@jonathanleelx/meddle 0.5.0-beta.23 → 0.5.0-beta.25

package/CONFIG_STRUCTURE.md

@@ -204,6 +204,7 @@ https://localhost:13001/micro/app?a=1
 | `detailBodySizeKB` | 日志详情保存的请求/响应体截断阈值（KB），默认 `256`；调大可保留更大 body 便于排查，但会增加内存占用（最多 `MAX_DETAIL_SIZE=200` 条同时驻留）。作用范围为单个 session，解析顺序：当前 session 的 `settings.json` → 默认 session（`~/.meddle/settings.json`，仅非默认 session 继承）→ 环境变量 `MEDDLE_MAX_DETAIL_BODY_KB` → 默认 `256`。修改后下次请求即生效（基于 mtime 缓存检测） |
 | `activeRuleFiles` | 当前启用的路由规则文件名称，顺序即合并顺序 |
 | `ruleFileOrder` | Web 规则文件 Tab 的完整显示顺序（含禁用文件）；启用文件的合并顺序与其在该数组中的相对顺序一致 |
+| `readonlyRuleFiles` | 只读（加锁）的规则文件名称。可选，缺省即全部可读写。只能在 Web 界面中修改；锁住的规则文件拒绝 CLI / MCP / API 的一切写入。见 [只读规则集](./docs/RULESET_READONLY.md) |
 | `mocksFilePath` | 自定义 Mock JSON 路径；空值使用默认位置 |
 | `pluginMode` | 插件 Pipeline 模式：`off`、`shadow` 或 `on` |
 | `clientAliases` | 客户端 IP 到设备名称的映射 |

package/README.md

@@ -181,6 +181,22 @@ meddle --remote --no-intercept-https
 
 所有 `mock_rule_*`、`route_rule_*`、`route_preview` 工具均支持可选 `session` 参数，指定后可操作对应 session 的规则，不传则操作默认 session。
 
+**路由规则写入**（`route_rule_add` / `route_rule_update` / `route_rule_delete`）只改包含该 pattern 的那一行，规则文件里的注释、空行、`//` 禁用规则和其他规则（连同排除项）都按原样保留：
+
+- **不传 `exclusions`**：保留该规则原有的排除规则（`route_rule_add` 覆盖已有规则时也一样；新规则则没有排除规则）。
+- **传 `exclusions: []`**：清空该规则的排除规则。
+- 传非空数组：用它替换原有的排除规则。
+- 如果一行写了多个 pattern，修改或删除其中一个时，若剩下的 pattern 以 `//` 或 `#` 开头（拆开后会被当成注释），写入会被拒绝并提示「该行剩余的 pattern 以 // 或 # 开头，拆开后会被当成注释，请用文本编辑器手动修改」，规则文件不变。
+- 新增规则的 pattern 不能以 `#` 或 `//` 开头（例如 `#foo.com`、`//foo.com`），否则写进文件后会被当成注释或禁用行。写入会被拒绝并提示「规则不能以 // 或 # 开头，否则会被当成禁用行或注释。要写注释或禁用规则，请用文本编辑器。」，规则文件不变。
+- CLI：`meddle route update <file> <pattern> --exclusions=` 清空该规则的排除项（该行不再有 `!path`，其余行逐字节不变）。`--exclusions=/a,/b` 替换。pattern 里写 `!path`（如 `"api.example.com !/health"`）同样是替换。两者都不写则保留原有排除项。单独的 `--exclusions`（没有 `=`）、空的 `!`、未知参数，或 `!path` 与 `--exclusions` 同时出现，都会非 0 退出且不改文件。`#` 只有出现在一行开头（前导空白之后）才是整行注释；行尾的 `#` 不是注释。
+
+**只读规则集**（[详细说明](./docs/RULESET_READONLY.md)）：规则集（规则文件）可以在 Meddle Web 界面中加只读锁，防止 Agent 误改。
+
+- `route_rule_list` 的结果带 `readonly: true|false`。
+- 锁住后 `route_rule_add` / `route_rule_update` / `route_rule_delete` / `route_rule_active_set`（会改变锁住规则集的启用状态时）全部被拒绝，规则文件不变，工具返回 `isError: true` 与 `{"error":{"code":"RULESET_READONLY","message":"该规则集已设为只读，只能在 Meddle 界面中解锁","ruleFile":"…"}}`。CLI 同样拒绝，退出码为 `3`。
+- **CLI 和 MCP 都没有加锁 / 解锁的命令或工具**，只能由人在 Meddle 界面中操作。界面使用页面令牌 + 同源校验；这只是防误改，不是安全隔离（可被 `curl` 取页面令牌并伪造 `Origin` 绕过，有 shell 的 Agent 也能直接改磁盘文件）。
+- 锁住的规则集不能重命名，需先在 Meddle 界面中解锁再改名；在 Meddle 之外直接改文件名视为新规则集（可读写），旧锁记录自动清除。
+
 ### 多 Session 隔离（预览功能）
 
