import type { Locale, TranslationTree } from '../i18n';

/**
 * SecureClawPage translations.
 * Covers: runtime policy, cost circuit breaker, monitors, memory review,
 * skill audit, egress control, behavioral baseline, audit checks,
 * auto-remediation modules, dangerous commands, injection patterns,
 * privacy rules, supply-chain IOC, SecureClaw alerts.
 */
export const secureClawTranslations: Record<Locale, TranslationTree> = {
  en: {
    title: 'SecureClaw Security Audit & Hardening',
    eyebrow: 'secureclaw · secplane',
    heading: 'SecureClaw Security Audit & Hardening',
    description: 'Configure SecureClaw plugin runtime policy for each OpenClaw instance: failure degradation mode, risk level, cost circuit breaker; and whether to auto-run harden on gateway start (off by default, enable cautiously). The alert list below shows real-time audit/monitor/killswitch events from the SecureClaw plugin.',
    dispatchButton: 'Dispatch to Instances…',
    dispatching: 'Dispatching…',
    dispatchComplete: 'Dispatch complete',
    dispatchHint: 'Compile current secureclaw_config into user_config and push to selected OpenClaw instances via install_skill.',
    dispatchTitle: 'Select SecureClaw Dispatch Target Instances',
    loading: 'Loading…',
    failureMode: {
      label: 'Failure Degradation Mode (failureMode)',
      blockAll: { label: 'Block all', help: 'Default — block everything, most secure' },
      safeMode: { label: 'Safe mode', help: 'Only allow read operations, block all writes' },
      readOnly: { label: 'Read only', help: 'Only allow ls/cat/git status' },
    },
    riskProfile: {
      label: 'Runtime Risk Level (riskProfile)',
      strict: { label: 'Strict', help: 'Strict approval, restricted tool set' },
      standard: { label: 'Standard', help: 'Default' },
      permissive: { label: 'Permissive', help: 'Relaxed approval, suitable for trusted environments' },
    },
    policy: {
      title: 'Runtime Policy',
      subtitle: 'Control how SecureClaw plugin behaves on onGatewayStart and how it degrades on failure',
      autoHarden: 'Auto Harden',
      autoHardenWarn: '⚠ Enabling this will have SecureClaw automatically modify openclaw.json, adjust socket permissions, clean credentials, etc. on gateway start.',
      autoHardenNote: ' Only enable when you fully understand each hardening operation; production environments should keep this off, review audit reports manually before deciding.',
    },
    costCircuit: {
      title: 'Cost Circuit Breaker',
      subtitle: 'When any enabled limit is exceeded, the "circuit breaker" pauses the session',
      enabled: 'Enable Cost Circuit Breaker',
      enabledHelp: 'When off, even with limits configured, only alerts are written without actually pausing the session',
      hourlyLimit: 'Hourly Limit',
      dailyLimit: 'Daily Limit',
      monthlyLimit: 'Monthly Limit',
    },
    monitors: {
      title: 'Background Monitors',
      subtitle: '4 long-running monitors started by SecureClaw. Turning one off = SecureClaw skips that monitor\'s start() call.',
      credentials: 'Credential Leak Monitor (credentials)',
      credentialsHelp: 'Scan stateDir for API keys / private keys / cookie files',
      memory: 'Memory Integrity Monitor (memory)',
      memoryHelp: 'Monitor memory_store / MEMORY.md / SOUL.md for unexpected writes',
      skills: 'Skill Scan Monitor (skills)',
      skillsHelp: 'Scan ~/.openclaw/skills and workspace/skills for suspicious installations',
      cost: 'Cost Monitor (cost)',
      costHelp: 'Collect LLM call tokens & cost — prerequisite for cost.* limits above to work',
    },
    memoryReview: {
      title: 'Memory Review Details',
      subtitle: 'When memory monitor is on, the items below control specific scan policies',
      integrityChecks: 'Integrity Checks (integrityChecks)',
      integrityChecksHelp: 'Hash baseline comparison for protected memory files',
      promptInjectionScan: 'Injection Scan (promptInjectionScan)',
      promptInjectionScanHelp: 'Scan for prompt injection patterns when reading memory content',
      quarantineEnabled: 'Quarantine (quarantineEnabled)',
      quarantineEnabledHelp: 'Move risky memory entries to quarantine directory instead of loading into context',
      trustLevels: 'Source Trust Levels (trustLevels)',
      trustLevelsHelp: 'Label sources as trusted / unverified / external, affecting whether injected into LLM context',
    },
    skillAudit: {
      title: 'Skill Audit',
      subtitle: 'Control scan behavior when new skills are installed',
      blockUnaudited: 'Block Unaudited Skills (blockUnaudited)',
      blockUnauditedHelp: 'Skills that haven\'t passed skill scan cannot be installed or enabled',
      scanOnInstall: 'Scan on Install (scanOnInstall)',
      scanOnInstallHelp: 'Auto-run quick-audit before new skill install; reject high-risk directly',
      iocCheckEnabled: 'IOC Check (iocCheckEnabled)',
      iocCheckEnabledHelp: 'Match against malicious hashes / domains in ioc/indicators.json',
    },
    egressControl: {
      title: 'Network Egress Control',
      subtitle: 'Control whether tool calls are restricted to whitelisted domains',
      allowlistEnabled: 'Enable Egress Allowlist (egressAllowlistEnabled)',
      allowlistEnabledHelp: 'When enabled, only domains in the SecureClaw allowlist can be accessed by tool calls.',
