openclaw-safeclaw-plugin 1.0.0 → 1.1.0

package/dist/index.js

@@ -7,23 +7,38 @@
  * to the SafeClaw service and acts on the responses.
  */
 import { loadConfig, configHash } from './tui/config.js';
+import crypto from 'crypto';
+import { createRequire } from 'module';
+const require = createRequire(import.meta.url);
+const { version: PLUGIN_VERSION } = require('./package.json');
 // --- Configuration ---
-const config = loadConfig();
+const CONFIG_RELOAD_INTERVAL_MS = 60_000; // Reload config every 60 seconds
+let config = loadConfig();
+let configLoadedAt = Date.now();
+function getConfig() {
+    const now = Date.now();
+    if (now - configLoadedAt >= CONFIG_RELOAD_INTERVAL_MS) {
+        config = loadConfig();
+        configLoadedAt = now;
+    }
+    return config;
+}
 // --- HTTP Client ---
 async function post(path, body) {
-    if (!config.enabled)
+    const cfg = getConfig();
+    if (!cfg.enabled)
         return null;
     const headers = { 'Content-Type': 'application/json' };
-    if (config.apiKey) {
-        headers['Authorization'] = `Bearer ${config.apiKey}`;
+    if (cfg.apiKey) {
+        headers['Authorization'] = `Bearer ${cfg.apiKey}`;
     }
-    const agentFields = config.agentId ? { agentId: config.agentId, agentToken: config.agentToken } : {};
+    const agentFields = cfg.agentId ? { agentId: cfg.agentId, agentToken: cfg.agentToken } : {};
     try {
-        const res = await fetch(`${config.serviceUrl}${path}`, {
+        const res = await fetch(`${cfg.serviceUrl}${path}`, {
             method: 'POST',
             headers,
             body: JSON.stringify({ ...body, ...agentFields }),
-            signal: AbortSignal.timeout(config.timeoutMs),
+            signal: AbortSignal.timeout(cfg.timeoutMs),
         });
         if (!res.ok) {
             // Try to parse structured error body from service
@@ -43,26 +58,27 @@ async function post(path, body) {
     }
     catch (e) {
         if (e instanceof DOMException && e.name === 'TimeoutError') {
-            console.warn(`[SafeClaw] Timeout after ${config.timeoutMs}ms on ${path} (${config.serviceUrl})`);
+            console.warn(`[SafeClaw] Timeout after ${cfg.timeoutMs}ms on ${path} (${cfg.serviceUrl})`);
         }
         else if (e instanceof TypeError && (e.message.includes('fetch') || e.message.includes('ECONNREFUSED'))) {
-            console.warn(`[SafeClaw] Connection refused: ${config.serviceUrl}${path} — is the service running?`);
+            console.warn(`[SafeClaw] Connection refused: ${cfg.serviceUrl}${path} — is the service running?`);
         }
         else {
-            console.warn(`[SafeClaw] Service unavailable: ${config.serviceUrl}${path}`);
+            console.warn(`[SafeClaw] Service unavailable: ${cfg.serviceUrl}${path}`);
         }
         return null; // Caller checks failMode
     }
 }
 let handshakeCompleted = false;
 async function performHandshake() {
-    if (!config.apiKey) {
+    const cfg = getConfig();
+    if (!cfg.apiKey) {
         console.warn('[SafeClaw] No API key configured — skipping handshake');
         return false;
     }
     const r = await post('/handshake', {
-        pluginVersion: '0.1.3',
-        configHash: configHash(config),
+        pluginVersion: PLUGIN_VERSION,
+        configHash: configHash(cfg),
     });
     if (r === null) {
         console.warn('[SafeClaw] ✗ Handshake failed — API key may be invalid or service unreachable');
@@ -73,12 +89,13 @@ async function performHandshake() {
     return true;
 }
 async function checkConnection() {
+    const cfg = getConfig();
     const label = `[SafeClaw]`;
-    console.log(`${label} Connecting to ${config.serviceUrl} ...`);
-    console.log(`${label} Mode: enforcement=${config.enforcement}, failMode=${config.failMode}`);
+    console.log(`${label} Connecting to ${cfg.serviceUrl} ...`);
+    console.log(`${label} Mode: enforcement=${cfg.enforcement}, failMode=${cfg.failMode}`);
     try {
-        const res = await fetch(`${config.serviceUrl}/health`, {
-            signal: AbortSignal.timeout(config.timeoutMs * 2),
+        const res = await fetch(`${cfg.serviceUrl}/health`, {
+            signal: AbortSignal.timeout(cfg.timeoutMs * 2),
         });
         if (res.ok) {
             const data = await res.json();
