@claw-link/gateway-host 0.2.12 → 0.2.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claw-link/gateway-host",
-  "version": "0.2.12",
+  "version": "0.2.13",
   "description": "ClawLink Host Gateway — a secure, outbound-only worker that bridges a local agent CLI (OpenClaw, Hermes, Claude, Codex, Cursor) to your ClawLink agents. No inbound ports; authenticated per-agent by a Host Token.",
   "homepage": "https://claw-link.co",
   "bin": {

package/src/adapters/cli.js

@@ -116,8 +116,13 @@ function makeCliAdapter(cfg) {
       // edit or run shell. permArgs is handed to defaultArgs so each adapter can place
       // it correctly (e.g. Codex must put flags BEFORE its `--` end-of-options).
       // Operator args_template overrides take full control.
-      const scope = job.scope || 'customer';
-      const permArgs = (!Array.isArray(agent.args_template) && cfg.permissions) ? cfg.permissions(scope) : [];
+      // Harness nodes do collaborative work (write code/files, run commands), so they get
+      // workspace-write like an admin "configure" turn — even though they're carried on the
+      // 'customer' scope. Real customer chats stay read-only.
+      const writable = !!job.harness || job.scope === 'configure' || job.scope === 'sub_configure';
+      const permArgs = (!Array.isArray(agent.args_template) && cfg.permissions)
+        ? cfg.permissions(writable ? 'configure' : (job.scope || 'customer'))
+        : [];
       const argvFor = (rid) => Array.isArray(agent.args_template)
         ? buildArgv(agent.args_template, { prompt: fullPrompt, sessionId: rid || '', systemPrompt })
         : cfg.defaultArgs(fullPrompt, rid, cfg.promptViaStdin, permArgs);