npm - openclaw-safeclaw-plugin - Versions diffs - 0.9.2 → 1.1.0 - Mend

openclaw-safeclaw-plugin 0.9.2 → 1.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (17) hide show

package/dist/index.js CHANGED Viewed

@@ -7,29 +7,45 @@
  * to the SafeClaw service and acts on the responses.
  */
 import { loadConfig, configHash } from './tui/config.js';
+import crypto from 'crypto';
+import { createRequire } from 'module';
+const require = createRequire(import.meta.url);
+const { version: PLUGIN_VERSION } = require('./package.json');
 // --- Configuration ---
-const config = loadConfig();
+const CONFIG_RELOAD_INTERVAL_MS = 60_000; // Reload config every 60 seconds
+let config = loadConfig();
+let configLoadedAt = Date.now();
+function getConfig() {
+    const now = Date.now();
+    if (now - configLoadedAt >= CONFIG_RELOAD_INTERVAL_MS) {
+        config = loadConfig();
+        configLoadedAt = now;
+    }
+    return config;
+}
 // --- HTTP Client ---
 async function post(path, body) {
-    if (!config.enabled)
+    const cfg = getConfig();
+    if (!cfg.enabled)
         return null;
     const headers = { 'Content-Type': 'application/json' };
-    if (config.apiKey) {
-        headers['Authorization'] = `Bearer ${config.apiKey}`;
+    if (cfg.apiKey) {
+        headers['Authorization'] = `Bearer ${cfg.apiKey}`;
     }
-    const agentFields = config.agentId ? { agentId: config.agentId, agentToken: config.agentToken } : {};
+    const agentFields = cfg.agentId ? { agentId: cfg.agentId, agentToken: cfg.agentToken } : {};
     try {
-        const res = await fetch(`${config.serviceUrl}${path}`, {
+        const res = await fetch(`${cfg.serviceUrl}${path}`, {
             method: 'POST',
             headers,
             body: JSON.stringify({ ...body, ...agentFields }),
-            signal: AbortSignal.timeout(config.timeoutMs),
+            signal: AbortSignal.timeout(cfg.timeoutMs),
         });
         if (!res.ok) {
             // Try to parse structured error body from service
             try {
                 const errBody = await res.json();
-                const detail = errBody.detail ?? `HTTP ${res.status}`;
+                const rawDetail = errBody.detail ?? `HTTP ${res.status}`;
+                const detail = typeof rawDetail === 'string' ? rawDetail : JSON.stringify(rawDetail);
                 const hint = errBody.hint ? ` (${errBody.hint})` : '';
                 console.warn(`[SafeClaw] ${path}: ${detail}${hint}`);
             }
@@ -42,26 +58,27 @@ async function post(path, body) {
     }
     catch (e) {
         if (e instanceof DOMException && e.name === 'TimeoutError') {
-            console.warn(`[SafeClaw] Timeout after ${config.timeoutMs}ms on ${path} (${config.serviceUrl})`);
+            console.warn(`[SafeClaw] Timeout after ${cfg.timeoutMs}ms on ${path} (${cfg.serviceUrl})`);
         }
         else if (e instanceof TypeError && (e.message.includes('fetch') || e.message.includes('ECONNREFUSED'))) {
-            console.warn(`[SafeClaw] Connection refused: ${config.serviceUrl}${path} — is the service running?`);
+            console.warn(`[SafeClaw] Connection refused: ${cfg.serviceUrl}${path} — is the service running?`);
         }
         else {
-            console.warn(`[SafeClaw] Service unavailable: ${config.serviceUrl}${path}`);
+            console.warn(`[SafeClaw] Service unavailable: ${cfg.serviceUrl}${path}`);
         }
         return null; // Caller checks failMode
     }
 }
 let handshakeCompleted = false;
 async function performHandshake() {
-    if (!config.apiKey) {
+    const cfg = getConfig();
+    if (!cfg.apiKey) {
         console.warn('[SafeClaw] No API key configured — skipping handshake');
         return false;
     }
     const r = await post('/handshake', {
-        pluginVersion: '0.1.3',
-        configHash: configHash(config),
+        pluginVersion: PLUGIN_VERSION,
+        configHash: configHash(cfg),
     });
     if (r === null) {
         console.warn('[SafeClaw] ✗ Handshake failed — API key may be invalid or service unreachable');
@@ -72,12 +89,13 @@ async function performHandshake() {
     return true;
 }
 async function checkConnection() {
+    const cfg = getConfig();
     const label = `[SafeClaw]`;
-    console.log(`${label} Connecting to ${config.serviceUrl} ...`);
-    console.log(`${label} Mode: enforcement=${config.enforcement}, failMode=${config.failMode}`);
+    console.log(`${label} Connecting to ${cfg.serviceUrl} ...`);
+    console.log(`${label} Mode: enforcement=${cfg.enforcement}, failMode=${cfg.failMode}`);
     try {