@@ -89,8 +106,8 @@ async function checkConnection() {
         }
     }
     catch {
-        console.warn(`${label} ✗ Cannot reach service at ${config.serviceUrl}`);
-        if (config.failMode === 'closed') {
+        console.warn(`${label} ✗ Cannot reach service at ${cfg.serviceUrl}`);
+        if (cfg.failMode === 'closed') {
             console.warn(`${label}   fail-mode=closed → tool calls will be BLOCKED until service is reachable`);
         }
         else {
@@ -101,18 +118,20 @@ async function checkConnection() {
 export default {
     id: 'safeclaw',
     name: 'SafeClaw Neurosymbolic Governance',
-    version: '0.1.3',
+    version: PLUGIN_VERSION,
     register(api) {
-        if (!config.enabled) {
+        if (!getConfig().enabled) {
             console.log('[SafeClaw] Plugin disabled');
             return;
         }
+        // Generate a unique instance ID for this plugin run (fallback when agentId is not configured)
+        const instanceId = getConfig().agentId || `instance-${crypto.randomUUID()}`;
         // Heartbeat watchdog — send config hash to service every 30s
         const sendHeartbeat = async () => {
             try {
                 await post('/heartbeat', {
-                    agentId: config.agentId || 'default',
-                    configHash: configHash(config),
+                    agentId: instanceId,
+                    configHash: configHash(getConfig()),
                     status: 'alive',
                 });
             }
@@ -120,32 +139,40 @@ export default {
                 // Heartbeat failure is non-fatal
             }
         };
-        // Start heartbeat after connection check + handshake
+        // Start heartbeat only after connection check + handshake completes (#84)
+        let heartbeatInterval;
         checkConnection()
             .then(() => performHandshake())
             .then((ok) => {
-            if (!ok && config.failMode === 'closed') {
-                console.warn('[SafeClaw] ⚠ Handshake failed with fail-mode=closed — tool calls will be BLOCKED');
+            if (!ok && getConfig().failMode === 'closed') {
+                console.warn('[SafeClaw] Handshake failed with fail-mode=closed — tool calls will be BLOCKED');
             }
+            heartbeatInterval = setInterval(sendHeartbeat, 30000);
             return sendHeartbeat();
         })
             .catch(() => { });
-        const heartbeatInterval = setInterval(sendHeartbeat, 30000);
         // Clean shutdown: send shutdown heartbeat and clear interval
-        const shutdown = () => {
-            clearInterval(heartbeatInterval);
-            post('/heartbeat', {
-                agentId: config.agentId || 'default',
-                configHash: configHash(config),
-                status: 'shutdown',
-            }).catch(() => { });
+        // Use async shutdown for SIGINT/SIGTERM where async is supported (#55)
+        const shutdown = async () => {
+            if (heartbeatInterval)
+                clearInterval(heartbeatInterval);
+            try {
+                await post('/heartbeat', {
+                    agentId: instanceId,
+                    configHash: configHash(getConfig()),
+                    status: 'shutdown',
+                });
+            }
+            catch {
+                // Best-effort shutdown notification
+            }
         };
-        process.on('exit', shutdown);
-        process.on('SIGINT', () => { shutdown(); process.exit(0); });
-        process.on('SIGTERM', () => { shutdown(); process.exit(0); });
+        process.on('SIGINT', async () => { await shutdown(); process.exit(0); });
+        process.on('SIGTERM', async () => { await shutdown(); process.exit(0); });
         // THE GATE — constraint checking on every tool call
         api.on('before_tool_call', async (event, ctx) => {
-            if (!handshakeCompleted && config.failMode === 'closed' && config.enforcement === 'enforce') {
+            const cfg = getConfig();
+            if (!handshakeCompleted && cfg.failMode === 'closed' && cfg.enforcement === 'enforce') {
                 return { block: true, blockReason: 'SafeClaw handshake not completed (fail-closed)' };
             }
             const r = await post('/evaluate/tool-call', {
