shroud-privacy 2.5.4 → 2.5.5

package/README.md

@@ -78,14 +78,14 @@ Shroud does not guarantee compliance — regex-based detection has limitations (
 
 > **How it works:** Shroud intercepts ALL outbound LLM API calls (Anthropic, OpenAI, Google, any provider) at the `fetch` level and obfuscates detected entities in every message — including assistant history and Slack `<mailto:>` markup — before it leaves the process. On the response side, SSE streaming is deobfuscated per content block with buffered flushing. Every delivery path (Slack, WhatsApp, TUI, Telegram, Discord, Signal, web) gets real text automatically. Zero host patches required.
 
-> **Requires OpenClaw 2026.3.22 or later.**
+> **Requires OpenClaw 2026.3.24 or later.**
 
 ### OpenClaw support policy
 
 - **Formal minimum supported version:** `2026.3.24` (from `openclaw.plugin.json` `minOpenClawVersion`).
 - **Release validation matrix (this release):**
   - **Baseline:** `2026.3.28` (includes WhatsApp E2E path)
-  - **Latest-at-release:** `2026.4.9` (full 192-scenario E2E pass)
+  - **Latest-at-release:** `2026.4.14` (Slack E2E pass)
 - **Latest caveat:** on OpenClaw builds where WhatsApp provisioning via `channels add` is unsupported, latest-focused compat runs skip WhatsApp E2E and validate Slack E2E.
 - **Source of truth for current matrix:** `docs/ci-current-state.md` and `CHANGELOG.md`.
 
@@ -93,10 +93,10 @@ Shroud does not guarantee compliance — regex-based detection has limitations (
 
 ## Install
 
-### OpenClaw (2026.3.22+)
+### OpenClaw (2026.3.24+)
 
 ```bash
-openclaw --version    # ensure 2026.3.22+
+openclaw --version    # ensure 2026.3.24+
 openclaw plugins install shroud-privacy
 ```
 

package/app-server.mjs

@@ -19,8 +19,9 @@ import { createHash, randomBytes } from "node:crypto";
 import { createInterface } from "node:readline";
 import { pathToFileURL } from "node:url";
 import { resolve, dirname } from "node:path";
-import { writeFileSync, readFileSync } from "node:fs";
+import { writeFileSync, readFileSync, unlinkSync } from "node:fs";
 import { fileURLToPath } from "node:url";
+import { createServer as createNetServer } from "node:net";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const shroudDist = process.argv[2] || resolve(__dirname, "dist");
@@ -424,21 +425,22 @@ const METHODS = {
   setPartition: handleSetPartition,
 };
 
-function dispatch(line) {
+function dispatch(line, writeFn) {
   if (!line.trim()) return;
+  const write = writeFn || ((s) => process.stdout.write(s));
 
   let req;
   try {
     req = JSON.parse(line);
   } catch (e) {
-    process.stdout.write(jsonError(null, ERR_PARSE, `Parse error: ${e.message}`) + "\n");
+    write(jsonError(null, ERR_PARSE, `Parse error: ${e.message}`) + "\n");
     return;
   }
 
   const { id, method, params } = req;
 
   if (id === undefined || id === null || !method) {
-    process.stdout.write(
+    write(
       jsonError(id ?? null, ERR_INVALID_REQ, "Missing required field: id and method") + "\n"
     );
     return;
@@ -446,7 +448,7 @@ function dispatch(line) {
 
   const handler = METHODS[method];
   if (!handler) {
-    process.stdout.write(
+    write(
       jsonError(id, ERR_NO_METHOD, `Method not found: ${method}`) + "\n"
     );
     return;
@@ -459,10 +461,10 @@ function dispatch(line) {
     const response = handler(id, params);
     // shutdown writes its own response and exits
     if (method !== "shutdown") {
-      process.stdout.write(response + "\n");
+      write(response + "\n");
     }
   } catch (e) {
-    process.stdout.write(
+    write(
       jsonError(id, ERR_ENGINE, `Engine error: ${e.message}`) + "\n"
     );
   }
@@ -519,16 +521,83 @@ const handshake = {
 };
 
 process.stderr.write(`[app-server] Starting APP server v${engineVersion}\n`);
-process.stdout.write(JSON.stringify(handshake) + "\n");
 
