Lensmor Gateway

Controlled Lensmor OpenClaw native gateway plugin for trade show intelligence workflows.

Tools

lensmor_cli — executes guarded Lensmor API actions through a relative-path allowlist and server-side precheck.
lensmor_upload_file — uploads generated result content only; it does not read local file paths.

Requires LENSMOR_BASE_URL and LENSMOR_API_KEY from the host runtime environment.
LENSMOR_BASE_URL must be HTTPS and must not point to localhost, private IP ranges, or internal hostnames.
Model-facing API calls must use relative paths and pass the Lensmor route allowlist.
Explicit unlock actions require user approval before execution.
Bounded metered usage actions may run without an approval prompt only after Lensmor precheck returns allowed=true and their credit cost is at or below maxAutoApprovedMeteredCredits (default 100). Set the limit to 0 to require approval for all chargeable metered actions.
Uploads accept only generated string content with safe basenames and .csv, .json, .md, or .txt extensions.
Upload PUT/sign URLs returned by Lensmor must be HTTPS and must not point to localhost, private IP ranges, or internal hostnames.
The plugin does not shell out, execute user-provided commands, read arbitrary local files, inspect browser data, or access Slack tokens.

npm test
npm pack --dry-run