-        const res = await fetch(`${config.serviceUrl}/health`, {
-            signal: AbortSignal.timeout(config.timeoutMs * 2),
+        const res = await fetch(`${cfg.serviceUrl}/health`, {
+            signal: AbortSignal.timeout(cfg.timeoutMs * 2),
         });
         if (res.ok) {
             const data = await res.json();
@@ -88,8 +106,8 @@ async function checkConnection() {
         }
     }
     catch {
-        console.warn(`${label} ✗ Cannot reach service at ${config.serviceUrl}`);
-        if (config.failMode === 'closed') {
+        console.warn(`${label} ✗ Cannot reach service at ${cfg.serviceUrl}`);
+        if (cfg.failMode === 'closed') {
             console.warn(`${label}   fail-mode=closed → tool calls will be BLOCKED until service is reachable`);
         }
         else {
@@ -100,60 +118,61 @@ async function checkConnection() {
 export default {
     id: 'safeclaw',
     name: 'SafeClaw Neurosymbolic Governance',
-    version: '0.1.3',
+    version: PLUGIN_VERSION,
     register(api) {
-        if (!config.enabled) {
+        if (!getConfig().enabled) {
             console.log('[SafeClaw] Plugin disabled');
             return;
         }
+        // Generate a unique instance ID for this plugin run (fallback when agentId is not configured)
+        const instanceId = getConfig().agentId || `instance-${crypto.randomUUID()}`;
         // Heartbeat watchdog — send config hash to service every 30s
         const sendHeartbeat = async () => {
             try {
-                await fetch(`${config.serviceUrl}/heartbeat`, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({
-                        agentId: config.agentId || 'default',
-                        configHash: configHash(config),
-                        status: 'alive',
-                    }),
-                    signal: AbortSignal.timeout(config.timeoutMs),
+                await post('/heartbeat', {
+                    agentId: instanceId,
+                    configHash: configHash(getConfig()),
+                    status: 'alive',
                 });
             }
             catch {
                 // Heartbeat failure is non-fatal
             }
         };
-        // Start heartbeat after connection check + handshake
+        // Start heartbeat only after connection check + handshake completes (#84)
+        let heartbeatInterval;
         checkConnection()
             .then(() => performHandshake())
             .then((ok) => {
-            if (!ok && config.failMode === 'closed') {
-                console.warn('[SafeClaw] ⚠ Handshake failed with fail-mode=closed — tool calls will be BLOCKED');
+            if (!ok && getConfig().failMode === 'closed') {
+                console.warn('[SafeClaw] Handshake failed with fail-mode=closed — tool calls will be BLOCKED');
             }
+            heartbeatInterval = setInterval(sendHeartbeat, 30000);
             return sendHeartbeat();
         })
             .catch(() => { });
-        const heartbeatInterval = setInterval(sendHeartbeat, 30000);
         // Clean shutdown: send shutdown heartbeat and clear interval
-        const shutdown = () => {
-            clearInterval(heartbeatInterval);
-            fetch(`${config.serviceUrl}/heartbeat`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({
-                    agentId: config.agentId || 'default',
-                    configHash: configHash(config),
+        // Use async shutdown for SIGINT/SIGTERM where async is supported (#55)
+        const shutdown = async () => {
+            if (heartbeatInterval)
+                clearInterval(heartbeatInterval);
+            try {
+                await post('/heartbeat', {
+                    agentId: instanceId,
+                    configHash: configHash(getConfig()),
                     status: 'shutdown',
-                }),
-            }).catch(() => { });
+                });
+            }
+            catch {
+                // Best-effort shutdown notification
+            }
         };
-        process.on('exit', shutdown);
-        process.on('SIGINT', () => { shutdown(); process.exit(0); });
-        process.on('SIGTERM', () => { shutdown(); process.exit(0); });
+        process.on('SIGINT', async () => { await shutdown(); process.exit(0); });
+        process.on('SIGTERM', async () => { await shutdown(); process.exit(0); });
         // THE GATE — constraint checking on every tool call
         api.on('before_tool_call', async (event, ctx) => {
-            if (!handshakeCompleted && config.failMode === 'closed' && config.enforcement === 'enforce') {