 // ---------------------------------------------------------------------------
-// Main loop
+// Socket listener mode (--listen <path>)
 // ---------------------------------------------------------------------------
 
-const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
-rl.on("line", dispatch);
-rl.on("close", () => {
-  clearInterval(heartbeatInterval);
-  dumpStats();
-  process.exit(0);
-});
+const listenFlag = process.argv.indexOf("--listen");
+const SOCKET_PATH = listenFlag !== -1 ? (process.argv[listenFlag + 1] || "/tmp/shroud-app.sock") : null;
+
+if (SOCKET_PATH) {
+  // Remove stale socket file
+  try { unlinkSync(SOCKET_PATH); } catch {}
+
+  let socketClients = 0;
+  const socketServer = createNetServer((conn) => {
+    socketClients++;
+    const clientId = socketClients;
+    process.stderr.write(`[app-server] Socket client #${clientId} connected\n`);
+
+    // Send handshake to this client
+    conn.write(JSON.stringify(handshake) + "\n");
+
+    let connected = true;
+    const connRl = createInterface({ input: conn, crlfDelay: Infinity });
+    const connWrite = (s) => { if (connected) try { conn.write(s); } catch {} };
+
+    connRl.on("line", (line) => dispatch(line, connWrite));
+    connRl.on("error", () => {});
+    conn.on("error", () => { connected = false; });
+    conn.on("close", () => {
+      connected = false;
+      process.stderr.write(`[app-server] Socket client #${clientId} disconnected\n`);
+    });
+  });
+
+  socketServer.listen(SOCKET_PATH, () => {
+    process.stderr.write(`[app-server] Listening on socket: ${SOCKET_PATH}\n`);
+  });
+
+  socketServer.on("error", (err) => {
+    process.stderr.write(`[app-server] Socket error: ${err.message}\n`);
+    process.exit(1);
+  });
+
+  // Also still serve stdin for backwards compat
+  process.stdout.write(JSON.stringify(handshake) + "\n");
+  const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
+  rl.on("line", (line) => dispatch(line));
+  rl.on("close", () => {
+    try { unlinkSync(SOCKET_PATH); } catch {}
+    socketServer.close();
+    clearInterval(heartbeatInterval);
+    dumpStats();
+    process.exit(0);
+  });
+
+  // Cleanup socket on exit
+  for (const sig of ["SIGINT", "SIGTERM"]) {
+    process.on(sig, () => {
+      try { unlinkSync(SOCKET_PATH); } catch {}
+      socketServer.close();
+      clearInterval(heartbeatInterval);
+      dumpStats();
+      process.exit(0);
+    });
+  }
+} else {
+  // ---------------------------------------------------------------------------
+  // Default: stdin/stdout mode
+  // ---------------------------------------------------------------------------
+
+  process.stdout.write(JSON.stringify(handshake) + "\n");
+
+  const rl = createInterface({ input: process.stdin, crlfDelay: Infinity });
+  rl.on("line", (line) => dispatch(line));
+  rl.on("close", () => {
+    clearInterval(heartbeatInterval);
+    dumpStats();
+    process.exit(0);
+  });
+}

package/dist/config.d.ts

@@ -11,6 +11,7 @@ import { ShroudConfig } from "./types.js";
  * Priority: env vars > pluginConfig > defaults.
  */
 export declare const STATS_FILE: string;
+export declare const STORE_FILE: string;
 export declare const IS_TEST: boolean;
 export declare function resolveConfig(pluginConfig?: unknown): ShroudConfig;
 /** Validation issue severity. */

