podwatch 1.0.2

package/dist/scanner.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * Skill/plugin scanner — scans installed skills and plugins.
+ *
+ * Scans:
+ * - ~/.openclaw/skills/ (managed skills)
+ * - <workspace>/skills/ (workspace skills)
+ * - ~/.openclaw/extensions/ (installed plugins)
+ *
+ * Reports: name, version, source, permissions, risk indicators.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanSkillsAndPlugins = scanSkillsAndPlugins;
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const node_os_1 = require("node:os");
+// ---------------------------------------------------------------------------
+// Scanner
+// ---------------------------------------------------------------------------
+async function scanSkillsAndPlugins(workspaceDir) {
+    const home = (0, node_os_1.homedir)();
+    const skills = [];
+    const plugins = [];
+    // Scan managed skills
+    await scanDirectory((0, node_path_1.resolve)(home, ".openclaw", "skills"), "skill", "managed", skills);
+    // Scan workspace skills
+    if (workspaceDir) {
+        await scanDirectory((0, node_path_1.resolve)(workspaceDir, "skills"), "skill", "workspace", skills);
+    }
+    // Scan installed plugins/extensions
+    await scanDirectory((0, node_path_1.resolve)(home, ".openclaw", "extensions"), "plugin", "installed", plugins);
+    return {
+        skills,
+        plugins,
+        scannedAt: Date.now(),
+    };
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+async function scanDirectory(dir, type, source, results) {
+    try {
+        const entries = await (0, promises_1.readdir)(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (!entry.isDirectory())
+                continue;
+            const itemDir = (0, node_path_1.join)(dir, entry.name);
+            const item = {
+                name: entry.name,
+                type,
+                source,
+            };
+            // Try to read metadata
+            if (type === "skill") {
+                await readSkillMeta(itemDir, item);
+            }
+            else {
+                await readPluginMeta(itemDir, item);
+            }
+            results.push(item);
+        }
+    }
+    catch {
+        // Directory doesn't exist — that's fine
+    }
+}
+async function readSkillMeta(dir, item) {
+    try {
+        const skillMd = await (0, promises_1.readFile)((0, node_path_1.join)(dir, "SKILL.md"), "utf-8");
+        // Parse YAML frontmatter
+        const match = skillMd.match(/^---\n([\s\S]*?)\n---/);
+        if (match) {
+            const frontmatter = match[1];
+            const nameMatch = frontmatter.match(/^name:\s*(.+)$/m);
+            const descMatch = frontmatter.match(/^description:\s*"?(.+?)"?$/m);
+            const versionMatch = frontmatter.match(/^version:\s*(.+)$/m);
+            if (nameMatch)
+                item.name = nameMatch[1].trim();
+            if (descMatch)
+                item.description = descMatch[1].trim();
+            if (versionMatch)
+                item.version = versionMatch[1].trim();
+        }
+    }
+    catch {
+        // No SKILL.md — skip metadata
+    }
+}
+async function readPluginMeta(dir, item) {
+    try {
+        const manifest = await (0, promises_1.readFile)((0, node_path_1.join)(dir, "openclaw.plugin.json"), "utf-8");
+        const parsed = JSON.parse(manifest);
+        if (parsed.name)
+            item.name = parsed.name;
+        if (parsed.version)
+            item.version = parsed.version;
+        if (parsed.description)
+            item.description = parsed.description;
+    }
+    catch {
+        // Try package.json fallback
+        try {
+            const pkg = await (0, promises_1.readFile)((0, node_path_1.join)(dir, "package.json"), "utf-8");
+            const parsed = JSON.parse(pkg);
+            if (parsed.name)
+                item.name = parsed.name;
+            if (parsed.version)
+                item.version = parsed.version;
+            if (parsed.description)
+                item.description = parsed.description;
+        }
+        catch {
+            // No metadata available
+        }
+    }
+}
+//# sourceMappingURL=scanner.js.map

