shellward 0.5.3 → 0.5.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shellward",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "AI Agent Security Middleware — 8-layer defense against prompt injection, data exfiltration & dangerous commands. DLP model: use data freely, block external leaks. Zero dependencies. SDK + OpenClaw plugin. Supports LangChain, AutoGPT, Claude Code, Cursor, OpenAI Agents.",
   "keywords": [
     "shellward",

package/src/layers/data-flow-guard.ts

@@ -1,15 +1,11 @@
 // src/layers/data-flow-guard.ts — L7 OpenClaw Adapter
 // Thin adapter: wires OpenClaw hooks to ShellWard core engine for data flow tracking
-// Compat: uses tool_result_persist as fallback when after_tool_call/before_tool_call unavailable
 
 import type { ShellWard } from '../core/engine'
 
 export function setupDataFlowGuard(api: any, guard: ShellWard, enforce: boolean) {
-  let hasReadTracker = false
-  let hasEgressBlock = false
-
-  // Primary read tracker: after_tool_call
-  hasReadTracker = api.on('after_tool_call', (event: any) => {
+  // Track file reads via after_tool_call
+  api.on('after_tool_call', (event: any) => {
     const toolName = String(event.toolName || '').toLowerCase()
     const params = (event.params && typeof event.params === 'object') ? event.params : {}
     const path = String(params.path || params.file_path || params.filename || params.target || '')
@@ -19,8 +15,8 @@ export function setupDataFlowGuard(api: any, guard: ShellWard, enforce: boolean)
     }
   }, { name: 'shellward.data-flow-read-tracker', priority: 50 })
 
-  // Primary egress block: before_tool_call
-  hasEgressBlock = api.on('before_tool_call', (event: any) => {
+  // Block outbound sends when sensitive data was recently accessed
+  api.on('before_tool_call', (event: any) => {
     const toolName = String(event.toolName || '')
     const params = (event.params && typeof event.params === 'object') ? event.params : {}
 
@@ -30,61 +26,5 @@ export function setupDataFlowGuard(api: any, guard: ShellWard, enforce: boolean)
     }
   }, { name: 'shellward.data-flow-egress', priority: 250 })
 
-  // Fallback: tool_result_persist for both read tracking and egress detection
-  // When after_tool_call/before_tool_call are unavailable, we use tool_result_persist
-  // which fires for every tool result before it's persisted to transcript
-  if (!hasReadTracker || !hasEgressBlock) {
-    api.on('tool_result_persist', (event: any) => {
-      const msg = event.message
-      if (!msg) return undefined
-      const toolName = String(msg.toolName || '')
-      if (!toolName) return undefined
-      const toolLower = toolName.toLowerCase()
-
-      // Fallback read tracking: scan tool results for PII to detect sensitive data access
-      // The L2 output-scanner already does scanData() which calls markSensitiveData()
-      // So read tracking is covered. Here we also track file reads by tool name.
-      if (!hasReadTracker && guard.isReadTool(toolLower)) {
-        // We don't have the file path from tool_result_persist,
-        // but L2's scanData already marks sensitive data when PII is found in results
-        guard.log.write({
-          level: 'INFO',
-          layer: 'L7',
-          action: 'detect',
-          detail: `Read tool executed: ${toolName} (tracking via result scan)`,
-          tool: toolName,
-        })
-      }
-
-      // Fallback egress detection: check if an outbound tool was used after sensitive data
-      if (!hasEgressBlock) {
-        // We can't block here (tool already ran), but we detect and log
-        const fakeParams: Record<string, any> = {}
-        const result = guard.checkOutbound(toolName, fakeParams)
-        if (!result.allowed) {
-          guard.log.write({
-            level: 'CRITICAL',
-            layer: 'L7',
-            action: 'detect',
-            detail: guard.locale === 'zh'
-              ? `⚠️ 数据外泄检测 (无法前置拦截): ${toolName} 在访问敏感数据后执行了外发操作`
-              : `⚠️ Data exfiltration detected (pre-block unavailable): ${toolName} sent data after sensitive access`,
-            tool: toolName,
-            pattern: 'data_exfil_chain',
-          })
-        }
-      }
-
-      return undefined
-    }, { name: 'shellward.data-flow-fallback', priority: 90 })
-
-    if (!hasReadTracker) {
-      api.logger.warn('[ShellWard] L7 Data Flow Guard: after_tool_call unavailable, using result-based tracking')
-    }
-    if (!hasEgressBlock) {
-      api.logger.warn('[ShellWard] L7 Data Flow Guard: before_tool_call unavailable, using post-execution detection')
-    }
-  }
-
   api.logger.info('[ShellWard] L7 Data Flow Guard enabled')
 }

