@commonlyai/cli 0.1.2 → 0.1.5

package/src/lib/adapters/codex.js

@@ -38,9 +38,24 @@
  */
 
 import { spawn as childSpawn, spawnSync } from 'child_process';
-import { mkdtemp, readFile, rm } from 'fs/promises';
-import { tmpdir } from 'os';
-import { join } from 'path';
+import { createHash } from 'crypto';
+import {
+  chmod,
+  lstat,
+  mkdir,
+  mkdtemp,
+  readFile,
+  readlink,
+  rm,
+  symlink,
+  unlink,
+} from 'fs/promises';
+import { homedir, tmpdir } from 'os';
+import {
+  dirname,
+  join,
+  resolve as pathResolve,
+} from 'path';
 
 // Default timeout for a single codex spawn (exec mode).
 //
@@ -84,9 +99,10 @@ const buildPrompt = (prompt, memoryLongTerm) => {
 // Codex-specific constraints:
 //   - stdio/command servers only (no url transport here); url-only entries
 //     are skipped rather than half-wired.
-//   - Declared env MUST ride inside the mcp_servers.<name>.env table — codex
-//     does not pass its parent env to the MCP child it spawns (the PR #398
-//     cloud-codex lesson; same failure mode locally).
+//   - Token-bearing values ride through `env_vars`, never a `-c ...env=...`
+//     argv override. Command lines are visible to other same-user processes
+//     unless the OS sandbox blocks process inspection; keeping bearer tokens
+//     out of argv is an independent defense.
 const SUBSTITUTION_KEYS = ['COMMONLY_AGENT_TOKEN', 'COMMONLY_API_URL', 'COMMONLY_INSTANCE_URL'];
 const PLACEHOLDER_RE = /\$\{(COMMONLY_[A-Z_]+)\}/g;
 
@@ -109,26 +125,152 @@ const toml = (s) => JSON.stringify(String(s));
 