 多 Session 允许同时运行多个独立的 `meddle` 代理进程，每个进程拥有独立的配置目录（MEDDLE_HOME）、端口、路由规则和 Mock 规则，适用于多个 Agent 或项目需要隔离代理环境的场景。

package/bin/commands/route/active.js

@@ -5,7 +5,13 @@
 const output = require('../../lib/output')
 const { isProxyRunning } = require('../../lib/proxy-detect')
 const { apiGet, apiPut } = require('../../lib/api-client')
-const { listRuleFiles, getActiveRuleFileNames, setActiveRuleFileNames, setRuleFileEnabled } = require('../../lib/file-access')
+const { listRuleFiles, getActiveRuleFileNames, setRuleFileEnabled } = require('../../lib/file-access')
+const { isRulesetReadonlyError, exitRulesetReadonly, assertListedFilesWritable } = require('../../lib/ruleset-readonly')
+
+/** Names whose enabled state `active set <file>` would change. */
+function pendingToggles(files, target) {
+  return files.filter((f) => !!f.enabled !== (f.name === target)).map((f) => f.name)
+}
 
 // Parse arguments (skip 'route' and 'active' from argv)
 const args = process.argv.slice(4)
@@ -39,6 +45,9 @@ async function run() {
           process.exit(1)
         }
 
+        // Issue #137: refuse up front so a locked ruleset never leaves a half-applied switch.
+        assertListedFilesWritable(files, pendingToggles(files, targetFile))
+
         for (const f of files) {
           const nextEnabled = f.name === targetFile
           if (!!f.enabled === nextEnabled) continue
@@ -53,6 +62,7 @@ async function run() {
         output.header('Active Route File Set')
         output.success(targetFile)
       } catch (e) {
+        if (isRulesetReadonlyError(e)) exitRulesetReadonly(e, { json: jsonFlag, ruleFile: targetFile })
         // Fallback to file mode
         const files = listRuleFiles()
         const target = files.find(f => f.name === targetFile)
@@ -61,6 +71,7 @@ async function run() {
           process.exit(1)
         }
 
+        assertListedFilesWritable(files, pendingToggles(files, targetFile))
         // Disable all, then enable target
         files.forEach(f => setRuleFileEnabled(f.name, f.name === targetFile))
 
@@ -83,6 +94,7 @@ async function run() {
         process.exit(1)
       }
 
+      assertListedFilesWritable(files, pendingToggles(files, targetFile))
       files.forEach(f => setRuleFileEnabled(f.name, f.name === targetFile))
 
       output.warnFileOnlyMode()
@@ -140,6 +152,7 @@ async function run() {
 }
 
 run().catch(e => {
+  if (isRulesetReadonlyError(e)) exitRulesetReadonly(e, { json: jsonFlag, ruleFile: targetFile })
   output.error(e.message)
   process.exit(1)
 })