@@ -155,21 +182,22 @@ export default {
                 params: event.params ?? {},
                 sessionHistory: event.sessionHistory ?? [],
             });
-            if (r === null && config.failMode === 'closed' && config.enforcement === 'enforce') {
-                return { block: true, blockReason: `SafeClaw service unavailable at ${config.serviceUrl} (fail-closed)` };
+            if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'enforce') {
+                return { block: true, blockReason: `SafeClaw service unavailable at ${cfg.serviceUrl} (fail-closed)` };
             }
-            else if (r === null && config.failMode === 'closed' && config.enforcement === 'warn-only') {
-                console.warn(`[SafeClaw] Service unavailable at ${config.serviceUrl} (fail-closed mode, warn-only)`);
+            else if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'warn-only') {
+                console.warn(`[SafeClaw] Service unavailable at ${cfg.serviceUrl} (fail-closed mode, warn-only)`);
             }
-            else if (r === null && config.failMode === 'closed' && config.enforcement === 'audit-only') {
-                console.warn(`[SafeClaw] Service unavailable at ${config.serviceUrl} (fail-closed mode, audit-only)`);
+            else if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'audit-only') {
+                console.warn(`[SafeClaw] Service unavailable at ${cfg.serviceUrl} (fail-closed mode, audit-only)`);
             }
             if (r?.block) {
-                if (config.enforcement === 'enforce') {
-                    return { block: true, blockReason: r.reason };
+                const blockReason = r.reason || 'Blocked by SafeClaw (no reason provided)';
+                if (cfg.enforcement === 'enforce') {
+                    return { block: true, blockReason };
                 }
-                if (config.enforcement === 'warn-only') {
-                    console.warn(`[SafeClaw] Warning: ${r.reason}`);
+                if (cfg.enforcement === 'warn-only') {
+                    console.warn(`[SafeClaw] Warning: ${blockReason}`);
                 }
                 // audit-only: logged server-side, no action here
             }
@@ -186,24 +214,29 @@ export default {
         }, { priority: 100 });
         // Message governance — check outbound messages
         api.on('message_sending', async (event, ctx) => {
+            const cfg = getConfig();
             const r = await post('/evaluate/message', {
                 sessionId: ctx.sessionId ?? event.sessionId,
                 userId: ctx.userId ?? event.userId,
                 to: event.to,
                 content: event.content,
             });
-            if (r === null && config.failMode === 'closed' && config.enforcement === 'enforce') {
-                return { cancel: true };
+            if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'enforce') {
+                return { cancel: true, cancelReason: 'SafeClaw service unavailable (fail-closed mode)' };
             }
-            else if (r === null && config.failMode === 'closed' && config.enforcement === 'warn-only') {
+            else if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'warn-only') {
                 console.warn('[SafeClaw] Service unavailable (fail-closed mode, warn-only)');
             }
+            else if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'audit-only') {
+                console.info('[SafeClaw] audit-only: service unreachable, allowing message (fail-closed)');
+            }
             if (r?.block) {
-                if (config.enforcement === 'enforce') {
-                    return { cancel: true };
+                const blockReason = r.reason || 'Blocked by SafeClaw (no reason provided)';
+                if (cfg.enforcement === 'enforce') {
+                    return { cancel: true, cancelReason: blockReason };
                 }
-                if (config.enforcement === 'warn-only') {
-                    console.warn(`[SafeClaw] Warning: ${r.reason}`);
+                if (cfg.enforcement === 'warn-only') {
+                    console.warn(`[SafeClaw] Warning: ${blockReason}`);
                 }
                 // audit-only: logged server-side, no action here
             }

