@commonlyai/cli 0.1.180 → 0.1.182

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.180",
+  "version": "0.1.182",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -58,9 +58,12 @@ import {
   environmentForServer,
   normalizeSandboxTrust,
   parseEnvironmentFile,
+  refuseWorkspaceTrust,
   resolveWorkspace,
   validateEnvironmentSpec,
+  WORKSPACE_SANDBOX_ALLOW,
 } from '../lib/environment.js';
+import { firstRunWorkspace, podIsConfirmedPrivate, workspaceTurnPlacement } from '../lib/workspace-trust.js';
 import {
   ADAPTERS_WITH_DEFAULT_MCP,
   ADAPTERS_WITH_GRANT_BROKER,
@@ -297,6 +300,53 @@ export const printAttachRunGuidance = ({
 // a foreground run re-bootstraps from the Connect page's env exports after the
 // local record is removed; a daemon-managed seat is switched through the
 // registry, which the daemon applies on its next pass.
+// `run --allow write,web`: the grants a first-run workspace seat starts with
+// (TASK-294). An unknown name is refused rather than dropped.
+export const parseAllowGrants = (value) => {
+  if (value === undefined || value === null) return [];
+  const requested = String(value).split(',').map((grant) => grant.trim()).filter(Boolean);
+  if (!requested.length || requested.some((grant) => !WORKSPACE_SANDBOX_ALLOW.includes(grant))) {
+    throw new Error(`--allow takes ${WORKSPACE_SANDBOX_ALLOW.join(' and/or ')}, comma-separated `
+      + `(got ${JSON.stringify(String(value))})`);
+  }
+  return WORKSPACE_SANDBOX_ALLOW.filter((grant) => requested.includes(grant));
+};
+
+// Grants are fixed when the token file is written. A later --allow that
+// differs is refused with the way to change them, never applied quietly.
+export const checkRunAllowRequest = ({ record, requested = [] }) => {
+  if (!requested.length) return { ok: true };
+  const savedList = record?.environment?.sandbox?.allow || [];
+  const saved = WORKSPACE_SANDBOX_ALLOW.filter((grant) => savedList.includes(grant));
+  if (saved.join(',') === requested.join(',')) return { ok: true };
+  const name = record.agentName;
+  return {
+    ok: false,
+    message: [
+      `'${name}' was set up with ${saved.length ? `--allow ${saved.join(',')}` : 'no --allow'}; `
+        + `--allow ${requested.join(',')} was not applied.`,
+      `To change it: commonly agent detach ${name} --force, then re-run with the Connect-page `
+        + `env exports and --allow ${requested.join(',')}.`,
+    ].join('\n'),
+  };
+};
+
+// What a first-run workspace seat may do, said once at bootstrap. A write
+// grant hands it Bash, whose commands reach the network, so that line never
+// claims the seat is offline.
+const workspaceGrantLine = (workspacePath, allow) => {
+  const write = allow.includes('write');
+  const web = allow.includes('web');
+  if (!write) {
+    return web
+      ? `this agent can read ${workspacePath}, run read-only git there, and fetch web pages; it cannot edit files.`
+      : `this agent can read ${workspacePath} and run read-only git there; it cannot edit files or reach the web.`;
+  }
+  return `this agent can read and edit files in ${workspacePath} and run commands there`
+    + (web ? ', and fetch web pages' : '')
+    + '. Its commands can reach the network. Its .git stays read-only, so it cannot commit.';
+};
+
 export const checkRunAdapterRequest = ({ record, requestedAdapter, tokenPath }) => {
   const requested = String(requestedAdapter || '').trim().toLowerCase();
   if (!requested) return { ok: true };
@@ -320,6 +370,10 @@ export const bootstrapAgentRecordFromEnv = async ({
   adapterRegistry = { getAdapter, listAdapterNames },
   adapterOverride = null,
   log = () => {},
+  startDir = process.cwd(),
+  home,
+  allow = [],
+  platform = process.platform,
 }) => {
   const runtimeToken = (env.COMMONLY_AGENT_TOKEN || '').trim();
   if (!runtimeToken) return null;
@@ -398,6 +452,28 @@ export const bootstrapAgentRecordFromEnv = async ({
   });
   if (bindingRefusal) throw new Error(bindingRefusal);
 
