@commonlyai/cli 0.1.190 → 0.1.192

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.190",
+  "version": "0.1.192",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -939,8 +939,16 @@ export const updateAgentConfiguration = async ({
  * two gates, because those gates compare `trust` directly.
  */
 export const resolveAttachSandbox = ({
-  environment, adapterName, platform = process.platform,
+  environment, adapterName, adapter = null, platform = process.platform,
 } = {}) => {
+  // An adapter that enforces one confined shape of its own (dsh: Seatbelt with a
+  // restricted network and NO trust) says so here, and its check is the one that
+  // decides: the trust-keyed gates below cannot express that shape, so before
+  // this they refused the only environment dsh accepts (D106). The adapter's
+  // check throws on every other shape, so this admits nothing it would refuse.
+  if (typeof adapter?.confinesOwnSandbox === 'function' && adapter.confinesOwnSandbox(environment)) {
+    return { mode: environment.sandbox.mode, trust: environment.sandbox.trust };
+  }
   const sandbox = normalizeSandboxTrust(environment?.sandbox);
   const trust = sandbox?.trust;
   // `workspace` is claude-only for now (TASK-294). Refused here with the words
@@ -988,6 +996,7 @@ export const performAttach = async ({
   memoryInstance = 'default',
   log = () => {},
   adapterRegistry = { getAdapter, listAdapterNames },
+  seatbelt: probeSeatbelt = detectSeatbelt,
 }) => {
   const adapter = adapterRegistry.getAdapter(adapterName);
   if (!adapter) {
@@ -1022,7 +1031,7 @@ export const performAttach = async ({
     }
     log(`workspace: ${workspace.path}${workspace.created ? ' (created)' : ''}`);
 
-    const { mode: sandboxMode } = resolveAttachSandbox({ environment, adapterName });
+    const { mode: sandboxMode } = resolveAttachSandbox({ environment, adapterName, adapter });
     if (sandboxMode === 'bwrap') {
       const bwrap = detectBwrap();
       if (!bwrap.available) {
@@ -1047,19 +1056,20 @@ export const performAttach = async ({
           + '(deny-by-default filesystem + network)',
         );
       } else {
-        const seatbelt = detectSeatbelt();
-        if (!seatbelt.available) {
-          throw new Error(
-            `public Claude sandbox.mode=${sandboxMode} requires macOS Seatbelt: `
-            + `${seatbelt.error}. On Linux use sandbox.mode=bwrap.`,
-          );
-        }
         const adapterLabel = ({ opencode: 'OpenCode', qwen: 'Qwen', claude: 'Claude' })[adapterName]
           || adapterName;
-        log(
-          `sandbox: public ${sandboxMode} via macOS Seatbelt `
-          + `(deny-by-default host filesystem; ${adapterLabel}/MCP network retained)`,
-        );
+        const seatbelt = probeSeatbelt();
+        if (!seatbelt.available) {
+          // dsh refuses bwrap, so it gets no Linux hint that leads to a second refusal.
+          throw new Error(adapterName === 'dsh'
+            ? `confined dsh sandbox.mode=${sandboxMode} requires macOS Seatbelt: ${seatbelt.error}.`
+            : `public ${adapterLabel} sandbox.mode=${sandboxMode} requires macOS Seatbelt: `
+              + `${seatbelt.error}. On Linux use sandbox.mode=bwrap.`);
+        }
+        log(adapterName === 'dsh'
+          ? `sandbox: confined dsh ${sandboxMode} via macOS Seatbelt (restricted network)`
+          : `sandbox: public ${sandboxMode} via macOS Seatbelt `
+            + `(deny-by-default host filesystem; ${adapterLabel}/MCP network retained)`);
       }
     } else if (sandboxMode !== 'none' && sandboxMode !== undefined) {
       throw new Error(

package/src/lib/adapters/dsh.js

@@ -55,6 +55,43 @@ export const isConfinedDsh = (environment = {}) => {
 
 export const assertPrivateDsh = (environment = {}) => { isConfinedDsh(environment); };
 
