@commonlyai/cli 0.1.180 → 0.1.181

package/src/lib/adapters/opencode.js

@@ -47,6 +47,7 @@ import { buildMemoryPreamble } from '../memory-bridge.js';
 import {
   isLegacySandboxTrust,
   normalizeSandboxTrust,
+  refuseWorkspaceTrust,
   validateEnvironmentSpec,
 } from '../environment.js';
 import { adapterFailure, spawnCredentials } from '../upstream-refusal.js';
@@ -651,6 +652,7 @@ export default {
   async spawn(prompt, rawCtx = {}) {
     const seatModel = requireSeatModel(rawCtx.environment, 'opencode');
     const sandbox = normalizeSandboxTrust(rawCtx.environment?.sandbox);
+    refuseWorkspaceTrust(sandbox, 'opencode');
     const ctx = rawCtx.environment
       ? { ...rawCtx, environment: { ...rawCtx.environment, sandbox } }
       : rawCtx;

package/src/lib/adapters/pi.js

@@ -44,7 +44,7 @@ import {
   spawnCredentials,
 } from '../upstream-refusal.js';
 import { buildMemoryPreamble } from '../memory-bridge.js';
-import { effectiveSandboxTrust } from '../environment.js';
+import { effectiveSandboxTrust, refuseWorkspaceTrust } from '../environment.js';
 import { GRANT_BROKER_REFUSAL, isGrantBrokerUrl } from './pi-mcp-client.mjs';
 import { deliverSeatCredential, withholdRuntimeCredential } from '../mcp-credential-delivery.js';
 import { prepareMcpSpawn } from '../mcp-home.js';
@@ -306,6 +306,7 @@ export const sessionExists = async (sessionDir, sessionId) => {
  */
 export const assertNoSandboxDeclared = (environment = {}) => {
   const sandbox = environment?.sandbox || {};
+  refuseWorkspaceTrust(sandbox, 'pi');
   if (effectiveSandboxTrust(sandbox.trust) === 'public') {
     throw new Error('pi adapter: public-trust seats are not supported — pi has no enforced sandbox; do not attach a pi seat to a stranger-readable pod');
   }

package/src/lib/adapters/qwen.js

@@ -9,7 +9,7 @@ import { buildMemoryPreamble } from '../memory-bridge.js';
 import { deliverSeatCredential } from '../mcp-credential-delivery.js';
 import { prepareMcpSpawn, publicMcpUnavailableError, selectedMcpVersionDir } from '../mcp-home.js';
 import { writeCredentialFile } from '../credential-file.js';
-import { normalizeSandboxTrust, validateEnvironmentSpec } from '../environment.js';
+import { normalizeSandboxTrust, refuseWorkspaceTrust, validateEnvironmentSpec } from '../environment.js';
 import { resolvePublicSandboxMode } from '../sandbox/mode.js';
 import { detectBwrap, wrapArgvWithBwrap } from '../sandbox/bwrap.js';
 import { wrapArgvWithSeatbelt } from '../sandbox/seatbelt.js';
@@ -234,6 +234,7 @@ export default {
   async spawn(prompt, ctx = {}) {
     const seatModel = requireSeatModel(ctx.environment, 'qwen', true);
     const sandbox = normalizeSandboxTrust(ctx.environment?.sandbox);
+    refuseWorkspaceTrust(sandbox, 'qwen');
     const isPublic = sandbox?.trust === 'public';
     const mode = isPublic ? resolvePublicSandboxMode(sandbox) : null;
     if (isPublic && !['workspace', 'read-only', 'bwrap'].includes(mode)) {

package/src/lib/default-environment.js

@@ -151,13 +151,15 @@ export const withDefaultSandbox = (environment) => {
   // gate accepts — benign (same effective trust) but not a mirror, and the
   // comment would be false. The ORIGINAL block is what gets returned below.
   const sandbox = normalizeSandboxTrust(environment?.sandbox);
-  // An ENFORCED declaration is one the adapters act on: a public trust (whose
-  // mode they resolve, and refuse to spawn without) or an explicit non-'none'
+  // An ENFORCED declaration is one the adapters act on: a public or workspace
+  // trust (whose mode they resolve, and refuse to spawn without — every adapter
+  // but claude refuses `workspace` outright, TASK-294) or an explicit non-'none'
   // mode. `mode: 'none'`, an empty block and a missing one are all the same
   // thing to a spawn — no confinement — so all three are replaced here.
   const enforced = sandbox !== null && typeof sandbox === 'object'
     && sandbox.mode !== 'none'
-    && (sandbox.trust === 'public' || typeof sandbox.mode === 'string');
+    && (sandbox.trust === 'public' || sandbox.trust === 'workspace'
+      || typeof sandbox.mode === 'string');
   if (enforced) return environment;
   return { ...(environment || {}), sandbox: defaultSeatSandbox() };
 };