package/bin/commands/route/add.js

@@ -5,133 +5,142 @@
 const output = require('../../lib/output')
 const { isProxyRunning } = require('../../lib/proxy-detect')
 const { apiGet, apiPut } = require('../../lib/api-client')
-const { getRuleFileContent, saveRuleFileContent, parseEprc, ruleMapToEprcText } = require('../../lib/file-access')
+const { getRuleFileContent, saveRuleFileContent } = require('../../lib/file-access')
+const { addRouteRule } = require('../../lib/rule-file-edit')
+const { isRulesetReadonlyError, exitRulesetReadonly } = require('../../lib/ruleset-readonly')
+const { parseRouteWriteArgs, parsePatternArg, resolveExclusions } = require('../../lib/route-write-args')
+
+const ADD_HELP = `
+meddle route add <file> <pattern> <target> [--exclusions=<list>] [--json]
+
+Add a rule. If the pattern already exists, its target is overwritten in place.
+--exclusions= clears that rule's exclusions; --exclusions=/a,/b replaces them.
+Omit --exclusions and any !path in the pattern to keep existing exclusions.
+See: meddle route update --help
+`
 
-// Parse arguments (skip 'route' and 'add' from argv)
 const args = process.argv.slice(4)
-const jsonFlag = args.includes('--json')
+
+function fail(message, jsonFlag) {
+  if (jsonFlag) {
+    console.log(JSON.stringify({ success: false, error: { message } }))
+    console.error(message)
+  } else {
+    output.setJsonMode(false)
+    output.error(message)
+  }
+  process.exit(1)
+}
+
+let parsed
+try {
+  parsed = parseRouteWriteArgs(args)
+} catch (e) {
+  fail(e.message, args.includes('--json'))
+}
+
+if (parsed.help) {
+  console.log(ADD_HELP.trim())
+  process.exit(0)
+}
+
+const jsonFlag = parsed.json
 output.setJsonMode(jsonFlag)
 
-// Get positional arguments: file, pattern, target
-const positionalArgs = args.filter(a => !a.startsWith('--'))
-const fileName = positionalArgs[0]
-const pattern = positionalArgs[1]
-const target = positionalArgs[2]
+const fileName = parsed.positional[0]
+const pattern = parsed.positional[1]
+const target = parsed.positional[2]
 
-async function run() {
-  if (!fileName) {
-    output.error('Missing required argument: <file>')
-    process.exit(1)
+let explicitExclusions = false
+let appliedExclusions = []
+
+function planAdd() {
+  const { patterns, exclusions: patternExclusions } = parsePatternArg(pattern)
+  if (patterns.length === 0) fail('Missing required argument: <pattern>', jsonFlag)
+  const resolved = resolveExclusions(patternExclusions, parsed.exclusions)
+  explicitExclusions = resolved.explicit
+  appliedExclusions = resolved.exclusions || []
+  return { patterns, exclusions: resolved.explicit ? resolved.exclusions : undefined }
+}
+
+/**
+ * Issue #145: edit only the line(s) holding this pattern; comments, blank
+ * lines and other rules (with their `!exclusions`) keep their exact bytes.
+ * Exclusions may be given inside the pattern argument ("app.example.com !/api")
+ * or with --exclusions. `--exclusions=` clears them (issue #149).
+ */
+function applyAdd(text, plan) {
+  let next = text
+  for (const p of plan.patterns) {
+    next = addRouteRule(next, { pattern: p, target: target.trim(), exclusions: plan.exclusions }).content
   }
-  if (!pattern) {
-    output.error('Missing required argument: <pattern>')
-    process.exit(1)
+  return next
+}
+
+function emitAdded({ fileOnly }) {
+  const payload = { success: true, file: fileName, pattern: pattern.trim(), target: target.trim() }
+  if (explicitExclusions) payload.exclusions = appliedExclusions
+  if (fileOnly) {
+    payload.fileOnly = true
+    payload.warning = output.FILE_ONLY_WARNING
+  }
+  if (jsonFlag) {
+    output.jsonRaw(payload)
+    return
   }
-  if (!target) {
-    output.error('Missing required argument: <target>')
-    process.exit(1)
+  output.header('Route Rule Added')
+  output.success(`${pattern.trim()} -> ${target.trim()}`)
+  if (explicitExclusions) {
+    output.kv('Exclusions', appliedExclusions.length ? appliedExclusions.map((e) => `!${e}`).join(' ') : 'cleared')
   }
+  output.kv('File', fileName)
+}
 