+/**
+ * The macOS developer tools a confined writer needs for git, granted read-only.
+ * /usr/bin/git is an xcrun shim: inside the sandbox it cannot read the tools it
+ * forwards to, so `git` fails with "No developer tools were found" and a writer
+ * cannot commit (D106). Returns null when no tools are installed; the seat then
+ * runs without git rather than failing.
+ *
+ * DEVELOPER_DIR and xcode-select are both settable by whoever starts the seat,
+ * so the resolved path is granted only when it is one of the two places Apple
+ * installs developer tools. Anything else (/, a home directory) returns null
+ * rather than widening what the sandbox can read.
+ */
+const DEVELOPER_DIR_SHAPES = [
+  /^\/Library\/Developer\/CommandLineTools$/,
+  /^\/Applications\/[^/]+\.app\/Contents\/Developer$/,
+];
+
+export const developerToolsDir = ({
+  env = process.env, run = spawnSync, exists = existsSync, realpath = realpathSync,
+} = {}) => {
+  const declared = env?.DEVELOPER_DIR;
+  const dir = declared || String(run('/usr/bin/xcode-select', ['-p'], { encoding: 'utf8' })?.stdout || '').trim();
+  if (!dir || !isAbsolute(dir) || !exists(dir)) return null;
+  const resolved = realpath(dir);
+  return DEVELOPER_DIR_SHAPES.some((shape) => shape.test(resolved)) ? resolved : null;
+};
+
+/**
+ * The confined child's PATH with /usr/bin first, so bare `git` is the xcrun
+ * shim the developer-tools grant serves. Seat runners put /opt/homebrew/bin
+ * ahead of it, and Homebrew git fails inside the sandbox reading its own
+ * /opt/homebrew/etc/gitconfig. Other entries keep their order, so tools
+ * /usr/bin lacks (node, npm) still resolve as before.
+ */
+export const systemToolsFirst = (pathValue) => ['/usr/bin', ...String(pathValue || '').split(delimiter)
+  .filter((dir) => dir && dir !== '/usr/bin')].join(delimiter);
+
 const onPath = (name, env) => {
   if (isAbsolute(name)) return existsSync(name) ? name : null;
   for (const dir of String(env?.PATH || '').split(delimiter)) {
@@ -296,6 +333,9 @@ export default {
   requiresModel: true,
   name: 'dsh', runtimeType: 'dsh', supportsProvider: true,
 
+  // The attach gate defers to this for dsh's one confined shape (D106).
+  confinesOwnSandbox: (environment) => isConfinedDsh(environment),
+
   async validateEnvironment(environment, workspacePath) {
     const validation = validateEnvironmentSpec(environment);
     if (!validation.ok) throw new Error(validation.errors.join('; '));
@@ -408,6 +448,11 @@ export default {
         for (const name of ['HTTPS_PROXY', 'https_proxy', 'HTTP_PROXY', 'http_proxy']) env[name] = egress.url;
         env.NO_PROXY = '127.0.0.1,localhost';
         env.no_proxy = env.NO_PROXY;
+        const developerDir = (ctx._developerToolsDir || developerToolsDir)({ env: sourceEnv });
+        if (developerDir) {
+          env.DEVELOPER_DIR = developerDir;
+          env.PATH = systemToolsFirst(env.PATH);
+        }
         [command, ...commandArgs] = (ctx._wrapArgvWithSeatbelt || wrapArgvWithSeatbelt)([process.execPath, entry, ...args], {
           workspacePath: ctx.cwd,
           workspaceAccess: 'write',
@@ -416,7 +461,7 @@ export default {
           mcpConfigDir: tempDir,
           network: 'loopback',
           loopbackNetworkPorts: [proxy.port, relay.port, egress.port],
-          readOnlyDirectories: [packages, ...mcpDirectories],
+          readOnlyDirectories: [packages, ...mcpDirectories, ...(developerDir ? [developerDir] : [])],
         });
       }
       const credentials = [...spawnCredentials(ctx, []), bearer];

package/src/lib/adapters/opencode.js

@@ -65,7 +65,7 @@ const ISOLATED_INSTANCE_PORT = 8766;
 const LOOPBACK_BRIDGE = fileURLToPath(new URL('../sandbox/opencode-loopback.mjs', import.meta.url));
 const TERMINATION_GRACE_MS = 5000;
 // Bump only with a passing real sandbox-exec smoke against the new version.
-const TESTED_OPENCODE_VERSIONS = Object.freeze(['1.18.35', '1.19.0']);
+const TESTED_OPENCODE_VERSIONS = Object.freeze(['1.18.35', '1.19.0', '1.19.4']);
 const ALLOW_UNTESTED_OPENCODE_VERSION_ENV = 'COMMONLY_OPENCODE_ALLOW_UNTESTED_VERSION';
 const VERSION_CHECK_TIMEOUT_MS = 5000;
 const OPENCODE_CONFIG_GITIGNORE = [

package/src/lib/adapters/qwen.js

@@ -1,4 +1,4 @@
-/** Qwen Code 0.25.1 wrapper. Public turns have fresh HOME, config and keys. */
+/** Qwen Code 0.25.1 and 0.26.2 wrapper. Public turns have fresh HOME, config and keys. */
 import { requireSeatModel } from './seat-model.js';
 import { spawn as childSpawn, spawnSync } from 'child_process';
 import { lstatSync, realpathSync } from 'fs';
@@ -17,7 +17,7 @@ import { resolveProviderKeyFile, startProviderProxy } from '../provider-proxy.js
 import { adapterFailure, spawnCredentials } from '../upstream-refusal.js';
 
 // Add a version only with a passing real clean-box sandbox smoke that names it.
-const TESTED_QWEN_VERSIONS = Object.freeze(['0.25.1']);
+const TESTED_QWEN_VERSIONS = Object.freeze(['0.25.1', '0.26.2']);
 const ALLOW_UNTESTED_QWEN_VERSION_ENV = 'COMMONLY_QWEN_ALLOW_UNTESTED_VERSION';
 const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
 const TERMINATION_GRACE_MS = 5000;