
58
|
+
agentType,
|
|
59
|
+
agentName,
|
|
60
|
+
apiKey: apiKey2,
|
|
61
|
+
policyId,
|
|
62
|
+
baseUrl = DEFAULT_BASE_URL,
|
|
63
|
+
timeoutMs = DEFAULT_TIMEOUT_MS
|
|
64
|
+
} = payload;
|
|
65
|
+
const evalUrl = `${baseUrl.replace(/\/$/, "")}/api/v1/policy-router/evaluate`;
|
|
66
|
+
const content = `tool_name: ${toolName}
|
|
67
|
+
args: ${JSON.stringify(args)}`;
|
|
68
|
+
try {
|
|
69
|
+
const controller = new AbortController();
|
|
70
|
+
const timer = setTimeout(() => controller.abort(), timeoutMs);
|
|
71
|
+
const res = await fetch(evalUrl, {
|
|
72
|
+
method: "POST",
|
|
73
|
+
headers: {
|
|
74
|
+
"Authorization": `Bearer ${apiKey2}`,
|
|
75
|
+
"Content-Type": "application/json"
|
|
76
|
+
},
|
|
77
|
+
body: JSON.stringify({
|
|
78
|
+
subjectContent: content,
|
|
79
|
+
subjectType: "tool_argument",
|
|
80
|
+
direction: "ingress",
|
|
81
|
+
agentId,
|
|
82
|
+
agentType,
|
|
83
|
+
agentName,
|
|
84
|
+
...policyId ? { policyId } : {}
|
|
85
|
+
}),
|
|
86
|
+
signal: controller.signal
|
|
87
|
+
});
|
|
88
|
+
clearTimeout(timer);
|
|
89
|
+
if (!res.ok) {
|
|
90
|
+
console.warn(`[fastgrc] Evaluate returned ${res.status} \u2014 failing open`);
|
|
91
|
+
return null;
|
|
92
|
+
}
|
|
93
|
+
return await res.json();
|
|
94
|
+
} catch (err) {
|
|
95
|
+
const reason = err instanceof Error && err.name === "AbortError" ? "timeout" : String(err);
|
|
96
|
+
console.warn(`[fastgrc] Evaluate failed (${reason}) \u2014 failing open`);
|
|
97
|
+
return null;
|
|
98
|
+
}
|
|
99
|
+
}
|
|
100
|
+
|
|
101
|
+
// src/plugin.ts
|
|
102
|
+
var DEFAULT_BASE_URL2 = "https://app.fastgrc.ai";
|
|
103
|
+
var DEFAULT_TIMEOUT_MS2 = 3e3;
|
|
104
|
+
var apiKey = resolveApiKey();
|
|
105
|
+
if (!apiKey) {
|
|
106
|
+
console.warn(
|
|
107
|
+
"[fastgrc] No API key found \u2014 all tool calls will proceed unchecked.\n\n Run once to connect:\n fastgrc-hook set-key fgrc_k1_your_key_here\n\n Get a key at: https://app.fastgrc.ai/connect\n Manage keys at: https://app.fastgrc.ai/dashboard/settings"
|
|
108
|
+
);
|
|
109
|
+
}
|
|
110
|
+
var plugin = {
|
|
111
|
+
name: "fastgrc",
|
|
112
|
+
hooks: {
|
|
113
|
+
async before_tool_call(toolName, args, context) {
|
|
114
|
+
if (!apiKey) return void 0;
|
|
115
|
+
const result = await evaluate({
|
|
116
|
+
toolName,
|
|
117
|
+
args,
|
|
118
|
+
agentId: context.id,
|
|
119
|
+
agentType: context.type,
|
|
120
|
+
agentName: context.name,
|
|
121
|
+
apiKey,
|
|
122
|
+
baseUrl: DEFAULT_BASE_URL2,
|
|
123
|
+
timeoutMs: DEFAULT_TIMEOUT_MS2
|
|
124
|
+
});
|
|
125
|
+
if (!result) return void 0;
|
|
126
|
+
const { decision, reasoning, policyContext, reasonTags } = result;
|
|
127
|
+
const matchedRule = policyContext?.matchedRule ?? "policy rule";
|
|
128
|
+
if (decision === "block") {
|
|
129
|
+
return {
|
|
130
|
+
block: true,
|
|
131
|
+
blockReason: `[${matchedRule}] ${reasoning}`
|
|
132
|
+
};
|
|
133
|
+
}
|
|
134
|
+
if (decision === "require_approval") {
|
|
135
|
+
return {
|
|
136
|
+
