@commonlyai/cli 0.1.189 → 0.1.191

package/node_modules/@commonlyai/seats/src/adapters/hermes.js

@@ -1,7 +1,7 @@
-/** Hermes 0.22.2 local CLI wrapper. Hermes owns provider I/O; this file only spawns it. */
+/** Hermes 0.22 local CLI wrapper. Hermes owns provider I/O; this file only spawns it. */
 import { spawn as childSpawn, spawnSync } from 'child_process';
-import { createHash } from 'crypto';
-import { mkdir } from 'fs/promises';
+import { createHash, randomBytes } from 'crypto';
+import { chmod, mkdir, readFile, rename, rm, writeFile } from 'fs/promises';
 import { homedir } from 'os';
 import { join } from 'path';
 import { StringDecoder } from 'string_decoder';
@@ -9,11 +9,64 @@ import { observeSpawn, controlsFromArguments } from '../runtime-observation.js';
 import { requireSeatModel } from '../seat-model.js';
 import { adapterFailure, spawnCredentials } from '../upstream-refusal.js';
 
-export const TESTED_HERMES_VERSION = '0.22.2';
+export const SUPPORTED_HERMES_VERSION_RANGE = '>=0.22.5 <0.23.0';
+const supportsHermesVersion = (version) => {
+  const match = /^(\d+)\.(\d+)\.(\d+)$/.exec(version || '');
+  if (!match) return false;
+  return Number(match[1]) === 0 && Number(match[2]) === 22 && Number(match[3]) >= 5;
+};
 const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
 const VERSION_TIMEOUT_MS = 15000;
 const MAX_STDERR_CHARS = 4096;
 const MAX_LINE_CHARS = 1024 * 1024;
+// Keys the wrapper owns in the profile's .env. Every other line is the user's.
+const PROFILE_ENV_KEYS = ['OPENROUTER_API_KEY', 'OPENROUTER_BASE_URL'];
+const PLAIN_ENV_VALUE = /^[A-Za-z0-9_\-.:/+=@%~]+$/;
+
+const definedKey = (line) => {
+  const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line);
+  return match ? match[1] : null;
+};
+
+// From 0.22.5 the detached gateway serves a profiles/<hash> home with a child
+// env scrubbed of credentials and overlaid with that profile's own .env
+// (tools/environments/local.py, served_profile_child_env), so a key in the
+// spawn env never reaches the model. Hermes documents <profile>/.env as where
+// a profile's API keys live (website/docs/user-guide/profiles.md). The file
+// stays after the turn: the gateway outlives the spawn and rereads it.
+export const syncProfileEnv = async (home, env) => {
+  const owned = PROFILE_ENV_KEYS.filter((key) => env[key]);
+  for (const key of owned) {
+    if (!PLAIN_ENV_VALUE.test(env[key])) {
+      throw new Error(`${key} contains characters a Hermes .env line cannot carry unquoted; refusing to write it`);
+    }
+  }
+  const path = join(home, '.env');
+  let current = '';
+  try {
+    current = await readFile(path, 'utf8');
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw new Error(`Cannot read the Hermes profile .env (${error?.code || 'read failed'})`);
+  }
+  const kept = current.split(/\r?\n/).filter((line, index, lines) => (
+    !owned.includes(definedKey(line)) && !(index === lines.length - 1 && line === '')
+  ));
+  const next = `${[...kept, ...owned.map((key) => `${key}=${env[key]}`)].join('\n')}\n`;
+  await chmod(home, 0o700);
+  if (next === current) {
+    await chmod(path, 0o600);
+    return;
+  }
+  const temp = join(home, `.env.${process.pid}.${randomBytes(6).toString('hex')}.tmp`);
+  try {
+    await writeFile(temp, next, { mode: 0o600, flag: 'wx' });
+    await chmod(temp, 0o600);
+    await rename(temp, path);
+  } catch (error) {
+    await rm(temp, { force: true });
+    throw new Error(`Cannot write the Hermes profile .env (${error?.code || 'write failed'})`);
+  }
+};
 