package/src/lib/environment.js

@@ -47,7 +47,14 @@ const ALLOWED_TOP_KEYS = new Set([
 const ALLOWED_SANDBOX_MODES = new Set([
   'none', 'workspace', 'read-only', 'bwrap', 'firejail', 'container', 'managed',
 ]);
-const ALLOWED_SANDBOX_TRUST = new Set(['public']);
+// `workspace` is the middle trust the comment below waits for (TASK-294): a seat
+// on a pod nobody outside it can read, allowed to read its start directory and
+// run read-only git there. Only the claude adapter reads it; every other adapter
+// refuses it before spawning, so it never degrades into a bare spawn.
+const ALLOWED_SANDBOX_TRUST = new Set(['public', 'workspace']);
+// The opt-ins a `workspace` seat can carry. Each one widens a single thing:
+// `write` adds Edit/Write/Bash and a writable workspace; `web` adds WebFetch.
+export const WORKSPACE_SANDBOX_ALLOW = Object.freeze(['write', 'web']);
 const ALLOWED_NETWORK_POLICIES = new Set(['unrestricted', 'restricted']);
 const INLINE_PROVIDER_CREDENTIAL_FIELD = /(?:key|token|secret|password|authorization|header|credential|auth)/i;
 
@@ -72,7 +79,8 @@ const findInlineProviderCredentialField = (value, path) => {
 // above, and a record that already carries it is resolved TOWARD confinement,
 // never toward the bare spawn (Wren 69585): `internal` is read as `public`, so
 // such a seat is confined where it can be and refuses to derive where it
-// cannot. A real middle trust arrives as its own adapter that reads it.
+// cannot. A real middle trust arrives as its own adapter that reads it — and
+// `workspace` (above) is that trust, which is why it is NOT a legacy alias.
 export const LEGACY_SANDBOX_TRUST = Object.freeze({ internal: 'public' });
 export const isLegacySandboxTrust = (sandbox) => (
   typeof sandbox?.trust === 'string'
@@ -100,6 +108,21 @@ export const effectiveSandboxTrust = (trust) => (
     : trust
 );
 
+/**
+ * Throw when an adapter that does not implement the `workspace` tier is handed
+ * one (TASK-294). Only claude reads it. Every other adapter branches on
+ * `trust === 'public'`, so an unread `workspace` would fall into its
+ * non-public branch — the same silent widening `internal` was (Vera 69592).
+ * Called at each adapter's spawn entry, before any other sandbox read.
+ */
+export const refuseWorkspaceTrust = (sandbox, adapterLabel) => {
+  if (sandbox?.trust !== 'workspace') return;
+  throw new Error(
+    `${adapterLabel} adapter: sandbox.trust=workspace is claude-only for now. `
+    + "Declare sandbox.trust 'public' for this seat, or attach it with the claude adapter.",
+  );
+};
+
 const expandHome = (p) => {
   if (!p || typeof p !== 'string') return p;
   if (p === '~') return homedir();
@@ -294,18 +317,33 @@ export const validateEnvironmentSpec = (spec) => {
       errors.push('sandbox must be an object');
     } else {
       const {
-        mode, trust, network, filesystem,
+        mode, trust, network, filesystem, allow,
       } = spec.sandbox;
       if (mode !== undefined && !ALLOWED_SANDBOX_MODES.has(mode)) {
         errors.push(`sandbox.mode must be one of: ${[...ALLOWED_SANDBOX_MODES].join(', ')}`);
       }
       if (trust !== undefined && !ALLOWED_SANDBOX_TRUST.has(trust)) {
         errors.push(
-          "sandbox.trust must be 'public' — it marks a seat anyone in the pod can "
-          + 'talk to; omit it for your own seat '
+          "sandbox.trust must be 'public' or 'workspace' — 'public' marks a seat "
+          + "anyone in the pod can talk to, 'workspace' a seat on a private pod that "
+          + 'reads its start directory; omit it for an unconfined seat of your own '
           + `(got ${JSON.stringify(trust)})`,
         );
       }
+      if (allow !== undefined) {
+        if (!Array.isArray(allow) || !allow.every((a) => WORKSPACE_SANDBOX_ALLOW.includes(a))) {
+          errors.push(`sandbox.allow must be an array of: ${WORKSPACE_SANDBOX_ALLOW.join(', ')}`);
+        } else if (trust !== 'workspace') {
+          // An opt-in widens the workspace tier and nothing else. On a public
+          // seat it would read as a way to hand strangers Bash.
+          errors.push(
+            "sandbox.allow applies only to trust 'workspace' "
+            + `(got trust ${JSON.stringify(trust)})`,
+          );
+        } else if (allow.includes('write') && mode === 'read-only') {
+          errors.push("sandbox.allow 'write' cannot be combined with sandbox.mode 'read-only'");
+        }
+      }
       if (network !== undefined) {
         if (typeof network !== 'object' || network === null) {
           errors.push('sandbox.network must be an object');