+  // The daemon's baseline for a seat nobody wrote a spec for, sandbox
+  // included: this record is derived from nothing the person declared.
+  const environment = seatBaseline(buildDefaultEnvironment(adapterName), adapterName, { sandbox: true });
+  // A claude seat whose every pod is confirmed private reads the directory
+  // it was started from (TASK-294); anything else keeps the public default.
+  const workspace = firstRunWorkspace({
+    adapterName, installations: installs, startDir, home, platform,
+  });
+  if (allow.length && !workspace?.workspacePath) {
+    throw new Error(`--allow ${allow.join(',')} applies only to an agent that works in the folder it `
+      + 'starts in, and this one '
+      + (workspace?.reason
+        ? `would read only its scratch folder, because ${workspace.reason}.${workspace.fix ? ` ${workspace.fix}` : ''}`
+        : 'does not.'));
+  }
+  if (workspace?.workspacePath) {
+    log(workspaceGrantLine(workspace.workspacePath, allow));
+  } else if (workspace?.reason) {
+    log(`this agent can read only its own scratch folder, because ${workspace.reason}.`
+      + (workspace.fix ? ` ${workspace.fix}` : ''));
+  }
+
   return {
     agentName,
     displayName: identity?.displayName || primary?.displayName || agentName,
@@ -406,10 +482,10 @@ export const bootstrapAgentRecordFromEnv = async ({
     instanceUrl,
     runtimeToken,
     adapter: adapterName,
-    // The daemon's baseline for a seat nobody wrote a spec for, sandbox
-    // included: this record is derived from nothing the person declared.
-    environment: seatBaseline(buildDefaultEnvironment(adapterName), adapterName, { sandbox: true }),
-    workspacePath: null,
+    environment: workspace?.workspacePath
+      ? { ...environment, sandbox: { trust: 'workspace', ...(allow.length ? { allow } : {}) } }
+      : environment,
+    workspacePath: workspace?.workspacePath || null,
   };
 };
 
@@ -616,6 +692,31 @@ export const assertSandboxDeclaredForPublicPod = async ({
     return;
   }
 