package/dist/config.js

@@ -11,6 +11,8 @@ import { randomBytes } from "node:crypto";
  * Priority: env vars > pluginConfig > defaults.
  */
 export const STATS_FILE = process.env.SHROUD_STATS_FILE || "/tmp/shroud-stats.json";
+export const STORE_FILE = process.env.SHROUD_STORE_FILE
+    || ((process.env.HOME || "/root") + "/.openclaw/shroud-store.json");
 export const IS_TEST = process.env.NODE_ENV === "test";
 export function resolveConfig(pluginConfig) {
     const raw = pluginConfig != null && typeof pluginConfig === "object"

package/dist/hooks.js

@@ -21,14 +21,63 @@
  * 8. globalThis.fetch intercept           -- obfuscates requests, deobfuscates responses
  */
 import { createHash, randomBytes } from "node:crypto";
-import { writeFileSync } from "node:fs";
+import { writeFileSync, readFileSync, mkdirSync, statSync } from "node:fs";
 import { BUILTIN_PATTERNS } from "./detectors/regex.js";
-import { STATS_FILE, IS_TEST } from "./config.js";
+import { STATS_FILE, STORE_FILE, IS_TEST } from "./config.js";
 import { DnsCache } from "./dns-cache.js";
 import { FieldScopeResolver } from "./field-scope.js";
+import { dirname } from "node:path";
 function getSharedObfuscator(fallback) {
     return globalThis.__shroudObfuscator || fallback;
 }
+const storeSyncMtime = new WeakMap();
+const SHROUD_REPLY_DISPATCHER_PATCH_MARK = Symbol.for("shroud.replyDispatcherPatched");
+function shouldUseDiskStoreSync() {
+    return !IS_TEST || globalThis.__shroudEnableDiskStoreSync === true;
+}
+function persistStore(ob) {
+    try {
+        if (ob.getStats().storeMappings === 0)
+            return;
+        const data = ob.exportStore();
+        mkdirSync(dirname(STORE_FILE), { recursive: true });
+        writeFileSync(STORE_FILE, JSON.stringify(data) + "\n");
+        try {
+            storeSyncMtime.set(ob, statSync(STORE_FILE).mtimeMs);
+        }
+        catch {
+            storeSyncMtime.delete(ob);
+        }
+    }
+    catch {
+        // best-effort
+    }
+}
+function restoreStore(ob, logger, options) {
+    try {
+        if (!shouldUseDiskStoreSync())
+            return 0;
+        const stat = statSync(STORE_FILE);
+        const lastSync = storeSyncMtime.get(ob);
+        if (!options?.force && lastSync === stat.mtimeMs)
+            return 0;
+        const raw = readFileSync(STORE_FILE, "utf-8");
+        const data = JSON.parse(raw);
+        if (!data || !Array.isArray(data.mappings)) {
+            storeSyncMtime.set(ob, stat.mtimeMs);
+            return 0;
+        }
+        const imported = ob.importStore(data);
+        storeSyncMtime.set(ob, stat.mtimeMs);
+        if (imported > 0 && logger) {
+            logger.info(`[shroud] Restored ${imported} mappings from disk (${STORE_FILE})`);
+        }
+        return imported;
+    }
+    catch {
+        return 0;
+    }
+}
 function dumpStatsFile(fallback) {
     try {
         const ob = getSharedObfuscator(fallback);
@@ -42,6 +91,47 @@ function dumpStatsFile(fallback) {
         // best-effort
     }
 }
+function deobfuscateVisibleReplyPayload(value, deobfuscate) {
+    if (typeof value === "string")
+        return deobfuscate(value);
+    if (Array.isArray(value))
+        return value.map((item) => deobfuscateVisibleReplyPayload(item, deobfuscate));
+    if (!value || typeof value !== "object")
+        return value;
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null)
+        return value;
+    const out = {};
+    for (const [key, entry] of Object.entries(value)) {
+        out[key] = deobfuscateVisibleReplyPayload(entry, deobfuscate);
+    }
+    return out;
+}
+function wrapReplyDispatcherMethod(method, deobfuscate) {
+    if (typeof method !== "function")
+        return method;
+    if (method[SHROUD_REPLY_DISPATCHER_PATCH_MARK])
+        return method;
+    const wrapped = function shroudPatchedReplyDispatcher(payload, ...args) {
+        return method.call(this, deobfuscateVisibleReplyPayload(payload, deobfuscate), ...args);
+    };
+    Object.defineProperty(wrapped, SHROUD_REPLY_DISPATCHER_PATCH_MARK, { value: true });
+    return wrapped;
+}
+function patchReplyDispatcher(dispatcher, deobfuscate) {
+    if (!dispatcher || typeof dispatcher !== "object")
+        return false;
+    let patched = false;
+    for (const key of ["sendBlockReply", "sendFinalReply", "sendToolResult"]) {
+        const method = dispatcher[key];
+        const wrapped = wrapReplyDispatcherMethod(method, deobfuscate);
+        if (wrapped !== method) {
+            dispatcher[key] = wrapped;
+            patched = true;
+        }
+    }
+    return patched;
+}
 // ---------------------------------------------------------------------------
 // Hashing utilities (audit proof hashes)
 // ---------------------------------------------------------------------------
@@ -223,6 +313,9 @@ export function registerHooks(api, obfuscator) {
         else {
             g.__shroudObfuscator = obfuscator;
         }
+        if (isFirstLoad) {
