openclaw-safeclaw-plugin 0.9.1 → 1.0.0

package/cli.tsx

@@ -134,7 +134,37 @@ if (command === 'connect') {
   writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
   chmodSync(configPath, 0o600);
 
-  console.log(`Connected! API key saved to ${configPath}`);
+  console.log(`API key saved to ${configPath}`);
+
+  // Validate key via handshake
+  try {
+    const res = await fetch(`${serviceUrl}/handshake`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        'Authorization': `Bearer ${apiKey}`,
+      },
+      body: JSON.stringify({ pluginVersion: '0.1.3', configHash: '' }),
+      signal: AbortSignal.timeout(5000),
+    });
+    if (res.ok) {
+      const data = await res.json() as Record<string, unknown>;
+      console.log(`Connected! org=${data.orgId}, scope=${data.scope}`);
+    } else {
+      let detail = `HTTP ${res.status}`;
+      try {
+        const body = await res.json() as Record<string, unknown>;
+        detail = (body.error ?? body.detail ?? detail) as string;
+      } catch { /* ignore */ }
+      console.warn(`Warning: API key saved but handshake failed — ${detail}`);
+      if (res.status === 401) {
+        console.warn('The key may be invalid or revoked. Check https://safeclaw.eu/dashboard');
+      }
+    }
+  } catch {
+    console.warn(`Warning: API key saved but could not reach ${serviceUrl}`);
+    console.warn('Run "safeclaw status" later to verify the connection.');
+  }
 
   // Register with OpenClaw
   console.log('Registering SafeClaw plugin with OpenClaw...');

package/dist/cli.js

@@ -119,7 +119,39 @@ if (command === 'connect') {
     mkdirSync(configDir, { recursive: true });
     writeFileSync(configPath, JSON.stringify(config, null, 2) + '\n');
     chmodSync(configPath, 0o600);
-    console.log(`Connected! API key saved to ${configPath}`);
+    console.log(`API key saved to ${configPath}`);
+    // Validate key via handshake
+    try {
+        const res = await fetch(`${serviceUrl}/handshake`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'Authorization': `Bearer ${apiKey}`,
+            },
+            body: JSON.stringify({ pluginVersion: '0.1.3', configHash: '' }),
+            signal: AbortSignal.timeout(5000),
+        });
+        if (res.ok) {
+            const data = await res.json();
+            console.log(`Connected! org=${data.orgId}, scope=${data.scope}`);
+        }
+        else {
+            let detail = `HTTP ${res.status}`;
+            try {
+                const body = await res.json();
+                detail = (body.error ?? body.detail ?? detail);
+            }
+            catch { /* ignore */ }
+            console.warn(`Warning: API key saved but handshake failed — ${detail}`);
+            if (res.status === 401) {
+                console.warn('The key may be invalid or revoked. Check https://safeclaw.eu/dashboard');
+            }
+        }
+    }
+    catch {
+        console.warn(`Warning: API key saved but could not reach ${serviceUrl}`);
+        console.warn('Run "safeclaw status" later to verify the connection.');
+    }
     // Register with OpenClaw
     console.log('Registering SafeClaw plugin with OpenClaw...');
     const registered = registerWithOpenClaw();

package/dist/index.js

@@ -29,7 +29,8 @@ async function post(path, body) {
             // Try to parse structured error body from service
             try {
                 const errBody = await res.json();
-                const detail = errBody.detail ?? `HTTP ${res.status}`;
+                const rawDetail = errBody.detail ?? `HTTP ${res.status}`;
+                const detail = typeof rawDetail === 'string' ? rawDetail : JSON.stringify(rawDetail);
                 const hint = errBody.hint ? ` (${errBody.hint})` : '';
                 console.warn(`[SafeClaw] ${path}: ${detail}${hint}`);
             }
@@ -109,15 +110,10 @@ export default {
         // Heartbeat watchdog — send config hash to service every 30s
         const sendHeartbeat = async () => {
             try {
-                await fetch(`${config.serviceUrl}/heartbeat`, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        agentId: config.agentId || 'default',
-                        configHash: configHash(config),
-                        status: 'alive',
-                    }),
-                    signal: AbortSignal.timeout(config.timeoutMs),
+                await post('/heartbeat', {
+                    agentId: config.agentId || 'default',
+                    configHash: configHash(config),
+                    status: 'alive',
                 });
             }
             catch {
@@ -138,14 +134,10 @@ export default {
         // Clean shutdown: send shutdown heartbeat and clear interval
         const shutdown = () => {
             clearInterval(heartbeatInterval);
-            fetch(`${config.serviceUrl}/heartbeat`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    agentId: config.agentId || 'default',
-                    configHash: configHash(config),
-                    status: 'shutdown',
-                }),
+            post('/heartbeat', {
+                agentId: config.agentId || 'default',
+                configHash: configHash(config),
+                status: 'shutdown',
             }).catch(() => { });
         };
         process.on('exit', shutdown);