requireApproval: { timeoutBehavior: "deny" }
|
|
137
|
+
};
|
|
138
|
+
}
|
|
139
|
+
if (Array.isArray(reasonTags) && reasonTags.includes("override_block_active")) {
|
|
140
|
+
const msg = policyContext?.matchedRule ? `[FastGRC] Observability mode \u2014 would have blocked: [${policyContext.matchedRule}] ${reasoning}` : `[FastGRC] Observability mode \u2014 would have blocked: ${reasoning}`;
|
|
141
|
+
console.warn(msg);
|
|
142
|
+
}
|
|
143
|
+
return void 0;
|
|
144
|
+
}
|
|
145
|
+
}
|
|
146
|
+
};
|
|
147
|
+
var plugin_default = plugin;
|
package/dist/plugin.mjs
ADDED
|
@@ -0,0 +1,114 @@
|
|
|
1
|
+
// src/index.ts
|
|
2
|
+
import * as fs from "fs";
|
|
3
|
+
import * as os from "os";
|
|
4
|
+
import * as path from "path";
|
|
5
|
+
var DEFAULT_BASE_URL = "https://app.fastgrc.ai";
|
|
6
|
+
var DEFAULT_TIMEOUT_MS = 3e3;
|
|
7
|
+
function resolveApiKey(explicit) {
|
|
8
|
+
if (explicit) return explicit;
|
|
9
|
+
if (process.env.FASTGRC_API_KEY) return process.env.FASTGRC_API_KEY;
|
|
10
|
+
try {
|
|
11
|
+
const cfg = JSON.parse(fs.readFileSync(path.join(os.homedir(), ".fastgrc.json"), "utf8"));
|
|
12
|
+
if (cfg.apiKey) return cfg.apiKey;
|
|
13
|
+
} catch {
|
|
14
|
+
}
|
|
15
|
+
return void 0;
|
|
16
|
+
}
|
|
17
|
+
async function evaluate(payload) {
|
|
18
|
+
const {
|
|
19
|
+
toolName,
|
|
20
|
+
args,
|
|
21
|
+
agentId,
|
|
22
|
+
agentType,
|
|
23
|
+
agentName,
|
|
24
|
+
apiKey: apiKey2,
|
|
25
|
+
policyId,
|
|
26
|
+
baseUrl = DEFAULT_BASE_URL,
|
|
27
|
+
timeoutMs = DEFAULT_TIMEOUT_MS
|
|
28
|
+
} = payload;
|
|
29
|
+
const evalUrl = `${baseUrl.replace(/\/$/, "")}/api/v1/policy-router/evaluate`;
|
|
30
|
+
const content = `tool_name: ${toolName}
|
|
31
|
+
args: ${JSON.stringify(args)}`;
|
|
32
|
+
try {
|
|
33
|
+
const controller = new AbortController();
|
|
34
|
+
const timer = setTimeout(() => controller.abort(), timeoutMs);
|
|
35
|
+
const res = await fetch(evalUrl, {
|
|
36
|
+
method: "POST",
|
|
37
|
+
headers: {
|
|
38
|
+
"Authorization": `Bearer ${apiKey2}`,
|
|
39
|
+
"Content-Type": "application/json"
|
|
40
|
+
},
|
|
41
|
+
body: JSON.stringify({
|
|
42
|
+
subjectContent: content,
|
|
43
|
+
subjectType: "tool_argument",
|
|
44
|
+
direction: "ingress",
|
|
45
|
+
agentId,
|
|
46
|
+
agentType,
|
|
47
|
+
agentName,
|
|
48
|
+
...policyId ? { policyId } : {}
|
|
49
|
+
}),
|
|
50
|
+
signal: controller.signal
|
|
51
|
+
});
|
|
52
|
+
clearTimeout(timer);
|
|
53
|
+
if (!res.ok) {
|
|
54
|
+
console.warn(`[fastgrc] Evaluate returned ${res.status} \u2014 failing open`);
|
|
55
|
+
return null;
|
|
56
|
+
}
|
|
57
|
+
return await res.json();
|
|
58
|
+
} catch (err) {
|
|
59
|
+
const reason = err instanceof Error && err.name === "AbortError" ? "timeout" : String(err);
|
|
60
|
+
console.warn(`[fastgrc] Evaluate failed (${reason}) \u2014 failing open`);
|
|
61
|
+
return null;
|
|
62
|
+
}
|
|
63
|
+
}
|
|
64
|
+
|
|
65
|
+
// src/plugin.ts
|
|
66
|
+
var DEFAULT_BASE_URL2 = "https://app.fastgrc.ai";
|
|
67
|
+
var DEFAULT_TIMEOUT_MS2 = 3e3;
|
|
68
