openclaw-safeclaw-plugin 1.0.0 → 1.2.0

package/dist/index.js

@@ -7,23 +7,46 @@
  * to the SafeClaw service and acts on the responses.
  */
 import { loadConfig, configHash } from './tui/config.js';
+import crypto from 'crypto';
+import { createRequire } from 'module';
+const require = createRequire(import.meta.url);
+const { version: PLUGIN_VERSION } = require('./package.json');
 // --- Configuration ---
-const config = loadConfig();
+const CONFIG_RELOAD_INTERVAL_MS = 60_000; // Reload config every 60 seconds
+let config = loadConfig();
+let configLoadedAt = Date.now();
+// OpenClaw plugin config — merged on top of file config when available
+let _ocPluginConfig = {};
+// Logger — defaults to console, replaced by api.logger when available
+let log = console;
+function getConfig() {
+    const now = Date.now();
+    if (now - configLoadedAt >= CONFIG_RELOAD_INTERVAL_MS) {
+        config = loadConfig();
+        configLoadedAt = now;
+    }
+    // OpenClaw config takes priority over file config
+    return {
+        ...config,
+        ...Object.fromEntries(Object.entries(_ocPluginConfig).filter(([_, v]) => v != null)),
+    };
+}
 // --- HTTP Client ---
 async function post(path, body) {
-    if (!config.enabled)
+    const cfg = getConfig();
+    if (!cfg.enabled)
         return null;
     const headers = { 'Content-Type': 'application/json' };
-    if (config.apiKey) {
-        headers['Authorization'] = `Bearer ${config.apiKey}`;
+    if (cfg.apiKey) {
+        headers['Authorization'] = `Bearer ${cfg.apiKey}`;
     }
-    const agentFields = config.agentId ? { agentId: config.agentId, agentToken: config.agentToken } : {};
+    const agentFields = cfg.agentId ? { agentId: cfg.agentId, agentToken: cfg.agentToken } : {};
     try {
-        const res = await fetch(`${config.serviceUrl}${path}`, {
+        const res = await fetch(`${cfg.serviceUrl}${path}`, {
             method: 'POST',
             headers,
             body: JSON.stringify({ ...body, ...agentFields }),
-            signal: AbortSignal.timeout(config.timeoutMs),
+            signal: AbortSignal.timeout(cfg.timeoutMs),
         });
         if (!res.ok) {
             // Try to parse structured error body from service
@@ -32,10 +55,10 @@ async function post(path, body) {
                 const rawDetail = errBody.detail ?? `HTTP ${res.status}`;
                 const detail = typeof rawDetail === 'string' ? rawDetail : JSON.stringify(rawDetail);
                 const hint = errBody.hint ? ` (${errBody.hint})` : '';
-                console.warn(`[SafeClaw] ${path}: ${detail}${hint}`);
+                log.warn(`[SafeClaw] ${path}: ${detail}${hint}`);
             }
             catch {
-                console.warn(`[SafeClaw] HTTP ${res.status} from ${path}`);
+                log.warn(`[SafeClaw] HTTP ${res.status} from ${path}`);
             }
             return null; // Caller checks failMode
         }
@@ -43,76 +66,103 @@ async function post(path, body) {
     }
     catch (e) {
         if (e instanceof DOMException && e.name === 'TimeoutError') {
-            console.warn(`[SafeClaw] Timeout after ${config.timeoutMs}ms on ${path} (${config.serviceUrl})`);
+            log.warn(`[SafeClaw] Timeout after ${cfg.timeoutMs}ms on ${path} (${cfg.serviceUrl})`);
         }
         else if (e instanceof TypeError && (e.message.includes('fetch') || e.message.includes('ECONNREFUSED'))) {
-            console.warn(`[SafeClaw] Connection refused: ${config.serviceUrl}${path} — is the service running?`);
+            log.warn(`[SafeClaw] Connection refused: ${cfg.serviceUrl}${path} — is the service running?`);
