openclaw-sentinel 0.3.2 → 2026.3.5

package/README.md

@@ -1,5 +1,15 @@
 # 🛡️ OpenClaw Sentinel
 
+[![npm version](https://img.shields.io/npm/v/openclaw-sentinel.svg)](https://www.npmjs.com/package/openclaw-sentinel)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
+[![Node.js](https://img.shields.io/badge/node-%3E%3D18-brightgreen.svg)](https://nodejs.org)
+[![OpenClaw Plugin](https://img.shields.io/badge/OpenClaw-plugin-blue.svg)](https://github.com/openclaw/openclaw)
+[![Powered by osquery](https://img.shields.io/badge/powered%20by-osquery-00125F.svg)](https://github.com/osquery/osquery)
+
+<p align="center">
+  <img src="docs/sentinel-alerts-screenshot.png" alt="Sentinel real-time alerts via Signal" width="500">
+</p>
+
 OpenClaw agents run with elevated privileges on your machine — shell access, file operations, network connections. Sentinel continuously monitors for unauthorized access, suspicious processes, privilege escalation, and system anomalies, alerting you in real-time through any OpenClaw channel.
 
 A security monitoring plugin for [OpenClaw](https://github.com/openclaw/openclaw), powered by [osquery](https://github.com/osquery/osquery).
@@ -66,7 +76,32 @@ sudo yum install osquery
 
 ## Installation
 
-### From npm (recommended)
+### Using OpenClaw CLI (recommended)
+
+```bash
+openclaw plugins install openclaw-sentinel
+```
+
+This pulls the package from npm, installs it into `~/.openclaw/extensions/sentinel/`, and registers it in your config automatically.
+
+Then configure and restart:
+
+```bash
+openclaw gateway restart
+```
+
+You can also manage it with:
+
+```bash
+openclaw plugins list        # See installed plugins
+openclaw plugins info sentinel  # Plugin details
+openclaw plugins update      # Update all npm-installed plugins
+openclaw plugins uninstall sentinel  # Remove
+```
+
+### From npm (manual)
+
+If you prefer manual setup:
 
 ```bash
 npm install -g openclaw-sentinel

package/dist/__tests__/alert-tailer.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/__tests__/alert-tailer.test.js

@@ -0,0 +1,261 @@
+import { describe, it, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { writeFileSync, mkdirSync, appendFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { AlertTailer } from "../alert-tailer.js";
+const TEST_DIR = join(tmpdir(), `sentinel-alert-tailer-test-${Date.now()}`);
+const EVENTS_PATH = join(TEST_DIR, "events.jsonl");
+function makeEvent(overrides = {}) {
+    return {
+        id: `evt-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+        timestamp: Date.now(),
+        severity: "high",
+        category: "process",
+        title: "Suspicious command detected",
+        description: "test command",
+        hostname: "test-host",
+        details: {},
+        ...overrides,
+    };
+}
+function makeConfig(overrides = {}) {
+    return {
+        alertSeverity: "info",
+        alertChannel: "signal",
+        alertTo: "+1234567890",
+        clawAssess: false,
+        ...overrides,
+    };
+}
+describe("AlertTailer", () => {
+    beforeEach(() => {
+        mkdirSync(TEST_DIR, { recursive: true });
+        // Create empty events file
+        writeFileSync(EVENTS_PATH, "");
+    });
+    afterEach(() => {
+        rmSync(TEST_DIR, { recursive: true, force: true });
+    });
+    it("starts at end of file and ignores existing events", async () => {
+        // Write some pre-existing events
+        const oldEvent = makeEvent({ title: "Old event" });
+        appendFileSync(EVENTS_PATH, JSON.stringify(oldEvent) + "\n");
+        const alerts = [];
+        const tailer = new AlertTailer({
+            eventsPath: EVENTS_PATH,
+            config: makeConfig(),
+            suppressionStore: null,
+            sendAlert: async (text) => { alerts.push(text); },
+            clawAssessEvent: async () => null,
+        });
+        await tailer.start();
+        // Wait for fs.watch to settle
+        await new Promise((r) => setTimeout(r, 300));
+        assert.equal(alerts.length, 0, "Should not alert on pre-existing events");
+        tailer.stop();
+    });
+    it("alerts on new events written after start", async () => {
+        const alerts = [];
+        const tailer = new AlertTailer({
+            eventsPath: EVENTS_PATH,
+            config: makeConfig(),
+            suppressionStore: null,
+            sendAlert: async (text) => { alerts.push(text); },
+            clawAssessEvent: async () => null,
+        });
+        await tailer.start();
+        await new Promise((r) => setTimeout(r, 200));
+        // Write a new event
+        const evt = makeEvent({ title: "New suspicious command" });
+        appendFileSync(EVENTS_PATH, JSON.stringify(evt) + "\n");
+        // Wait for debounce (100ms) + processing
+        await new Promise((r) => setTimeout(r, 500));
+        assert.ok(alerts.length > 0, "Should alert on new events");
+        assert.ok(alerts[0].includes("New suspicious command"));
+        tailer.stop();
+    });
+    it("respects severity threshold", async () => {
+        const alerts = [];
+        const tailer = new AlertTailer({
+            eventsPath: EVENTS_PATH,
+            config: makeConfig({ alertSeverity: "high" }),
+            suppressionStore: null,
+            sendAlert: async (text) => { alerts.push(text); },
+            clawAssessEvent: async () => null,
+        });
+        await tailer.start();
+        await new Promise((r) => setTimeout(r, 200));
+        // Write info event (below threshold)
+        appendFileSync(EVENTS_PATH, JSON.stringify(makeEvent({ severity: "info", title: "Info event" })) + "\n");
+        await new Promise((r) => setTimeout(r, 500));
+        assert.equal(alerts.length, 0, "Should not alert on info when threshold is high");
+        // Write high event (meets threshold)
+        appendFileSync(EVENTS_PATH, JSON.stringify(makeEvent({ severity: "high", title: "High event" })) + "\n");
+        await new Promise((r) => setTimeout(r, 500));
+        assert.equal(alerts.length, 1, "Should alert on high severity");
+        tailer.stop();
+    });
+    it("deduplicates same-title events within window", async () => {
+        const alerts = [];
+        const tailer = new AlertTailer({
+            eventsPath: EVENTS_PATH,
+            config: makeConfig(),
+            suppressionStore: null,
+            sendAlert: async (text) => { alerts.push(text); },
+            clawAssessEvent: async () => null,
+        });