+  // A `workspace` seat lets the room read its start directory (TASK-294), so it
+  // needs the pod CONFIRMED private, not merely not known to be public: a pod
+  // whose visibility cannot be read fails closed here, the way dsh does above.
+  if (environment?.sandbox?.trust === 'workspace') {
+    let pod;
+    try {
+      pod = await client.get(`/api/pods/${podId}`);
+    } catch {
+      throw new Error(
+        'sandbox.trust=workspace requires confirmed private pod visibility before attach, '
+        + 'and this pod\'s visibility could not be read',
+      );
+    }
+    if (podIsConfirmedPrivate(pod)) return;
+    const label = pod?.name ? `"${pod.name}"` : podId;
+    const reported = typeof pod?.publicRead === 'boolean' && typeof pod?.communityListed === 'boolean';
+    let why = 'did not report its visibility';
+    if (reported) why = pod.publicRead || pod.communityListed ? 'is publicly readable' : 'is open to join';
+    throw new Error(
+      `${label} ${why}, so sandbox.trust=workspace would let people you do not control read this `
+      + 'agent\'s start directory. Declare "sandbox": { "trust": "public" } for this pod, or attach '
+      + 'to a private, invite-only pod.',
+    );
+  }
+
   // Normalized FIRST (Vera 71715, Wren 71718): the predicate below reads a
   // legacy `internal` record as the `public` it means, the same mapping the
   // attach gate and both adapters use. Reading it raw refused a record that
@@ -842,11 +943,20 @@ export const resolveAttachSandbox = ({
 } = {}) => {
   const sandbox = normalizeSandboxTrust(environment?.sandbox);
   const trust = sandbox?.trust;
+  // `workspace` is claude-only for now (TASK-294). Refused here with the words
+  // the adapter would use at spawn, so the attach fails before anything is
+  // published rather than at the seat's first turn.
+  if (trust === 'workspace' && adapterName !== 'claude') {
+    refuseWorkspaceTrust(sandbox, adapterName || 'this');
+  }
+  // Both confined trusts take their mode from the host the same way; they
+  // differ in what the policy inside the sandbox allows, not in the sandbox.
+  const confined = trust === 'public' || trust === 'workspace';
   const mode = sandbox?.mode
-    || (trust === 'public' ? resolvePublicSandboxMode(sandbox, platform) : 'none');
-  if (trust === 'public' && mode === 'none') {
+    || (confined ? resolvePublicSandboxMode(sandbox, platform) : 'none');
+  if (confined && mode === 'none') {
     throw new Error(
-      'sandbox.trust=public requires an enforced sandbox mode; refusing to attach unsandboxed',
+      `sandbox.trust=${trust} requires an enforced sandbox mode; refusing to attach unsandboxed`,
     );
   }
   // Moved in from the call site (Vera 71675): this is the check the raw compare
@@ -854,7 +964,7 @@ export const resolveAttachSandbox = ({
   // pure — a mode and an adapter name — so it belongs with the derivation, and
   // its witnesses live beside it.
   if ((mode === 'workspace' || mode === 'read-only')
-    && (trust !== 'public' || !ADAPTERS_WITH_DEFAULT_SANDBOX.has(adapterName))) {
+    && (!confined || !ADAPTERS_WITH_DEFAULT_SANDBOX.has(adapterName))) {
     throw new Error(
       `sandbox.mode=${mode} requires public trust and an adapter with sandbox enforcement`,
     );
@@ -1438,8 +1548,42 @@ export const performRun = ({
   // as binary-not-found — so we ensure it up front to avoid the confusing
   // diagnostic. ADR-008: when an environment spec was attached, the resolved
   // workspace path replaces the /tmp default.
-  const agentCwd = workspacePath || join(tmpdir(), 'commonly-agents', agentName);
+  const scratchCwd = join(tmpdir(), 'commonly-agents', agentName);
+  const agentCwd = workspacePath || scratchCwd;
   if (!existsSync(agentCwd)) mkdirSync(agentCwd, { recursive: true });
+  // TASK-294: a pod can turn public after attach, so a workspace seat re-reads
+  // its pods before every turn, and a turn it cannot confirm (a failed read
+  // included) runs as a public seat in the scratch folder. The session is
+  // bound to where and as what the turn runs, so a public turn never resumes
+  // a conversation that read the workspace, whatever claude's resume would
+  // find from another folder.
+  let lastPlacementReason = null;
+  const placeTurn = async () => {
+    if (seatEnvironment?.sandbox?.trust !== 'workspace') {
+      return { environment: seatEnvironment, cwd: agentCwd, binding: sessionBinding };
+    }
+    let installations = null;
+    try {
+      const identity = await client.get('/api/agents/runtime/installations', {}, {
+        signal: AbortSignal.timeout(5000),
+      });
+      installations = Array.isArray(identity?.installations) ? identity.installations : [];
+    } catch {
+      installations = null;
+    }
+    const placement = workspaceTurnPlacement({
+      environment: seatEnvironment, workspacePath: agentCwd, installations, scratchDir: scratchCwd,
+    });
+    if (placement.reason !== lastPlacementReason) {
+      log(placement.reason
+        ? `this turn runs as a public seat in ${scratchCwd}, because ${placement.reason}`
+        : `every pod is confirmed private again; turns read ${agentCwd}`);
+      lastPlacementReason = placement.reason;
+    }
+    if (!existsSync(placement.cwd)) mkdirSync(placement.cwd, { recursive: true });
+    const where = `${placement.environment.sandbox.trust}:${placement.cwd}`;
+    return { ...placement, binding: sessionBinding ? `${sessionBinding}:${where}` : where };
+  };
   const batchLimit = Math.min(50, Math.max(1, Number(inboxBatchLimit) || 10));
 
   const processEvent = async (event) => {
@@ -1690,11 +1834,12 @@ export const performRun = ({
   const runTurn = async ({
     event, eventPodId, prompt, preSpawnIds, snapshotMessages, claimKeeper, trigger,
   }) => {
+    const placement = await placeTurn();
     // TASK-440: a cold, large session starts fresh at wake instead of being
     // resumed. The restart note leads the prompt; memory still reaches the
     // fresh session through the adapter's preamble.
-    const sessionEntry = getSessionEntry(agentName, eventPodId, { binding: sessionBinding });
-    let sessionId = getSession(agentName, eventPodId, { binding: sessionBinding });
+    const sessionEntry = getSessionEntry(agentName, eventPodId, { binding: placement.binding });
+    let sessionId = getSession(agentName, eventPodId, { binding: placement.binding });
     let recycleBriefing = null;
     if (sessionId && shouldStartFreshSession({
       lastTurn: sessionEntry?.lastTurn,
@@ -1711,8 +1856,13 @@ export const performRun = ({
       sessionId = null;
     }
     // ADR-005 §Memory bridge: read long_term before spawn, inject via ctx,
-    // and (if the adapter returns a summary) patch-sync back after.
-    const memoryLongTerm = await readLongTerm(client, { onError });
+    // and (if the adapter returns a summary) patch-sync back after. A workspace
+    // seat's turn that runs public (placement.reason) gets none of it: its
+    // memory may hold what earlier turns read in the project, and what this
+    // turn reads in an unconfirmed room must not reach the next workspace turn.
+    // The adapter also denies the memory tools for it (memoryWithheld).
+    const memoryWithheld = Boolean(placement.reason);
+    const memoryLongTerm = memoryWithheld ? undefined : await readLongTerm(client, { onError });
 
