shellward 0.5.2 → 0.5.4

package/README.md

@@ -50,7 +50,7 @@ Your AI agent has full access to tools — shell, email, HTTP, file system. One
 
 | Platform | Integration | Note |
 |----------|------------|------|
-| **OpenClaw** | Plugin | `openclaw plugins install shellward` — out of the box |
+| **OpenClaw** | Plugin + SDK | `openclaw plugins install shellward` — adapts to available hooks |
 | **Claude Code** | SDK | Anthropic's official CLI agent |
 | **Cursor** | SDK | AI-powered coding IDE |
 | **LangChain** | SDK | LLM application framework |

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "shellward",
   "name": "ShellWard",
   "description": "AI Agent Security Middleware — injection detection, dangerous operation blocking, PII audit (incl. Chinese ID card, phone, bank card), data exfiltration prevention. SDK + OpenClaw plugin.",
-  "version": "0.5.0",
+  "version": "0.5.3",
   "skills": ["./skills"],
   "configSchema": {
     "type": "object",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shellward",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "AI Agent Security Middleware — 8-layer defense against prompt injection, data exfiltration & dangerous commands. DLP model: use data freely, block external leaks. Zero dependencies. SDK + OpenClaw plugin. Supports LangChain, AutoGPT, Claude Code, Cursor, OpenAI Agents.",
   "keywords": [
     "shellward",

package/src/index.ts

@@ -20,7 +20,7 @@ import { registerAllCommands } from './commands/index'
 import { checkForUpdate } from './update-check'
 import { runAutoCheckOnStartup } from './auto-check'
 
-const CURRENT_VERSION = '0.5.0'
+const CURRENT_VERSION = '0.5.3'
 
 // Re-export core engine for SDK usage
 export { ShellWard } from './core/engine'
@@ -32,11 +32,14 @@ export type { ShellWardConfig } from './types'
  * If a security hook throws, we log the error and fail-safe:
  * - before_tool_call: block (deny on error, safer than allow)
  * - other hooks: return undefined (don't break the chain)
+ *
+ * Returns boolean indicating whether hook registration succeeded.
+ * This allows layers to detect missing hooks and register fallbacks.
  */
 function createSafeApi(api: any, guard: ShellWard): any {
   return {
     ...api,
-    on(hookName: string, handler: Function, opts?: any) {
+    on(hookName: string, handler: Function, opts?: any): boolean {
       const isBlockHook = hookName === 'before_tool_call'
       const wrappedHandler = (event: any) => {
         try {
@@ -56,7 +59,12 @@ function createSafeApi(api: any, guard: ShellWard): any {
           return undefined
         }
       }
-      api.on(hookName, wrappedHandler, opts)
+      try {
+        api.on(hookName, wrappedHandler, opts)
+        return true
+      } catch {
+        return false
+      }
     },
   }
 }

package/src/layers/data-flow-guard.ts

@@ -1,9 +1,10 @@
 // src/layers/data-flow-guard.ts — L7 OpenClaw Adapter
-// Thin adapter: wires OpenClaw's after_tool_call + before_tool_call hooks to ShellWard core engine
+// Thin adapter: wires OpenClaw hooks to ShellWard core engine for data flow tracking
 
 import type { ShellWard } from '../core/engine'
 
 export function setupDataFlowGuard(api: any, guard: ShellWard, enforce: boolean) {
+  // Track file reads via after_tool_call
   api.on('after_tool_call', (event: any) => {
     const toolName = String(event.toolName || '').toLowerCase()
     const params = (event.params && typeof event.params === 'object') ? event.params : {}
@@ -14,6 +15,7 @@ export function setupDataFlowGuard(api: any, guard: ShellWard, enforce: boolean)
     }
   }, { name: 'shellward.data-flow-read-tracker', priority: 50 })
 
+  // Block outbound sends when sensitive data was recently accessed
   api.on('before_tool_call', (event: any) => {
     const toolName = String(event.toolName || '')
     const params = (event.params && typeof event.params === 'object') ? event.params : {}

package/src/layers/input-auditor.ts

@@ -1,9 +1,11 @@
 // src/layers/input-auditor.ts — L4 OpenClaw Adapter
-// Thin adapter: wires OpenClaw's before_tool_call + message_received hooks to ShellWard core engine
+// Thin adapter: wires OpenClaw hooks to ShellWard core engine for injection detection
+// Compat: registers all known hook name variants — OpenClaw silently ignores unknown ones
 
 import type { ShellWard } from '../core/engine'
 
 export function setupInputAuditor(api: any, guard: ShellWard, enforce: boolean) {
+  // Tool call parameter scanning via before_tool_call
   api.on('before_tool_call', (event: any) => {
     const args: Record<string, any> = (event.params && typeof event.params === 'object') ? event.params : {}
     const texts = guard.extractTextFields(args)
@@ -22,11 +24,16 @@ export function setupInputAuditor(api: any, guard: ShellWard, enforce: boolean)
     }
   }, { name: 'shellward.input-auditor', priority: 300 })
 