+        await tailer.start();
+        await new Promise((r) => setTimeout(r, 200));
+        // Write same event twice quickly
+        const evt = makeEvent({ title: "Duplicate event", category: "network" });
+        appendFileSync(EVENTS_PATH, JSON.stringify(evt) + "\n" + JSON.stringify(evt) + "\n");
+        await new Promise((r) => setTimeout(r, 500));
+        assert.equal(alerts.length, 1, "Should deduplicate same-title events");
+        tailer.stop();
+    });
+    it("does not deduplicate SSH failed auth events", async () => {
+        const alerts = [];
+        const tailer = new AlertTailer({
+            eventsPath: EVENTS_PATH,
+            config: makeConfig(),
+            suppressionStore: null,
+            sendAlert: async (text) => { alerts.push(text); },
+            clawAssessEvent: async () => null,
+        });
+        await tailer.start();
+        await new Promise((r) => setTimeout(r, 200));
+        const evt = makeEvent({ title: "SSH failed authentication", category: "ssh_login" });
+        appendFileSync(EVENTS_PATH, JSON.stringify(evt) + "\n" + JSON.stringify(evt) + "\n");
+        await new Promise((r) => setTimeout(r, 500));
+        assert.equal(alerts.length, 2, "SSH failed auth should not be deduped");
+        tailer.stop();
+    });
+    it("includes Claw assessment when enabled", async () => {
+        const alerts = [];
+        const tailer = new AlertTailer({
+            eventsPath: EVENTS_PATH,
+            config: makeConfig({ clawAssess: true }),
+            suppressionStore: null,
+            sendAlert: async (text) => { alerts.push(text); },
+            clawAssessEvent: async () => "This is a benign agent command.",
+        });
+        await tailer.start();
+        await new Promise((r) => setTimeout(r, 200));
+        appendFileSync(EVENTS_PATH, JSON.stringify(makeEvent()) + "\n");
+        await new Promise((r) => setTimeout(r, 500));
+        assert.ok(alerts.length > 0);
+        assert.ok(alerts[0].includes("benign agent command"), "Should include Claw assessment");
+        tailer.stop();
+    });
+    it("still alerts when Claw assessment fails", async () => {
+        const alerts = [];
+        const tailer = new AlertTailer({
+            eventsPath: EVENTS_PATH,
+            config: makeConfig({ clawAssess: true }),
+            suppressionStore: null,
+            sendAlert: async (text) => { alerts.push(text); },
+            clawAssessEvent: async () => { throw new Error("LLM timeout"); },
+        });
+        await tailer.start();
+        await new Promise((r) => setTimeout(r, 200));
+        appendFileSync(EVENTS_PATH, JSON.stringify(makeEvent()) + "\n");
+        await new Promise((r) => setTimeout(r, 500));
+        assert.ok(alerts.length > 0, "Should still alert even if Claw assessment fails");
+        tailer.stop();
+    });
+    it("handles multiple events in a batch", async () => {
+        const alerts = [];
+        const tailer = new AlertTailer({
+            eventsPath: EVENTS_PATH,
+            config: makeConfig(),
+            suppressionStore: null,
+            sendAlert: async (text) => { alerts.push(text); },
+            clawAssessEvent: async () => null,
+        });
+        await tailer.start();
+        await new Promise((r) => setTimeout(r, 200));
+        // Write 3 different events at once
+        const lines = [
+            JSON.stringify(makeEvent({ title: "Event A", category: "network" })),
+            JSON.stringify(makeEvent({ title: "Event B", category: "file" })),
+            JSON.stringify(makeEvent({ title: "Event C", category: "auth" })),
+        ].join("\n") + "\n";
+        appendFileSync(EVENTS_PATH, lines);
+        await new Promise((r) => setTimeout(r, 500));
+        assert.equal(alerts.length, 3, "Should process all events in batch");
+        tailer.stop();
+    });
+    it("skips malformed JSON lines", async () => {
+        const alerts = [];
+        const tailer = new AlertTailer({
+            eventsPath: EVENTS_PATH,
+            config: makeConfig(),
+            suppressionStore: null,
+            sendAlert: async (text) => { alerts.push(text); },
+            clawAssessEvent: async () => null,
+        });
+        await tailer.start();
+        await new Promise((r) => setTimeout(r, 200));
+        appendFileSync(EVENTS_PATH, "not valid json\n" + JSON.stringify(makeEvent({ title: "Valid event" })) + "\n");
+        await new Promise((r) => setTimeout(r, 500));
+        assert.equal(alerts.length, 1, "Should skip bad lines and process valid ones");
+        assert.ok(alerts[0].includes("Valid event"));
+        tailer.stop();
+    });
+    it("stops cleanly", async () => {
+        const tailer = new AlertTailer({
+            eventsPath: EVENTS_PATH,
+            config: makeConfig(),
+            suppressionStore: null,
+            sendAlert: async () => { },
+            clawAssessEvent: async () => null,
+        });
+        await tailer.start();
+        tailer.stop();
+        // Write event after stop — should not be processed
+        const alerts = [];
+        appendFileSync(EVENTS_PATH, JSON.stringify(makeEvent()) + "\n");
+        await new Promise((r) => setTimeout(r, 300));
+        // No crash, no processing after stop
+        assert.ok(true, "Should stop without errors");
+    });
+    it("handles events file not existing at start", async () => {
+        rmSync(EVENTS_PATH, { force: true });
+        const tailer = new AlertTailer({
+            eventsPath: EVENTS_PATH,
+            config: makeConfig(),
+            suppressionStore: null,
+            sendAlert: async () => { },
+            clawAssessEvent: async () => null,
+        });
+        // Should not throw
+        await tailer.start();
+        await new Promise((r) => setTimeout(r, 200));
+        tailer.stop();
+        assert.ok(true, "Should handle missing file gracefully");
+    });
+    it("updateConfig changes threshold at runtime", async () => {
+        const alerts = [];
+        const tailer = new AlertTailer({
+            eventsPath: EVENTS_PATH,
+            config: makeConfig({ alertSeverity: "high" }),
+            suppressionStore: null,
+            sendAlert: async (text) => { alerts.push(text); },
+            clawAssessEvent: async () => null,
+        });
+        await tailer.start();
+        await new Promise((r) => setTimeout(r, 200));
+        // Info event — should be filtered
