shroud-privacy 2.2.0 → 2.2.2

package/README.md

@@ -234,33 +234,19 @@ The CLI reads live stats from `/tmp/shroud-stats.json` (override with `SHROUD_ST
 
 ### How privacy works
 
-Shroud uses runtime prototype patches — **no OpenClaw files are modified**:
+Shroud uses **one `globalThis.fetch` intercept** for both directions — no OpenClaw file modifications required:
 
-**Outbound (PII → LLM):** Patches `globalThis.fetch` to intercept all POST requests to LLM API endpoints (`/messages`, `/chat/completions`). Obfuscates every message in the request body — user, assistant, system, tool results — before the request leaves the process. Strips Slack `<mailto:>` markup to prevent PII leaking through chat formatting. Re-obfuscates deobfuscated assistant messages in conversation history to prevent multi-turn PII leaks. Works for every LLM provider.
+**Outbound (PII → LLM):** The fetch intercept catches all POST requests to LLM API endpoints (`/v1/messages`, `/chat/completions`, `:generateContent`, etc.). Every message in the request body — user, assistant, system, tool results — is obfuscated before the request leaves the process. Slack `<mailto:>` markup is stripped to prevent PII leaking through chat formatting. Assistant messages from previous turns are re-obfuscated to prevent multi-turn PII leaks.
 
-**Inbound (LLM → User):** Patches `EventStream.prototype.push()` to deobfuscate streaming responses in real-time. Fake values are replaced with real values as they stream.
+**Inbound (LLM → User):** The same fetch intercept wraps the LLM's SSE streaming response with a per-block flushing `TransformStream`. Text deltas are buffered per content block. When `content_block_stop` arrives, the accumulated text is deobfuscated and flushed — the first delta receives the full real text, subsequent deltas are emptied. Non-PII blocks stream with zero delay. PII blocks delay by ~0.5-1s (time for one content block to complete). JSON (non-streaming) responses are parsed and deobfuscated directly.
 
-**Channel delivery:** Shroud registers `globalThis.__shroudDeobfuscate(text)` — a single global function that converts fake values back to real values. OpenClaw calls this once in its generic message delivery function, before sending to any channel. If Shroud isn't loaded, the function doesn't exist — transparent no-op. The `message_sending` hook provides a backup deobfuscation path.
+**Result:** OpenClaw receives already-deobfuscated events from the LLM response — it never sees fake text. Every delivery path (Slack, WhatsApp, TUI, Telegram, Discord, Signal, cron, subagents, web) gets real text automatically. Zero OpenClaw patches required. Works with `streaming: "on"` and `streaming: "off"`, and with every LLM provider.
 
-All patches are applied once at plugin load and are idempotent — subsequent loads detect and skip them.
-
-### OpenClaw channel delivery patch
-
-Shroud requires a one-line addition to OpenClaw's message delivery function — the single point where all outbound channel messages pass through. This covers ALL channels (Slack, WhatsApp, Signal, Telegram, web, etc.) with one change:
-
-```js
-// In OpenClaw's generic message delivery function:
-const deob = globalThis.__shroudDeobfuscate;
-if (deob && typeof text === 'string') text = deob(text);
-```
-
-**Why this works:**
-- **One change, all channels** — no per-channel hooks needed
-- **Transparent** — if Shroud isn't loaded, `globalThis.__shroudDeobfuscate` is `undefined`, the `if` is false, zero overhead
-- **All releases** — works on any OpenClaw version that sends channel messages through a common delivery path
-- **Last-moment deobfuscation** — fakes are replaced with real values at the latest possible point, just before the HTTP API call
-
-The `deploy-local.sh` script includes a post-install verification step that tests the full chain.
+**Defense-in-depth layers:**
+1. `EventStream.prototype.push()` patch — deobfuscates content blocks in `message_end` events
+2. `globalThis.__shroudDeobfuscate` — available for on-demand deobfuscation
+3. `message_sending` hook — deobfuscates outbound message content when fired by OpenClaw
+4. `before_message_write` hook — deobfuscates assistant messages in the transcript
 
 ### Rule hit counters
 

package/dist/config.d.ts

@@ -10,6 +10,8 @@ import { ShroudConfig } from "./types.js";
  *
  * Priority: env vars > pluginConfig > defaults.
  */
+export declare const STATS_FILE: string;
+export declare const IS_TEST: boolean;
 export declare function resolveConfig(pluginConfig?: unknown): ShroudConfig;
 /** Validation issue severity. */
 export type ConfigSeverity = "error" | "warning" | "info";

package/dist/config.js

@@ -10,6 +10,8 @@ import { randomBytes } from "node:crypto";
  *
  * Priority: env vars > pluginConfig > defaults.
  */
+export const STATS_FILE = process.env.SHROUD_STATS_FILE || "/tmp/shroud-stats.json";
+export const IS_TEST = process.env.NODE_ENV === "test";
 export function resolveConfig(pluginConfig) {
     const raw = pluginConfig != null && typeof pluginConfig === "object"
         ? pluginConfig