     // Sharpen TASK-129: focus is a turn-start read, not an enqueue-time
     // snapshot. Read through the authorized runtime context route immediately
@@ -1856,7 +2006,7 @@ export const performRun = ({
       // only for tests and has no commit-making child process.
       if (adapter?.name !== 'stub') {
         commitAttribution = prepareCommitAttribution({
-          cwd: agentCwd,
+          cwd: placement.cwd,
           env: process.env,
           agentName,
           displayName,
@@ -1886,11 +2036,13 @@ export const performRun = ({
         providerKey,
         timeoutMs: effectiveTurnTimeoutMs,
         sessionId,
-        cwd: agentCwd,
+        cwd: placement.cwd,
+        skillMountDir: scratchCwd,
         env: commitAttribution?.env || process.env,
         commitAttributionEnv: commitAttribution?.sandboxEnv || null,
         memoryLongTerm,
-        environment: seatEnvironment,
+        memoryWithheld,
+        environment: placement.environment,
         onSkillsLinked: ({ mounted, conflicted }) => {
           skillMount = {
             mounted: [...new Set([...serverSkills.mounted, ...mounted.map(reportedSkillName)])],
@@ -1934,7 +2086,7 @@ export const performRun = ({
       // wake can decide whether to recycle. Adapters that report nothing keep
       // resuming.
       setSession(agentName, eventPodId, result.newSessionId, {
-        binding: sessionBinding,
+        binding: placement.binding,
         contextTokens: result.contextTokens ?? null,
       });
     }
@@ -2157,7 +2309,7 @@ export const performRun = ({
         );
       }
     }
-    if (result.memorySummary) {
+    if (result.memorySummary && !memoryWithheld) {
       try {
         await syncBack(client, { summary: result.memorySummary });
         log(`[${event.type}] memory synced (${Buffer.byteLength(result.memorySummary)} bytes)`);
@@ -3708,7 +3860,15 @@ Docs:
     .option('--cascade-grace <n>', `Extra turns allowed when this seat was directly addressed; 0 disables the grace (env ${CASCADE_ENV_VARS.addressedGrace}, default ${CASCADE_DEFAULTS.addressedGrace})`)
     .option('--cascade-reset <ms>', `Silence window that clears the streak (env ${CASCADE_ENV_VARS.resetMs}, default ${CASCADE_DEFAULTS.resetMs})`)
     .option('--refusal-handoff <agent>', 'Agent to @mention when the model provider refuses a request\'s content; the request is acked as refused, never retried')
+    .option('--allow <grants>', 'On first run of an agent that works in its folder, also let it edit files and run commands (write) and/or fetch web pages (web), comma-separated. Commands reach the network.')
     .action(async (name, opts) => {
+      let allow;
+      try {
+        allow = parseAllowGrants(opts.allow);
+      } catch (err) {
+        console.error(`${stamp()} [${name}] ${err.message}`);
+        process.exit(1);
+      }
       let record = loadAgentToken(name);
       let bootstrapped = false;
       if (!record) {
@@ -3719,6 +3879,7 @@ Docs:
             name,
             adapterOverride: opts.adapter || null,
             log: (line) => console.log(`${stamp()} [${name}] ${line}`),
+            allow,
           });
         } catch (err) {
           console.error(`${stamp()} [${name}] ${err.message}`);
@@ -3758,6 +3919,11 @@ Docs:
         );
       }
 