package/dist/tui/About.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Text, Box } from 'ink';
 export default function About() {
-    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, children: "About" }) }), _jsx(Text, { children: "  SafeClaw Neurosymbolic Governance" }), _jsx(Text, { dimColor: true, children: "  Validates AI agent actions against OWL" }), _jsx(Text, { dimColor: true, children: "  ontologies and SHACL constraints." }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { children: "  Web:  " }), _jsx(Text, { color: "cyan", children: "https://safeclaw.eu" })] }), _jsxs(Box, { children: [_jsx(Text, { children: "  Docs: " }), _jsx(Text, { color: "cyan", children: "https://safeclaw.eu/docs" })] }), _jsxs(Box, { children: [_jsx(Text, { children: "  Repo: " }), _jsx(Text, { color: "cyan", children: "https://github.com/tendlyeu/SafeClaw" })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "  q to quit" }) })] }));
+    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, children: "About SafeClaw" }) }), _jsx(Text, { children: "  Neurosymbolic governance for AI agents." }), _jsx(Text, { dimColor: true, children: "  Validates tool calls, messages, and actions against" }), _jsx(Text, { dimColor: true, children: "  OWL ontologies and SHACL constraints before execution." }), _jsx(Box, { marginTop: 1, marginBottom: 1, children: _jsx(Text, { bold: true, children: "  Features" }) }), _jsx(Text, { dimColor: true, children: "  - 9-step constraint pipeline (SHACL, policies, preferences, dependencies)" }), _jsx(Text, { dimColor: true, children: "  - Role-based access control with per-user preferences" }), _jsx(Text, { dimColor: true, children: "  - Multi-agent governance with delegation detection" }), _jsx(Text, { dimColor: true, children: "  - Append-only audit trail with compliance reporting" }), _jsx(Text, { dimColor: true, children: "  - Passive LLM security reviewer and classification observer" }), _jsx(Text, { dimColor: true, children: "  - Natural language policy compilation" }), _jsx(Box, { marginTop: 1, marginBottom: 1, children: _jsx(Text, { bold: true, children: "  CLI commands" }) }), _jsx(Text, { dimColor: true, children: "  safeclaw-plugin  This plugin CLI (connect, status, config, tui)" }), _jsx(Text, { dimColor: true, children: "  safeclaw         Service CLI (serve, audit, policy, pref, status)" }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { children: "  Web:  " }), _jsx(Text, { color: "cyan", children: "https://safeclaw.eu" })] }), _jsxs(Box, { children: [_jsx(Text, { children: "  Docs: " }), _jsx(Text, { color: "cyan", children: "https://safeclaw.eu/docs" })] }), _jsxs(Box, { children: [_jsx(Text, { children: "  Repo: " }), _jsx(Text, { color: "cyan", children: "https://github.com/tendlyeu/SafeClaw" })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "  q to quit" }) })] }));
 }

package/dist/tui/App.js

@@ -33,5 +33,5 @@ export default function App() {
             }
         }
     });
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { borderStyle: "single", borderColor: "green", paddingX: 1, children: [_jsx(Text, { bold: true, color: "green", children: "SafeClaw " }), _jsxs(Text, { dimColor: true, children: ["v", PKG_VERSION] })] }), _jsxs(Box, { paddingX: 1, gap: 2, children: [TABS.map((t, i) => (_jsx(Text, { bold: tab === t, color: tab === t ? 'cyan' : 'white', dimColor: tab !== t, children: `${i + 1}:${t}` }, t))), _jsx(Text, { dimColor: true, children: " tab/1-3 to switch" })] }), _jsxs(Box, { marginTop: 1, children: [tab === 'Status' && _jsx(Status, { config: config }), tab === 'Settings' && (_jsx(Settings, { config: config, onConfigChange: setConfig })), tab === 'About' && _jsx(About, {})] })] }));
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { borderStyle: "single", borderColor: "green", paddingX: 1, children: [_jsx(Text, { bold: true, color: "green", children: "SafeClaw " }), _jsxs(Text, { dimColor: true, children: ["v", PKG_VERSION] })] }), _jsxs(Box, { paddingX: 1, gap: 2, children: [TABS.map((t, i) => (_jsx(Text, { bold: tab === t, color: tab === t ? 'cyan' : 'white', dimColor: tab !== t, children: `${i + 1}:${t}` }, t))), _jsx(Text, { dimColor: true, children: " tab/1-3 switch  q quit" })] }), _jsxs(Box, { marginTop: 1, children: [tab === 'Status' && _jsx(Status, { config: config }), tab === 'Settings' && (_jsx(Settings, { config: config, onConfigChange: setConfig })), tab === 'About' && _jsx(About, {})] })] }));
