@commonlyai/cli 0.1.179 → 0.1.181

package/src/lib/memory-bridge.js

@@ -60,7 +60,7 @@ export const ROW_SLICING_CUE = 'Slicing: when a row is too large for one turn, s
 export const buildMemoryPreamble = (
   prompt,
   memoryLongTerm,
-  { freshSession = false, workCues = [] } = {},
+  { freshSession = false, workCues = [], memoryWithheld = false } = {},
 ) => {
   // `null` is the UNREADABLE signal, and it is deliberately not the same value
   // as `''`. Telling a seat whose token was revoked that "nothing has ever been
@@ -68,7 +68,14 @@ export const buildMemoryPreamble = (
   // defect this cue exists to fix — one state over. When we could not read, say
   // that, and say nothing about what is stored.
   let context;
-  if (memoryLongTerm === null) {
+  if (memoryWithheld) {
+    // A workspace seat's turn that runs public: not unreadable and not empty,
+    // so neither of those cues is true. Its memory tools are off as well.
+    context = `=== Context (your persistent memory) ===\n`
+      + `(withheld this turn — this turn runs as a public seat because not every `
+      + `pod you answer in is confirmed private, so your memory stays out of it and `
+      + `the memory tools are off. This says nothing about what you have saved.)`;
+  } else if (memoryLongTerm === null) {
     context = `=== Context (your persistent memory) ===\n`
       + `(unreadable this turn — the memory read failed, so this says NOTHING `
       + `about what you have saved. Do not treat it as empty and do not re-save `
@@ -96,7 +103,9 @@ export const buildMemoryPreamble = (
     + 'This is a fresh session. Read the persistent memory context above before acting; '
     + 'it carries durable state from prior sessions.\n';
   let sessionEndCue = '=== Before this session ends ===\n';
-  if (memoryLongTerm === null) {
+  if (memoryWithheld) {
+    sessionEndCue += 'Memory is withheld this turn, so there is nothing to save.';
+  } else if (memoryLongTerm === null) {
     sessionEndCue += 'Memory was unreadable on this fresh session. Do not treat it as empty or '
       + 'write a replacement based on this cue.';
   } else if (memoryLongTerm) {

package/src/lib/sandbox/host-check.js

@@ -70,7 +70,9 @@ export const hostSandboxRefusal = ({
   if (!Object.prototype.hasOwnProperty.call(ADAPTER_LABELS, adapterName)) return null;
   const sandbox = normalizeSandboxTrust(environment?.sandbox);
   if (!sandbox || typeof sandbox !== 'object') return null;
-  const mode = sandbox.mode ?? (sandbox.trust === 'public' ? resolvePublicSandboxMode(sandbox, platform) : undefined);
+  // Every host-confined trust (public, and workspace since TASK-294) derives its
+  // mode here; any other trust gets back only the mode it declared.
+  const mode = sandbox.mode ?? resolvePublicSandboxMode(sandbox, platform);
   if (mode !== 'bwrap' && !SEATBELT_MODES.has(mode)) return null;
 
   if (platform === 'win32') return windowsSandboxMessage(adapterName);

package/src/lib/sandbox/mode.js

@@ -28,14 +28,21 @@
  * NOT used by the codex adapter. Codex's `mode` is read-vs-write access, not a
  * host mechanism — its permission profiles run on both platforms — so its
  * derived default is 'workspace' everywhere.
+ *
+ * A `workspace` trust (TASK-294) resolves the same way: it is confined by the
+ * same host mechanism and differs only in what the policy inside allows. The
+ * grant-broker guard still reads the trust itself, not this mode, so resolving
+ * it here does not make a workspace seat eligible for a room grant.
  */
 import { effectiveSandboxTrust } from '../environment.js';
 
 export const PUBLIC_SANDBOX_MODES = new Set(['workspace', 'read-only']);
 
+const HOST_CONFINED_TRUSTS = new Set(['public', 'workspace']);
+
 export const resolvePublicSandboxMode = (sandbox, platform = process.platform) => {
   const declared = sandbox?.mode;
-  if (effectiveSandboxTrust(sandbox?.trust) !== 'public') return declared;
+  if (!HOST_CONFINED_TRUSTS.has(effectiveSandboxTrust(sandbox?.trust))) return declared;
   if (declared !== undefined && declared !== null) return declared;
   return platform === 'darwin' ? 'workspace' : 'bwrap';
 };

package/src/lib/sandbox/seatbelt.js

@@ -300,6 +300,17 @@ const escapeSbplString = (value) => String(value)
 