package/dist/hooks.d.ts

@@ -1,17 +1,24 @@
 /**
  * OpenClaw lifecycle hooks for the Shroud privacy plugin.
  *
- * Registers 5 hooks + 1 global streaming deobfuscation hook:
- * 1. before_prompt_build   (async) -- obfuscate user prompt via prependContext
- * 2. before_message_write  (SYNC)  -- bidirectional: obfuscate non-assistant,
- *                                     DEOBFUSCATE assistant messages
+ * Privacy architecture — two directions, one fetch intercept:
+ *   Outbound (obfuscation):  globalThis.fetch intercept replaces real PII
+ *                            with deterministic fakes before ANY LLM API call.
+ *   Inbound (deobfuscation): Same fetch intercept buffers the LLM's SSE
+ *                            response per content block, deobfuscates fakes
+ *                            back to real values, and returns clean events.
+ *                            OpenClaw never sees fakes — all channels, sessions,
+ *                            and delivery paths receive real text automatically.
+ *
+ * Hooks:
+ * 1. before_prompt_build   (async) -- pre-seed mapping store for the fetch intercept
+ * 2. before_message_write  (SYNC)  -- deobfuscate assistant messages for transcript
  * 3. before_tool_call      (async) -- deobfuscate tool params (+ depth tracking)
  * 4. tool_result_persist   (SYNC)  -- obfuscate tool result message
- * 5. message_sending       (async) -- deobfuscate outbound message content
- * 6. globalThis.__shroudStreamDeobfuscate -- global function called by pi-ai's
- *                                     patched EventStream.push() to deobfuscate
- *                                     streaming text_delta events from ALL LLM
- *                                     providers before OpenClaw processes them
+ * 5. message_sending       (async) -- deobfuscate outbound message content (backup)
+ * 6. globalThis.__shroudStreamDeobfuscate -- streaming event deobfuscation hook
+ * 7. globalThis.__shroudDeobfuscate       -- channel delivery deobfuscation hook
+ * 8. globalThis.fetch intercept           -- obfuscates requests, deobfuscates responses
  */
 import { Obfuscator } from "./obfuscator.js";
 export interface PluginApi {

