Inside Clawdius.

// 30+ patterns. Here's a taste.
const CREDENTIAL_PATTERNS = [
  { name: 'aws_access_key',    regex: /AKIA[0-9A-Z]{16}/ },
  { name: 'anthropic_key',     regex: /sk-ant-[a-zA-Z0-9_-]{20,}/ },
  { name: 'github_token',      regex: /(ghp|gho|ghs|github_pat)_[a-zA-Z0-9_]{20,}/ },
  { name: 'stripe_key',        regex: /(sk|pk|rk)_(live|test)_[a-zA-Z0-9]{10,}/ },
  { name: 'jwt',               regex: /eyJ[a-zA-Z0-9_-]{10,}\.eyJ[a-zA-Z0-9_-]{10,}\.[a-zA-Z0-9_-]+/ },
  { name: 'ssh_private_key',   regex: /-----BEGIN (RSA|OPENSSH|EC|DSA) PRIVATE KEY-----/ },
  { name: 'eth_private_key',   regex: /0x[0-9a-fA-F]{64}/ },
  // ... 23 more patterns
] as const;

// Scan result: { action: 'allow' | 'redact' | 'block' }
// Runs on EVERY outbound message at the proxy layer.
// The agent never sees the original value.

// Every API call your bot makes can be cryptographically signed.
// Built on RFC 9421 (HTTP Message Signatures) + EIP-191.

const response = await authenticatedRequest({
  url: 'https://api.external-service.com/data',
  method: 'POST',
  body: JSON.stringify({ query: 'ETH price' }),
});

// What the receiving service gets:
// Signature-Input: sig1=("@method" "@path" "content-digest");
//                  keyid="0x742d...0bEb";nonce="abc123";created=1707350400
// Signature: sig1=:BASE64_ECDSA_SIGNATURE:
//
// The service recovers the wallet address from the signature,
// looks up the bot's ERC-8004 AgentCard, and trusts — or rejects.

// Agent wallet: can trade, can NEVER withdraw.
// Enforced by Hyperliquid's exchange — not our code.

// EIP-712 typed data signing for every trade action:
const signature = await signTypedData({
  domain: {
    name: 'Exchange',
    version: '1',
    chainId: 42161,                    // Arbitrum
    verifyingContract: '0x...',
  },
  types: {
    Order: [
      { name: 'asset', type: 'uint32' },
      { name: 'isBuy', type: 'bool' },
      { name: 'limitPx', type: 'uint64' },
      { name: 'sz', type: 'uint64' },
      { name: 'nonce', type: 'uint64' },  // Replay protection
    ],
  },
  value: orderParams,
});

// Risk controls enforced at proxy level BEFORE signing:
// - Max position size (% of account)
// - Max leverage
// - Max open positions
// - Daily loss limit (% of starting balance)