+            restoreStore(obfuscator, api.logger, { force: true });
+        }
         // DNS cache for public URL detection — shared across plugin instances
         if (!g.__shroudDnsCache) {
             const cache = new DnsCache();
@@ -257,6 +350,9 @@ export function registerHooks(api, obfuscator) {
     // OpenClaw loads the plugin multiple times; only one instance has the mappings.
     const ob = () => getSharedObfuscator(obfuscator);
     const sessionScope = globalThis;
+    const syncStore = (force = false, logger) => {
+        restoreStore(ob(), logger, { force });
+    };
     const config = ob().config;
     let _fieldScopeResolver;
     let _fieldScopeConfigRef;
@@ -357,62 +453,80 @@ export function registerHooks(api, obfuscator) {
                 totalEntities += result.entities.length;
             }
         }
-        // Obfuscate ALL messages in-place — seeds the mapping store AND mutates
-        // the message array so PII is replaced before OpenClaw builds the request.
-        // This is critical when the LLM SDK (e.g. OpenAI v6) captures fetch at
-        // construction time, bypassing Shroud's globalThis.fetch intercept.
-        // The fetch intercept is still the primary path for SDKs that use
-        // globalThis.fetch (Anthropic) — double-obfuscation is safe because
-        // already-obfuscated text has no detectable PII entities.
+        // Obfuscate ALL messages via copies so delivery code never sees partially
+        // mutated objects that OpenClaw may still reference elsewhere.
         if (Array.isArray(event?.messages)) {
-            for (const msg of event.messages) {
+            for (let i = 0; i < event.messages.length; i++) {
+                const msg = event.messages[i];
+                let msgCopy = null;
                 // String content (Anthropic/OpenAI)
                 if (typeof msg.content === "string") {
                     const cleaned = stripSlackLinksForHook(msg.content);
                     const result = ob().obfuscate(cleaned, undefined, _exemptCats);
                     totalEntities += result.entities.length;
                     if (result.entities.length > 0 || cleaned !== msg.content) {
-                        msg.content = result.entities.length > 0 ? result.obfuscated : cleaned;
+                        msgCopy = { ...msg, content: result.entities.length > 0 ? result.obfuscated : cleaned };
                     }
                 }
                 // Array content blocks
                 else if (Array.isArray(msg.content)) {
-                    for (const b of msg.content) {
-                        if (b?.type === "text" && typeof b.text === "string") {
+                    let blockChanged = false;
+                    const newBlocks = msg.content.map((b) => {
+                        if (!b || typeof b !== "object")
+                            return b;
+                        let newBlock = b;
+                        if (b.type === "text" && typeof b.text === "string") {
                             const cleaned = stripSlackLinksForHook(b.text);
                             const result = ob().obfuscate(cleaned, undefined, _exemptCats);
                             totalEntities += result.entities.length;
                             if (result.entities.length > 0 || cleaned !== b.text) {
-                                b.text = result.entities.length > 0 ? result.obfuscated : cleaned;
+                                newBlock = { ...newBlock, text: result.entities.length > 0 ? result.obfuscated : cleaned };
+                                blockChanged = true;
                             }
                         }
                         // tool_result blocks with string content
-                        if (typeof b?.content === "string") {
+                        if (typeof b.content === "string") {
                             const cleaned = stripSlackLinksForHook(b.content);
                             const result = ob().obfuscate(cleaned, undefined, _exemptCats);
                             totalEntities += result.entities.length;
                             if (result.entities.length > 0 || cleaned !== b.content) {
-                                b.content = result.entities.length > 0 ? result.obfuscated : cleaned;
+                                newBlock = { ...newBlock, content: result.entities.length > 0 ? result.obfuscated : cleaned };
+                                blockChanged = true;
                             }
                         }
+                        return newBlock;
+                    });
+                    if (blockChanged) {
+                        msgCopy = { ...msg, content: newBlocks };
                     }
                 }
                 // OpenAI tool_calls in assistant messages
                 if (Array.isArray(msg.tool_calls)) {
-                    for (const tc of msg.tool_calls) {
+                    let tcChanged = false;