 const buildMcpOverrideArgs = (mcpServers, ctx = {}) => {
   const flags = [];
+  const forwardedEnv = {};
   for (const server of mcpServers || []) {
     if (!server?.name || !Array.isArray(server.command) || !server.command.length) continue;
     const [command, ...rest] = server.command.map((a) => substitutePlaceholders(a, ctx));
     flags.push('-c', `mcp_servers.${server.name}.command=${toml(command)}`);
+    // The user opted into every server present in the environment spec.
+    // Public permission profiles + approval_policy=never otherwise auto-deny
+    // side-effecting MCP calls, silently removing the agent's Commonly tools.
+    // Mirror Claude's --allowedTools behavior: declared MCP servers are the
+    // capability boundary, and all of their tools are non-interactively
+    // approved inside that boundary.
+    flags.push(
+      '-c',
+      `mcp_servers.${server.name}.default_tools_approval_mode="approve"`,
+    );
     if (rest.length) {
       flags.push('-c', `mcp_servers.${server.name}.args=[${rest.map(toml).join(',')}]`);
     }
-    const envEntries = Object.entries(server.env || {})
-      .map(([k, v]) => `${k} = ${toml(substitutePlaceholders(v, ctx))}`);
+    const envEntries = [];
+    const envVars = [];
+    for (const [key, rawValue] of Object.entries(server.env || {})) {
+      const value = substitutePlaceholders(rawValue, ctx);
+      const carriesRuntimeToken = !!ctx.runtimeToken
+        && typeof value === 'string'
+        && value.includes(ctx.runtimeToken);
+      if (carriesRuntimeToken) {
+        if (forwardedEnv[key] !== undefined && forwardedEnv[key] !== value) {
+          throw new Error(
+            `codex MCP servers declare conflicting token-bearing values for env var ${key}`,
+          );
+        }
+        forwardedEnv[key] = value;
+        envVars.push(key);
+      } else {
+        envEntries.push(`${key} = ${toml(value)}`);
+      }
+    }
     if (envEntries.length) {
       flags.push('-c', `mcp_servers.${server.name}.env={${envEntries.join(', ')}}`);
     }
+    if (envVars.length) {
+      flags.push('-c', `mcp_servers.${server.name}.env_vars=[${envVars.map(toml).join(',')}]`);
+    }
+  }
+  return { flags, forwardedEnv };
+};
+
+const PUBLIC_PERMISSION_PROFILE = 'commonly_public';
+const PUBLIC_SANDBOX_MODES = new Set(['workspace', 'read-only']);
+
+const statOrNull = async (path) => {
+  try {
+    return await lstat(path);
+  } catch (err) {
+    if (err?.code === 'ENOENT') return null;
+    throw err;
+  }
+};
+
+// Codex reads $CODEX_HOME/AGENTS.md before model-generated commands enter the
+// OS sandbox. Pointing a public run at the operator's normal ~/.codex would
+// therefore expose global private instructions even though shell reads of
+// ~/.codex are denied. Give every public wrapper identity its own persistent
+// Codex home for sessions/state, with only an auth symlink back to the
+// operator credential. The symlink itself lives under ~/.commonly, which the
+// permission profile denies to model-generated commands.
+const preparePublicCodexHome = async (ctx) => {
+  const operatorHome = ctx.env?.CODEX_HOME
+    || process.env.CODEX_HOME
+    || join(homedir(), '.codex');
+  const identity = ctx.agentName || ctx.cwd || 'anonymous';
+  const identityHash = createHash('sha256').update(identity).digest('hex').slice(0, 20);
+  const publicHome = ctx._publicCodexHome
+    || join(homedir(), '.commonly', 'codex-homes', identityHash);
+  if (pathResolve(publicHome) === pathResolve(operatorHome)) {
+    throw new Error('public codex home must be isolated from the operator CODEX_HOME');
+  }
+
+  await mkdir(publicHome, { recursive: true, mode: 0o700 });
+  await chmod(publicHome, 0o700);
+
+  const sourceAuth = join(operatorHome, 'auth.json');
+  const targetAuth = join(publicHome, 'auth.json');
+  const sourceStat = await statOrNull(sourceAuth);
+  const targetStat = await statOrNull(targetAuth);
+  if (targetStat && !targetStat.isSymbolicLink()) {
+    throw new Error(`refusing to replace non-symlink public Codex credential: ${targetAuth}`);
+  }
+  if (sourceStat) {
+    const currentTarget = targetStat
+      ? pathResolve(dirname(targetAuth), await readlink(targetAuth))
+      : null;
+    if (currentTarget !== pathResolve(sourceAuth)) {
+      if (targetStat) await unlink(targetAuth);
+      await symlink(sourceAuth, targetAuth);
+    }
+  } else if (targetStat) {
+    // A stale symlink could unexpectedly authenticate through an old home
+    // after the operator intentionally logged out. Remove it and let Codex
+    // fail closed with its normal "not logged in" error.
+    await unlink(targetAuth);
   }
-  return flags;
+  return publicHome;
+};
+
+const publicPermissionProfileFlags = (mode) => {
+  if (!PUBLIC_SANDBOX_MODES.has(mode)) {
+    throw new Error(
+      `public codex agents require sandbox.mode=workspace or read-only, got ${mode || 'unset'}`,
+    );
+  }
+  const workspaceAccess = mode === 'read-only' ? 'read' : 'write';
+  const filesystem = [
+    '":minimal"="read"',
+    '"~/.commonly"="deny"',
+    '"~/.claude"="deny"',
+    '"~/.codex"="deny"',
+    '"~/.ssh"="deny"',
+    '"~/.aws"="deny"',
+    '"~/.config"="deny"',
+    '"/private/tmp"="deny"',
+    `":workspace_roots"={"."="${workspaceAccess}",".commonly/**"="deny",".codex/**"="deny","*.env"="deny","*/*.env"="deny","*/*/*.env"="deny"}`,
+  ].join(',');
+  return [
+    '-c', `default_permissions=${toml(PUBLIC_PERMISSION_PROFILE)}`,
+    '-c', `permissions.${PUBLIC_PERMISSION_PROFILE}.filesystem={${filesystem}}`,
+    '-c', `permissions.${PUBLIC_PERMISSION_PROFILE}.network.enabled=false`,
+    // The MCP launcher receives explicitly forwarded env_vars separately.
+    // Model-generated shell commands inherit only a small non-secret core.
+    '-c', 'shell_environment_policy.inherit="core"',
+    '-c', 'shell_environment_policy.ignore_default_excludes=false',
+    '-c', 'shell_environment_policy.include_only=["PATH","HOME","TMPDIR","LANG","LC_*"]',
+  ];
 };
 