+      const allowRequest = checkRunAllowRequest({ record, requested: allow });
+      if (!allowRequest.ok) {
+        console.error(`${stamp()} [${name}] ${allowRequest.message}`);
+        process.exit(1);
+      }
       const adapterRequest = checkRunAdapterRequest({
         record, requestedAdapter: opts.adapter, tokenPath: tokenFile(name),
       });

package/src/lib/adapters/claude.js

@@ -63,7 +63,10 @@ import {
   writeFile,
 } from 'fs/promises';
 import { homedir, tmpdir } from 'os';
-import { delimiter, isAbsolute, join } from 'path';
+import {
+  delimiter, dirname, isAbsolute, join,
+} from 'path';
+import { fileURLToPath } from 'url';
 
 import {
   isLegacySandboxTrust,
@@ -135,6 +138,65 @@ const PUBLIC_DENIED_TOOLS = [
   'NotebookEdit',
   'Task',
 ];
+// TASK-294: a workspace seat is confined as a public one is, except that its
+// folder is the person's project, which the jail holds read-only unless the
+// seat was granted write, and whose .git it holds read-only either way.
+const isConfinedTrust = (trust) => trust === 'public' || trust === 'workspace';
+// What each `sandbox.allow` grant moves out of the denies. `web` grants
+// WebFetch alone: WebSearch, NotebookEdit and Task stay denied at every tier.
+// Bash and Write land wherever the jail lets them, so the jail, not this list,
+// bounds a write.
+const WORKSPACE_ALLOW_TOOLS = {
+  write: ['Edit', 'Write', 'Bash'],
+  web: ['WebFetch'],
+};
+// The grants a seat's environment carries. They widen the workspace tier
+// only, so any other trust gets none, whatever its record says.
+const workspaceGrants = (sandbox) => (
+  sandbox?.trust === 'workspace' && Array.isArray(sandbox.allow) ? sandbox.allow : []
+);
+// A workspace seat reads its project's history through one read-only git tool
+// (git-readonly-server.js). The server runs inside the jail, so the jail must
+// admit its code (cli/src/lib, plus package.json for the module type) and the
+// git binary it runs.
+const WORKSPACE_GIT_SERVER = fileURLToPath(new URL('../git-readonly-server.js', import.meta.url));
+const WORKSPACE_GIT_PACKAGE_JSON = fileURLToPath(new URL('../../../package.json', import.meta.url));
+// macOS's /usr/bin/git is an xcrun shim, and it fails inside Seatbelt ("No
+// developer tools were found"). So the jail gets the binary git itself runs:
+// `git --exec-path`, resolved here on the host, holds a `git` that links to it.
+const resolveRealGit = () => {
+  const result = spawnSync('git', ['--exec-path'], { encoding: 'utf8', timeout: 5000 });
+  const execDir = result?.status === 0 ? String(result.stdout || '').trim() : '';
+  if (!execDir) return null;
+  try {
+    return realpathSync(join(execDir, 'git'));
+  } catch {
+    return null;
+  }
+};
+const withWorkspaceGit = (ctx) => {
+  if (ctx.environment?.sandbox?.trust !== 'workspace' || !ctx.cwd) return ctx;
+  const git = resolveRealGit();
+  if (!git) {
+    // eslint-disable-next-line no-console
+    console.warn('[claude] git was not found on this machine, so this workspace seat has no git tool');
+    return ctx;
+  }
+  const server = {
+    name: 'workspace_git',
+    transport: 'stdio',
+    command: [process.execPath, WORKSPACE_GIT_SERVER, '--root', ctx.cwd, '--git', git],
+  };
+  return {
+    ...ctx,
+    environment: { ...ctx.environment, mcp: [...(ctx.environment.mcp || []), server] },
+    workspaceGit: {
+      executable: git,
+      readDirectories: [dirname(WORKSPACE_GIT_SERVER)],
+      readPaths: [WORKSPACE_GIT_PACKAGE_JSON],
+    },
+  };
+};
 const PUBLIC_SAFE_ENV = /^(?:PATH|LANG|LC_[A-Z_]+|TERM|USER|LOGNAME|NO_COLOR|CI|SSL_CERT_FILE|SSL_CERT_DIR)$/;
 
 const statOrNull = async (path) => {
@@ -248,8 +310,13 @@ const buildClaudeEnv = (input, state, expansionEnv = {}, credentialFile = null,
 
 const absoluteToolDeny = (path) => `Read(/${path}/**)`;
 