 const readVersion = (env, spawnSyncImpl = spawnSync) => {
   let probe;
@@ -24,8 +77,8 @@ const readVersion = (env, spawnSyncImpl = spawnSync) => {
     if (probe.error?.code === 'ENOENT') return null;
     if (probe.error || probe.status !== 0) continue;
     const version = String(probe.stdout || '').match(/Hermes Agent v([^\s]+)/i)?.[1];
-    if (version !== TESTED_HERMES_VERSION) {
-      throw new Error(`Hermes ${version || 'unknown'} is unsupported; this adapter requires ${TESTED_HERMES_VERSION}`);
+    if (!supportsHermesVersion(version)) {
+      throw new Error(`Hermes ${version || 'unknown'} is unsupported; this adapter supports ${SUPPORTED_HERMES_VERSION_RANGE}. Run hermes update if yours is older than 0.22.5; releases 0.23 and later are not supported yet`);
     }
     return version;
   }
@@ -182,13 +235,18 @@ export const createHermesAdapter = ({
     await mkdir(home, { recursive: true, mode: 0o700 });
     const env = { ...(ctx.env || process.env), HERMES_HOME: home };
     if (!readVersion(env, ctx._spawnSyncImpl)) {
-      throw new Error('Hermes Agent 0.22.2 is not on PATH');
+      throw new Error(`Hermes Agent ${SUPPORTED_HERMES_VERSION_RANGE} is not on PATH; install for your OS: https://hermes-agent.nousresearch.com/docs/getting-started/installation`);
     }
     if (!env.OPENROUTER_API_KEY) {
       throw new Error('Supply the operator OPENROUTER_API_KEY through Secret Manager before running Hermes');
     }
+    await syncProfileEnv(home, env);
+    const cwd = ctx.cwd || process.cwd();
+    // 0.22.5's gateway rejects --no-restore-cwd; --in pins the workspace on
+    // both fresh and resumed turns. 0.22.2-0.22.4 are refused above, so no
+    // version-keyed flag is needed.
     const args = ['chat', '--oneshot', '--query-file', '-', '--format', 'stream-json',
-      '--provider', 'openrouter', '--source', 'tool', '--no-restore-cwd'];
+      '--provider', 'openrouter', '--source', 'tool', '--in', cwd];
     if (seatModel) args.push('--model', seatModel);
     if (ctx.sessionId) args.push('--resume', ctx.sessionId);
     const fullPrompt = memoryPreamble(prompt, ctx.memoryLongTerm, {
@@ -198,8 +256,8 @@ export const createHermesAdapter = ({
     const timeoutMs = Number.isFinite(requestedTimeout) && requestedTimeout > 0
       ? Math.min(requestedTimeout, DEFAULT_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS;
     return runHermes({
-      args, prompt: fullPrompt, cwd: ctx.cwd, env, timeoutMs,
-      spawnImpl: ctx._spawnImpl, onSpawn: ctx.onSpawn, controls: controlsFromArguments(args, { modelFlag: '--model', valueFlags: ['--query-file', '--format', '--provider', '--source', '--resume'] }),
+      args, prompt: fullPrompt, cwd, env, timeoutMs,
+      spawnImpl: ctx._spawnImpl, onSpawn: ctx.onSpawn, controls: controlsFromArguments(args, { modelFlag: '--model', valueFlags: ['--query-file', '--format', '--provider', '--source', '--in', '--resume'] }),
       credentials: spawnCredentials(ctx, ['OPENROUTER_API_KEY']),
     });
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.189",
+  "version": "0.1.191",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -939,8 +939,16 @@ export const updateAgentConfiguration = async ({
  * two gates, because those gates compare `trust` directly.
  */
 export const resolveAttachSandbox = ({
-  environment, adapterName, platform = process.platform,
+  environment, adapterName, adapter = null, platform = process.platform,
 } = {}) => {
+  // An adapter that enforces one confined shape of its own (dsh: Seatbelt with a
+  // restricted network and NO trust) says so here, and its check is the one that
+  // decides: the trust-keyed gates below cannot express that shape, so before
+  // this they refused the only environment dsh accepts (D106). The adapter's
+  // check throws on every other shape, so this admits nothing it would refuse.
+  if (typeof adapter?.confinesOwnSandbox === 'function' && adapter.confinesOwnSandbox(environment)) {
+    return { mode: environment.sandbox.mode, trust: environment.sandbox.trust };
+  }
   const sandbox = normalizeSandboxTrust(environment?.sandbox);
   const trust = sandbox?.trust;
   // `workspace` is claude-only for now (TASK-294). Refused here with the words
@@ -988,6 +996,7 @@ export const performAttach = async ({
   memoryInstance = 'default',
   log = () => {},
   adapterRegistry = { getAdapter, listAdapterNames },
+  seatbelt: probeSeatbelt = detectSeatbelt,
 }) => {
   const adapter = adapterRegistry.getAdapter(adapterName);
   if (!adapter) {
@@ -1022,7 +1031,7 @@ export const performAttach = async ({
     }
     log(`workspace: ${workspace.path}${workspace.created ? ' (created)' : ''}`);
 
