@claw-link/gateway-host 0.4.1 → 0.4.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@claw-link/gateway-host",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "ClawLink Host Gateway — a secure, outbound-only worker that bridges a local agent CLI (OpenClaw, Hermes, Claude, Codex, Cursor) to your ClawLink agents. No inbound ports; authenticated per-agent by a Host Token.",
   "homepage": "https://claw-link.co",
   "bin": {

package/src/adapters/claude.js

@@ -29,5 +29,8 @@ module.exports = makeCliAdapter({
       ? (profile === 'trusted'
           ? ['--permission-mode', 'bypassPermissions']
           : ['--permission-mode', 'acceptEdits'])
-      : ['--disallowedTools', 'Write Edit MultiEdit NotebookEdit Bash'],
+      // Read-only (customer) turns: deny every write/exec tool. NOTE: each name must be a tool the
+      // installed CLI knows — an unknown name (e.g. the removed `MultiEdit`) makes the CLI reject the
+      // WHOLE run ("deny rule matches no known tool"), which broke every read-only turn on CLI ≥ 2.1.x.
+      : ['--disallowedTools', 'Write Edit NotebookEdit Bash'],
 });

package/src/adapters/cli.js

@@ -179,9 +179,14 @@ function makeCliAdapter(cfg) {
       // Harness nodes do collaborative work (write code/files, run commands), so they get
       // workspace-write like an admin "configure" turn — even though they're carried on the
       // 'customer' scope. Real customer chats stay read-only.
-      const writable = !!job.harness || job.scope === 'configure' || job.scope === 'sub_configure';
-      // 'trusted' profile only ever applies to WRITABLE turns (harness/configure) — customer
-      // chats stay read-only regardless, so a public conversation can never run shell commands.
+      // A validated OWNER testing their OWN agent (chat tags the job config_type='admin_writable' only
+      // for an authenticated admin_test) is WRITABLE too — so tool-agents can run their pipeline from
+      // the test chat. Double-gated: this branch requires the agent to be `trusted`, so a real/anon
+      // customer chat can NEVER become writable (they can't set the tag AND aren't trusted).
+      const adminWritable = job.config_type === 'admin_writable' && (agent.permission_profile || null) === 'trusted';
+      const writable = !!job.harness || job.scope === 'configure' || job.scope === 'sub_configure' || adminWritable;
+      // 'trusted' profile only ever applies to WRITABLE turns (harness/configure/owner-admin) — real
+      // customer chats stay read-only regardless, so a public conversation can never run shell commands.
       const permArgs = (!Array.isArray(agent.args_template) && cfg.permissions)
         ? cfg.permissions(writable ? 'configure' : (job.scope || 'customer'), agent.permission_profile || null)
         : [];