codexmate 0.0.39 → 0.0.40

package/cli/config-bootstrap.js

@@ -273,7 +273,12 @@ stream_idle_timeout_ms = 300000
         fs.writeFileSync(INIT_MARK_FILE, JSON.stringify(payload, null, 2), 'utf-8');
     }
 
-    function ensureManagedConfigBootstrap() {
+    function ensureManagedConfigBootstrap(options = {}) {
+        const allowWrite = !(options && options.allowWrite === false);
+        if (!allowWrite) {
+            initNotice = '';
+            return { notice: '', readOnly: true };
+        }
         ensureConfigDir();
 
         const initializedAt = new Date().toISOString();

package/cli.js

@@ -213,6 +213,7 @@ const CLAUDE_PROJECTS_DIR = path.join(os.homedir(), '.claude', 'projects');
 const CODEBUDDY_DIR = path.join(os.homedir(), '.codebuddy');
 const CODEBUDDY_PROJECTS_DIR = path.join(CODEBUDDY_DIR, 'projects');
 const CODEXMATE_DIR = path.join(os.homedir(), '.codexmate');
+const CODEXMATE_PREFERENCES_FILE = path.join(CODEXMATE_DIR, 'preferences.json');
 const CODEXMATE_SESSIONS_DIR = path.join(CODEXMATE_DIR, 'sessions');
 const CODEXMATE_DERIVED_SESSIONS_DIR = path.join(CODEXMATE_SESSIONS_DIR, 'derived');
 const CODEXMATE_DERIVED_CODEX_DIR = path.join(CODEXMATE_DERIVED_SESSIONS_DIR, 'codex');
@@ -717,6 +718,7 @@ function readConfig() {
 }
 
 function writeConfig(content) {
+    assertToolConfigWriteAllowed('codex');
     try {
         fs.writeFileSync(CONFIG_FILE, content, 'utf-8');
     } catch (e) {
@@ -734,6 +736,7 @@ function readModels() {
 }
 
 function writeModels(models) {
+    assertToolConfigWriteAllowed('codex');
     fs.writeFileSync(MODELS_FILE, JSON.stringify(models, null, 2), 'utf-8');
 }
 
@@ -747,10 +750,12 @@ function readCurrentModels() {
 }
 
 function writeCurrentModels(data) {
+    assertToolConfigWriteAllowed('codex');
     fs.writeFileSync(CURRENT_MODELS_FILE, JSON.stringify(data, null, 2), 'utf-8');
 }
 
 function updateAuthJson(apiKey) {
+    assertToolConfigWriteAllowed('codex');
     let authData = {};
     if (fs.existsSync(AUTH_FILE)) {
         try {
@@ -766,6 +771,141 @@ function isPlainObject(value) {
     return !!value && typeof value === 'object' && !Array.isArray(value);
 }
 