package/src/lib/git-readonly-server.js

@@ -0,0 +1,138 @@
+/**
+ * The `workspace_git` MCP server: one tool, `git`, for a workspace-trust seat
+ * (TASK-294). The claude adapter spawns it as
+ *
+ *   node git-readonly-server.js --root <workspace> --git <binary>
+ *
+ * and the model sees it as `mcp__workspace_git__git`. It speaks the MCP stdio
+ * transport (newline-delimited JSON-RPC 2.0) and hands every call to
+ * runReadonlyGit, which refuses anything that is not read-only and runs the
+ * rest with execFile in the workspace.
+ */
+import { realpathSync, statSync } from 'fs';
+import { isAbsolute } from 'path';
+import { createInterface } from 'readline';
+import { fileURLToPath } from 'url';
+import { READONLY_GIT_SUBCOMMANDS, runReadonlyGit } from './git-readonly.js';
+
+export const SERVER_NAME = 'workspace_git';
+export const TOOL_NAME = 'git';
+const SERVER_VERSION = '1.0.0';
+
+// The tool surface is the same in each of these, so the server answers in the
+// version the client asked for when it is one of them.
+const SUPPORTED_PROTOCOL_VERSIONS = Object.freeze(['2024-11-05', '2025-03-26', '2025-06-18']);
+
+export const GIT_TOOL = Object.freeze({
+  name: TOOL_NAME,
+  description: `Run read-only git in your workspace: ${READONLY_GIT_SUBCOMMANDS.join(', ')}. `
+    + 'Pass the subcommand and its arguments separately, one argument per array entry, '
+    + "e.g. { subcommand: 'log', args: ['-n', '5', '--oneline'] }. "
+    + 'Options that write a file, run a program, or read outside the workspace are refused with the reason, '
+    + 'and paths must stay inside the workspace. For log, diff and show, put paths after \'--\' '
+    + "(e.g. ['-p', '--', 'src/app.js']). .env files are left out of every result. "
+    + 'This is the only git available to you.',
+  inputSchema: {
+    type: 'object',
+    properties: {
+      subcommand: { type: 'string', enum: [...READONLY_GIT_SUBCOMMANDS] },
+      args: {
+        type: 'array',
+        items: { type: 'string' },
+        description: 'Arguments after the subcommand, one per entry.',
+      },
+    },
+    required: ['subcommand'],
+    additionalProperties: false,
+  },
+});
+
+const reply = (id, result) => ({ jsonrpc: '2.0', id, result });
+const fail = (id, code, message) => ({ jsonrpc: '2.0', id, error: { code, message } });
+
+/**
+ * A handler for one parsed JSON-RPC message. Resolves the response, or null
+ * for a notification (a message with no id), which gets none.
+ */
+export const createGitServerHandler = ({
+  root, git = 'git', baseEnv = process.env, run = runReadonlyGit,
+}) => async (message) => {
+  if (!message || typeof message !== 'object' || Array.isArray(message) || typeof message.method !== 'string') {
+    return fail(message?.id ?? null, -32600, 'Invalid Request');
+  }
+  const { id, method, params } = message;
+  if (id === undefined) return null;
+  if (method === 'initialize') {
+    const asked = params?.protocolVersion;
+    return reply(id, {
+      protocolVersion: SUPPORTED_PROTOCOL_VERSIONS.includes(asked) ? asked : SUPPORTED_PROTOCOL_VERSIONS[0],
+      capabilities: { tools: {} },
+      serverInfo: { name: SERVER_NAME, version: SERVER_VERSION },
+    });
+  }
+  if (method === 'ping') return reply(id, {});
+  if (method === 'tools/list') return reply(id, { tools: [GIT_TOOL] });
+  if (method === 'tools/call') {
+    if (params?.name !== TOOL_NAME) return fail(id, -32602, `Unknown tool: ${params?.name}`);
+    const { subcommand, args = [] } = params.arguments || {};
+    const { ok, text } = await run({
+      subcommand, args, root, git, baseEnv,
+    });
+    return reply(id, { content: [{ type: 'text', text }], isError: !ok });
+  }
+  return fail(id, -32601, `Method not found: ${method}`);
+};
+
+/** `--root <dir> --git <binary>`; the root must be an existing directory. */
+export const parseServerArgs = (argv) => {
+  const value = (flag) => {
+    const at = argv.indexOf(flag);
+    return at === -1 ? undefined : argv[at + 1];
+  };
+  const root = value('--root');
+  if (typeof root !== 'string' || !isAbsolute(root)) throw new Error('--root <absolute workspace path> is required');
+  const real = realpathSync(root);
+  if (!statSync(real).isDirectory()) throw new Error(`--root ${root} is not a directory`);
+  return { root: real, git: value('--git') || 'git' };
+};
+
+export const serve = ({
+  root, git, input = process.stdin, output = process.stdout, baseEnv = process.env,
+}) => {
+  const handle = createGitServerHandler({ root, git, baseEnv });
+  // A closed pipe on the client side is the client leaving, not an error.
+  output.on('error', () => {});
+  const lines = createInterface({ input, crlfDelay: Infinity });
+  lines.on('line', async (line) => {
+    if (!line.trim()) return;
+    let message;
+    try {
+      message = JSON.parse(line);
+    } catch {
+      output.write(`${JSON.stringify(fail(null, -32700, 'Parse error'))}\n`);
+      return;
+    }
+    const response = await handle(message);
+    if (response) output.write(`${JSON.stringify(response)}\n`);
+  });
+  return lines;
+};
+
+const runAsMain = () => {
+  try {
+    return Boolean(process.argv[1]) && realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url));
+  } catch {
+    return false;
+  }
+};
+
+if (runAsMain()) {
+  let options;
+  try {
+    options = parseServerArgs(process.argv.slice(2));
+  } catch (err) {
+    process.stderr.write(`${SERVER_NAME}: ${err.message}\n`);
+    process.exit(2);
+  }
+  serve(options);
+}

