@chrysb/alphaclaw 0.3.4-beta.0 → 0.3.5-beta.0

package/lib/server/routes/browse.js

@@ -4,11 +4,32 @@ const { execFile } = require("child_process");
 const kDefaultTreeDepth = 10;
 const kIgnoredDirectoryNames = new Set([
   ".git",
+  ".alphaclaw",
   "node_modules",
   ".cache",
   "dist",
   "build",
 ]);
+const kLockedBrowsePaths = new Set([
+  "hooks/bootstrap/agents.md",
+  "hooks/bootstrap/tools.md",
+  ".alphaclaw/hourly-git-sync.sh",
+  ".alphaclaw/.cli-device-auto-approved",
+]);
+
+const matchesPolicyPath = (policyPathSet, normalizedPath) => {
+  const safeNormalizedPath = String(normalizedPath || "").trim();
+  if (!safeNormalizedPath) return false;
+  for (const policyPath of policyPathSet) {
+    if (
+      safeNormalizedPath === policyPath ||
+      safeNormalizedPath.endsWith(`/${policyPath}`)
+    ) {
+      return true;
+    }
+  }
+  return false;
+};
 
 const registerBrowseRoutes = ({ app, fs, kRootDir }) => {
   const kRootResolved = path.resolve(kRootDir);
@@ -25,6 +46,14 @@ const registerBrowseRoutes = ({ app, fs, kRootDir }) => {
     return rawPath.replace(/\\/g, "/").replace(/^\/+/, "");
   };
 
+  const normalizePolicyPath = (inputPath) =>
+    String(inputPath || "")
+      .replace(/\\/g, "/")
+      .replace(/^\.\/+/, "")
+      .replace(/^\/+/, "")
+      .trim()
+      .toLowerCase();
+
   const resolveSafePath = (inputPath) => {
     const relativePath = normalizeRelativePath(inputPath);
     const absolutePath = path.resolve(kRootResolved, relativePath);
@@ -88,42 +117,48 @@ const registerBrowseRoutes = ({ app, fs, kRootDir }) => {
     return { type: "folder", name: nodeName, path: nodePath, children };
   };
 
-  const runGitSync = (message, relativeFilePath) =>
+  const runGitCommand = (args) =>
     new Promise((resolve) => {
-      const syncArgs = ["git-sync", "-m", message];
-      if (relativeFilePath) {
-        syncArgs.push("--file", String(relativeFilePath));
-      }
       execFile(
-        "alphaclaw",
-        syncArgs,
-        { timeout: 20000, cwd: kRootResolved },
-        (error) => {
+        "git",
+        args,
+        { timeout: 10000, cwd: kRootResolved },
+        (error, stdout, stderr) => {
           if (error) {
             return resolve({
               ok: false,
-              error: error.message || "alphaclaw git-sync failed",
+              error: String(stderr || stdout || error.message || "git command failed").trim(),
             });
           }
-          return resolve({ ok: true });
+          return resolve({ ok: true, stdout: String(stdout || "") });
         },
       );
     });
 
-  const runGitCommand = (args) =>
+  const runGitCommandWithExitCode = (args) =>
     new Promise((resolve) => {
       execFile(
         "git",
         args,
         { timeout: 10000, cwd: kRootResolved },
         (error, stdout, stderr) => {
-          if (error) {
+          const safeStdout = String(stdout || "");
+          const safeStderr = String(stderr || "");
+          if (!error) {
             return resolve({
-              ok: false,
-              error: String(stderr || stdout || error.message || "git command failed").trim(),
+              ok: true,
+              stdout: safeStdout,
+              stderr: safeStderr,
+              exitCode: 0,
             });
           }
-          return resolve({ ok: true, stdout: String(stdout || "") });
+          return resolve({
+            ok: false,
+            stdout: safeStdout,
+            stderr: safeStderr,
+            exitCode: Number.isInteger(error.code) ? error.code : 1,
+            error: String(error.message || "git command failed"),
+          });
         },
       );
     });
@@ -138,6 +173,16 @@ const registerBrowseRoutes = ({ app, fs, kRootDir }) => {
       .trim();
   };
 