+const TOOL_CONFIG_PERMISSION_TARGETS = new Set(['codex', 'claude']);
+const TOOL_CONFIG_PERMISSION_DEFAULTS = Object.freeze({ codex: false, claude: false });
+let toolConfigWriteGuardDepth = 0;
+
+function enterToolConfigWriteGuard() {
+    toolConfigWriteGuardDepth += 1;
+    let active = true;
+    return () => {
+        if (!active) return;
+        active = false;
+        toolConfigWriteGuardDepth = Math.max(0, toolConfigWriteGuardDepth - 1);
+    };
+}
+
+function isToolConfigWriteGuardActive() {
+    return toolConfigWriteGuardDepth > 0;
+}
+
+function normalizeToolConfigTarget(value) {
+    const target = typeof value === 'string' ? value.trim().toLowerCase() : '';
+    return TOOL_CONFIG_PERMISSION_TARGETS.has(target) ? target : '';
+}
+
+function normalizeToolConfigPermissions(value) {
+    const source = isPlainObject(value) ? value : {};
+    return {
+        codex: source.codex === true,
+        claude: source.claude === true
+    };
+}
+
+function readCodexmatePreferences() {
+    if (!fs.existsSync(CODEXMATE_PREFERENCES_FILE)) return {};
+    try {
+        const raw = fs.readFileSync(CODEXMATE_PREFERENCES_FILE, 'utf-8');
+        const parsed = raw && raw.trim() ? JSON.parse(raw) : {};
+        return isPlainObject(parsed) ? parsed : {};
+    } catch (_) {
+        return {};
+    }
+}
+
+function writeCodexmatePreferences(preferences) {
+    ensureDir(CODEXMATE_DIR);
+    writeJsonAtomic(CODEXMATE_PREFERENCES_FILE, isPlainObject(preferences) ? preferences : {});
+}
+
+function readToolConfigPermissions() {
+    const preferences = readCodexmatePreferences();
+    return normalizeToolConfigPermissions(preferences.toolConfigPermissions || TOOL_CONFIG_PERMISSION_DEFAULTS);
+}
+
+function isToolConfigWriteAllowed(target) {
+    const normalizedTarget = normalizeToolConfigTarget(target);
+    if (!normalizedTarget) return false;
+    return readToolConfigPermissions()[normalizedTarget] === true;
+}
+
+function buildToolConfigWriteDeniedPayload(target) {
+    const normalizedTarget = normalizeToolConfigTarget(target) || target || '';
+    return {
+        error: '当前为仅浏览，未修改配置。',
+        errorCode: 'tool-config-write-disabled',
+        target: normalizedTarget,
+        permissions: readToolConfigPermissions()
+    };
+}
+
+function assertToolConfigWriteAllowed(target) {
+    if (!isToolConfigWriteGuardActive()) return;
+    if (isToolConfigWriteAllowed(target)) return;
+    const payload = buildToolConfigWriteDeniedPayload(target);
+    const err = new Error(payload.error);
+    err.code = payload.errorCode;
+    err.target = payload.target;
+    throw err;
+}
+
+function getApiToolConfigWriteTarget(action) {
+    const name = typeof action === 'string' ? action.trim() : '';
+    if (!name) return '';
+    const codexWriteActions = new Set([
+        'apply-config-template',
+        'add-provider',
+        'update-provider',
+        'delete-provider',
+        'reset-config',
+        'add-model',
+        'delete-model',
+        'restore-codex-dir',
+        'import-config',
+        'import-auth-profile',
+        'switch-auth-profile',
+        'delete-auth-profile',
+        'proxy-enable-codex-default',
+        'proxy-apply-provider',
+        'local-bridge-toggle',
+        'local-bridge-set-excluded'
+    ]);
+    const claudeWriteActions = new Set([
+        'apply-claude-settings-raw',
+        'apply-claude-config',
+        'restore-claude-dir',
+        'claude-local-bridge-toggle',
+        'claude-local-bridge-set-excluded',
+        'claude-local-bridge-sync-providers'
+    ]);
+    if (codexWriteActions.has(name)) return 'codex';
+    if (claudeWriteActions.has(name)) return 'claude';
+    return '';
+}
+
+function setToolConfigPermission(params = {}) {
+    const target = normalizeToolConfigTarget(params && params.target);
+    if (!target) return { error: '未知配置对象' };
+    const preferences = readCodexmatePreferences();
+    const current = normalizeToolConfigPermissions(preferences.toolConfigPermissions || TOOL_CONFIG_PERMISSION_DEFAULTS);
+    current[target] = params && params.allowWrite === true;
+    preferences.toolConfigPermissions = current;
+    writeCodexmatePreferences(preferences);
+
+    let bootstrapNotice = '';
+    if (target === 'codex' && current.codex) {
+        const bootstrap = ensureManagedConfigBootstrap({ allowWrite: true });
+        bootstrapNotice = bootstrap && bootstrap.notice ? bootstrap.notice : '';
+    }
+
+    return {
+        success: true,
+        target,
+        permissions: current,
+        bootstrapNotice
+    };
+}
+
 const PROVIDER_CONFIG_KEYS = new Set([
     'name',
     'base_url',
@@ -5543,6 +5683,7 @@ function readLocalBridgeSettings() {
 }
 
 function writeLocalBridgeSettings(settings) {
+    assertToolConfigWriteAllowed('codex');
     fs.writeFileSync(LOCAL_BRIDGE_SETTINGS_FILE, JSON.stringify(settings, null, 2), 'utf-8');
 }
 
