@commonlyai/cli 0.1.195 → 0.1.197

package/node_modules/@commonlyai/seats/README.md

@@ -15,8 +15,7 @@ It is private and is not published on its own. `@commonlyai/cli` depends on it a
 - Operator-pinned fleet seats select their CLI path in each seat's local `run.sh` launcher,
   outside this repo. Update that pin and restart the seat to load a release.
   Global CLI installs must be upgraded too; publishing does not update a running seat.
-- Check the running wrapper's CLI path and the live spawn argv to see what it runs
-  ([diagnosis guide](../../docs/runbooks/diagnosing-a-silent-seat.md#2-read-the-live-spawn--the-prompt-is-in-argv)).
+- Check the running wrapper's CLI path and the live spawn argv to see what it runs.
   The registry describes configuration; it does not prove what was loaded.
 
 **Rule:** nothing here imports Commonly code. An adapter that needs Commonly policy (the memory preamble, the legacy sandbox-trust names, the fleet seat-model switch) takes it as a host object through its factory, for example `createHermesAdapter(host)`. The CLI binds that host in `cli/src/lib/adapters/<name>.js`. `cli/__tests__/seats-package.test.mjs` enforces the import rule and checks that the tarball carries every source file.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.195",
+  "version": "0.1.197",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/lib/sandbox/seatbelt.js

@@ -289,7 +289,6 @@ const OPEN_NETWORK = String.raw`
     (socket-protocol 2)))
 (allow mach-lookup
   (global-name "com.apple.SecurityServer")
-  (global-name "com.apple.SystemConfiguration.DNSConfiguration")
   (global-name "com.apple.SystemConfiguration.configd")
   (global-name "com.apple.networkd")
   (global-name "com.apple.ocspd")
@@ -297,6 +296,18 @@ const OPEN_NETWORK = String.raw`
   (global-name "com.apple.securityd.xpc"))
 `;
 
+// Both network modes. On macOS, c-ares (node's dns.Resolver and dns.resolve*)
+// reads the resolver list from configd's DNSConfiguration service while the
+// Resolver is constructed. Denied, that lookup does not always fail: at
+// times it blocks the main thread forever. dsh builds a Resolver as it loads,
+// so confined turns ran to their 900 s timeout without sending a request
+// (D106). Admitted, resolution fails fast, because mDNSResponder and port 53
+// stay unreachable in a loopback profile. The service returns configuration
+// and opens no channel out.
+const RESOLVER_CONFIG = String.raw`
+(allow mach-lookup (global-name "com.apple.SystemConfiguration.DNSConfiguration"))
+`;
+
 const escapeSbplString = (value) => String(value)
   .replaceAll('\\', '\\\\')
   .replaceAll('"', '\\"')
@@ -466,7 +477,7 @@ export const buildSeatbeltProfile = ({
   })() : [];
 
   return [
-    (network === 'open' ? `${PLATFORM_BASELINE}${OPEN_NETWORK}` : PLATFORM_BASELINE).trim(),
+    `${PLATFORM_BASELINE}${RESOLVER_CONFIG}${network === 'open' ? OPEN_NETWORK : ''}`.trim(),
     executableRules,
     executableSymlinkRules,
     `(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(resolvedWorkspace)}"))`,