@commonlyai/cli 0.1.185 → 0.1.186

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.185",
+  "version": "0.1.186",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -1563,13 +1563,15 @@ export const performRun = ({
       return { environment: seatEnvironment, cwd: agentCwd, binding: sessionBinding };
     }
     let installations = null;
+    let readError = null;
     try {
       const identity = await client.get('/api/agents/runtime/installations', {}, {
         signal: AbortSignal.timeout(5000),
       });
       installations = Array.isArray(identity?.installations) ? identity.installations : [];
-    } catch {
+    } catch (err) {
       installations = null;
+      readError = err;
     }
     const placement = workspaceTurnPlacement({
       environment: seatEnvironment, workspacePath: agentCwd, installations, scratchDir: scratchCwd,
@@ -1582,7 +1584,7 @@ export const performRun = ({
     }
     if (!existsSync(placement.cwd)) mkdirSync(placement.cwd, { recursive: true });
     const where = `${placement.environment.sandbox.trust}:${placement.cwd}`;
-    return { ...placement, binding: sessionBinding ? `${sessionBinding}:${where}` : where };
+    return { ...placement, readError, binding: sessionBinding ? `${sessionBinding}:${where}` : where };
   };
   const batchLimit = Math.min(50, Math.max(1, Number(inboxBatchLimit) || 10));
 
@@ -1835,6 +1837,33 @@ export const performRun = ({
     event, eventPodId, prompt, preSpawnIds, snapshotMessages, claimKeeper, trigger,
   }) => {
     const placement = await placeTurn();
+    // A workspace turn placed public (its pod turned public, or its pods could
+    // not be read) is confined as a public seat, which this host may not be
+    // able to do: Claude Code on Linux has only the workspace jail. Refuse it
+    // as the run start would, before anything is read or spawned. The model
+    // never runs and nothing is posted. A public pod is a settled answer, so a
+    // human's message is handed to another listener (claim-outcome.js). A
+    // failed read is not: it throws, so the event stays unacked and comes back
+    // through the spawn-retry backoff instead of being refused for good.
+    if (placement.reason) {
+      const turnRefusal = hostSandboxRefusal({ environment: placement.environment, adapterName: adapter.name });
+      if (turnRefusal && placement.readError) {
+        throw Object.assign(
+          new Error(`turn deferred, because its pods could not be read: ${placement.readError.message}`, {
+            cause: placement.readError,
+          }),
+          { status: placement.readError.status },
+        );
+      }
+      if (turnRefusal) {
+        log(`turn refused, because ${placement.reason}: ${turnRefusal.replace(/\n\s*/g, ' ')}`);
+        return {
+          outcome: 'no_action',
+          refused: { reason: 'delivery-refused' },
+          reason: 'host-cannot-confine-turn',
+        };
+      }
+    }
     // TASK-440: a cold, large session starts fresh at wake instead of being
     // resumed. The restart note leads the prompt; memory still reaches the
     // fresh session through the adapter's preamble.

package/src/lib/adapters/claude.js

@@ -788,6 +788,25 @@ const resolveClaudePath = (env = process.env) => {
   return 'claude';
 };
 
+// Where the claude this host would run is installed: the folder the Linux
+// workspace jail has to bind, since it binds the system binary folders only.
+// Null when the binary cannot be located (a bare name, a dangling link).
+const resolveClaudeInstall = (env) => {
+  const claudeBin = resolveClaudePath(env);
+  if (!isAbsolute(claudeBin)) return { claudeBin, claudeInstall: null };
+  try {
+    return { claudeBin, claudeInstall: dirname(realpathSync(claudeBin)) };
+  } catch {
+    return { claudeBin, claudeInstall: null };
+  }
+};
+
+// A jail that cannot carry claude would fail inside at every spawn.
+const claudeInstallRefusal = (claudeBin) => new Error(
+  'workspace Claude agents on Linux need Claude Code on PATH, so the sandbox can carry its install; '
+  + `\`${claudeBin}\` could not be resolved`,
+);
+
 const prepareArgv = async (innerArgv, ctx) => {
   const env = ctx.environment;
   const claudeEnv = withClaudePath(ctx.claudeEnv);
@@ -941,12 +960,9 @@ const prepareArgv = async (innerArgv, ctx) => {
           + `repository (run \`git init\` in ${ctx.cwd}), so its .git can be held read-only`);
       }
     }
-    const claudeBin = resolveClaudePath(claudeEnv);
+    const { claudeBin, claudeInstall } = resolveClaudeInstall(claudeEnv);
+    if (!claudeInstall) throw claudeInstallRefusal(claudeBin);
     const { statePath } = ctx.publicClaudeState;
-    let claudeInstall = null;
-    try {
-      claudeInstall = dirname(realpathSync(claudeBin));
-    } catch { /* an unresolvable binary fails at spawn with its own error */ }
     const wrapped = wrapArgvWithBwrap([claudeBin, ...innerArgv], env, {
       workspacePath: ctx.cwd,
       workspaceReadOnly: !grants.includes('write'),
@@ -1125,6 +1141,8 @@ export default {
         // jail never gets a copy of the login.
         const bwrap = (ctx._detectBwrap || detectBwrap)();
         if (!bwrap.available) throw new Error(`workspace Claude agents require bwrap: ${bwrap.error}`);
+        const { claudeBin, claudeInstall } = resolveClaudeInstall(withClaudePath(ctx.env));
+        if (!claudeInstall) throw claudeInstallRefusal(claudeBin);
         publicClaudeState = await prepareWorkspaceBwrapClaudeState(ctx);
       }
       if (publicTrust) {