@@ -5641,6 +5782,7 @@ function readClaudeLocalBridgeSettings() {
 }
 
 function writeClaudeLocalBridgeSettings(settings) {
+    assertToolConfigWriteAllowed('claude');
     fs.writeFileSync(CLAUDE_LOCAL_BRIDGE_SETTINGS_FILE, JSON.stringify(settings, null, 2), 'utf-8');
 }
 
@@ -5655,6 +5797,7 @@ function readClaudeLocalProvidersFile() {
 }
 
 function writeClaudeLocalProvidersFile(data) {
+    assertToolConfigWriteAllowed('claude');
     ensureDir(CONFIG_DIR);
     fs.writeFileSync(CLAUDE_LOCAL_PROVIDERS_FILE, JSON.stringify(data, null, 2), 'utf-8');
 }
@@ -5669,6 +5812,7 @@ function syncClaudeProvidersToBridgeFile() {
 }
 
 function toggleClaudeLocalBridge(params = {}) {
+    assertToolConfigWriteAllowed('claude');
     const enable = !!params.enable;
     const settings = readClaudeLocalBridgeSettings();
 
@@ -9177,6 +9321,7 @@ function maskKey(key) {
 
 // 应用到 Claude Code settings.json（跨平台）
 function applyToClaudeSettings(config = {}) {
+    assertToolConfigWriteAllowed('claude');
     try {
         const apiKey = (config.apiKey || '').trim();
         if (!apiKey) {
@@ -9276,6 +9421,7 @@ function readClaudeSettingsRaw() {
 }
 
 function applyClaudeSettingsRaw(params = {}) {
+    assertToolConfigWriteAllowed('claude');
     const content = typeof params.content === 'string' ? params.content : '';
     if (!content.trim()) {
         return { error: '内容不能为空' };
@@ -10769,14 +10915,28 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
             });
             req.on('end', async () => {
                 if (bodyTooLarge) return;
+                let leaveToolConfigWriteGuard = null;
                 try {
                     const { action, params } = JSON.parse(body || '{}');
+                    leaveToolConfigWriteGuard = typeof enterToolConfigWriteGuard === 'function'
+                        ? enterToolConfigWriteGuard()
+                        : () => {};
                     let result;
 
-                    switch (action) {
+                    const guardedToolConfigTarget = getApiToolConfigWriteTarget(action);
+                    if (guardedToolConfigTarget && !isToolConfigWriteAllowed(guardedToolConfigTarget)) {
+                        result = buildToolConfigWriteDeniedPayload(guardedToolConfigTarget);
+                    } else {
+                        switch (action) {
                         case 'health-check':
                             result = { ok: true };
                             break;
+                        case 'get-tool-config-permissions':
+                            result = { permissions: readToolConfigPermissions() };
+                            break;
+                        case 'set-tool-config-permission':
+                            result = setToolConfigPermission(params || {});
+                            break;
                         case 'status': {
                             const statusConfigResult = readConfigOrVirtualDefault();
                             const config = statusConfigResult.config;
@@ -10815,7 +10975,8 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
                                 configReady: !statusConfigResult.isVirtual,
                                 configErrorType: statusConfigResult.errorType || '',
                                 configNotice: statusConfigResult.reason || '',
-                                initNotice: consumeInitNotice()
+                                initNotice: consumeInitNotice(),
+                                toolConfigPermissions: readToolConfigPermissions()
                             };
                             break;
                         }
@@ -11455,6 +11616,7 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
                             break;
                         default:
                             result = { error: '未知操作' };
+                        }
                     }
 