 const literal = (path) => `(literal "${escapeSbplString(path)}")`;
 const subpath = (path) => `(subpath "${escapeSbplString(path)}")`;
+// Every .env and .env.* file under the workspace, at any depth, and everything
+// inside a directory of that name: a real project keeps one beside each
+// package, not only at its root (TASK-294). An SBPL regex literal takes no
+// escapes, so a path it cannot hold is refused.
+const envFilesUnder = (workspace) => {
+  if (/["\r\n]/.test(workspace)) {
+    throw new Error('Seatbelt workspacePath must not contain a quote or a line break');
+  }
+  const pattern = workspace.replace(/[\\^$.|?*+()[\]{}]/g, '\\$&');
+  return `(regex #"^${pattern}/(.*/)?\\.env([./].*)?$")`;
+};
 
 const assertAbsolutePath = (path, label) => {
   if (!path || !isAbsolute(path)) {
@@ -356,6 +367,10 @@ export const buildSeatbeltProfile = ({
   readOnlyDirectories = [],
   loopbackNetworkPorts = [],
   allowClaudeRuntimeAccess = false,
+  // Names directly inside a writable workspace that stay read-only. A
+  // workspace seat granted write keeps its project's .git read-only, so every
+  // change it makes is one `git status` shows the person (TASK-294).
+  readOnlyWorkspaceEntries = [],
 }) => {
   for (const [path, label] of [
     [workspacePath, 'workspacePath'],
@@ -375,6 +390,11 @@ export const buildSeatbeltProfile = ({
   if (!['read', 'write'].includes(workspaceAccess)) {
     throw new Error('Seatbelt workspaceAccess must be read or write');
   }
+  for (const entry of readOnlyWorkspaceEntries) {
+    if (typeof entry !== 'string' || !entry || entry.includes('/') || entry === '.' || entry === '..') {
+      throw new Error('Seatbelt readOnlyWorkspaceEntries entries must be names inside the workspace');
+    }
+  }
 
   const resolvedWorkspace = realpathOrSelf(workspacePath);
   const resolvedExecutable = realpathOrSelf(executablePath);
@@ -411,6 +431,12 @@ export const buildSeatbeltProfile = ({
     `(allow file-read* file-test-existence ${subpath(path)})`,
     `(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(path)}"))`,
   ].join('\n'))).join('\n');
+  // A symlinked entry is held at both its name and its target, so the write
+  // cannot land through whichever path the link resolves to.
+  const readOnlyWorkspaceRules = [...new Set(readOnlyWorkspaceEntries.flatMap((entry) => {
+    const entryPath = join(resolvedWorkspace, entry);
+    return [entryPath, realpathOrSelf(entryPath)];
+  }))].map((path) => `(deny file-write* ${subpath(path)})`).join('\n');
   const loopbackNetworkRules = [...new Set(loopbackNetworkPorts)].map((port) => (
     `(allow network-outbound (remote tcp "localhost:${port}"))`
   )).join('\n');
@@ -444,7 +470,8 @@ export const buildSeatbeltProfile = ({
     // paths are not. Explicit deny wins over the broad workspace allow.
     `(deny file-read* file-write* ${subpath(join(resolvedWorkspace, '.commonly'))})`,
     `(deny file-read* file-write* ${subpath(join(resolvedWorkspace, '.codex'))})`,
-    `(deny file-read* file-write* ${literal(join(resolvedWorkspace, '.env'))})`,
+    `(deny file-read* file-write* ${envFilesUnder(resolvedWorkspace)})`,
+    readOnlyWorkspaceRules,
     ...claudeRuntimeRules,
   ].filter(Boolean).join('\n\n');
 };