package/dist/hooks.js

@@ -1,26 +1,32 @@
 /**
  * OpenClaw lifecycle hooks for the Shroud privacy plugin.
  *
- * Registers 5 hooks + 1 global streaming deobfuscation hook:
- * 1. before_prompt_build   (async) -- obfuscate user prompt via prependContext
- * 2. before_message_write  (SYNC)  -- bidirectional: obfuscate non-assistant,
- *                                     DEOBFUSCATE assistant messages
+ * Privacy architecture — two directions, one fetch intercept:
+ *   Outbound (obfuscation):  globalThis.fetch intercept replaces real PII
+ *                            with deterministic fakes before ANY LLM API call.
+ *   Inbound (deobfuscation): Same fetch intercept buffers the LLM's SSE
+ *                            response per content block, deobfuscates fakes
+ *                            back to real values, and returns clean events.
+ *                            OpenClaw never sees fakes — all channels, sessions,
+ *                            and delivery paths receive real text automatically.
+ *
+ * Hooks:
+ * 1. before_prompt_build   (async) -- pre-seed mapping store for the fetch intercept
+ * 2. before_message_write  (SYNC)  -- deobfuscate assistant messages for transcript
  * 3. before_tool_call      (async) -- deobfuscate tool params (+ depth tracking)
  * 4. tool_result_persist   (SYNC)  -- obfuscate tool result message
- * 5. message_sending       (async) -- deobfuscate outbound message content
- * 6. globalThis.__shroudStreamDeobfuscate -- global function called by pi-ai's
- *                                     patched EventStream.push() to deobfuscate
- *                                     streaming text_delta events from ALL LLM
- *                                     providers before OpenClaw processes them
+ * 5. message_sending       (async) -- deobfuscate outbound message content (backup)
+ * 6. globalThis.__shroudStreamDeobfuscate -- streaming event deobfuscation hook
+ * 7. globalThis.__shroudDeobfuscate       -- channel delivery deobfuscation hook
+ * 8. globalThis.fetch intercept           -- obfuscates requests, deobfuscates responses
  */
 import { createHash, randomBytes } from "node:crypto";
-import { readFileSync, writeFileSync } from "node:fs";
+import { writeFileSync } from "node:fs";
 import { BUILTIN_PATTERNS } from "./detectors/regex.js";
-const STATS_FILE = process.env.SHROUD_STATS_FILE || "/tmp/shroud-stats.json";
+import { STATS_FILE, IS_TEST } from "./config.js";
 function getSharedObfuscator(fallback) {
     return globalThis.__shroudObfuscator || fallback;
 }
-const MAPPINGS_FILE = process.env.SHROUD_MAPPINGS_FILE || "/tmp/shroud-mappings.json";
 function dumpStatsFile(fallback) {
     try {
         const ob = getSharedObfuscator(fallback);
@@ -33,30 +39,6 @@ function dumpStatsFile(fallback) {
     catch {
         // best-effort
     }
-    // Also dump mapping table for child process fetch intercept
-    try {
-        const ob = getSharedObfuscator(fallback);
-        const store = ob._store;
-        if (store?.allMappings) {
-            const allMap = store.allMappings();
-            const mappings = {};
-            for (const [real, fake] of allMap) {
-                mappings[real] = fake;
-            }
-            const config = ob.config;
-            writeFileSync(MAPPINGS_FILE, JSON.stringify({
-                mappings,
-                secretKey: config.secretKey,
-                persistentSalt: config.persistentSalt,
-            }) + "\n");
-        }
-    }
-    catch (e) {
-        try {
-            writeFileSync(MAPPINGS_FILE + ".error", String(e) + "\n");
-        }
-        catch { }
-    }
 }
 // ---------------------------------------------------------------------------
 // Hashing utilities (audit proof hashes)
@@ -200,7 +182,8 @@ export function registerHooks(api, obfuscator) {
         text = text.replace(/<(https?:\/\/[^>]+)>/g, "$1");
         return text;
     }
-    if (process.env.NODE_ENV !== "test") {
+    const isFirstLoad = !globalThis.__shroudObfuscator;
+    if (!IS_TEST) {
         const g = globalThis;
         if (g.__shroudObfuscator) {
             obfuscator = g.__shroudObfuscator;
@@ -214,16 +197,6 @@ export function registerHooks(api, obfuscator) {
     const ob = () => getSharedObfuscator(obfuscator);
     const config = ob().config;
     const auditActive = config.auditEnabled || config.verboseLogging;
-    // Write initial config to mappings file so the fetch preload in child
-    // processes can create a compatible obfuscator on the first API call.
-    try {
-        writeFileSync(MAPPINGS_FILE, JSON.stringify({
-            mappings: {},
-            secretKey: config.secretKey,
-            persistentSalt: config.persistentSalt,
-        }) + "\n");
-    }
-    catch { /* best-effort */ }
     // -----------------------------------------------------------------------
     // 1. before_prompt_build (async): obfuscate user prompt
     // -----------------------------------------------------------------------
@@ -246,9 +219,8 @@ export function registerHooks(api, obfuscator) {
             }
         }
         // Pre-create mappings for PII in user messages WITHOUT mutating them.
-        // This ensures the fetch preload (in child process) has the mappings
-        // before the API call. The actual replacement happens in the preload.
-        api.logger?.info(`[shroud] event keys: ${Object.keys(event || {}).join(",")}`);
+        // This seeds the mapping store so the fetch intercept's response
+        // deobfuscation can replace fakes with the correct real values.
         if (Array.isArray(event?.messages)) {
             for (const msg of event.messages) {
                 const texts = [];
@@ -292,26 +264,6 @@ export function registerHooks(api, obfuscator) {
         const role = msg.role ?? "";
         // --- Assistant messages: DEOBFUSCATE (fakes → real values) ---
         if (role === "assistant") {
-            // Import mappings created by the fetch preload (child process) so we can
-            // deobfuscate fakes that the preload generated independently.
-            try {
-                const raw = readFileSync(MAPPINGS_FILE, "utf-8");
-                const data = JSON.parse(raw.trim());
-                const preloadMappings = data?.mappings;
-                if (preloadMappings && typeof preloadMappings === "object") {
-                    const store = ob()._store;
-                    if (store?.put) {
-                        for (const [real, fake] of Object.entries(preloadMappings)) {
-                            if (typeof fake === "string" && store.getFake(real) === undefined) {
-                                store.put(real, fake, "preload");
-                            }
-                        }
-                    }
-                }
-            }
-            catch {
-                // best-effort — file may not exist yet
-            }
             const _raw = typeof msg.content === "string" ? msg.content :
                 Array.isArray(msg.content) ? msg.content.map((b) => b?.text || "").join("") : "";
             if (_raw.length < 500)
@@ -515,52 +467,46 @@ export function registerHooks(api, obfuscator) {
     api.on("message_sending", async (event) => {
         if (!event?.content)
             return;
-        // String content — direct deobfuscation
+        // String content — direct deobfuscation.
+        // IMPORTANT: Always return { content } even if deobfuscation is a no-op.
+        // OpenClaw may pass already-deobfuscated text here (from before_message_write
+        // modifying the message in place) while the original delivery payload still
