hyperclaw 4.0.0 → 4.0.2

package/dist/sdk/index.js

@@ -12,8 +12,8 @@ function defineTool(tool) {
 		...tool
 	};
 }
-const SDK_VERSION = "4.0.0";
-const SDK_COMPAT = ">=4.0.0";
+const SDK_VERSION = "4.0.2";
+const SDK_COMPAT = ">=4.0.2";
 
 //#endregion
 exports.SDK_COMPAT = SDK_COMPAT;

package/dist/sdk/index.mjs

@@ -11,8 +11,8 @@ function defineTool(tool) {
 		...tool
 	};
 }
-const SDK_VERSION = "4.0.0";
-const SDK_COMPAT = ">=4.0.0";
+const SDK_VERSION = "4.0.2";
+const SDK_COMPAT = ">=4.0.2";
 
 //#endregion
 export { SDK_COMPAT, SDK_VERSION, defineChannelExtension, definePlugin, defineTool };

package/dist/security-C-5URby1.js

@@ -0,0 +1,73 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const chalk = require_chunk.__toESM(require("chalk"));
+const inquirer = require_chunk.__toESM(require("inquirer"));
+const boxen = require_chunk.__toESM(require("boxen"));
+
+//#region src/infra/security.ts
+const DISCLAIMER_TEXT = `
+  A bad prompt can trick your AI agent into doing unsafe things.
+  By continuing, you acknowledge the following risks:
+
+  ${chalk.default.yellow("•")} ${chalk.default.white("Prompt injection:")} Malicious users may try to override your agent's behavior
+  ${chalk.default.yellow("•")} ${chalk.default.white("Channel pairing:")} Use allowlists to restrict who can DM your agent
+  ${chalk.default.yellow("•")} ${chalk.default.white("Sandbox & least privilege:")} Only enable skills your agent actually needs
+  ${chalk.default.yellow("•")} ${chalk.default.white("Keep secrets out:")} Never put API keys in prompts or messages
+  ${chalk.default.yellow("•")} ${chalk.default.white("Use strongest model:")} Capable models are harder to jailbreak
+  ${chalk.default.yellow("•")} ${chalk.default.white("Gateway auth token:")} Always set a strong token — never leave it blank
+
+  This software is ${chalk.default.bold("inherently powerful and inherently risky")}.
+  You are responsible for how your agent behaves.
+`;
+async function configureDMPolicy(channelName) {
+	console.log(chalk.default.cyan(`\n  📨 DM Policy for ${channelName}\n`));
+	console.log(chalk.default.gray("  Who is allowed to send direct messages to your agent?\n"));
+	const { policy } = await inquirer.default.prompt([{
+		type: "list",
+		name: "policy",
+		message: "DM access policy:",
+		choices: [
+			{
+				name: `${chalk.default.yellow("Pairing")}         — Users must send a pairing code first ${chalk.default.gray("(Recommended)")}`,
+				value: "pairing"
+			},
+			{
+				name: `${chalk.default.cyan("Allowlist")}       — Only specific users/IDs can DM`,
+				value: "allowlist"
+			},
+			{
+				name: `${chalk.default.green("Open")}            — Anyone can DM ${chalk.default.red("(Not recommended for public bots)")}`,
+				value: "open"
+			},
+			{
+				name: `${chalk.default.gray("Disabled")}        — No DMs allowed`,
+				value: "disabled"
+			}
+		]
+	}]);
+	const config = { policy };
+	if (policy === "pairing") {
+		const crypto = await import("crypto");
+		config.pairingCode = crypto.randomBytes(3).toString("hex").toUpperCase();
+		console.log(chalk.default.green(`\n  ✅ Pairing code generated: ${chalk.default.bold(config.pairingCode)}`));
+		console.log(chalk.default.gray(`  Users must DM /pair ${config.pairingCode} to unlock access\n`));
+	}
+	if (policy === "allowlist") {
+		const { allowFrom } = await inquirer.default.prompt([{
+			type: "input",
+			name: "allowFrom",
+			message: "Enter allowed user IDs (comma-separated):",
+			hint: "e.g. @username, 123456789"
+		}]);
+		config.allowFrom = allowFrom.split(",").map((s) => s.trim()).filter(Boolean);
+		console.log(chalk.default.gray(`\n  Docs: https://docs.hyperclaw.ai/channels/${channelName}/allowlist\n`));
+	}
+	return config;
+}
+
+//#endregion
+Object.defineProperty(exports, 'configureDMPolicy', {
+  enumerable: true,
+  get: function () {
+    return configureDMPolicy;
+  }
+});

package/dist/security-_xve79aq.js

@@ -0,0 +1,4 @@
+const require_chunk = require('./chunk-jS-bbMI5.js');
+const require_security = require('./security-C-5URby1.js');
+
+exports.configureDMPolicy = require_security.configureDMPolicy;