         }
         else {
-            console.warn(`[SafeClaw] Service unavailable: ${config.serviceUrl}${path}`);
+            log.warn(`[SafeClaw] Service unavailable: ${cfg.serviceUrl}${path}`);
         }
         return null; // Caller checks failMode
     }
 }
+async function get(path) {
+    const cfg = getConfig();
+    if (!cfg.enabled)
+        return null;
+    const headers = {};
+    if (cfg.apiKey)
+        headers['Authorization'] = `Bearer ${cfg.apiKey}`;
+    try {
+        const res = await fetch(`${cfg.serviceUrl}${path}`, {
+            signal: AbortSignal.timeout(cfg.timeoutMs),
+            headers,
+        });
+        if (!res.ok)
+            return null;
+        return await res.json();
+    }
+    catch {
+        return null;
+    }
+}
+// --- Plugin Definition ---
 let handshakeCompleted = false;
 async function performHandshake() {
-    if (!config.apiKey) {
-        console.warn('[SafeClaw] No API key configured — skipping handshake');
+    const cfg = getConfig();
+    if (!cfg.apiKey) {
+        log.warn('[SafeClaw] No API key configured — skipping handshake');
         return false;
     }
     const r = await post('/handshake', {
-        pluginVersion: '0.1.3',
-        configHash: configHash(config),
+        pluginVersion: PLUGIN_VERSION,
+        configHash: configHash(cfg),
     });
     if (r === null) {
-        console.warn('[SafeClaw] ✗ Handshake failed — API key may be invalid or service unreachable');
+        log.warn('[SafeClaw] Handshake failed — API key may be invalid or service unreachable');
         return false;
     }
-    console.log(`[SafeClaw] ✓ Handshake OK — org=${r.orgId}, scope=${r.scope}, engine=${r.engineReady ? 'ready' : 'not ready'}`);
+    log.info(`[SafeClaw] Handshake OK — org=${r.orgId}, scope=${r.scope}, engine=${r.engineReady ? 'ready' : 'not ready'}`);
     handshakeCompleted = true;
     return true;
 }
 async function checkConnection() {
+    const cfg = getConfig();
     const label = `[SafeClaw]`;
-    console.log(`${label} Connecting to ${config.serviceUrl} ...`);
-    console.log(`${label} Mode: enforcement=${config.enforcement}, failMode=${config.failMode}`);
+    log.info(`${label} Connecting to ${cfg.serviceUrl} ...`);
+    log.info(`${label} Mode: enforcement=${cfg.enforcement}, failMode=${cfg.failMode}`);
     try {
-        const res = await fetch(`${config.serviceUrl}/health`, {
-            signal: AbortSignal.timeout(config.timeoutMs * 2),
+        const res = await fetch(`${cfg.serviceUrl}/health`, {
+            signal: AbortSignal.timeout(cfg.timeoutMs * 2),
         });
         if (res.ok) {
             const data = await res.json();
-            console.log(`${label} ✓ Connected — service ${data.status ?? 'ok'}`);
+            log.info(`${label} Connected — service ${data.status ?? 'ok'}`);
         }
         else {
-            console.warn(`${label} ✗ Service responded with HTTP ${res.status}`);
+            log.warn(`${label} Service responded with HTTP ${res.status}`);
         }
     }
     catch {
-        console.warn(`${label} ✗ Cannot reach service at ${config.serviceUrl}`);
-        if (config.failMode === 'closed') {
-            console.warn(`${label}   fail-mode=closed → tool calls will be BLOCKED until service is reachable`);
+        log.warn(`${label} Cannot reach service at ${cfg.serviceUrl}`);
+        if (cfg.failMode === 'closed') {
+            log.warn(`${label}   fail-mode=closed — tool calls will be BLOCKED until service is reachable`);
         }
         else {
-            console.warn(`${label}   fail-mode=open → tool calls will be ALLOWED despite no connection`);