package/src/lib/git-readonly.js

@@ -0,0 +1,328 @@
+/**
+ * Read-only git for a `workspace`-trust seat (TASK-294).
+ *
+ * A workspace seat may look at the repository it was started in (status, log,
+ * diff, show, blame) and nothing more: no git call it can make may write a
+ * file, run a program, or read outside its workspace. A Bash permission prefix
+ * is not a boundary this relies on, so Bash stays denied to workspace seats
+ * and git never goes through it. Git is one MCP tool (git-readonly-server.js)
+ * whose argv this module builds and runs with execFile, with no shell in
+ * between.
+ *
+ * What holds the line:
+ * 1. The subcommand is one of five builtins. A builtin name never resolves to
+ *    an alias, and the caller's arguments go AFTER it, where git's top-level
+ *    options (`-c`, `-C`, `--git-dir`, `--exec-path`, …) are not parsed.
+ * 2. The arguments are checked against the spellings that write, execute, or
+ *    read a file the caller names (DENIED_LONG_OPTIONS, DENIED_SHORT_OPTIONS,
+ *    DENIED_SHORT_OPTIONS_BY_SUBCOMMAND), including git's accepted
+ *    abbreviations of them (`--outp=`), and against
+ *    paths that leave the workspace.
+ * 3. diff, log and show run with `--no-ext-diff --no-textconv`, and blame with
+ *    `--no-textconv`, so no external diff or conversion program configured for
+ *    the repository runs, and the spellings that would turn them back on are
+ *    refused. log and show also run with `--no-show-signature`, and
+ *    `format.pretty` is forced to `medium`, so nothing runs gpg:
+ *    `--show-signature`, a `%G` placeholder and a configured format alias
+ *    (which can hold one) are refused. `core.fsmonitor` is forced off for the
+ *    same reason: `git status` runs it. What still runs is a clean filter the
+ *    repository's own config defines, when status, diff or blame read a
+ *    working-tree file: without it they report unchanged files as changed. It
+ *    runs inside the sandbox below, and the seat cannot define one. A
+ *    submodule's git runs as a child process that gets none of these flags, so
+ *    `--submodule=diff` is refused, and the settings that would start one are
+ *    forced through `-c`, which does reach it (TOP_LEVEL).
+ * 4. The environment is rebuilt from an allowlist. No inherited GIT_* variable
+ *    survives, system and global config are off, optional locks are off (so
+ *    status never rewrites the index), and GIT_CEILING_DIRECTORIES stops
+ *    repository discovery at the workspace. The only repository git can open
+ *    is one rooted there, so `show HEAD:<path>` cannot reach a file above it.
+ *    No git it runs contacts a remote: lazy fetching is off, so a partial
+ *    clone reports an object it lacks as missing instead of fetching it, and
+ *    no transport is allowed, which covers git older than 2.44, where
+ *    GIT_NO_LAZY_FETCH does nothing.
+ * 5. Outside this module, the seat's sandbox (Seatbelt or bwrap) mounts the
+ *    workspace read-only.
+ * 6. A committed `.env` or `.env.*` stays as far out of reach as the file
+ *    itself, which the sandbox denies at any depth. An argument naming one
+ *    (`.env`, `HEAD:.env`, `:0:sub/.env.local`, `-L1,5:.env`) is refused, and
+ *    status, log, diff and show run with pathspecs excluding them, so no patch,
+ *    pickaxe match or blob id comes from one whatever path or glob the caller
+ *    named. `--follow` takes exactly one path, so it is refused, and so is
+ *    `--full-diff`, which lets pathspecs pick commits and then shows every
+ *    file each one changed. A line range (log and show `-L<range>:<file>`)
+ *    takes no pathspec, so it is taken only as the first argument, in one
+ *    piece, where git cannot read it as another option's value, and its file
+ *    is name-checked. What this cannot stop is `show <blob id>` with an id
+ *    learned somewhere else.
+ */
+import { execFile } from 'child_process';
+import { realpathSync } from 'fs';
+import {
+  dirname, isAbsolute, relative, resolve,
+} from 'path';
+
+export const READONLY_GIT_SUBCOMMANDS = Object.freeze(['status', 'log', 'diff', 'show', 'blame']);