      allowlistNote: 'Note: The current allowlist is still maintained by openclaw.json; secplane does not push the list itself for now.',
    },
    behavioral: {
      title: 'Behavioral Baseline (behavioral)',
      subtitle: 'Accumulate tool call patterns, alert on significant deviations from baseline',
      baselineEnabled: 'Enable Baseline Accumulation (baselineEnabled)',
      baselineEnabledHelp: 'Accumulate tool call frequency to jsonl; when off, baseline does not update',
      deviationThreshold: 'Deviation Threshold (deviationThreshold)',
      windowMinutes: 'Window Length (windowMinutes)',
      minutes: 'minutes',
    },
    audit: {
      title: 'Audit Checks · 56 Items',
      subtitle: 'SecureClaw runs 56 audits on startup. Enforce = normal report; Observe = still reports but severity reduced to LOW (auto-harden skips); Off = completely skip.',
      total: 'total',
      enforceCount: 'enforce',
      observeCount: 'observe',
      offCount: 'off',
      empty: 'No audit rules loaded (seed may not have run)',
      bulkEnforce: 'All Enforce',
      bulkObserve: 'All Observe',
      bulkOff: 'All Off',
      current: 'current:',
    },
    categoryLabel: {
      'access-control': 'Access Control (access-control)',
      'control-tokens': 'Control Tokens (control-tokens)',
      'cost': 'Cost (cost)',
      'credentials': 'Credentials (credentials)',
      'cross-layer': 'Cross-Layer Risk (cross-layer)',
      'degradation': 'Degradation Mode (degradation)',
      'execution': 'Execution (execution)',
      'gateway': 'Gateway (gateway)',
      'ioc': 'Threat Intelligence (ioc)',
      'kill-switch': 'Emergency Brake (kill-switch)',
      'memory': 'Memory (memory)',
      'memory-trust': 'Memory Trust (memory-trust)',
      'supply-chain': 'Skill Supply Chain (supply-chain)',
    },
    hardening: {
      title: 'Auto-Remediation Modules · 5',
      subtitle: 'Each module controls whether a class of auto-fix runs when autoHarden=true. Enabling a module = allows it to modify pod config during harden. All disabled by default to prevent accidental changes.',
      warn: '⚠ Review what each module will change in the audit report before enabling.',
      allowHarden: 'Allow Harden',
      noHarden: 'Skip Harden',
      empty: 'No hardening module rules loaded',
    },
    dangerousCommands: {
      title: 'Dangerous Command Blocking · dangerous-commands.json',
      subtitle: 'Each category has its own severity + action. Click pattern text to edit regex; "+ Add" at bottom to add new pattern; "+ New Category" on the right to add custom category.',
      newCategory: '+ New Category',
      newCategoryPrompt: 'New category name (English snake_case, e.g. custom_internal_cmd):',
      patterns: 'patterns',
      disabled: 'disabled',
      enable: 'Enable',
      disable: 'Disable',
      delete: 'Del',
      deleteCategory: 'Delete category',
      removePatternsFirst: 'Please remove all patterns under this category first',
      addPlaceholder: 'Add new regex to {cat} (e.g. \\bsudo\\s+rm\\s+-rf)',
      emptyPatterns: 'Empty — add pattern below',
    },
    injectionPatterns: {
      title: 'Prompt Injection Strings · injection-patterns.json',
      subtitle: 'Injection feature phrases under 7 categories (case-insensitive substring match). Total {count} entries.',
      newCategory: '+ New Category',
      newCategoryPrompt: 'New injection category name (English snake_case, e.g. business_logic_bypass):',
      firstPhrasePrompt: 'First string for this category (placeholder, editable in UI):',
      addPlaceholder: 'Add new injection string to {cat} (case-insensitive substring match)',
      empty: 'Empty',
    },
    privacyRules: {
      title: 'PII Privacy Rules · privacy-rules.json · {count} entries',
      subtitle: 'Click regex or fix column to edit. Action: block = reject / remove = delete / rewrite = rewrite.',
      newRule: '+ New Rule',
      newRulePrompt: 'New rule id (English snake_case, e.g. employee_id):',
      regexPrompt: 'Regex (editable in table):',
      fixPrompt: 'Rewrite hint for Agent (optional):',
      idCol: 'ID',
      regexCol: 'Regex',
      actionCol: 'Action',
      fixCol: 'Fix Hint',
      enableCol: 'Enable',
      on: 'On',
      off: 'Off',
      delete: 'Del',
    },
    ioc: {
      title: 'Supply Chain Threat Intelligence · supply-chain-ioc.json · {count} entries',
      subtitle: '5 sub-categories. Click to toggle enable/disable; × to remove.',
      addPlaceholder: {
        suspicious_skill_pattern: 'Add new skill malicious feature regex (e.g. atob\\()',
        c2_server: 'Add new C2 IP / hostname',
        clawhavoc_name: 'Add new impersonating skill name pattern',
        clawhavoc_malware: 'Add new malware family name',
        malicious_domain: 'Add new malicious domain',
        infostealer_target: 'Add new sensitive file path to protect',
      },
      empty: 'Empty',
    },
    alerts: {
      title: 'SecureClaw Alerts',
      subtitle: 'audit findings (severity≥medium) / credential monitor / cost monitor / kill switch — pulled from secplane_alert in real-time, source=secureclaw',
      refresh: 'Refresh',
      time: 'Time',
      source: 'Source',
      rule: 'Rule / Defense',
      severity: 'Severity',
      action: 'Action',
      evidence: 'Evidence',
      noAlerts: 'No SecureClaw alerts yet — will auto-populate once the plugin is up',
    },