+            log.warn(`${label}   fail-mode=open — tool calls will be ALLOWED despite no connection`);
         }
     }
 }
 export default {
     id: 'safeclaw',
     name: 'SafeClaw Neurosymbolic Governance',
-    version: '0.1.3',
+    version: PLUGIN_VERSION,
     register(api) {
-        if (!config.enabled) {
+        if (!getConfig().enabled) {
             console.log('[SafeClaw] Plugin disabled');
             return;
         }
+        log = api.logger ?? console;
+        _ocPluginConfig = api.pluginConfig ?? {};
+        // Generate a unique instance ID for this plugin run (fallback when agentId is not configured)
+        const instanceId = getConfig().agentId || `instance-${crypto.randomUUID()}`;
         // Heartbeat watchdog — send config hash to service every 30s
         const sendHeartbeat = async () => {
             try {
                 await post('/heartbeat', {
-                    agentId: config.agentId || 'default',
-                    configHash: configHash(config),
+                    agentId: instanceId,
+                    configHash: configHash(getConfig()),
                     status: 'alive',
                 });
             }
@@ -120,115 +170,268 @@ export default {
                 // Heartbeat failure is non-fatal
             }
         };
-        // Start heartbeat after connection check + handshake
-        checkConnection()
+        // Clean shutdown: send shutdown heartbeat and clear interval (#194)
+        let heartbeatInterval;
+        const shutdown = async () => {
+            if (heartbeatInterval)
+                clearInterval(heartbeatInterval);
+            try {
+                await post('/heartbeat', {
+                    agentId: instanceId,
+                    configHash: configHash(getConfig()),
+                    status: 'shutdown',
+                });
+            }
+            catch {
+                // Best-effort shutdown notification
+            }
+        };
+        // Start heartbeat after connection check + handshake completes (#84)
+        const startupPromise = checkConnection()
             .then(() => performHandshake())
             .then((ok) => {
-            if (!ok && config.failMode === 'closed') {
-                console.warn('[SafeClaw] ⚠ Handshake failed with fail-mode=closed — tool calls will be BLOCKED');
+            if (!ok && getConfig().failMode === 'closed') {
+                log.warn('[SafeClaw] Handshake failed with fail-mode=closed — tool calls will be BLOCKED');
             }
+            heartbeatInterval = setInterval(sendHeartbeat, 30000);
             return sendHeartbeat();
         })
             .catch(() => { });
-        const heartbeatInterval = setInterval(sendHeartbeat, 30000);
-        // Clean shutdown: send shutdown heartbeat and clear interval
-        const shutdown = () => {
-            clearInterval(heartbeatInterval);
-            post('/heartbeat', {
-                agentId: config.agentId || 'default',
-                configHash: configHash(config),
-                status: 'shutdown',
-            }).catch(() => { });
-        };
-        process.on('exit', shutdown);
-        process.on('SIGINT', () => { shutdown(); process.exit(0); });
-        process.on('SIGTERM', () => { shutdown(); process.exit(0); });
-        // THE GATE — constraint checking on every tool call
+        // Register as an OpenClaw service so the gateway manages our lifecycle.
+        // The service's stop() method sends the shutdown heartbeat — no process.exit()
+        // needed, which avoids killing the entire gateway process (#194).