 }

package/dist/tui/Settings.js

@@ -9,6 +9,7 @@ const SETTINGS = [
     { key: 'enforcement', label: 'Enforcement', type: 'cycle', values: ENFORCEMENT_MODES },
     { key: 'failMode', label: 'Fail Mode', type: 'cycle', values: FAIL_MODES },
     { key: 'serviceUrl', label: 'Service URL', type: 'text' },
+    { key: 'apiKey', label: 'API Key', type: 'text' },
 ];
 export default function Settings({ config, onConfigChange }) {
     const [selected, setSelected] = useState(0);
@@ -22,7 +23,18 @@ export default function Settings({ config, onConfigChange }) {
     useInput((input, key) => {
         if (editing) {
             if (key.return) {
-                updateConfig({ serviceUrl: editBuffer });
+                const editingKey = SETTINGS[selected].key;
+                if (editingKey === 'apiKey' && editBuffer && !editBuffer.startsWith('sc_')) {
+                    // Reject invalid API keys — must start with sc_
+                    return;
+                }
+                try {
+                    updateConfig({ [editingKey]: editBuffer });
+                }
+                catch {
+                    // saveConfig may throw on invalid URL — stay in edit mode
+                    return;
+                }
                 setEditing(false);
             }
             else if (key.escape) {
@@ -57,7 +69,7 @@ export default function Settings({ config, onConfigChange }) {
             }
             else if (setting.type === 'text' && key.return) {
                 setEditing(true);
-                setEditBuffer(config.serviceUrl);
+                setEditBuffer(String(config[setting.key] ?? ''));
             }
         }
     });
@@ -68,8 +80,13 @@ export default function Settings({ config, onConfigChange }) {
                 if (setting.key === 'enabled') {
                     value = config.enabled ? 'ON' : 'OFF';
                 }
-                else if (setting.key === 'serviceUrl' && editing && isSelected) {
-                    value = editBuffer + '█';
+                else if (setting.type === 'text' && editing && isSelected) {
+                    value = (setting.key === 'apiKey' ? '*'.repeat(editBuffer.length) : editBuffer) + '█';
+                }
+                else if (setting.key === 'apiKey') {
+                    value = config.apiKey
+                        ? `${config.apiKey.slice(0, 6)}..${config.apiKey.slice(-4)}`
+                        : '(not set)';
                 }
                 else {
                     value = String(config[setting.key]);
@@ -79,6 +96,8 @@ export default function Settings({ config, onConfigChange }) {
                                 ? config.enabled ? 'green' : 'red'
                                 : undefined, children: value }), showArrows && _jsx(Text, { dimColor: true, children: ' ▶' })] }, setting.key));
             }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: editing
-                        ? '  type to edit · enter to save · esc to cancel'
-                        : '  ↑↓ navigate · ←→ change · enter to edit URL · q quit' }) }), _jsx(Box, { children: _jsx(Text, { dimColor: true, children: '  Saves to ~/.safeclaw/config.json' }) })] }));
+                        ? SETTINGS[selected].key === 'apiKey' && editBuffer && !editBuffer.startsWith('sc_')
+                            ? '  API key must start with sc_ · esc to cancel'
+                            : '  type to edit · enter to save · esc to cancel'
+                        : '  ↑↓ navigate · ←→/enter cycle/toggle · enter to edit text fields · q quit' }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: '  Enforcement: enforce=block violations, warn-only=log only, audit-only=record only, disabled=off' }) }), _jsx(Box, { children: _jsx(Text, { dimColor: true, children: '  Fail Mode:   open=allow if service unreachable, closed=block if service unreachable' }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: '  All changes save to ~/.safeclaw/config.json immediately.' }) })] }));
 }

package/dist/tui/Status.js

@@ -1,13 +1,22 @@
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { jsxs as _jsxs, jsx as _jsx, Fragment as _Fragment } from "react/jsx-runtime";