+            const cfg = getConfig();
+            if (!handshakeCompleted && cfg.failMode === 'closed' && cfg.enforcement === 'enforce') {
                 return { block: true, blockReason: 'SafeClaw handshake not completed (fail-closed)' };
             }
             const r = await post('/evaluate/tool-call', {
@@ -163,21 +182,22 @@ export default {
                 params: event.params ?? {},
                 sessionHistory: event.sessionHistory ?? [],
             });
-            if (r === null && config.failMode === 'closed' && config.enforcement === 'enforce') {
-                return { block: true, blockReason: `SafeClaw service unavailable at ${config.serviceUrl} (fail-closed)` };
+            if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'enforce') {
+                return { block: true, blockReason: `SafeClaw service unavailable at ${cfg.serviceUrl} (fail-closed)` };
             }
-            else if (r === null && config.failMode === 'closed' && config.enforcement === 'warn-only') {
-                console.warn(`[SafeClaw] Service unavailable at ${config.serviceUrl} (fail-closed mode, warn-only)`);
+            else if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'warn-only') {
+                console.warn(`[SafeClaw] Service unavailable at ${cfg.serviceUrl} (fail-closed mode, warn-only)`);
             }
-            else if (r === null && config.failMode === 'closed' && config.enforcement === 'audit-only') {
-                console.warn(`[SafeClaw] Service unavailable at ${config.serviceUrl} (fail-closed mode, audit-only)`);
+            else if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'audit-only') {
+                console.warn(`[SafeClaw] Service unavailable at ${cfg.serviceUrl} (fail-closed mode, audit-only)`);
             }
             if (r?.block) {
-                if (config.enforcement === 'enforce') {
-                    return { block: true, blockReason: r.reason };
+                const blockReason = r.reason || 'Blocked by SafeClaw (no reason provided)';
+                if (cfg.enforcement === 'enforce') {
+                    return { block: true, blockReason };
                 }
-                if (config.enforcement === 'warn-only') {
-                    console.warn(`[SafeClaw] Warning: ${r.reason}`);
+                if (cfg.enforcement === 'warn-only') {
+                    console.warn(`[SafeClaw] Warning: ${blockReason}`);
                 }
                 // audit-only: logged server-side, no action here
             }
@@ -194,24 +214,29 @@ export default {
         }, { priority: 100 });
         // Message governance — check outbound messages
         api.on('message_sending', async (event, ctx) => {
+            const cfg = getConfig();
             const r = await post('/evaluate/message', {
                 sessionId: ctx.sessionId ?? event.sessionId,
                 userId: ctx.userId ?? event.userId,
                 to: event.to,
                 content: event.content,
             });
-            if (r === null && config.failMode === 'closed' && config.enforcement === 'enforce') {
-                return { cancel: true };
+            if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'enforce') {
+                return { cancel: true, cancelReason: 'SafeClaw service unavailable (fail-closed mode)' };
             }
-            else if (r === null && config.failMode === 'closed' && config.enforcement === 'warn-only') {
+            else if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'warn-only') {
                 console.warn('[SafeClaw] Service unavailable (fail-closed mode, warn-only)');
             }
+            else if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'audit-only') {
+                console.info('[SafeClaw] audit-only: service unreachable, allowing message (fail-closed)');
+            }
             if (r?.block) {
-                if (config.enforcement === 'enforce') {
-                    return { cancel: true };
+                const blockReason = r.reason || 'Blocked by SafeClaw (no reason provided)';
+                if (cfg.enforcement === 'enforce') {
+                    return { cancel: true, cancelReason: blockReason };
                 }
-                if (config.enforcement === 'warn-only') {
-                    console.warn(`[SafeClaw] Warning: ${r.reason}`);
+                if (cfg.enforcement === 'warn-only') {
+                    console.warn(`[SafeClaw] Warning: ${blockReason}`);
                 }
                 // audit-only: logged server-side, no action here
             }

