openclaw-plugin-exec-grant 1.1.0 → 1.2.0

package/index.ts

@@ -1,8 +1,43 @@
 import { execFileSync } from "node:child_process";
-import { join } from "node:path";
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { homedir } from "node:os";
 
 const PLUGIN_ID = "openclaw-plugin-exec-grant";
 const SCRIPTS_DIR = join(__dirname, "skills", "exec-grant", "scripts");
+const APPROVALS_FILE = join(homedir(), ".openclaw", "exec-approvals.json");
+
+const DEFAULT_ALLOWLIST = [
+  "ls",
+  "cat",
+  "head",
+  "tail",
+  "wc",
+  "grep",
+  "find",
+  "file",
+  "echo",
+  "printf",
+  "date",
+  "whoami",
+  "pwd",
+  "git status",
+  "git log",
+  "git diff",
+  "git show",
+  "node --version",
+  "npm --version",
+  "python3 --version",
+  "openclaw config get",
+  "openclaw message send",
+  "jq",
+  "sed",
+  "awk",
+  "sort",
+  "uniq",
+  "tr",
+  "cut",
+];
 
 function runScript(
   name: string,
@@ -23,20 +58,190 @@ function runScript(
   }
 }
 
+function ensureAllowlistBaseline(logger: any): void {
+  mkdirSync(dirname(APPROVALS_FILE), { recursive: true });
+
+  if (!existsSync(APPROVALS_FILE)) {
+    const baseline = {
+      agents: {
+        main: {
+          security: "allowlist",
+          allowlist: DEFAULT_ALLOWLIST,
+        },
+      },
+    };
+    writeFileSync(APPROVALS_FILE, JSON.stringify(baseline, null, 2) + "\n");
+    logger?.info(
+      `[exec-grant] Created ${APPROVALS_FILE} with allowlist baseline (${DEFAULT_ALLOWLIST.length} commands)`,
+    );
+    return;
+  }
+
+  // File exists -- check if security mode is set
+  try {
+    const data = JSON.parse(readFileSync(APPROVALS_FILE, "utf-8"));
+    const security = data?.agents?.main?.security;
+    if (!security) {
+      // Set security to allowlist without overwriting other fields
+      if (!data.agents) data.agents = {};
+      if (!data.agents.main) data.agents.main = {};
+      data.agents.main.security = "allowlist";
+      if (!data.agents.main.allowlist) {
+        data.agents.main.allowlist = DEFAULT_ALLOWLIST;
+      }
+      writeFileSync(APPROVALS_FILE, JSON.stringify(data, null, 2) + "\n");
+      logger?.info(
+        `[exec-grant] Set agents.main.security = "allowlist" in ${APPROVALS_FILE}`,
+      );
+    }
+  } catch {
+    // File exists but isn't valid JSON -- leave it alone
+    logger?.warn(`[exec-grant] Could not parse ${APPROVALS_FILE}, skipping baseline setup`);
+  }
+}
+
 export default function register(api: any) {
-  const config = api.getConfig?.() ?? {};
-  const adminTarget = config.adminTarget;
-  const channel = config.channel;
+  const logger = api.logger;
+  const pluginConfig = api.pluginConfig ?? {};
+
+  // --- Auto-create allowlist baseline ---
+  ensureAllowlistBaseline(logger);
+
+  // --- Startup guidance ---
+  const adminTarget = pluginConfig.adminTarget;
+  const channel = pluginConfig.channel;
 
   if (!adminTarget || !channel) {
-    api.logger?.warn(
-      `[exec-grant] Missing config. Set adminTarget and channel:\n` +
-        `  openclaw config set plugins.entries.${PLUGIN_ID}.config.adminTarget "<target>"\n` +
-        `  openclaw config set plugins.entries.${PLUGIN_ID}.config.channel "<channel>"\n` +
-        `  Example channels: whatsapp, telegram, slack, discord, signal`,
+    logger?.warn(
+      `[exec-grant] Plugin installed but not configured yet.\n` +
+        `  Run: openclaw exec-grant-setup\n` +
+        `  Or manually set in openclaw.json:\n` +
+        `    plugins.entries.${PLUGIN_ID}.config.adminTarget = "<target>"\n` +
+        `    plugins.entries.${PLUGIN_ID}.config.channel = "<channel>"`,
+    );
+  } else {
+    logger?.info(
+      `[exec-grant] Ready. Admin: ${adminTarget} via ${channel}. ` +
+        `Commands: /grant <min>, /revoke, /grant-status`,
     );
   }
 