-    const { mode: sandboxMode } = resolveAttachSandbox({ environment, adapterName });
+    const { mode: sandboxMode } = resolveAttachSandbox({ environment, adapterName, adapter });
     if (sandboxMode === 'bwrap') {
       const bwrap = detectBwrap();
       if (!bwrap.available) {
@@ -1047,19 +1056,20 @@ export const performAttach = async ({
           + '(deny-by-default filesystem + network)',
         );
       } else {
-        const seatbelt = detectSeatbelt();
-        if (!seatbelt.available) {
-          throw new Error(
-            `public Claude sandbox.mode=${sandboxMode} requires macOS Seatbelt: `
-            + `${seatbelt.error}. On Linux use sandbox.mode=bwrap.`,
-          );
-        }
         const adapterLabel = ({ opencode: 'OpenCode', qwen: 'Qwen', claude: 'Claude' })[adapterName]
           || adapterName;
-        log(
-          `sandbox: public ${sandboxMode} via macOS Seatbelt `
-          + `(deny-by-default host filesystem; ${adapterLabel}/MCP network retained)`,
-        );
+        const seatbelt = probeSeatbelt();
+        if (!seatbelt.available) {
+          // dsh refuses bwrap, so it gets no Linux hint that leads to a second refusal.
+          throw new Error(adapterName === 'dsh'
+            ? `confined dsh sandbox.mode=${sandboxMode} requires macOS Seatbelt: ${seatbelt.error}.`
+            : `public ${adapterLabel} sandbox.mode=${sandboxMode} requires macOS Seatbelt: `
+              + `${seatbelt.error}. On Linux use sandbox.mode=bwrap.`);
+        }
+        log(adapterName === 'dsh'
+          ? `sandbox: confined dsh ${sandboxMode} via macOS Seatbelt (restricted network)`
+          : `sandbox: public ${sandboxMode} via macOS Seatbelt `
+            + `(deny-by-default host filesystem; ${adapterLabel}/MCP network retained)`);
       }
     } else if (sandboxMode !== 'none' && sandboxMode !== undefined) {
       throw new Error(

package/src/lib/adapters/dsh.js

@@ -55,6 +55,43 @@ export const isConfinedDsh = (environment = {}) => {
 
 export const assertPrivateDsh = (environment = {}) => { isConfinedDsh(environment); };
 