+        if (api.registerService) {
+            api.registerService({
+                id: 'safeclaw-governance',
+                start() { },
+                async stop() {
+                    await startupPromise; // Ensure startup finished before tearing down
+                    await shutdown();
+                },
+            });
+        }
+        else {
+            // Fallback for older OpenClaw versions without registerService:
+            // No process.exit() — just clean up on beforeExit
+            process.on('beforeExit', () => { shutdown().catch(() => { }); });
+        }
+        // THE GATE — constraint checking on every tool call (#195: use correct OpenClaw field names)
         api.on('before_tool_call', async (event, ctx) => {
-            if (!handshakeCompleted && config.failMode === 'closed' && config.enforcement === 'enforce') {
+            const cfg = getConfig();
+            if (!handshakeCompleted && cfg.failMode === 'closed' && cfg.enforcement === 'enforce') {
                 return { block: true, blockReason: 'SafeClaw handshake not completed (fail-closed)' };
             }
             const r = await post('/evaluate/tool-call', {
-                sessionId: ctx.sessionId ?? event.sessionId,
-                userId: ctx.userId ?? event.userId,
-                toolName: event.toolName ?? event.tool_name,
+                sessionId: ctx.sessionId ?? event.sessionId ?? '',
+                userId: ctx.agentId ?? '',
+                toolName: event.toolName ?? '',
                 params: event.params ?? {},
-                sessionHistory: event.sessionHistory ?? [],
+                runId: ctx.runId ?? '',
             });
-            if (r === null && config.failMode === 'closed' && config.enforcement === 'enforce') {
-                return { block: true, blockReason: `SafeClaw service unavailable at ${config.serviceUrl} (fail-closed)` };
+            if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'enforce') {
+                return { block: true, blockReason: `SafeClaw service unavailable at ${cfg.serviceUrl} (fail-closed)` };
             }
-            else if (r === null && config.failMode === 'closed' && config.enforcement === 'warn-only') {
-                console.warn(`[SafeClaw] Service unavailable at ${config.serviceUrl} (fail-closed mode, warn-only)`);
+            else if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'warn-only') {
+                log.warn(`[SafeClaw] Service unavailable at ${cfg.serviceUrl} (fail-closed mode, warn-only)`);
             }
-            else if (r === null && config.failMode === 'closed' && config.enforcement === 'audit-only') {
-                console.warn(`[SafeClaw] Service unavailable at ${config.serviceUrl} (fail-closed mode, audit-only)`);
+            else if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'audit-only') {
+                log.warn(`[SafeClaw] Service unavailable at ${cfg.serviceUrl} (fail-closed mode, audit-only)`);
             }
             if (r?.block) {
-                if (config.enforcement === 'enforce') {
-                    return { block: true, blockReason: r.reason };
+                const blockReason = r.reason || 'Blocked by SafeClaw (no reason provided)';
+                if (cfg.enforcement === 'enforce') {
+                    return { block: true, blockReason };
                 }
-                if (config.enforcement === 'warn-only') {
-                    console.warn(`[SafeClaw] Warning: ${r.reason}`);
+                if (cfg.enforcement === 'warn-only') {
+                    log.warn(`[SafeClaw] Warning: ${blockReason}`);
                 }
                 // audit-only: logged server-side, no action here
             }
         }, { priority: 100 });
         // Context injection — prepend governance context to agent system prompt
-        api.on('before_agent_start', async (event, ctx) => {
+        // (#195: before_agent_start is deprecated; use before_prompt_build + prependSystemContext)
+        api.on('before_prompt_build', async (event, ctx) => {
             const r = await post('/context/build', {
-                sessionId: ctx.sessionId ?? event.sessionId,
-                userId: ctx.userId ?? event.userId,
+                sessionId: ctx.sessionId ?? event.sessionId ?? '',
+                userId: ctx.agentId ?? '',
             });
             if (r?.prependContext) {
-                return { prependContext: r.prependContext };
+                return { prependSystemContext: r.prependContext };
             }
         }, { priority: 100 });
