@claw-link/gateway-host 0.3.10 → 0.3.11

package/bin/cli.js

@@ -36,6 +36,15 @@ async function main() {
     case 'model':
       return require('../scripts/install').setModelCmd();
 
+    case 'set-permission':
+    case 'set-perm':
+    case 'permission':
+      return require('../scripts/install').setPermissionCmd();
+
+    case 'set-concurrency':
+    case 'concurrency':
+      return require('../scripts/install').setConcurrencyCmd();
+
     case 'agents':
     case 'list':
       return require('../scripts/install').listAgents();
@@ -101,6 +110,8 @@ async function main() {
         '  rm-agent    Remove a mapped agent (clhost rm-agent <id>)',
         '  retoken     Re-enter a new Host Token for an existing agent (clhost retoken <id>)',
         '  set-model   Set the model an agent’s runtime uses (clhost set-model <id> <model>)',
+        '  set-permission  Permission profile for writable turns (clhost set-permission <id> trusted|standard)',
+        '  set-concurrency Parallel jobs for an agent, isolated per-job dirs (clhost set-concurrency <id> <n>)',
         '  agents      List mapped agents',
         '  status      Show bridge, service state, and mapped agents',
         '  doctor      Diagnose config, runtime binaries, bridge + token/machine binding',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claw-link/gateway-host",
-  "version": "0.3.10",
+  "version": "0.3.11",
   "description": "ClawLink Host Gateway — a secure, outbound-only worker that bridges a local agent CLI (OpenClaw, Hermes, Claude, Codex, Cursor) to your ClawLink agents. No inbound ports; authenticated per-agent by a Host Token.",
   "homepage": "https://claw-link.co",
   "bin": {

package/scripts/install.js

@@ -226,7 +226,7 @@ function printAgents(cfg) {
   for (const a of agents) {
     const id = a.agent_id || '(unresolved)';
     const tok = a.host_token ? `…${String(a.host_token).slice(-4)}` : '—';
-    console.log(`    • ${id}  runtime=${a.runtime || 'pull'}  token=${tok}` + (a.model ? `  model=${a.model}` : '') + (a.work_dir ? `  work=${a.work_dir}` : ''));
+    console.log(`    • ${id}  runtime=${a.runtime || 'pull'}  token=${tok}` + (a.model ? `  model=${a.model}` : '') + (a.permission_profile ? `  perm=${a.permission_profile}` : '') + (Number(a.concurrency) > 1 ? `  conc=${a.concurrency}` : '') + (a.work_dir ? `  work=${a.work_dir}` : ''));
   }
   // Show a concrete, copy-pasteable example (commands also accept any id prefix).
   const example = agents[0].agent_id || '<id>';
@@ -310,6 +310,61 @@ async function setModelCmd() {
   console.log(`  ✓ ${clear ? `Cleared model for ${agent.agent_id} — using the ${agent.runtime} default.` : `Set ${agent.agent_id} model → ${modelArg} (${agent.runtime}).`}` + note);
 }
 