package/src/lib/workspace-trust.js

@@ -0,0 +1,139 @@
+/**
+ * The two facts a `workspace`-trust seat depends on (TASK-294), as pure
+ * predicates so the attach path, the first-run bootstrap and the per-spawn
+ * check all read them the same way.
+ *
+ * 1. Every pod the seat answers in is CONFIRMED private: not publicly
+ *    readable, not listed, and invite-only. Visibility alone is not enough,
+ *    because any agent can add itself to an open pod an agent created, listed
+ *    or not. A pod whose fields the server did not report counts as public:
+ *    the workspace tier lets the room read the start directory, so an unknown
+ *    room fails closed.
+ * 2. The start directory is a directory worth exposing to that room, and not
+ *    one that contains the operator's whole account: `/`, `$HOME`, an ancestor
+ *    of `$HOME`, or a directory inside one of the credential stores the public
+ *    policy denies by name.
+ */
+import { realpathSync } from 'fs';
+import { homedir } from 'os';
+import {
+  isAbsolute, join, relative, resolve,
+} from 'path';
+
+/** A pod is private only when the server says so in all three fields. */
+export const podIsConfirmedPrivate = (pod) => (
+  typeof pod?.publicRead === 'boolean'
+  && typeof pod?.communityListed === 'boolean'
+  && !pod.publicRead
+  && !pod.communityListed
+  && pod.joinPolicy === 'invite-only'
+);
+
+/** True only for a non-empty list in which every pod is confirmed private. */
+export const allPodsConfirmedPrivate = (pods) => (
+  Array.isArray(pods) && pods.length > 0 && pods.every(podIsConfirmedPrivate)
+);
+
+// The stores claude.js denies by absolute path for a public seat. A start
+// directory inside one of them would put the seat's own credentials in reach.
+const CREDENTIAL_DIRS = ['.commonly', '.claude', '.codex', '.ssh', '.aws', '.config'];
+
+const realOrResolved = (p) => {
+  try {
+    return realpathSync(p);
+  } catch {
+    return resolve(p);
+  }
+};
+
+const isInsideOrEqual = (child, parent) => {
+  const rel = relative(parent, child);
+  return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+};
+
+/**
+ * Why `dir` cannot be a workspace seat's start directory, or `null` when it can.
+ * Symlinks are resolved first, so a link to `$HOME` is refused as `$HOME`.
+ */
+export const workspaceStartDirRefusal = (dir, { home = homedir() } = {}) => {
+  if (typeof dir !== 'string' || !isAbsolute(dir)) {
+    return 'the start directory is not an absolute path';
+  }
+  const real = realOrResolved(dir);
+  const realHome = realOrResolved(home);
+  if (real === '/') return 'the start directory is /';
+  if (isInsideOrEqual(realHome, real)) {
+    return real === realHome
+      ? 'the start directory is your home directory'
+      : 'the start directory contains your home directory';
+  }
+  const store = CREDENTIAL_DIRS.find((name) => isInsideOrEqual(real, join(realHome, name)));
+  if (store) return `the start directory is inside ~/${store}`;
+  return null;
+};
+
+const PUBLIC_POD_REASON = 'a pod it answers in is publicly readable or open to join, or did not report whether it is';
+// claude.js refuses a workspace seat under bwrap, so off macOS the default
+// would be a seat that fails every turn rather than one that reads a project.
+const NOT_MACOS_REASON = 'an agent works in its folder only on macOS for now';
+
+/**
+ * Where a first-run claude seat may read (TASK-294), from three facts the
+ * bootstrap already holds: the adapter it detected, the rooms its token
+ * answers in, and the directory the person ran it from. It returns the start
+ * directory only when all three allow it, and otherwise the reason the seat
+ * keeps the `public` default it had before, plus a `fix` when the person can
+ * change the outcome by starting somewhere else. Any other adapter gets `null`:
+ * `workspace` is claude-only for now, so there is nothing to decide.
+ */
+export const firstRunWorkspace = ({
+  adapterName, installations, startDir, home, platform = process.platform,
+} = {}) => {
+  if (adapterName !== 'claude') return null;
+  if (platform !== 'darwin') return { workspacePath: null, reason: NOT_MACOS_REASON };
+  if (!allPodsConfirmedPrivate(installations)) {
+    return { workspacePath: null, reason: PUBLIC_POD_REASON };
+  }
+  const refusal = workspaceStartDirRefusal(startDir, home === undefined ? {} : { home });
+  if (refusal) {
+    return {
+      workspacePath: null,
+      reason: refusal,
+      fix: 'To let it read a project, run this command from that project\'s folder.',
+    };
+  }
+  return { workspacePath: realOrResolved(startDir), reason: null };
+};
+
+/**
+ * Where one turn of a seat runs, and under which trust. A pod can turn public
+ * after attach, so a `workspace` seat's rooms are re-read before every turn
+ * (`installations` is that read, or `null` when it failed). A turn that cannot
+ * confirm them all private runs as a `public` seat in its scratch folder: the
+ * confinement it would have had without the workspace. Any other trust runs
+ * where and as it was started.
+ */
+export const workspaceTurnPlacement = ({
+  environment, workspacePath, installations, scratchDir,
+} = {}) => {
+  const cwd = workspacePath || scratchDir;
+  if (environment?.sandbox?.trust !== 'workspace' || allPodsConfirmedPrivate(installations)) {
+    return { environment, cwd, reason: null };
+  }
+  // Its write/web grants widen the workspace tier only, so the public turn
+  // drops them rather than carry them into a room strangers can read.
+  const { allow: _grants, ...sandbox } = environment.sandbox;
+  return {
+    environment: { ...environment, sandbox: { ...sandbox, trust: 'public' } },
+    cwd: scratchDir,
+    reason: installations === null ? 'its pods could not be read' : PUBLIC_POD_REASON,
+  };
+};
+
+export default {
+  podIsConfirmedPrivate,
+  allPodsConfirmedPrivate,
+  workspaceStartDirRefusal,
+  firstRunWorkspace,
+  workspaceTurnPlacement,
+};