 import { useState, useEffect } from 'react';
 import { Text, Box, useInput } from 'ink';
 import { exec } from 'child_process';
+import { existsSync, readFileSync } from 'fs';
+import { join, dirname } from 'path';
+import { homedir } from 'os';
+import { fileURLToPath } from 'url';
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const PKG_VERSION = JSON.parse(readFileSync(join(__dirname, '..', '..', 'package.json'), 'utf-8')).version;
 export default function Status({ config }) {
     const [health, setHealth] = useState(null);
     const [error, setError] = useState(null);
     const [lastCheck, setLastCheck] = useState(null);
     const [openclawStatus, setOpenclawStatus] = useState('checking');
     const [restartMsg, setRestartMsg] = useState(null);
+    const [evaluateStatus, setEvaluateStatus] = useState('checking');
+    const [handshakeStatus, setHandshakeStatus] = useState('checking');
+    const [handshakeDetail, setHandshakeDetail] = useState('');
     const checkHealth = async () => {
         try {
             const res = await fetch(`${config.serviceUrl}/health`, {
@@ -17,18 +26,76 @@ export default function Status({ config }) {
                 const data = await res.json();
                 setHealth(data);
                 setError(null);
+                // If healthy, run deeper checks
+                checkEvaluate();
+                if (config.apiKey)
+                    checkHandshake();
+                else {
+                    setHandshakeStatus('fail');
+                    setHandshakeDetail('No API key');
+                }
             }
             else {
                 setHealth(null);
                 setError(`HTTP ${res.status}`);
+                setEvaluateStatus('fail');
+                setHandshakeStatus('fail');
             }
         }
         catch {
             setHealth(null);
             setError('Cannot connect');
+            setEvaluateStatus('fail');
+            setHandshakeStatus('fail');
         }
         setLastCheck(new Date());
     };
+    const checkEvaluate = async () => {
+        try {
+            const res = await fetch(`${config.serviceUrl}/evaluate/tool-call`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    ...(config.apiKey ? { 'Authorization': `Bearer ${config.apiKey}` } : {}),
+                },
+                body: JSON.stringify({
+                    sessionId: 'tui-check', userId: 'tui-check',
+                    toolName: 'echo', params: { message: 'tui-check' },
+                }),
+                signal: AbortSignal.timeout(config.timeoutMs),
+            });
+            setEvaluateStatus(res.ok || res.status === 422 || res.status === 401 || res.status === 403 ? 'ok' : 'fail');
+        }
+        catch {
+            setEvaluateStatus('fail');
+        }
+    };
+    const checkHandshake = async () => {
+        try {
+            const res = await fetch(`${config.serviceUrl}/handshake`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Authorization': `Bearer ${config.apiKey}`,
+                },
+                body: JSON.stringify({ pluginVersion: PKG_VERSION, configHash: '' }),
+                signal: AbortSignal.timeout(config.timeoutMs),
+            });
+            if (res.ok) {
+                const data = await res.json();
+                setHandshakeStatus('ok');
+                setHandshakeDetail(`org=${data.orgId ?? '?'}`);
+            }
+            else {
+                setHandshakeStatus('fail');
+                setHandshakeDetail(`HTTP ${res.status}`);
+            }
+        }
+        catch {
+            setHandshakeStatus('fail');
+            setHandshakeDetail('timeout');
+        }
+    };
     const checkOpenClaw = () => {
         exec('openclaw daemon status', { timeout: 10000 }, (err, stdout) => {
             if (err) {
@@ -67,6 +134,7 @@ export default function Status({ config }) {
             restartOpenClaw();
         }
     });
+    // Derived display values
     const connected = health !== null;
     const dot = '●';
     const serviceDotColor = connected ? 'green' : 'red';
@@ -77,5 +145,29 @@ export default function Status({ config }) {
     const openclawText = openclawStatus === 'checking' ? 'Checking...'