 // Build the argv after the `codex` binary. Resume vs new turn is a
 // subcommand-level distinction in modern codex, not an option flag — keep
 // that detail isolated here so the spawn path stays linear.
-const buildArgs = ({ sessionId, prompt, outputFile, mcpFlags = [] }) => {
+const buildArgs = ({
+  sessionId,
+  prompt,
+  outputFile,
+  mcpFlags = [],
+  publicSandboxMode = null,
+}) => {
+  const publicSandbox = publicSandboxMode !== null;
   // `--dangerously-bypass-approvals-and-sandbox` disables codex CLI's
   // bubblewrap (bwrap) sandbox + approval prompts. bwrap needs CAP_SYS_ADMIN
   // or unprivileged user-namespaces — neither available to standard k8s
@@ -137,26 +279,39 @@ const buildArgs = ({ sessionId, prompt, outputFile, mcpFlags = [] }) => {
   // slave: Permission denied" inside cloud-codex pods (verified 2026-05-15).
   // The pod is the security perimeter — agent identity is isolated, workspace
   // is PVC-scoped, no host mounts. bwrap inside the pod is redundant.
-  // On a laptop wrapper run (sam-local-codex etc.) the same flag is fine: the
-  // operator's machine is already the security boundary they signed up for
-  // when running `commonly agent run`.
+  // Public laptop wrappers are different: untrusted pod content must never
+  // inherit that bypass. Codex >=0.138 permission profiles provide a native
+  // deny-by-default read/write/network boundary on macOS and Linux. Do not
+  // pass legacy `--sandbox` alongside them: Codex documents that the legacy
+  // mode disables permission-profile composition.
+  const executionPolicy = publicSandbox
+    ? [
+      '--ignore-user-config',
+      '--ignore-rules',
+      ...publicPermissionProfileFlags(publicSandboxMode),
+    ]
+    : ['--dangerously-bypass-approvals-and-sandbox'];
   const common = [
     '--json',
     '--skip-git-repo-check',
-    '--dangerously-bypass-approvals-and-sandbox',
+    ...executionPolicy,
     ...mcpFlags,
     '-o',
     outputFile,
   ];
+  // Approval policy is a global option in Codex 0.144, so it must precede
+  // the `exec` subcommand. A denied operation is returned to the model;
+  // non-interactive public agents never hang waiting for an operator.
+  const prefix = publicSandbox ? ['--ask-for-approval', 'never'] : [];
   if (sessionId) {
     // Place <sessionId> immediately after the `exec resume` subcommand so a
     // future codex parser change can't accidentally consume it as the value
     // of a preceding flag (e.g. -o). Codex's CLI signature is documented as
     // `codex exec resume [OPTIONS] [SESSION_ID] [PROMPT]`, and this ordering
     // matches that intent unambiguously regardless of clap version.
-    return ['exec', 'resume', sessionId, ...common, prompt];
+    return [...prefix, 'exec', 'resume', sessionId, ...common, prompt];
   }
-  return ['exec', ...common, prompt];
+  return [...prefix, 'exec', ...common, prompt];
 };
 
 // Stream-parse JSONL stdout. Codex emits one event per line; partial lines
@@ -270,20 +425,29 @@ export default {
     const outputFile = join(dir, 'last-message.txt');
 
     try {
+      const mcp = buildMcpOverrideArgs(ctx.environment?.mcp, {
+        runtimeToken: ctx.runtimeToken,
+        instanceUrl: ctx.instanceUrl,
+      });
+      const publicSandboxMode = ctx.environment?.sandbox?.trust === 'public'
+        ? ctx.environment?.sandbox?.mode || 'unset'
+        : null;
       const args = buildArgs({
         sessionId: ctx.sessionId || null,
         prompt: fullPrompt,
         outputFile,
-        mcpFlags: buildMcpOverrideArgs(ctx.environment?.mcp, {
-          runtimeToken: ctx.runtimeToken,
-          instanceUrl: ctx.instanceUrl,
-        }),
+        mcpFlags: mcp.flags,
+        publicSandboxMode,
       });
+      const childEnv = { ...(ctx.env || process.env), ...mcp.forwardedEnv };
+      if (publicSandboxMode !== null) {
+        childEnv.CODEX_HOME = await preparePublicCodexHome(ctx);
+      }
 