+
+// Long options refused in any position, with what each one does.
+export const DENIED_LONG_OPTIONS = Object.freeze({
+  '--output': 'writes its result to a file',
+  '--ext-diff': 'runs an external diff program',
+  '--textconv': 'runs a configured conversion program',
+  '--no-index': 'compares files outside the repository',
+  '--contents': 'reads a file the caller names',
+  '--ignore-revs-file': 'reads a file the caller names',
+  '--git-dir': 'opens a different repository',
+  '--work-tree': 'opens a different working tree',
+  '--exec-path': 'runs git programs from another directory',
+  '--config-env': 'sets configuration',
+  '--paginate': 'runs a pager',
+  '--show-signature': 'runs gpg to check a signature',
+  '--follow': 'needs exactly one path, and every log here also carries the .env excludes',
+  '--full-diff': 'shows every file a picked commit changed, .env files included',
+});
+
+// Real options that are also prefixes of a denied one. Git takes an exact name
+// over an abbreviation, so these never mean the denied option.
+const EXACT_NAMES_THAT_PREFIX_A_DENIED_ONE = new Set(['--text', '--ignore-rev']);
+
+// Single-letter options refused, with what each one does.
+export const DENIED_SHORT_OPTIONS = Object.freeze({
+  c: 'sets configuration (as a top-level option)',
+  C: 'changes directory (as a top-level option); use --find-copies to detect copies',
+  O: 'reads a file the caller names',
+});
+
+// Letters refused for one subcommand only. log, diff and show read -S as the
+// pickaxe string, but blame reads it as a file of revisions, and prints back a
+// line it cannot parse ("bad graft data: <line>").
+export const DENIED_SHORT_OPTIONS_BY_SUBCOMMAND = Object.freeze({
+  blame: Object.freeze({ S: 'reads a revisions file the caller names' }),
+});
+
+// Short options that carry their value in the same argument (`-n5`, `-U3`,
+// `-Sneedle`, `-Gregex`, `-L1,5:file`, `-M50%`, `-B`). Git hands the rest of
+// the argument to the option as its value, so nothing after the letter can be
+// read as another option.
+const VALUE_SHORT_OPTIONS = new Set(['n', 'U', 'S', 'G', 'L', 'M', 'B']);
+const STATUS_UNTRACKED_MODES = new Set(['-uno', '-unormal', '-uall']);
+
+// Ahead of the caller's arguments, so a configured program never runs.
+const FORCED_OPTIONS = Object.freeze({
+  diff: ['--no-ext-diff', '--no-textconv'],
+  log: ['--no-ext-diff', '--no-textconv', '--no-show-signature'],
+  show: ['--no-ext-diff', '--no-textconv', '--no-show-signature'],
+  status: [],
+  blame: ['--no-textconv'],
+});
+// `format.pretty` is the repository's default format for log and show, and a
+// format can hold a %G placeholder; `medium` is git's own default. The last
+// three reach the child git a submodule runs in, which FORCED_OPTIONS do not:
+// `diff.submodule=diff` would run git diff inside each submodule under that
+// submodule's own config, `status.submoduleSummary` runs git log there, and
+// `log.showSignature` would make that log run gpg.
+const TOP_LEVEL = Object.freeze([
+  '--no-pager', '-c', 'core.fsmonitor=false', '-c', 'format.pretty=medium',
+  '-c', 'diff.submodule=short', '-c', 'status.submoduleSummary=false', '-c', 'log.showSignature=false',
+]);
+
+// A %G placeholder (%G?, %GG, %GS, %GK, %GF, %GP, %GT) runs gpg on each signed
+// commit. A value with no %, no format: and no tformat: is looked up by
+// prefix among the built-in formats and the repository's `pretty.<name>`
+// aliases, and an alias can hold one, so only a built-in name is taken.
+const FORMAT_ARGUMENT = /^--(?:pretty|format)=([\s\S]*)$/;
+const BUILTIN_FORMATS = Object.freeze(['oneline', 'short', 'medium', 'full', 'fuller', 'reference', 'email', 'mboxrd', 'raw']);
+const checkFormat = (arg) => {
+  const match = FORMAT_ARGUMENT.exec(arg);
+  if (!match) return null;
+  const value = match[1];
+  if (value.includes('%G')) return `${arg} is refused: a %G placeholder runs gpg to check a signature`;
+  const userFormat = value === '' || value.startsWith('format:') || value.startsWith('tformat:') || value.includes('%');
+  if (userFormat || BUILTIN_FORMATS.includes(value.toLowerCase())) return null;