+        appendFileSync(EVENTS_PATH, JSON.stringify(makeEvent({ severity: "info", title: "Info 1" })) + "\n");
+        await new Promise((r) => setTimeout(r, 500));
+        assert.equal(alerts.length, 0);
+        // Update config to info threshold
+        tailer.updateConfig(makeConfig({ alertSeverity: "info" }));
+        // Info event — should now alert
+        appendFileSync(EVENTS_PATH, JSON.stringify(makeEvent({ severity: "info", title: "Info 2" })) + "\n");
+        await new Promise((r) => setTimeout(r, 500));
+        assert.equal(alerts.length, 1);
+        tailer.stop();
+    });
+});

package/dist/__tests__/analyzer.test.js

@@ -131,7 +131,7 @@ describe("analyzeLoginEvents", () => {
     });
     it("emits info event for known hosts", () => {
         const rows = [
-            { user: "sunil", host: "192.168.1.100", type: "user" },
+            { user: "alice", host: "192.168.1.100", type: "user" },
         ];
         const events = analyzeLoginEvents(rows, knownHosts);
         assert.equal(events.length, 1);
@@ -140,9 +140,9 @@ describe("analyzeLoginEvents", () => {
     });
     it("emits info event for Tailscale CGNAT range (100.64-127.x.x)", () => {
         const rows = [
-            { user: "sunil", host: "100.79.207.74", type: "user" },
-            { user: "sunil", host: "100.94.48.17", type: "user" },
-            { user: "sunil", host: "100.127.255.255", type: "user" },
+            { user: "alice", host: "100.79.207.74", type: "user" },
+            { user: "alice", host: "100.94.48.17", type: "user" },
+            { user: "alice", host: "100.127.255.255", type: "user" },
         ];
         const events = analyzeLoginEvents(rows, new Set());
         assert.equal(events.length, 3);
@@ -159,10 +159,10 @@ describe("analyzeLoginEvents", () => {
     });
     it("skips localhost and empty hosts", () => {
         const rows = [
-            { user: "sunil", host: "", type: "user" },
-            { user: "sunil", host: "localhost", type: "user" },
-            { user: "sunil", host: "127.0.0.1", type: "user" },
-            { user: "sunil", host: "::1", type: "user" },
+            { user: "alice", host: "", type: "user" },
+            { user: "alice", host: "localhost", type: "user" },
+            { user: "alice", host: "127.0.0.1", type: "user" },
+            { user: "alice", host: "::1", type: "user" },
         ];
         const events = analyzeLoginEvents(rows, new Set());
         assert.equal(events.length, 0);

package/dist/__tests__/log-stream.test.js

@@ -7,11 +7,11 @@ import assert from "node:assert/strict";
 describe("SSH log line patterns", () => {
     // These patterns match what sshd outputs and our parser expects
     it("matches 'Accepted publickey' pattern", () => {
-        const line = '2026-02-22 16:30:00.123456-0500  0x1234  Default  0x0  0  sshd: Accepted publickey for sunil from 100.79.207.74 port 52341 ssh2';
+        const line = '2026-02-22 16:30:00.123456-0500  0x1234  Default  0x0  0  sshd: Accepted publickey for alice from 100.79.207.74 port 52341 ssh2';
         const match = line.match(/sshd.*?:\s+Accepted\s+(\S+)\s+for\s+(\S+)\s+from\s+(\S+)\s+port\s+(\d+)/);
         assert.ok(match);
         assert.equal(match[1], "publickey");
-        assert.equal(match[2], "sunil");
+        assert.equal(match[2], "alice");
         assert.equal(match[3], "100.79.207.74");
         assert.equal(match[4], "52341");
     });
@@ -24,10 +24,10 @@ describe("SSH log line patterns", () => {
         assert.equal(match[3], "203.0.113.42");
     });
     it("matches 'Failed password' pattern", () => {
-        const line = '2026-02-22 16:30:00.123456-0500  0x1234  Default  0x0  0  sshd: Failed password for sunil from 203.0.113.42 port 22 ssh2';
+        const line = '2026-02-22 16:30:00.123456-0500  0x1234  Default  0x0  0  sshd: Failed password for alice from 203.0.113.42 port 22 ssh2';
         const match = line.match(/sshd.*?:\s+Failed\s+password\s+for\s+(?:invalid\s+user\s+)?(\S+)\s+from\s+(\S+)\s+port\s+(\d+)/);
         assert.ok(match);
-        assert.equal(match[1], "sunil");
+        assert.equal(match[1], "alice");
         assert.equal(match[2], "203.0.113.42");
     });
     it("matches 'Failed password for invalid user' pattern", () => {
@@ -45,16 +45,16 @@ describe("SSH log line patterns", () => {
         assert.equal(match[2], "203.0.113.42");
     });
     it("matches macOS sshd-session USER_PROCESS pattern", () => {
-        const line = "Feb 22 16:39:32 sunils-mac-mini sshd-session: sunil [priv][58912]: USER_PROCESS: 58916 ttys001";
+        const line = "Feb 22 16:39:32 my-hostname sshd-session: alice [priv][58912]: USER_PROCESS: 58916 ttys001";
         const match = line.match(/sshd-session:\s+(\S+)\s+\[priv\]\[(\d+)\]:\s+USER_PROCESS:\s+(\d+)\s+(\S+)/);
         assert.ok(match);
-        assert.equal(match[1], "sunil");
+        assert.equal(match[1], "alice");
         assert.equal(match[2], "58912");
         assert.equal(match[3], "58916");
         assert.equal(match[4], "ttys001");
     });
     it("does not match sshd-session DEAD_PROCESS", () => {
-        const line = "Feb 22 16:38:12 sunils-mac-mini sshd-session: sunil [priv][53930]: DEAD_PROCESS: 53934 ttys012";
+        const line = "Feb 22 16:38:12 my-hostname sshd-session: alice [priv][53930]: DEAD_PROCESS: 53934 ttys012";
         const match = line.match(/sshd-session:\s+(\S+)\s+\[priv\]\[(\d+)\]:\s+USER_PROCESS:\s+(\d+)\s+(\S+)/);
         assert.equal(match, null);
     });
@@ -88,27 +88,27 @@ describe("Tailscale IP detection", () => {
 });
 describe("Linux sudo log patterns", () => {
     it("matches sudo command execution", () => {
-        const line = "Feb 22 16:30:00 myhost sudo[1234]:   sunil : TTY=pts/0 ; PWD=/home/sunil ; USER=root ; COMMAND=/usr/bin/apt update";
+        const line = "Feb 22 16:30:00 myhost sudo[1234]:   alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/apt update";
         const match = line.match(/sudo\[\d+\]:\s+(\S+)\s*:\s*(?:.*?;\s*)?TTY=(\S+)\s*;\s*PWD=(\S+)\s*;\s*USER=(\S+)\s*;\s*COMMAND=(.*)/);
         assert.ok(match);
-        assert.equal(match[1], "sunil");
+        assert.equal(match[1], "alice");
         assert.equal(match[2], "pts/0");
         assert.equal(match[4], "root");
         assert.equal(match[5].trim(), "/usr/bin/apt update");
     });
     it("matches sudo with incorrect password attempts", () => {