    inline: {
      clickToEdit: 'Click to edit',
      emptyClickToAdd: '(empty — click to add)',
    },
    addInput: {
      add: '+ Add',
    },
    toggle: {
      on: 'On',
      off: 'Off',
    },
    numberRow: {
      usd: 'USD',
    },
  },

  zh: {
    title: 'SecureClaw 安全审计与加固',
    eyebrow: 'secureclaw · secplane',
    heading: 'SecureClaw 安全审计与加固',
    description: '配置 SecureClaw 插件在每个 OpenClaw 实例上的运行策略：失败降级模式、风险等级、成本熔断；以及是否在网关启动时自动跑 harden（默认关闭，谨慎打开）。下方告警列表实时显示 SecureClaw 插件回传的 audit/monitor/killswitch 事件。',
    dispatchButton: '下发到实例…',
    dispatching: '下发中…',
    dispatchComplete: '下发完成',
    dispatchHint: '把当前 secureclaw_config 编译为 user_config 并通过 install_skill 推送到选中的 OpenClaw 实例。',
    dispatchTitle: '选择 SecureClaw 下发目标实例',
    loading: '加载中…',
    failureMode: {
      label: '失败降级模式 (failureMode)',
      blockAll: { label: 'Block all', help: '默认 — 全部拦截，最安全' },
      safeMode: { label: 'Safe mode', help: '只允许读操作，拦截所有写' },
      readOnly: { label: 'Read only', help: '只允许 ls/cat/git status' },
    },
    riskProfile: {
      label: '运行风险等级 (riskProfile)',
      strict: { label: 'Strict', help: '严格审批，限制工具集' },
      standard: { label: 'Standard', help: '默认' },
      permissive: { label: 'Permissive', help: '放宽审批，适合受信环境' },
    },
    policy: {
      title: '运行策略',
      subtitle: '控制 SecureClaw 插件在 onGatewayStart 时怎么干，以及失败时如何降级',
      autoHarden: '自动 Harden',
      autoHardenWarn: '⚠ 启用后 SecureClaw 会在网关启动时自动修改 openclaw.json、调整 socket 权限、清理 credential 等。',
      autoHardenNote: ' 仅在你完全理解每项 hardening 操作时启用；生产环境建议保持关闭，用 audit 报告人工 review 后再决定。',
    },
    costCircuit: {
      title: '成本熔断',
      subtitle: '超过任意一个启用的上限时，按"circuit breaker"暂停 session',
      enabled: '启用成本熔断',
      enabledHelp: '关闭后即便配了上限也只会写告警，不会真暂停 session',
      hourlyLimit: '每小时上限',
      dailyLimit: '每天上限',
      monthlyLimit: '每月上限',
    },
    monitors: {
      title: '后台监视器',
      subtitle: 'SecureClaw 启动时拉起的 4 个长期运行监视器。关闭某项 = SecureClaw 跳过该监视器的 start() 调用。',
      credentials: '凭据泄漏监视器 (credentials)',
      credentialsHelp: '扫描 stateDir 内的 API key / 私钥 / cookie 文件',
      memory: '记忆完整性监视器 (memory)',
      memoryHelp: '监视 memory_store / MEMORY.md / SOUL.md 的非预期写入',
      skills: 'Skill 扫描监视器 (skills)',
      skillsHelp: '扫描 ~/.openclaw/skills 与 workspace/skills 的可疑安装',
      cost: 'Cost 监视器 (cost)',
      costHelp: '采集 LLM 调用 token 与 cost — 是上面 cost.* 上限生效的前提',
    },
    memoryReview: {
      title: '记忆审查细项',
      subtitle: 'memory 监视器开启后，下面细项控制具体扫描策略',
      integrityChecks: '完整性校验 (integrityChecks)',
      integrityChecksHelp: '对受保护的记忆文件做 hash baseline 比对',
      promptInjectionScan: '注入扫描 (promptInjectionScan)',
      promptInjectionScanHelp: '在读取记忆内容时扫描 prompt 注入 pattern',
      quarantineEnabled: '隔离 (quarantineEnabled)',
      quarantineEnabledHelp: '命中风险时把记忆条目移到 quarantine 目录而不是直接读入 context',
      trustLevels: '来源信任分级 (trustLevels)',
      trustLevelsHelp: '按来源标注 trusted / unverified / external，影响是否注入到 LLM context',
    },
    skillAudit: {
      title: 'Skill 审计',
      subtitle: '控制新 skill 安装时的扫描行为',
      blockUnaudited: '拦截未审计 Skill (blockUnaudited)',
      blockUnauditedHelp: '未通过 skill scan 的 skill 不允许安装或启用',
      scanOnInstall: '安装时扫描 (scanOnInstall)',
      scanOnInstallHelp: '新 skill 安装前自动跑 quick-audit，高危直接拒绝',
      iocCheckEnabled: 'IOC 比对 (iocCheckEnabled)',
      iocCheckEnabledHelp: '对照 ioc/indicators.json 的恶意 hash / 域名做匹配',
    },
    egressControl: {
      title: '网络出口控制',
      subtitle: '控制工具调用是否限制在白名单域名内',
      allowlistEnabled: '启用出口白名单 (egressAllowlistEnabled)',
      allowlistEnabledHelp: '开启后只有 SecureClaw allowlist 内的域名能被工具调用访问。',
      allowlistNote: '注：当前 allowlist 列表仍由 openclaw.json 维护，secplane 暂不下发列表本身。',
    },
    behavioral: {
      title: '行为基线 (behavioral)',
      subtitle: '累积 tool 调用模式，对显著偏离基线的行为告警',
      baselineEnabled: '启用基线累积 (baselineEnabled)',
      baselineEnabledHelp: '累积 tool 调用频率到 jsonl，关闭后基线不更新',
      deviationThreshold: '偏差阈值 (deviationThreshold)',
      windowMinutes: '窗口长度 (windowMinutes)',
      minutes: '分钟',
    },
    audit: {
      title: 'Audit 检查 · 56 项',
      subtitle: 'SecureClaw 启动时跑 56 个 audit。Enforce = 正常报告；Observe = 仍报但 severity 降为 LOW（auto-harden 不动它）；Off = 完全跳过。',
      total: '共',
      enforceCount: 'enforce',
      observeCount: 'observe',
      offCount: 'off',
      empty: '未加载到 audit 规则（seed 可能没跑过）',
      bulkEnforce: '全 Enforce',
      bulkObserve: '全 Observe',
      bulkOff: '全 Off',
      current: '当前:',
    },
    categoryLabel: {
      'access-control': '访问控制 (access-control)',
      'control-tokens': '控制 token (control-tokens)',
      'cost': '成本 (cost)',
      'credentials': '凭据 (credentials)',
      'cross-layer': '跨层风险 (cross-layer)',
      'degradation': '降级模式 (degradation)',
      'execution': '执行 (execution)',
      'gateway': '网关 (gateway)',
      'ioc': '威胁情报 (ioc)',
      'kill-switch': '紧急刹车 (kill-switch)',
      'memory': '记忆 (memory)',
      'memory-trust': '记忆信任 (memory-trust)',
      'supply-chain': 'Skill 供应链 (supply-chain)',
    },
    hardening: {
      title: '自动修复模块 · 5 个',
      subtitle: '每个模块控制一类自动 fix 是否在 autoHarden=true 时跑。开启某模块 = 允许它在 harden 时改 pod 配置。默认全部关闭以避免任何意外修改。',
      warn: '⚠ 启用前先 review 该模块在 audit 报告里会改什么。',
      allowHarden: '允许 harden',
      noHarden: '不动 harden',
      empty: '未加载到 hardening 模块规则',
    },
    dangerousCommands: {
      title: '危险命令拦截 · dangerous-commands.json',