         : openclawStatus === 'running' ? 'Running'
             : 'Not running';
-    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, children: "Status" }) }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Service     ' }), _jsxs(Text, { color: serviceDotColor, children: [dot, " "] }), _jsx(Text, { children: serviceText })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  OpenClaw    ' }), _jsxs(Text, { color: openclawDotColor, children: [dot, " "] }), _jsx(Text, { children: openclawText }), restartMsg && _jsx(Text, { dimColor: true, children: `  (${restartMsg})` })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Enforcement  ' }), _jsx(Text, { children: config.enforcement })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Fail Mode    ' }), _jsx(Text, { children: config.failMode })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Enabled      ' }), _jsx(Text, { color: config.enabled ? 'green' : 'red', children: config.enabled ? 'ON' : 'OFF' })] }), health?.version && (_jsxs(Box, { marginTop: 1, children: [_jsx(Text, { dimColor: true, children: '  Service v' }), _jsx(Text, { children: health.version })] })), lastCheck && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { dimColor: true, children: ['  Last check: ', lastCheck.toLocaleTimeString()] }) })), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { dimColor: true, children: '  Press ' }), _jsx(Text, { bold: true, children: "r" }), _jsx(Text, { dimColor: true, children: ' to restart OpenClaw daemon' })] })] }));
+    // Plugin file checks
+    const extensionDir = join(homedir(), '.openclaw', 'extensions', 'safeclaw');
+    const pluginInstalled = existsSync(join(extensionDir, 'openclaw.plugin.json'))
+        && existsSync(join(extensionDir, 'index.js'));
+    // Plugin enabled in OpenClaw config
+    let pluginEnabled = false;
+    const ocConfigPath = join(homedir(), '.openclaw', 'openclaw.json');
+    if (existsSync(ocConfigPath)) {
+        try {
+            const ocConfig = JSON.parse(readFileSync(ocConfigPath, 'utf-8'));
+            pluginEnabled = !!ocConfig?.plugins?.entries?.safeclaw?.enabled;
+        }
+        catch { /* ignore */ }
+    }
+    const apiKeyMasked = config.apiKey
+        ? `${config.apiKey.slice(0, 6)}..${config.apiKey.slice(-4)}`
+        : '(not set)';
+    const statusDot = (status) => {
+        if (status === 'checking')
+            return _jsxs(Text, { color: "yellow", children: [dot, " "] });
+        if (status === 'ok' || status === true)
+            return _jsxs(Text, { color: "green", children: [dot, " "] });
+        return _jsxs(Text, { color: "red", children: [dot, " "] });
+    };
+    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, children: "Status" }) }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Service      ' }), _jsxs(Text, { color: serviceDotColor, children: [dot, " "] }), _jsx(Text, { children: serviceText })] }), connected && (_jsxs(_Fragment, { children: [_jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '    Evaluate   ' }), statusDot(evaluateStatus), _jsx(Text, { children: evaluateStatus === 'ok' ? 'Responding' : evaluateStatus === 'checking' ? 'Checking...' : 'Not responding' })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '    Handshake  ' }), statusDot(handshakeStatus), _jsx(Text, { children: handshakeStatus === 'ok' ? handshakeDetail : handshakeStatus === 'checking' ? 'Checking...' : handshakeDetail })] })] })), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  OpenClaw      ' }), _jsxs(Text, { color: openclawDotColor, children: [dot, " "] }), _jsx(Text, { children: openclawText }), restartMsg && _jsx(Text, { dimColor: true, children: `  (${restartMsg})` })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '    Plugin     ' }), statusDot(pluginInstalled), _jsx(Text, { children: pluginInstalled ? 'Installed' : 'Not installed' })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '    Config     ' }), statusDot(pluginEnabled), _jsx(Text, { children: pluginEnabled ? 'Enabled' : 'Not enabled' })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  API Key      ' }), statusDot(!!config.apiKey), _jsx(Text, { children: apiKeyMasked })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Enforcement  ' }), _jsx(Text, { children: config.enforcement })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Fail Mode    ' }), _jsx(Text, { children: config.failMode })] }), _jsxs(Box, { children: [_jsx(Text, { dimColor: true, children: '  Enabled      ' }), _jsx(Text, { color: config.enabled ? 'green' : 'red', children: config.enabled ? 'ON' : 'OFF' })] }), health?.version && (_jsxs(Box, { marginTop: 1, children: [_jsx(Text, { dimColor: true, children: '  Service v' }), _jsx(Text, { children: health.version })] })), lastCheck && (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { dimColor: true, children: ['  Last check: ', lastCheck.toLocaleTimeString()] }) })), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { dimColor: true, children: '  Press ' }), _jsx(Text, { bold: true, children: "r" }), _jsx(Text, { dimColor: true, children: ' to restart OpenClaw daemon' })] })] }));
 }

package/dist/tui/config.d.ts

@@ -17,6 +17,10 @@ export interface SafeClawConfig {
 }
 export declare const CONFIG_PATH: string;
 export declare function loadConfig(): SafeClawConfig;
+/**
+ * Check whether a URL is a valid http:// or https:// URL.