+  const normalizeChangedPath = (rawPath) => {
+    const value = String(rawPath || "").trim();
+    if (!value) return "";
+    if (value.includes(" -> ")) {
+      const segments = value.split(" -> ");
+      return String(segments[segments.length - 1] || "").trim();
+    }
+    return value;
+  };
+
   app.get("/api/browse/tree", (req, res) => {
     const depthValue = Number.parseInt(String(req.query.depth || ""), 10);
     const depth = Number.isFinite(depthValue) && depthValue > 0 ? depthValue : kDefaultTreeDepth;
@@ -200,12 +245,48 @@ const registerBrowseRoutes = ({ app, fs, kRootDir }) => {
         .filter(Boolean);
       const branchLine = statusLines.find((line) => line.startsWith("##")) || "";
       const branch = branchLine.replace(/^##\s*/, "").split("...")[0] || "unknown";
+      const diffNumstatResult = await runGitCommand(["diff", "--numstat", "HEAD"]);
+      const diffStatsByPath = new Map();
+      if (diffNumstatResult.ok) {
+        diffNumstatResult.stdout
+          .split("\n")
+          .map((line) => line.trim())
+          .filter(Boolean)
+          .forEach((line) => {
+            const [addedRaw = "", deletedRaw = "", rawPath = ""] = line.split("\t");
+            const normalizedPath = normalizeChangedPath(rawPath);
+            if (!normalizedPath) return;
+            const addedLines = Number.parseInt(addedRaw, 10);
+            const deletedLines = Number.parseInt(deletedRaw, 10);
+            diffStatsByPath.set(normalizedPath, {
+              addedLines: Number.isFinite(addedLines) ? addedLines : null,
+              deletedLines: Number.isFinite(deletedLines) ? deletedLines : null,
+            });
+          });
+      }
       const changedFiles = statusLines
         .filter((line) => !line.startsWith("##"))
-        .map((line) => ({
-          status: line.slice(0, 2).trim() || "M",
-          path: line.slice(3).trim(),
-        }));
+        .map((line) => {
+          const rawStatus = line.slice(0, 2);
+          const pathValue = normalizeChangedPath(line.slice(3));
+          const stats = diffStatsByPath.get(pathValue) || {
+            addedLines: null,
+            deletedLines: null,
+          };
+          const statusKind =
+            rawStatus === "??" || rawStatus.includes("A")
+              ? "U"
+              : rawStatus.includes("D")
+                ? "D"
+                : "M";
+          return {
+            status: rawStatus.trim() || "M",
+            statusKind,
+            path: pathValue,
+            addedLines: stats.addedLines,
+            deletedLines: stats.deletedLines,
+          };
+        });
 
       let repoSlug = envRepoSlug;
       if (!repoSlug) {
@@ -248,7 +329,7 @@ const registerBrowseRoutes = ({ app, fs, kRootDir }) => {
         branch,
         isDirty: changedFiles.length > 0,
         changedFilesCount: changedFiles.length,
-        changedFiles: changedFiles.slice(0, 8),
+        changedFiles: changedFiles.slice(0, 16),
         commits,
       });
     } catch (error) {
@@ -259,12 +340,143 @@ const registerBrowseRoutes = ({ app, fs, kRootDir }) => {
     }
   });
 