+        // has fake text. Returning { content } forces OpenClaw to use our text
+        // instead of falling back to the original payload.
         if (typeof event.content === "string") {
-            if (auditActive) {
-                const { text: deobfuscated, replacementCount } = ob().deobfuscateWithStats(event.content);
-                if (deobfuscated === event.content)
-                    return;
-                try {
-                    emitDeobfuscationAudit(api.logger, config, randomBytes(8).toString("hex"), replacementCount);
+            const deobfuscated = ob().deobfuscate(event.content);
+            if (deobfuscated !== event.content) {
+                api.logger?.info("[shroud] message_sending: deobfuscated outbound message");
+                if (auditActive) {
+                    try {
+                        const { replacementCount } = ob().deobfuscateWithStats(event.content);
+                        emitDeobfuscationAudit(api.logger, config, randomBytes(8).toString("hex"), replacementCount);
+                    }
+                    catch { /* best-effort */ }
                 }
-                catch { /* best-effort */ }
                 dumpStatsFile(obfuscator);
-                return { content: deobfuscated };
             }
-            const deobfuscated = ob().deobfuscate(event.content);
-            if (deobfuscated === event.content)
-                return;
-            api.logger?.info("[shroud] message_sending: deobfuscated outbound message");
-            dumpStatsFile(obfuscator);
+            // Always return content to override the original payload
             return { content: deobfuscated };
         }
-        // Array content (blocks) — walk and deobfuscate all text leaves
+        // Array content (blocks) — walk and deobfuscate all text leaves.
+        // Always return content to override the original payload (same reason as above).
         if (Array.isArray(event.content)) {
-            let changed = false;
             const newContent = event.content.map((block) => {
                 if (block && typeof block === "object") {
                     if (typeof block.text === "string") {
                         const deob = ob().deobfuscate(block.text);
-                        if (deob !== block.text) {
-                            changed = true;
+                        if (deob !== block.text)
                             return { ...block, text: deob };
-                        }
                     }
                     if (typeof block.content === "string") {
                         const deob = ob().deobfuscate(block.content);
-                        if (deob !== block.content) {
-                            changed = true;
+                        if (deob !== block.content)
                             return { ...block, content: deob };
-                        }
                     }
                 }
                 return block;
             });
-            if (!changed)
-                return;
-            api.logger?.info("[shroud] message_sending: deobfuscated outbound blocks");
-            dumpStatsFile(obfuscator);
             return { content: newContent };
         }
     });
@@ -621,67 +567,32 @@ export function registerHooks(api, obfuscator) {
     // but the final message will be correct.
     const SHROUD_BUF = Symbol("shroudStreamBuf");
     globalThis.__shroudStreamDeobfuscate = (stream, event) => {
-        // Streaming deobfuscation is DISABLED. On OpenClaw 2026.3.24+ with
-        // streaming: off, before_message_write handles all deobfuscation.
-        // The streaming buffer causes text artifacts when fake/real lengths
-        // differ — accumulated partial fakes persist in channel delivery
-        // alongside the corrected final text, producing duplicate content.
-        //
-        // The message_end handler below still runs to deobfuscate the final
-        // content blocks (partial/message), ensuring the delivered message
-        // has real values.
+        // Streaming event hook — called by patched EventStream.prototype.push().
+        // Text deltas pass through unchanged (deobfuscation happens at the fetch
+        // response level via per-block SSE flushing). The message_end handler
+        // deobfuscates content blocks as a defense-in-depth measure.
         const isTextDelta = event.type === "text_delta";
         const isMessageUpdateTextDelta = event.type === "message_update" &&
             event.assistantMessageEvent?.type === "text_delta";
         if (isTextDelta || isMessageUpdateTextDelta) {
+            // Pass through text_delta events unchanged.
             let buf = stream[SHROUD_BUF];
             if (!buf) {
-                buf = { raw: "", emitted: 0, deobCount: 0 };
+                buf = { raw: "", deobCount: 0 };
                 stream[SHROUD_BUF] = buf;
             }
             const src = isMessageUpdateTextDelta ? event.assistantMessageEvent : event;
             const chunk = typeof src.delta === "string" ? src.delta
                 : typeof src.text === "string" ? src.text : "";
-            if (!chunk)
-                return event;
-            buf.raw += chunk;
-            const deob = ob().deobfuscate(buf.raw);
-            // Emit the new portion of the deobfuscated buffer
-            let newText;
-            if (deob.length > buf.emitted) {
-                newText = deob.slice(buf.emitted);
-                buf.emitted = deob.length;
-            }
-            else {
-                // Deobfuscated text is shorter — fake was replaced with shorter real.
-                // Emit empty for this chunk; the accumulated delivery text already
-                // has some fake chars that will be corrected on message_end.
-                newText = "";
-                buf.emitted = deob.length;
-            }
-            if (newText !== chunk) {
-                buf.deobCount = (buf.deobCount || 0) + 1;
-                // Also increment the obfuscator's counter directly
-                const obInst = ob();
-                if (typeof obInst._deobfuscationEvents === "number") {
-                    obInst._deobfuscationEvents++;
-                    obInst._totalReplacementsDeobfuscated++;
-                }
-                if (isMessageUpdateTextDelta) {
-                    const patched = { ...src, delta: newText };
-                    if (typeof src.text === "string")
-                        patched.text = newText;
-                    event = { ...event, assistantMessageEvent: patched };
-                }
-                else {
-                    event = { ...event, delta: newText };
-                    if (typeof event.text === "string")
-                        event.text = newText;
-                }
-            }
+            if (chunk)
+                buf.raw += chunk;
+            return event;
         }
-        // On message_end/done: deobfuscate the full content in the partial/message
-        // to correct any partial fakes from streaming
+        // On message_end/done: deobfuscate content blocks in the final message.
+        // This is critical for streaming delivery — OpenClaw uses the content
+        // blocks from the done/message_end event as the authoritative text for
+        // channel delivery. Text_delta deob is disabled (causes garbled
+        // concatenation), but message_end content block deob must remain.
         const isEnd = event.type === "done" || event.type === "message_end" ||
             event.type === "error" || event.type === "agent_end" ||
             (event.type === "message_update" && (event.assistantMessageEvent?.type === "text_end"));