                     const responseBody = JSON.stringify(result, null, 2);
@@ -11463,7 +11625,9 @@ function createWebServer({ htmlPath, assetsDir, webDir, host, port, openBrowser
                         'Content-Length': Buffer.byteLength(responseBody, 'utf-8')
                     });
                     res.end(responseBody, 'utf-8');
+                    if (leaveToolConfigWriteGuard) leaveToolConfigWriteGuard();
                 } catch (e) {
+                    if (leaveToolConfigWriteGuard) leaveToolConfigWriteGuard();
                     const errorBody = JSON.stringify({ error: e.message }, null, 2);
                     res.writeHead(500, {
                         'Content-Type': 'application/json; charset=utf-8',
@@ -16062,7 +16226,10 @@ async function main() {
     const args = process.argv.slice(2);
     const command = args[0];
     const isMcpCommand = command === 'mcp';
-    const bootstrap = ensureManagedConfigBootstrap();
+    const shouldGateInitialBootstrap = command === 'run' || isMcpCommand;
+    const bootstrap = ensureManagedConfigBootstrap({
+        allowWrite: shouldGateInitialBootstrap ? isToolConfigWriteAllowed('codex') : true
+    });
     if (bootstrap && bootstrap.notice) {
         // MCP stdio transport requires stdout to be protocol-clean.
         if (!isMcpCommand) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codexmate",
-  "version": "0.0.39",
+  "version": "0.0.40",
   "description": "Codex/Claude Code/OpenClaw 配置、会话与任务编排 CLI + Web 工具",
   "main": "cli.js",
   "bin": {

package/plugins/prompt-templates/computed.mjs

@@ -102,18 +102,75 @@ function renderTemplate(templateText, values = {}) {
     });
 }
 
+function translate(t, key, fallback, params = null) {
+    if (typeof t !== 'function') return fallback;
+    const translated = t(key, params);
+    return translated === key ? fallback : translated;
+}
+
+function localizePluginMeta(meta, t) {
+    const safe = meta && typeof meta === 'object' ? meta : {};
+    const titleKey = typeof safe.titleKey === 'string' ? safe.titleKey : '';
+    const descriptionKey = typeof safe.descriptionKey === 'string' ? safe.descriptionKey : '';
+    const statusLabelKey = typeof safe.statusLabelKey === 'string' ? safe.statusLabelKey : '';
+    return {
+        ...safe,
+        title: titleKey ? translate(t, titleKey, safe.title || '') : (safe.title || ''),
+        description: descriptionKey ? translate(t, descriptionKey, safe.description || '') : (safe.description || ''),
+        statusLabel: statusLabelKey ? translate(t, statusLabelKey, safe.statusLabel || '') : (safe.statusLabel || '')
+    };
+}
+
+const BUILTIN_TEMPLATE_I18N = Object.freeze({
+    builtin_comment_polish: Object.freeze({
+        nameKey: 'plugins.builtin.commentPolish.name',
+        descKey: 'plugins.builtin.commentPolish.desc',
+        lineKey: 'plugins.builtin.commentPolish.line1',
+        fallbackName: '代码注释润色',
+        fallbackDesc: '轻微收敛以下代码注释 {{code}}',
+        fallbackLine: '轻微收敛以下代码注释',
+        vars: ['{{code}}']
+    }),
+    builtin_rule_ack: Object.freeze({
+        nameKey: 'plugins.builtin.ruleAck.name',
+        descKey: 'plugins.builtin.ruleAck.desc',
+        lineKey: 'plugins.builtin.ruleAck.line1',
+        fallbackName: '规则确认回复',
+        fallbackDesc: '请根据【{{rule}}】，收到请回复',
+        fallbackLine: '请根据【{{rule}}】，收到请回复',
+        vars: []
+    })
+});
+
+function localizeBuiltinPromptTemplate(item, t) {
+    const safe = item && typeof item === 'object' ? item : {};
+    if (safe.isBuiltin !== true) return safe;
+    const spec = BUILTIN_TEMPLATE_I18N[safe.id];
+    if (!spec) return safe;
+    const line = translate(t, spec.lineKey, spec.fallbackLine);
+    return {
+        ...safe,
+        name: translate(t, spec.nameKey, spec.fallbackName),
+        description: translate(t, spec.descKey, spec.fallbackDesc),
+        template: spec.vars && spec.vars.length ? [line, '', ...spec.vars].join('\n') : line
+    };
+}
+
 import { pluginsRegistry } from '../registry.mjs';
 
