@matelink/cli 2026.4.13 → 2026.4.14

package/bin/matecli.mjs

@@ -25,14 +25,31 @@ const DEFAULT_GATEWAY_HOST = "127.0.0.1";
 const DEFAULT_WEBHOOK_PATH = "/testnextim/webhook";
 const DEFAULT_BIND_PATH = "/testnextim/bind";
 const GATEWAY_RPC_CLI_TIMEOUT_MS = DEFAULT_NETWORK_TIMEOUT_MS;
+const WORKSPACE_FILE_LIST_MAX = 2000;
+const WORKSPACE_SKIP_DIRS = new Set([
+  ".git",
+  "node_modules",
+  ".next",
+  "dist",
+  "build",
+  ".turbo",
+  ".cache",
+]);
 const CLI_PACKAGE_NAME = "@matelink/cli";
 const CLI_COMMAND_NAME = "matecli";
 const SERVICE_LABEL = "com.matelink.matecli.bridge";
 const SERVICE_UNIT_NAME = "matelink-matecli-bridge.service";
 const SERVICE_TASK_NAME = "Matelink MateCLI Bridge";
-// Relay worker defaults to full operator scope so gateway HTTP routes and RPC-adjacent
-// compatibility endpoints remain available without per-method scope juggling.
-const DEFAULT_GATEWAY_SCOPES = "operator.admin";
+// Mirror the WS bridge's operator scopes for local HTTP proxy calls as well.
+// Some OpenClaw gateway builds require explicit read/write scopes and do not
+// treat operator.admin as an umbrella permission for `/v1/responses`.
+const DEFAULT_GATEWAY_SCOPES = [
+  "operator.admin",
+  "operator.read",
+  "operator.write",
+  "operator.approvals",
+  "operator.pairing",
+].join(",");
 const CLI_ENTRY = fileURLToPath(import.meta.url);
 const CLI_LANGUAGE = detectCliLanguage();
 const CLI_I18N = {
@@ -501,6 +518,208 @@ function readJsonFileIfExists(filePath) {
   }
 }
 