-const buildPublicClaudePolicyArgs = (mcpToolPatterns) => {
+// The tools that read or write the seat's agent-wide memory.
+const MEMORY_TOOLS = Object.freeze(['commonly_read_agent_memory', 'commonly_write_agent_memory', 'commonly_save_my_memory']);
+
+const buildPublicClaudePolicyArgs = (mcpToolPatterns, { trust, allow = [], memoryWithheld = false } = {}) => {
   const home = homedir();
+  // `allow` is already narrowed to a workspace seat's grants (workspaceGrants).
+  const granted = allow.flatMap((grant) => WORKSPACE_ALLOW_TOOLS[grant] || []);
   const deniedReads = [
     absoluteToolDeny(join(home, '.commonly')),
     absoluteToolDeny(join(home, '.claude')),
@@ -262,6 +329,26 @@ const buildPublicClaudePolicyArgs = (mcpToolPatterns) => {
     'Read(./.codex/**)',
     'Read(./.env)',
   ];
+  // A workspace seat reads a real project, so every .env variant at any depth,
+  // and what a .env directory holds, stays out of reach (the jail holds the
+  // same line). .git is denied too: its config can carry a remote URL with a
+  // token in it, and history comes through the read-only git tool, which runs
+  // in its own process. And the seat cannot install itself into a room partway
+  // through a turn: the per-turn check confirmed its pods private before the
+  // spawn.
+  const workspaceDenies = trust === 'workspace'
+    ? [
+      'Read(./.env.*)', 'Read(./**/.env)', 'Read(./**/.env.*)',
+      'Read(./.env/**)', 'Read(./**/.env/**)', 'Read(./**/.env.*/**)',
+      'Read(./.git/**)', 'Read(./**/.git/**)',
+      ...mcpToolPatterns.map((pattern) => pattern.replace(/\*$/, 'commonly_self_install_into_pod')),
+    ]
+    : [];
+  // A workspace seat's turn that runs public gets no memory in its prompt
+  // (agent.js), and no tool that would read or write it either.
+  const memoryDenies = memoryWithheld
+    ? MEMORY_TOOLS.flatMap((tool) => mcpToolPatterns.map((pattern) => pattern.replace(/\*$/, tool)))
+    : [];
   return [
     // HOME points at an isolated, sanitized state directory. Ignore settings
     // from user/project/local sources and disable slash-command extensions;
@@ -271,8 +358,9 @@ const buildPublicClaudePolicyArgs = (mcpToolPatterns) => {
     '--strict-mcp-config',
     '--no-chrome',
     '--permission-mode', 'dontAsk',
-    '--allowedTools', 'Read(./**)', ...mcpToolPatterns,
-    '--disallowedTools', ...PUBLIC_DENIED_TOOLS, ...deniedReads,
+    '--allowedTools', 'Read(./**)', ...granted, ...mcpToolPatterns,
+    '--disallowedTools', ...PUBLIC_DENIED_TOOLS.filter((tool) => !granted.includes(tool)),
+    ...deniedReads, ...workspaceDenies, ...memoryDenies,
   ];
 };
 