      subtitle: '每 category 有自己的 severity + action。点 pattern 文本可改 regex；底部 `+ 添加` 加新 pattern；右侧 `+ 新增 category` 加自定义类别。',
      newCategory: '+ 新增 category',
      newCategoryPrompt: '新 category 名（英文 snake_case，例如 custom_internal_cmd）：',
      patterns: '个 pattern',
      disabled: 'disabled',
      enable: '启用',
      disable: '关闭',
      delete: '删',
      deleteCategory: '删除 category',
      removePatternsFirst: '请先移除该 category 下的所有 pattern',
      addPlaceholder: '加新 regex 到 {cat}（例如 \\bsudo\\s+rm\\s+-rf）',
      emptyPatterns: '空 — 在下方添加 pattern',
    },
    injectionPatterns: {
      title: '提示词注入字符串 · injection-patterns.json',
      subtitle: '7 个 category 下的注入特征短语（大小写不敏感子串匹配）。共 {count} 条。',
      newCategory: '+ 新增类别',
      newCategoryPrompt: '新注入类别名（英文 snake_case，例如 business_logic_bypass）：',
      firstPhrasePrompt: '该类别的第一条字符串（占位，可在 UI 改）：',
      addPlaceholder: '加新注入字符串到 {cat}（不区分大小写子串匹配）',
      empty: '空',
    },
    privacyRules: {
      title: 'PII 隐私规则 · privacy-rules.json · {count} 条',
      subtitle: '点击正则或 fix 列编辑。Action: block 拒发 / remove 删除 / rewrite 重写。',
      newRule: '+ 新建规则',
      newRulePrompt: '新规则 id（英文 snake_case，例如 employee_id）：',
      regexPrompt: '正则（可在表格里改）：',
      fixPrompt: '给 Agent 的重写提示（可空）：',
      idCol: 'ID',
      regexCol: '正则',
      actionCol: 'Action',
      fixCol: 'Fix 提示',
      enableCol: '启用',
      on: '开',
      off: '关',
      delete: '删',
    },
    ioc: {
      title: '供应链威胁情报 · supply-chain-ioc.json · {count} 条',
      subtitle: '5 个子分类。每条点击可切换启用/关闭，× 移除。',
      addPlaceholder: {
        suspicious_skill_pattern: '加新 skill 恶意特征正则（如 atob\\()',
        c2_server: '加新 C2 IP / hostname',
        clawhavoc_name: '加新仿冒 skill 名称模式',
        clawhavoc_malware: '加新恶意软件家族名',
        malicious_domain: '加新恶意域名',
        infostealer_target: '加新需保护的敏感文件路径',
      },
      empty: '空',
    },
    alerts: {
      title: 'SecureClaw 告警',
      subtitle: 'audit findings (severity≥medium) / credential monitor / cost monitor / kill switch — 实时从 secplane_alert 拉取，source=secureclaw',
      refresh: '刷新',
      time: '时间',
      source: '来源',
      rule: '规则 / Defense',
      severity: '严重度',
      action: '动作',
      evidence: '证据',
      noAlerts: '暂无 SecureClaw 告警 — 等插件起来后会自动填充',
    },
    inline: {
      clickToEdit: '点击编辑',
      emptyClickToAdd: '(empty — 点击新增)',
    },
    addInput: {
      add: '+ 添加',
    },
    toggle: {
      on: '开启',
      off: '关闭',
    },
    numberRow: {
      usd: 'USD',
    },
  },

  ja: {
    title: 'SecureClaw セキュリティ監査とハードニング',
    eyebrow: 'secureclaw · secplane',
    heading: 'SecureClaw セキュリティ監査とハードニング',
    description: '各OpenClawインスタンスでのSecureClawプラグインのランタイムポリシーを設定：フェイルオーバーモード、リスクレベル、コストサーキットブレーカー；ゲートウェイ起動時に自動ハードニングを実行するかどうか（デフォルトオフ、慎重に有効化）。下のアラートリストはSecureClawプラグインからのaudit/monitor/killswitchイベントをリアルタイム表示。',
    dispatchButton: 'インスタンスに配信…', dispatching: '配信中…', dispatchComplete: '配信完了', dispatchHint: '現在のsecureclaw_configをuser_configにコンパイルし、install_skillで選択したOpenClawインスタンスにプッシュ。', dispatchTitle: 'SecureClaw配信先インスタンスを選択',
    loading: '読み込み中…',
    failureMode: { label: 'フェイルオーバーモード (failureMode)', blockAll: { label: 'Block all', help: 'デフォルト — 全ブロック、最も安全' }, safeMode: { label: 'Safe mode', help: '読み取り操作のみ許可、全書き込みをブロック' }, readOnly: { label: 'Read only', help: 'ls/cat/git statusのみ許可' } },
    riskProfile: { label: 'ランタイムリスクレベル (riskProfile)', strict: { label: 'Strict', help: '厳格な承認、ツールセット制限' }, standard: { label: 'Standard', help: 'デフォルト' }, permissive: { label: 'Permissive', help: '緩和された承認、信頼された環境向け' } },
    policy: { title: 'ランタイムポリシー', subtitle: 'ゲートウェイ開始時のSecureClawプラグインの動作とフェイルオーバー方法を制御', autoHarden: '自動ハードニング', autoHardenWarn: '⚠ 有効にすると、SecureClawはゲートウェイ起動時にopenclaw.jsonの変更、ソケット権限の調整、認証情報のクリア等を自動実行します。', autoHardenNote: ' 各ハードニング操作を完全に理解している場合のみ有効化してください。本番環境ではオフを推奨し、auditレポートを手動レビュー後に決定してください。' },
    costCircuit: { title: 'コストサーキットブレーカー', subtitle: '有効な上限を超えると、"サーキットブレーカー"でセッションを一時停止', enabled: 'コストサーキットブレーカー有効化', enabledHelp: 'オフの場合、上限を設定していてもアラートのみ記録され、セッションは一時停止されません', hourlyLimit: '毎時上限', dailyLimit: '毎日上限', monthlyLimit: '毎月上限' },
    monitors: { title: 'バックグラウンドモニター', subtitle: 'SecureClaw起動時に開始される4つの長期実行モニター。オフにするとSecureClawはそのモニターのstart()呼び出しをスキップ。', credentials: '資格情報漏洩モニター (credentials)', credentialsHelp: 'stateDir内のAPIキー/秘密鍵/cookieファイルをスキャン', memory: 'メモリ整合性モニター (memory)', memoryHelp: 'memory_store / MEMORY.md / SOUL.mdの予期しない書き込みを監視', skills: 'スキルスキャンモニター (skills)', skillsHelp: '~/.openclaw/skillsとworkspace/skillsの疑わしいインストールをスキャン', cost: 'コストモニター (cost)', costHelp: 'LLM呼び出しのトークンとコストを収集 — 上記cost.*上限が機能する前提' },
    memoryReview: { title: 'メモリレビュー詳細', subtitle: 'メモリモニターがオンの場合、以下の項目が具体的なスキャンポリシーを制御', integrityChecks: '整合性チェック (integrityChecks)', integrityChecksHelp: '保護されたメモリファイルのハッシュベースライン比較', promptInjectionScan: 'インジェクションスキャン (promptInjectionScan)', promptInjectionScanHelp: 'メモリコンテンツ読み取り時にプロンプトインジェクションパターンをスキャン', quarantineEnabled: '隔離 (quarantineEnabled)', quarantineEnabledHelp: 'リスク検出時、メモリエントリをコンテキストに読み込む代わりに隔離ディレクトリに移動', trustLevels: 'ソース信頼レベル (trustLevels)', trustLevelsHelp: 'ソースをtrusted/unverified/externalとラベル付けし、LLMコンテキストへの注入に影響' },
    skillAudit: { title: 'スキル監査', subtitle: '新規スキルインストール時のスキャン動作を制御', blockUnaudited: '未監査スキルブロック (blockUnaudited)', blockUnauditedHelp: 'スキルスキャンを通過していないスキルはインストール/有効化不可', scanOnInstall: 'インストール時スキャン (scanOnInstall)', scanOnInstallHelp: '新規スキルインストール前にクイック監査を自動実行、高危険は直接拒否', iocCheckEnabled: 'IOCチェック (iocCheckEnabled)', iocCheckEnabledHelp: 'ioc/indicators.jsonの悪意あるハッシュ/ドメインと照合' },
