@claw-link/gateway-host 0.2.2 → 0.2.3

package/README.md

@@ -61,6 +61,17 @@ Change the Claude model by editing `.claude/settings.json` (e.g. `"model": "opus
 For Codex/Cursor, set the model via their CLI (`args_template` in the config, or the
 tool's own settings).
 
+**Permissions by scope** — each job carries a scope, and the Claude adapter runs with
+matching permissions automatically:
+
+| Trigger | Scope | Claude permissions |
+|---------|-------|--------------------|
+| Admin **Setup via Chat** / apply skill | `configure` | `--permission-mode acceptEdits` — may write workspace files (GUARDRAILS/SOUL/BOOTSTRAP/TOOLS/AGENTS) |
+| Customer chat + discovery | `customer` | `--disallowedTools "Write Edit MultiEdit NotebookEdit Bash"` — **read-only**, cannot edit config or run shell |
+
+So an agent's files are editable from the admin panel but never from customer/discovery
+chat. (Operator `args_template` overrides this for advanced setups.)
+
 ## Commands
 
 After install the `clhost` command is available (aliases: `gateway-host`, `claw-host`):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claw-link/gateway-host",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "ClawLink Host Gateway — a secure, outbound-only worker that bridges a local agent CLI (OpenClaw, Hermes, Claude, Codex, Cursor) to your ClawLink agents. No inbound ports; authenticated per-agent by a Host Token.",
   "homepage": "https://claw-link.co",
   "bin": {

package/src/adapters/claude.js

@@ -16,4 +16,11 @@ module.exports = makeCliAdapter({
     '--verbose',
     ...(resumeId ? ['--resume', resumeId] : []),
   ],
+  // Admin "configure" turns may write workspace files (auto-accept edits, no shell
+  // prompt); customer/discovery turns are strictly read-only (no Write/Edit/Bash) so
+  // they can never modify the agent's config or hang on a permission prompt.
+  permissions: (scope) =>
+    (scope === 'configure' || scope === 'sub_configure')
+      ? ['--permission-mode', 'acceptEdits']
+      : ['--disallowedTools', 'Write Edit MultiEdit NotebookEdit Bash'],
 });

package/src/adapters/cli.js

@@ -76,9 +76,14 @@ function makeCliAdapter(cfg) {
       // spawn never fails with ENOENT (coding workspaces are validated at setup).
       try { fs.mkdirSync(agent.work_dir, { recursive: true }); } catch { /* ignore */ }
 
+      // Scope-based permissions: admin "configure" turns may write workspace files
+      // (GUARDRAILS/SOUL/etc.); customer/discovery turns are read-only and cannot
+      // edit or run shell. Operator args_template overrides take full control.
+      const scope = job.scope || 'customer';
+      const permArgs = (!Array.isArray(agent.args_template) && cfg.permissions) ? cfg.permissions(scope) : [];
       const argvFor = (rid) => Array.isArray(agent.args_template)
         ? buildArgv(agent.args_template, { prompt: fullPrompt, sessionId: rid || '', systemPrompt })
-        : cfg.defaultArgs(fullPrompt, rid, cfg.promptViaStdin);
+        : [...cfg.defaultArgs(fullPrompt, rid, cfg.promptViaStdin), ...permArgs];
 
       let emittedAny = false;
       const runOnce = async function* (rid) {