Confirm the target OpenClaw environment and config file location.
Ask which approval language the user wants:
- Chinese: index.zh-CN.ts
- English: index.en.ts
Default to English if the user does not specify a language.
Ensure the plugin directory is reachable from plugins.load.paths.
Ensure plugins.entries["ssh-guard"].enabled is true.
Check the current top-level session.dmScope value first.
If it is already per-channel-peer or per-account-channel-peer, keep it and skip the selection step.
Otherwise, tell the user session.dmScope: "main" is not supported for this plugin in DM flows.
Ask the user to choose one of these top-level session.dmScope values:
- per-channel-peer
- per-account-channel-peer
Explain the two choices as OpenClaw session-routing behavior first:

per-channel-peer: DM session key is agent:<agentId>:<channel>:direct:<peerId>, so the same person gets a different DM session in each channel
per-account-channel-peer: DM session key is agent:<agentId>:<channel>:<accountId>:direct:<peerId>, so DM sessions are separated by channel, receiving account, and person

Then explain the plugin recommendation separately:

default to per-channel-peer
use per-account-channel-peer when one channel has multiple accounts and they should not share DM session state

If the user has no preference, default to per-channel-peer.
Explain whether the user should:

point OpenClaw directly at this repository directory, or
copy/symlink the files into an existing extensions directory

Remind the user to restart or reload OpenClaw after changing plugin config.

Language Selection

Use these entry files:

index.zh-CN.ts: Chinese approval prompts and approval keywords
index.en.ts: English approval prompts and approval keywords
index.ts: default entry and currently points to index.en.ts

If the user wants Chinese prompts, either:

change the plugin entry to load index.zh-CN.ts, or
change index.ts to export index.zh-CN.ts

If the user wants English prompts, keep the current default or point the entry to index.en.ts.

Installation Rules

Prefer using this repository as the single source of truth for the plugin.
Do not describe the plugin as a generic policy skill first; it is primarily a publishable OpenClaw plugin repository.
When updating openclaw.json, make minimal changes:
- add top-level session.dmScope if missing
- add the plugin directory to plugins.load.paths if missing
- add ssh-guard to plugins.entries if missing
- set enabled to true unless the user explicitly wants it disabled
Use absolute paths in config examples.
Preserve existing plugin entries and load paths.
Do not offer main as a valid choice for this plugin's DM setup flow.
Present per-channel-peer and per-account-channel-peer as the recommended DM setup choices for this plugin.
If session.dmScope is already per-channel-peer or per-account-channel-peer, do not ask the user to change it.
Explain that group sessions are unaffected because OpenClaw already routes groups as agent:<agentId>:<channel>:group:<groupId>.

Default Config Shape

Show config updates in this form:

"session": {
  "dmScope": "per-channel-peer"
},
"plugins": {
  "load": {
    "paths": [
      "/absolute/path/to/ssh-guard"
    ]
  },
  "entries": {
    "ssh-guard": {
      "enabled": true
    }
  }
}

Repo Positioning

When the user asks what this repository is for, explain:

this repository is mainly for publishing and reusing the ssh-guard plugin
the plugin blocks commands whose command text contains ssh until the user explicitly approves them
the repository also includes language-specific entry files so deployments can choose Chinese or English approval prompts
the plugin requires isolated top-level session.dmScope for DM use, and should not be installed with session.dmScope: "main"

Notes

Prefer direct, actionable installation guidance over re-explaining the internal approval state machine.
If the user asks to install the plugin into another repo, update that repo’s config to reference this repository cleanly.
If language preference is unknown and no surrounding context suggests otherwise, choose English by default and mention that Chinese is available.

📦 Repository: https://github.com/yanbo92/ssh-guard

Channel	Status
Telegram	✅ Supported
Feishu	✅ Supported
Mattermost	✅ Supported
Weixin	❌ Not Supported
Others	🔍 Unverified

ssh-guard

SSH Guard

Channel Compatibility

Workflow