|
+
var apiKey = resolveApiKey();
|
|
69
|
+
if (!apiKey) {
|
|
70
|
+
console.warn(
|
|
71
|
+
"[fastgrc] No API key found \u2014 all tool calls will proceed unchecked.\n\n Run once to connect:\n fastgrc-hook set-key fgrc_k1_your_key_here\n\n Get a key at: https://app.fastgrc.ai/connect\n Manage keys at: https://app.fastgrc.ai/dashboard/settings"
|
|
72
|
+
);
|
|
73
|
+
}
|
|
74
|
+
var plugin = {
|
|
75
|
+
name: "fastgrc",
|
|
76
|
+
hooks: {
|
|
77
|
+
async before_tool_call(toolName, args, context) {
|
|
78
|
+
if (!apiKey) return void 0;
|
|
79
|
+
const result = await evaluate({
|
|
80
|
+
toolName,
|
|
81
|
+
args,
|
|
82
|
+
agentId: context.id,
|
|
83
|
+
agentType: context.type,
|
|
84
|
+
agentName: context.name,
|
|
85
|
+
apiKey,
|
|
86
|
+
baseUrl: DEFAULT_BASE_URL2,
|
|
87
|
+
timeoutMs: DEFAULT_TIMEOUT_MS2
|
|
88
|
+
});
|
|
89
|
+
if (!result) return void 0;
|
|
90
|
+
const { decision, reasoning, policyContext, reasonTags } = result;
|
|
91
|
+
const matchedRule = policyContext?.matchedRule ?? "policy rule";
|
|
92
|
+
if (decision === "block") {
|
|
93
|
+
return {
|
|
94
|
+
block: true,
|
|
95
|
+
blockReason: `[${matchedRule}] ${reasoning}`
|
|
96
|
+
};
|
|
97
|
+
}
|
|
98
|
+
if (decision === "require_approval") {
|
|
99
|
+
return {
|
|
100
|
+
requireApproval: { timeoutBehavior: "deny" }
|
|
101
|
+
};
|
|
102
|
+
}
|
|
103
|
+
if (Array.isArray(reasonTags) && reasonTags.includes("override_block_active")) {
|
|
104
|
+
const msg = policyContext?.matchedRule ? `[FastGRC] Observability mode \u2014 would have blocked: [${policyContext.matchedRule}] ${reasoning}` : `[FastGRC] Observability mode \u2014 would have blocked: ${reasoning}`;
|
|
105
|
+
console.warn(msg);
|
|
106
|
+
}
|
|
107
|
+
return void 0;
|
|
108
|
+
}
|
|
109
|
+
}
|
|
110
|
+
};
|
|
111
|
+
var plugin_default = plugin;
|
|
112
|
+
export {
|
|
113
|
+
plugin_default as default
|
|
114
|
+
};
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "fastgrc-openclaw",
|
|
3
|
-
"version": "1.0.
|
|
3
|
+
"version": "1.0.6",
|
|
4
4
|
"description": "FastGRC agent compliance plugin for OpenClaw — evaluates every tool call against your policy before it executes",
|
|
5
5
|
"main": "./dist/index.js",
|
|
6
6
|
"module": "./dist/index.mjs",
|
|
@@ -10,14 +10,23 @@
|
|
|
10
10
|
"types": "./dist/index.d.ts",
|
|
11
11
|
"import": "./dist/index.mjs",
|
|
12
12
|
"require": "./dist/index.js"
|
|
13
|
+
},
|
|
14
|
+
"./plugin": {
|
|
15
|
+
"types": "./dist/plugin.d.ts",
|
|
16
|
+
"import": "./dist/plugin.mjs",
|
|
17
|
+
"require": "./dist/plugin.js"
|
|
13
18
|
}
|
|
14
19
|
},
|
|
20
|
+
"openclaw": {
|
|
21
|
+
"extensions": ["./dist/plugin.js"]
|
|
22
|
+
},
|
|
15
23
|
"bin": {
|
|
16
24
|
"fastgrc-hook": "./dist/bin.js"
|
|
17
25
|
},
|
|
18
26
|
"files": [
|
|
19
27
|
"dist",
|
|
20
|
-
"README.md"
|
|
28
|
+
"README.md",
|
|
29
|
+
"openclaw.plugin.json"
|
|
21
30
|
],
|
|
22
31
|
"scripts": {
|
|
23
32
|
"build": "tsup && node -e \"require('fs').chmodSync('dist/bin.js', '755')\"",
|