@@ -636,7 +724,8 @@ const prepareArgv = async (innerArgv, ctx) => {
 
   const sandboxTrust = env.sandbox?.trust;
   const sandboxMode = resolvePublicSandboxMode(env.sandbox);
-  const publicNativeSandbox = sandboxTrust === 'public'
+  const grants = workspaceGrants(env.sandbox);
+  const publicNativeSandbox = isConfinedTrust(sandboxTrust)
     && PUBLIC_SANDBOX_MODES.has(sandboxMode);
   // A public trust is ONE contract on both platforms: the jail bounds the
   // filesystem and the policy bounds the tools. The bwrap branch below used to
@@ -665,9 +754,15 @@ const prepareArgv = async (innerArgv, ctx) => {
   // non-string) used to fall through to the bare `claude` spawn below — an
   // unconfined seat with a public record, which is how a record can claim
   // confinement it never applies (Vera 69548).
-  if (sandboxTrust === 'public' && !publicNativeSandbox && sandboxMode !== 'bwrap') {
+  // bwrap points the child's HOME at its folder (childHome below), so a
+  // workspace seat's transcripts would be written into the person's project.
+  if (sandboxTrust === 'workspace' && sandboxMode === 'bwrap') {
+    throw new Error('workspace Claude agents run on macOS only for now: under bwrap '
+      + 'their transcripts would be written into the project folder');
+  }
+  if (isConfinedTrust(sandboxTrust) && !publicNativeSandbox && sandboxMode !== 'bwrap') {
     throw new Error(
-      'public Claude agents require an enforced sandbox mode '
+      `${sandboxTrust} Claude agents require an enforced sandbox mode `
       + `(workspace or read-only on macOS, bwrap elsewhere), got ${JSON.stringify(sandboxMode)}`,
     );
   }
@@ -683,7 +778,9 @@ const prepareArgv = async (innerArgv, ctx) => {
     }
     innerArgv = [
       ...innerArgv,
-      ...buildPublicClaudePolicyArgs(allowedPatterns),
+      ...buildPublicClaudePolicyArgs(allowedPatterns, {
+        trust: sandboxTrust, allow: grants, memoryWithheld: ctx.memoryWithheld === true,
+      }),
       ...(ctx.publicSkillArgs || []),
     ];
     const claudeBin = resolveClaudePath(claudeEnv);
@@ -695,13 +792,24 @@ const prepareArgv = async (innerArgv, ctx) => {
       .filter((command) => typeof command === 'string' && isAbsolute(command));
     const wrapped = wrapArgvWithSeatbelt([claudeBin, ...innerArgv], {
       workspacePath: ctx.cwd,
-      workspaceAccess: sandboxMode === 'read-only' ? 'read' : 'write',
+      workspaceAccess: sandboxMode === 'read-only'
+        || (sandboxTrust === 'workspace' && !grants.includes('write')) ? 'read' : 'write',
+      readOnlyWorkspaceEntries: sandboxTrust === 'workspace' ? ['.git'] : [],
       executablePath: claudeBin,
       statePath: ctx.publicClaudeState.statePath,
       mcpConfigDir: ctx.mcpConfigDir,
-      executablePaths: [...mcpExecutables, ...commitHookExecutables, ...originalHookExecutables],
+      executablePaths: [
+        ...mcpExecutables,
+        ...(ctx.workspaceGit ? [ctx.workspaceGit.executable] : []),
+        ...commitHookExecutables,
+        ...originalHookExecutables,
+      ],
       allowClaudeRuntimeAccess: true,
-      readOnlyDirectories: ctx.mcpReadDirectories || [],
+      readOnlyDirectories: [
+        ...(ctx.mcpReadDirectories || []),
+        ...(ctx.workspaceGit?.readDirectories || []),
+      ],
+      readOnlyPaths: ctx.workspaceGit?.readPaths || [],
     });
     return {
       cmd: wrapped[0],
@@ -721,7 +829,7 @@ const prepareArgv = async (innerArgv, ctx) => {
     }
     innerArgv = [
       ...innerArgv,
-      ...buildPublicClaudePolicyArgs(allowedPatterns),
+      ...buildPublicClaudePolicyArgs(allowedPatterns, { memoryWithheld: ctx.memoryWithheld === true }),
       ...(ctx.publicSkillArgs || []),
     ];
   } else if (allowedPatterns.length > 0) {
@@ -788,13 +896,13 @@ export default {
     // one declaration is exactly how this seat crashed with "public Claude
     // state was not prepared" instead of spawning confined.
     const ctx = rawCtx.environment
-      ? {
+      ? withWorkspaceGit({
         ...rawCtx,
         environment: {
           ...rawCtx.environment,
           sandbox: normalizeSandboxTrust(rawCtx.environment.sandbox),
         },
-      }
+      })
       : rawCtx;
     if (isLegacySandboxTrust(rawCtx.environment?.sandbox)) {
       // eslint-disable-next-line no-console
@@ -812,11 +920,12 @@ export default {
     // the only two paths that build a real prompt. buildPrompt handles
     // undefined and '' as absence itself; it does not need a guard, it needs
     // the value.
-    const publicTrust = ctx.environment?.sandbox?.trust === 'public';
+    const publicTrust = isConfinedTrust(ctx.environment?.sandbox?.trust);
     const workCues = publicTrust ? [] : WORK_CUES;
     const fullPrompt = buildPrompt(prompt, ctx.memoryLongTerm, {
       freshSession: !isResume,
       workCues,
+      memoryWithheld: ctx.memoryWithheld === true,
     });
     const sessionFlag = isResume ? '--resume' : '--session-id';
     // Model pin from the ADR-008 environment spec. Absent it, claude picks its
@@ -842,8 +951,12 @@ export default {
 
