Go to file
MIST 9e33782b7d
feat(browser): 放开内网服务访问限制,新增局域网部署模式开关 (#472)
* feat(browser): 放开内网服务访问限制,新增局域网部署模式开关

### 背景
局域网部署时,Agent 用浏览器工具访问 http://192.168.x.x:port 等内网服务会被默认 SSRF 严格模式拦截。

### 方案
新增两个 .env 开关(默认 false,行为与改动前完全一致):

- PLAYWRIGHT_ALLOW_PRIVATE_NETWORK=true :放行本地回环和私有 IP,云元数据端点仍拦截
- PLAYWRIGHT_IGNORE_HTTPS_ERRORS=true :忽略 HTTPS 证书错误(自签证书场景)
顺带修复 IPv6 AWS IMDS 网段 fd00:ec2::/64 在严格模式下漏网的问题。

### 验证
24 个单元测试全通过(UrlSafetyChecker 21 + BrowserProperties 3),覆盖严格/豁免两模式 + 4 个 check 重载 + IPv6 IMDS 网段。

### 风险
开关仅作用于浏览器工具;公网部署务必保持 false。

* feat(browser): Playwright 超时可配 + snapshot 智能截断与 selector 作用域

### 背景
Agent 用浏览器工具访问慢链路或大页面(超大表格)时遇到两类问题:

1. Playwright 默认 30s 超时不够用,且无法配置
2. snapshot 全量抓取页面文本,硬截断在 20000 字符处会切在元素中间,LLM 拿到残缺数据且不知道有截断
### 方案
新增三个 .env 开关(默认值与改动前完全一致):

开关 作用 PLAYWRIGHT_DEFAULT_TIMEOUT_SECONDS 单次操作超时(click / fill / waitForLoadState) PLAYWRIGHT_NAVIGATION_TIMEOUT_SECONDS 导航超时(page.navigate / load-state) PLAYWRIGHT_SNAPSHOT_MAX_LENGTH snapshot 文本截断长度

snapshot 改造:

- 支持 selector 参数作用域到子树(之前只用于 click/type)
- budget 机制按元素边界智能截断,不再切在 <td> 中间
- 返回 truncated:true + hint 引导 LLM 用 selector 重抓
- JSON 字段顺序优化:truncated/hint 放 content 前,确保框架 spill preview(head 800 chars)能切到
### 验证
- 28 个单元测试全通过(BrowserPropertiesTest 7 + UrlSafetyCheckerTest 21)
- IDE 诊断 0 错误
- 覆盖:默认值不变 + setter 往返 + 严格/豁免两模式
### 兼容性
- 默认值保持 30s / 30s / 20000,行为与改动前完全一致
- selector 参数本就是 @ToolParam(required=false) ,LLM schema 无变化,只是描述更新引导 snapshot 场景也能用
- 不影响 webhook / image download 等其他 SSRF 守卫

## 改动汇总
文件 改动 BrowserProperties.java +3 字段: defaultTimeoutSeconds / defaultNavigationTimeoutSeconds / snapshotMaxLength (默认 30/30/20000) BrowserLauncher.java 抽 applyContextDefaults(context) 在三处 context 创建点调用;补全 setIgnoreHTTPSErrors 在 wrapLocalBrowser 落地 BrowserUseTool.java 工具描述 + selector 描述引导 LLM 在 snapshot 场景用 selector;doSnapshot 改造支持 selector 参数 + budget 智能截断 + JSON 字段顺序(truncated/hint 放 content 前确保 spill preview 能切到) docker-compose.yml +3 开关: PLAYWRIGHT_DEFAULT_TIMEOUT_SECONDS / PLAYWRIGHT_NAVIGATION_TIMEOUT_SECONDS / PLAYWRIGHT_SNAPSHOT_MAX_LENGTH .env.example +3 开关,简短说明 BrowserPropertiesTest.java +4 测试覆盖新字段默认值和 setter

