shroud-privacy 2.0.18 → 2.0.19

package/dist/hooks.js

@@ -179,19 +179,12 @@ export function registerHooks(api, obfuscator) {
             return;
         dumpStatsFile(obfuscator);
         api.logger?.info(`[shroud] before_prompt_build: obfuscated ${result.entities.length} entities`);
-        // NOTE: OpenClaw's hook API only supports prependContext (not prompt
-        // replacement). The raw user text still reaches the LLM alongside
-        // the obfuscated version. This is a known limitation tracked as a
-        // feature request for OpenClaw's before_prompt_build hook.
+        // Return the obfuscated prompt as a full replacement.
+        // OpenClaw's deploy-local.sh patches before_prompt_build to support
+        // the `prompt` field, which replaces params.prompt entirely so that
+        // raw PII never reaches the LLM.
         return {
-            prependContext: [
-                "--- SHROUD PRIVACY LAYER ---",
-                "The following user message has been privacy-filtered.",
-                "Use ONLY the sanitized version below. Do NOT reference the original values.",
-                "",
-                result.obfuscated,
-                "--- END SHROUD ---",
-            ].join("\n"),
+            prompt: result.obfuscated,
         };
     });
     // -----------------------------------------------------------------------
@@ -223,11 +216,40 @@ export function registerHooks(api, obfuscator) {
             if (Array.isArray(msg.content)) {
                 let changed = false;
                 const newContent = msg.content.map((block) => {
-                    if (block && typeof block === "object" && typeof block.text === "string") {
-                        const deobfuscated = obfuscator.deobfuscate(block.text);
-                        if (deobfuscated !== block.text) {
-                            changed = true;
-                            return { ...block, text: deobfuscated };
+                    if (block && typeof block === "object") {
+                        // Handle blocks with .text (text content blocks)
+                        if (typeof block.text === "string") {
+                            const deobfuscated = obfuscator.deobfuscate(block.text);
+                            if (deobfuscated !== block.text) {
+                                changed = true;
+                                return { ...block, text: deobfuscated };
+                            }
+                        }
+                        // Handle blocks with .content as string (tool_result blocks)
+                        if (typeof block.content === "string") {
+                            const deobfuscated = obfuscator.deobfuscate(block.content);
+                            if (deobfuscated !== block.content) {
+                                changed = true;
+                                return { ...block, content: deobfuscated };
+                            }
+                        }
+                        // Handle blocks with .content as array (nested content blocks)
+                        if (Array.isArray(block.content)) {
+                            let innerChanged = false;
+                            const newInner = block.content.map((inner) => {
+                                if (inner && typeof inner === "object" && typeof inner.text === "string") {
+                                    const deobfuscated = obfuscator.deobfuscate(inner.text);
+                                    if (deobfuscated !== inner.text) {
+                                        innerChanged = true;
+                                        return { ...inner, text: deobfuscated };
+                                    }
+                                }
+                                return inner;
+                            });
+                            if (innerChanged) {
+                                changed = true;
+                                return { ...block, content: newInner };
+                            }
                         }
                     }
                     return block;
@@ -259,12 +281,45 @@ export function registerHooks(api, obfuscator) {
             let changed = false;
             const allResults = [];
             const newContent = msg.content.map((block) => {
-                if (block && typeof block === "object" && typeof block.text === "string") {
-                    const result = obfuscator.obfuscate(block.text);
-                    if (result.entities.length > 0) {
-                        changed = true;
-                        allResults.push(result);
-                        return { ...block, text: result.obfuscated };
+                if (block && typeof block === "object") {
+                    // Handle blocks with .text (text content blocks)
+                    if (typeof block.text === "string") {
+                        const result = obfuscator.obfuscate(block.text);
+                        if (result.entities.length > 0) {
+                            changed = true;
+                            allResults.push(result);
+                            return { ...block, text: result.obfuscated };
+                        }
+                    }
+                    // Handle blocks with .content as string (tool_result blocks)
+                    if (typeof block.content === "string") {
+                        const result = obfuscator.obfuscate(block.content);
+                        if (result.entities.length > 0) {
+                            changed = true;
+                            allResults.push(result);
+                            return { ...block, content: result.obfuscated };
+                        }
+                    }
+                    // Handle blocks with .content as array (nested content blocks)
+                    if (Array.isArray(block.content)) {
+                        let innerChanged = false;
+                        const innerResults = [];
+                        const newInner = block.content.map((inner) => {
+                            if (inner && typeof inner === "object" && typeof inner.text === "string") {
+                                const result = obfuscator.obfuscate(inner.text);
+                                if (result.entities.length > 0) {
+                                    innerChanged = true;
+                                    innerResults.push(result);
+                                    return { ...inner, text: result.obfuscated };
+                                }
+                            }
+                            return inner;
+                        });
+                        if (innerChanged) {
+                            changed = true;
+                            allResults.push(...innerResults);
+                            return { ...block, content: newInner };
+                        }
                     }
                 }
                 return block;