+  app.get("/api/browse/git-diff", async (req, res) => {
+    const resolvedPath = resolveSafePath(req.query.path);
+    if (!resolvedPath.ok) {
+      return res.status(400).json({ ok: false, error: resolvedPath.error });
+    }
+    const relativePath = String(resolvedPath.relativePath || "").trim();
+    if (!relativePath) {
+      return res.status(400).json({ ok: false, error: "path is required" });
+    }
+
+    try {
+      const statusResult = await runGitCommandWithExitCode([
+        "status",
+        "--porcelain",
+        "--",
+        relativePath,
+      ]);
+      if (!statusResult.ok && /not a git repository/i.test(statusResult.stderr || "")) {
+        return res.status(400).json({ ok: false, error: "No git repo at this root" });
+      }
+      const statusLines = statusResult.stdout
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean);
+      const isUntracked = statusLines.some((line) => line.startsWith("??"));
+
+      const diffResult = isUntracked
+        ? await runGitCommandWithExitCode([
+            "diff",
+            "--no-index",
+            "--",
+            "/dev/null",
+            resolvedPath.absolutePath,
+          ])
+        : await runGitCommandWithExitCode(["diff", "HEAD", "--", relativePath]);
+
+      const untrackedAllowedFailure =
+        isUntracked && diffResult.exitCode === 1 && diffResult.stdout;
+      if (!diffResult.ok && !untrackedAllowedFailure) {
+        return res.status(500).json({
+          ok: false,
+          error: diffResult.stderr || diffResult.error || "Could not load file diff",
+        });
+      }
+
+      const content = String(diffResult.stdout || "")
+        .replaceAll(resolvedPath.absolutePath, relativePath)
+        .trimEnd();
+      return res.json({
+        ok: true,
+        path: relativePath,
+        content,
+      });
+    } catch (error) {
+      return res
+        .status(500)
+        .json({ ok: false, error: error.message || "Could not load file diff" });
+    }
+  });
+
+  app.post("/api/browse/git-sync", async (req, res) => {
+    try {
+      const commitMessageRaw = String(req.body?.message || "").trim();
+      const commitMessage = commitMessageRaw || "sync changes";
+      const statusResult = await runGitCommand(["status", "--porcelain"]);
+      if (!statusResult.ok) {
+        if (/not a git repository/i.test(statusResult.error || "")) {
+          return res
+            .status(400)
+            .json({ ok: false, error: "No git repo at this root" });
+        }
+        return res.status(500).json({
+          ok: false,
+          error: statusResult.error || "Could not read git status",
+        });
+      }
+      const hasChanges = statusResult.stdout
+        .split("\n")
+        .map((line) => line.trim())
+        .filter(Boolean).length > 0;
+      if (!hasChanges) {
+        return res.json({
+          ok: true,
+          committed: false,
+          message: "No changes to sync",
+        });
+      }
+      const addResult = await runGitCommand(["add", "-A"]);
+      if (!addResult.ok) {
+        return res.status(500).json({
+          ok: false,
+          error: addResult.error || "Could not stage changes",
+        });
+      }
+      const commitResult = await runGitCommand(["commit", "-m", commitMessage]);
+      if (!commitResult.ok) {
+        if (/nothing to commit/i.test(commitResult.error || "")) {
+          return res.json({
+            ok: true,
+            committed: false,
+            message: "No changes to sync",
+          });
+        }
+        return res.status(500).json({
+          ok: false,
+          error: commitResult.error || "Could not commit changes",
+        });
+      }
+      const shortHashResult = await runGitCommand(["rev-parse", "--short", "HEAD"]);
+      const shortHash = shortHashResult.ok ? String(shortHashResult.stdout || "").trim() : "";
+      return res.json({
+        ok: true,
+        committed: true,
+        shortHash,
+        message: `Committed ${shortHash || "changes"}`,
+      });
+    } catch (error) {
+      return res.status(500).json({
+        ok: false,
+        error: error.message || "Could not sync changes",
+      });
+    }
+  });
+
   app.put("/api/browse/write", async (req, res) => {
     const { path: targetPath, content } = req.body || {};
     const resolvedPath = resolveSafePath(targetPath);
     if (!resolvedPath.ok) {
       return res.status(400).json({ ok: false, error: resolvedPath.error });
     }
+    const normalizedPolicyPath = normalizePolicyPath(resolvedPath.relativePath);
+    if (matchesPolicyPath(kLockedBrowsePaths, normalizedPolicyPath)) {
+      return res.status(403).json({
+        ok: false,
+        error: "This file is managed by Alpha Claw and cannot be edited.",
+      });
+    }
     if (typeof content !== "string") {
       return res.status(400).json({ ok: false, error: "content must be a string" });
     }
@@ -275,16 +487,9 @@ const registerBrowseRoutes = ({ app, fs, kRootDir }) => {
         return res.status(400).json({ ok: false, error: "Path is not a file" });
       }
       fs.writeFileSync(resolvedPath.absolutePath, content, "utf8");
-      const fileName = path.basename(resolvedPath.absolutePath);
-      const syncResult = await runGitSync(
-        `Edit ${fileName} via UI`,
-        resolvedPath.relativePath,
-      );
       return res.json({
         ok: true,
         path: resolvedPath.relativePath,
-        synced: syncResult.ok,
-        syncError: syncResult.ok ? undefined : syncResult.error,
       });
     } catch (error) {
       return res.status(500).json({ ok: false, error: error.message || "Could not save file" });