     let mountedSkills = [];
     let skillMount = { mounted: [], conflicted: [] };
-    if (ctx.environment && ctx.cwd) {
-      const skills = await mountSkills(ctx.environment, ctx.cwd);
+    // A workspace seat's folder is the person's project, and mountSkills writes
+    // from this host process, outside any jail. Its skills are copied to the
+    // run loop's scratch folder instead and reach it as prompt text.
+    const skillDir = ctx.environment?.sandbox?.trust === 'workspace' ? ctx.skillMountDir : ctx.cwd;
+    if (ctx.environment && skillDir) {
+      const skills = await mountSkills(ctx.environment, skillDir);
       mountedSkills = skills.mounted;
       skillMount = skills;
       if (skills.conflicted.length > 0) {
@@ -948,6 +1061,7 @@ export default {
         const freshPrompt = buildPrompt(prompt, ctx.memoryLongTerm, {
           freshSession: true,
           workCues,
+          memoryWithheld: ctx.memoryWithheld === true,
         });
         const retryBase = ['-p', freshPrompt,
         '--output-format', 'text', '--session-id', freshId, ...modelArgs];

package/src/lib/adapters/codex.js

@@ -69,7 +69,7 @@ import { deliverSeatCredential, withholdRuntimeCredential } from '../mcp-credent
 import { prepareMcpSpawn, publicMcpUnavailableError, selectedMcpVersionDir } from '../mcp-home.js';
 import { buildMemoryPreamble, ROW_SLICING_CUE } from '../memory-bridge.js';
 import { resolveSkillSource, skillsAsText } from '../skill-prompt.js';
-import { isLegacySandboxTrust, normalizeSandboxTrust } from '../environment.js';
+import { isLegacySandboxTrust, normalizeSandboxTrust, refuseWorkspaceTrust } from '../environment.js';
 import { adapterFailure, spawnCredentials } from '../upstream-refusal.js';
 
 // Default timeout for a single codex spawn (exec mode).
@@ -653,6 +653,7 @@ export default {
   async spawn(prompt, ctx = {}) {
     const seatModel = requireSeatModel(ctx.environment, 'codex');
     const sandbox = normalizeSandboxTrust(ctx.environment?.sandbox);
+    refuseWorkspaceTrust(sandbox, 'codex');
     // Passed through UNCOALESCED. `ctx.memoryLongTerm || ''` was here, and
     // `null || ''` is `''` — which routed the unreadable case straight into
     // the empty-memory branch and made the whole distinction unreachable from

package/src/lib/adapters/dsh.js

@@ -9,7 +9,7 @@ import { homedir, tmpdir } from 'os';
 import { basename, join } from 'path';
 import { buildMemoryPreamble } from '../memory-bridge.js';
 import { commonlyMcpServer } from '../default-environment.js';
-import { effectiveSandboxTrust, validateEnvironmentSpec } from '../environment.js';
+import { effectiveSandboxTrust, refuseWorkspaceTrust, validateEnvironmentSpec } from '../environment.js';
 import { deliverSeatCredential } from '../mcp-credential-delivery.js';
 import { describeMcpCommand } from '../mcp-server-version.js';
 import { writeCredentialFile } from '../credential-file.js';
@@ -23,6 +23,7 @@ const SAFE_ENV = /^(?:PATH|LANG|LC_[A-Z_]+|TERM|USER|LOGNAME|NO_COLOR|CI|SSL_CER
 
 export const assertPrivateDsh = (environment = {}) => {
   const sandbox = environment?.sandbox || {};
+  refuseWorkspaceTrust(sandbox, 'dsh');
   if (effectiveSandboxTrust(sandbox.trust) === 'public') {
     throw new Error('dsh adapter: public-trust seats are not supported; nested Seatbelt fails closed');
   }

package/src/lib/adapters/goose.js

@@ -6,7 +6,7 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { StringDecoder } from 'node:string_decoder';
 import { buildMemoryPreamble } from '../memory-bridge.js';
-import { effectiveSandboxTrust, validateEnvironmentSpec } from '../environment.js';
+import { effectiveSandboxTrust, refuseWorkspaceTrust, validateEnvironmentSpec } from '../environment.js';
 import { writeCredentialFile } from '../credential-file.js';
 import { deliverSeatCredential, withholdRuntimeCredential } from '../mcp-credential-delivery.js';
 import { prepareMcpSpawn } from '../mcp-home.js';
@@ -24,6 +24,7 @@ const SAFE_ENV = /^(?:PATH|LANG|LC_[A-Z_]+|TERM|USER|LOGNAME|NO_COLOR|CI|SSL_CER
 
 export const assertNoSandboxDeclared = (environment = {}) => {
   const sandbox = environment?.sandbox || {};
+  refuseWorkspaceTrust(sandbox, 'goose');
   if (effectiveSandboxTrust(sandbox.trust) === 'public') {
     throw new Error('goose adapter: public-trust seats are not supported until the deny-by-default attack test passes');
   }