shroud-privacy 2.2.16 → 2.2.18

package/README.md

@@ -80,6 +80,15 @@ Shroud does not guarantee compliance — regex-based detection has limitations (
 
 > **Requires OpenClaw 2026.3.22 or later.**
 
+### OpenClaw support policy
+
+- **Formal minimum supported version:** `2026.3.24` (from `openclaw.plugin.json` `minOpenClawVersion`).
+- **Release validation matrix (this release):**
+  - **Baseline:** `2026.3.28` (includes WhatsApp E2E path)
+  - **Latest-at-release:** `2026.4.5` (Slack E2E path)
+- **Latest caveat:** on OpenClaw builds where WhatsApp provisioning via `channels add` is unsupported, latest-focused compat runs skip WhatsApp E2E and validate Slack E2E.
+- **Source of truth for current matrix:** `docs/ci-current-state.md` and `CHANGELOG.md`.
+
 ---
 
 ## Install

package/dist/detectors/context.js

@@ -9,6 +9,7 @@
  * 10. Confidence decay by frequency (common words lose confidence)
  */
 import { Category } from "../types.js";
+import { isDocExample } from "./regex.js";
 /**
  * Single-pass multi-string scanner using a combined regex.
  * Replaces per-string indexOf loops with one regex alternation pass — O(M)
@@ -28,6 +29,10 @@ function scanMultiplePatterns(text, values, covered, category, confidence, detec
         const val = m[0];
         const key = `${pos}:${pos + val.length}`;
         if (!covered.has(key)) {
+            if (isDocExample(val, category)) {
+                covered.add(key);
+                continue;
+            }
             covered.add(key);
             results.push({
                 value: val,
@@ -330,6 +335,9 @@ export class ContextDetector {
                     e.category === Category.HOSTNAME)) {
                 // Only learn values that look like identifiers (not too short, not common words)
                 if (e.value.length >= 3 && !COMMON_WORDS.has(e.value.toLowerCase())) {
+                    if (isDocExample(e.value, e.category)) {
+                        continue;
+                    }
                     this._learnedEntities.set(e.value, e.category);
                 }
             }

package/dist/detectors/regex.js

@@ -172,6 +172,17 @@ export function isDocExample(value, category) {
         case Category.HOSTNAME:
             if (DOC_HOSTNAMES.has(value) || DOC_HOSTNAMES.has(value.toUpperCase()))
                 return true;
+            {
+                const lower = value.toLowerCase();
+                for (const d of DOC_DOMAINS) {
+                    if (lower === d || lower.endsWith(`.${d}`))
+                        return true;
+                }
+                for (const d of PUBLIC_DOMAINS) {
+                    if (lower === d || lower.endsWith(`.${d}`))
+                        return true;
+                }
+            }
             for (const pfx of DOC_HOSTNAME_PREFIXES) {
                 if (value.toUpperCase().startsWith(pfx))
                     return true;

package/dist/hooks.js

@@ -179,7 +179,7 @@ export function registerHooks(api, obfuscator) {
     // cannot deobfuscate CGNAT surrogates in outbound channel messages.
     function stripSlackLinksForHook(text) {
         text = text.replace(/<mailto:[^|>]+\|([^>]*)>/g, "$1");
-        text = text.replace(/<https?:\/\/[^|>]+\|([^>]*)>/g, "$1");
+        text = text.replace(/<(https?:\/\/[^|>]+)\|[^>]*>/g, "$1");
         text = text.replace(/<(https?:\/\/[^>]+)>/g, "$1");
         return text;
     }
@@ -225,12 +225,23 @@ export function registerHooks(api, obfuscator) {
     // All hook closures must use the shared obfuscator, not the local parameter.
     // OpenClaw loads the plugin multiple times; only one instance has the mappings.
     const ob = () => getSharedObfuscator(obfuscator);
+    const sessionScope = globalThis;
     const config = ob().config;
     const auditActive = config.auditEnabled || config.verboseLogging;
     // -----------------------------------------------------------------------
     // 1. before_prompt_build (async): obfuscate user prompt
     // -----------------------------------------------------------------------
-    api.on("before_prompt_build", async (event) => {
+    api.on("before_prompt_build", async (event, ctx) => {
+        // Scope mapping and learned-entity state to the OpenClaw session key.
+        // The obfuscator instance is shared globally across plugin instances, so
+        // without this reset independent sessions can contaminate each other.
+        if (typeof ctx?.sessionKey === "string" && ctx.sessionKey) {
+            const prevSessionKey = sessionScope.__shroudLastSessionKey;
+            if (typeof prevSessionKey === "string" && prevSessionKey !== ctx.sessionKey) {
+                ob().reset();
+            }
+            sessionScope.__shroudLastSessionKey = ctx.sessionKey;
+        }
         // Reset tool depth at the start of each turn — tool calls from the
         // previous turn are complete, so the counter should not carry over.
         if (ob().toolDepth > 0) {
@@ -880,7 +891,7 @@ export function registerHooks(api, obfuscator) {
                 // leaking real PII to the LLM.
                 function stripSlackLinks(text) {
                     text = text.replace(/<mailto:[^|>]+\|([^>]*)>/g, "$1");
-                    text = text.replace(/<https?:\/\/[^|>]+\|([^>]*)>/g, "$1");
+                    text = text.replace(/<(https?:\/\/[^|>]+)\|[^>]*>/g, "$1");
                     text = text.replace(/<(https?:\/\/[^>]+)>/g, "$1");
                     return text;
                 }

package/dist/obfuscator.js

@@ -101,8 +101,8 @@ function compressIPv6(addr) {
 function stripSlackLinks(text) {
     // <mailto:X|DISPLAY> → DISPLAY  (email links)
     text = text.replace(/<mailto:[^|>]+\|([^>]*)>/g, "$1");
-    // <URL|DISPLAY> → DISPLAY       (URL links with display text)
-    text = text.replace(/<https?:\/\/[^|>]+\|([^>]*)>/g, "$1");
+    // <URL|DISPLAY> → URL           (preserve real URL for passthrough checks)
+    text = text.replace(/<(https?:\/\/[^|>]+)\|[^>]*>/g, "$1");
     // <URL> → URL                    (bare URL links, no display text)
     text = text.replace(/<(https?:\/\/[^>]+)>/g, "$1");
     return text;

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "shroud-privacy",
   "name": "Shroud",
-  "version": "2.2.12",
+  "version": "2.2.17",
   "description": "Privacy obfuscation with deterministic fake values and deobfuscation — PII never reaches the LLM, tool calls still work",
   "configSchema": {
     "type": "object",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shroud-privacy",
-  "version": "2.2.16",
+  "version": "2.2.18",
   "description": "Privacy and infrastructure protection for AI agents — detects sensitive data (PII, network topology, credentials, OT/SCADA) and replaces with deterministic fakes before anything reaches the LLM.",
   "type": "module",
   "main": "dist/index.js",
@@ -23,7 +23,6 @@
     "test:unit": "vitest run",
     "test:integration": "node tests/harness/run.mjs",
     "test:docker": "bash compat/run-e2e.sh latest",
-    "test:docker:legacy": "bash compat/run-compat.sh latest",
     "test:all": "npm run test:unit && npm run test:integration && npm run test:docker",
     "test:watch": "vitest",
     "lint": "tsc --noEmit",