package/src/lib/sandbox/host-check.js

@@ -46,15 +46,17 @@ export const windowsSandboxMessage = (adapterName) => {
 };
 
 /**
- * Claude Code on Linux (WSL included). The bubblewrap namespace binds the
- * system binary folders only, and Claude Code installs under the person's
- * home or /usr/local, so a confined spawn could not even start it; its login
- * and settings live under that home too (Ubuntu run, 2026-10-16). Until the
- * namespace carries what Claude needs, the seat stops here with its options.
+ * Claude Code on Linux (WSL included) for any seat but a workspace one. Only
+ * the workspace jail (#2784) carries what Claude needs: its install, a HOME
+ * of its own and a copy of the login. The public jail binds the system binary
+ * folders only, so a confined spawn could not even start Claude (Ubuntu run,
+ * 2026-10-16), and giving it the login would hand strangers a jail that holds
+ * it. A workspace seat needs every pod it answers in to be invite-only.
  */
 export const linuxClaudeMessage = () => [
-  'Commonly runs a connected Claude Code inside a sandbox, and on Linux (WSL included) that sandbox',
-  'cannot run Claude Code yet, so this agent cannot listen for @mentions here. Instead:',
+  'Commonly runs a connected Claude Code inside a sandbox. On Linux (WSL included) it does that only',
+  'for an agent whose pods are all invite-only, and this one is not, so it cannot listen for @mentions here. Instead:',
+  '  - From an invite-only pod: run the commands its Connect page shows, from your project\'s folder.',
   '  - Use Commonly from your own Claude Code sessions: the Connect page shows a `claude mcp add` command.',
   HOSTED_LINE,
 ].join('\n');
@@ -76,7 +78,11 @@ export const hostSandboxRefusal = ({
   if (mode !== 'bwrap' && !SEATBELT_MODES.has(mode)) return null;
 
   if (platform === 'win32') return windowsSandboxMessage(adapterName);
-  if (mode === 'bwrap' && adapterName === 'claude') return linuxClaudeMessage();
+  // A workspace claude seat falls through to the bubblewrap probe below; the
+  // probe failing, for any reason, is a refusal like any other adapter's.
+  if (mode === 'bwrap' && adapterName === 'claude' && sandbox.trust !== 'workspace') {
+    return linuxClaudeMessage();
+  }
   if (mode === 'bwrap') {
     const bwrap = detectBwrap();
     return bwrap.available ? null : `This seat runs in a bubblewrap sandbox, which is not available here. ${bwrap.error}`;

package/src/lib/workspace-trust.js

@@ -73,9 +73,10 @@ export const workspaceStartDirRefusal = (dir, { home = homedir() } = {}) => {
 };
 
 const PUBLIC_POD_REASON = 'a pod it answers in is publicly readable or open to join, or did not report whether it is';
-// claude.js refuses a workspace seat under bwrap, so off macOS the default
+// claude.js runs a workspace seat under Seatbelt on macOS and under bwrap on
+// Linux (#2784). Native Windows has no sandbox for it, so there the default
 // would be a seat that fails every turn rather than one that reads a project.
-const NOT_MACOS_REASON = 'an agent works in its folder only on macOS for now';
+const UNSUPPORTED_OS_REASON = 'an agent works in its folder only on macOS and Linux for now';
 
 /**
  * Where a first-run claude seat may read (TASK-294), from three facts the
@@ -90,7 +91,9 @@ export const firstRunWorkspace = ({
   adapterName, installations, startDir, home, platform = process.platform,
 } = {}) => {
   if (adapterName !== 'claude') return null;
-  if (platform !== 'darwin') return { workspacePath: null, reason: NOT_MACOS_REASON };
+  if (platform !== 'darwin' && platform !== 'linux') {
+    return { workspacePath: null, reason: UNSUPPORTED_OS_REASON };
+  }
   if (!allPodsConfirmedPrivate(installations)) {
     return { workspacePath: null, reason: PUBLIC_POD_REASON };
   }