-  const running = await isProxyRunning()
+async function run() {
+  if (!fileName) fail('Missing required argument: <file>', jsonFlag)
+  if (!pattern) fail('Missing required argument: <pattern>', jsonFlag)
+  if (!target) fail('Missing required argument: <target>', jsonFlag)
+  if (parsed.positional.length > 3) fail(`Unexpected argument: ${parsed.positional[3]}`, jsonFlag)
+
+  let plan
+  try {
+    plan = planAdd()
+  } catch (e) {
+    fail(e.message, jsonFlag)
+  }
 
-  const pat = pattern.trim()
-  const tgt = target.trim()
+  const running = await isProxyRunning()
 
   if (running) {
     try {
-      // Get current content
       let content = await apiGet(`/api/rule-files/${encodeURIComponent(fileName)}/content`)
       const text = typeof content === 'string' ? content : String(content)
-      const ruleMap = parseEprc(text)
-
-      // Handle [marker] syntax
-      const bm = pat.match(/\[([^\]]+)\]/)
-      if (bm) {
-        ruleMap[pat.replace(bm[0], bm[1])] = tgt + bm[0]
-      } else {
-        ruleMap[pat] = tgt
-      }
-
-      const newContent = ruleMapToEprcText(ruleMap)
+      const newContent = applyAdd(text, plan)
       await apiPut(`/api/rule-files/${encodeURIComponent(fileName)}/content`, { content: newContent })
-
-      if (jsonFlag) {
-        output.jsonRaw({ success: true, file: fileName, pattern: pat, target: tgt })
-        return
-      }
-
-      output.header('Route Rule Added')
-      output.success(`${pat} -> ${tgt}`)
-      output.kv('File', fileName)
+      emitAdded({ fileOnly: false })
+      return
     } catch (e) {
-      // Fallback to file mode
+      // Issue #137: a locked ruleset is a final answer, never a cue to write the file directly.
+      if (isRulesetReadonlyError(e)) exitRulesetReadonly(e, { json: jsonFlag, ruleFile: fileName })
       const content = getRuleFileContent(fileName)
-      if (!content) {
-        output.error(`Route file not found: ${fileName}`)
-        process.exit(1)
-      }
-
-      const ruleMap = parseEprc(content)
-      const bm = pat.match(/\[([^\]]+)\]/)
-      if (bm) {
-        ruleMap[pat.replace(bm[0], bm[1])] = tgt + bm[0]
-      } else {
-        ruleMap[pat] = tgt
-      }
-
-      const newContent = ruleMapToEprcText(ruleMap)
+      if (!content) fail(`Route file not found: ${fileName}`, jsonFlag)
+      const newContent = applyAdd(content, plan)
       saveRuleFileContent(fileName, newContent)
       output.warnFileOnlyMode()
-
-      if (jsonFlag) {
-        output.jsonRaw({ success: true, file: fileName, pattern: pat, target: tgt,
-        fileOnly: true,
-        warning: output.FILE_ONLY_WARNING
-      })
-        return
-      }
-
-
-      output.header('Route Rule Added')
-      output.success(`${pat} -> ${tgt}`)
-      output.kv('File', fileName)
-    }
-  } else {
-    // File mode
-    const content = getRuleFileContent(fileName)
-    if (!content) {
-      output.error(`Route file not found: ${fileName}`)
-      process.exit(1)
-    }
-
-    const ruleMap = parseEprc(content)
-    const bm = pat.match(/\[([^\]]+)\]/)
-    if (bm) {
-      ruleMap[pat.replace(bm[0], bm[1])] = tgt + bm[0]
-    } else {
-      ruleMap[pat] = tgt
-    }
-
-    const newContent = ruleMapToEprcText(ruleMap)
-    saveRuleFileContent(fileName, newContent)
-    output.warnFileOnlyMode()
-
-    if (jsonFlag) {
-      output.jsonRaw({ success: true, file: fileName, pattern: pat, target: tgt,
-      fileOnly: true,
-      warning: output.FILE_ONLY_WARNING
-    })
+      emitAdded({ fileOnly: true })
       return
     }
-
-
-    output.header('Route Rule Added')
-    output.success(`${pat} -> ${tgt}`)
-    output.kv('File', fileName)
   }
+
+  const content = getRuleFileContent(fileName)
+  if (!content) fail(`Route file not found: ${fileName}`, jsonFlag)
+  const newContent = applyAdd(content, plan)
+  saveRuleFileContent(fileName, newContent)
+  output.warnFileOnlyMode()
+  emitAdded({ fileOnly: true })
 }
 