    egressControl: { title: 'ネットワークエグレス制御', subtitle: 'ツール呼び出しをホワイトリストドメインに制限するかどうかを制御', allowlistEnabled: 'エグレス許可リスト有効化 (egressAllowlistEnabled)', allowlistEnabledHelp: '有効にすると、SecureClaw許可リスト内のドメインのみツール呼び出しでアクセス可能。', allowlistNote: '注：現在の許可リストはopenclaw.jsonで管理されており、secplaneはリスト自体をプッシュしません。' },
    behavioral: { title: '行動ベースライン (behavioral)', subtitle: 'ツール呼び出しパターンを蓄積し、ベースラインからの大幅な逸脱をアラート', baselineEnabled: 'ベースライン蓄積有効化 (baselineEnabled)', baselineEnabledHelp: 'ツール呼び出し頻度をjsonlに蓄積、オフの場合ベースラインは更新されない', deviationThreshold: '偏差閾値 (deviationThreshold)', windowMinutes: 'ウィンドウ長 (windowMinutes)', minutes: '分' },
    audit: { title: '監査チェック · 56項目', subtitle: 'SecureClawは起動時に56の監査を実行。Enforce = 通常レポート；Observe = レポートするが重要度をLOWに降格（auto-hardenはスキップ）；Off = 完全スキップ。', total: '計', enforceCount: 'enforce', observeCount: 'observe', offCount: 'off', empty: '監査ルールが読み込まれていません（seedが未実行の可能性）', bulkEnforce: '全Enforce', bulkObserve: '全Observe', bulkOff: '全Off', current: '現在:' },
    categoryLabel: { 'access-control': 'アクセス制御 (access-control)', 'control-tokens': '制御トークン (control-tokens)', 'cost': 'コスト (cost)', 'credentials': '資格情報 (credentials)', 'cross-layer': 'クロスレイヤーリスク (cross-layer)', 'degradation': 'デグレードモード (degradation)', 'execution': '実行 (execution)', 'gateway': 'ゲートウェイ (gateway)', 'ioc': '脅威インテリジェンス (ioc)', 'kill-switch': '緊急ストップ (kill-switch)', 'memory': 'メモリ (memory)', 'memory-trust': 'メモリ信頼 (memory-trust)', 'supply-chain': 'スキルサプライチェーン (supply-chain)' },
    hardening: { title: '自動修復モジュール · 5', subtitle: '各モジュールはautoHarden=true時に自動修正クラスを実行するかどうかを制御。モジュール有効化 = ハードニング時にポッド設定の変更を許可。誤操作を防ぐためデフォルトは全オフ。', warn: '⚠ 有効化前にauditレポートで各モジュールの変更内容を確認してください。', allowHarden: 'ハードニング許可', noHarden: 'ハードニングスキップ', empty: 'ハードニングモジュールルールが読み込まれていません' },
    dangerousCommands: { title: '危険コマンドブロック · dangerous-commands.json', subtitle: '各カテゴリに独自のseverity + actionがあります。パターンテキストをクリックしてregexを編集；下部の"+ 追加"で新パターン追加；右側の"+ 新規カテゴリ"でカスタムカテゴリ追加。', newCategory: '+ 新規カテゴリ', newCategoryPrompt: '新カテゴリ名（英語 snake_case、例：custom_internal_cmd）：', patterns: 'パターン', disabled: 'disabled', enable: '有効', disable: '無効', delete: '削', deleteCategory: 'カテゴリ削除', removePatternsFirst: 'このカテゴリ下の全パターンを先に削除してください', addPlaceholder: '{cat}に新regexを追加（例：\\bsudo\\s+rm\\s+-rf）', emptyPatterns: '空 — 下部からパターンを追加' },
    injectionPatterns: { title: 'プロンプトインジェクション文字列 · injection-patterns.json', subtitle: '7カテゴリのインジェクション特徴フレーズ（大文字小文字区別なし部分文字列マッチ）。合計{count}件。', newCategory: '+ 新規カテゴリ', newCategoryPrompt: '新インジェクションカテゴリ名（英語 snake_case、例：business_logic_bypass）：', firstPhrasePrompt: 'このカテゴリの最初の文字列（プレースホルダー、UIで編集可能）：', addPlaceholder: '{cat}に新インジェクション文字列を追加（大文字小文字区別なし部分文字列マッチ）', empty: '空' },
    privacyRules: { title: 'PIIプライバシールール · privacy-rules.json · {count}件', subtitle: '正規表現またはfix列をクリックして編集。Action: block = 拒否 / remove = 削除 / rewrite = 書き換え。', newRule: '+ 新規ルール', newRulePrompt: '新ルールid（英語 snake_case、例：employee_id）：', regexPrompt: '正規表現（テーブルで編集可能）：', fixPrompt: 'エージェントへの書き換えヒント（空可）：', idCol: 'ID', regexCol: '正規表現', actionCol: 'Action', fixCol: 'Fix ヒント', enableCol: '有効', on: 'オン', off: 'オフ', delete: '削' },
    ioc: { title: 'サプライチェーン脅威インテリジェンス · supply-chain-ioc.json · {count}件', subtitle: '5サブカテゴリ。クリックで有効/無効切替、×で削除。', addPlaceholder: { suspicious_skill_pattern: '新skill悪意特徴正規表現を追加（例：atob\\()）', c2_server: '新C2 IP / ホスト名を追加', clawhavoc_name: '新偽装skill名パターンを追加', clawhavoc_malware: '新マルウェアファミリ名を追加', malicious_domain: '新悪意ドメインを追加', infostealer_target: '新保護対象の機密ファイルパスを追加' }, empty: '空' },
    alerts: { title: 'SecureClawアラート', subtitle: 'audit findings (severity≥medium) / credential monitor / cost monitor / kill switch — secplane_alertからリアルタイム取得、source=secureclaw', refresh: '更新', time: '時刻', source: 'ソース', rule: 'ルール/Defense', severity: '重要度', action: 'アクション', evidence: '証拠', noAlerts: 'SecureClawアラートなし — プラグイン起動後に自動入力されます' },
    inline: { clickToEdit: 'クリックして編集', emptyClickToAdd: '(空 — クリックして追加)' },
    addInput: { add: '+ 追加' },
    toggle: { on: 'オン', off: 'オフ' },
    numberRow: { usd: 'USD' },
  },

  ko: {
    title: 'SecureClaw 보안 감사 및 강화',
    eyebrow: 'secureclaw · secplane',
    heading: 'SecureClaw 보안 감사 및 강화',
    description: '각 OpenClaw 인스턴스에서 SecureClaw 플러그인의 런타임 정책 구성: 실패 강등 모드, 리스크 등급, 비용 서킷 브레이커; 게이트웨이 시작 시 자동 harden 실행 여부 (기본 꺼짐, 신중하게 활성화). 아래 알림 목록은 SecureClaw 플러그인의 실시간 audit/monitor/killswitch 이벤트를 표시합니다.',
    dispatchButton: '인스턴스에 배포…', dispatching: '배포 중…', dispatchComplete: '배포 완료', dispatchHint: '현재 secureclaw_config를 user_config로 컴파일하고 install_skill을 통해 선택한 OpenClaw 인스턴스에 푸시.', dispatchTitle: 'SecureClaw 배포 대상 인스턴스 선택',
    loading: '로딩 중…',
    failureMode: { label: '실패 강등 모드 (failureMode)', blockAll: { label: 'Block all', help: '기본값 — 전체 차단, 가장 안전' }, safeMode: { label: 'Safe mode', help: '읽기 작업만 허용, 모든 쓰기 차단' }, readOnly: { label: 'Read only', help: 'ls/cat/git status만 허용' } },
    riskProfile: { label: '런타임 리스크 등급 (riskProfile)', strict: { label: 'Strict', help: '엄격한 승인, 제한된 도구 세트' }, standard: { label: 'Standard', help: '기본값' }, permissive: { label: 'Permissive', help: '완화된 승인, 신뢰된 환경에 적합' } },
    policy: { title: '런타임 정책', subtitle: '게이트웨이 시작 시 SecureClaw 플러그인의 동작과 실패 시 강등 방법 제어', autoHarden: '자동 Harden', autoHardenWarn: '⚠ 활성화하면 SecureClaw가 게이트웨이 시작 시 openclaw.json 수정, 소켓 권한 조정, 자격 증명 정리 등을 자동 실행합니다.', autoHardenNote: ' 각 강화 작업을 완전히 이해하는 경우에만 활성화하십시오. 프로덕션 환경에서는 끄기를 권장하며, audit 보고서를 수동 검토 후 결정하십시오.' },