package/dist/tui/config.js

@@ -105,8 +105,8 @@ export function saveConfig(config) {
     existing.enforcement.mode = config.enforcement;
     existing.enforcement.failMode = config.failMode;
     // Ensure parent directory exists
-    mkdirSync(dirname(CONFIG_PATH), { recursive: true });
-    writeFileSync(CONFIG_PATH, JSON.stringify(existing, null, 2) + '\n', 'utf-8');
+    mkdirSync(dirname(CONFIG_PATH), { recursive: true, mode: 0o700 });
+    writeFileSync(CONFIG_PATH, JSON.stringify(existing, null, 2) + '\n', { encoding: 'utf-8', mode: 0o600 });
 }
 /**
  * SHA-256 hash of the four TUI-managed config fields.

package/index.ts

@@ -36,7 +36,8 @@ async function post(path: string, body: Record<string, unknown>): Promise<Record
       // Try to parse structured error body from service
       try {
         const errBody = await res.json() as Record<string, unknown>;
-        const detail = errBody.detail ?? `HTTP ${res.status}`;
+        const rawDetail = errBody.detail ?? `HTTP ${res.status}`;
+        const detail = typeof rawDetail === 'string' ? rawDetail : JSON.stringify(rawDetail);
         const hint = errBody.hint ? ` (${errBody.hint})` : '';
         console.warn(`[SafeClaw] ${path}: ${detail}${hint}`);
       } catch {
@@ -141,15 +142,10 @@ export default {
     // Heartbeat watchdog — send config hash to service every 30s
     const sendHeartbeat = async () => {
       try {
-        await fetch(`${config.serviceUrl}/heartbeat`, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({
-            agentId: config.agentId || 'default',
-            configHash: configHash(config),
-            status: 'alive',
-          }),
-          signal: AbortSignal.timeout(config.timeoutMs),
+        await post('/heartbeat', {
+          agentId: config.agentId || 'default',
+          configHash: configHash(config),
+          status: 'alive',
         });
       } catch {
         // Heartbeat failure is non-fatal
@@ -171,14 +167,10 @@ export default {
     // Clean shutdown: send shutdown heartbeat and clear interval
     const shutdown = () => {
       clearInterval(heartbeatInterval);
-      fetch(`${config.serviceUrl}/heartbeat`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          agentId: config.agentId || 'default',
-          configHash: configHash(config),
-          status: 'shutdown',
-        }),
+      post('/heartbeat', {
+        agentId: config.agentId || 'default',
+        configHash: configHash(config),
+        status: 'shutdown',
       }).catch(() => {});
     };
     process.on('exit', shutdown);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-safeclaw-plugin",
-  "version": "0.9.1",
+  "version": "1.0.0",
   "description": "SafeClaw Neurosymbolic Governance plugin for OpenClaw — validates AI agent actions against OWL ontologies and SHACL constraints",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/tui/config.ts

@@ -116,9 +116,9 @@ export function saveConfig(config: SafeClawConfig): void {
   (existing.enforcement as Record<string, unknown>).failMode = config.failMode;
 
   // Ensure parent directory exists
-  mkdirSync(dirname(CONFIG_PATH), { recursive: true });
+  mkdirSync(dirname(CONFIG_PATH), { recursive: true, mode: 0o700 });
 
-  writeFileSync(CONFIG_PATH, JSON.stringify(existing, null, 2) + '\n', 'utf-8');
+  writeFileSync(CONFIG_PATH, JSON.stringify(existing, null, 2) + '\n', { encoding: 'utf-8', mode: 0o600 });
 }
 
 /**