@@ -703,47 +614,35 @@ export function registerHooks(api, obfuscator) {
                     }
                 }
             }
-            // Audit: use the replacement count accumulated during streaming
-            const buf = stream[SHROUD_BUF];
-            const streamDeobCount = buf?.deobCount ?? 0;
-            if (streamDeobCount > 0 && auditActive) {
-                try {
-                    emitDeobfuscationAudit(api.logger, config, randomBytes(8).toString("hex"), streamDeobCount);
-                }
-                catch { /* best-effort */ }
-            }
             dumpStatsFile(obfuscator);
             delete stream[SHROUD_BUF];
         }
         return event;
     };
-    api.logger?.info("[shroud] Installed global streaming deobfuscation hook");
     // -----------------------------------------------------------------------
-    // 7. Global deobfuscation hook for OpenClaw channel delivery.
-    //    OpenClaw calls this once, in its generic message-delivery function,
-    //    before sending to ANY channel (Slack, WhatsApp, Signal, web, etc.).
-    //    Transparent: if Shroud isn't loaded the global doesn't exist — no-op.
-    //    Works on all past + present releases with a single 3-line patch:
-    //
-    //      const deob = globalThis.__shroudDeobfuscate;
-    //      if (deob && typeof text === 'string') text = deob(text);
-    //
+    // 7. Global deobfuscation hook for channel delivery (defense-in-depth).
+    //    Primary deobfuscation happens in the fetch response interceptor (8).
+    //    This hook is available for any code that calls
+    //    globalThis.__shroudDeobfuscate(text) directly.
     // -----------------------------------------------------------------------
     globalThis.__shroudDeobfuscate = (text) => {
         if (typeof text !== "string")
             return text;
         return ob().deobfuscate(text);
     };
-    api.logger?.info("[shroud] Registered globalThis.__shroudDeobfuscate for channel delivery");
     // -----------------------------------------------------------------------
-    // 8. Outbound fetch intercept: obfuscate ALL user message content before
-    //    it reaches any LLM API. This is the last line of defense — it works
-    //    regardless of which hooks fire, which OpenClaw version is running,
-    //    and which LLM provider is used (Anthropic, OpenAI, Google, etc.).
+    // 8. Fetch intercept — the universal privacy boundary.
+    //
+    //    REQUEST (obfuscation): Patches globalThis.fetch to intercept outbound
+    //    POST requests to LLM API paths (/v1/messages, /chat/completions, etc.).
+    //    Obfuscates all message content before it leaves the process.
     //
-    //    Patches globalThis.fetch to inspect outbound POST requests to known
-    //    LLM API paths (/messages, /chat/completions). If the request body
-    //    contains a messages array with user role content, obfuscate it.
+    //    RESPONSE (deobfuscation): Wraps the LLM's SSE response with a
+    //    per-block flushing TransformStream. Text deltas are buffered per
+    //    content block. On content_block_stop, the accumulated text is
+    //    deobfuscated and flushed — first delta gets the full real text,
+    //    subsequent deltas are emptied. Non-PII blocks stream with zero delay.
+    //    OpenClaw receives clean events; every channel gets real text.
     // -----------------------------------------------------------------------
     const LLM_API_PATHS = [
         "/v1/messages", // Anthropic
@@ -758,7 +657,6 @@ export function registerHooks(api, obfuscator) {
         "/v1/models/", // Google Vertex AI
     ];
     const originalFetch = globalThis.fetch;
-    api.logger?.info(`[shroud][fetch-guard] hasFetch=${!!originalFetch} patched=${!!globalThis.__shroudFetchPatched}`);
     if (originalFetch && !(globalThis.__shroudFetchPatched)) {
         globalThis.__shroudFetchPatched = true;
         globalThis.fetch = async function shroudFetchInterceptor(input, init) {
@@ -876,10 +774,9 @@ export function registerHooks(api, obfuscator) {
                     // Strip Slack markup first so PII detection works on clean text
                     const cleaned = stripSlackLinks(text);
                     const textChanged = cleaned !== text;
-                    if (!needsObfuscation(cleaned)) {
-                        // Even if no known reals found, return cleaned text if Slack links were stripped
-                        return textChanged ? { text: cleaned, modified: true } : { text, modified: false };
-                    }
+                    // Always run obfuscation — the needsObfuscation check was skipping
+                    // NEW PII that wasn't in the store (e.g., LLM-generated emails
+                    // echoed back by the user). Detection must run on every message.
                     const result = ob().obfuscate(cleaned);
                     return result.entities.length > 0 || textChanged
                         ? { text: result.obfuscated, modified: true }
@@ -954,14 +851,276 @@ export function registerHooks(api, obfuscator) {
                         headers.set("content-length", String(new TextEncoder().encode(newBody).length));
                         newInit.headers = headers;
                     }
-                    return originalFetch.call(globalThis, input, newInit);
+                    return deobfuscateResponse(originalFetch.call(globalThis, input, newInit));
                 }
             }
             catch {
                 // JSON parse failed or other error — pass through unmodified
             }
-            return originalFetch.call(globalThis, input, init);
+            return deobfuscateResponse(originalFetch.call(globalThis, input, init));
         };
-        api.logger?.info("[shroud] Installed outbound fetch intercept — PII obfuscated before ALL LLM API calls");
+        // ── Response deobfuscation ──────────────────────────────
+        // Wraps the LLM response to replace fakes with reals BEFORE
+        // OpenClaw processes it. This is the universal deobfuscation
+        // point — OpenClaw receives clean text, so ALL channels,
+        // sessions, and delivery paths get real values automatically.
+        //
+        // For streaming (SSE): buffers the response body, deobfuscates
+        // all text content, returns a new Response with clean data.
+        // For JSON: wraps response.json() to deobfuscate.
+        async function deobfuscateResponse(fetchPromise) {
+            const response = await fetchPromise;
+            if (!response.ok || !response.body)
+                return response;
+            const contentType = response.headers.get("content-type") || "";
+            // SSE streaming response — per-block flushing.
+            // Non-PII events pass through immediately. Text deltas are buffered
+            // per content block. When content_block_stop arrives, the block's
+            // accumulated text is deobfuscated and all buffered events for that
+            // block are flushed — first delta gets the full deobbed text,
+            // subsequent deltas get empty strings. Preserves streaming UX:
+            // non-PII blocks stream normally, PII blocks delay by ~0.5-1s.
+            if (contentType.includes("text/event-stream")) {
+                // Per-block state
+                const blockAccum = new Map();
+                const blockBuffer = new Map();
+                // OpenAI per-choice state
+                const choiceAccum = new Map();
+                const choiceBuffer = new Map();