    costCircuit: { title: '비용 서킷 브레이커', subtitle: '활성화된 한도를 초과하면 "서킷 브레이커"가 세션을 일시 정지', enabled: '비용 서킷 브레이커 활성화', enabledHelp: '끄면 한도를 설정해도 알림만 기록되고 세션이 실제로 일시 정지되지 않습니다', hourlyLimit: '시간당 한도', dailyLimit: '일일 한도', monthlyLimit: '월간 한도' },
    monitors: { title: '백그라운드 모니터', subtitle: 'SecureClaw 시작 시 실행되는 4개의 장기 실행 모니터. 하나를 끄면 SecureClaw가 해당 모니터의 start() 호출을 건너뜁니다.', credentials: '자격 증명 유출 모니터 (credentials)', credentialsHelp: 'stateDir 내의 API 키 / 개인 키 / 쿠키 파일 스캔', memory: '메모리 무결성 모니터 (memory)', memoryHelp: 'memory_store / MEMORY.md / SOUL.md의 예상치 못한 쓰기 모니터링', skills: '스킬 스캔 모니터 (skills)', skillsHelp: '~/.openclaw/skills 및 workspace/skills의 의심스러운 설치 스캔', cost: '비용 모니터 (cost)', costHelp: 'LLM 호출 토큰 및 비용 수집 — 위 cost.* 한도가 작동하기 위한 전제' },
    memoryReview: { title: '메모리 검토 세부 항목', subtitle: '메모리 모니터가 켜져 있을 때 아래 항목이 구체적인 스캔 정책을 제어', integrityChecks: '무결성 검사 (integrityChecks)', integrityChecksHelp: '보호된 메모리 파일의 해시 베이스라인 비교', promptInjectionScan: '인젝션 스캔 (promptInjectionScan)', promptInjectionScanHelp: '메모리 콘텐츠 읽기 시 프롬프트 인젝션 패턴 스캔', quarantineEnabled: '격리 (quarantineEnabled)', quarantineEnabledHelp: '리스크 감지 시 메모리 항목을 컨텍스트에 로드하는 대신 격리 디렉토리로 이동', trustLevels: '소스 신뢰 등급 (trustLevels)', trustLevelsHelp: '소스를 trusted/unverified/external로 레이블 지정, LLM 컨텍스트 주입 여부에 영향' },
    skillAudit: { title: '스킬 감사', subtitle: '새 스킬 설치 시 스캔 동작 제어', blockUnaudited: '미감사 스킬 차단 (blockUnaudited)', blockUnauditedHelp: '스킬 스캔을 통과하지 못한 스킬은 설치/활성화 불가', scanOnInstall: '설치 시 스캔 (scanOnInstall)', scanOnInstallHelp: '새 스킬 설치 전 자동 퀵 감사 실행, 고위험은 직접 거부', iocCheckEnabled: 'IOC 확인 (iocCheckEnabled)', iocCheckEnabledHelp: 'ioc/indicators.json의 악성 해시/도메인과 매칭' },
    egressControl: { title: '네트워크 이그레스 제어', subtitle: '도구 호출을 화이트리스트 도메인으로 제한할지 여부 제어', allowlistEnabled: '이그레스 허용 목록 활성화 (egressAllowlistEnabled)', allowlistEnabledHelp: '활성화하면 SecureClaw 허용 목록 내의 도메인만 도구 호출로 접근 가능합니다.', allowlistNote: '참고: 현재 허용 목록은 openclaw.json에서 관리되며, secplane은 목록 자체를 푸시하지 않습니다.' },
    behavioral: { title: '행동 베이스라인 (behavioral)', subtitle: '도구 호출 패턴을 누적하고 베이스라인에서의 유의미한 편차에 알림', baselineEnabled: '베이스라인 누적 활성화 (baselineEnabled)', baselineEnabledHelp: '도구 호출 빈도를 jsonl에 누적, 끄면 베이스라인이 업데이트되지 않음', deviationThreshold: '편차 임계값 (deviationThreshold)', windowMinutes: '윈도우 길이 (windowMinutes)', minutes: '분' },
    audit: { title: '감사 체크 · 56항목', subtitle: 'SecureClaw 시작 시 56개 감사 실행. Enforce = 정상 보고；Observe = 보고하지만 심각도를 LOW로 강등(auto-harden 건너뜀)；Off = 완전 건너뜀.', total: '총', enforceCount: 'enforce', observeCount: 'observe', offCount: 'off', empty: '감사 규칙이 로드되지 않았습니다(seed가 실행되지 않았을 수 있음)', bulkEnforce: '전체 Enforce', bulkObserve: '전체 Observe', bulkOff: '전체 Off', current: '현재:' },
    categoryLabel: { 'access-control': '액세스 제어 (access-control)', 'control-tokens': '제어 토큰 (control-tokens)', 'cost': '비용 (cost)', 'credentials': '자격 증명 (credentials)', 'cross-layer': '교차 계층 리스크 (cross-layer)', 'degradation': '강등 모드 (degradation)', 'execution': '실행 (execution)', 'gateway': '게이트웨이 (gateway)', 'ioc': '위협 인텔리전스 (ioc)', 'kill-switch': '긴급 정지 (kill-switch)', 'memory': '메모리 (memory)', 'memory-trust': '메모리 신뢰 (memory-trust)', 'supply-chain': '스킬 공급망 (supply-chain)' },
    hardening: { title: '자동 수정 모듈 · 5', subtitle: '각 모듈은 autoHarden=true 시 자동 수정 클래스 실행 여부를 제어합니다. 모듈 활성화 = harden 시 파드 설정 변경을 허용. 우발적 변경 방지를 위해 기본값은 모두 꺼짐.', warn: '⚠ 활성화 전 audit 보고서에서 각 모듈이 변경할 내용을 검토하세요.', allowHarden: 'harden 허용', noHarden: 'harden 건너뛰기', empty: '강화 모듈 규칙이 로드되지 않았습니다' },
    dangerousCommands: { title: '위험 명령 차단 · dangerous-commands.json', subtitle: '각 카테고리에 고유한 severity + action이 있습니다. 패턴 텍스트를 클릭하여 regex 편집；하단의 "+ 추가"로 새 패턴 추가；우측의 "+ 새 카테고리"로 커스텀 카테고리 추가.', newCategory: '+ 새 카테고리', newCategoryPrompt: '새 카테고리 이름 (영어 snake_case, 예: custom_internal_cmd):', patterns: '패턴', disabled: 'disabled', enable: '활성', disable: '비활성', delete: '삭', deleteCategory: '카테고리 삭제', removePatternsFirst: '이 카테고리 아래의 모든 패턴을 먼저 제거하세요', addPlaceholder: '{cat}에 새 regex 추가 (예: \\bsudo\\s+rm\\s+-rf)', emptyPatterns: '비어 있음 — 아래에서 패턴 추가' },
    injectionPatterns: { title: '프롬프트 인젝션 문자열 · injection-patterns.json', subtitle: '7개 카테고리의 인젝션 특징 문구 (대소문자 구분 없는 부분 문자열 매치). 총 {count}개.', newCategory: '+ 새 카테고리', newCategoryPrompt: '새 인젝션 카테고리 이름 (영어 snake_case, 예: business_logic_bypass):', firstPhrasePrompt: '이 카테고리의 첫 번째 문자열 (자리표시자, UI에서 편집 가능):', addPlaceholder: '{cat}에 새 인젝션 문자열 추가 (대소문자 구분 없는 부분 문자열 매치)', empty: '비어 있음' },
    privacyRules: { title: 'PII 개인정보 규칙 · privacy-rules.json · {count}개', subtitle: '정규식 또는 fix 열을 클릭하여 편집. Action: block = 거부 / remove = 삭제 / rewrite = 재작성.', newRule: '+ 새 규칙', newRulePrompt: '새 규칙 id (영어 snake_case, 예: employee_id):', regexPrompt: '정규식 (테이블에서 편집 가능):', fixPrompt: '에이전트에 대한 재작성 힌트 (선택):', idCol: 'ID', regexCol: '정규식', actionCol: 'Action', fixCol: 'Fix 힌트', enableCol: '활성', on: '켜기', off: '끄기', delete: '삭' },
    ioc: { title: '공급망 위협 인텔리전스 · supply-chain-ioc.json · {count}개', subtitle: '5개 하위 카테고리. 클릭하여 활성/비활성 전환, ×로 제거.', addPlaceholder: { suspicious_skill_pattern: '새 스킬 악성 특징 정규식 추가 (예: atob\\() )', c2_server: '새 C2 IP / 호스트명 추가', clawhavoc_name: '새 사칭 스킬 이름 패턴 추가', clawhavoc_malware: '새 멀웨어 패밀리명 추가', malicious_domain: '새 악성 도메인 추가', infostealer_target: '새 보호 대상 민감 파일 경로 추가' }, empty: '비어 있음' },