 run().catch(e => {
-  output.error(e.message)
-  process.exit(1)
+  if (isRulesetReadonlyError(e)) exitRulesetReadonly(e, { json: jsonFlag, ruleFile: fileName })
+  fail(e.message, jsonFlag)
 })

package/bin/commands/route/delete.js

@@ -5,49 +5,87 @@
 const output = require('../../lib/output')
 const { isProxyRunning } = require('../../lib/proxy-detect')
 const { apiGet, apiPut } = require('../../lib/api-client')
-const { getRuleFileContent, saveRuleFileContent, parseEprc, ruleMapToEprcText } = require('../../lib/file-access')
+const { getRuleFileContent, saveRuleFileContent } = require('../../lib/file-access')
+const { deleteRouteRule } = require('../../lib/rule-file-edit')
+const { isRulesetReadonlyError, exitRulesetReadonly } = require('../../lib/ruleset-readonly')
+const { parseRouteWriteArgs, parsePatternArg } = require('../../lib/route-write-args')
+
+const DELETE_HELP = `
+meddle route delete <file> <pattern> [--json]
+
+Delete a rule. This command does not take --exclusions.
+`
 
-// Parse arguments (skip 'route' and 'delete' from argv)
 const args = process.argv.slice(4)
-const jsonFlag = args.includes('--json')
+
+function fail(message, jsonFlag) {
+  if (jsonFlag) {
+    console.log(JSON.stringify({ success: false, error: { message } }))
+    console.error(message)
+  } else {
+    output.setJsonMode(false)
+    output.error(message)
+  }
+  process.exit(1)
+}
+
+let parsed
+try {
+  parsed = parseRouteWriteArgs(args, { allowExclusions: false })
+} catch (e) {
+  fail(e.message, args.includes('--json'))
+}
+
+if (parsed.help) {
+  console.log(DELETE_HELP.trim())
+  process.exit(0)
+}
+
+const jsonFlag = parsed.json
 output.setJsonMode(jsonFlag)
 
-// Get positional arguments: file, pattern
-const positionalArgs = args.filter(a => !a.startsWith('--'))
-const fileName = positionalArgs[0]
-const pattern = positionalArgs[1]
+const fileName = parsed.positional[0]
+const pattern = parsed.positional[1]
 
-async function run() {
-  if (!fileName) {
-    output.error('Missing required argument: <file>')
-    process.exit(1)
+/**
+ * Issue #145: remove only this pattern; every other line (comments, blank
+ * lines, other rules and their `!exclusions`) keeps its exact bytes.
+ */
+function applyDelete(text) {
+  const { patterns } = parsePatternArg(pattern)
+  if (patterns.length === 0) {
+    fail('Missing required argument: <pattern>', jsonFlag)
   }
-  if (!pattern) {
-    output.error('Missing required argument: <pattern>')
-    process.exit(1)
+  let next = text
+  for (const p of patterns) {
+    const result = deleteRouteRule(next, { pattern: p })
+    if (!result.found) {
+      fail(`Pattern not found: ${pattern.trim()}`, jsonFlag)
+    }
+    next = result.content
+  }
+  return next
+}
+
+async function run() {
+  if (!fileName) fail('Missing required argument: <file>', jsonFlag)
+  if (!pattern) fail('Missing required argument: <pattern>', jsonFlag)
+  if (parsed.positional.length > 2) fail(`Unexpected argument: ${parsed.positional[2]}`, jsonFlag)
+  try {
+    parsePatternArg(pattern)
+  } catch (e) {
+    fail(e.message, jsonFlag)
   }
 
   const running = await isProxyRunning()
 
   const pat = pattern.trim()
 