+  return `${arg} is refused: name a built-in format (${BUILTIN_FORMATS.join(', ')}) or give format:<placeholders>`;
+};
+
+// Mirrors the names sandbox/seatbelt.js denies at any depth.
+const ENV_FILE_SEGMENT = /^\.env(\..*)?$/;
+const namesEnvFile = (arg) => arg.split(':')
+  .some((part) => part.split('/').some((segment) => ENV_FILE_SEGMENT.test(segment)));
+const NAMES_ENV_FILE = 'it names a .env file, which the workspace keeps out of reach';
+const ENV_EXCLUDES = Object.freeze([
+  ':(exclude,glob)**/.env', ':(exclude,glob)**/.env.*', ':(exclude,glob)**/.env/**', ':(exclude,glob)**/.env.*/**',
+]);
+// blame takes one literal file, so the name check above covers it. A
+// blob-to-blob diff (`diff A:f B:f`) takes no pathspec and is refused by git
+// here; `diff A B -- f` is the same diff. A line range takes none either (see
+// checkLineRange), so its file is name-checked instead.
+const PATHSPEC_SUBCOMMANDS = new Set(['status', 'log', 'diff', 'show']);
+
+// log and show trace a line range (-L<range>:<file>), and git refuses a
+// pathspec with one, so that call runs without the .env excludes. Only a token
+// git is sure to read as -L may turn them off: the first argument, with its
+// range in it. After another argument, git can read it as that option's value;
+// a bare -L takes the next argument as its range, which the name check may
+// read as an option instead. status and diff take no -L at all.
+const LINE_RANGE_SUBCOMMANDS = new Set(['log', 'show']);
+const checkLineRange = (arg, index, subcommand) => {
+  if (!LINE_RANGE_SUBCOMMANDS.has(subcommand)) return `-L is refused for ${subcommand}: only log and show trace a line range`;
+  if (index > 0 || arg.length === 2) {
+    return `${arg} is refused: give one line range, as the first argument and in one piece (-L<start>,<end>:<file>), so git cannot read it as another option's value`;
+  }
+  return null;
+};
+
+const MAX_ARGS = 64;
+const MAX_ARG_LENGTH = 4096;
+export const MAX_OUTPUT_CHARS = 50 * 1024;
+const MAX_BUFFER_BYTES = 4 * 1024 * 1024;
+const DEFAULT_TIMEOUT_MS = 30 * 1000;
+
+const refuse = (reason) => ({ ok: false, reason });
+
+const realOrResolved = (p) => {
+  try {
+    return realpathSync(p);
+  } catch {
+    return resolve(p);
+  }
+};
+
+const escapesRoot = (root, arg) => {
+  const rel = relative(root, resolve(root, arg));
+  return rel === '..' || rel.startsWith('../') || isAbsolute(rel);
+};
+
+const checkLongOption = (arg) => {
+  const name = arg.split('=')[0];
+  if (arg.endsWith('=diff') && name.length >= 3 && '--submodule'.startsWith(name)) {
+    return `${arg} is refused: it runs git diff inside each submodule, where the forced options don't reach; --submodule=log lists the same commits`;
+  }
+  if (Object.prototype.hasOwnProperty.call(DENIED_LONG_OPTIONS, name)) {
+    return `${name} is refused: it ${DENIED_LONG_OPTIONS[name]}`;
+  }
+  if (name.length >= 3 && !EXACT_NAMES_THAT_PREFIX_A_DENIED_ONE.has(name)) {
+    const denied = Object.keys(DENIED_LONG_OPTIONS).find((option) => option.startsWith(name));
+    if (denied) return `${name} is refused: git reads it as ${denied}, which ${DENIED_LONG_OPTIONS[denied]}`;
+  }
+  return null;
+};
+
+const checkShortOption = (arg, subcommand) => {
+  if (/^-\d+$/.test(arg)) return null;
+  const letter = arg[1];
+  if (Object.prototype.hasOwnProperty.call(DENIED_SHORT_OPTIONS, letter)) {
+    return `-${letter} is refused: it ${DENIED_SHORT_OPTIONS[letter]}`;
+  }
+  const deniedHere = DENIED_SHORT_OPTIONS_BY_SUBCOMMAND[subcommand] || {};
+  if (Object.prototype.hasOwnProperty.call(deniedHere, letter)) {
+    return `-${letter} is refused for ${subcommand}: it ${deniedHere[letter]}`;
+  }
+  if (arg.length === 2) return null;
+  if (VALUE_SHORT_OPTIONS.has(letter)) return null;
+  if (subcommand === 'status' && STATUS_UNTRACKED_MODES.has(arg)) return null;
+  return `${arg} is refused: pass each short option as its own argument`;
+};
+
+/**
+ * The argv for one read-only git call, or the reason it is refused.
+ * `root` is the workspace; the caller's paths are checked against it.
+ */
+export const readonlyGitArgv = ({ subcommand, args = [], root }) => {
