OpenClaw 防护

You are setting up APort Agent Guardrails for OpenClaw. Follow these steps in order.

Step 1: Check prerequisites

Run these checks. If any fail, tell the user what to install and stop.

CODEBLOCK0
Expected: GNU bash, version 4 or higher.

CODEBLOCK1
Expected: jq-1.x. If missing: brew install jq (macOS) or apt install jq (Linux).

CODEBLOCK2
Expected: OpenClaw found. If not found, tell the user to install OpenClaw first.

Step 2: Install

Ask the user which method they prefer:

Option A — From source (recommended):
CODEBLOCK3

Option B — Via npx:
CODEBLOCK4

Both run the same interactive wizard. Let the user interact with it directly. Do not answer the prompts for them.

The wizard will:

1. 1. Create a local passport file
2. Configure capabilities and limits
3. Register the OpenClaw before_tool_call hook

Expected outcome: Files created under ~/.openclaw/aport/ including passport.json.

Step 3: Verify

CODEBLOCK5
Expected: Exit code 0 (allowed).

CODEBLOCK6
Expected: Exit code 1 (denied).

If both behave as expected, tell the user guardrails are active. All evaluation runs locally — zero network calls by default.

Step 4: Check audit log

CODEBLOCK7
Expected: Shows recent allow/deny decisions from the verification step.

Troubleshooting

If the wizard fails:

• - Check ~/.openclaw/ directory exists and is writable
• Check openclaw plugin list shows aport-guardrail
• Run with DEBUG_APORT=1 prefix for verbose output

If a tool is unexpectedly blocked:

• - Check ~/.openclaw/aport/decision.json for the deny reason

Optional: API mode

Not enabled by default. For teams wanting centralized dashboards, the user sets APORT_API_URL and APORT_AGENT_ID environment variables. Only tool name and action type are sent (never file contents or credentials).

References

• - Source code (Apache 2.0)
• Security Model
• OAP Specification