# @atbash/openclaw

OpenClaw plugin that gates every tool call against the ATBASH policy service. A thin adapter on top of [`@atbash/sdk`](https://www.npmjs.com/package/@atbash/sdk) — the SDK does the audit pipeline, this package wires it into OpenClaw's `before_tool_call` hook.

If you're not using OpenClaw and want to use ATBASH from your own code, install the SDK directly.

## Install

```bash
openclaw plugins install @atbash/openclaw
```

The plugin signs audit transactions locally with your agent's secp256k1 private key. The key never leaves your machine; only signed bytes plus the corresponding public key are transmitted.

## Get an agent key

The plugin reads from `~/.config/atbash/guard-client-key` by default. The file is JSON:

```json
{
  "privKey": "your-hex-private-key-64-chars",
  "pubKey":  "your-hex-public-key-66-chars"
}
```

…or `key=value`:

```
privkey=your-hex-private-key-64-chars
pubkey=your-hex-public-key-66-chars
```

Contact the ATBASH team to register an agent and obtain a key pair.

## Configure it in OpenClaw

Open `~/.openclaw/openclaw.json` and add:

```json
{
  "plugins": {
      "allow": [
      "openclaw"
    ],
    "load": {
      "paths": [
        "/Users/<your-username>/.openclaw/extensions/openclaw"
      ]
    },
    "entries": {
      "openclaw": {
        "enabled": true,
        "config": {
          "enabled": true,
          "enforceDecision": true,
          "chromiaSecretPath": "~/.config/atbash/guard-client-key"
        },
        "hooks": {
          "allowConversationAccess": true,
          "allowPromptInjection": true
      }
      }
    }
  }
}
```

### Config fields

| Field | Type | Default | What it does |
|---|---|---|---|
| `enabled` | bool | `true` | Master switch. `false` = plugin returns immediately. |
| `enforceDecision` | bool | `true` | Surfaced to logs. The plugin always blocks on `BLOCK`. |
| `chromiaSecretPath` | string | `~/.config/atbash/guard-client-key` | Path to the agent key file. Supports `~/`. |
| `debug` | bool | `false` | Reserved. No-op today. |

## Updating

```bash
openclaw plugins update @atbash/openclaw
```

## Uninstalling

```bash
openclaw plugins uninstall @atbash/openclaw
```

The agent key file at `~/.config/atbash/guard-client-key` is **not** removed — delete it manually if you want to retire the agent identity.

## Secret redaction

Before each tool call is sent to the judge, the underlying [`@atbash/sdk`](https://www.npmjs.com/package/@atbash/sdk) scans the args and context for secret-shaped values and replaces matches with `[REDACTED:<kind>]`. Redaction is client-side and happens **before signing**, so secrets never reach the signed bytes, the request body, the on-chain log, or the AI provider.

When the redactor fires, OpenClaw will surface a warning like:

```
[atbash] redacted secrets before judge call { tool: "exec", count: 2, kinds: ["anthropic", "generic_token"] }
```

The `kinds` field shows which patterns matched. `anthropic` / `openai` / `aws_access_key` / `jwt` / etc. indicate real vendor secrets. `generic_token` is a catch-all for long random-looking strings — it can also match UUIDs and content hashes; the judge still gets enough context to evaluate the action, but worth knowing if you see it unexpectedly.

The agent's own tool execution is unaffected — only the data sent to the judge is scrubbed. Full kind list and behaviour reference: see the [SDK README](https://www.npmjs.com/package/@atbash/sdk).

## Troubleshooting

**Tool calls aren't being audited.**
Check `enabled: true` is set both on the entry (`plugins.entries.openclaw.enabled`) and inside `config` (`config.enabled`).

**Every tool call is blocked, even safe ones.**
The plugin is fail-closed: any pipeline error blocks. Look for `[atbash] …` warnings in the OpenClaw log. Most often: missing key, expired key, or restricted egress.

## License

Proprietary — all rights reserved. See [LICENSE](https://atbash.ai/license). Commercial licensing inquiries: contact the Atbash team.