claw-guard

# ClawGuard — Task & Gateway Watchdog

A lightweight service that monitors **registered** events:

1. **Sub-agent task PIDs** — if PID dies → notify and remove. If log/dir stale → alert and remove.
2. **Gateway restarts** — if restart fails → revert config backups (newest to oldest) → retry → notify.

**ClawGuard only monitors what is explicitly registered.** It does not auto-discover.

## Install

```bash
cd <skill-dir>
bash scripts/install.sh
```

Installs:
- **Daemon**: systemd user service (Linux) or launchd agent (macOS) — `Restart=always`, auto-starts on boot
- **CLI**: `claw-guard` in `~/.local/bin/`
- **Data**: `~/.openclaw/workspace/tools/claw-guard/`

## OpenClaw Integration (Recommended)

### 1. Auto-register gateway restarts

Add `ExecStartPre` to your gateway service so every restart (manual, crash, or `Restart=always`) is automatically registered:

```ini
# ~/.config/systemd/user/openclaw-gateway.service
[Service]
ExecStartPre=/home/<user>/.local/bin/claw-guard register-restart
ExecStart=...
```

Then reload: `systemctl --user daemon-reload`

Now every gateway restart automatically:
- Snapshots the current config (rotates up to 5 backups)
- Watches for the gateway to come back
- If it fails → reverts config backups newest-to-oldest → notifies default channel

**No manual `claw-guard register-restart` needed — systemd handles it.**

### 2. Add task execution rules to AGENTS.md

Add these rules so the agent always registers its work:

```markdown
## Task Execution Rules (MANDATORY)

### Sub-agent requirement
- **Any exec/tool call that might take >5s → sub-agent** (`sessions_spawn`).
  Main agent stays responsive.
- **Complex or unpredictable tasks → always sub-agent.** Even if they might
  be fast. If you can't guarantee it won't block, delegate it.
- **Only run in main agent** if certain it won't block I/O (quick file reads,
  short `grep`, `git status`, `claw-guard status`, etc.)

### ClawGuard registration (MANDATORY for all sub-agents)
Every sub-age...