-        const line = "Feb 22 16:30:00 myhost sudo[1234]:   sunil : 3 incorrect password attempts ; TTY=pts/0 ; PWD=/home/sunil ; USER=root ; COMMAND=/usr/bin/rm -rf /";
+        const line = "Feb 22 16:30:00 myhost sudo[1234]:   alice : 3 incorrect password attempts ; TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/rm -rf /";
         const match = line.match(/sudo\[\d+\]:\s+(\S+)\s*:\s*(?:.*?;\s*)?TTY=(\S+)\s*;\s*PWD=(\S+)\s*;\s*USER=(\S+)\s*;\s*COMMAND=(.*)/);
         assert.ok(match);
-        assert.equal(match[1], "sunil");
+        assert.equal(match[1], "alice");
         assert.ok(line.includes("incorrect password"));
     });
     it("matches sudo PAM session opened", () => {
-        const line = "Feb 22 16:30:00 myhost sudo[1234]: pam_unix(sudo:session): session opened for user root(uid=0) by sunil(uid=1000)";
+        const line = "Feb 22 16:30:00 myhost sudo[1234]: pam_unix(sudo:session): session opened for user root(uid=0) by alice(uid=1000)";
         const match = line.match(/sudo\[\d+\]:\s+pam_unix\(sudo:session\):\s+session\s+opened\s+for\s+user\s+(\S+).*?by\s+(\S+)/);
         assert.ok(match);
         assert.equal(match[1], "root(uid=0)");
-        assert.equal(match[2], "sunil(uid=1000)");
+        assert.equal(match[2], "alice(uid=1000)");
     });
 });
 describe("Linux user account log patterns", () => {
@@ -125,16 +125,16 @@ describe("Linux user account log patterns", () => {
         assert.equal(match[1], "olduser");
     });
     it("matches passwd password changed", () => {
-        const line = "Feb 22 16:30:00 myhost passwd[1234]: pam_unix(passwd:chauthtok): password changed for sunil";
+        const line = "Feb 22 16:30:00 myhost passwd[1234]: pam_unix(passwd:chauthtok): password changed for alice";
         const match = line.match(/passwd\[\d+\]:\s+pam_unix\(passwd:chauthtok\):\s+password\s+changed\s+for\s+(\S+)/);
         assert.ok(match);
-        assert.equal(match[1], "sunil");
+        assert.equal(match[1], "alice");
     });
     it("matches usermod change user", () => {
-        const line = "Feb 22 16:30:00 myhost usermod[1234]: change user 'sunil' shell";
+        const line = "Feb 22 16:30:00 myhost usermod[1234]: change user 'alice' shell";
         const match = line.match(/usermod\[\d+\]:\s+change\s+user\s+'(\S+)'/);
         assert.ok(match);
-        assert.equal(match[1], "sunil");
+        assert.equal(match[1], "alice");
     });
     it("matches groupadd new group (strips trailing comma)", () => {
         const line = "Feb 22 16:30:00 myhost groupadd[1234]: new group: name=newgroup, GID=1002";
@@ -151,10 +151,10 @@ describe("Linux remote desktop log patterns", () => {
         assert.equal(match[1], "203.0.113.42");
     });
     it("matches xrdp session started", () => {
-        const line = "Feb 22 16:30:00 myhost xrdp-sesman[1234]: session started for user sunil";
+        const line = "Feb 22 16:30:00 myhost xrdp-sesman[1234]: session started for user alice";
         const match = line.match(/xrdp-sesman\[\d+\]:\s+.*?session\s+started.*?user\s+(\S+)/i);
         assert.ok(match);
-        assert.equal(match[1], "sunil");
+        assert.equal(match[1], "alice");
     });
     it("matches VNC connection", () => {
         const line = "Feb 22 16:30:00 myhost x11vnc[1234]: Got connection from client 203.0.113.42";

package/dist/__tests__/suppressions.test.js

@@ -83,14 +83,14 @@ describe("SuppressionStore", () => {
         await store.add({
             scope: "field",
             field: "user",
-            fieldValue: "sunil",
+            fieldValue: "alice",
             reason: "Sunil's own sudo",
             expiresAt: null,
         });
         const evt = makeEvent({
             title: "sudo command executed",
             category: "privilege",
-            details: { user: "sunil", command: "/usr/bin/ls" },
+            details: { user: "alice", command: "/usr/bin/ls" },
         });
         assert.ok(store.isSuppressed(evt));
         // Different user should not be suppressed
@@ -176,7 +176,7 @@ describe("SuppressionStore", () => {
     it("describes rules in plain English", () => {
         assert.equal(SuppressionStore.describe({ scope: "title", title: "sudo command executed" }), 'All alerts titled "sudo command executed"');
         assert.equal(SuppressionStore.describe({ scope: "category", category: "ssh_login" }), 'All alerts in category "ssh_login"');
-        assert.equal(SuppressionStore.describe({ scope: "field", field: "user", fieldValue: "sunil" }), 'Alerts where user = "sunil"');
+        assert.equal(SuppressionStore.describe({ scope: "field", field: "user", fieldValue: "alice" }), 'Alerts where user = "alice"');
         assert.equal(SuppressionStore.describe({ scope: "exact", title: "test" }), 'Exact match: "test" with specific description');
     });
     it("increments suppress count on repeated matches", async () => {

package/dist/alert-tailer.d.ts

@@ -0,0 +1,39 @@
+/**
+ * AlertTailer — Tails events.jsonl and handles all alerting logic.
+ *
+ * Decouples detection (log stream watchers, osquery) from alerting
+ * (rate limiting, dedup, suppression, Claw assessment, delivery).
+ *
+ * Architecture:
+ *   Watchers → logEvent() → events.jsonl → AlertTailer → assess → deliver
+ */
+import type { SecurityEvent, SentinelConfig } from "./config.js";
+import { SuppressionStore } from "./suppressions.js";
+export interface AlertTailerOptions {
+    eventsPath: string;
+    config: SentinelConfig;
+    suppressionStore: SuppressionStore | null;
+    sendAlert: (text: string) => Promise<void>;
+    clawAssessEvent: (evt: SecurityEvent) => Promise<string | null>;
+}
+export declare class AlertTailer {
+    private eventsPath;
+    private config;
+    private suppressionStore;
+    private sendAlert;
+    private clawAssessEvent;
+    private alertState;
+    private fileOffset;
+    private watcher;
+    private running;
+    private debounceTimer;
+    private pollInterval;
+    constructor(opts: AlertTailerOptions);
+    start(): Promise<void>;
+    stop(): void;
+    private debouncedProcessNew;
+    private processNewLines;
+    private processEvent;
+    /** Update config at runtime (e.g., after reload) */
+    updateConfig(config: SentinelConfig): void;
+}

package/dist/alert-tailer.js

@@ -0,0 +1,174 @@
+/**
+ * AlertTailer — Tails events.jsonl and handles all alerting logic.
+ *
+ * Decouples detection (log stream watchers, osquery) from alerting
+ * (rate limiting, dedup, suppression, Claw assessment, delivery).