+                    const newToolCalls = msg.tool_calls.map((tc) => {
                         if (typeof tc.function?.arguments === "string") {
                             const result = ob().obfuscate(tc.function.arguments, undefined, _exemptCats);
                             totalEntities += result.entities.length;
-                            if (result.entities.length > 0)
-                                tc.function.arguments = result.obfuscated;
+                            if (result.entities.length > 0) {
+                                tcChanged = true;
+                                return { ...tc, function: { ...tc.function, arguments: result.obfuscated } };
+                            }
                         }
+                        return tc;
+                    });
+                    if (tcChanged) {
+                        msgCopy = msgCopy ? { ...msgCopy, tool_calls: newToolCalls } : { ...msg, tool_calls: newToolCalls };
                     }
                 }
+                if (msgCopy) {
+                    event.messages[i] = msgCopy;
+                }
             }
         }
         if (totalEntities === 0)
             return;
         dumpStatsFile(obfuscator);
+        persistStore(ob());
         api.logger?.info(`[shroud] before_prompt_build: obfuscated ${totalEntities} entities (mappings synced)`);
         return obfuscatedPrompt ? { systemPrompt: obfuscatedPrompt } : undefined;
     });
@@ -434,41 +548,45 @@ export function registerHooks(api, obfuscator) {
         const role = msg.role ?? "";
         // --- Assistant messages: DEOBFUSCATE (fakes → real values) ---
         if (role === "assistant") {
+            syncStore();
             const _raw = typeof msg.content === "string" ? msg.content :
                 Array.isArray(msg.content) ? msg.content.map((b) => b?.text || "").join("") : "";
             if (_raw.length < 500)
                 api.logger?.info(`[shroud][raw-assistant] ${_raw}`);
             if (typeof msg.content === "string") {
                 const { text: deobfuscated, replacementCount } = ob().deobfuscateWithStats(msg.content);
-                if (deobfuscated === msg.content)
-                    return;
-                api.logger?.info("[shroud] before_message_write: deobfuscated assistant message");
-                if (auditActive && replacementCount > 0) {
-                    try {
-                        emitDeobfuscationAudit(api.logger, config, randomBytes(8).toString("hex"), replacementCount);
+                if (replacementCount > 0) {
+                    api.logger?.info("[shroud] before_message_write: deobfuscated assistant message");
+                    if (auditActive) {
+                        try {
+                            emitDeobfuscationAudit(api.logger, config, randomBytes(8).toString("hex"), replacementCount);
+                        }
+                        catch { }
                     }
-                    catch { }
+                    dumpStatsFile(obfuscator);
                 }
-                dumpStatsFile(obfuscator);
                 return { message: { ...msg, content: deobfuscated } };
             }
             if (Array.isArray(msg.content)) {
                 let changed = false;
+                let deobCount = 0;
                 const newContent = msg.content.map((block) => {
                     if (block && typeof block === "object") {
                         // Handle blocks with .text (text content blocks)
                         if (typeof block.text === "string") {
-                            const deobfuscated = ob().deobfuscate(block.text);
+                            const { text: deobfuscated, replacementCount } = ob().deobfuscateWithStats(block.text);
                             if (deobfuscated !== block.text) {
                                 changed = true;
+                                deobCount += replacementCount;
                                 return { ...block, text: deobfuscated };
                             }
                         }
                         // Handle blocks with .content as string (tool_result blocks)
                         if (typeof block.content === "string") {
-                            const deobfuscated = ob().deobfuscate(block.content);
+                            const { text: deobfuscated, replacementCount } = ob().deobfuscateWithStats(block.content);
                             if (deobfuscated !== block.content) {
                                 changed = true;
+                                deobCount += replacementCount;
                                 return { ...block, content: deobfuscated };
                             }
                         }
@@ -477,9 +595,10 @@ export function registerHooks(api, obfuscator) {
                             let innerChanged = false;
                             const newInner = block.content.map((inner) => {