package/dist/obfuscator.js

@@ -118,6 +118,53 @@ function buildCombinedFakeRegex(fakes) {
     const escaped = fakes.map((f) => f.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"));
     return new RegExp(escaped.join("|"), "g");
 }
+/**
+ * Multi-pass deobfuscation that protects already-replaced regions.
+ *
+ * Uses placeholder sentinels: each replacement is temporarily stored as a
+ * unique placeholder (U+FFFF-based) that cannot match any fake value regex.
+ * After all passes complete, placeholders are swapped back to their real
+ * values. This prevents cascading replacements when a real value contains
+ * a substring that is also a fake value (e.g., fake "ACL-MGMT" maps to
+ * real "ACL-MGMT-FILTER" — without protection, later passes would find
+ * "ACL-MGMT" inside the restored value and replace it again).
+ */
+function multiPassDeobfuscate(text, combinedRe, reverse, knownFakeSet, maxPasses) {
+    if (!combinedRe)
+        return { text, replacements: 0 };
+    let result = text;
+    let totalReplacements = 0;
+    // Map placeholder ID -> real value.  Placeholders use \uFFFF + index
+    // which cannot appear in fake values (they are printable ASCII).
+    const placeholders = [];
+    for (let pass = 0; pass < maxPasses; pass++) {
+        let passReplacements = 0;
+        combinedRe.lastIndex = 0;
+        result = result.replace(combinedRe, (match) => {
+            const real = reverse.get(match);
+            if (real !== undefined) {
+                passReplacements++;
+                knownFakeSet.delete(match);
+                // Store real value behind a placeholder to protect it from
+                // subsequent passes matching substrings within it.
+                const idx = placeholders.length;
+                placeholders.push(real);
+                return `\uFFFF${idx}\uFFFF`;
+            }
+            return match;
+        });
+        totalReplacements += passReplacements;
+        if (passReplacements === 0)
+            break;
+    }
+    // Swap placeholders back to real values
+    if (placeholders.length > 0) {
+        result = result.replace(/\uFFFF(\d+)\uFFFF/g, (_m, idxStr) => {
+            return placeholders[parseInt(idxStr, 10)] ?? _m;
+        });
+    }
+    return { text: result, replacements: totalReplacements };
+}
 /**
  * Convert a simple wildcard pattern (* and ?) to a RegExp.
  * Caches compiled patterns for reuse. Bounded to 500 entries.
@@ -381,32 +428,15 @@ export class Obfuscator {
         }
         // Build a single combined regex for all fakes (longest-match-first).
         const fakes = [...reverse.keys()].sort((a, b) => b.length - a.length);
-        // Recursive deobfuscation — multiple passes for nested structures
-        let result = text;
-        let totalReplacements = 0;
-        const MAX_PASSES = 3;
         // Collect known fakes that were NOT replaced (for residual pass)
         const knownFakeSet = new Set(fakes);
         // Build combined regex: escape each fake, join with alternation
         const combinedRe = buildCombinedFakeRegex(fakes);
-        for (let pass = 0; pass < MAX_PASSES; pass++) {
-            let passReplacements = 0;
-            if (combinedRe) {
-                combinedRe.lastIndex = 0;
-                result = result.replace(combinedRe, (match) => {
-                    const real = reverse.get(match);
-                    if (real !== undefined) {
-                        passReplacements++;
-                        knownFakeSet.delete(match);
-                        return real;
-                    }
-                    return match;
-                });
-            }
-            totalReplacements += passReplacements;
-            if (passReplacements === 0)
-                break; // No more replacements possible
-        }
+        // Multi-pass deobfuscation with protection against cascading replacements
+        const MAX_PASSES = 3;
+        const deobResult = multiPassDeobfuscate(text, combinedRe, reverse, knownFakeSet, MAX_PASSES);
+        let result = deobResult.text;
+        let totalReplacements = deobResult.replacements;
         // Subnet-aware deobfuscation: reverse-map CGNAT IPs the LLM derived
         const residual = this._deobfuscateResidualCgnat(result, knownFakeSet);
         if (residual.count > 0) {
@@ -454,30 +484,13 @@ export class Obfuscator {
             reverse.set(fake, real);
         }
         const fakes = [...reverse.keys()].sort((a, b) => b.length - a.length);
-        // Recursive deobfuscation
-        let result = text;
-        let replacementCount = 0;
-        const MAX_PASSES = 3;
         const knownFakeSet = new Set(fakes);
         const combinedRe = buildCombinedFakeRegex(fakes);
-        for (let pass = 0; pass < MAX_PASSES; pass++) {
-            let passReplacements = 0;
-            if (combinedRe) {
-                combinedRe.lastIndex = 0;
-                result = result.replace(combinedRe, (match) => {
-                    const real = reverse.get(match);
-                    if (real !== undefined) {
-                        passReplacements++;
-                        knownFakeSet.delete(match);
-                        return real;
-                    }
-                    return match;
-                });
-            }
-            replacementCount += passReplacements;
-            if (passReplacements === 0)
-                break;
-        }
+        // Multi-pass deobfuscation with protection against cascading replacements
+        const MAX_PASSES = 3;
+        const deobResult = multiPassDeobfuscate(text, combinedRe, reverse, knownFakeSet, MAX_PASSES);
+        let result = deobResult.text;
+        let replacementCount = deobResult.replacements;
         // Subnet-aware deobfuscation for LLM-derived CGNAT IPs
         const residual = this._deobfuscateResidualCgnat(result, knownFakeSet);
         if (residual.count > 0) {

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "shroud-privacy",
   "name": "Shroud",
-  "version": "2.0.18",
+  "version": "2.0.19",
   "description": "Privacy obfuscation with deterministic fake values and deobfuscation — PII never reaches the LLM, tool calls still work",
   "configSchema": {
     "type": "object",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shroud-privacy",
-  "version": "2.0.18",
+  "version": "2.0.19",
   "description": "Privacy obfuscation plugin for OpenClaw — detects sensitive data and replaces with deterministic fake values",
   "type": "module",
   "main": "dist/index.js",