## 测试结果
## 数据流论证的关键决策
决策 依据 truncated:true 和 hint 放在 JSON content 字段之前 ToolResultStorage.buildPreview 会把 >8000 chars 的结果截到 head 800 chars,放在前面确保 LLM 看到 selector 参数描述从 "for click/type" 改为明确说 "OPTIONAL for snapshot" LLM 读 JSON schema 时按描述判断参数用途,原描述误导 LLM 不在 snapshot 用 selector 截断从硬 substring(0, N) 改为 JS budget 机制递归累计 避免切在 <td>订单号 ABC 中间,截断发生在 TEXT_NODE 完整段或下一个子元素开始之前 用 ElementHandle.querySelector + evaluate 替代字符串拼接 selector 进 JS 防止 selector 注入(selector 含特殊字符如引号、反斜杠) 三处 context 创建点统一调 applyContextDefaults 确保 CDP / external-CDP / 本地 launch 三条路径都应用配置的 timeout

## 临时改动还原
文件 改动 还原状态 mateclaw-server/pom.xml 临时加 maven-compiler-plugin + Lombok annotation processor  已删除,恢复原始状态

## 未测项
项 原因 doSnapshot 的 JS budget 逻辑 需启动真 Playwright + 大页面,单元测试范围外 BrowserLauncher.applyContextDefaults 是否真的影响 page.click 行为 同上,集成测试范围 LLM 是否真的会按 hint 用 selector 重调 取决于 LLM 推理能力,需端到端测试
2026-07-02 09:25:16 +08:00
.github/ISSUE_TEMPLATE sync: settings UI polish, channel reliability fixes, DeepSeek cross-turn fix 2026-04-29 11:22:47 +08:00
assets docs(readme): surface 1.3.0 themes in README + architecture diagrams 2026-05-14 15:10:03 +08:00
docker/searxng fix(docker): bake searxng settings.yml into custom image 2026-04-24 23:25:03 +08:00
docs fix(wiki): dedup directory-scanned files by source path, not just content hash (#272) 2026-06-07 19:50:21 +08:00
mateclaw-desktop feat(tool): desktop local file/shell tools via WebSocket tunnel 2026-06-26 18:24:25 +08:00
mateclaw-plugin-api chore(build): centralize Maven revision management 2026-05-18 10:01:11 +08:00
mateclaw-plugin-sample chore(build): centralize Maven revision management 2026-05-18 10:01:11 +08:00
mateclaw-server feat(browser): 放开内网服务访问限制,新增局域网部署模式开关 (#472) 2026-07-02 09:25:16 +08:00
mateclaw-ui feat(delegation): 本轮 token 总量页脚 + 子 Agent 用量向上滚加 2026-06-30 17:21:10 +08:00
mateclaw-webchat fix(webchat): align demo and widget theme tokens 2026-05-04 19:23:45 +08:00
rfcs feat(kb-open): P0-A open-API auth — API keys, rate limit, centralized authorization 2026-06-28 14:45:53 +08:00
.dockerignore chore: bump version to 1.1.137-SNAPSHOT 2026-04-18 21:58:54 +08:00
.env.example feat(browser): 放开内网服务访问限制,新增局域网部署模式开关 (#472) 2026-07-02 09:25:16 +08:00
.gitignore chore(repo): drop unused npm/yarn lockfiles and fix inline FQNs 2026-06-21 10:06:28 +08:00
docker-compose.yml feat(browser): 放开内网服务访问限制,新增局域网部署模式开关 (#472) 2026-07-02 09:25:16 +08:00
LICENSE chore: add Apache-2.0 license 2026-04-04 23:29:51 +08:00
pom.xml chore: bump version to 1.7.0-SNAPSHOT 2026-06-23 10:20:47 +08:00
README_zh.md docs(readme): mark v1.6.0 as the latest stable release at the top 2026-06-22 17:51:02 +08:00
README.md docs(readme): mark v1.6.0 as the latest stable release at the top 2026-06-22 17:51:02 +08:00

MateClaw Logo

MateClaw

Your second brain

Agent Harness · Spring Boot inside · One JAR to ship

GitHub Repo Documentation Live Demo Website Java Version Spring Boot Vue Last Commit License

[Website] [Live Demo] [Documentation] [中文]

MateClaw Preview


Other personal AI agents are built for one person. MateClaw is the one your IT department can actually sign off on.