-  // Handle [marker] syntax for lookup
-  const bm = pat.match(/\[([^\]]+)\]/)
-  const internalKey = bm ? pat.replace(bm[0], bm[1]) : pat
-
   if (running) {
     try {
       let content = await apiGet(`/api/rule-files/${encodeURIComponent(fileName)}/content`)
       const text = typeof content === 'string' ? content : String(content)
-      const ruleMap = parseEprc(text)
-
-      if (!Object.prototype.hasOwnProperty.call(ruleMap, internalKey)) {
-        output.error(`Pattern not found: ${pat}`)
-        process.exit(1)
-      }
-
-      delete ruleMap[internalKey]
-      const newContent = ruleMapToEprcText(ruleMap)
+      const newContent = applyDelete(text)
       await apiPut(`/api/rule-files/${encodeURIComponent(fileName)}/content`, { content: newContent })
 
       if (jsonFlag) {
@@ -59,21 +97,15 @@ async function run() {
       output.success(pat)
       output.kv('File', fileName)
     } catch (e) {
+      // Issue #137: a locked ruleset is a final answer, never a cue to write the file directly.
+      if (isRulesetReadonlyError(e)) exitRulesetReadonly(e, { json: jsonFlag, ruleFile: fileName })
       // Fallback to file mode
       const content = getRuleFileContent(fileName)
       if (!content) {
-        output.error(`Route file not found: ${fileName}`)
-        process.exit(1)
-      }
-
-      const ruleMap = parseEprc(content)
-      if (!Object.prototype.hasOwnProperty.call(ruleMap, internalKey)) {
-        output.error(`Pattern not found: ${pat}`)
-        process.exit(1)
+        fail(`Route file not found: ${fileName}`, jsonFlag)
       }
 
-      delete ruleMap[internalKey]
-      const newContent = ruleMapToEprcText(ruleMap)
+      const newContent = applyDelete(content)
       saveRuleFileContent(fileName, newContent)
       output.warnFileOnlyMode()
 
@@ -94,18 +126,10 @@ async function run() {
     // File mode
     const content = getRuleFileContent(fileName)
     if (!content) {
-      output.error(`Route file not found: ${fileName}`)
-      process.exit(1)
+      fail(`Route file not found: ${fileName}`, jsonFlag)
     }
 
-    const ruleMap = parseEprc(content)
-    if (!Object.prototype.hasOwnProperty.call(ruleMap, internalKey)) {
-      output.error(`Pattern not found: ${pat}`)
-      process.exit(1)
-    }
-
-    delete ruleMap[internalKey]
-    const newContent = ruleMapToEprcText(ruleMap)
+    const newContent = applyDelete(content)
     saveRuleFileContent(fileName, newContent)
     output.warnFileOnlyMode()
 
@@ -125,6 +149,6 @@ async function run() {
 }
 
 run().catch(e => {
-  output.error(e.message)
-  process.exit(1)
+  if (isRulesetReadonlyError(e)) exitRulesetReadonly(e, { json: jsonFlag, ruleFile: fileName })
+  fail(e.message, jsonFlag)
 })

package/bin/commands/route/index.js

@@ -39,10 +39,16 @@ Route Commands:
   meddle route active                           Show active route files
   meddle route active set <file>                Set active route file
   meddle route create <name> [--content <text>] Create a route file
-  meddle route add <file> <pattern> <target>    Add a rule to file
-  meddle route update <file> <pattern> <target> Update a rule in file
+  meddle route add <file> <pattern> <target> [--exclusions=<list>]
+                                            Add a rule to file
+  meddle route update <file> <pattern> [<target>] [--exclusions=<list>]
+                                            Update a rule in file
   meddle route delete <file> <pattern>          Delete a rule from file
 
