secr — Secrets management & NHI governance

Package: @secr/openclaw-plugin (npm) Version: 0.1.2 Description: Native OpenClaw plugin — secrets broker, MCP gateway enforcement, and approval flow for OpenClaw agents. Install via `openclaw plugins install npm:@secr/openclaw-plugin` (or `clawhub:secr` once published). The package is an OpenClaw plugin designed for integrating secrets management and governance via the 'secr' platform. Its core function is to broker secrets, enforce external policies (Managed Control Plane/MCP Gateway) on tool calls, and optionally materialize environment variables with authorized secrets. Key functionalities include: 1. **Configuration Management (`state.js`)**: Reads configuration from system paths (`~/.openclaw/openclaw.json`) and resolves agent identity and scope (token, organization, project, environment), often requiring access to local identity files (`./IDENTITY.md`). It lazily initializes connections to the external 'secr' service (OpenClawSecretBroker and McpGateway). 2. **Tool Registration (`tools.js`)**: Exposes three tools for agents: `secr.get_secret` (resolves a secret's existence/length, but redacts the value in chat output), `secr.list_envs` (lists accessible secret keys), and `secr.materialize_env` (injects allowed secrets into `process.env`). 3. **Security Enforcement Hook (`tool-call-hook.js`)**: Registers a `before_tool_call` hook to enforce policies provided by the McpGateway (allow/deny, rate limiting, approval requirements) for all non-internal tools. It uses parameter redaction for auditing and implements a 'fail open' mechanism if gateway initialization fails. It integrates with OpenClaw's native approval UI when required. The code uses standard Node APIs (`fs`, `os`, `path`) for configuration access as expected of a local plugin. All external communication is directed towards the configured 'secr' API. The logic is consistent with its stated purpose of providing secure governance for AI agents.