Multi-user workspaces. Approval-gated sensitive actions. Full audit trail. Spring Boot Actuator health monitoring. Per-channel error isolation so one chat platform's outage doesn't take down the rest. One JAR on your own machine, zero data egress.

And underneath, a real agent harness. ReAct + Plan-and-Execute on a StateGraph runtime — not a one-shot RAG call dressed up. Tools, Skills, MCP, and ACP converge on one registry with per-employee binding. Sensitive tool calls flow through an approval gate you can actually inspect. Multi-vendor failover keeps the loop running when a provider doesn't.

Most AI tools die when their vendor has a bad day. Most forget you the moment the tab closes. Most give you a chatbox and call it a product.

MateClaw is the whole widget. One deployment. Reasoning, knowledge, memory, tools, channels — built together, not bolted on. And when your primary model goes down, the next one picks up mid-sentence.


Three things that make it different

1 · Your AI doesn't die when a model does

Primary key expired. Vendor returns 401. Network blip. Quota drained.

Other tools hand you a red error card. MateClaw routes to the next healthy provider — DashScope, OpenAI, Anthropic, Gemini, DeepSeek, Kimi, Ollama, LM Studio, MLX, 14+ in total — and the user sees the reply finish. A provider health tracker parks bad vendors in a cooldown window so they don't waste seconds on every turn.

You don't write a retry script. You drag providers into priority order in Settings → Models and watch the health dashboard fill with green dots as requests route around failures in real time.

Upload a PDF, a batch of markdown, a scraped page — raw material in.

MateClaw's LLM Wiki digests it into structured pages, builds [[links]] between them, and remembers where every sentence came from. Click a citation, see the exact source chunk. Ask a question, the page you get is stitched from the right chunks — with references you can verify.

This is the difference between a warehouse and a library.

3 · One product, five surfaces

Surface What it is
Web Console Full admin — digital employees, models, skills, knowledge, security, cron, runtime console (see what every employee is doing, force-recycle in one click)
Desktop Electron app with a bundled JRE 21. Double-click, run. No Java install
Webchat Widget One <script> tag embed. Drop it on any site
IM Channels DingTalk · Feishu · WeChat Work · WeChat · Telegram · Discord · QQ · Slack
Plugin SDK Java module for third-party capability packs

Same brain. Same memory. Same tools. Different doors.

$0 · No tokens metered. No seats billed. Your server. Your data. Your keys.


What's in the box

Digital employees, not chatbots

You hire coworkers, not chat boxes. Each one has a Role, a Goal, a Backstory, a pixel-art avatar, and a color of their own — five career templates ship ready (Product Researcher · Customer Support · Knowledge Curator · Data Analyst · Executive Assistant). ReAct drives iterative reasoning, Plan-and-Execute decomposes complex multi-step work, employees can delegate to one another in parallel. Dynamic context pruning, smart truncation, stale-stream cleanup — the boring stuff that makes long conversations actually work.

Knowledge & memory

  • LLM Wiki — raw materials digest into linked pages with citations; the hot cache auto-injects into every employee's system prompt. Transformations engine (1.3.0+) turns the Wiki from a search index into a processing pipeline
  • Workspace memoryAGENTS.md, SOUL.md, PROFILE.md, MEMORY.md, daily notes
  • Memory lifecycle — post-conversation extraction, scheduled consolidation, Dreaming workflows. Workflows can also write directly into an employee's MEMORY.md via the write_memory step

Skills · MCP · ACP — three ways to extend capability

  • SKILL.md packages — manifest + prompt + tool list + LESSONS.md (gets smarter the more you use it). Eight starter templates plus a five-step creation wizard, with Pre-flight checks that tell you what's missing before install
  • MCP — stdio / SSE / Streamable HTTP, plug into any external tool server. Per-employee binding (1.3.0+) means a tool you install for one employee doesn't bleed into another's toolbox
  • ACP — bring top-tier coding agents like Claude Code and Codex in as employees, auto-bridged to skill cards with wrapper tools
  • Tool Guard — RBAC + approval flow + path protection. Capability needs boundaries

Business orchestration (1.3.0+)

