limits-openclaw 0.0.6

package/dist/test/unit/pre.test.js

@@ -0,0 +1,72 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+const callEnforceMock = vi.fn();
+vi.mock("../../src/enforcer.js", () => ({ callEnforce: callEnforceMock }));
+describe("preHook", () => {
+    let beforeHandler = null;
+    beforeEach(async () => {
+        callEnforceMock.mockReset();
+        beforeHandler = null;
+        const api = {
+            config: {
+                plugins: {
+                    entries: {
+                        "limits-openclaw": {
+                            enabled: true,
+                            config: {
+                                baseUrl: "https://api.test.com",
+                                failMode: "allow",
+                                tokenSource: "event.metadata.apiToken",
+                            },
+                        },
+                    },
+                },
+            },
+            on(event, handler) {
+                if (event === "before_tool_call")
+                    beforeHandler = handler;
+            },
+        };
+        const { register } = await import("../../src/index.js");
+        register(api);
+    });
+    async function runPre(event, ctx) {
+        if (!beforeHandler)
+            throw new Error("before_tool_call not registered");
+        return beforeHandler(event, ctx);
+    }
+    it("ALLOW returns null", async () => {
+        callEnforceMock.mockResolvedValue({ action: "ALLOW" });
+        const event = {
+            toolName: "read_file",
+            toolParams: {},
+            metadata: { apiToken: "sk_ok" },
+        };
+        const result = await runPre(event, undefined);
+        expect(result).toBe(null);
+    });
+    it("BLOCK returns { block: true, reason }", async () => {
+        callEnforceMock.mockResolvedValue({
+            action: "BLOCK",
+            reason: "Policy forbids this tool",
+        });
+        const event = {
+            toolName: "stripe_charge",
+            metadata: { apiToken: "sk_ok" },
+        };
+        const result = await runPre(event, undefined);
+        expect(result).toEqual({ block: true, reason: "Policy forbids this tool" });
+    });
+    it("REWRITE returns { args }", async () => {
+        callEnforceMock.mockResolvedValue({
+            action: "REWRITE",
+            rewriteArgs: { amount: 100, currency: "usd" },
+        });
+        const event = {
+            toolName: "payment",
+            toolParams: { amount: 500 },
+            metadata: { apiToken: "sk_ok" },
+        };
+        const result = await runPre(event, undefined);
+        expect(result).toEqual({ args: { amount: 100, currency: "usd" } });
+    });
+});

package/dist/test/unit/token.test.js

@@ -0,0 +1,48 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { extractToken } from "../../src/token.js";
+describe("extractToken", () => {
+    const origEnv = process.env;
+    beforeEach(() => {
+        process.env = { ...origEnv };
+    });
+    afterEach(() => {
+        process.env = origEnv;
+    });
+    it("reads event.metadata.apiToken", () => {
+        const event = { metadata: { apiToken: "sk_test_123" } };
+        expect(extractToken("event.metadata.apiToken", event, undefined)).toBe("sk_test_123");
+    });
+    it("reads ctx.auth.token", () => {
+        const ctx = { auth: { token: "bearer_abc" } };
+        expect(extractToken("ctx.auth.token", ctx, ctx)).toBe("bearer_abc");
+    });
+    it("reads env.LIMITS_API_TOKEN", () => {
+        process.env.LIMITS_API_TOKEN = "env_secret";
+        expect(extractToken("env.LIMITS_API_TOKEN", undefined, undefined)).toBe("env_secret");
+    });
+    it("returns undefined for missing event path", () => {
+        const event = {};
+        expect(extractToken("event.metadata.apiToken", event, undefined)).toBe(undefined);
+    });
+    it("returns undefined for missing ctx path", () => {
+        const ctx = {};
+        expect(extractToken("ctx.auth.token", undefined, ctx)).toBe(undefined);
+    });
+    it("returns undefined for missing env key", () => {
+        expect(extractToken("env.NONEXISTENT_KEY_XYZ", undefined, undefined)).toBe(undefined);
+    });
+    it("returns undefined for non-string value at path", () => {
+        const event = { metadata: { apiToken: 42 } };
+        expect(extractToken("event.metadata.apiToken", event, undefined)).toBe(undefined);
+    });
+    it("returns undefined for malformed source (single segment)", () => {
+        expect(extractToken("event", {}, undefined)).toBe(undefined);
+    });
+    it("returns undefined for empty string", () => {
+        expect(extractToken("", {}, undefined)).toBe(undefined);
+    });
+    it("trims tokenSource", () => {
+        const event = { metadata: { apiToken: "trimmed" } };
+        expect(extractToken("  event.metadata.apiToken  ", event, undefined)).toBe("trimmed");
+    });
+});

package/openclaw.plugin.json

@@ -0,0 +1,45 @@
+{
+  "id": "limits-openclaw",
+  "name": "limits-openclaw",
+  "description": "Delegates policy enforcement to the Limits platform before and after every tool call. Optional policy-generator tools for creating/updating policies from natural language.",
+  "version": "0.0.1",
+  "main": "./dist/index.js",
+  "configSchema": {
+    "type": "object",
+    "additionalProperties": true,
+    "properties": {
+      "baseUrl": {
+        "type": "string",
+        "description": "Base URL for POST /openclaw/enforce and for policy-generator API calls. Same URL for enforcement and policy tools."
+      },
+      "apiToken": {
+        "type": "string",
+        "description": "Organization API key for /openclaw/enforce and policy-generator tools. Store securely in gateway config or use LIMITS_ENFORCER_API_TOKEN env."
+      },
+      "timeoutMs": {
+        "type": "number",
+        "default": 2500,
+        "description": "Request timeout in milliseconds."
+      },
+      "failMode": {
+        "type": "string",
+        "enum": [
+          "allow",
+          "block"
+        ],
+        "default": "allow",
+        "description": "When Limits backend is unreachable: allow = proceed; block = block the call (pre) or replace result (post)."
+      },
+      "tokenSource": {
+        "type": "string",
+        "default": "event.metadata.apiToken",
+        "description": "Dot-separated path to API token: event.metadata.apiToken, ctx.auth.token, or env.LIMITS_API_TOKEN."
+      },
+      "redactLogs": {
+        "type": "boolean",
+        "default": true,
+        "description": "Whether to avoid logging sensitive data."
+      }
+    }
+  }
+}

package/package.json

@@ -0,0 +1,55 @@
+{
+  "name": "limits-openclaw",
+  "version": "0.0.6",
+  "description": "Delegates policy enforcement to the Limits platform before and after every tool call.",
+  "keywords": [
+    "openclaw",
+    "limits",
+    "policy",
+    "enforcement",
+    "agent"
+  ],
+  "author": "Limits",
+  "license": "MIT",
+  "type": "module",
+  "main": "./dist/index.js",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "openclaw.plugin.json",
+    "README.md",
+    "LICENSE",
+    "package.json"
+  ],
+  "openclaw": {
+    "id": "limits-openclaw",
+    "entry": "./dist/index.js",
+    "hooks": [
+      "./"
+    ],
+    "extensions": [
+      "./"
+    ],
+    "events": [
+      "before_tool_call",
+      "after_tool_call"
+    ]
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "prepublishOnly": "npm run build",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "configure": "node scripts/configure.js"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.0.0",
+    "@types/node": "^20.0.0",
+    "vitest": "^2.0.0"
+  }
+}