package/dist/tui/About.js CHANGED Viewed

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Text, Box } from 'ink';
 export default function About() {
-    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, children: "About" }) }), _jsx(Text, { children: "  SafeClaw Neurosymbolic Governance" }), _jsx(Text, { dimColor: true, children: "  Validates AI agent actions against OWL" }), _jsx(Text, { dimColor: true, children: "  ontologies and SHACL constraints." }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { children: "  Web:  " }), _jsx(Text, { color: "cyan", children: "https://safeclaw.eu" })] }), _jsxs(Box, { children: [_jsx(Text, { children: "  Docs: " }), _jsx(Text, { color: "cyan", children: "https://safeclaw.eu/docs" })] }), _jsxs(Box, { children: [_jsx(Text, { children: "  Repo: " }), _jsx(Text, { color: "cyan", children: "https://github.com/tendlyeu/SafeClaw" })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "  q to quit" }) })] }));
+    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, children: "About SafeClaw" }) }), _jsx(Text, { children: "  Neurosymbolic governance for AI agents." }), _jsx(Text, { dimColor: true, children: "  Validates tool calls, messages, and actions against" }), _jsx(Text, { dimColor: true, children: "  OWL ontologies and SHACL constraints before execution." }), _jsx(Box, { marginTop: 1, marginBottom: 1, children: _jsx(Text, { bold: true, children: "  Features" }) }), _jsx(Text, { dimColor: true, children: "  - 9-step constraint pipeline (SHACL, policies, preferences, dependencies)" }), _jsx(Text, { dimColor: true, children: "  - Role-based access control with per-user preferences" }), _jsx(Text, { dimColor: true, children: "  - Multi-agent governance with delegation detection" }), _jsx(Text, { dimColor: true, children: "  - Append-only audit trail with compliance reporting" }), _jsx(Text, { dimColor: true, children: "  - Passive LLM security reviewer and classification observer" }), _jsx(Text, { dimColor: true, children: "  - Natural language policy compilation" }), _jsx(Box, { marginTop: 1, marginBottom: 1, children: _jsx(Text, { bold: true, children: "  CLI commands" }) }), _jsx(Text, { dimColor: true, children: "  safeclaw-plugin  This plugin CLI (connect, status, config, tui)" }), _jsx(Text, { dimColor: true, children: "  safeclaw         Service CLI (serve, audit, policy, pref, status)" }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { children: "  Web:  " }), _jsx(Text, { color: "cyan", children: "https://safeclaw.eu" })] }), _jsxs(Box, { children: [_jsx(Text, { children: "  Docs: " }), _jsx(Text, { color: "cyan", children: "https://safeclaw.eu/docs" })] }), _jsxs(Box, { children: [_jsx(Text, { children: "  Repo: " }), _jsx(Text, { color: "cyan", children: "https://github.com/tendlyeu/SafeClaw" })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "  q to quit" }) })] }));
 }

package/dist/tui/App.js CHANGED Viewed

@@ -33,5 +33,5 @@ export default function App() {
             }
         }
     });
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { borderStyle: "single", borderColor: "green", paddingX: 1, children: [_jsx(Text, { bold: true, color: "green", children: "SafeClaw " }), _jsxs(Text, { dimColor: true, children: ["v", PKG_VERSION] })] }), _jsxs(Box, { paddingX: 1, gap: 2, children: [TABS.map((t, i) => (_jsx(Text, { bold: tab === t, color: tab === t ? 'cyan' : 'white', dimColor: tab !== t, children: `${i + 1}:${t}` }, t))), _jsx(Text, { dimColor: true, children: " tab/1-3 to switch" })] }), _jsxs(Box, { marginTop: 1, children: [tab === 'Status' && _jsx(Status, { config: config }), tab === 'Settings' && (_jsx(Settings, { config: config, onConfigChange: setConfig })), tab === 'About' && _jsx(About, {})] })] }));
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { borderStyle: "single", borderColor: "green", paddingX: 1, children: [_jsx(Text, { bold: true, color: "green", children: "SafeClaw " }), _jsxs(Text, { dimColor: true, children: ["v", PKG_VERSION] })] }), _jsxs(Box, { paddingX: 1, gap: 2, children: [TABS.map((t, i) => (_jsx(Text, { bold: tab === t, color: tab === t ? 'cyan' : 'white', dimColor: tab !== t, children: `${i + 1}:${t}` }, t))), _jsx(Text, { dimColor: true, children: " tab/1-3 switch  q quit" })] }), _jsxs(Box, { marginTop: 1, children: [tab === 'Status' && _jsx(Status, { config: config }), tab === 'Settings' && (_jsx(Settings, { config: config, onConfigChange: setConfig })), tab === 'About' && _jsx(About, {})] })] }));
 }