package/lib/server/routes/pairings.js

@@ -1,15 +1,21 @@
 const fs = require("fs");
 const { OPENCLAW_DIR } = require("../constants");
+const { buildManagedPaths } = require("../internal-files-migration");
 
 const registerPairingRoutes = ({ app, clawCmd, isOnboarded, fsModule = fs, openclawDir = OPENCLAW_DIR }) => {
   let pairingCache = { pending: [], ts: 0 };
   const PAIRING_CACHE_TTL = 10000;
-  const kCliAutoApproveMarkerPath = `${openclawDir}/.cli-device-auto-approved`;
+  const {
+    cliDeviceAutoApprovedPath: kCliAutoApproveMarkerPath,
+    internalDir: kManagedFilesDir,
+  } = buildManagedPaths({
+    openclawDir,
+  });
 
   const hasCliAutoApproveMarker = () => fsModule.existsSync(kCliAutoApproveMarkerPath);
 
   const writeCliAutoApproveMarker = () => {
-    fsModule.mkdirSync(openclawDir, { recursive: true });
+    fsModule.mkdirSync(kManagedFilesDir, { recursive: true });
     fsModule.writeFileSync(
       kCliAutoApproveMarkerPath,
       JSON.stringify({ approvedAt: new Date().toISOString() }, null, 2),

package/lib/server/routes/system.js

@@ -1,3 +1,5 @@
+const { buildManagedPaths } = require("../internal-files-migration");
+
 const registerSystemRoutes = ({
   app,
   fs,
@@ -35,7 +37,9 @@ const registerSystemRoutes = ({
     kSystemVars.has(key) || kEnvVarsReservedForUserInput.has(key);
   const kSystemCronPath = "/etc/cron.d/openclaw-hourly-sync";
   const kSystemCronConfigPath = `${OPENCLAW_DIR}/cron/system-sync.json`;
-  const kSystemCronScriptPath = `${OPENCLAW_DIR}/hourly-git-sync.sh`;
+  const { hourlyGitSyncPath: kSystemCronScriptPath } = buildManagedPaths({
+    openclawDir: OPENCLAW_DIR,
+  });
   const kDefaultSystemCronSchedule = "0 * * * *";
   const isValidCronSchedule = (value) =>
     typeof value === "string" && /^(\S+\s+){4}\S+$/.test(value.trim());

package/lib/server.js

@@ -76,6 +76,9 @@ const {
   installControlUiSkill,
   syncBootstrapPromptFiles,
 } = require("./server/onboarding/workspace");
+const {
+  migrateManagedInternalFiles,
+} = require("./server/internal-files-migration");
 const { createTelegramApi } = require("./server/telegram-api");
 const { createDiscordApi } = require("./server/discord-api");
 const { createWatchdogNotifier } = require("./server/watchdog-notify");
@@ -100,6 +103,10 @@ const { PORT, GATEWAY_URL, kTrustProxyHops, SETUP_API_PREFIXES } = constants;
 
 startEnvWatcher();
 attachGatewaySignalHandlers();
+migrateManagedInternalFiles({
+  fs,
+  openclawDir: constants.OPENCLAW_DIR,
+});
 
 const app = express();
 app.set("trust proxy", kTrustProxyHops);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chrysb/alphaclaw",
-  "version": "0.3.4-beta.0",
+  "version": "0.3.5-beta.0",
   "publishConfig": {
     "access": "public"
   },