+// `set-permission <id-or-prefix> <trusted|standard>` — set the agent's permission profile for
+// WRITABLE (configure/harness) turns. 'trusted' lets the runtime run shell commands without
+// prompts (claude bypassPermissions / codex danger-full-access) — required for dev/infra/CI
+// agents that npm/mvn/docker/git. Customer chats stay read-only regardless. Restarts to apply.
+async function setPermissionCmd() {
+  const cfg = config.load();
+  if (!cfg || !(cfg.agents || []).length) { console.log('No agents configured. Run: clhost add-agent'); return; }
+  const target = (process.argv[3] || '').trim();
+  const profile = (process.argv[4] || '').trim().toLowerCase();
+  if (!target || !['trusted', 'standard'].includes(profile)) {
+    console.log('Usage: clhost set-permission <agent-id|prefix> <trusted|standard>');
+    console.log('  trusted   Writable turns run shell without prompts (dev/infra/CI agents).');
+    console.log('  standard  Default: writable turns may edit files only; no unprompted shell.\n');
+    printAgents(cfg);
+    return;
+  }
+  const agent = cfg.agents.find((a) => a.agent_id && (a.agent_id === target || a.agent_id.startsWith(target)));
+  if (!agent) { console.log(`  No agent matched '${target}'.`); return; }
+  agent.permission_profile = profile === 'trusted' ? 'trusted' : null;
+  config.save(cfg);
+  if (profile === 'trusted') {
+    console.log('  ⚠ trusted = this agent can run ANY shell command on this machine during harness/');
+    console.log('    configure turns. Only use for agents whose workspaces + briefs you control.');
+  }
+  const r = await gracefulServiceRestartCLI();
+  const note = !r.restarted ? ' Run `clhost restart` to apply.'
+    : r.confirmed ? ' Service restarted.' : ' Restarting — check `clhost status`.';
+  console.log(`  ✓ ${agent.agent_id} permission profile → ${profile}.` + note);
+}
+
+// `set-concurrency <id-or-prefix> <n>` — how many jobs this agent runs IN PARALLEL. With n > 1,
+// each job gets an isolated working dir (work_dir/.jobs/<job-id>) so parallel runs can't trample
+// each other; skill files (CLAUDE.md/AGENTS.md etc.) still apply via the parent directory.
+// Scale dev agents in a harness by pointing MULTIPLE nodes at the same agent + raising this.
+async function setConcurrencyCmd() {
+  const cfg = config.load();
+  if (!cfg || !(cfg.agents || []).length) { console.log('No agents configured. Run: clhost add-agent'); return; }
+  const target = (process.argv[3] || '').trim();
+  const n = Number((process.argv[4] || '').trim());
+  if (!target || !Number.isInteger(n) || n < 1 || n > 16) {
+    console.log('Usage: clhost set-concurrency <agent-id|prefix> <1-16>');
+    console.log('  n parallel jobs for this agent. n>1 isolates each job in work_dir/.jobs/<id>.\n');
+    printAgents(cfg);
+    return;
+  }
+  const agent = cfg.agents.find((a) => a.agent_id && (a.agent_id === target || a.agent_id.startsWith(target)));
+  if (!agent) { console.log(`  No agent matched '${target}'.`); return; }
+  agent.concurrency = n;
+  config.save(cfg);
+  const r = await gracefulServiceRestartCLI();
+  const note = !r.restarted ? ' Run `clhost restart` to apply.'
+    : r.confirmed ? ' Service restarted.' : ' Restarting — check `clhost status`.';
+  console.log(`  ✓ ${agent.agent_id} concurrency → ${n}${n > 1 ? ' (per-job isolated working dirs)' : ''}.` + note);
+}
+
 // `start | stop | restart` — control the installed background service.
 function serviceControl(action) {
   const platform = process.platform;
@@ -739,7 +794,7 @@ async function update() {
 }
 
 module.exports = {
-  run, installOnly, addAgentCmd, removeAgentCmd, retokenCmd, setModelCmd, listAgents, status,
+  run, installOnly, addAgentCmd, removeAgentCmd, retokenCmd, setModelCmd, setPermissionCmd, setConcurrencyCmd, listAgents, status,
   serviceControl, serviceControlCmd, installService, SERVICE_LABEL,
   versionCmd, doctor, logs, update,
 };

package/src/adapters/claude.js

@@ -21,8 +21,13 @@ module.exports = makeCliAdapter({
   // Admin "configure" turns may write workspace files (auto-accept edits, no shell
   // prompt); customer/discovery turns are strictly read-only (no Write/Edit/Bash) so
   // they can never modify the agent's config or hang on a permission prompt.
-  permissions: (scope) =>
+  // 'trusted' profile (clhost set-permission <id> trusted) upgrades WRITABLE turns to
+  // bypassPermissions so dev/infra agents can run shell (npm/mvn/docker/git) without
+  // prompts — customer turns stay read-only regardless.
+  permissions: (scope, profile) =>
     (scope === 'configure' || scope === 'sub_configure')
-      ? ['--permission-mode', 'acceptEdits']
+      ? (profile === 'trusted'
+          ? ['--permission-mode', 'bypassPermissions']
+          : ['--permission-mode', 'acceptEdits'])
       : ['--disallowedTools', 'Write Edit MultiEdit NotebookEdit Bash'],
 });