package/src/layers/input-auditor.ts

@@ -1,6 +1,6 @@
 // src/layers/input-auditor.ts — L4 OpenClaw Adapter
 // Thin adapter: wires OpenClaw hooks to ShellWard core engine for injection detection
-// Compat: supports both old (message_received) and new (message:received) hook names
+// Compat: registers all known hook name variants — OpenClaw silently ignores unknown ones
 
 import type { ShellWard } from '../core/engine'
 
@@ -24,18 +24,16 @@ export function setupInputAuditor(api: any, guard: ShellWard, enforce: boolean)
     }
   }, { name: 'shellward.input-auditor', priority: 300 })
 
-  // Message scanning: try both OpenClaw hook naming conventions
+  // Message scanning: register ALL known naming conventions
+  // OpenClaw silently ignores unknown hooks (no error thrown), so register all variants
   const messageHandler = (event: any) => {
     const content = typeof event.content === 'string' ? event.content : ''
     if (!content) return
     guard.checkInjection(content, { source: 'message' })
   }
 
-  // Try new-style colon-separated hook name first, then legacy underscore style
-  const registered = api.on('message:received', messageHandler, { name: 'shellward.message-auditor', priority: 100 })
-  if (!registered) {
-    api.on('message_received', messageHandler, { name: 'shellward.message-auditor', priority: 100 })
-  }
+  api.on('message_received', messageHandler, { name: 'shellward.message-auditor', priority: 100 })
+  api.on('message:received', messageHandler, { name: 'shellward.message-auditor-v2', priority: 100 })
 
   api.logger.info(`[ShellWard] L4 Input Auditor enabled`)
 }

package/src/layers/outbound-guard.ts

@@ -1,6 +1,6 @@
 // src/layers/outbound-guard.ts — L6 OpenClaw Adapter
 // Thin adapter: wires OpenClaw hooks to ShellWard core engine for outbound response scanning
-// Compat: supports both old (message_sending) and new (message:sent) hook names
+// Compat: registers all known hook name variants
 
 import type { ShellWard } from '../core/engine'
 
@@ -21,11 +21,9 @@ export function setupOutboundGuard(api: any, guard: ShellWard, enforce: boolean)
     return undefined
   }
 
-  // Try new-style hook name first, then legacy
-  const registered = api.on('message:sent', handler, { name: 'shellward.outbound-guard', priority: 100 })
-  if (!registered) {
-    api.on('message_sending', handler, { name: 'shellward.outbound-guard', priority: 100 })
-  }
+  // Register ALL known naming conventions — OpenClaw silently ignores unknown ones
+  api.on('message_sending', handler, { name: 'shellward.outbound-guard', priority: 100 })
+  api.on('message:sent', handler, { name: 'shellward.outbound-guard-v2', priority: 100 })
 
   api.logger.info('[ShellWard] L6 Outbound Guard enabled')
 }

package/src/layers/session-guard.ts

@@ -1,11 +1,10 @@
 // src/layers/session-guard.ts — L8 OpenClaw Adapter
 // Thin adapter: wires OpenClaw hooks to ShellWard core engine for session monitoring
-// Compat: supports multiple hook naming conventions and graceful degradation
+// Compat: registers all known hook name variants
 
 import type { ShellWard } from '../core/engine'
 
 export function setupSessionGuard(api: any, guard: ShellWard, enforce: boolean) {
-  // Session end: try new-style, then legacy, then command-based
   const sessionEndHandler = () => {
     guard.log.write({
       level: 'INFO',
@@ -17,16 +16,11 @@ export function setupSessionGuard(api: any, guard: ShellWard, enforce: boolean)
     })
   }
 