  • Workflow — compose multiple employees plus system actions (approval / channel dispatch / write-memory) into a publishable, triggerable, replayable linear DSL. Seven step modes (sequential / fan_out / collect / conditional / await_approval / dispatch_channel / write_memory). JSON-first authoring with Monaco + schema validation, or natural-language → draft generation
  • Triggers — wire system events to workflows or to employee conversations. Six pattern types (cron / webhook / channel_message / agent_lifecycle / content_match / workflow_completion). Default-on event governance: dedup, per-trigger rate limit, bot-self filter, recursion guard, fail-closed unknown patterns
  • Wiki Transformations — Wiki stops being retrieval-only. User-authored templates run against raw materials or existing pages, with cross-material map-reduce aggregation, reverse-citation extraction, JSON output mode, and per-template model picker

You see what every employee is doing

Admin Runtime Console (Settings → System → Runtime) — who's running, what step they're on, how many tokens, one-click force-recycle when stuck. Streaming is staged honestly (thinking / tool / answer), per-event SSE IDs make reconnects safe, multi-employee delegation no longer fights itself, long tasks demand evidence-grounded answers.

Multimodal creation

Text-to-speech · Speech-to-text · Image · Music · Video · 3D. First-class, not add-ons. Sidecar routing (1.3.0+) means a text-only main model + an image attachment no longer dead-ends — a configured vision model describes the image, and the main model answers. Image edit lands too: refer to an earlier conversation attachment by msg:<id>:<idx> and ask the model to recolor or restyle it. Four document-generation tools (DocxRenderTool / XlsxRenderTool / PptxRenderTool / PdfRenderTool) render Markdown straight to Office files inside the JVM — no subprocess, no Office install.

Enterprise-ready

RBAC + JWT. Personal Access Tokens for headless scripts and CI. HMAC-SHA-256 outbound webhook signing. Distributed Cron lock so multi-instance deployments don't double-fire. Full audit trail. Flyway-managed schema that auto-heals on upgrade. One JAR to ship. MySQL in production, H2 for dev — nothing to change in your code.


AI is becoming infrastructure

On March 2, 2026, Claude went dark for 4 hours across API, web, and mobile. Three weeks later, another 5 hours. Every company that bet their AI strategy on a single vendor spent those outages staring at red error cards.

This is the same shift databases went through around 2010 and cloud went through around 2018: the winning layer stops being tied to one supplier. 57% of companies now run AI agents in production. None of them want one vendor's bad day to become their bad day.

MateClaw is that layer — built the Spring Boot way.


Why MateClaw

MateClaw OpenClaw Hermes Agent Claude Code Cursor
Multi-vendor failover Chain + health tracker + cooldown Swap providers via config Orchestration w/ retry Anthropic only One model
Knowledge digestion LLM Wiki + page-level citations Canvas + memory Skills Hub + memory Code index
Multi-user admin RBAC + approval + audit + runtime console Config-file first Single-user CLI Enterprise tier Teams plan
Capability extension Skills (LESSONS) + MCP + ACP MCP MCP
Surfaces Web admin + Desktop + Widget + SDK + 8 IM 25+ chat channels 15+ channels (CLI-led) 3 IM preview IDE only
Stack Java (Spring Boot) TypeScript Python TypeScript Electron/TS
License / Price Apache 2.0 · Free MIT · Free MIT · Free Proprietary · $20200/mo Proprietary · $0200/mo

OpenClaw and Hermes Agent are excellent personal AI platforms — pick either if you're running one user on one laptop, building your own agent from CLI, and treating everything as config files to hand-tune. Both have bigger communities than MateClaw today.

MateClaw is the version built for teams. RBAC per digital employee, per model, per tool. An approval flow that pauses risky actions for review. Full audit trail. The Admin Runtime Console gives one operator real-time visibility into 50 employees running across 14 vendors — stuck? force-recycle in one click. Spring Boot inside — drop-in for any Java shop already running production services.

Same "whole widget" philosophy. Different center of gravity.


Quick start

# Backend
cd mateclaw-server
mvn spring-boot:run           # http://localhost:18088

# Frontend
cd mateclaw-ui
pnpm install && pnpm dev      # http://localhost:5173

Login: admin / admin123

Docker

cp .env.example .env
docker compose up -d          # http://localhost:18080

Desktop

Download from GitHub Releases. Bundles JRE 21. No Java install needed.