+ *
+ * Architecture:
+ *   Watchers → logEvent() → events.jsonl → AlertTailer → assess → deliver
+ */
+import { watch } from "node:fs";
+import { stat } from "node:fs/promises";
+import { createReadStream } from "node:fs";
+import { createInterface } from "node:readline";
+import { shouldAlert, meetsThreshold, createAlertState } from "./alerts.js";
+import { SuppressionStore } from "./suppressions.js";
+import { formatAlert } from "./analyzer.js";
+export class AlertTailer {
+    eventsPath;
+    config;
+    suppressionStore;
+    sendAlert;
+    clawAssessEvent;
+    alertState;
+    fileOffset = 0;
+    watcher = null;
+    running = false;
+    debounceTimer = null;
+    pollInterval = null;
+    constructor(opts) {
+        this.eventsPath = opts.eventsPath;
+        this.config = opts.config;
+        this.suppressionStore = opts.suppressionStore;
+        this.sendAlert = opts.sendAlert;
+        this.clawAssessEvent = opts.clawAssessEvent;
+        this.alertState = createAlertState();
+    }
+    async start() {
+        if (this.running)
+            return;
+        this.running = true;
+        // Start at end of file (only process new events)
+        try {
+            const st = await stat(this.eventsPath);
+            this.fileOffset = st.size;
+            console.log(`[sentinel] AlertTailer started, offset=${this.fileOffset}`);
+        }
+        catch {
+            this.fileOffset = 0;
+            console.log("[sentinel] AlertTailer started, events file not yet created");
+        }
+        // Watch for changes
+        try {
+            this.watcher = watch(this.eventsPath, { persistent: false }, (eventType) => {
+                if (eventType === "change") {
+                    this.debouncedProcessNew();
+                }
+            });
+            this.watcher.on("error", (err) => {
+                console.warn(`[sentinel] AlertTailer watcher error: ${err.message}`);
+            });
+        }
+        catch {
+            // File might not exist yet — poll for it
+            this.pollInterval = setInterval(async () => {
+                try {
+                    await stat(this.eventsPath);
+                    if (this.pollInterval)
+                        clearInterval(this.pollInterval);
+                    this.pollInterval = null;
+                    if (this.running)
+                        this.start();
+                }
+                catch { /* keep waiting */ }
+            }, 5000);
+        }
+    }
+    stop() {
+        this.running = false;
+        if (this.watcher) {
+            this.watcher.close();
+            this.watcher = null;
+        }
+        if (this.debounceTimer) {
+            clearTimeout(this.debounceTimer);
+            this.debounceTimer = null;
+        }
+        if (this.pollInterval) {
+            clearInterval(this.pollInterval);
+            this.pollInterval = null;
+        }
+        console.log("[sentinel] AlertTailer stopped");
+    }
+    debouncedProcessNew() {
+        // Debounce: multiple writes within 100ms get batched
+        if (this.debounceTimer)
+            clearTimeout(this.debounceTimer);
+        this.debounceTimer = setTimeout(() => {
+            this.processNewLines().catch((err) => {
+                console.error(`[sentinel] AlertTailer processing error: ${err.message}`);
+            });
+        }, 100);
+    }
+    async processNewLines() {
+        if (!this.running)
+            return;
+        try {
+            const st = await stat(this.eventsPath);
+            if (st.size <= this.fileOffset)
+                return; // No new data
+            // Read only new bytes
+            const stream = createReadStream(this.eventsPath, {
+                start: this.fileOffset,
+                encoding: "utf8",
+            });
+            const rl = createInterface({ input: stream, crlfDelay: Infinity });
+            const newEvents = [];
+            for await (const line of rl) {
+                if (!line.trim())
+                    continue;
+                try {
+                    const evt = JSON.parse(line);
+                    newEvents.push(evt);
+                }
+                catch {
+                    // Skip malformed lines
+                }
+            }
+            this.fileOffset = st.size;
+            // Process each event through the alert pipeline
+            for (const evt of newEvents) {
+                await this.processEvent(evt);
+            }
+        }
+        catch (err) {
+            console.error(`[sentinel] AlertTailer read error: ${err.message}`);
+        }
+    }
+    async processEvent(evt) {
+        const meets = meetsThreshold(evt.severity, this.config.alertSeverity);
+        if (!meets)
+            return;
+        const should = shouldAlert(evt, this.alertState);
+        if (!should)
+            return;
+        // Check suppression
+        const suppressed = this.suppressionStore?.isSuppressed(evt);
+        if (suppressed) {
+            console.log(`[sentinel] Alert suppressed by rule "${suppressed.reason}" (${SuppressionStore.describe(suppressed)})`);
+            return;
+        }
+        // Claw assessment
+        if (this.config.clawAssess) {
+            console.log(`[sentinel] Claw assessment enabled, calling for: ${evt.title}`);
+            try {
+                const assessment = await this.clawAssessEvent(evt);
+                console.log(`[sentinel] Claw assessment result: ${assessment?.slice(0, 80) ?? "(null)"}`);
+                await this.sendAlert(formatAlert(evt, assessment));
+            }
+            catch (err) {
+                console.warn(`[sentinel] Claw assessment failed: ${err.message ?? err}`);
+                await this.sendAlert(formatAlert(evt)).catch(() => { });
+            }
+        }
+        else {
+            await this.sendAlert(formatAlert(evt)).catch((err) => {
+                console.error(`[sentinel] Alert delivery failed: ${err.message ?? err}`);
+            });
+        }
+    }
+    /** Update config at runtime (e.g., after reload) */
+    updateConfig(config) {
+        this.config = config;
+    }
+}

package/dist/config.d.ts

@@ -19,8 +19,8 @@ export interface SentinelConfig {
     trustedPaths?: string[];
     trustedCommandPatterns?: string[];
     watchPaths?: string[];
-    /** Add a one-line LLM assessment to alerts before sending (requires openclaw CLI) */
-    llmAlertAssessment?: boolean;
+    /** Add a one-line Claw assessment to alerts before sending (requires openclaw CLI) */
+    clawAssess?: boolean;
 }
 export declare const DEFAULT_CONFIG: Required<Pick<SentinelConfig, "pollIntervalMs" | "enableProcessMonitor" | "enableFileIntegrity" | "enableNetworkMonitor" | "trustedSigningIds" | "trustedPaths" | "watchPaths">>;
 /** A security event detected by Sentinel */

package/dist/index.d.ts

@@ -5,10 +5,11 @@
  * Uses event-driven log tailing for sub-second alerting.
  *
  * Architecture:
- *   osqueryd (daemon, managed externally via launchd) → writes results to JSON log
- *   Sentinel watcher  → tails log file via fs.watch + poll fallback
- *   Analyzer          → evaluates results against detection rules
- *   OpenClaw messaging → alerts on configured channel
+ *   Watchers (log stream + osquery) → events.jsonl → AlertTailer → assess → deliver
+ *
+ *   Detection is decoupled from alerting — watchers only parse and persist,
+ *   while AlertTailer handles rate limiting, dedup, suppression, Claw assessment,
+ *   and delivery by tailing events.jsonl.