package/dist/tui/Settings.js CHANGED Viewed

@@ -9,6 +9,7 @@ const SETTINGS = [
     { key: 'enforcement', label: 'Enforcement', type: 'cycle', values: ENFORCEMENT_MODES },
     { key: 'failMode', label: 'Fail Mode', type: 'cycle', values: FAIL_MODES },
     { key: 'serviceUrl', label: 'Service URL', type: 'text' },
+    { key: 'apiKey', label: 'API Key', type: 'text' },
 ];
 export default function Settings({ config, onConfigChange }) {
     const [selected, setSelected] = useState(0);
@@ -22,7 +23,18 @@ export default function Settings({ config, onConfigChange }) {
     useInput((input, key) => {
         if (editing) {
             if (key.return) {
-                updateConfig({ serviceUrl: editBuffer });
+                const editingKey = SETTINGS[selected].key;
+                if (editingKey === 'apiKey' && editBuffer && !editBuffer.startsWith('sc_')) {
+                    // Reject invalid API keys — must start with sc_
+                    return;
+                }
+                try {
+                    updateConfig({ [editingKey]: editBuffer });
+                }
+                catch {
+                    // saveConfig may throw on invalid URL — stay in edit mode
+                    return;
+                }
                 setEditing(false);
             }
             else if (key.escape) {
@@ -57,7 +69,7 @@ export default function Settings({ config, onConfigChange }) {
             }
             else if (setting.type === 'text' && key.return) {
                 setEditing(true);
-                setEditBuffer(config.serviceUrl);
+                setEditBuffer(String(config[setting.key] ?? ''));
             }
         }
     });
@@ -68,8 +80,13 @@ export default function Settings({ config, onConfigChange }) {
                 if (setting.key === 'enabled') {
                     value = config.enabled ? 'ON' : 'OFF';
                 }
-                else if (setting.key === 'serviceUrl' && editing && isSelected) {
-                    value = editBuffer + '█';
+                else if (setting.type === 'text' && editing && isSelected) {
+                    value = (setting.key === 'apiKey' ? '*'.repeat(editBuffer.length) : editBuffer) + '█';
+                }
+                else if (setting.key === 'apiKey') {
+                    value = config.apiKey
+                        ? `${config.apiKey.slice(0, 6)}..${config.apiKey.slice(-4)}`
+                        : '(not set)';
                 }
                 else {
                     value = String(config[setting.key]);
@@ -79,6 +96,8 @@ export default function Settings({ config, onConfigChange }) {
                                 ? config.enabled ? 'green' : 'red'
                                 : undefined, children: value }), showArrows && _jsx(Text, { dimColor: true, children: ' ▶' })] }, setting.key));
             }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: editing
-                        ? '  type to edit · enter to save · esc to cancel'
-                        : '  ↑↓ navigate · ←→ change · enter to edit URL · q quit' }) }), _jsx(Box, { children: _jsx(Text, { dimColor: true, children: '  Saves to ~/.safeclaw/config.json' }) })] }));
+                        ? SETTINGS[selected].key === 'apiKey' && editBuffer && !editBuffer.startsWith('sc_')
+                            ? '  API key must start with sc_ · esc to cancel'
+                            : '  type to edit · enter to save · esc to cancel'
+                        : '  ↑↓ navigate · ←→/enter cycle/toggle · enter to edit text fields · q quit' }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: '  Enforcement: enforce=block violations, warn-only=log only, audit-only=record only, disabled=off' }) }), _jsx(Box, { children: _jsx(Text, { dimColor: true, children: '  Fail Mode:   open=allow if service unreachable, closed=block if service unreachable' }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: '  All changes save to ~/.safeclaw/config.json immediately.' }) })] }));
 }

