@claw-link/gateway-host 0.2.2 → 0.2.4

package/README.md

@@ -61,6 +61,17 @@ Change the Claude model by editing `.claude/settings.json` (e.g. `"model": "opus
 For Codex/Cursor, set the model via their CLI (`args_template` in the config, or the
 tool's own settings).
 
+**Permissions by scope** — each job carries a scope, and the Claude adapter runs with
+matching permissions automatically:
+
+| Trigger | Scope | Claude permissions |
+|---------|-------|--------------------|
+| Admin **Setup via Chat** / apply skill | `configure` | `--permission-mode acceptEdits` — may write workspace files (GUARDRAILS/SOUL/BOOTSTRAP/TOOLS/AGENTS) |
+| Customer chat + discovery | `customer` | `--disallowedTools "Write Edit MultiEdit NotebookEdit Bash"` — **read-only**, cannot edit config or run shell |
+
+So an agent's files are editable from the admin panel but never from customer/discovery
+chat. (Operator `args_template` overrides this for advanced setups.)
+
 ## Commands
 
 After install the `clhost` command is available (aliases: `gateway-host`, `claw-host`):

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claw-link/gateway-host",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "ClawLink Host Gateway — a secure, outbound-only worker that bridges a local agent CLI (OpenClaw, Hermes, Claude, Codex, Cursor) to your ClawLink agents. No inbound ports; authenticated per-agent by a Host Token.",
   "homepage": "https://claw-link.co",
   "bin": {

package/src/adapters/claude.js

@@ -16,4 +16,11 @@ module.exports = makeCliAdapter({
     '--verbose',
     ...(resumeId ? ['--resume', resumeId] : []),
   ],
+  // Admin "configure" turns may write workspace files (auto-accept edits, no shell
+  // prompt); customer/discovery turns are strictly read-only (no Write/Edit/Bash) so
+  // they can never modify the agent's config or hang on a permission prompt.
+  permissions: (scope) =>
+    (scope === 'configure' || scope === 'sub_configure')
+      ? ['--permission-mode', 'acceptEdits']
+      : ['--disallowedTools', 'Write Edit MultiEdit NotebookEdit Bash'],
 });

package/src/adapters/cli.js

@@ -76,9 +76,14 @@ function makeCliAdapter(cfg) {
       // spawn never fails with ENOENT (coding workspaces are validated at setup).
       try { fs.mkdirSync(agent.work_dir, { recursive: true }); } catch { /* ignore */ }
 
+      // Scope-based permissions: admin "configure" turns may write workspace files
+      // (GUARDRAILS/SOUL/etc.); customer/discovery turns are read-only and cannot
+      // edit or run shell. Operator args_template overrides take full control.
+      const scope = job.scope || 'customer';
+      const permArgs = (!Array.isArray(agent.args_template) && cfg.permissions) ? cfg.permissions(scope) : [];
       const argvFor = (rid) => Array.isArray(agent.args_template)
         ? buildArgv(agent.args_template, { prompt: fullPrompt, sessionId: rid || '', systemPrompt })
-        : cfg.defaultArgs(fullPrompt, rid, cfg.promptViaStdin);
+        : [...cfg.defaultArgs(fullPrompt, rid, cfg.promptViaStdin), ...permArgs];
 
       let emittedAny = false;
       const runOnce = async function* (rid) {

package/src/machine.js

@@ -1,29 +1,58 @@
 'use strict';
-// Stable machine fingerprint for host binding. Derived from the host's physical
-// MAC address(es) + hostname, then hashed — we send only the HASH to ClawLink, so
-// raw MACs never leave the machine. Supabase binds this on first connect; after
-// that, only this machine may act for the agent (a stolen token from elsewhere
-// fails the binding check).
+// Stable machine fingerprint for host binding. We bind an agent's token to ONE
+// machine so a stolen token can't be used elsewhere. The fingerprint MUST be
+// stable across reboots and network changes — earlier versions hashed MAC
+// addresses, which rotate (Tailscale/Docker/VPN/private-WiFi) and caused false
+// "host binding mismatch" errors. We now use the OS hardware machine id, with a
+// persisted random id as a fallback, and send only the HASH.
 
 const os = require('os');
+const fs = require('fs');
+const path = require('path');
 const crypto = require('crypto');
+const { execSync } = require('child_process');
+const { enrichedEnv } = require('./paths');
 
-function macAddresses() {
-  const macs = [];
-  const ifaces = os.networkInterfaces();
-  for (const name of Object.keys(ifaces)) {
-    for (const ni of ifaces[name] || []) {
-      if (ni.internal) continue;
-      if (!ni.mac || ni.mac === '00:00:00:00:00:00') continue;
-      macs.push(ni.mac.toLowerCase());
+const HOME_DIR = path.join(os.homedir(), '.clawlink-host');
+
+function execSafe(cmd) {
+  try { return execSync(cmd, { stdio: ['ignore', 'pipe', 'ignore'], timeout: 4000, env: enrichedEnv() }).toString(); }
+  catch { return ''; }
+}
+
+// Stable, hardware-tied id where available.
+function hardwareId() {
+  try {
+    if (process.platform === 'darwin') {
+      const m = execSafe('ioreg -rd1 -c IOPlatformExpertDevice').match(/IOPlatformUUID"\s*=\s*"([^"]+)"/);
+      if (m) return 'hw:' + m[1];
+    } else if (process.platform === 'linux') {
+      for (const p of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
+        try { const id = fs.readFileSync(p, 'utf8').trim(); if (id) return 'hw:' + id; } catch { /* next */ }
+      }
+    } else if (process.platform === 'win32') {
+      const m = execSafe('reg query "HKLM\\SOFTWARE\\Microsoft\\Cryptography" /v MachineGuid').match(/MachineGuid\s+REG_SZ\s+([\w-]+)/i);
+      if (m) return 'hw:' + m[1];
     }
-  }
-  return [...new Set(macs)].sort();
+  } catch { /* fall through */ }
+  return null;
+}
+
+// Stable random id persisted under the home dir (fallback when no hardware id).
+function persistedId() {
+  const idPath = path.join(HOME_DIR, 'machine-id');
+  try { const id = fs.readFileSync(idPath, 'utf8').trim(); if (id) return 'id:' + id; } catch { /* create below */ }
+  try {
+    fs.mkdirSync(HOME_DIR, { recursive: true });
+    const id = crypto.randomBytes(32).toString('hex');
+    fs.writeFileSync(idPath, id, { mode: 0o600 });
+    try { fs.chmodSync(idPath, 0o600); } catch { /* best effort */ }
+    return 'id:' + id;
+  } catch { return null; }
 }
 
 function machineId() {
-  const macs = macAddresses();
-  const basis = (macs.length ? macs.join(',') : 'no-mac') + '|' + os.hostname();
+  const basis = hardwareId() || persistedId() || ('host:' + os.hostname());
   return crypto.createHash('sha256').update(basis).digest('hex');
 }