  *
  * Note: osqueryd requires root/sudo — it must be started separately
  * (e.g., via launchd). This plugin only watches the result logs.

package/dist/index.js

@@ -5,10 +5,11 @@
  * Uses event-driven log tailing for sub-second alerting.
  *
  * Architecture:
- *   osqueryd (daemon, managed externally via launchd) → writes results to JSON log
- *   Sentinel watcher  → tails log file via fs.watch + poll fallback
- *   Analyzer          → evaluates results against detection rules
- *   OpenClaw messaging → alerts on configured channel
+ *   Watchers (log stream + osquery) → events.jsonl → AlertTailer → assess → deliver
+ *
+ *   Detection is decoupled from alerting — watchers only parse and persist,
+ *   while AlertTailer handles rate limiting, dedup, suppression, Claw assessment,
+ *   and delivery by tailing events.jsonl.
  *
  * Note: osqueryd requires root/sudo — it must be started separately
  * (e.g., via launchd). This plugin only watches the result logs.
@@ -19,7 +20,8 @@ import { join } from "node:path";
 import { homedir } from "node:os";
 import { Type } from "@sinclair/typebox";
 import { findOsquery, query } from "./osquery.js";
-import { shouldAlert, meetsThreshold, createAlertState } from "./alerts.js";
+import { createAlertState } from "./alerts.js";
+import { AlertTailer } from "./alert-tailer.js";
 import { EventStore } from "./persistence.js";
 import { ResultLogWatcher } from "./watcher.js";
 import { LogStreamWatcher } from "./log-stream.js";
@@ -27,6 +29,12 @@ import { SuppressionStore } from "./suppressions.js";
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 const execFileAsync = promisify(execFile);
+// Use globalThis so state survives module re-evaluation on SIGUSR1 restarts.
+const G = globalThis;
+const SENTINEL_NS = "__sentinel__";
+if (!G[SENTINEL_NS])
+    G[SENTINEL_NS] = { cleanup: null, initialized: false };
+const _g = G[SENTINEL_NS];
 import { analyzeProcessEvents, analyzeLoginEvents, analyzeFailedAuth, analyzeListeningPorts, analyzeFileEvents, formatAlert, } from "./analyzer.js";
 // ── State ──
 const state = {
@@ -98,7 +106,7 @@ async function checkDaemon(sentinelDir) {
  * assessment of a security event. Returns the assessment string, or null
  * on failure.
  */
-async function llmAssessEvent(evt) {
+async function clawAssessEvent(evt) {
     const details = typeof evt.details === "string" ? evt.details : JSON.stringify(evt.details);
     const prompt = `You are a security-savvy AI agent named Claw monitoring your human's machine. A security event was detected:
 
@@ -108,7 +116,7 @@ Category: ${evt.category}
 Description: ${evt.description}
 Details: ${details}
 
-Context: This machine runs OpenClaw (an AI assistant platform) which frequently spawns commands via heartbeats, cron jobs, and agent tasks — python one-liners, curl/wget API calls, bq queries, git, npm/node, etc. The user is "sunil".
+Context: This machine runs OpenClaw (an AI assistant platform) which frequently spawns commands via heartbeats, cron jobs, and agent tasks — python one-liners, curl/wget API calls, bq queries, git, npm/node, etc. The user is the machine owner.
 
 Reply with ONLY a single short sentence (under 30 words) giving your honest take on whether this is a real problem or likely benign. Be direct, opinionated, and useful — like a senior engineer glancing at an alert. No preamble.`;
     try {
@@ -134,7 +142,7 @@ Reply with ONLY a single short sentence (under 30 words) giving your honest take
         }
     }
     catch (err) {
-        console.warn(`[sentinel] LLM assessment failed: ${err?.message ?? err}`);
+        console.warn(`[sentinel] Claw assessment failed: ${err?.message ?? err}`);
         return null;
     }
 }
@@ -166,31 +174,7 @@ function handleResult(result, config, sendAlert) {
     }
     for (const evt of events) {
         logEvent(evt);
-        if (meetsThreshold(evt.severity, config.alertSeverity) && shouldAlert(evt, alertRateState)) {
-            const suppressed = suppressionStore?.isSuppressed(evt);
-            if (suppressed) {
-                console.log(`[sentinel] Alert suppressed by rule "${suppressed.reason}" (${SuppressionStore.describe(suppressed)})`);
-            }
-            else if (config.llmAlertAssessment) {
-                // Get LLM assessment and include it in the alert
-                console.log(`[sentinel] LLM assessment enabled, calling for: ${evt.title}`);
-                llmAssessEvent(evt).then((assessment) => {
-                    console.log(`[sentinel] LLM assessment result: ${assessment?.slice(0, 80) ?? "(null)"}`);
-                    sendAlert(formatAlert(evt, assessment)).catch((err) => {
-                        console.error("[sentinel] alert failed:", err);
-                    });
-                }).catch((err) => {
-                    console.warn(`[sentinel] LLM assessment promise rejected: ${err}`);
-                    sendAlert(formatAlert(evt)).catch(() => { });
-                });
-            }
-            else {
-                console.log(`[sentinel] LLM assessment NOT enabled (llmAlertAssessment=${config.llmAlertAssessment})`);
-                sendAlert(formatAlert(evt)).catch((err) => {
-                    console.error("[sentinel] alert failed:", err);
-                });
-            }
-        }
+        // AlertTailer handles alerting by tailing events.jsonl
     }
     if (events.length > 0) {
         console.log(`[sentinel] ${events.length} events from ${result.name}`);
@@ -210,9 +194,10 @@ export default function sentinel(api) {
     }
     catch { /* ignore */ }
     const pluginConfig = { ...fileConfig, ...apiConfig };
-    console.log(`[sentinel] Config v0.3.2: alertSeverity=${pluginConfig.alertSeverity}, alertChannel=${pluginConfig.alertChannel}, llmAssess=${pluginConfig.llmAlertAssessment}, trustedPatterns=${(pluginConfig.trustedCommandPatterns ?? []).length}`);
+    console.log(`[sentinel] Config v2026.2.26-1: alertSeverity=${pluginConfig.alertSeverity}, alertChannel=${pluginConfig.alertChannel}, clawAssess=${pluginConfig.clawAssess}, trustedPatterns=${(pluginConfig.trustedCommandPatterns ?? []).length}`);
     let watcher = null;
     let logStreamWatcher = null;
+    let alertTailer = null;
     const sentinelDir = pluginConfig.logPath ?? SENTINEL_DIR_DEFAULT;
     const sendAlert = async (text) => {
         const channel = pluginConfig.alertChannel;
@@ -373,7 +358,7 @@ export default function sentinel(api) {
         name: "sentinel_suppress",
         description: "Manage alert suppression rules. Actions: 'add' (create a suppression), 'list' (show all), 'remove' (delete by id), 'cleanup' (remove expired). " +
             "Scopes: 'title' (suppress all alerts with this title), 'category' (suppress entire category like ssh_login/privilege/auth), " +
-            "'field' (suppress when a specific detail field matches, e.g. field=user fieldValue=sunil), 'exact' (suppress only this exact title+description). " +