package/dist/tui/Status.js CHANGED Viewed

@@ -1,13 +1,22 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
 import { useState, useEffect } from 'react';
 import { Text, Box, useInput } from 'ink';
 import { exec } from 'child_process';
+import { existsSync, readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { homedir } from 'os';
+import { fileURLToPath } from 'url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PKG_VERSION = JSON.parse(readFileSync(join(__dirname, '..', '..', 'package.json'), 'utf-8')).version;
 export default function Status({ config }) {
     const [health, setHealth] = useState(null);
     const [error, setError] = useState(null);
     const [lastCheck, setLastCheck] = useState(null);
     const [openclawStatus, setOpenclawStatus] = useState('checking');
     const [restartMsg, setRestartMsg] = useState(null);
+    const [evaluateStatus, setEvaluateStatus] = useState('checking');
+    const [handshakeStatus, setHandshakeStatus] = useState('checking');
+    const [handshakeDetail, setHandshakeDetail] = useState('');
     const checkHealth = async () => {
         try {
             const res = await fetch(`${config.serviceUrl}/health`, {
@@ -17,18 +26,76 @@ export default function Status({ config }) {
                 const data = await res.json();
                 setHealth(data);
                 setError(null);
+                // If healthy, run deeper checks
+                checkEvaluate();
+                if (config.apiKey)
+                    checkHandshake();
+                else {
+                    setHandshakeStatus('fail');
+                    setHandshakeDetail('No API key');
+                }
             }
             else {
                 setHealth(null);
                 setError(`HTTP ${res.status}`);
+                setEvaluateStatus('fail');
+                setHandshakeStatus('fail');
             }
         }
         catch {
             setHealth(null);
             setError('Cannot connect');
+            setEvaluateStatus('fail');
+            setHandshakeStatus('fail');
         }
         setLastCheck(new Date());
     };
+    const checkEvaluate = async () => {
+        try {
+            const res = await fetch(`${config.serviceUrl}/evaluate/tool-call`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(config.apiKey ? { 'Authorization': `Bearer ${config.apiKey}` } : {}),
+                },
+                body: JSON.stringify({
+                    sessionId: 'tui-check', userId: 'tui-check',
+                    toolName: 'echo', params: { message: 'tui-check' },
+                }),
+                signal: AbortSignal.timeout(config.timeoutMs),
+            });
+            setEvaluateStatus(res.ok || res.status === 422 || res.status === 401 || res.status === 403 ? 'ok' : 'fail');
+        }
+        catch {
+            setEvaluateStatus('fail');
+        }
+    };
+    const checkHandshake = async () => {
+        try {
+            const res = await fetch(`${config.serviceUrl}/handshake`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Authorization': `Bearer ${config.apiKey}`,
+                },
+                body: JSON.stringify({ pluginVersion: PKG_VERSION, configHash: '' }),
+                signal: AbortSignal.timeout(config.timeoutMs),
+            });
+            if (res.ok) {
+                const data = await res.json();
+                setHandshakeStatus('ok');
+                setHandshakeDetail(`org=${data.orgId ?? '?'}`);
+            }
+            else {
+                setHandshakeStatus('fail');
+                setHandshakeDetail(`HTTP ${res.status}`);
+            }
+        }
+        catch {
+            setHandshakeStatus('fail');
+            setHandshakeDetail('timeout');
+        }
+    };
     const checkOpenClaw = () => {
         exec('openclaw daemon status', { timeout: 10000 }, (err, stdout) => {
             if (err) {
@@ -67,6 +134,7 @@ export default function Status({ config }) {
             restartOpenClaw();
         }
     });
+    // Derived display values
     const connected = health !== null;
     const dot = '●';
     const serviceDotColor = connected ? 'green' : 'red';
@@ -77,5 +145,29 @@ export default function Status({ config }) {
     const openclawText = openclawStatus === 'checking' ? 'Checking...'
         : openclawStatus === 'running' ? 'Running'
             : 'Not running';