+Read-only route files:
+  Files locked in the Meddle web UI reject add/update/delete and active set
+  (error RULESET_READONLY, exit code 3). Lock/unlock is only available in the web UI.
+
 Examples:
   meddle route list
   meddle route show dev-rules
@@ -53,7 +59,19 @@ Examples:
   meddle route create staging --content "example.com localhost:3000"
   meddle route add dev-rules "api.test.com" "localhost:8080"
   meddle route update dev-rules "api.test.com" "localhost:9000"
+  meddle route update dev-rules "api.test.com" --exclusions=
   meddle route delete dev-rules "api.test.com"
+
+Exclusions:
+  Omit --exclusions and any !path in the pattern to keep the rule's exclusions.
+  --exclusions=            Clear exclusions (that line loses every !path).
+  --exclusions=/a,/b       Replace exclusions. A leading ! is optional.
+  "pattern !/a"            Replace exclusions. A bare "!" is an error.
+  A bare --exclusions, an unknown flag, or both forms at once exits 1
+  and does not change the file. meddle route update --help has the details.
+
+  A "#" comments out a whole line only when it is the first non-space
+  character. A "#" later on a rule line is a pattern, not a trailing comment.
 `)
     process.exit(1)
 }

package/bin/commands/route/list.js

@@ -48,7 +48,7 @@ async function run() {
     output.section('Active Files')
     active.forEach(f => {
       const excludeInfo = f.excludeCount > 0 ? `, ${f.excludeCount} exclusions` : ''
-      output.success(`${f.name} (${f.ruleCount} rules${excludeInfo})`)
+      output.success(`${f.name} (${f.ruleCount} rules${excludeInfo})${f.readonly ? ' [read-only]' : ''}`)
     })
   }
 
@@ -56,7 +56,7 @@ async function run() {
     output.section('Inactive Files')
     inactive.forEach(f => {
       const excludeInfo = f.excludeCount > 0 ? `, ${f.excludeCount} exclusions` : ''
-      output.bullet(`${f.name} (${f.ruleCount} rules${excludeInfo})`, false)
+      output.bullet(`${f.name} (${f.ruleCount} rules${excludeInfo})${f.readonly ? ' [read-only]' : ''}`, false)
     })
   }
 }

package/bin/commands/route/show.js

@@ -5,7 +5,7 @@
 const output = require('../../lib/output')
 const { isProxyRunning } = require('../../lib/proxy-detect')
 const { apiGet } = require('../../lib/api-client')
-const { getRuleFileContent, parseEprcWithExclusions } = require('../../lib/file-access')
+const { getRuleFileContent, parseEprcWithExclusions, isRuleFileReadonly } = require('../../lib/file-access')
 
 // Parse arguments (skip 'route' and 'show' from argv)
 const args = process.argv.slice(4)
@@ -26,10 +26,15 @@ async function run() {
   let content = null
   let ruleMap = {}
   let excludeMap = {}
+  // Issue #137: report the lock state (read-only for the CLI either way).
+  let readonly = false
 
   if (running) {
     try {
       content = await apiGet(`/api/rule-files/${encodeURIComponent(fileName)}/content`)
+      const files = await apiGet('/api/rule-files')
+      const info = Array.isArray(files) ? files.find((f) => f && f.name === fileName) : null
+      readonly = Boolean(info && info.readonly)
       const parsed = parseEprcWithExclusions(typeof content === 'string' ? content : String(content))
       ruleMap = parsed.ruleMap
       excludeMap = parsed.excludeMap
@@ -43,6 +48,7 @@ async function run() {
       const parsed = parseEprcWithExclusions(content)
       ruleMap = parsed.ruleMap
       excludeMap = parsed.excludeMap
+      readonly = isRuleFileReadonly(fileName)
     }
   } else {
     content = getRuleFileContent(fileName)
@@ -53,6 +59,7 @@ async function run() {
     const parsed = parseEprcWithExclusions(content)
     ruleMap = parsed.ruleMap
     excludeMap = parsed.excludeMap
+    readonly = isRuleFileReadonly(fileName)
   }
 
   // Build display rules (handle [marker] syntax)
@@ -76,6 +83,7 @@ async function run() {
   if (jsonFlag) {
     output.jsonRaw({
       file: fileName,
+      readonly,
       rules: displayRules,
       ruleCount: Object.keys(displayRules).length,
       exclusionCount: totalExclusions
@@ -84,6 +92,7 @@ async function run() {
   }
 
   output.header(`Route File: ${fileName}`)
+  output.kv('Read-only', readonly ? 'Yes (unlock in the Meddle UI)' : 'No')
   output.kv('Rules', Object.keys(displayRules).length)
   if (totalExclusions > 0) {
     output.kv('Exclusions', totalExclusions)