       const { threadId } = await runCodex({
         args,
         cwd: ctx.cwd,
-        env: ctx.env,
+        env: childEnv,
         timeoutMs: ctx.timeoutMs || DEFAULT_TIMEOUT_MS,
         spawnImpl: ctx._spawnImpl, // test seam only — do not use in production
       });

package/src/lib/environment.js

@@ -5,7 +5,7 @@
  * how an agent's runtime should be shaped: workspace path, sandbox mode, the
  * Claude skills to mount, the MCP servers to expose. This module is the
  * adapter-facing read-side: parse, validate, and realize the workspace +
- * skill links on disk. Sandbox argv wrapping lives in `./sandbox/bwrap.js`
+ * skill mounts on disk. Sandbox argv wrapping lives in `./sandbox/bwrap.js`
  * because it is per-driver (Linux-only, bwrap-specific).
  *
  * Zero runtime deps: Node 20 has no built-in YAML, so we accept JSON only and
@@ -14,7 +14,9 @@
  * place to add a `.yaml` branch — the rest of the module is parser-agnostic.
  */
 
-import { readFile, mkdir, symlink, lstat, readlink, cp } from 'fs/promises';
+import {
+  readFile, mkdir, lstat, cp, rm, chmod, readdir, writeFile,
+} from 'fs/promises';
 import { existsSync } from 'fs';
 import { dirname, isAbsolute, join, resolve as pathResolve, basename } from 'path';
 import { homedir } from 'os';
@@ -25,12 +27,15 @@ import { homedir } from 'os';
 // relative skill paths) is NOT stored on the returned spec. Leaking the user's
 // absolute filesystem path into `config.environment` sent to the backend
 // exposes `$HOME` layout for zero server-side benefit. Callers pass
-// `envFileDir` as a separate argument to resolveWorkspace / linkSkills.
+// `envFileDir` as a separate argument to resolveWorkspace / mountSkills.
 
 const ALLOWED_TOP_KEYS = new Set([
   'version', 'workspace', 'sandbox', 'skills', 'mcp',
 ]);
-const ALLOWED_SANDBOX_MODES = new Set(['none', 'bwrap', 'firejail', 'container', 'managed']);
+const ALLOWED_SANDBOX_MODES = new Set([
+  'none', 'workspace', 'read-only', 'bwrap', 'firejail', 'container', 'managed',
+]);
+const ALLOWED_SANDBOX_TRUST = new Set(['public', 'internal']);
 const ALLOWED_NETWORK_POLICIES = new Set(['unrestricted', 'restricted']);
 
 const expandHome = (p) => {
@@ -82,7 +87,7 @@ export const parseEnvironmentFile = async (absolutePath) => {
   // Return the bare spec — no envFileDir wrapping, no underscore-prefixed
   // annotations. The caller is responsible for tracking envFileDir separately
   // (compute via `dirname(envPath)`) and passing it explicitly to
-  // resolveWorkspace / linkSkills when relative paths in the spec need to
+  // resolveWorkspace / mountSkills when relative paths in the spec need to
   // resolve. This keeps the spec safe to serialize and ship to the backend
   // (`config.environment` on AgentInstallation) without leaking $HOME layout.
   return parsed;
@@ -127,10 +132,15 @@ export const validateEnvironmentSpec = (spec) => {
     if (typeof spec.sandbox !== 'object' || spec.sandbox === null) {
       errors.push('sandbox must be an object');
     } else {
-      const { mode, network, filesystem } = spec.sandbox;
+      const {
+        mode, trust, network, filesystem,
+      } = spec.sandbox;
       if (mode !== undefined && !ALLOWED_SANDBOX_MODES.has(mode)) {
         errors.push(`sandbox.mode must be one of: ${[...ALLOWED_SANDBOX_MODES].join(', ')}`);
       }
+      if (trust !== undefined && !ALLOWED_SANDBOX_TRUST.has(trust)) {
+        errors.push(`sandbox.trust must be one of: ${[...ALLOWED_SANDBOX_TRUST].join(', ')}`);
+      }
       if (network !== undefined) {
         if (typeof network !== 'object' || network === null) {
           errors.push('sandbox.network must be an object');
@@ -238,35 +248,72 @@ export const resolveWorkspace = async (spec, agentName, envFileDir = null) => {
   return { path: absPath, created };
 };
 