+                let sseRemainder = "";
+                const transform = new TransformStream({
+                    transform(chunk, controller) {
+                        const text = sseRemainder + new TextDecoder().decode(chunk);
+                        // SSE events are separated by \n\n
+                        const parts = text.split("\n\n");
+                        // Last part may be incomplete — save for next chunk
+                        sseRemainder = parts.pop() || "";
+                        for (const part of parts) {
+                            if (!part.trim()) {
+                                controller.enqueue(new TextEncoder().encode("\n\n"));
+                                continue;
+                            }
+                            const dataLine = part.split("\n").find((l) => l.startsWith("data: "));
+                            if (!dataLine) {
+                                controller.enqueue(new TextEncoder().encode(part + "\n\n"));
+                                continue;
+                            }
+                            let json;
+                            try {
+                                json = JSON.parse(dataLine.slice(6));
+                            }
+                            catch {
+                                controller.enqueue(new TextEncoder().encode(part + "\n\n"));
+                                continue;
+                            }
+                            // Anthropic text_delta: buffer until block_stop
+                            if (json.type === "content_block_delta" && json.delta?.type === "text_delta") {
+                                const idx = json.index ?? 0;
+                                blockAccum.set(idx, (blockAccum.get(idx) || "") + (json.delta.text || ""));
+                                if (!blockBuffer.has(idx))
+                                    blockBuffer.set(idx, []);
+                                blockBuffer.get(idx).push(part);
+                                // Don't flush yet — wait for content_block_stop
+                                continue;
+                            }
+                            // Anthropic content_block_stop: flush buffered deltas for this block
+                            if (json.type === "content_block_stop") {
+                                const idx = json.index ?? 0;
+                                const accumulated = blockAccum.get(idx);
+                                const buffered = blockBuffer.get(idx);
+                                if (accumulated && buffered && buffered.length > 0) {
+                                    const deobbed = ob().deobfuscate(accumulated);
+                                    // First buffered delta gets the full deobbed text
+                                    let first = true;
+                                    for (const eventStr of buffered) {
+                                        const dLine = eventStr.split("\n").find((l) => l.startsWith("data: "));
+                                        if (dLine) {
+                                            try {
+                                                const dJson = JSON.parse(dLine.slice(6));
+                                                if (dJson.delta?.type === "text_delta") {
+                                                    dJson.delta.text = first ? deobbed : "";
+                                                    first = false;
+                                                    const nonDataLines = eventStr.split("\n").filter((l) => !l.startsWith("data: ")).join("\n");
+                                                    const rebuilt = (nonDataLines ? nonDataLines + "\n" : "") + "data: " + JSON.stringify(dJson);
+                                                    controller.enqueue(new TextEncoder().encode(rebuilt + "\n\n"));
+                                                    continue;
+                                                }
+                                            }
+                                            catch { }
+                                        }
+                                        controller.enqueue(new TextEncoder().encode(eventStr + "\n\n"));
+                                    }
+                                    blockAccum.delete(idx);
+                                    blockBuffer.delete(idx);
+                                }
+                                // Emit the stop event itself
+                                controller.enqueue(new TextEncoder().encode(part + "\n\n"));
+                                continue;
+                            }
+                            // OpenAI delta.content: buffer until finish_reason
+                            if (Array.isArray(json.choices)) {
+                                let buffered = false;
+                                for (const choice of json.choices) {
+                                    const idx = choice.index ?? 0;
+                                    if (typeof choice.delta?.content === "string") {
+                                        choiceAccum.set(idx, (choiceAccum.get(idx) || "") + choice.delta.content);
+                                        if (!choiceBuffer.has(idx))
+                                            choiceBuffer.set(idx, []);
+                                        choiceBuffer.get(idx).push(part);
+                                        buffered = true;
+                                    }
+                                    // finish_reason signals block complete — flush
+                                    if (choice.finish_reason) {
+                                        const accumulated = choiceAccum.get(idx);
+                                        const buf = choiceBuffer.get(idx);
+                                        if (accumulated && buf && buf.length > 0) {
+                                            const deobbed = ob().deobfuscate(accumulated);
+                                            let first = true;
+                                            for (const eventStr of buf) {
+                                                const dLine = eventStr.split("\n").find((l) => l.startsWith("data: "));
+                                                if (dLine) {
+                                                    try {
+                                                        const dJson = JSON.parse(dLine.slice(6));
+                                                        if (Array.isArray(dJson.choices)) {
+                                                            for (const c of dJson.choices) {
+                                                                if (typeof c.delta?.content === "string") {
+                                                                    c.delta.content = first ? deobbed : "";
+                                                                    first = false;
+                                                                }
+                                                            }
+                                                            const nonDataLines = eventStr.split("\n").filter((l) => !l.startsWith("data: ")).join("\n");
+                                                            const rebuilt = (nonDataLines ? nonDataLines + "\n" : "") + "data: " + JSON.stringify(dJson);
+                                                            controller.enqueue(new TextEncoder().encode(rebuilt + "\n\n"));
+                                                            continue;
+                                                        }