+function readOpenClawConfigForRuntime() {
+  const configPath = resolveOpenClawConfigPath();
+  let content;
+  try {
+    content = fs.readFileSync(configPath, "utf8");
+  } catch {
+    throw new Error(t("config_read_failed", { path: configPath }));
+  }
+  try {
+    return JSON.parse(content);
+  } catch {
+    throw new Error(t("config_invalid_json", { path: configPath }));
+  }
+}
+
+function resolveConfiguredWorkspaceRoot() {
+  const configPath = resolveOpenClawConfigPath();
+  const config = ensureObject(readOpenClawConfigForRuntime());
+  const workspaceRaw = String(config?.agents?.defaults?.workspace ?? "").trim();
+  const resolved = workspaceRaw
+    ? (path.isAbsolute(workspaceRaw)
+      ? workspaceRaw
+      : path.resolve(path.dirname(configPath), workspaceRaw))
+    : path.join(resolveOpenClawHome(), "workspace");
+  return path.resolve(resolved);
+}
+
+function normalizeWorkspaceRelativePath(rawName) {
+  const value = String(rawName ?? "").trim();
+  if (!value) {
+    throw new Error("workspace file name is required");
+  }
+  const normalized = value.replaceAll("\\", "/");
+  if (normalized.includes("\0") || /^[a-z]:\//i.test(normalized)) {
+    throw new Error("invalid workspace file path");
+  }
+  const relative = path.posix.normalize(normalized).replace(/^\/+/, "");
+  if (!relative || relative === "." || relative === ".." || relative.startsWith("../")) {
+    throw new Error("invalid workspace file path");
+  }
+  return relative;
+}
+
+function resolveWorkspaceFilePath(workspaceRoot, rawName) {
+  const relativePath = normalizeWorkspaceRelativePath(rawName);
+  const absolutePath = path.resolve(workspaceRoot, relativePath);
+  const relativeFromRoot = path.relative(workspaceRoot, absolutePath);
+  if (
+    !relativeFromRoot ||
+    relativeFromRoot === ".." ||
+    relativeFromRoot.startsWith(`..${path.sep}`) ||
+    path.isAbsolute(relativeFromRoot)
+  ) {
+    throw new Error("workspace file path escapes workspace root");
+  }
+  return {
+    relativePath,
+    absolutePath,
+  };
+}
+
+function buildWorkspaceFileMeta({
+  workspaceRoot,
+  relativePath,
+  absolutePath,
+  includeContent = false,
+  missing = false,
+}) {
+  if (missing) {
+    return {
+      name: relativePath,
+      path: absolutePath,
+      missing: true,
+      size: null,
+      updatedAtMs: null,
+      content: null,
+    };
+  }
+  const stats = fs.statSync(absolutePath);
+  if (!stats.isFile()) {
+    throw new Error(`workspace path is not a file: ${relativePath}`);
+  }
+  return {
+    name: relativePath,
+    path: absolutePath,
+    missing: false,
+    size: stats.size,
+    updatedAtMs: Math.round(stats.mtimeMs),
+    content: includeContent ? fs.readFileSync(absolutePath, "utf8") : null,
+  };
+}
+
+function listWorkspaceFiles(workspaceRoot) {
+  const files = [];
+  const walk = (relativeDir = "") => {
+    if (files.length >= WORKSPACE_FILE_LIST_MAX) {
+      return;
+    }
+    const absoluteDir = relativeDir
+      ? path.join(workspaceRoot, relativeDir)
+      : workspaceRoot;
+    let entries = [];
+    try {
+      entries = fs.readdirSync(absoluteDir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      if (files.length >= WORKSPACE_FILE_LIST_MAX) {
+        break;
+      }
+      if (entry.name === "." || entry.name === ".." || entry.isSymbolicLink()) {
+        continue;
+      }
+      const relativePath = relativeDir
+        ? path.posix.join(relativeDir.replaceAll("\\", "/"), entry.name)
+        : entry.name;
+      const absolutePath = path.join(absoluteDir, entry.name);
+      if (entry.isDirectory()) {
+        if (WORKSPACE_SKIP_DIRS.has(entry.name)) {
+          continue;
+        }
+        walk(relativePath);
+        continue;
+      }
+      if (!entry.isFile()) {
+        continue;
+      }
+      try {
+        files.push(buildWorkspaceFileMeta({
+          workspaceRoot,
+          relativePath,
+          absolutePath,
+        }));
+      } catch {
+        // Ignore transient file stat/read issues.
+      }
+    }
+  };
+  walk("");
+  return files;
+}
+
+async function callWorkspaceRpcLocal({
+  method,
+  params,
+}) {
+  const workspaceRoot = resolveConfiguredWorkspaceRoot();
+  if (method === "agents.files.list") {
+    return {
+      ok: true,
+      workspace: workspaceRoot,
+      files: listWorkspaceFiles(workspaceRoot),
+    };
+  }
+
+  if (method === "agents.files.get") {
+    const { relativePath, absolutePath } = resolveWorkspaceFilePath(workspaceRoot, params?.name);
+    if (!fs.existsSync(absolutePath)) {
+      return {
+        ok: true,
+        workspace: workspaceRoot,
+        file: buildWorkspaceFileMeta({
+          workspaceRoot,
+          relativePath,
+          absolutePath,
+          missing: true,
+        }),
+      };
+    }
+    return {
+      ok: true,
+      workspace: workspaceRoot,
+      file: buildWorkspaceFileMeta({
+        workspaceRoot,
+        relativePath,
+        absolutePath,
+        includeContent: true,
+      }),
+    };
+  }
+
+  if (method === "agents.files.set") {
+    const { relativePath, absolutePath } = resolveWorkspaceFilePath(workspaceRoot, params?.name);
+    fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+    fs.writeFileSync(absolutePath, String(params?.content ?? ""), "utf8");
+    return {
+      ok: true,
+      workspace: workspaceRoot,
+      file: buildWorkspaceFileMeta({
+        workspaceRoot,
+        relativePath,
+        absolutePath,
+        includeContent: true,
+      }),
+    };
+  }
+
+  return null;
+}
+
 function commandToString(command, args) {
   return [command, ...args]
     .map((part) => {
@@ -2709,6 +2928,14 @@ async function callGatewayRpcLocal({
     };
   }
 
+  if (
+    method === "agents.files.list" ||
+    method === "agents.files.get" ||
+    method === "agents.files.set"
+  ) {
+    return callWorkspaceRpcLocal({ method, params });
+  }
+
   // Prefer CLI first for broad compatibility, but fall back to the persistent
   // WS client when the CLI gateway call hits transient websocket closures.
   try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@matelink/cli",
-  "version": "2026.4.13",
+  "version": "2026.4.14",
   "private": false,
   "description": "Relay-first CLI for pairing and bridging OpenClaw gateway traffic",
   "type": "module",