-  api.on('message_received', (event: any) => {
+  // Message scanning: register ALL known naming conventions
+  // OpenClaw silently ignores unknown hooks (no error thrown), so register all variants
+  const messageHandler = (event: any) => {
     const content = typeof event.content === 'string' ? event.content : ''
     if (!content) return
     guard.checkInjection(content, { source: 'message' })
-  }, { name: 'shellward.message-auditor', priority: 100 })
+  }
+
+  api.on('message_received', messageHandler, { name: 'shellward.message-auditor', priority: 100 })
+  api.on('message:received', messageHandler, { name: 'shellward.message-auditor-v2', priority: 100 })
 
   api.logger.info(`[ShellWard] L4 Input Auditor enabled`)
 }

package/src/layers/outbound-guard.ts

@@ -1,10 +1,11 @@
 // src/layers/outbound-guard.ts — L6 OpenClaw Adapter
-// Thin adapter: wires OpenClaw's message_sending hook to ShellWard core engine
+// Thin adapter: wires OpenClaw hooks to ShellWard core engine for outbound response scanning
+// Compat: registers all known hook name variants
 
 import type { ShellWard } from '../core/engine'
 
 export function setupOutboundGuard(api: any, guard: ShellWard, enforce: boolean) {
-  api.on('message_sending', (event: any) => {
+  const handler = (event: any) => {
     const content = event.content
     if (!content || typeof content !== 'string') return undefined
 
@@ -18,7 +19,11 @@ export function setupOutboundGuard(api: any, guard: ShellWard, enforce: boolean)
     }
 
     return undefined
-  }, { name: 'shellward.outbound-guard', priority: 100 })
+  }
+
+  // Register ALL known naming conventions — OpenClaw silently ignores unknown ones
+  api.on('message_sending', handler, { name: 'shellward.outbound-guard', priority: 100 })
+  api.on('message:sent', handler, { name: 'shellward.outbound-guard-v2', priority: 100 })
 
   api.logger.info('[ShellWard] L6 Outbound Guard enabled')
 }

package/src/layers/session-guard.ts

@@ -1,10 +1,11 @@
 // src/layers/session-guard.ts — L8 OpenClaw Adapter
-// Thin adapter: wires OpenClaw's session_end + subagent_spawning hooks to ShellWard core engine
+// Thin adapter: wires OpenClaw hooks to ShellWard core engine for session monitoring
+// Compat: registers all known hook name variants
 
 import type { ShellWard } from '../core/engine'
 
 export function setupSessionGuard(api: any, guard: ShellWard, enforce: boolean) {
-  api.on('session_end', () => {
+  const sessionEndHandler = () => {
     guard.log.write({
       level: 'INFO',
       layer: 'L8',
@@ -13,9 +14,14 @@ export function setupSessionGuard(api: any, guard: ShellWard, enforce: boolean)
         ? '会话结束 — 安全审计完成'
         : 'Session ended — security audit complete',
     })
-  }, { name: 'shellward.session-end', priority: 50 })
+  }
 
-  api.on('subagent_spawning', (event: any) => {
+  // Register ALL known naming conventions for session end
+  api.on('session_end', sessionEndHandler, { name: 'shellward.session-end', priority: 50 })
+  api.on('session:end', sessionEndHandler, { name: 'shellward.session-end-v2', priority: 50 })
+  api.on('command:new', sessionEndHandler, { name: 'shellward.session-end-fallback', priority: 50 })
+
+  const subagentHandler = (event: any) => {
     const mode = event.mode || 'unknown'
     guard.log.write({
       level: 'MEDIUM',
@@ -25,7 +31,11 @@ export function setupSessionGuard(api: any, guard: ShellWard, enforce: boolean)
         ? `子 Agent 创建: mode=${mode}, agentId=${event.agentId || 'unknown'}`
         : `Subagent spawning: mode=${mode}, agentId=${event.agentId || 'unknown'}`,
     })
-  }, { name: 'shellward.subagent-guard', priority: 100 })
+  }
+
+  // Register ALL known naming conventions for subagent monitoring
+  api.on('subagent_spawning', subagentHandler, { name: 'shellward.subagent-guard', priority: 100 })
+  api.on('subagent:spawning', subagentHandler, { name: 'shellward.subagent-guard-v2', priority: 100 })
 
   api.logger.info('[ShellWard] L8 Session Guard enabled')
 }