@claw-link/gateway-host 0.2.6 → 0.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claw-link/gateway-host",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "ClawLink Host Gateway — a secure, outbound-only worker that bridges a local agent CLI (OpenClaw, Hermes, Claude, Codex, Cursor) to your ClawLink agents. No inbound ports; authenticated per-agent by a Host Token.",
   "homepage": "https://claw-link.co",
   "bin": {

package/scripts/install.js

@@ -171,11 +171,13 @@ function printAgents(cfg) {
   if (!agents.length) { console.log('  No agents mapped. Run: clhost add-agent'); return; }
   console.log(`  ${agents.length} agent(s) mapped:`);
   for (const a of agents) {
-    const id = (a.agent_id || '(unresolved)').slice(0, 8);
+    const id = a.agent_id || '(unresolved)';
     const tok = a.host_token ? `…${String(a.host_token).slice(-4)}` : '—';
-    console.log(`    • ${id}…  runtime=${a.runtime || 'pull'}  token=${tok}` + (a.work_dir ? `  work=${a.work_dir}` : ''));
+    console.log(`    • ${id}  runtime=${a.runtime || 'pull'}  token=${tok}` + (a.work_dir ? `  work=${a.work_dir}` : ''));
   }
-  console.log('\n  Update a token after rotating it:  clhost retoken <id>');
+  // Show a concrete, copy-pasteable example (commands also accept any id prefix).
+  const example = agents[0].agent_id || '<id>';
+  console.log(`\n  Re-enter a token after rotating (full id or any prefix):  clhost retoken ${example}`);
 }
 
 // `agents` — list mapped agents.

package/src/adapters/cli.js

@@ -4,6 +4,7 @@
 // The operator can override binary + args_template in config.
 
 const fs = require('fs');
+const path = require('path');
 const { spawnStreaming, buildArgv } = require('./base');
 const sessionStore = require('../session-store');
 
@@ -46,8 +47,42 @@ function makeStreamJsonParser(capture) {
   };
 }
 
+// Codex `exec --json` JSONL events. The assistant's text is in
+// item.completed → item.type 'agent_message' → item.text (there can be several:
+// narration + final). thread.started.thread_id is the resume id. command/file/mcp
+// items become tool/log lines for the activity log.
+function makeCodexJsonParser(capture) {
+  return function parse(line) {
+    const s = line.trim();
+    if (!s || s[0] !== '{') return []; // skip non-JSON (e.g. "Reading additional input…")
+    let ev;
+    try { ev = JSON.parse(s); } catch { return []; }
+    const out = [];
+    if (ev.type === 'thread.started') {
+      if (ev.thread_id && capture) capture.sessionId = ev.thread_id;
+    } else if (ev.type === 'item.completed' && ev.item) {
+      const it = ev.item;
+      if (it.type === 'agent_message' && typeof it.text === 'string') {
+        out.push({ type: 'chunk', content: (capture && capture.sawText ? '\n\n' : '') + it.text });
+        if (capture) capture.sawText = true;
+      } else if (it.type === 'command_execution' && it.command) {
+        out.push({ type: 'tool', content: `run: ${String(it.command).replace(/^\/bin\/\w+ -lc /, '').slice(0, 80)}` });
+      } else if (it.type === 'file_change' && Array.isArray(it.changes)) {
+        out.push({ type: 'tool', content: it.changes.map((c) => `${c.kind || 'edit'} ${path.basename(c.path || '')}`).join(', ') || 'file_change' });
+      } else if (it.type === 'mcp_tool_call') {
+        out.push({ type: 'tool', content: it.tool || it.name || 'mcp' });
+      }
+    } else if (ev.type === 'turn.failed') {
+      const m = (ev.error && (ev.error.message || ev.error)) || 'turn failed';
+      out.push({ type: 'log', content: `error: ${String(m).slice(0, 200)}` });
+    }
+    return out;
+  };
+}
+
 /**
- * @param cfg { name, binaries:[], defaultArgs(fullPrompt, resumeId):[], streamJson?:bool,
+ * @param cfg { name, binaries:[], defaultArgs(fullPrompt, resumeId, promptViaStdin, permArgs):[],
+ *              streamJson?:bool, makeParser?:(capture)=>parseFn, permissions?:(scope)=>[],
  *              promptViaStdin?:bool, timeoutMs?:number }
  */
 function makeCliAdapter(cfg) {
@@ -90,7 +125,9 @@ function makeCliAdapter(cfg) {
       let emittedAny = false;
       const runOnce = async function* (rid) {
         const capture = {};
-        const parseLine = cfg.streamJson ? makeStreamJsonParser(capture) : genericLineParser;
+        const parseLine = cfg.makeParser ? cfg.makeParser(capture)
+          : cfg.streamJson ? makeStreamJsonParser(capture)
+          : genericLineParser;
         for await (const evt of spawnStreaming({
           binary, argv: argvFor(rid), cwd: agent.work_dir, timeoutMs,
           stdinInput: cfg.promptViaStdin ? fullPrompt : null, parseLine,
@@ -122,4 +159,4 @@ function makeCliAdapter(cfg) {
   };
 }
 