package/src/adapters/cli.js

@@ -113,9 +113,26 @@ function makeCodexJsonParser(capture) {
   };
 }
 
+// Best-effort cleanup of per-job working dirs older than 48h (parallel workers create one per job).
+const JOB_DIR_TTL_MS = 48 * 60 * 60 * 1000;
+let lastPruneAt = 0;
+function pruneJobDirs(jobsRoot, logger) {
+  const now = Date.now();
+  if (now - lastPruneAt < 10 * 60 * 1000) return; // at most every 10 min across all agents
+  lastPruneAt = now;
+  try {
+    for (const name of fs.readdirSync(jobsRoot)) {
+      const p = path.join(jobsRoot, name);
+      try {
+        if (now - fs.statSync(p).mtimeMs > JOB_DIR_TTL_MS) fs.rmSync(p, { recursive: true, force: true });
+      } catch { /* skip entry */ }
+    }
+  } catch { /* no .jobs dir yet */ }
+}
+
 /**
  * @param cfg { name, binaries:[], defaultArgs(fullPrompt, resumeId, promptViaStdin, permArgs, model):[],
- *              streamJson?:bool, makeParser?:(capture)=>parseFn, permissions?:(scope)=>[],
+ *              streamJson?:bool, makeParser?:(capture)=>parseFn, permissions?:(scope, profile)=>[],
  *              promptViaStdin?:bool, timeoutMs?:number }
  */
 function makeCliAdapter(cfg) {
@@ -136,9 +153,21 @@ function makeCliAdapter(cfg) {
       // the spawn never fail with ENOENT (coding workspaces are validated at setup).
       try { fs.mkdirSync(agent.work_dir, { recursive: true }); } catch { /* ignore */ }
 
-      // Download any attachments into the workspace and reference their LOCAL paths, so the CLI
+      // Parallel workers: when the agent runs jobs CONCURRENTLY (concurrency > 1), each job gets an
+      // ISOLATED working dir under .jobs/<job-id> so two runs never trample each other's files
+      // (git index, node_modules, build output). Claude/Codex read CLAUDE.md / AGENTS.md up the
+      // directory tree, so the workspace skill files still apply. Serial agents keep the shared
+      // work_dir (cache warmth). Old job dirs are pruned best-effort after 48h.
+      let runDir = agent.work_dir;
+      if (Number(agent.concurrency) > 1) {
+        runDir = path.join(agent.work_dir, '.jobs', String(job.id).replace(/[^a-zA-Z0-9-]/g, '').slice(0, 12) || 'job');
+        try { fs.mkdirSync(runDir, { recursive: true }); } catch { /* fall back to shared dir */ }
+        pruneJobDirs(path.join(agent.work_dir, '.jobs'), logger);
+      }
+
+      // Download any attachments into the working dir and reference their LOCAL paths, so the CLI
       // (which can't reach a URL) can open them via its Read tool.
-      const attBlock = await localizeAttachments(job.attachments, agent.work_dir, logger);
+      const attBlock = await localizeAttachments(job.attachments, runDir, logger);
       const base = systemPrompt ? `${systemPrompt}\n\n---\n\nUser request:\n${userPrompt}` : userPrompt;
       const fullPrompt = base + attBlock;
 
@@ -151,8 +180,10 @@ function makeCliAdapter(cfg) {
       // workspace-write like an admin "configure" turn — even though they're carried on the
       // 'customer' scope. Real customer chats stay read-only.
       const writable = !!job.harness || job.scope === 'configure' || job.scope === 'sub_configure';
+      // 'trusted' profile only ever applies to WRITABLE turns (harness/configure) — customer
+      // chats stay read-only regardless, so a public conversation can never run shell commands.
       const permArgs = (!Array.isArray(agent.args_template) && cfg.permissions)
-        ? cfg.permissions(writable ? 'configure' : (job.scope || 'customer'))
+        ? cfg.permissions(writable ? 'configure' : (job.scope || 'customer'), agent.permission_profile || null)
         : [];
       // Optional per-agent model override (e.g. `clhost set-model <id> sonnet`). Each adapter
       // places it with the runtime's correct flag; ignored when an args_template takes over.
@@ -168,7 +199,7 @@ function makeCliAdapter(cfg) {
           : cfg.streamJson ? makeStreamJsonParser(capture)
           : genericLineParser;
         for await (const evt of spawnStreaming({
-          binary, argv: argvFor(rid), cwd: agent.work_dir, timeoutMs,
+          binary, argv: argvFor(rid), cwd: runDir, timeoutMs,
           stdinInput: cfg.promptViaStdin ? fullPrompt : null, parseLine, signal,
         })) {
           if (evt.type === 'chunk') emittedAny = true;

