@commonlyai/cli 0.1.1 → 0.1.4

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.1",
+  "version": "0.1.4",
   "license": "Apache-2.0",
-  "description": "The Commonly CLI \u2014 connect agents, manage pods, iterate fast",
+  "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",
   "main": "./src/index.js",
   "bin": {

package/src/commands/agent.js

@@ -21,12 +21,19 @@ import { getToken, resolveInstanceUrl } from '../lib/config.js';
 import { startPoller } from '../lib/poller.js';
 import { startWebhookServer, forwardToLocalWebhook } from '../lib/webhook-server.js';
 import { getAdapter, listAdapterNames } from '../lib/adapters/index.js';
-import { getSession, setSession, clearSessions } from '../lib/session-store.js';
+import {
+  getSession,
+  setSession,
+  clearSessions,
+  wasEventHandled,
+  recordHandledEvent,
+} from '../lib/session-store.js';
 import { readLongTerm, syncBack } from '../lib/memory-bridge.js';
 import { detectMemorySources, composeImport, importMemory } from '../lib/memory-import.js';
 import { detectSkills, importSkills } from '../lib/skills-import.js';
 import { parseEnvironmentFile, resolveWorkspace } from '../lib/environment.js';
 import { detectBwrap } from '../lib/sandbox/bwrap.js';
+import { detectSeatbelt } from '../lib/sandbox/seatbelt.js';
 
 // ── Token file I/O — ~/.commonly/tokens/<name>.json (ADR-005) ───────────────
 
@@ -100,20 +107,41 @@ export const listLocalAgents = () => {
     .filter(Boolean);
 };
 
-// Event types that carry a human/agent-authored prompt the wrapper should
-// forward to the CLI. Other event types (heartbeat, delivery, etc.) are acked
-// as no_action even if they happen to carry `content` in their payload.
-const CHAT_EVENT_TYPES = new Set(['chat.mention', 'message.posted', 'dm.message']);
+// Event types that carry a prompt the wrapper should forward to the CLI.
+// Other event types (heartbeat, delivery, etc.) are acked as no_action even
+// if they happen to carry `content` in their payload.
+const PROMPT_EVENT_TYPES = new Set([
+  'chat.mention',
+  'message.posted',
+  'dm.message',
+  'first_contact',
+]);
 
 // ── default environment for adapters that benefit from auto-MCP wiring ─────
 
 // Adapters that can consume `mcp[]` from the resolved environment spec.
-// `claude` reads it via --mcp-config (see adapters/claude.js). `codex` and
-// `stub` do not (codex uses ~/.codex/config.toml at boot, set up server-side
-// for cloud-codex; the local codex wrapper doesn't ship MCP wiring yet —
-// follow-up after #440). Returning null means "no default" — the wrapper
-// proceeds with environment=null exactly like before this change.
-const ADAPTERS_WITH_DEFAULT_MCP = new Set(['claude']);
+// `claude` reads it via --mcp-config (see adapters/claude.js); `codex` via
+// `-c mcp_servers.*` config overrides (see adapters/codex.js — added after
+// the 2026-07-22 as-operator attribution incident, where an MCP-less codex
+// agent posted through the operator's CLI profile because it had no
+// commonly_* tools of its own). `stub` does not. Returning null means "no
+// default" — the wrapper proceeds with environment=null exactly like before.
+const ADAPTERS_WITH_DEFAULT_MCP = new Set(['claude', 'codex']);
+const CODEX_PERMISSION_PROFILE_MIN_VERSION = [0, 138, 0];
+
+const versionAtLeast = (version, minimum) => {
+  const parts = String(version || '')
+    .match(/\d+(?:\.\d+){1,2}/)?.[0]
+    .split('.')
+    .map(Number);
+  if (!parts) return false;
+  for (let i = 0; i < minimum.length; i += 1) {
+    const current = parts[i] || 0;
+    if (current > minimum[i]) return true;
+    if (current < minimum[i]) return false;
+  }
+  return true;
+};
 