-module.exports = { makeCliAdapter, genericLineParser, makeStreamJsonParser };
+module.exports = { makeCliAdapter, genericLineParser, makeStreamJsonParser, makeCodexJsonParser };

package/src/adapters/codex.js

@@ -1,22 +1,33 @@
 'use strict';
-// OpenAI Codex CLI, non-interactive. VERIFY exact subcommand/flags + resume
-// mechanism against the installed CLI; operators can override args_template.
-const { makeCliAdapter } = require('./cli');
+// OpenAI Codex CLI (`codex exec`), non-interactive. Verified against codex-cli
+// 0.142.x. Notes that drove this implementation:
+//  - `exec` has NO `--ask-for-approval` flag (passing it = exit code 2). Approval is
+//    set via the `-c approval_policy=...` config override; in exec it never prompts.
+//  - Sandbox: `exec` accepts `-s/--sandbox`, but `exec resume` does NOT — so we set
+//    the sandbox via `-c sandbox_mode=...`, which BOTH accept (uniform args).
+//  - `--skip-git-repo-check` so a non-git workspace doesn't fail.
+//  - `--json` emits JSONL events; the answer is item.completed→agent_message→text.
+//  - Resume is a SUBCOMMAND: `codex exec resume [OPTIONS] <SESSION_ID> -- <prompt>`,
+//    and the session id is thread.started.thread_id from the previous run.
+const { makeCliAdapter, makeCodexJsonParser } = require('./cli');
 
 module.exports = makeCliAdapter({
   name: 'codex',
   binaries: ['codex'],
   promptViaStdin: false,
-  // Flags go BEFORE `--`; `--` ends option parsing so an untrusted prompt starting
-  // with '-' is treated as a positional argument, never as a flag (arg-injection
-  // hardening). `--ask-for-approval never` ensures it never blocks waiting for an
-  // interactive approval in headless mode.
-  defaultArgs: (fullPrompt, _resumeId, _stdin, perm = []) => ['exec', ...perm, '--', fullPrompt],
-  // Admin "configure" → workspace-write sandbox (may write files in its work dir);
-  // customer/discovery → read-only sandbox (cannot modify anything). Never the
-  // danger/full-access sandbox.
-  permissions: (scope) =>
-    (scope === 'configure' || scope === 'sub_configure')
-      ? ['--sandbox', 'workspace-write', '--ask-for-approval', 'never']
-      : ['--sandbox', 'read-only', '--ask-for-approval', 'never'],
+  makeParser: makeCodexJsonParser,
+  defaultArgs: (fullPrompt, resumeId, _stdin, perm = []) => {
+    const opts = ['--json', '--skip-git-repo-check', ...perm];
+    // `--` ends option parsing so a prompt starting with '-' is positional, never a flag.
+    return resumeId
+      ? ['exec', 'resume', ...opts, resumeId, '--', fullPrompt]
+      : ['exec', ...opts, '--', fullPrompt];
+  },
+  // Admin "configure" → workspace-write (may write its work dir); customer/discovery
+  // → read-only. approval_policy=never so it never blocks on an approval prompt.
+  // Set via `-c` config overrides (the only form `exec resume` also accepts).
+  permissions: (scope) => {
+    const mode = (scope === 'configure' || scope === 'sub_configure') ? 'workspace-write' : 'read-only';
+    return ['-c', `sandbox_mode="${mode}"`, '-c', 'approval_policy="never"'];
+  },
 });