+  if (!READONLY_GIT_SUBCOMMANDS.includes(subcommand)) {
+    return refuse(`git ${subcommand} is refused: only ${READONLY_GIT_SUBCOMMANDS.join(', ')} are available`);
+  }
+  if (!Array.isArray(args) || args.some((arg) => typeof arg !== 'string')) {
+    return refuse('args must be an array of strings');
+  }
+  if (args.length > MAX_ARGS) return refuse(`at most ${MAX_ARGS} arguments`);
+  if (typeof root !== 'string' || !isAbsolute(root)) return refuse('the workspace is not an absolute path');
+  let pathsOnly = false;
+  let lineRange = false;
+  for (const [index, arg] of args.entries()) {
+    if (arg.length > MAX_ARG_LENGTH || arg.includes('\0')) return refuse('an argument is too long or contains NUL');
+    if (pathsOnly || arg === '-' || !arg.startsWith('-')) {
+      if (escapesRoot(root, arg)) return refuse(`${arg} is refused: it is outside the workspace`);
+      if (namesEnvFile(arg)) return refuse(`${arg} is refused: ${NAMES_ENV_FILE}`);
+    } else if (arg === '--') {
+      pathsOnly = true;
+    } else {
+      const reason = arg.startsWith('--') ? checkLongOption(arg) || checkFormat(arg) : checkShortOption(arg, subcommand);
+      if (reason) return refuse(reason);
+      if (arg.startsWith('-L')) {
+        if (namesEnvFile(arg.slice(2))) return refuse(`${arg} is refused: ${NAMES_ENV_FILE}`);
+        if (PATHSPEC_SUBCOMMANDS.has(subcommand)) {
+          const lineRangeReason = checkLineRange(arg, index, subcommand);
+          if (lineRangeReason) return refuse(lineRangeReason);
+          lineRange = true;
+        }
+      }
+    }
+  }
+  const excludes = PATHSPEC_SUBCOMMANDS.has(subcommand) && !lineRange
+    ? [...(pathsOnly ? [] : ['--']), ...ENV_EXCLUDES]
+    : [];
+  return { ok: true, argv: [...TOP_LEVEL, subcommand, ...FORCED_OPTIONS[subcommand], ...args, ...excludes] };
+};
+
+// What git keeps from the seat's environment. Everything else is dropped,
+// every GIT_* variable included.
+const KEPT_ENV = new Set(['PATH', 'HOME', 'USER', 'LOGNAME', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TMPDIR', 'TZ']);
+
+export const readonlyGitEnv = ({ root, baseEnv = process.env }) => {
+  const env = {};
+  for (const [key, value] of Object.entries(baseEnv || {})) {
+    if (KEPT_ENV.has(key) && typeof value === 'string') env[key] = value;
+  }
+  return {
+    ...env,
+    GIT_CONFIG_NOSYSTEM: '1',
+    GIT_CONFIG_GLOBAL: '/dev/null',
+    GIT_ATTR_NOSYSTEM: '1',
+    GIT_OPTIONAL_LOCKS: '0',
+    GIT_TERMINAL_PROMPT: '0',
+    GIT_NO_LAZY_FETCH: '1',
+    // A name no transport uses, so every protocol is refused.
+    GIT_ALLOW_PROTOCOL: 'none',
+    GIT_PAGER: 'cat',
+    PAGER: 'cat',
+    GIT_CEILING_DIRECTORIES: dirname(realOrResolved(root)),
+  };
+};
+
+const truncate = (text) => (text.length <= MAX_OUTPUT_CHARS
+  ? text
+  : `${text.slice(0, MAX_OUTPUT_CHARS)}\n[output truncated at ${MAX_OUTPUT_CHARS} characters; narrow it with -n, a path, or a revision range]`);
+
+/**
+ * Run one read-only git call in `root`. Resolves `{ ok, text }`; never rejects.
+ * `git` is the binary to run (the adapter resolves it outside the sandbox).
+ */
+export const runReadonlyGit = ({
+  subcommand, args, root, git = 'git', baseEnv = process.env, timeoutMs = DEFAULT_TIMEOUT_MS,
+}) => new Promise((done) => {
+  const checked = readonlyGitArgv({ subcommand, args, root });
+  if (!checked.ok) {
+    done({ ok: false, text: checked.reason });
+    return;
+  }
+  execFile(git, checked.argv, {
+    cwd: root,
+    env: readonlyGitEnv({ root, baseEnv }),
+    timeout: timeoutMs,
+    maxBuffer: MAX_BUFFER_BYTES,
+    encoding: 'utf8',
+    windowsHide: true,
+  }, (error, stdout, stderr) => {
+    const out = String(stdout || '');
+    if (!error) {
+      done({ ok: true, text: truncate(out || '(no output)') });
+      return;
+    }
+    const detail = String(stderr || '').trim() || error.message;
+    done({ ok: false, text: truncate([out.trim(), detail].filter(Boolean).join('\n')) });
+  });
+});
+
+export default {
+  READONLY_GIT_SUBCOMMANDS, DENIED_LONG_OPTIONS, DENIED_SHORT_OPTIONS, readonlyGitArgv, readonlyGitEnv, runReadonlyGit,
+};