 // The commonly behavior skill ships inside this package (cli/skills/commonly)
 // so a fresh attach can mount it into the agent without a network fetch.
@@ -193,6 +221,12 @@ export const performAttach = async ({
     log(`workspace: ${workspace.path}${workspace.created ? ' (created)' : ''}`);
 
     const sandboxMode = environment.sandbox?.mode || 'none';
+    const sandboxTrust = environment.sandbox?.trust;
+    if (sandboxTrust === 'public' && sandboxMode === 'none') {
+      throw new Error(
+        'sandbox.trust=public requires an enforced sandbox mode; refusing to attach unsandboxed',
+      );
+    }
     if (sandboxMode === 'bwrap') {
       const bwrap = detectBwrap();
       if (!bwrap.available) {
@@ -204,10 +238,41 @@ export const performAttach = async ({
           + 'are advisory in Phase 1. Use sandbox.mode=container for enforced policy.',
         );
       }
+    } else if (sandboxMode === 'workspace' || sandboxMode === 'read-only') {
+      if (sandboxTrust !== 'public' || !['codex', 'claude'].includes(adapterName)) {
+        throw new Error(
+          `sandbox.mode=${sandboxMode} is currently implemented only for public `
+          + `codex or Claude adapters`,
+        );
+      }
+      if (adapterName === 'codex') {
+        if (!versionAtLeast(detected.version, CODEX_PERMISSION_PROFILE_MIN_VERSION)) {
+          throw new Error(
+            `public codex sandbox requires Codex >=0.138.0 permission profiles; `
+            + `detected ${detected.version || 'unknown'}`,
+          );
+        }
+        log(
+          `sandbox: public ${sandboxMode} via Codex native permission profile `
+          + '(deny-by-default filesystem + network)',
+        );
+      } else {
+        const seatbelt = detectSeatbelt();
+        if (!seatbelt.available) {
+          throw new Error(
+            `public Claude sandbox.mode=${sandboxMode} requires macOS Seatbelt: `
+            + `${seatbelt.error}. On Linux use sandbox.mode=bwrap.`,
+          );
+        }
+        log(
+          `sandbox: public ${sandboxMode} via macOS Seatbelt `
+          + '(deny-by-default host filesystem; Claude/MCP network retained)',
+        );
+      }
     } else if (sandboxMode !== 'none' && sandboxMode !== undefined) {
       throw new Error(
         `sandbox.mode=${sandboxMode} is not yet implemented in the local-CLI driver. `
-        + `Phase 1 supports: none, bwrap.`,
+        + `Supported locally: none, bwrap, and public codex/Claude workspace/read-only.`,
       );
     }
   } else {
@@ -366,7 +431,7 @@ export const runMemoryImport = async ({
 // ── run: local-CLI wrapper loop (ADR-005) ────────────────────────────────────
 
 const extractPrompt = (event) => {
-  if (!CHAT_EVENT_TYPES.has(event.type)) return null;
+  if (!PROMPT_EVENT_TYPES.has(event.type)) return null;
   const p = event.payload || {};
   return p.content || p.prompt || p.text || null;
 };
@@ -432,7 +497,7 @@ export const performRun = ({
     // and (if the adapter returns a summary) patch-sync back after.
     const memoryLongTerm = await readLongTerm(client, { onError });
 
-    // Snapshot the pod's recent message ids so that, after the spawn, we can
+    // Snapshot the pod's recent messages so that, after the spawn, we can
     // tell whether the agent posted itself via commonly_post_message. If it
     // did, its final CLI text is a narration/log — echoing it would duplicate
     // the message and re-fire any @mention. This is the wrapper-side guarantee
@@ -440,17 +505,20 @@ export const performRun = ({
     // without relying on the agent to emit NO_REPLY. (A rare concurrent post by
     // another member during the spawn window can suppress a genuine wrapper
     // reply — an acceptable trade against a guaranteed double-post.)
-    const snapshotMessageIds = async () => {
+    const snapshotMessages = async () => {
       try {
         const { messages = [] } = await client.get(
           `/api/agents/runtime/pods/${eventPodId}/messages`, { limit: 10 },
         );
-        return new Set(messages.map((m) => String(m._id || m.id)));
+        return messages;
       } catch {
         return null; // detection unavailable — fall back to posting the reply
       }
     };
-    const preSpawnIds = await snapshotMessageIds();
+    const preSpawn = await snapshotMessages();
+    const preSpawnIds = preSpawn
+      ? new Set(preSpawn.map((m) => String(m._id || m.id)))
+      : null;
 
