Rule Guard

README

# OpenClaw Rule Guard

A tiny OpenClaw plugin that loads a user-maintained Markdown rule file and injects its active rules before every model turn.

It deliberately does **one thing only**: prompt injection. It does not call a second model, rewrite replies, cache judgments, or pretend prompt rules are a security boundary.

## Why

Personal assistants often need stable preferences such as response language, verification standards, or operating boundaries. Keeping those preferences in a standalone file makes them editable without changing the agent configuration or restarting the gateway.

## How it works

```text
rules.md
   │ read fresh for each turn
   ▼
marker extraction → disabled-line filtering → prompt injection → model response
                                                   │
                                                   └─ local metadata-only JSONL log
```

1. OpenClaw fires `before_prompt_build`.
2. The plugin reads the configured Markdown file.
3. Text before `<!-- rules:start -->` is ignored.
4. Lines containing `<!-- off -->` are excluded.
5. Remaining text is returned as `prependSystemContext` by default.

Reading the file on every turn is intentional: saving a rule makes it effective on the next turn, with no watcher, cache, or restart.

## Install

Copy `index.js` and `openclaw.plugin.json` into an OpenClaw plugin directory, then configure the plugin if you do not want the defaults. Copy `rules.example.md` to `~/.openclaw/rules.md` and edit it.

Defaults:

| Setting | Default |
|---|---|
| `rulesPath` | `~/.openclaw/rules.md` |
| `rulesMarker` | `<!-- rules:start -->` |
| `injectAs` | `prependSystemContext` |
| `logPath` | `~/.openclaw/logs/rule-guard.log` |

## Rule file format

```md
# Notes for humans; not injected

<!-- rules:start -->

- Lead with the conclusion.
- Clearly label uncertainty.
- Temporarily disabled rule. <!-- off -->
```

## Privacy and security

- No personal rule file, host name, account ID, session key, agent ID, credential, or production log is included in this repository.
- Logs contain only timestamp, outcome, active-rule count, injected character count, and injection position.
- Rule content is sent to the configured model provider as part of the prompt. Do not put secrets in the rule file.
- Prompt instructions are soft constraints, not access control. Use permissions, allowlists, sandboxing, and deterministic validation for hard guarantees.
- A malicious or conflicting prompt may override a rule. This plugin does not claim otherwise.

## Design history

The first internal design used a second model call to judge every answer and sometimes rewrite it. That architecture was removed because it increased latency and token use, could not reliably inspect media, risked mixing context across concurrent sessions, and could make delivered replies differ from conversation history.

Version 1.0 keeps the useful primitive and deletes the risky machinery:

```text
Before: generate → judge → maybe rewrite → send
Now:    inject rules → generate → send
```

The trade-off is explicit: simpler and consistent, but not enforcement.

## Test

Requires a current Node.js release. No dependencies are installed.

```sh
npm test
```

## License

MIT

Chinese documentation: [README.zh-CN.md](README.zh-CN.md)