package/src/lib/memory-bridge.js

@@ -60,7 +60,7 @@ export const ROW_SLICING_CUE = 'Slicing: when a row is too large for one turn, s
 export const buildMemoryPreamble = (
   prompt,
   memoryLongTerm,
-  { freshSession = false, workCues = [] } = {},
+  { freshSession = false, workCues = [], memoryWithheld = false } = {},
 ) => {
   // `null` is the UNREADABLE signal, and it is deliberately not the same value
   // as `''`. Telling a seat whose token was revoked that "nothing has ever been
@@ -68,7 +68,14 @@ export const buildMemoryPreamble = (
   // defect this cue exists to fix — one state over. When we could not read, say
   // that, and say nothing about what is stored.
   let context;
-  if (memoryLongTerm === null) {
+  if (memoryWithheld) {
+    // A workspace seat's turn that runs public: not unreadable and not empty,
+    // so neither of those cues is true. Its memory tools are off as well.
+    context = `=== Context (your persistent memory) ===\n`
+      + `(withheld this turn — this turn runs as a public seat because not every `
+      + `pod you answer in is confirmed private, so your memory stays out of it and `
+      + `the memory tools are off. This says nothing about what you have saved.)`;
+  } else if (memoryLongTerm === null) {
     context = `=== Context (your persistent memory) ===\n`
       + `(unreadable this turn — the memory read failed, so this says NOTHING `
       + `about what you have saved. Do not treat it as empty and do not re-save `
@@ -96,7 +103,9 @@ export const buildMemoryPreamble = (
     + 'This is a fresh session. Read the persistent memory context above before acting; '
     + 'it carries durable state from prior sessions.\n';
   let sessionEndCue = '=== Before this session ends ===\n';
-  if (memoryLongTerm === null) {
+  if (memoryWithheld) {
+    sessionEndCue += 'Memory is withheld this turn, so there is nothing to save.';
+  } else if (memoryLongTerm === null) {
     sessionEndCue += 'Memory was unreadable on this fresh session. Do not treat it as empty or '
       + 'write a replacement based on this cue.';
   } else if (memoryLongTerm) {