+/**
+ * The macOS developer tools a confined writer needs for git, granted read-only.
+ * /usr/bin/git is an xcrun shim: inside the sandbox it cannot read the tools it
+ * forwards to, so `git` fails with "No developer tools were found" and a writer
+ * cannot commit (D106). Returns null when no tools are installed; the seat then
+ * runs without git rather than failing.
+ *
+ * DEVELOPER_DIR and xcode-select are both settable by whoever starts the seat,
+ * so the resolved path is granted only when it is one of the two places Apple
+ * installs developer tools. Anything else (/, a home directory) returns null
+ * rather than widening what the sandbox can read.
+ */
+const DEVELOPER_DIR_SHAPES = [
+  /^\/Library\/Developer\/CommandLineTools$/,
+  /^\/Applications\/[^/]+\.app\/Contents\/Developer$/,
+];
+
+export const developerToolsDir = ({
+  env = process.env, run = spawnSync, exists = existsSync, realpath = realpathSync,
+} = {}) => {
+  const declared = env?.DEVELOPER_DIR;
+  const dir = declared || String(run('/usr/bin/xcode-select', ['-p'], { encoding: 'utf8' })?.stdout || '').trim();
+  if (!dir || !isAbsolute(dir) || !exists(dir)) return null;
+  const resolved = realpath(dir);
+  return DEVELOPER_DIR_SHAPES.some((shape) => shape.test(resolved)) ? resolved : null;
+};
+
+/**
+ * The confined child's PATH with /usr/bin first, so bare `git` is the xcrun
+ * shim the developer-tools grant serves. Seat runners put /opt/homebrew/bin
+ * ahead of it, and Homebrew git fails inside the sandbox reading its own
+ * /opt/homebrew/etc/gitconfig. Other entries keep their order, so tools
+ * /usr/bin lacks (node, npm) still resolve as before.
+ */
+export const systemToolsFirst = (pathValue) => ['/usr/bin', ...String(pathValue || '').split(delimiter)
+  .filter((dir) => dir && dir !== '/usr/bin')].join(delimiter);
+
 const onPath = (name, env) => {
   if (isAbsolute(name)) return existsSync(name) ? name : null;
   for (const dir of String(env?.PATH || '').split(delimiter)) {
@@ -296,6 +333,9 @@ export default {
   requiresModel: true,
   name: 'dsh', runtimeType: 'dsh', supportsProvider: true,
 
+  // The attach gate defers to this for dsh's one confined shape (D106).
+  confinesOwnSandbox: (environment) => isConfinedDsh(environment),
+
   async validateEnvironment(environment, workspacePath) {
     const validation = validateEnvironmentSpec(environment);
     if (!validation.ok) throw new Error(validation.errors.join('; '));
@@ -408,6 +448,11 @@ export default {
         for (const name of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy']) env[name] = egress.url;
         env.NO_PROXY = '127.0.0.1,localhost';
         env.no_proxy = env.NO_PROXY;
+        const developerDir = (ctx._developerToolsDir || developerToolsDir)({ env: sourceEnv });
+        if (developerDir) {
+          env.DEVELOPER_DIR = developerDir;
+          env.PATH = systemToolsFirst(env.PATH);
+        }
         [command, ...commandArgs] = (ctx._wrapArgvWithSeatbelt || wrapArgvWithSeatbelt)([process.execPath, entry, ...args], {
           workspacePath: ctx.cwd,
           workspaceAccess: 'write',
@@ -416,7 +461,7 @@ export default {
           mcpConfigDir: tempDir,
           network: 'loopback',
           loopbackNetworkPorts: [proxy.port, relay.port, egress.port],
-          readOnlyDirectories: [packages, ...mcpDirectories],
+          readOnlyDirectories: [packages, ...mcpDirectories, ...(developerDir ? [developerDir] : [])],
         });
       }
       const credentials = [...spawnCredentials(ctx, []), bearer];

package/src/lib/adapters/hermes.js

@@ -5,7 +5,7 @@ import { buildMemoryPreamble } from '../memory-bridge.js';
 import { effectiveSandboxTrust } from '../environment.js';
 import { seatModelRequired } from './seat-model.js';
 
-export { TESTED_HERMES_VERSION, readHermesJsonl } from '@commonlyai/seats/adapters/hermes';
+export { SUPPORTED_HERMES_VERSION_RANGE, readHermesJsonl, syncProfileEnv } from '@commonlyai/seats/adapters/hermes';
 
 // Commonly's policy for the generic Hermes adapter: its memory preamble, its
 // legacy sandbox-trust names, the fleet seat-model switch, and the profile