Architecture

Business Architecture

Technical architecture

Technical Architecture


Project structure

mateclaw/
├── mateclaw-server/        Spring Boot 3.5 backend (Spring AI Alibaba, StateGraph runtime)
├── mateclaw-ui/            Vue 3 + TypeScript admin SPA (built into the server JAR)
├── mateclaw-webchat/       Embeddable chat widget (UMD / ES bundles)
├── mateclaw-plugin-api/    Java SDK for third-party capability plugins
├── mateclaw-plugin-sample/ Reference plugin implementation
├── docker-compose.yml
└── .env.example

Desktop binaries ship via GitHub Releases with a bundled JRE 21 — no Java install needed.

Tech stack

Layer Technology
Backend Spring Boot 3.5 · Spring AI Alibaba 1.1 · MyBatis Plus · Flyway
Digital Employee Runtime StateGraph · ReAct + Plan-Execute · Role / Goal / Backstory · LESSONS self-evolution
Orchestration Workflow (7 step modes · Pebble DSL) · Triggers (6 pattern types · event governance) · Wiki Transformations (1.3.0+)
Capability Extension SKILL.md packages · MCP (stdio / SSE / HTTP · per-agent binding) · ACP bridge (Claude Code / Codex)
Database H2 (dev) · MySQL 8.0+ (prod)
Auth Spring Security + JWT
Frontend Vue 3 · TypeScript · Vite · Element Plus · TailwindCSS 4
Desktop Electron · electron-updater · JRE 21 (bundled)
Widget Vite library mode · UMD + ES bundles

Documentation

Full docs at claw.mate.vip/docs — setup, architecture, each subsystem, API reference.

Roadmap

v1.6.0 (shipped 2026-06-22) — make the autonomous employee fast, sharp-eyed, and embeddable:

  • Faster first token — two-stage skill loading (base skills resident, scenario skills retrieved on demand by a relevance scorer) plus prefix compression, cutting the cold-start payload that used to blow past a million characters
  • Native code executionexecute_code lets an employee write and run sandboxed code to compute, transform data, and assemble multi-format reports, all JVM-side
  • Vision that persists — images stay in context across turns; image_analyze re-reads an attachment on demand, so "zoom into that chart" follow-ups work without re-uploading
  • Embeddable & headless — the webchat widget becomes a Web/API surface with multi-session support and per-end-user identity (endUserId), isolating memory per end user
  • A Wiki you actually read — reading split from management, a unified Sources tab with per-KB auto-sync, and clickable cross-KB [[wikilinks]]
  • Steadier under load — self-healing MCP connections · tool-call recovery on interleaved-thinking models · evidence-gated plan execution

Full story in the v1.6.0 release notes.

v1.5.0 (shipped 2026-06-04) — Goal checklists (fuzzy score → ticked boxes) · self-maintaining Wiki ([[wikilinks]] · fact/experience layers · pageType profiles & permissions · KB pipelines · local-directory ingest) · per-owner memory isolation (owner_key + visibility scope + endUserId passthrough) · per-agent primary knowledge base · provider-preference model routing. Full story in the v1.5.0 release notes.

v1.4.0 (shipped 2026-05-23) — Persistent Goals (lock a goal, self-evaluate every turn) · subagent delegation tree (3 levels deep · sync / parallel / async · one-sentence team builder) · progressive tool/skill disclosure · Workspace RBAC (Owner / Admin / Member / Viewer) · Feishu first-class (interactive / approval / streaming cards · channel-native tools). See the v1.4.0 release notes.

v1.3.0 (shipped 2026-05-13) — Workflow engine · 6-pattern trigger system · Wiki transformations · per-agent MCP binding · multimodal sidecar routing · four JVM-native document-generation tools · image edit. See the v1.3.0 release notes.

Contributing

git clone https://github.com/mateaix/mateclaw.git
cd mateclaw
cd mateclaw-server && mvn clean compile
cd ../mateclaw-ui && pnpm install && pnpm dev

Why the name

Mate is companion. Claw is capability.

Something that stays with you — and grabs work and moves it.

License

Apache License 2.0. No asterisks.