+ */
+export declare function isValidServiceUrl(url: string): boolean;
 /**
  * Persist managed config fields back to ~/.safeclaw/config.json.
  * Reads the existing file (if any), merges the fields SafeClaw manages,

package/dist/tui/config.js

@@ -14,7 +14,7 @@ export const CONFIG_PATH = join(homedir(), '.safeclaw', 'config.json');
 // --- Functions ---
 export function loadConfig() {
     const defaults = {
-        serviceUrl: 'https://api.safeclaw.eu/api/v1',
+        serviceUrl: 'http://localhost:8420/api/v1',
         apiKey: '',
         timeoutMs: 5000,
         enabled: true,
@@ -48,13 +48,23 @@ export function loadConfig() {
             // Config file unreadable — use defaults
         }
     }
+    else {
+        console.warn(`[SafeClaw] No config file found at ${CONFIG_PATH} — using defaults (serviceUrl=${defaults.serviceUrl})`);
+    }
     // Env vars override config file
     if (process.env.SAFECLAW_URL)
         defaults.serviceUrl = process.env.SAFECLAW_URL;
     if (process.env.SAFECLAW_API_KEY)
         defaults.apiKey = process.env.SAFECLAW_API_KEY;
-    if (process.env.SAFECLAW_TIMEOUT_MS)
-        defaults.timeoutMs = parseInt(process.env.SAFECLAW_TIMEOUT_MS, 10);
+    if (process.env.SAFECLAW_TIMEOUT_MS) {
+        const parsed = parseInt(process.env.SAFECLAW_TIMEOUT_MS, 10);
+        if (!Number.isNaN(parsed) && parsed > 0) {
+            defaults.timeoutMs = parsed;
+        }
+        else {
+            console.warn(`[SafeClaw] Invalid SAFECLAW_TIMEOUT_MS="${process.env.SAFECLAW_TIMEOUT_MS}", using default ${defaults.timeoutMs}ms`);
+        }
+    }
     if (process.env.SAFECLAW_ENABLED === 'false')
         defaults.enabled = false;
     if (process.env.SAFECLAW_ENFORCEMENT)
@@ -78,6 +88,20 @@ export function loadConfig() {
     }
     return defaults;
 }
+/**
+ * Check whether a URL is a valid http:// or https:// URL.
+ */
+export function isValidServiceUrl(url) {
+    if (!url || url.trim() === '')
+        return false;
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Persist managed config fields back to ~/.safeclaw/config.json.
  * Reads the existing file (if any), merges the fields SafeClaw manages,
@@ -93,17 +117,32 @@ export function saveConfig(config) {
             // Unreadable — start fresh
         }
     }
+    // Normalize serviceUrl: strip trailing slashes (consistent with loadConfig)
+    config.serviceUrl = config.serviceUrl.replace(/\/+$/, '');
+    // Validate serviceUrl before saving
+    if (!isValidServiceUrl(config.serviceUrl)) {
+        throw new Error(`Invalid service URL: "${config.serviceUrl}" — must be a valid http:// or https:// URL`);
+    }
     // Merge managed fields into existing structure
     existing.enabled = config.enabled;
     if (!existing.remote || typeof existing.remote !== 'object') {
         existing.remote = {};
     }
     existing.remote.serviceUrl = config.serviceUrl;
+    if (config.apiKey) {
+        existing.remote.apiKey = config.apiKey;
+    }
     if (!existing.enforcement || typeof existing.enforcement !== 'object') {
         existing.enforcement = {};
     }
     existing.enforcement.mode = config.enforcement;
     existing.enforcement.failMode = config.failMode;
+    if (config.agentId) {
+        existing.agentId = config.agentId;
+    }
+    if (config.agentToken) {
+        existing.agentToken = config.agentToken;
+    }
     // Ensure parent directory exists
     mkdirSync(dirname(CONFIG_PATH), { recursive: true, mode: 0o700 });
     writeFileSync(CONFIG_PATH, JSON.stringify(existing, null, 2) + '\n', { encoding: 'utf-8', mode: 0o600 });