 export function createPluginsComputed() {
     return {
         pluginsCatalog() {
-            return pluginsRegistry.map((entry) => entry && entry.meta).filter(Boolean);
+            return pluginsRegistry
+                .map((entry) => entry && entry.meta)
+                .filter(Boolean)
+                .map((meta) => localizePluginMeta(meta, this.t));
         },
 
         pluginsActiveMeta() {
             const id = typeof this.pluginsActiveId === 'string' ? this.pluginsActiveId.trim() : '';
             const entry = pluginsRegistry.find((item) => item && item.id === id) || null;
-            return entry && entry.meta ? entry.meta : null;
+            return entry && entry.meta ? localizePluginMeta(entry.meta, this.t) : null;
         },
 
         pluginsActiveAttribution() {
@@ -138,6 +195,7 @@ export function createPluginsComputed() {
             const list = Array.isArray(this.promptTemplatesListRaw) ? this.promptTemplatesListRaw : [];
             return list
                 .map((item) => normalizePromptTemplateEntry(item))
+                .map((item) => localizeBuiltinPromptTemplate(item, this.t))
                 .filter((item) => item.id && item.name)
                 .map((item) => {
                     const vars = parseTemplateVariables(item.template);
@@ -178,7 +236,7 @@ export function createPluginsComputed() {
             const id = typeof draft.id === 'string' ? draft.id : '';
             const name = typeof draft.name === 'string' ? draft.name : '';
             if (!id && !name) return null;
-            return normalizePromptTemplateEntry(draft);
+            return localizeBuiltinPromptTemplate(normalizePromptTemplateEntry(draft), this.t);
         },
 
         promptTemplateVars() {

package/plugins/prompt-templates/manifest.mjs

@@ -3,8 +3,11 @@ import { pluginOwnership } from './ownership.mjs';
 const baseMeta = {
     id: 'prompt-templates',
     title: 'Prompt Templates',
+    titleKey: 'plugins.catalog.promptTemplates.title',
     description: 'Standardized, template-driven prompts with variables and copy/export helpers.',
+    descriptionKey: 'plugins.catalog.promptTemplates.description',
     statusLabel: 'standard',
+    statusLabelKey: 'plugins.status.standard',
     tone: 'configured'
 };
 

package/web-ui/app.js

@@ -366,6 +366,8 @@ document.addEventListener('DOMContentLoaded', () => {
                 codexDownloadProgress: 0,
                 codexDownloadTimer: null,
                 settingsTab: 'general',
+                toolConfigPermissions: { codex: false, claude: false },
+                toolConfigPermissionSaving: { codex: false, claude: false },
                 sessionTrashEnabled: true,
                 sessionTrashItems: [],
                 sessionTrashVisibleCount: SESSION_TRASH_PAGE_SIZE,

package/web-ui/modules/app.computed.main-tabs.mjs

@@ -44,7 +44,9 @@ function readTaskOrchestrationDraftMetrics(taskOrchestration) {
 }
 
 function translateTaskText(t, key, fallback, params = null) {
-    return typeof t === 'function' ? t(key, params) : fallback;
+    if (typeof t !== 'function') return fallback;
+    const translated = t(key, params);
+    return translated === key ? fallback : translated;
 }
 
 function createTaskDraftChecklist(metrics, t = null) {

package/web-ui/modules/app.methods.index.mjs

@@ -20,6 +20,7 @@ import { createOpenclawEditingMethods } from './app.methods.openclaw-editing.mjs
 import { createOpenclawPersistMethods } from './app.methods.openclaw-persist.mjs';
 import { createProvidersMethods } from './app.methods.providers.mjs';
 import { createRuntimeMethods } from './app.methods.runtime.mjs';
+import { createToolConfigPermissionMethods } from './app.methods.tool-config-permissions.mjs';
 import { createTaskOrchestrationMethods } from './app.methods.task-orchestration.mjs';
 import { createSessionActionMethods } from './app.methods.session-actions.mjs';
 import { createSessionBrowserMethods } from './app.methods.session-browser.mjs';
@@ -81,6 +82,7 @@ export function createAppMethods() {
         ...createAgentsMethods({ api, apiWithMeta }),
         ...createProvidersMethods({ api }),
         ...createClaudeConfigMethods({ api }),
+        ...createToolConfigPermissionMethods({ api }),
         ...createOpenclawCoreMethods(),
         ...createOpenclawEditingMethods(),
         ...createOpenclawPersistMethods({

