# shamash-openclaw (pip)

Python package wrapper that installs the OpenClaw Shamash plugin and a bundled platform-compatible Shamash binary.

## Install

```bash
pip install shamash-openclaw
```

## One-command setup

```bash
shamash-openclaw-setup
```

This command:

1. Verifies `~/.openclaw/` exists.
2. Copies plugin assets into `~/.openclaw/plugins/shamash-openclaw/`.
3. Installs a bundled platform-appropriate `shamash` binary into `bin/shamash`.
4. Registers plugin load path in `~/.openclaw/openclaw.json`.

## Recommended config hardening

Set explicit plugin/tool restrictions in `~/.openclaw/openclaw.json`:

```json
{
  "plugins": {
    "allow": ["shamash-openclaw"]
  },
  "tools": {
    "deny": ["web_fetch"]
  }
}
```

Why both settings are required:

- `plugins.allow` prevents rogue plugins from loading and registering competing hooks.
- `tools.deny: ["web_fetch"]` forces web retrieval through `shamash_fetch`, so Gate 2 scanning cannot be bypassed by direct `web_fetch` use.

## Verify

After restarting OpenClaw:

- Run `/shamash` in chat and confirm plugin status appears.
- Check logs for `Shamash 4-gate firewall active`.

## Notes

- Bundled binaries are currently shipped for darwin/linux x64+arm64; unsupported platforms require manual `binaryPath` override.
- If bundled binary install fails, set `plugins.config.shamash-openclaw.binaryPath` manually.
- For detailed plugin configuration, see `integrations/openclaw/README.md`.