+  // --- Interactive setup CLI command ---
+  api.registerCli(
+    ({ program, config }: any) => {
+      program
+        .command("exec-grant-setup")
+        .description("Configure the exec-grant plugin interactively")
+        .action(async () => {
+          // Dynamic import for prompts (clack is bundled with openclaw)
+          let prompts: any;
+          try {
+            prompts = await import("@clack/prompts");
+          } catch {
+            // Fallback: try readline
+            console.log("\n  exec-grant setup\n");
+            console.log("  Could not load interactive prompts.");
+            console.log("  Configure manually in openclaw.json:\n");
+            printManualConfig();
+            return;
+          }
+
+          prompts.intro("exec-grant setup");
+
+          const currentConfig =
+            config?.plugins?.entries?.[PLUGIN_ID]?.config ?? {};
+
+          const channelChoice = await prompts.select({
+            message: "Which messaging channel should approval requests use?",
+            options: [
+              { value: "whatsapp", label: "WhatsApp" },
+              { value: "telegram", label: "Telegram" },
+              { value: "slack", label: "Slack" },
+              { value: "discord", label: "Discord" },
+              { value: "signal", label: "Signal" },
+              { value: "msteams", label: "Microsoft Teams" },
+              { value: "matrix", label: "Matrix" },
+              { value: "other", label: "Other" },
+            ],
+            initialValue: currentConfig.channel || "whatsapp",
+          });
+
+          if (prompts.isCancel(channelChoice)) {
+            prompts.cancel("Setup cancelled.");
+            return;
+          }
+
+          let selectedChannel = channelChoice as string;
+          if (selectedChannel === "other") {
+            const custom = await prompts.text({
+              message: "Enter the channel name:",
+              placeholder: "nostr",
+            });
+            if (prompts.isCancel(custom)) {
+              prompts.cancel("Setup cancelled.");
+              return;
+            }
+            selectedChannel = custom as string;
+          }
+
+          const targetHint = getTargetHint(selectedChannel);
+          const target = await prompts.text({
+            message: `Admin contact (${targetHint.label}):`,
+            placeholder: targetHint.placeholder,
+            initialValue: currentConfig.adminTarget || "",
+            validate: (val: string) =>
+              val.trim().length === 0 ? "Required" : undefined,
+          });
+
+          if (prompts.isCancel(target)) {
+            prompts.cancel("Setup cancelled.");
+            return;
+          }
+
+          // Write config
+          console.log("");
+          try {
+            execFileSync("bash", [
+              "-c",
+              `openclaw config set "plugins.entries.${PLUGIN_ID}.config.channel" "${selectedChannel}" && ` +
+                `openclaw config set "plugins.entries.${PLUGIN_ID}.config.adminTarget" "${(target as string).trim()}"`,
+            ], { encoding: "utf-8", timeout: 15_000 });
+          } catch {
+            prompts.log.error("Failed to write config. Set manually:");
+            printManualConfig(selectedChannel, (target as string).trim());
+            return;
+          }
+
+          prompts.log.success(
+            `Channel: ${selectedChannel}\n  Admin: ${(target as string).trim()}`,
+          );
+
+          // Check allowlist baseline
+          if (existsSync(APPROVALS_FILE)) {
+            try {
+              const data = JSON.parse(readFileSync(APPROVALS_FILE, "utf-8"));
+              const sec = data?.agents?.main?.security;
+              prompts.log.info(
+                `Allowlist baseline: ${APPROVALS_FILE}\n  Security mode: ${sec || "not set"}`,
+              );
+            } catch {
+              // skip
+            }
+          }
+
+          prompts.log.info(
+            "Restart the gateway to apply changes:\n  openclaw gateway restart",
+          );
+
+          prompts.outro(
+            "Setup complete! Commands available: /grant <min>, /revoke, /grant-status",
+          );
+        });
+    },
+    { commands: ["exec-grant-setup"] },
+  );
+
+  // --- Slash commands ---
   api.registerCommand({
     name: "grant",
     description: "Activate time-boxed elevated shell access (admin only)",
@@ -47,7 +252,6 @@ export default function register(api: any) {
       if (!minutes || !/^\d+$/.test(minutes)) {
         return { text: "Usage: /grant <minutes>  (1-120)" };
       }
-      // Reply on the channel the admin used to send the command
       const replyChannel = ctx.channel || channel;
       const replyTarget = ctx.sender || adminTarget;
       const result = runScript("grant.sh", [minutes], {
@@ -85,3 +289,47 @@ export default function register(api: any) {
     },
   });
 }
+
+function getTargetHint(channel: string): {
+  label: string;
+  placeholder: string;
+} {
+  switch (channel) {
+    case "whatsapp":
+    case "signal":
+      return { label: "E.164 phone number", placeholder: "+16505551234" };
+    case "telegram":
+      return { label: "chat ID or @username", placeholder: "@admin" };
+    case "slack":
+      return {
+        label: "channel or user ID",
+        placeholder: "#approvals or @admin",
+      };
+    case "discord":
+      return { label: "channel or user ID", placeholder: "#approvals" };
+    case "msteams":
+      return { label: "channel or user", placeholder: "user@company.com" };
+    case "matrix":
+      return { label: "room or user", placeholder: "@admin:matrix.org" };
+    default:
+      return { label: "recipient identifier", placeholder: "admin" };
+  }
+}
+
+function printManualConfig(channel?: string, target?: string): void {
+  console.log(`    "plugins": {`);
+  console.log(`      "entries": {`);
+  console.log(`        "${PLUGIN_ID}": {`);
+  console.log(`          "enabled": true,`);
+  console.log(`          "config": {`);
+  console.log(
+    `            "adminTarget": "${target || "<your-admin-contact>"}"`,
+  );
+  console.log(
+    `            "channel": "${channel || "<whatsapp|telegram|slack|...>"}"`,
+  );
+  console.log(`          }`);
+  console.log(`        }`);
+  console.log(`      }`);
+  console.log(`    }`);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-plugin-exec-grant",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Time-boxed elevated shell access with WhatsApp admin approval for OpenClaw",
   "main": "index.ts",
   "license": "MIT",