Illia Polosukhin 32bfd24154 Add WASM sandbox secure API extension ...

Extends the WASM sandbox with HTTP API capabilities, secrets management,
tool aliasing, and leak detection. Key security principle: WASM never
sees credentials, injection happens at host boundary.

New modules:
- secrets: AES-256-GCM encrypted storage with HKDF key derivation
- leak_detector: Aho-Corasick + regex pattern matching for secret exfiltration
- capabilities: Extended capability system (HTTP, ToolInvoke, Secrets)
- allowlist: HTTP endpoint validation with glob patterns
- credential_injector: Host-boundary credential injection
- rate_limiter: Sliding window per-tool rate limiting
- storage: WASM binary storage with BLAKE3 integrity verification

Leak detection happens at two points:
1. Before HTTP request (prevents exfiltration via URL/headers/body)
2. After response (prevents exposure in outputs returned to WASM)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

2026-02-02 23:22:52 -08:00

migrations

…

src

…

tests

…

wit

…

.env.example

…

.gitignore

…

Cargo.lock

…

Cargo.toml

…

CLAUDE.md

…

Description

IronClaw is OpenClaw inspired implementation in Rust focused on privacy and security IronClaw 基于一个简单的原则：你的 AI 助手应该为你服务，而不是与你为敌。

1.8 GiB

Languages

Rust 86%

Python 7.5%

JavaScript 3.4%

Shell 1.9%

CSS 0.9%

Other 0.2%