-  let registered = api.on('session:end', sessionEndHandler, { name: 'shellward.session-end', priority: 50 })
-  if (!registered) {
-    registered = api.on('session_end', sessionEndHandler, { name: 'shellward.session-end', priority: 50 })
-  }
-  if (!registered) {
-    // Fallback: listen for command:new (session reset) as a proxy
-    api.on('command:new', sessionEndHandler, { name: 'shellward.session-end-fallback', priority: 50 })
-  }
+  // Register ALL known naming conventions for session end
+  api.on('session_end', sessionEndHandler, { name: 'shellward.session-end', priority: 50 })
+  api.on('session:end', sessionEndHandler, { name: 'shellward.session-end-v2', priority: 50 })
+  api.on('command:new', sessionEndHandler, { name: 'shellward.session-end-fallback', priority: 50 })
 
-  // Subagent monitoring: try multiple naming conventions
   const subagentHandler = (event: any) => {
     const mode = event.mode || 'unknown'
     guard.log.write({
@@ -39,14 +33,9 @@ export function setupSessionGuard(api: any, guard: ShellWard, enforce: boolean)
     })
   }
 
-  // Try ContextEngine-style hook, then legacy
-  let subRegistered = api.on('subagent:spawning', subagentHandler, { name: 'shellward.subagent-guard', priority: 100 })
-  if (!subRegistered) {
-    subRegistered = api.on('subagent_spawning', subagentHandler, { name: 'shellward.subagent-guard', priority: 100 })
-  }
-  if (!subRegistered) {
-    api.logger.warn('[ShellWard] L8 Session Guard: subagent hooks unavailable, subagent monitoring disabled')
-  }
+  // Register ALL known naming conventions for subagent monitoring
+  api.on('subagent_spawning', subagentHandler, { name: 'shellward.subagent-guard', priority: 100 })
+  api.on('subagent:spawning', subagentHandler, { name: 'shellward.subagent-guard-v2', priority: 100 })
 
   api.logger.info('[ShellWard] L8 Session Guard enabled')
 }

package/src/layers/tool-blocker.ts

@@ -1,12 +1,10 @@
 // src/layers/tool-blocker.ts — L3 OpenClaw Adapter
 // Thin adapter: wires OpenClaw's before_tool_call hook to ShellWard core engine
-// Compat: falls back to tool_result_persist for post-execution detection if before_tool_call unavailable
 
 import type { ShellWard } from '../core/engine'
 
 export function setupToolBlocker(api: any, guard: ShellWard, enforce: boolean) {
-  // Primary: pre-execution blocking via before_tool_call
-  const hasBeforeToolCall = api.on('before_tool_call', (event: any) => {
+  api.on('before_tool_call', (event: any) => {
     const tool = String(event.toolName || '')
     const args: Record<string, any> = (event.params && typeof event.params === 'object') ? event.params : {}
 
@@ -33,35 +31,5 @@ export function setupToolBlocker(api: any, guard: ShellWard, enforce: boolean) {
     }
   }, { name: 'shellward.tool-blocker', priority: 200 })
 
-  // Fallback: post-execution detection via tool_result_persist
-  // When before_tool_call is unavailable (some OpenClaw versions), we still detect
-  // dangerous tool usage after the fact and log it for audit trail
-  if (!hasBeforeToolCall) {
-    api.on('tool_result_persist', (event: any) => {
-      const msg = event.message
-      if (!msg) return undefined
-      const tool = String(msg.toolName || '')
-      if (!tool) return undefined
-
-      // Check if the tool itself is blocked
-      const toolCheck = guard.checkTool(tool)
-      if (!toolCheck.allowed) {
-        guard.log.write({
-          level: 'CRITICAL',
-          layer: 'L3',
-          action: 'detect',
-          detail: guard.locale === 'zh'
-            ? `⚠️ 高危工具已执行 (无法前置拦截): ${tool} — ${toolCheck.reason}`
-            : `⚠️ Dangerous tool executed (pre-block unavailable): ${tool} — ${toolCheck.reason}`,
-          tool,
-        })
-      }
-
-      return undefined
-    }, { name: 'shellward.tool-blocker-fallback', priority: 190 })
-
-    api.logger.warn('[ShellWard] L3 Tool Blocker: before_tool_call hook unavailable, using post-execution detection')
-  }
-
   api.logger.info('[ShellWard] L3 Tool Blocker enabled')
 }