    alerts: { title: 'SecureClaw 알림', subtitle: 'audit findings (severity≥medium) / credential monitor / cost monitor / kill switch — secplane_alert에서 실시간 가져오기, source=secureclaw', refresh: '새로고침', time: '시간', source: '소스', rule: '규칙/Defense', severity: '심각도', action: '동작', evidence: '증거', noAlerts: 'SecureClaw 알림 없음 — 플러그인 가동 후 자동 채워집니다' },
    inline: { clickToEdit: '클릭하여 편집', emptyClickToAdd: '(비어 있음 — 클릭하여 추가)' },
    addInput: { add: '+ 추가' },
    toggle: { on: '켜기', off: '끄기' },
    numberRow: { usd: 'USD' },
  },

  de: {
    title: 'SecureClaw Sicherheitsaudit & Härtung',
    eyebrow: 'secureclaw · secplane',
    heading: 'SecureClaw Sicherheitsaudit & Härtung',
    description: 'Konfigurieren Sie die SecureClaw-Plugin-Laufzeitrichtlinie für jede OpenClaw-Instanz: Fehlerdegradationsmodus, Risikostufe, Cost-Schutzschalter; und ob beim Gateway-Start automatisch gehärtet wird (standardmäßig aus, vorsichtig aktivieren). Die Alarmliste unten zeigt Echtzeit-Audit-/Monitor-/Killswitch-Ereignisse vom SecureClaw-Plugin.',
    dispatchButton: 'An Instanzen senden…', dispatching: 'Wird gesendet…', dispatchComplete: 'Versand abgeschlossen', dispatchHint: 'Aktuelle secureclaw_config als user_config kompilieren und per install_skill an ausgewählte OpenClaw-Instanzen pushen.', dispatchTitle: 'SecureClaw-Versand-Zielinstanzen auswählen',
    loading: 'Laden…',
    failureMode: { label: 'Fehlerdegradationsmodus (failureMode)', blockAll: { label: 'Block all', help: 'Standard — alles blockieren, am sichersten' }, safeMode: { label: 'Safe mode', help: 'Nur Lesevorgänge erlauben, alle Schreibvorgänge blockieren' }, readOnly: { label: 'Read only', help: 'Nur ls/cat/git status erlauben' } },
    riskProfile: { label: 'Laufzeit-Risikostufe (riskProfile)', strict: { label: 'Strict', help: 'Strenge Freigabe, eingeschränktes Tool-Set' }, standard: { label: 'Standard', help: 'Standard' }, permissive: { label: 'Permissive', help: 'Lockerere Freigabe, geeignet für vertrauenswürdige Umgebungen' } },
    policy: { title: 'Laufzeitrichtlinie', subtitle: 'Steuern Sie, wie das SecureClaw-Plugin bei onGatewayStart arbeitet und wie es bei Fehlern degradiert', autoHarden: 'Auto-Harden', autoHardenWarn: '⚠ Wenn aktiviert, ändert SecureClaw beim Gateway-Start automatisch openclaw.json, passt Socket-Berechtigungen an, bereinigt Anmeldeinformationen usw.', autoHardenNote: ' Nur aktivieren, wenn Sie jeden Härtungsvorgang vollständig verstehen; Produktionsumgebungen sollten dies deaktiviert lassen und Audit-Berichte manuell prüfen.' },
    costCircuit: { title: 'Cost-Schutzschalter', subtitle: 'Wenn ein aktiviertes Limit überschritten wird, pausiert der "Schutzschalter" die Session', enabled: 'Cost-Schutzschalter aktivieren', enabledHelp: 'Wenn deaktiviert, werden trotz konfigurierter Limits nur Alarme geschrieben, ohne die Session tatsächlich zu pausieren', hourlyLimit: 'Stündliches Limit', dailyLimit: 'Tägliches Limit', monthlyLimit: 'Monatliches Limit' },
    monitors: { title: 'Hintergrundmonitoren', subtitle: '4 langlebige Monitoren, die von SecureClaw gestartet werden. Einen ausschalten = SecureClaw überspringt den start()-Aufruf dieses Monitors.', credentials: 'Anmeldeinformations-Leck-Monitor (credentials)', credentialsHelp: 'stateDir nach API-Schlüsseln / privaten Schlüsseln / Cookie-Dateien scannen', memory: 'Speicher-Integritäts-Monitor (memory)', memoryHelp: 'memory_store / MEMORY.md / SOUL.md auf unerwartete Schreibvorgänge überwachen', skills: 'Skill-Scan-Monitor (skills)', skillsHelp: '~/.openclaw/skills und workspace/skills auf verdächtige Installationen scannen', cost: 'Kosten-Monitor (cost)', costHelp: 'LLM-Aufruf-Token & Kosten sammeln — Voraussetzung für obige cost.*-Limits' },
    memoryReview: { title: 'Speicherüberprüfungsdetails', subtitle: 'Wenn der Speicher-Monitor aktiv ist, steuern die folgenden Elemente spezifische Scan-Richtlinien', integrityChecks: 'Integritätsprüfungen (integrityChecks)', integrityChecksHelp: 'Hash-Baseline-Vergleich für geschützte Speicherdateien', promptInjectionScan: 'Injektion-Scan (promptInjectionScan)', promptInjectionScanHelp: 'Prompt-Injektionsmuster beim Lesen von Speicherinhalten scannen', quarantineEnabled: 'Quarantäne (quarantineEnabled)', quarantineEnabledHelp: 'Risikoreiche Speichereinträge in Quarantäne-Verzeichnis verschieben statt in Kontext zu laden', trustLevels: 'Quellenvertrauensstufen (trustLevels)', trustLevelsHelp: 'Quellen als trusted/unverified/external kennzeichnen, beeinflusst LLM-Kontext-Injektion' },
    skillAudit: { title: 'Skill-Audit', subtitle: 'Scan-Verhalten bei neuer Skill-Installation steuern', blockUnaudited: 'Ungeprüfte Skills blockieren (blockUnaudited)', blockUnauditedHelp: 'Skills, die den Skill-Scan nicht bestanden haben, können nicht installiert oder aktiviert werden', scanOnInstall: 'Bei Installation scannen (scanOnInstall)', scanOnInstallHelp: 'Vor neuer Skill-Installation automatisch Quick-Audit ausführen; Hochrisiko direkt ablehnen', iocCheckEnabled: 'IOC-Prüfung (iocCheckEnabled)', iocCheckEnabledHelp: 'Gegen bösartige Hashes / Domains in ioc/indicators.json abgleichen' },
    egressControl: { title: 'Netzwerk-Egress-Kontrolle', subtitle: 'Steuern Sie, ob Tool-Aufrufe auf Whitelist-Domains beschränkt sind', allowlistEnabled: 'Egress-Allowlist aktivieren (egressAllowlistEnabled)', allowlistEnabledHelp: 'Wenn aktiviert, können nur Domains in der SecureClaw-Allowlist von Tool-Aufrufen erreicht werden.', allowlistNote: 'Hinweis: Die aktuelle Allowlist wird weiterhin von openclaw.json verwaltet; secplane pusht die Liste selbst derzeit nicht.' },