-// ── linkSkills ──────────────────────────────────────────────────────────────
+// ── mountSkills ─────────────────────────────────────────────────────────────
+
+// Marks a skill directory as a Commonly-managed snapshot. Its presence is what
+// licenses a refresh to delete and re-copy the directory: without it we cannot
+// distinguish "a mount we made last spawn" from "a skill the user authored in
+// their workspace", and clobbering the latter would destroy real work.
+const MOUNT_MARKER = '.commonly-skill-mount';
+
+/**
+ * Recursively drop the write bit on every regular file in a mounted snapshot.
+ *
+ * Directories deliberately stay writable: unlinking a file requires write
+ * permission on its PARENT, so read-only directories would make the next
+ * refresh fail. This is defense-in-depth for the agent's own copy, not the
+ * load-bearing protection — that comes from the copy existing at all.
+ */
+const freezeFiles = async (dir) => {
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      // eslint-disable-next-line no-await-in-loop
+      await freezeFiles(full);
+    } else if (entry.isFile()) {
+      // eslint-disable-next-line no-await-in-loop
+      await chmod(full, 0o444);
+    }
+  }
+};
 
 /**
- * Symlink each `skills.claude[]` source path into `<workspacePath>/.claude/skills/`.
+ * Mount each `skills.claude[]` source into `<workspacePath>/.claude/skills/`
+ * as a READ-ONLY SNAPSHOT COPY.
  *
- * Idempotent: if a symlink already points at the declared source, it is
- * counted in `skipped` and left in place. If a DIFFERENT file or symlink
- * occupies the slot, it is recorded in `conflicted` with a reason — never
- * overwritten (a user-edited skill in the workspace must not be clobbered).
- * Missing source paths are also reported in `conflicted` so the caller can
- * surface them.
+ * Why a copy and not a symlink: a symlink is writable *through*, so an agent
+ * holding Write/Edit could edit the file that governs its own behaviour — and
+ * because these sources are usually files tracked in a repo (the bundled
+ * `cli/skills/commonly` is the common case), that edit lands in the operator's
+ * working tree. `npm publish` ships the working tree, not git HEAD, so a
+ * write-through edit can silently ride out in the next release. That is not
+ * hypothetical: @commonlyai/cli@0.1.4 shipped with the "post as yourself,
+ * never as your operator" guardrail (#702) missing for exactly this reason.
+ * The snapshot makes the data flow one-way: source → workspace, never back.
+ *
+ * Refreshed on every call — the claude adapter mounts per spawn — so edits to
+ * the source still reach the agent on its next turn. Only directories carrying
+ * MOUNT_MARKER are refreshed; anything else in the slot is reported as a
+ * conflict and left untouched.
+ *
+ * Legacy symlinks written by CLI ≤0.1.4 are replaced with a snapshot, since
+ * the symlink IS the vulnerable shape being retired.
  *
  * `envFileDir` is the directory of the env file (used to resolve relative
  * skill paths). Optional — when omitted, relative paths fall back to
- * `workspacePath`. Pass it from `performAttach` for attach-time resolution
- * matching the env file's location.
+ * `workspacePath`.
  *
- * Returns `{ linked, skipped, conflicted }`:
- *   - `linked`:     string[]            — newly created symlinks (absolute source paths)
- *   - `skipped`:    string[]            — already correctly linked (no-op)
+ * Returns `{ mounted, conflicted }`:
+ *   - `mounted`:    string[]            — absolute source paths snapshotted
  *   - `conflicted`: Array<{path, reason}> where reason ∈
- *       'different-target' | 'not-symlink' | 'missing-source'
+ *       'not-a-mount' | 'missing-source'
  */
-export const linkSkills = async (spec, workspacePath, envFileDir = null) => {
+export const mountSkills = async (spec, workspacePath, envFileDir = null) => {
   const sources = Array.isArray(spec?.skills?.claude) ? spec.skills.claude : [];
-  const linked = [];
-  const skipped = [];
+  const mounted = [];
   const conflicted = [];
-  if (sources.length === 0) return { linked, skipped, conflicted };
+  if (sources.length === 0) return { mounted, conflicted };
 