                                 if (inner && typeof inner === "object" && typeof inner.text === "string") {
-                                    const deobfuscated = ob().deobfuscate(inner.text);
+                                    const { text: deobfuscated, replacementCount } = ob().deobfuscateWithStats(inner.text);
                                     if (deobfuscated !== inner.text) {
                                         innerChanged = true;
+                                        deobCount += replacementCount;
                                         return { ...inner, text: deobfuscated };
                                     }
                                 }
@@ -493,13 +612,13 @@ export function registerHooks(api, obfuscator) {
                     }
                     return block;
                 });
-                if (!changed)
-                    return;
-                api.logger?.info("[shroud] before_message_write: deobfuscated assistant blocks");
-                dumpStatsFile(obfuscator);
-                return { message: { ...msg, content: newContent } };
+                if (deobCount > 0) {
+                    api.logger?.info("[shroud] before_message_write: deobfuscated assistant blocks");
+                    dumpStatsFile(obfuscator);
+                }
+                return { message: { ...msg, content: changed ? newContent : msg.content.map((b) => ({ ...b })) } };
             }
-            return;
+            return { message: { ...msg } };
         }
         // --- Non-assistant messages: OBFUSCATE (real values → fakes) ---
         if (typeof msg.content === "string") {
@@ -507,6 +626,7 @@ export function registerHooks(api, obfuscator) {
             if (result.entities.length === 0)
                 return;
             dumpStatsFile(obfuscator);
+            persistStore(ob());
             if (auditActive) {
                 try {
                     emitObfuscationAudit(api.logger, config, randomBytes(8).toString("hex"), result, msg.content, result.obfuscated);
@@ -566,6 +686,7 @@ export function registerHooks(api, obfuscator) {
             if (!changed)
                 return;
             dumpStatsFile(obfuscator);
+            persistStore(ob());
             if (auditActive) {
                 for (const result of allResults) {
                     try {
@@ -582,6 +703,7 @@ export function registerHooks(api, obfuscator) {
     // 3. before_tool_call (async): deobfuscate tool params + track depth
     // -----------------------------------------------------------------------
     api.on("before_tool_call", async (event) => {
+        syncStore();
         if (!event?.params || typeof event.params !== "object")
             return;
         // Block the message tool for send actions. The gateway auto-delivers
@@ -632,6 +754,7 @@ export function registerHooks(api, obfuscator) {
             return result.obfuscated;
         }, shouldScan);
         dumpStatsFile(obfuscator);
+        persistStore(ob());
         return { message: obfuscated };
     });
     // -----------------------------------------------------------------------
@@ -640,6 +763,7 @@ export function registerHooks(api, obfuscator) {
     //    sends blocks in the first call, text in the second).
     // -----------------------------------------------------------------------
     api.on("message_sending", async (event) => {
+        syncStore();
         if (!event?.content)
             return;
         // String content — direct deobfuscation.
@@ -685,6 +809,10 @@ export function registerHooks(api, obfuscator) {
             return { content: newContent };
         }
     });
+    api.on("reply_dispatch", (_event, ctx) => {
+        syncStore();
+        patchReplyDispatcher(ctx?.dispatcher, (text) => ob().deobfuscate(text));
+    });
     // -----------------------------------------------------------------------
     // Tool: shroud-stats — rulebase view with hit counters
     // -----------------------------------------------------------------------
@@ -741,26 +869,62 @@ export function registerHooks(api, obfuscator) {
     // overflow chunks. Partial fakes may briefly appear during streaming
     // but the final message will be correct.
     const SHROUD_BUF = Symbol("shroudStreamBuf");
+    const deobfuscateStreamTarget = (target) => {
+        if (!target || typeof target !== "object")
+            return;
+        if (typeof target.content === "string") {
+            const { text: deob } = ob().deobfuscateWithStats(target.content);
+            target.content = deob;
+            return;
+        }
+        if (!Array.isArray(target.content))
+            return;
+        for (const block of target.content) {
+            if (!block || typeof block !== "object")
+                continue;
+            if (typeof block.text === "string") {
+                const { text: deob } = ob().deobfuscateWithStats(block.text);
+                block.text = deob;
+            }