-    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, children: "Status" }) }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Service     ' }), _jsxs(Text, { color: serviceDotColor, children: [dot, " "] }), _jsx(Text, { children: serviceText })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  OpenClaw    ' }), _jsxs(Text, { color: openclawDotColor, children: [dot, " "] }), _jsx(Text, { children: openclawText }), restartMsg && _jsx(Text, { dimColor: true, children: `  (${restartMsg})` })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Enforcement  ' }), _jsx(Text, { children: config.enforcement })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Fail Mode    ' }), _jsx(Text, { children: config.failMode })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Enabled      ' }), _jsx(Text, { color: config.enabled ? 'green' : 'red', children: config.enabled ? 'ON' : 'OFF' })] }), health?.version && (_jsxs(Box, { marginTop: 1, children: [_jsx(Text, { dimColor: true, children: '  Service v' }), _jsx(Text, { children: health.version })] })), lastCheck && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { dimColor: true, children: ['  Last check: ', lastCheck.toLocaleTimeString()] }) })), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { dimColor: true, children: '  Press ' }), _jsx(Text, { bold: true, children: "r" }), _jsx(Text, { dimColor: true, children: ' to restart OpenClaw daemon' })] })] }));
+    // Plugin file checks
+    const extensionDir = join(homedir(), '.openclaw', 'extensions', 'safeclaw');
+    const pluginInstalled = existsSync(join(extensionDir, 'openclaw.plugin.json'))
+        && existsSync(join(extensionDir, 'index.js'));
+    // Plugin enabled in OpenClaw config
+    let pluginEnabled = false;
+    const ocConfigPath = join(homedir(), '.openclaw', 'openclaw.json');
+    if (existsSync(ocConfigPath)) {
+        try {
+            const ocConfig = JSON.parse(readFileSync(ocConfigPath, 'utf-8'));
+            pluginEnabled = !!ocConfig?.plugins?.entries?.safeclaw?.enabled;
+        }
+        catch { /* ignore */ }
+    }
+    const apiKeyMasked = config.apiKey
+        ? `${config.apiKey.slice(0, 6)}..${config.apiKey.slice(-4)}`
+        : '(not set)';
+    const statusDot = (status) => {
+        if (status === 'checking')
+            return _jsxs(Text, { color: "yellow", children: [dot, " "] });
+        if (status === 'ok' || status === true)
+            return _jsxs(Text, { color: "green", children: [dot, " "] });
+        return _jsxs(Text, { color: "red", children: [dot, " "] });
+    };
+    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, children: "Status" }) }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Service      ' }), _jsxs(Text, { color: serviceDotColor, children: [dot, " "] }), _jsx(Text, { children: serviceText })] }), connected && (_jsxs(_Fragment, { children: [_jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '    Evaluate   ' }), statusDot(evaluateStatus), _jsx(Text, { children: evaluateStatus === 'ok' ? 'Responding' : evaluateStatus === 'checking' ? 'Checking...' : 'Not responding' })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '    Handshake  ' }), statusDot(handshakeStatus), _jsx(Text, { children: handshakeStatus === 'ok' ? handshakeDetail : handshakeStatus === 'checking' ? 'Checking...' : handshakeDetail })] })] })), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  OpenClaw      ' }), _jsxs(Text, { color: openclawDotColor, children: [dot, " "] }), _jsx(Text, { children: openclawText }), restartMsg && _jsx(Text, { dimColor: true, children: `  (${restartMsg})` })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '    Plugin     ' }), statusDot(pluginInstalled), _jsx(Text, { children: pluginInstalled ? 'Installed' : 'Not installed' })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '    Config     ' }), statusDot(pluginEnabled), _jsx(Text, { children: pluginEnabled ? 'Enabled' : 'Not enabled' })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  API Key      ' }), statusDot(!!config.apiKey), _jsx(Text, { children: apiKeyMasked })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Enforcement  ' }), _jsx(Text, { children: config.enforcement })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Fail Mode    ' }), _jsx(Text, { children: config.failMode })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Enabled      ' }), _jsx(Text, { color: config.enabled ? 'green' : 'red', children: config.enabled ? 'ON' : 'OFF' })] }), health?.version && (_jsxs(Box, { marginTop: 1, children: [_jsx(Text, { dimColor: true, children: '  Service v' }), _jsx(Text, { children: health.version })] })), lastCheck && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { dimColor: true, children: ['  Last check: ', lastCheck.toLocaleTimeString()] }) })), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { dimColor: true, children: '  Press ' }), _jsx(Text, { bold: true, children: "r" }), _jsx(Text, { dimColor: true, children: ' to restart OpenClaw daemon' })] })] }));
 }

