install.ps1

# OpenClaw Guardian Safety Agent — Install Script (Windows)
# Usage: .\install.ps1 -OpenClawRoot C:\path\to\openclaw

param(
    [Parameter(Mandatory=$true)]
    [string]$OpenClawRoot
)

$ErrorActionPreference = "Stop"
$ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$PatchDir = $ScriptDir

# Resolve to absolute path.
$OpenClawRoot = Resolve-Path $OpenClawRoot

if (-not (Test-Path "$OpenClawRoot\package.json")) {
    Write-Error "Error: $OpenClawRoot does not look like an OpenClaw repo (package.json not found)"
    exit 1
}

if (-not (Test-Path "$OpenClawRoot\src\security")) {
    Write-Error "Error: $OpenClawRoot\src\security not found. Is this a valid OpenClaw source tree?"
    exit 1
}

Write-Host "=== OpenClaw Guardian Safety Agent - Install ===" -ForegroundColor Cyan
Write-Host "Target: $OpenClawRoot"
Write-Host ""

# --- Step 1: Copy new files ---
Write-Host "[1/3] Copying new guardian files..." -ForegroundColor Yellow

$NewFiles = @(
    "src\security\guardian-types.ts",
    "src\security\guardian-agent.ts",
    "src\security\guardian-audit.ts",
    "src\security\guardian-risk.ts",
    "src\security\guardian-agent.test.ts",
    "src\security\guardian-audit.test.ts",
    "src\security\guardian-config.test.ts",
    "src\security\guardian-hook.test.ts",
    "src\security\guardian-risk.test.ts",
    "src\security\guardian-scenario.test.ts"
)

foreach ($f in $NewFiles) {
    $dest = Join-Path $OpenClawRoot $f
    $src = Join-Path $PatchDir "files\$f"

    if (Test-Path $dest) {
        Write-Host "  Warning: $f already exists, backing up to $f.bak" -ForegroundColor DarkYellow
        Copy-Item $dest "$dest.bak" -Force
    }

    Copy-Item $src $dest -Force
    Write-Host "  + $f" -ForegroundColor Green
}

# --- Step 2: Apply patches to modified files ---
Write-Host ""
Write-Host "[2/3] Applying patches to existing files..." -ForegroundColor Yellow

$PatchFile = Join-Path $PatchDir "patches\modified-files.patch"
if (-not (Test-Path $PatchFile)) {
    Write-Error "Error: Patch file not found: $PatchFile"
    exit 1
}

Push-Location $OpenClawRoot
try {
    # Check if git is available and this is a git repo.
    $gitAvailable = $false
    try {
        git rev-parse --git-dir 2>$null | Out-Null
        $gitAvailable = $LASTEXITCODE -eq 0
    } catch {
        $gitAvailable = $false
    }

    if ($gitAvailable) {
        git apply --check $PatchFile 2>$null
        if ($LASTEXITCODE -eq 0) {
            git apply $PatchFile
            Write-Host "  Applied via git apply" -ForegroundColor Green
        } else {
            Write-Host "  git apply --check failed. Trying with --3way..." -ForegroundColor DarkYellow
            git apply --3way $PatchFile 2>$null
            if ($LASTEXITCODE -eq 0) {
                Write-Host "  Applied via git apply --3way" -ForegroundColor Green
            } else {
                Write-Error @"
Error: Patch cannot be applied cleanly.
Your OpenClaw version may be incompatible, or the patch is already applied.
Try applying manually: cd $OpenClawRoot; git apply --reject $PatchFile
"@
                exit 1
            }
        }
    } else {
        Write-Error "Error: Git is not available or this is not a git repository. Git is required for patch application."
        exit 1
    }
} finally {
    Pop-Location
}

# --- Step 3: Verify ---
Write-Host ""
Write-Host "[3/3] Verifying installation..." -ForegroundColor Yellow

$VerifyFiles = @(
    "src\security\guardian-types.ts",
    "src\security\guardian-agent.ts",
    "src\security\guardian-audit.ts",
    "src\security\guardian-risk.ts"
)

$AllOk = $true
foreach ($f in $VerifyFiles) {
    if (Test-Path (Join-Path $OpenClawRoot $f)) {
        Write-Host "  OK: $f" -ForegroundColor Green
    } else {
        Write-Host "  MISSING: $f" -ForegroundColor Red
        $AllOk = $false
    }
}

$hookFile = Join-Path $OpenClawRoot "src\agents\pi-tools.before-tool-call.ts"
if ((Get-Content $hookFile -Raw) -match "requiresGuardianReview") {
    Write-Host "  OK: Guardian hook integration detected" -ForegroundColor Green
} else {
    Write-Host "  WARNING: Guardian hook integration not detected" -ForegroundColor Red
    $AllOk = $false
}

$configFile = Join-Path $OpenClawRoot "src\config\types.openclaw.ts"
if ((Get-Content $configFile -Raw) -match "SafetyConfig") {
    Write-Host "  OK: SafetyConfig type detected" -ForegroundColor Green
} else {
    Write-Host "  WARNING: SafetyConfig not detected" -ForegroundColor Red
    $AllOk = $false
}

Write-Host ""
if ($AllOk) {
    Write-Host "=== Installation complete! ===" -ForegroundColor Green
    Write-Host ""
    Write-Host "To enable the guardian, add to your openclaw.json:" -ForegroundColor Cyan
    Write-Host @"
  {
    "safety": {
      "guardian": {
        "enabled": true,
        "model": "openrouter/qwen/qwen3-32b"
      }
    }
  }
"@
    Write-Host ""
    Write-Host "To run guardian tests:" -ForegroundColor Cyan
    Write-Host "  cd $OpenClawRoot; npx vitest run src/security/guardian-"
} else {
    Write-Host "=== Installation completed with warnings. Please check the output above. ===" -ForegroundColor Yellow
}