     log(`[${event.type}] spawning ${adapter.name}`);
     const result = await adapter.spawn(prompt, {
@@ -459,11 +527,13 @@ export const performRun = ({
       env: process.env,
       memoryLongTerm,
       environment,
-      // Runtime context the adapter uses to substitute ${COMMONLY_AGENT_TOKEN}
-      // / ${COMMONLY_API_URL} placeholders in MCP env values, command args,
-      // and URLs. Lets users keep tokens out of their checked-in env files.
+      // Runtime context the Claude/Codex adapters expose only to their
+      // per-spawn MCP environment. Claude keeps ${COMMONLY_*} placeholders
+      // literal on disk and lets its native MCP parser expand them, so the
+      // bearer token never enters the generated config file.
       runtimeToken: token,
       instanceUrl,
+      agentName,
       metadata: { event },
     });
 
@@ -482,10 +552,19 @@ export const performRun = ({
     const replyText = (result.text || '').trim();
     let agentPostedItself = false;
     if (preSpawnIds) {
-      const postSpawnIds = await snapshotMessageIds();
-      if (postSpawnIds) {
-        for (const id of postSpawnIds) {
-          if (!preSpawnIds.has(id)) { agentPostedItself = true; break; }
+      const postSpawn = await snapshotMessages();
+      if (postSpawn) {
+        for (const m of postSpawn) {
+          // Only a NEW message from a bot user counts as "the agent posted
+          // itself". A new human-authored message must NOT suppress the echo:
+          // it is either a human typing mid-turn, or the agent misusing an
+          // operator CLI profile / human token (the 2026-07-22 as-operator
+          // attribution incident) — in both cases the wrapper still delivers
+          // the reply under the agent's own identity.
+          if (!preSpawnIds.has(String(m._id || m.id)) && m.isBot) {
+            agentPostedItself = true;
+            break;
+          }
         }
       }
     }
@@ -524,13 +603,23 @@ export const performRun = ({
       for (const event of events) {
         if (!running) break;
         let result;
-        try {
-          result = await processEvent(event);
-        } catch (err) {
-          // Spawn failed — skip ack, let kernel re-deliver (ADR-005).
-          log(`[${event.type}] spawn error: ${err.message}`);
-          onError?.(err);
-          continue;
+        if (wasEventHandled(agentName, event._id)) {
+          result = { outcome: 'no_action', reason: 'duplicate-delivery' };
+          log(`[${event.type}] duplicate delivery ${event._id} — skipping spawn and re-acking`);
+        } else {
+          try {
+            result = await processEvent(event);
+          } catch (err) {
+            // Spawn failed — do not record or ack, so the kernel can re-deliver
+            // the event after the local runtime recovers (ADR-005).
+            log(`[${event.type}] spawn error: ${err.message}`);
+            onError?.(err);
+            continue;
+          }
+          // Record after successful processing but before ack. If the ack
+          // fails, the next delivery is skipped and re-acked instead of
+          // burning a second model turn for work that already completed.
+          recordHandledEvent(agentName, event._id);
         }
         try {
           await client.post(`/api/agents/runtime/events/${event._id}/ack`, { result });
@@ -685,7 +774,8 @@ export const performInit = async ({
  *      7 days after all installs go inactive — we don't force-revoke here
  *      because the token may legitimately still be in use for another pod.
  *   2. Local token file at ~/.commonly/tokens/<name>.json
- *   3. Local session store at ~/.commonly/sessions/<name>.json
+ *   3. Local session + handled-event stores at
+ *      ~/.commonly/sessions/<name>{,.events}.json
  *
  * Idempotent: if the backend returns 404 (already uninstalled elsewhere), we
  * still clean up local files so the CLI state stays in sync with reality.