         // Message governance — check outbound messages
+        // (#195: use ctx.conversationId/sessionId, ctx.accountId; return only { cancel: true })
         api.on('message_sending', async (event, ctx) => {
+            const cfg = getConfig();
             const r = await post('/evaluate/message', {
-                sessionId: ctx.sessionId ?? event.sessionId,
-                userId: ctx.userId ?? event.userId,
+                sessionId: ctx.conversationId ?? ctx.sessionId ?? event.sessionId ?? '',
+                userId: ctx.accountId ?? '',
                 to: event.to,
                 content: event.content,
+                channelId: ctx.channelId ?? '',
             });
-            if (r === null && config.failMode === 'closed' && config.enforcement === 'enforce') {
+            if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'enforce') {
+                log.warn('[SafeClaw] Blocking message: service unavailable (fail-closed mode)');
                 return { cancel: true };
             }
-            else if (r === null && config.failMode === 'closed' && config.enforcement === 'warn-only') {
-                console.warn('[SafeClaw] Service unavailable (fail-closed mode, warn-only)');
+            else if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'warn-only') {
+                log.warn('[SafeClaw] Service unavailable (fail-closed mode, warn-only)');
+            }
+            else if (r === null && cfg.failMode === 'closed' && cfg.enforcement === 'audit-only') {
+                log.info('[SafeClaw] audit-only: service unreachable, allowing message (fail-closed)');
             }
             if (r?.block) {
-                if (config.enforcement === 'enforce') {
+                const blockReason = r.reason || 'Blocked by SafeClaw (no reason provided)';
+                if (cfg.enforcement === 'enforce') {
+                    log.warn(`[SafeClaw] Blocking message: ${blockReason}`);
                     return { cancel: true };
                 }
-                if (config.enforcement === 'warn-only') {
-                    console.warn(`[SafeClaw] Warning: ${r.reason}`);
+                if (cfg.enforcement === 'warn-only') {
+                    log.warn(`[SafeClaw] Warning: ${blockReason}`);
                 }
                 // audit-only: logged server-side, no action here
             }
         }, { priority: 100 });
         // Async logging — fire-and-forget, no return value needed
+        // (#195: use event.prompt for input, event.lastAssistant for output; add provider/model)
         api.on('llm_input', (event, ctx) => {
             post('/log/llm-input', {
-                sessionId: ctx.sessionId ?? event.sessionId,
-                content: event.content,
+                sessionId: event.sessionId ?? ctx.sessionId ?? '',
+                content: event.prompt ?? '',
+                provider: event.provider ?? '',
+                model: event.model ?? '',
             }).catch(() => { });
         });
         api.on('llm_output', (event, ctx) => {
             post('/log/llm-output', {
-                sessionId: ctx.sessionId ?? event.sessionId,
-                content: event.content,
+                sessionId: event.sessionId ?? ctx.sessionId ?? '',
+                content: event.lastAssistant ?? '',
+                provider: event.provider ?? '',
+                model: event.model ?? '',
+                usage: event.usage ?? {},
             }).catch(() => { });
         });
+        // (#195: use event.toolName, !event.error for success, add durationMs and error)
         api.on('after_tool_call', (event, ctx) => {
             post('/record/tool-result', {
-                sessionId: ctx.sessionId ?? event.sessionId,
-                toolName: event.toolName ?? event.tool_name,
+                sessionId: ctx.sessionId ?? event.sessionId ?? '',
+                toolName: event.toolName ?? '',
                 params: event.params ?? {},
                 result: event.result ?? '',
-                success: event.success ?? false,
-            }).catch((e) => console.warn('[SafeClaw] Failed to record tool result:', e));
+                success: !event.error,
+                error: event.error ? String(event.error) : '',
+                durationMs: event.durationMs ?? 0,
+            }).catch((e) => log.warn('[SafeClaw] Failed to record tool result:', e));
+        });
+        // Subagent governance — block delegation bypass attempts (#188)
+        api.on('subagent_spawning', async (event, ctx) => {