+                                                    }
+                                                    catch { }
+                                                }
+                                                controller.enqueue(new TextEncoder().encode(eventStr + "\n\n"));
+                                            }
+                                            choiceAccum.delete(idx);
+                                            choiceBuffer.delete(idx);
+                                        }
+                                        buffered = false;
+                                    }
+                                }
+                                if (buffered)
+                                    continue;
+                            }
+                            // Deobfuscate content blocks in message events (message_start etc)
+                            if (Array.isArray(json.message?.content)) {
+                                for (const block of json.message.content) {
+                                    if (block?.type === "text" && typeof block.text === "string") {
+                                        block.text = ob().deobfuscate(block.text);
+                                    }
+                                }
+                                const nonDataLines = part.split("\n").filter((l) => !l.startsWith("data: ")).join("\n");
+                                const rebuilt = (nonDataLines ? nonDataLines + "\n" : "") + "data: " + JSON.stringify(json);
+                                controller.enqueue(new TextEncoder().encode(rebuilt + "\n\n"));
+                                continue;
+                            }
+                            // All other events pass through unchanged
+                            controller.enqueue(new TextEncoder().encode(part + "\n\n"));
+                        }
+                    },
+                    flush(controller) {
+                        // Flush any remaining buffered content (stream ended mid-block)
+                        for (const [idx, buffered] of blockBuffer) {
+                            const accumulated = blockAccum.get(idx) || "";
+                            const deobbed = ob().deobfuscate(accumulated);
+                            let first = true;
+                            for (const eventStr of buffered) {
+                                const dLine = eventStr.split("\n").find((l) => l.startsWith("data: "));
+                                if (dLine) {
+                                    try {
+                                        const dJson = JSON.parse(dLine.slice(6));
+                                        if (dJson.delta?.type === "text_delta") {
+                                            dJson.delta.text = first ? deobbed : "";
+                                            first = false;
+                                            const nonDataLines = eventStr.split("\n").filter((l) => !l.startsWith("data: ")).join("\n");
+                                            const rebuilt = (nonDataLines ? nonDataLines + "\n" : "") + "data: " + JSON.stringify(dJson);
+                                            controller.enqueue(new TextEncoder().encode(rebuilt + "\n\n"));
+                                            continue;
+                                        }
+                                    }
+                                    catch { }
+                                }
+                                controller.enqueue(new TextEncoder().encode(eventStr + "\n\n"));
+                            }
+                        }
+                        for (const [idx, buffered] of choiceBuffer) {
+                            const accumulated = choiceAccum.get(idx) || "";
+                            const deobbed = ob().deobfuscate(accumulated);
+                            let first = true;
+                            for (const eventStr of buffered) {
+                                const dLine = eventStr.split("\n").find((l) => l.startsWith("data: "));
+                                if (dLine) {
+                                    try {
+                                        const dJson = JSON.parse(dLine.slice(6));
+                                        if (Array.isArray(dJson.choices)) {
+                                            for (const c of dJson.choices) {
+                                                if (typeof c.delta?.content === "string") {
+                                                    c.delta.content = first ? deobbed : "";
+                                                    first = false;
+                                                }
+                                            }
+                                            const nonDataLines = eventStr.split("\n").filter((l) => !l.startsWith("data: ")).join("\n");
+                                            const rebuilt = (nonDataLines ? nonDataLines + "\n" : "") + "data: " + JSON.stringify(dJson);
+                                            controller.enqueue(new TextEncoder().encode(rebuilt + "\n\n"));
+                                            continue;
+                                        }
+                                    }
+                                    catch { }
+                                }
+                                controller.enqueue(new TextEncoder().encode(eventStr + "\n\n"));
+                            }
+                        }
+                        if (sseRemainder.trim()) {
+                            controller.enqueue(new TextEncoder().encode(sseRemainder));
+                        }
+                    },
+                });
+                const newBody = response.body.pipeThrough(transform);
+                return new Response(newBody, {
+                    status: response.status,
+                    statusText: response.statusText,
+                    headers: response.headers,
+                });
+            }
+            // JSON response (non-streaming)
+            if (contentType.includes("application/json")) {
+                const text = await response.text();
+                try {
+                    const json = JSON.parse(text);
+                    if (Array.isArray(json.content)) {
+                        for (const block of json.content) {
+                            if (block?.type === "text" && typeof block.text === "string") {
+                                block.text = ob().deobfuscate(block.text);
+                            }
+                        }
+                    }
+                    if (Array.isArray(json.choices)) {
+                        for (const choice of json.choices) {
+                            if (typeof choice.message?.content === "string") {
+                                choice.message.content = ob().deobfuscate(choice.message.content);
+                            }
+                        }
+                    }
+                    return new Response(JSON.stringify(json), {
+                        status: response.status,
+                        statusText: response.statusText,
+                        headers: response.headers,
+                    });
+                }
+                catch {
+                    return new Response(text, {
+                        status: response.status,
+                        statusText: response.statusText,
+                        headers: response.headers,
+                    });
+                }
+            }
+            return response;
+        }
     }
 }