+            "'field' (suppress when a specific detail field matches, e.g. field=user fieldValue=alice), 'exact' (suppress only this exact title+description). " +
             "Always explain to the user what will be suppressed before adding a rule.",
         parameters: Type.Object({
             action: Type.Union([
@@ -482,8 +467,19 @@ export default function sentinel(api) {
             }
         },
     });
+    // ── Clean up previous instance if re-initializing (SIGUSR1 restart) ──
+    if (typeof _g.cleanup === "function") {
+        console.log("[sentinel] Cleaning up previous instance before re-init");
+        _g.cleanup();
+        _g.cleanup = null;
+        _g.initialized = false;
+    }
     // ── Cleanup on process exit ──
     const cleanup = () => {
+        if (alertTailer) {
+            alertTailer.stop();
+            alertTailer = null;
+        }
         if (watcher) {
             watcher.stop();
             watcher = null;
@@ -494,14 +490,16 @@ export default function sentinel(api) {
             logStreamWatcher = null;
         }
     };
+    _g.cleanup = cleanup;
     process.on("exit", cleanup);
     process.on("SIGTERM", cleanup);
     process.on("SIGINT", cleanup);
     // ── Start monitoring immediately (fire-and-forget) ──
-    if (state.watching) {
+    if (_g.initialized) {
         console.log("[sentinel] Already initialized, skipping double-init");
         return;
     }
+    _g.initialized = true;
     (async () => {
         try {
             const osqueryiPath = findOsquery(pluginConfig.osqueryPath);
@@ -559,30 +557,20 @@ export default function sentinel(api) {
             // Start real-time log stream watcher for SSH events
             logStreamWatcher = new LogStreamWatcher((evt) => {
                 logEvent(evt);
-                if (meetsThreshold(evt.severity, pluginConfig.alertSeverity) &&
-                    shouldAlert(evt, alertRateState)) {
-                    const suppressed = suppressionStore?.isSuppressed(evt);
-                    if (suppressed) {
-                        console.log(`[sentinel] Alert suppressed by rule "${suppressed.reason}" (${SuppressionStore.describe(suppressed)})`);
-                    }
-                    else if (pluginConfig.llmAlertAssessment) {
-                        llmAssessEvent(evt).then((assessment) => {
-                            sendAlert(formatAlert(evt, assessment)).catch((err) => {
-                                console.error("[sentinel] alert failed:", err);
-                            });
-                        }).catch(() => {
-                            sendAlert(formatAlert(evt)).catch(() => { });
-                        });
-                    }
-                    else {
-                        sendAlert(formatAlert(evt)).catch((err) => {
-                            console.error("[sentinel] alert failed:", err);
-                        });
-                    }
-                }
+                // AlertTailer handles alerting by tailing events.jsonl
                 console.log(`[sentinel] [real-time] ${evt.severity}/${evt.category}: ${evt.title}`);
             }, state.knownHosts);
             logStreamWatcher.start();
+            // Start AlertTailer — single pipeline for all alerting
+            const eventsPath = join(sentinelDir, "events.jsonl");
+            alertTailer = new AlertTailer({
+                eventsPath,
+                config: pluginConfig,
+                suppressionStore,
+                sendAlert,
+                clawAssessEvent,
+            });
+            await alertTailer.start();
         }
         catch (err) {
             console.error("[sentinel] Failed to start:", err);

package/dist/log-stream.js

@@ -21,8 +21,8 @@ function event(severity, category, title, description, details) {
 /**
  * Parse a macOS `log stream` line for SSH events.
  * Lines look like:
- *   2026-02-22 16:30:00.123456-0500  0x1234  Default  0x0  0  sshd: Accepted publickey for sunil from 100.79.207.74 port 52341 ssh2
- *   2026-02-22 16:30:00.123456-0500  0x1234  Default  0x0  0  sshd: Failed password for sunil from 203.0.113.42 port 22 ssh2
+ *   2026-02-22 16:30:00.123456-0500  0x1234  Default  0x0  0  sshd: Accepted publickey for alice from 100.79.207.74 port 52341 ssh2
+ *   2026-02-22 16:30:00.123456-0500  0x1234  Default  0x0  0  sshd: Failed password for alice from 203.0.113.42 port 22 ssh2
  *   2026-02-22 16:30:00.123456-0500  0x1234  Default  0x0  0  sshd: Invalid user admin from 203.0.113.42 port 22
  */
 function parseMacOSLogLine(line, knownHosts) {
@@ -51,7 +51,7 @@ function parseMacOSLogLine(line, knownHosts) {
 /**
  * Parse a Linux journalctl line for SSH events.
  * Lines look like:
- *   Feb 22 16:30:00 hostname sshd[1234]: Accepted publickey for sunil from 100.79.207.74 port 52341 ssh2
+ *   Feb 22 16:30:00 hostname sshd[1234]: Accepted publickey for alice from 100.79.207.74 port 52341 ssh2
  */
 function parseLinuxLogLine(line, knownHosts) {
     // Same patterns work for both — sshd output is consistent
@@ -60,9 +60,9 @@ function parseLinuxLogLine(line, knownHosts) {
 /**
  * Parse Linux sudo events from journalctl / auth.log.
  * Lines look like:
- *   Feb 22 16:30:00 hostname sudo[1234]:   sunil : TTY=pts/0 ; PWD=/home/sunil ; USER=root ; COMMAND=/usr/bin/apt update
- *   Feb 22 16:30:00 hostname sudo[1234]: pam_unix(sudo:session): session opened for user root(uid=0) by sunil(uid=1000)
- *   Feb 22 16:30:00 hostname sudo[1234]:   sunil : 3 incorrect password attempts ; TTY=pts/0 ; PWD=/home/sunil ; USER=root ; COMMAND=/usr/bin/rm -rf /
+ *   Feb 22 16:30:00 hostname sudo[1234]:   alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/apt update
+ *   Feb 22 16:30:00 hostname sudo[1234]: pam_unix(sudo:session): session opened for user root(uid=0) by alice(uid=1000)
+ *   Feb 22 16:30:00 hostname sudo[1234]:   alice : 3 incorrect password attempts ; TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/usr/bin/rm -rf /
  */
 function parseLinuxSudo(line) {
     // Standard sudo command log
@@ -85,8 +85,8 @@ function parseLinuxSudo(line) {
  * Lines from useradd/userdel/usermod/passwd via journalctl or auth.log:
  *   Feb 22 16:30:00 hostname useradd[1234]: new user: name=backdoor, UID=1001, GID=1001, home=/home/backdoor, shell=/bin/bash
  *   Feb 22 16:30:00 hostname userdel[1234]: delete user 'olduser'
- *   Feb 22 16:30:00 hostname usermod[1234]: change user 'sunil' password
- *   Feb 22 16:30:00 hostname passwd[1234]: pam_unix(passwd:chauthtok): password changed for sunil
+ *   Feb 22 16:30:00 hostname usermod[1234]: change user 'alice' password
+ *   Feb 22 16:30:00 hostname passwd[1234]: pam_unix(passwd:chauthtok): password changed for alice
  *   Feb 22 16:30:00 hostname groupadd[1234]: new group: name=newgroup, GID=1002
  */
 function parseLinuxUserAccount(line) {
@@ -121,7 +121,7 @@ function parseLinuxUserAccount(line) {
  * Parse Linux remote desktop / VNC events.