    behavioral: { title: 'Verhaltensbasislinie (behavioral)', subtitle: 'Tool-Aufrufmuster akkumulieren, bei signifikanten Abweichungen von der Basislinie alarmieren', baselineEnabled: 'Basislinien-Akkumulation aktivieren (baselineEnabled)', baselineEnabledHelp: 'Tool-Aufruffrequenz in jsonl akkumulieren; wenn deaktiviert, wird die Basislinie nicht aktualisiert', deviationThreshold: 'Abweichungsschwelle (deviationThreshold)', windowMinutes: 'Fensterlänge (windowMinutes)', minutes: 'Minuten' },
    audit: { title: 'Audit-Prüfungen · 56 Einträge', subtitle: 'SecureClaw führt beim Start 56 Audits durch. Enforce = normaler Bericht; Observe = meldet weiterhin, aber Schweregrad auf LOW reduziert (auto-harden überspringt); Off = komplett überspringen.', total: 'Gesamt', enforceCount: 'enforce', observeCount: 'observe', offCount: 'off', empty: 'Keine Audit-Regeln geladen (Seed möglicherweise nicht ausgeführt)', bulkEnforce: 'Alle Enforce', bulkObserve: 'Alle Observe', bulkOff: 'Alle Off', current: 'Aktuell:' },
    categoryLabel: { 'access-control': 'Zugriffskontrolle (access-control)', 'control-tokens': 'Steuerungs-Token (control-tokens)', 'cost': 'Kosten (cost)', 'credentials': 'Anmeldeinformationen (credentials)', 'cross-layer': 'Cross-Layer-Risiko (cross-layer)', 'degradation': 'Degradationsmodus (degradation)', 'execution': 'Ausführung (execution)', 'gateway': 'Gateway (gateway)', 'ioc': 'Bedrohungs-Intelligence (ioc)', 'kill-switch': 'Notstopp (kill-switch)', 'memory': 'Speicher (memory)', 'memory-trust': 'Speicher-Vertrauen (memory-trust)', 'supply-chain': 'Skill-Lieferkette (supply-chain)' },
    hardening: { title: 'Auto-Remediations-Module · 5', subtitle: 'Jedes Modul steuert, ob eine Klasse von Auto-Fix ausgeführt wird, wenn autoHarden=true. Modul aktivieren = erlaubt Pod-Konfigurationsänderungen während Härtung. Standardmäßig alle deaktiviert zur Vermeidung versehentlicher Änderungen.', warn: '⚠ Überprüfen Sie vor Aktivierung, was das Modul im Audit-Bericht ändern wird.', allowHarden: 'Härten erlauben', noHarden: 'Härten überspringen', empty: 'Keine Härtungsmodul-Regeln geladen' },
    dangerousCommands: { title: 'Gefährliche Befehlsblockierung · dangerous-commands.json', subtitle: 'Jede Kategorie hat eigene Severity + Action. Auf Muster-Text klicken zum Regex-Bearbeiten; unten "+ Hinzufügen" für neues Muster; rechts "+ Neue Kategorie" für benutzerdefinierte Kategorie.', newCategory: '+ Neue Kategorie', newCategoryPrompt: 'Neuer Kategoriename (Englisch snake_case, z.B. custom_internal_cmd):', patterns: 'Muster', disabled: 'disabled', enable: 'Aktivieren', disable: 'Deaktivieren', delete: 'Entf', deleteCategory: 'Kategorie löschen', removePatternsFirst: 'Bitte entfernen Sie zuerst alle Muster unter dieser Kategorie', addPlaceholder: 'Neues Regex zu {cat} hinzufügen (z.B. \\bsudo\\s+rm\\s+-rf)', emptyPatterns: 'Leer — Muster unten hinzufügen' },
    injectionPatterns: { title: 'Prompt-Injektions-Zeichenketten · injection-patterns.json', subtitle: 'Injektions-Merkmalsphrasen unter 7 Kategorien (Groß-/Kleinschreibung-unempfindlicher Teilzeichenabgleich). Gesamt {count} Einträge.', newCategory: '+ Neue Kategorie', newCategoryPrompt: 'Neuer Injektions-Kategoriename (Englisch snake_case, z.B. business_logic_bypass):', firstPhrasePrompt: 'Erste Zeichenkette für diese Kategorie (Platzhalter, in UI bearbeitbar):', addPlaceholder: 'Neue Injektions-Zeichenkette zu {cat} hinzufügen (Groß-/Kleinschreibung-unempfindlicher Teilabgleich)', empty: 'Leer' },
    privacyRules: { title: 'PII-Datenschutzregeln · privacy-rules.json · {count} Einträge', subtitle: 'Auf Regex oder Fix-Spalte klicken zum Bearbeiten. Action: block = ablehnen / remove = löschen / rewrite = umschreiben.', newRule: '+ Neue Regel', newRulePrompt: 'Neue Regel-ID (Englisch snake_case, z.B. employee_id):', regexPrompt: 'Regex (in Tabelle bearbeitbar):', fixPrompt: 'Umschreib-Hinweis für Agent (optional):', idCol: 'ID', regexCol: 'Regex', actionCol: 'Action', fixCol: 'Fix-Hinweis', enableCol: 'Aktivieren', on: 'An', off: 'Aus', delete: 'Entf' },
    ioc: { title: 'Lieferketten-Bedrohungs-Intelligence · supply-chain-ioc.json · {count} Einträge', subtitle: '5 Unterkategorien. Klicken zum Aktivieren/Deaktivieren; × zum Entfernen.', addPlaceholder: { suspicious_skill_pattern: 'Neues Skill-Malware-Feature-Regex hinzufügen (z.B. atob\\() )', c2_server: 'Neue C2-IP / Hostname hinzufügen', clawhavoc_name: 'Neues Nachahmungs-Skill-Namensmuster hinzufügen', clawhavoc_malware: 'Neuen Malware-Familiennamen hinzufügen', malicious_domain: 'Neue bösartige Domain hinzufügen', infostealer_target: 'Neuen zu schützenden sensiblen Dateipfad hinzufügen' }, empty: 'Leer' },
    alerts: { title: 'SecureClaw-Alarme', subtitle: 'Audit-Funde (Schweregrad≥medium) / Credential-Monitor / Cost-Monitor / Kill Switch — Echtzeit von secplane_alert, source=secureclaw', refresh: 'Aktualisieren', time: 'Zeit', source: 'Quelle', rule: 'Regel/Defense', severity: 'Schweregrad', action: 'Aktion', evidence: 'Beweis', noAlerts: 'Keine SecureClaw-Alarme — werden automatisch ausgefüllt, sobald das Plugin läuft' },
    inline: { clickToEdit: 'Klicken zum Bearbeiten', emptyClickToAdd: '(leer — klicken zum Hinzufügen)' },
    addInput: { add: '+ Hinzufügen' },
    toggle: { on: 'An', off: 'Aus' },
    numberRow: { usd: 'USD' },
  },
};