+            if (typeof block.content === "string") {
+                const { text: deob } = ob().deobfuscateWithStats(block.content);
+                block.content = deob;
+            }
+            if (Array.isArray(block.content)) {
+                for (const inner of block.content) {
+                    if (!inner || typeof inner !== "object" || typeof inner.text !== "string")
+                        continue;
+                    const { text: deob } = ob().deobfuscateWithStats(inner.text);
+                    inner.text = deob;
+                }
+            }
+        }
+    };
     globalThis.__shroudStreamDeobfuscate = (stream, event) => {
-        // Streaming event hook — called by patched EventStream.prototype.push().
-        // Text deltas pass through unchanged (deobfuscation happens at the fetch
-        // response level via per-block SSE flushing). The message_end handler
-        // deobfuscates content blocks as a defense-in-depth measure.
-        const isTextDelta = event.type === "text_delta";
-        const isMessageUpdateTextDelta = event.type === "message_update" &&
-            event.assistantMessageEvent?.type === "text_delta";
-        if (isTextDelta || isMessageUpdateTextDelta) {
-            // Pass through text_delta events unchanged.
+        const eventTextType = event.type === "message_update"
+            ? event.assistantMessageEvent?.type
+            : event.type;
+        const isTextPhaseUpdate = eventTextType === "text_start" ||
+            eventTextType === "text_delta" ||
+            eventTextType === "text_end";
+        if (isTextPhaseUpdate) {
             let buf = stream[SHROUD_BUF];
             if (!buf) {
                 buf = { raw: "", deobCount: 0 };
                 stream[SHROUD_BUF] = buf;
             }
-            const src = isMessageUpdateTextDelta ? event.assistantMessageEvent : event;
+            const src = event.type === "message_update" ? event.assistantMessageEvent : event;
             const chunk = typeof src.delta === "string" ? src.delta
                 : typeof src.text === "string" ? src.text : "";
             if (chunk)
                 buf.raw += chunk;
+            const targets = [
+                event.partial, event.message,
+                event.assistantMessageEvent?.partial,
+                event.assistantMessageEvent?.message,
+            ];
+            for (const target of targets)
+                deobfuscateStreamTarget(target);
             return event;
         }
         // On message_end/done: deobfuscate content blocks in the final message.
@@ -772,23 +936,14 @@ export function registerHooks(api, obfuscator) {
             event.type === "error" || event.type === "agent_end" ||
             (event.type === "message_update" && (event.assistantMessageEvent?.type === "text_end"));
         if (isEnd) {
+            syncStore();
             const targets = [
                 event.message, event.partial,
                 event.assistantMessageEvent?.partial,
                 event.assistantMessageEvent?.message,
             ];
-            for (const target of targets) {
-                if (target?.content && Array.isArray(target.content)) {
-                    for (const block of target.content) {
-                        if (block?.type === "text" && typeof block.text === "string") {
-                            const deob = ob().deobfuscate(block.text);
-                            if (deob !== block.text) {
-                                block.text = deob;
-                            }
-                        }
-                    }
-                }
-            }
+            for (const target of targets)
+                deobfuscateStreamTarget(target);
             dumpStatsFile(obfuscator);
             delete stream[SHROUD_BUF];
         }
@@ -801,6 +956,7 @@ export function registerHooks(api, obfuscator) {
     //    globalThis.__shroudDeobfuscate(text) directly.
     // -----------------------------------------------------------------------
     globalThis.__shroudDeobfuscate = (text) => {
+        syncStore();
         if (typeof text !== "string")
             return text;
         return ob().deobfuscate(text);
@@ -915,6 +1071,7 @@ export function registerHooks(api, obfuscator) {
                             : null;
                 if (!messageArray) {
                     if (modified) {
+                        persistStore(ob());
                         const newBody = JSON.stringify(body);
                         return originalFetch.call(globalThis, input, { ...init, body: newBody });
                     }
@@ -1039,6 +1196,7 @@ export function registerHooks(api, obfuscator) {
                     }
                 }
                 if (modified) {
+                    persistStore(ob());
                     const newBody = JSON.stringify(body);
                     const newInit = { ...init, body: newBody };
                     // Update content-length if present