  * Lines from xrdp, vncserver, x11vnc:
  *   Feb 22 16:30:00 hostname xrdp[1234]: connected client: 203.0.113.42
- *   Feb 22 16:30:00 hostname xrdp-sesman[1234]: session started for user sunil
+ *   Feb 22 16:30:00 hostname xrdp-sesman[1234]: session started for user alice
  *   Feb 22 16:30:00 hostname x11vnc[1234]: Got connection from client 203.0.113.42
  */
 function parseLinuxRemoteDesktop(line) {
@@ -145,10 +145,10 @@ function parseLinuxRemoteDesktop(line) {
 /**
  * Parse macOS /var/log/system.log lines for SSH events.
  * Lines look like:
- *   Feb 22 16:39:32 sunils-mac-mini sshd-session: sunil [priv][58912]: USER_PROCESS: 58916 ttys001
- *   Feb 22 16:38:12 sunils-mac-mini sshd-session: sunil [priv][53930]: DEAD_PROCESS: 53934 ttys012
- *   Feb 22 16:51:16 sunils-mac-mini sshd[60738]: Failed password for sunil from 100.79.207.74 port 52341 ssh2
- *   Feb 22 16:51:16 sunils-mac-mini sshd[60738]: Invalid user admin from 100.79.207.74 port 52341
+ *   Feb 22 16:39:32 my-hostname sshd-session: alice [priv][58912]: USER_PROCESS: 58916 ttys001
+ *   Feb 22 16:38:12 my-hostname sshd-session: alice [priv][53930]: DEAD_PROCESS: 53934 ttys012
+ *   Feb 22 16:51:16 my-hostname sshd[60738]: Failed password for alice from 100.79.207.74 port 52341 ssh2
+ *   Feb 22 16:51:16 my-hostname sshd[60738]: Invalid user admin from 100.79.207.74 port 52341
  */
 function parseMacOSSyslog(line, knownHosts) {
     // Match sshd-session USER_PROCESS (successful login)
@@ -186,7 +186,7 @@ function parseMacOSSyslog(line, knownHosts) {
 /**
  * Parse macOS unified log lines for PAM authentication errors.
  * Line format:
- *   2026-02-22 16:56:51.705020-0500  0x14e5ecb  Default  0x0  62761  0  sshd-session: error: PAM: authentication error for sunil from 100.79.207.74
+ *   2026-02-22 16:56:51.705020-0500  0x14e5ecb  Default  0x0  62761  0  sshd-session: error: PAM: authentication error for alice from 100.79.207.74
  */
 function parseMacOSAuthError(line, _knownHosts) {
     // PAM authentication error (valid user, wrong password)

package/dist/suppressions.d.ts

@@ -5,7 +5,7 @@
  * - "exact": matches title + description exactly
  * - "title": matches events with the same title
  * - "category": matches all events in a category (e.g., all ssh_login)
- * - "field": matches a specific field value (e.g., details.user === "sunil")
+ * - "field": matches a specific field value (e.g., details.user === "alice")
  */
 import type { SecurityEvent } from "./config.js";
 export interface SuppressionRule {

package/dist/suppressions.js

@@ -5,7 +5,7 @@
  * - "exact": matches title + description exactly
  * - "title": matches events with the same title
  * - "category": matches all events in a category (e.g., all ssh_login)
- * - "field": matches a specific field value (e.g., details.user === "sunil")
+ * - "field": matches a specific field value (e.g., details.user === "alice")
  */
 import { readFile, writeFile, mkdir } from "node:fs/promises";
 import { existsSync } from "node:fs";

package/openclaw.plugin.json

@@ -1,9 +1,11 @@
 {
   "id": "sentinel",
   "name": "Sentinel",
-  "description": "Real-time endpoint security monitoring for macOS and Linux — process execution, SSH connections, privilege escalation, and file integrity alerts via OpenClaw.",
-  "version": "0.3.2",
-  "skills": ["skills/sentinel"],
+  "description": "Real-time endpoint security monitoring for macOS and Linux \u2014 process execution, SSH connections, privilege escalation, and file integrity alerts via OpenClaw.",
+  "version": "2026.3.5",
+  "skills": [
+    "skills/sentinel"
+  ],
   "configSchema": {
     "type": "object",
     "additionalProperties": false,
@@ -26,7 +28,13 @@
       },
       "alertSeverity": {
         "type": "string",
-        "enum": ["critical", "high", "medium", "low", "info"],
+        "enum": [
+          "critical",
+          "high",
+          "medium",
+          "low",
+          "info"
+        ],
         "description": "Minimum severity level to trigger alerts (default: high)"
       },
       "logPath": {
@@ -53,27 +61,35 @@
       },
       "trustedSigningIds": {
         "type": "array",
-        "items": { "type": "string" },
+        "items": {
+          "type": "string"
+        },
         "description": "Signing IDs to trust (skip alerts for these)"
       },
       "trustedPaths": {
         "type": "array",
-        "items": { "type": "string" },
+        "items": {
+          "type": "string"
+        },
         "description": "Process paths to trust (skip alerts for these)"
       },
       "trustedCommandPatterns": {
         "type": "array",
-        "items": { "type": "string" },
+        "items": {
+          "type": "string"
+        },
         "description": "Regex patterns for commands to skip (e.g. OpenClaw heartbeat scripts)"
       },
       "watchPaths": {
         "type": "array",
-        "items": { "type": "string" },
+        "items": {
+          "type": "string"
+        },
         "description": "File paths to monitor for integrity changes"
       },
-      "llmAlertAssessment": {
+      "clawAssess": {
         "type": "boolean",
-        "description": "Use LLM to assess suspicious commands before alerting (reduces false positives from automation)"
+        "description": "Use Claw to assess suspicious commands before alerting (reduces false positives from automation)"
       }
     }
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openclaw-sentinel",
-  "version": "0.3.2",
+  "version": "2026.3.5",
   "description": "Real-time endpoint security monitoring plugin for OpenClaw",
   "type": "module",
   "main": "dist/index.js",