package/dist/index.js

@@ -87,18 +87,14 @@ function patchEventStreamPrototype(logger) {
                 // Try requiring from the file's own directory (no exports restriction from parent)
                 const mod = localRequire("./event-stream.js");
                 EventStream = mod?.EventStream ?? mod?.default?.EventStream;
-                if (EventStream) {
-                    logger?.info(`[shroud] Found EventStream via direct file path: ${candidate}`);
+                if (EventStream)
                     break;
-                }
             }
             catch { /* try next */ }
         }
     }
-    if (!EventStream?.prototype?.push) {
-        logger?.info("[shroud] Could not locate EventStream class — streaming deobfuscation unavailable");
+    if (!EventStream?.prototype?.push)
         return;
-    }
     // Wrap prototype.push with the deobfuscation hook
     const originalPush = EventStream.prototype.push;
     EventStream.prototype.push = function shroudPatchedPush(event) {
@@ -110,7 +106,6 @@ function patchEventStreamPrototype(logger) {
     };
     // Mark as patched to prevent double-wrapping
     globalThis[PATCH_MARKER] = true;
-    logger?.info("[shroud] Patched EventStream.prototype.push — zero-file streaming deobfuscation active");
 }
 export default {
     id: "shroud-privacy",
@@ -160,6 +155,11 @@ export default {
                 };
             },
         });
-        api.logger?.info("[shroud] Plugin loaded — native TypeScript, no proxy required.");
+        // Single load confirmation — used by test harness to verify plugin loaded.
+        // Only logs once per process (suppressed on subsequent agent loads).
+        if (!globalThis.__shroudLoadLogged) {
+            globalThis.__shroudLoadLogged = true;
+            api.logger?.info("[shroud] Plugin loaded.");
+        }
     },
 };

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "shroud-privacy",
   "name": "Shroud",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "Privacy obfuscation with deterministic fake values and deobfuscation — PII never reaches the LLM, tool calls still work",
   "configSchema": {
     "type": "object",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shroud-privacy",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "Privacy obfuscation for AI agents — detects PII and replaces with deterministic fake values before anything reaches the LLM. Works with OpenClaw (plugin) or any agent (APP protocol).",
   "type": "module",
   "main": "dist/index.js",