package/dist/obfuscator.d.ts

@@ -5,6 +5,7 @@
  * tool_result_persist hook which is sync-only.
  */
 import { DetectedEntity, ObfuscationResult, ShroudConfig } from "./types.js";
+import { SerializedStore } from "./store.js";
 import { BaseDetector } from "./detectors/base.js";
 export declare class Obfuscator {
     config: ShroudConfig;
@@ -95,6 +96,10 @@ export declare class Obfuscator {
     maxFakeLength(): number;
     /** Return stats from audit logger and store. */
     getStats(): object;
+    /** Export the mapping store for persistence across restarts. */
+    exportStore(): SerializedStore;
+    /** Import mappings from a persisted store. Returns count of new mappings added. */
+    importStore(data: SerializedStore): number;
 }
 /** Remove overlapping entities, keeping higher confidence ones. */
 export declare function resolveOverlaps(entities: DetectedEntity[]): DetectedEntity[];

package/dist/obfuscator.js

@@ -852,6 +852,16 @@ export class Obfuscator {
         };
         return stats;
     }
+    /** Export the mapping store for persistence across restarts. */
+    exportStore() {
+        return this._store.export(this._mapping.salt);
+    }
+    /** Import mappings from a persisted store. Returns count of new mappings added. */
+    importStore(data) {
+        const before = this._store.size();
+        this._store.import(data);
+        return this._store.size() - before;
+    }
 }
 /** Remove overlapping entities, keeping higher confidence ones. */
 export function resolveOverlaps(entities) {

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "shroud-privacy",
   "name": "Shroud",
-  "version": "2.5.4",
+  "version": "2.5.5",
   "description": "Privacy obfuscation with deterministic fake values and deobfuscation — PII never reaches the LLM, tool calls still work",
   "configSchema": {
     "type": "object",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shroud-privacy",
-  "version": "2.5.4",
+  "version": "2.5.5",
   "description": "Privacy and infrastructure protection for AI agents — detects sensitive data (PII, network topology, credentials, OT/SCADA) and replaces with deterministic fakes before anything reaches the LLM.",
   "type": "module",
   "main": "dist/index.js",