+            const cfg = getConfig();
+            const r = await post('/evaluate/subagent-spawn', {
+                sessionId: ctx.sessionId ?? event.sessionId,
+                userId: ctx.agentId,
+                parentAgentId: event.parentAgentId,
+                childConfig: event.childConfig ?? {},
+                reason: event.reason ?? '',
+            });
+            if (r?.block && cfg.enforcement === 'enforce') {
+                throw new Error(r.reason || 'Blocked by SafeClaw: delegation bypass detected');
+            }
+            if (r?.block && cfg.enforcement === 'warn-only') {
+                log.warn(`[SafeClaw] Subagent spawn warning: ${r.reason}`);
+            }
+        }, { priority: 100 });
+        // Subagent ended — record child agent lifecycle (#188)
+        api.on('subagent_ended', (event, ctx) => {
+            post('/record/subagent-ended', {
+                sessionId: ctx.sessionId ?? event.sessionId,
+                parentAgentId: event.parentAgentId,
+                childAgentId: event.childAgentId,
+            }).catch(() => { });
         });
+        // Session lifecycle — notify service of session start (#189)
+        api.on('session_start', (event, ctx) => {
+            post('/session/start', {
+                sessionId: ctx.sessionId ?? event.sessionId,
+                userId: ctx.agentId,
+                agentId: instanceId,
+                metadata: event.metadata ?? {},
+            }).catch(() => { });
+        });
+        // Session lifecycle — notify service of session end (#189)
+        api.on('session_end', (event, ctx) => {
+            post('/session/end', {
+                sessionId: ctx.sessionId ?? event.sessionId,
+                userId: ctx.agentId,
+                agentId: instanceId,
+            }).catch(() => { });
+        });
+        // Inbound message governance — evaluate received messages (#190)
+        api.on('message_received', (event, ctx) => {
+            post('/evaluate/inbound-message', {
+                sessionId: ctx.sessionId ?? event.sessionId,
+                userId: ctx.agentId,
+                channel: event.channel ?? ctx.channelId ?? '',
+                sender: event.sender ?? '',
+                content: event.content ?? '',
+                metadata: event.metadata ?? {},
+            }).catch(() => { });
+        });
+        // Agent tools — let agents introspect governance state (#197)
+        if (api.registerTool) {
+            api.registerTool({
+                name: 'safeclaw_status',
+                description: 'Check SafeClaw governance service status, enforcement mode, and active constraints',
+                parameters: {},
+                async execute(_params, _ctx) {
+                    const health = await get('/health');
+                    const cfg = getConfig();
+                    return {
+                        status: health?.status ?? 'unreachable',
+                        enforcement: cfg.enforcement,
+                        failMode: cfg.failMode,
+                        serviceUrl: cfg.serviceUrl,
+                        handshakeCompleted,
+                    };
+                },
+            });
+            api.registerTool({
+                name: 'safeclaw_check_action',
+                description: 'Check if a specific tool call would be allowed by SafeClaw governance (dry run, no side effects)',
+                parameters: {
+                    type: 'object',
+                    properties: {
+                        toolName: { type: 'string', description: 'Tool name to check' },
+                        params: { type: 'object', description: 'Tool parameters to validate' },
+                    },
+                    required: ['toolName'],
+                },
+                async execute(params, ctx) {
+                    const r = await post('/evaluate/tool-call', {
+                        sessionId: ctx.sessionId ?? '',
+                        userId: ctx.agentId ?? '',
+                        toolName: params.toolName,
+                        params: params.params ?? {},
+                        dryRun: true,
+                    });
+                    return r ?? { error: 'Service unreachable' };
+                },
+            });
+        }
+        // CLI extension — `safeclaw status` command (#197)
+        if (api.registerCli) {
+            api.registerCli(({ program }) => {
+                const cmd = program.command('safeclaw').description('SafeClaw governance controls');
+                cmd.command('status')