package/web-ui/modules/app.methods.startup-claude.mjs

@@ -120,6 +120,12 @@ export function createStartupClaudeMethods(options = {}) {
                                 : String(defaultModelAutoCompactTokenLimit);
                         }
                     }
+                    if (statusRes.toolConfigPermissions && typeof statusRes.toolConfigPermissions === 'object') {
+                        this.toolConfigPermissions = {
+                            codex: statusRes.toolConfigPermissions.codex === true,
+                            claude: statusRes.toolConfigPermissions.claude === true
+                        };
+                    }
                     this.providersList = listRes.providers;
                     if (typeof this.loadLocalBridgeExcluded === 'function') { this.loadLocalBridgeExcluded(); }
                     if (typeof this.loadClaudeLocalBridgeStatus === 'function') { this.loadClaudeLocalBridgeStatus(); }

package/web-ui/modules/app.methods.tool-config-permissions.mjs

@@ -0,0 +1,87 @@
+export function createToolConfigPermissionMethods(options = {}) {
+    const { api } = options;
+
+    function normalizeTarget(value) {
+        const target = typeof value === 'string' ? value.trim().toLowerCase() : '';
+        return target === 'codex' || target === 'claude' ? target : '';
+    }
+
+    function normalizePermissions(value) {
+        const source = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+        return {
+            codex: source.codex === true,
+            claude: source.claude === true
+        };
+    }
+
+    return {
+        isToolConfigWriteAllowed(target) {
+            const normalizedTarget = normalizeTarget(target);
+            if (!normalizedTarget) return false;
+            return normalizePermissions(this.toolConfigPermissions)[normalizedTarget] === true;
+        },
+
+        toolConfigPermissionStatusLabel(target) {
+            return this.isToolConfigWriteAllowed(target)
+                ? this.t('toolConfig.allow')
+                : this.t('toolConfig.viewOnly');
+        },
+
+        async setToolConfigPermission(target, allowWrite) {
+            const normalizedTarget = normalizeTarget(target);
+            if (!normalizedTarget || this.toolConfigPermissionSaving[normalizedTarget]) return;
+
+            const nextAllowWrite = allowWrite === true;
+            const previous = normalizePermissions(this.toolConfigPermissions);
+            if (previous[normalizedTarget] === nextAllowWrite) return;
+
+            if (nextAllowWrite) {
+                const confirmed = await this.requestConfirmDialog({
+                    title: this.t('toolConfig.confirmTitle'),
+                    message: this.t(`toolConfig.${normalizedTarget}.confirmMessage`),
+                    confirmText: this.t('toolConfig.confirmAllow'),
+                    cancelText: this.t('confirm.cancel'),
+                    danger: true
+                });
+                if (!confirmed) {
+                    this.toolConfigPermissions = { ...previous };
+                    return;
+                }
+            }
+
+            this.toolConfigPermissionSaving = {
+                ...this.toolConfigPermissionSaving,
+                [normalizedTarget]: true
+            };
+            try {
+                const res = await api('set-tool-config-permission', {
+                    target: normalizedTarget,
+                    allowWrite: nextAllowWrite
+                });
+                if (res && res.error) {
+                    this.toolConfigPermissions = { ...previous };
+                    this.showMessage(res.error, 'error');
+                    return;
+                }
+                this.toolConfigPermissions = normalizePermissions(res && res.permissions);
+                this.showMessage(
+                    nextAllowWrite
+                        ? this.t('toolConfig.allowToast')
+                        : this.t('toolConfig.viewOnlyToast'),
+                    'success'
+                );
+                try {
+                    await this.loadAll({ preserveLoading: true });
+                } catch (_) {}
+            } catch (_) {
+                this.toolConfigPermissions = { ...previous };
+                this.showMessage(this.t('toolConfig.saveFailed'), 'error');
+            } finally {
+                this.toolConfigPermissionSaving = {
+                    ...this.toolConfigPermissionSaving,
+                    [normalizedTarget]: false
+                };
+            }
+        }
+    };
+}