package/dist/tui/config.d.ts CHANGED Viewed

@@ -17,6 +17,10 @@ export interface SafeClawConfig {
 }
 export declare const CONFIG_PATH: string;
 export declare function loadConfig(): SafeClawConfig;
+/**
+ * Check whether a URL is a valid http:// or https:// URL.
+ */
+export declare function isValidServiceUrl(url: string): boolean;
 /**
  * Persist managed config fields back to ~/.safeclaw/config.json.
  * Reads the existing file (if any), merges the fields SafeClaw manages,

package/dist/tui/config.js CHANGED Viewed

@@ -14,7 +14,7 @@ export const CONFIG_PATH = join(homedir(), '.safeclaw', 'config.json');
 // --- Functions ---
 export function loadConfig() {
     const defaults = {
-        serviceUrl: 'https://api.safeclaw.eu/api/v1',
+        serviceUrl: 'http://localhost:8420/api/v1',
         apiKey: '',
         timeoutMs: 5000,
         enabled: true,
@@ -48,13 +48,23 @@ export function loadConfig() {
             // Config file unreadable — use defaults
         }
     }
+    else {
+        console.warn(`[SafeClaw] No config file found at ${CONFIG_PATH} — using defaults (serviceUrl=${defaults.serviceUrl})`);
+    }
     // Env vars override config file
     if (process.env.SAFECLAW_URL)
         defaults.serviceUrl = process.env.SAFECLAW_URL;
     if (process.env.SAFECLAW_API_KEY)
         defaults.apiKey = process.env.SAFECLAW_API_KEY;
-    if (process.env.SAFECLAW_TIMEOUT_MS)
-        defaults.timeoutMs = parseInt(process.env.SAFECLAW_TIMEOUT_MS, 10);
+    if (process.env.SAFECLAW_TIMEOUT_MS) {
+        const parsed = parseInt(process.env.SAFECLAW_TIMEOUT_MS, 10);
+        if (!Number.isNaN(parsed) && parsed > 0) {
+            defaults.timeoutMs = parsed;
+        }
+        else {
+            console.warn(`[SafeClaw] Invalid SAFECLAW_TIMEOUT_MS="${process.env.SAFECLAW_TIMEOUT_MS}", using default ${defaults.timeoutMs}ms`);
+        }
+    }
     if (process.env.SAFECLAW_ENABLED === 'false')
         defaults.enabled = false;
     if (process.env.SAFECLAW_ENFORCEMENT)
@@ -78,6 +88,20 @@ export function loadConfig() {
     }
     return defaults;
 }
+/**
+ * Check whether a URL is a valid http:// or https:// URL.
+ */
+export function isValidServiceUrl(url) {
+    if (!url || url.trim() === '')
+        return false;
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Persist managed config fields back to ~/.safeclaw/config.json.
  * Reads the existing file (if any), merges the fields SafeClaw manages,
@@ -93,20 +117,35 @@ export function saveConfig(config) {
             // Unreadable — start fresh
         }
     }
+    // Normalize serviceUrl: strip trailing slashes (consistent with loadConfig)
+    config.serviceUrl = config.serviceUrl.replace(/\/+$/, '');
+    // Validate serviceUrl before saving
+    if (!isValidServiceUrl(config.serviceUrl)) {
+        throw new Error(`Invalid service URL: "${config.serviceUrl}" — must be a valid http:// or https:// URL`);
+    }
     // Merge managed fields into existing structure
     existing.enabled = config.enabled;
     if (!existing.remote || typeof existing.remote !== 'object') {
         existing.remote = {};
     }
     existing.remote.serviceUrl = config.serviceUrl;
+    if (config.apiKey) {
+        existing.remote.apiKey = config.apiKey;
+    }
     if (!existing.enforcement || typeof existing.enforcement !== 'object') {
         existing.enforcement = {};
     }
     existing.enforcement.mode = config.enforcement;
     existing.enforcement.failMode = config.failMode;
+    if (config.agentId) {
+        existing.agentId = config.agentId;
+    }
+    if (config.agentToken) {
+        existing.agentToken = config.agentToken;
+    }
     // Ensure parent directory exists
-    mkdirSync(dirname(CONFIG_PATH), { recursive: true });
-    writeFileSync(CONFIG_PATH, JSON.stringify(existing, null, 2) + '\n', 'utf-8');
+    mkdirSync(dirname(CONFIG_PATH), { recursive: true, mode: 0o700 });
+    writeFileSync(CONFIG_PATH, JSON.stringify(existing, null, 2) + '\n', { encoding: 'utf-8', mode: 0o600 });
 }
 /**
  * SHA-256 hash of the four TUI-managed config fields.