+                    .description('Show SafeClaw service status and enforcement mode')
+                    .action(async () => {
+                    const cfg = getConfig();
+                    const health = await get('/health');
+                    console.log(`SafeClaw: ${health?.status ?? 'unreachable'}`);
+                    console.log(`  Enforcement: ${cfg.enforcement}`);
+                    console.log(`  Fail mode: ${cfg.failMode}`);
+                    console.log(`  Service: ${cfg.serviceUrl}`);
+                });
+            }, { commands: ['safeclaw'] });
+        }
     },
 };

package/dist/tui/About.js

@@ -1,5 +1,5 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Text, Box } from 'ink';
 export default function About() {
-    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, children: "About" }) }), _jsx(Text, { children: "  SafeClaw Neurosymbolic Governance" }), _jsx(Text, { dimColor: true, children: "  Validates AI agent actions against OWL" }), _jsx(Text, { dimColor: true, children: "  ontologies and SHACL constraints." }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { children: "  Web:  " }), _jsx(Text, { color: "cyan", children: "https://safeclaw.eu" })] }), _jsxs(Box, { children: [_jsx(Text, { children: "  Docs: " }), _jsx(Text, { color: "cyan", children: "https://safeclaw.eu/docs" })] }), _jsxs(Box, { children: [_jsx(Text, { children: "  Repo: " }), _jsx(Text, { color: "cyan", children: "https://github.com/tendlyeu/SafeClaw" })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "  q to quit" }) })] }));
+    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(Box, { marginBottom: 1, children: _jsx(Text, { bold: true, children: "About SafeClaw" }) }), _jsx(Text, { children: "  Neurosymbolic governance for AI agents." }), _jsx(Text, { dimColor: true, children: "  Validates tool calls, messages, and actions against" }), _jsx(Text, { dimColor: true, children: "  OWL ontologies and SHACL constraints before execution." }), _jsx(Box, { marginTop: 1, marginBottom: 1, children: _jsx(Text, { bold: true, children: "  Features" }) }), _jsx(Text, { dimColor: true, children: "  - 9-step constraint pipeline (SHACL, policies, preferences, dependencies)" }), _jsx(Text, { dimColor: true, children: "  - Role-based access control with per-user preferences" }), _jsx(Text, { dimColor: true, children: "  - Multi-agent governance with delegation detection" }), _jsx(Text, { dimColor: true, children: "  - Append-only audit trail with compliance reporting" }), _jsx(Text, { dimColor: true, children: "  - Passive LLM security reviewer and classification observer" }), _jsx(Text, { dimColor: true, children: "  - Natural language policy compilation" }), _jsx(Box, { marginTop: 1, marginBottom: 1, children: _jsx(Text, { bold: true, children: "  CLI commands" }) }), _jsx(Text, { dimColor: true, children: "  safeclaw-plugin  This plugin CLI (connect, status, config, tui)" }), _jsx(Text, { dimColor: true, children: "  safeclaw         Service CLI (serve, audit, policy, pref, status)" }), _jsxs(Box, { marginTop: 1, children: [_jsx(Text, { children: "  Web:  " }), _jsx(Text, { color: "cyan", children: "https://safeclaw.eu" })] }), _jsxs(Box, { children: [_jsx(Text, { children: "  Docs: " }), _jsx(Text, { color: "cyan", children: "https://safeclaw.eu/docs" })] }), _jsxs(Box, { children: [_jsx(Text, { children: "  Repo: " }), _jsx(Text, { color: "cyan", children: "https://github.com/tendlyeu/SafeClaw" })] }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: "  q to quit" }) })] }));
 }

package/dist/tui/App.js

@@ -33,5 +33,5 @@ export default function App() {
             }
         }
     });
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { borderStyle: "single", borderColor: "green", paddingX: 1, children: [_jsx(Text, { bold: true, color: "green", children: "SafeClaw " }), _jsxs(Text, { dimColor: true, children: ["v", PKG_VERSION] })] }), _jsxs(Box, { paddingX: 1, gap: 2, children: [TABS.map((t, i) => (_jsx(Text, { bold: tab === t, color: tab === t ? 'cyan' : 'white', dimColor: tab !== t, children: `${i + 1}:${t}` }, t))), _jsx(Text, { dimColor: true, children: " tab/1-3 to switch" })] }), _jsxs(Box, { marginTop: 1, children: [tab === 'Status' && _jsx(Status, { config: config }), tab === 'Settings' && (_jsx(Settings, { config: config, onConfigChange: setConfig })), tab === 'About' && _jsx(About, {})] })] }));