package/src/adapters/codex.js

@@ -29,8 +29,11 @@ module.exports = makeCliAdapter({
   // Admin "configure" → workspace-write (may write its work dir); customer/discovery
   // → read-only. approval_policy=never so it never blocks on an approval prompt.
   // Set via `-c` config overrides (the only form `exec resume` also accepts).
-  permissions: (scope) => {
-    const mode = (scope === 'configure' || scope === 'sub_configure') ? 'workspace-write' : 'read-only';
+  // 'trusted' profile upgrades WRITABLE turns to danger-full-access (network + full fs) so
+  // dev agents can npm/mvn/docker — customer turns stay read-only regardless.
+  permissions: (scope, profile) => {
+    const writable = scope === 'configure' || scope === 'sub_configure';
+    const mode = writable ? (profile === 'trusted' ? 'danger-full-access' : 'workspace-write') : 'read-only';
     return ['-c', `sandbox_mode="${mode}"`, '-c', 'approval_policy="never"'];
   },
 });

package/src/config.js

@@ -74,6 +74,11 @@ function normalizeAgent(a) {
     // Optional model override for coding runtimes (claude/codex/cursor/hermes). null = the
     // runtime's own default. Set with `clhost set-model <id> <model>`.
     model: a.model || null,
+    // Permission profile for writable (configure/harness) turns: 'trusted' lets the runtime run
+    // shell commands without prompts (claude --permission-mode bypassPermissions, codex
+    // danger-full-access) — needed for dev/infra/CI agents that npm/mvn/docker/git. Customer
+    // chats stay read-only REGARDLESS of profile. Set with `clhost set-permission <id> trusted`.
+    permission_profile: a.permission_profile === 'trusted' ? 'trusted' : null,
     args_template: Array.isArray(a.args_template) ? a.args_template : null,
     local_gateway_url: a.local_gateway_url || null,
     local_gateway_token: a.local_gateway_token || null,

package/src/worker.js

@@ -159,6 +159,9 @@ async function runAgentLoop(agentCfg, cfg, p2p) {
   let inFlight = 0;
   const starts = []; // job start timestamps for the rolling rate-limit window
   let claimFails = 0; // consecutive claim() errors → exponential backoff w/ jitter (transient 5xx)
+  // Hard job ceiling: config `job_max_ms` overrides the env/default — long dev/build turns
+  // (harness agents running mvn/npm/docker) can legitimately exceed the 15-min default.
+  const jobMaxMs = Number(cfg.job_max_ms) > 0 ? Number(cfg.job_max_ms) : JOB_MAX_MS;
 
   while (!stopping) {
     const now = Date.now();
@@ -178,12 +181,12 @@ async function runAgentLoop(agentCfg, cfg, p2p) {
           inFlight++; starts.push(Date.now()); activeJobIds.add(job.id);
           // Watchdog: guarantees the slot is reclaimed and the job is failed back even
           // if the adapter never settles (no per-adapter timeout by default).
-          const watchdog = new Promise((resolve) => setTimeout(() => resolve('__watchdog__'), JOB_MAX_MS).unref());
+          const watchdog = new Promise((resolve) => setTimeout(() => resolve('__watchdog__'), jobMaxMs).unref());
           Promise.race([processJob(bridge, agentCfg, job, p2p), watchdog])
             .then(async (r) => {
               if (r === '__watchdog__') {
-                logger.error(`job ${job.id} exceeded ${JOB_MAX_MS}ms — reclaiming slot`);
-                try { await bridge.fail(job.id, `host watchdog: job exceeded ${JOB_MAX_MS}ms`); } catch { /* ignore */ }
+                logger.error(`job ${job.id} exceeded ${jobMaxMs}ms — reclaiming slot`);
+                try { await bridge.fail(job.id, `host watchdog: job exceeded ${jobMaxMs}ms`); } catch { /* ignore */ }
               }
             })
             .finally(() => { inFlight--; activeJobIds.delete(job.id); });