package/dist/scanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AA8BH,oDAoCC;AAhED,+CAA2D;AAC3D,yCAAoD;AACpD,qCAAkC;AAsBlC,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAEvE,KAAK,UAAU,oBAAoB,CAAC,YAAqB;IAC9D,MAAM,IAAI,GAAG,IAAA,iBAAO,GAAE,CAAC;IACvB,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,sBAAsB;IACtB,MAAM,aAAa,CACjB,IAAA,mBAAO,EAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,EACpC,OAAO,EACP,SAAS,EACT,MAAM,CACP,CAAC;IAEF,wBAAwB;IACxB,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,aAAa,CACjB,IAAA,mBAAO,EAAC,YAAY,EAAE,QAAQ,CAAC,EAC/B,OAAO,EACP,WAAW,EACX,MAAM,CACP,CAAC;IACJ,CAAC;IAED,oCAAoC;IACpC,MAAM,aAAa,CACjB,IAAA,mBAAO,EAAC,IAAI,EAAE,WAAW,EAAE,YAAY,CAAC,EACxC,QAAQ,EACR,WAAW,EACX,OAAO,CACR,CAAC;IAEF,OAAO;QACL,MAAM;QACN,OAAO;QACP,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,IAAwB,EACxB,MAAc,EACd,OAAsB;IAEtB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAO,EAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;gBAAE,SAAS;YAEnC,MAAM,OAAO,GAAG,IAAA,gBAAI,EAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,IAAI,GAAgB;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI;gBACJ,MAAM;aACP,CAAC;YAEF,uBAAuB;YACvB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACrB,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACN,MAAM,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;YAED,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,IAAiB;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;QAE/D,yBAAyB;QACzB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACrD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;YACvD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACnE,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;YAE7D,IAAI,SAAS;gBAAE,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/C,IAAI,SAAS;gBAAE,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtD,IAAI,YAAY;gBAAE,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,IAAiB;IAC1D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,sBAAsB,CAAC,EAAE,OAAO,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAIjC,CAAC;QAEF,IAAI,MAAM,CAAC,IAAI;YAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzC,IAAI,MAAM,CAAC,OAAO;YAAE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClD,IAAI,MAAM,CAAC,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAA,mBAAQ,EAAC,IAAA,gBAAI,EAAC,GAAG,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAI5B,CAAC;YAEF,IAAI,MAAM,CAAC,IAAI;gBAAE,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;YACzC,IAAI,MAAM,CAAC,OAAO;gBAAE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;YAClD,IAAI,MAAM,CAAC,WAAW;gBAAE,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/transmitter.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Batched HTTP transmitter — queues events and flushes to Podwatch cloud.
+ *
+ * Features:
+ * - Configurable batch size and flush interval
+ * - Exponential backoff on failure
+ * - Buffer overflow protection (drops SAFE events first)
+ * - Graceful shutdown (flush on gateway_stop)
+ * - Credential access tracking (for exfiltration detection)
+ * - Known tool tracking (for first-time tool alerts)
+ * - Cached budget state (synced every 60s from dashboard)
+ * - Local audit log for dropped events
+ * - 402 trial-expired handling
+ */
+import type { TransmitterConfig, PodwatchEvent } from "./types.js";
+interface CredentialAccess {
+    toolName: string;
+    path: string;
+    ts: number;
+}
+interface CachedBudget {
+    limit: number;
+    currentSpend: number;
+    lastSyncTs: number;
+}
+export declare const transmitter: {
+    start(cfg: TransmitterConfig): void;
+    enqueue(event: PodwatchEvent): void;
+    flush(): Promise<void>;
+    stop(): void;
+    /** Flush remaining events and stop. For graceful shutdown. */
+    shutdown(): Promise<void>;
+    /** Mark that a tool accessed credentials. */
+    markCredentialAccess(toolName: string, params: Record<string, unknown>): void;
+    /** Check if there was a credential access within the last `windowSec` seconds. */
+    hasRecentCredentialAccess(windowSec: number): boolean;
+    /** Get the most recent credential access details (for exfiltration alerts). */
+    getRecentCredentialAccess(windowSec: number): CredentialAccess | null;
+    _pruneCredentialAccesses(): void;
+    /** Check if a tool has been seen before. */
+    isKnownTool(toolName: string): boolean;
+    /** Record a tool as seen. Clears the set when it exceeds KNOWN_TOOLS_MAX_SIZE. */
+    recordToolSeen(toolName: string): void;
+    /** Get agent uptime in hours since plugin activated. */
+    getAgentUptimeHours(): number;
+    /** Get cached budget state (synced from dashboard every 60s). */
+    getCachedBudget(): CachedBudget | null;
+    /** Force a budget sync now. */
+    forceBudgetSync(): Promise<void>;
+    /** Current buffer size (for testing/diagnostics). */
+    readonly bufferedCount: number;
+    /** Number of known tools (for testing/diagnostics). */
+    readonly knownToolCount: number;
+    /** Whether trial has expired (for testing). */
+    readonly isTrialExpired: boolean;
+};
+export {};
+//# sourceMappingURL=transmitter.d.ts.map

package/dist/transmitter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transmitter.d.ts","sourceRoot":"","sources":["../src/transmitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AA6BnE,UAAU,gBAAgB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;CACZ;AAWD,UAAU,YAAY;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACpB;AA8ZD,eAAO,MAAM,WAAW;eACX,iBAAiB,GAAG,IAAI;mBA4BpB,aAAa,GAAG,IAAI;aA6CpB,OAAO,CAAC,IAAI,CAAC;YAIpB,IAAI;IAWZ,8DAA8D;gBAC5C,OAAO,CAAC,IAAI,CAAC;IAW/B,6CAA6C;mCACd,MAAM,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAiB7E,kFAAkF;yCAC7C,MAAM,GAAG,OAAO;IAMrD,+EAA+E;yCAC1C,MAAM,GAAG,gBAAgB,GAAG,IAAI;gCAOzC,IAAI;IAWhC,4CAA4C;0BACtB,MAAM,GAAG,OAAO;IAItC,kFAAkF;6BACzD,MAAM,GAAG,IAAI;IAWtC,wDAAwD;2BACjC,MAAM;IAS7B,iEAAiE;uBAC9C,YAAY,GAAG,IAAI;IAItC,+BAA+B;uBACN,OAAO,CAAC,IAAI,CAAC;IAQtC,qDAAqD;4BAChC,MAAM;IAI3B,uDAAuD;6BACjC,MAAM;IAI5B,+CAA+C;6BACzB,OAAO;CAG9B,CAAC"}