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Box, { borderStyle: "single", borderColor: "green", paddingX: 1, children: [_jsx(Text, { bold: true, color: "green", children: "SafeClaw " }), _jsxs(Text, { dimColor: true, children: ["v", PKG_VERSION] })] }), _jsxs(Box, { paddingX: 1, gap: 2, children: [TABS.map((t, i) => (_jsx(Text, { bold: tab === t, color: tab === t ? 'cyan' : 'white', dimColor: tab !== t, children: `${i + 1}:${t}` }, t))), _jsx(Text, { dimColor: true, children: " tab/1-3 switch  q quit" })] }), _jsxs(Box, { marginTop: 1, children: [tab === 'Status' && _jsx(Status, { config: config }), tab === 'Settings' && (_jsx(Settings, { config: config, onConfigChange: setConfig })), tab === 'About' && _jsx(About, {})] })] }));
 }

package/dist/tui/Settings.js

@@ -9,6 +9,7 @@ const SETTINGS = [
     { key: 'enforcement', label: 'Enforcement', type: 'cycle', values: ENFORCEMENT_MODES },
     { key: 'failMode', label: 'Fail Mode', type: 'cycle', values: FAIL_MODES },
     { key: 'serviceUrl', label: 'Service URL', type: 'text' },
+    { key: 'apiKey', label: 'API Key', type: 'text' },
 ];
 export default function Settings({ config, onConfigChange }) {
     const [selected, setSelected] = useState(0);
@@ -22,7 +23,18 @@ export default function Settings({ config, onConfigChange }) {
     useInput((input, key) => {
         if (editing) {
             if (key.return) {
-                updateConfig({ serviceUrl: editBuffer });
+                const editingKey = SETTINGS[selected].key;
+                if (editingKey === 'apiKey' && editBuffer && !editBuffer.startsWith('sc_')) {
+                    // Reject invalid API keys — must start with sc_
+                    return;
+                }
+                try {
+                    updateConfig({ [editingKey]: editBuffer });
+                }
+                catch {
+                    // saveConfig may throw on invalid URL — stay in edit mode
+                    return;
+                }
                 setEditing(false);
             }
             else if (key.escape) {
@@ -57,7 +69,7 @@ export default function Settings({ config, onConfigChange }) {
             }
             else if (setting.type === 'text' && key.return) {
                 setEditing(true);
-                setEditBuffer(config.serviceUrl);
+                setEditBuffer(String(config[setting.key] ?? ''));
             }
         }
     });
@@ -68,8 +80,13 @@ export default function Settings({ config, onConfigChange }) {
                 if (setting.key === 'enabled') {
                     value = config.enabled ? 'ON' : 'OFF';
                 }
-                else if (setting.key === 'serviceUrl' && editing && isSelected) {
-                    value = editBuffer + '█';
+                else if (setting.type === 'text' && editing && isSelected) {
+                    value = (setting.key === 'apiKey' ? '*'.repeat(editBuffer.length) : editBuffer) + '█';
+                }
+                else if (setting.key === 'apiKey') {
+                    value = config.apiKey
+                        ? `${config.apiKey.slice(0, 6)}..${config.apiKey.slice(-4)}`
+                        : '(not set)';
                 }
                 else {
                     value = String(config[setting.key]);
@@ -79,6 +96,8 @@ export default function Settings({ config, onConfigChange }) {
                                 ? config.enabled ? 'green' : 'red'
                                 : undefined, children: value }), showArrows && _jsx(Text, { dimColor: true, children: ' ▶' })] }, setting.key));
             }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: editing
-                        ? '  type to edit · enter to save · esc to cancel'
-                        : '  ↑↓ navigate · ←→ change · enter to edit URL · q quit' }) }), _jsx(Box, { children: _jsx(Text, { dimColor: true, children: '  Saves to ~/.safeclaw/config.json' }) })] }));
+                        ? SETTINGS[selected].key === 'apiKey' && editBuffer && !editBuffer.startsWith('sc_')
+                            ? '  API key must start with sc_ · esc to cancel'
+                            : '  type to edit · enter to save · esc to cancel'
+                        : '  ↑↓ navigate · ←→/enter cycle/toggle · enter to edit text fields · q quit' }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: '  Enforcement: enforce=block violations, warn-only=log only, audit-only=record only, disabled=off' }) }), _jsx(Box, { children: _jsx(Text, { dimColor: true, children: '  Fail Mode:   open=allow if service unreachable, closed=block if service unreachable' }) }), _jsx(Box, { marginTop: 1, children: _jsx(Text, { dimColor: true, children: '  All changes save to ~/.safeclaw/config.json immediately.' }) })] }));
 }