   const skillsDir = join(workspacePath, '.claude', 'skills');
   await mkdir(skillsDir, { recursive: true });
@@ -280,47 +327,43 @@ export const linkSkills = async (spec, workspacePath, envFileDir = null) => {
       conflicted.push({ path: absSource, reason: 'missing-source' });
       continue;
     }
-    const linkPath = join(skillsDir, basename(absSource));
+    const destPath = join(skillsDir, basename(absSource));
 
-    let existingTarget = null;
-    let slotIsNonSymlink = false;
+    let slot = null;
     try {
       // eslint-disable-next-line no-await-in-loop
-      const stat = await lstat(linkPath);
-      if (stat.isSymbolicLink()) {
-        // eslint-disable-next-line no-await-in-loop
-        existingTarget = await readlink(linkPath);
-      } else {
-        slotIsNonSymlink = true;
-      }
+      slot = await lstat(destPath);
     } catch (err) {
       // Only ENOENT means "slot is free, proceed." EACCES / EPERM / EIO are
-      // real failures that should surface — without this narrowing the
-      // subsequent symlink() call fails with a confusing follow-on error.
+      // real failures that should surface rather than becoming a confusing
+      // follow-on error from the copy below.
       if (err.code !== 'ENOENT') throw err;
     }
 
-    if (slotIsNonSymlink) {
-      conflicted.push({ path: absSource, reason: 'not-symlink' });
-      continue;
-    }
-
-    if (existingTarget) {
-      const resolvedExisting = isAbsolute(existingTarget)
-        ? existingTarget
-        : pathResolve(skillsDir, existingTarget);
-      if (resolvedExisting === absSource) {
-        skipped.push(absSource);
+    if (slot) {
+      const isLegacySymlink = slot.isSymbolicLink();
+      const isOwnedMount = slot.isDirectory() && existsSync(join(destPath, MOUNT_MARKER));
+      if (!isLegacySymlink && !isOwnedMount) {
+        // A real file, or a directory we did not create — user content.
+        conflicted.push({ path: absSource, reason: 'not-a-mount' });
         continue;
       }
-      conflicted.push({ path: absSource, reason: 'different-target' });
-      continue;
+      // eslint-disable-next-line no-await-in-loop
+      await rm(destPath, { recursive: true, force: true });
     }
 
     // eslint-disable-next-line no-await-in-loop
-    await symlink(absSource, linkPath);
-    linked.push(absSource);
+    await cp(absSource, destPath, { recursive: true });
+    // eslint-disable-next-line no-await-in-loop
+    await writeFile(
+      join(destPath, MOUNT_MARKER),
+      `mounted-from: ${absSource}\n`,
+      'utf8',
+    );
+    // eslint-disable-next-line no-await-in-loop
+    await freezeFiles(destPath);
+    mounted.push(absSource);
   }
 
-  return { linked, skipped, conflicted };
+  return { mounted, conflicted };
 };

package/src/lib/sandbox/bwrap.js

@@ -117,6 +117,17 @@ export const wrapArgvWithBwrap = (innerArgv, env, opts = {}) => {
     flags.push('--bind-try', p, p);
   }
 
+  // Adapter-owned transient inputs (for example Claude's per-spawn MCP
+  // config) live outside the workspace so model-visible Read(./**) cannot
+  // reach them. Bind only the exact directories the adapter prepared; they
+  // remain read-only inside the namespace and disappear after the spawn.
+  for (const p of opts.readOnlyPaths || []) {
+    if (!p || !isAbsolute(p)) {
+      throw new Error('wrapArgvWithBwrap opts.readOnlyPaths entries must be absolute paths');
+    }
+    flags.push('--ro-bind', p, p);
+  }
+
   flags.push('--bind', opts.workspacePath, opts.workspacePath);
   flags.push('--chdir', opts.workspacePath);
   flags.push('--setenv', 'HOME', opts.workspacePath);