@commonlyai/cli 0.1.230 → 0.1.232

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.230",
+  "version": "0.1.232",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/lib/adapters/opencode.js

@@ -21,6 +21,7 @@ import { observeSpawn, controlsFromArguments } from '../runtime-observation.js';
  */
 
 import { requireSeatModel, seatModelRequired } from './seat-model.js';
+import { isPatchAfterNewestTested } from './tested-version.js';
 import { spawn as childSpawn, spawnSync } from 'child_process';
 import { createHash } from 'crypto';
 import { realpathSync } from 'fs';
@@ -729,16 +730,21 @@ export default {
     if (!TESTED_OPENCODE_VERSIONS.includes(installedVersion)) {
       const mismatch = describeOpenCodeVersionMismatch(installedVersion);
       const allowOverride = process.env[ALLOW_UNTESTED_OPENCODE_VERSION_ENV] === '1';
-      if (isPublic && !allowOverride) {
+      const patchAfterTested = isPatchAfterNewestTested(installedVersion, TESTED_OPENCODE_VERSIONS);
+      if (isPublic && !allowOverride && !patchAfterTested) {
         throw new Error(
           `Public OpenCode seats refuse to run: ${mismatch}. `
           + `To override from the host process, set ${ALLOW_UNTESTED_OPENCODE_VERSION_ENV}=1.`,
         );
       }
+      let outcome = 'trusted seat continues';
+      if (isPublic) {
+        outcome = allowOverride
+          ? `continuing because the host process set ${ALLOW_UNTESTED_OPENCODE_VERSION_ENV}=1`
+          : 'a patch release on the newest smoke-tested line, so the public seat continues';
+      }
       // eslint-disable-next-line no-console
-      console.warn(isPublic
-        ? `[opencode] ${mismatch}; continuing because the host process set ${ALLOW_UNTESTED_OPENCODE_VERSION_ENV}=1`
-        : `[opencode] ${mismatch}; trusted seat continues`);
+      console.warn(`[opencode] ${mismatch}; ${outcome}`);
     }
 
     const fullPrompt = buildMemoryPreamble(prompt, ctx.memoryLongTerm, {

package/src/lib/adapters/qwen.js

@@ -1,5 +1,6 @@
 /** Qwen Code 0.25.1 and 0.26.2 wrapper. Public turns have fresh HOME, config and keys. */
 import { requireSeatModel } from './seat-model.js';
+import { isPatchAfterNewestTested } from './tested-version.js';
 import { spawn as childSpawn, spawnSync } from 'child_process';
 import { lstatSync, realpathSync } from 'fs';
 import { chmod, mkdtemp, readFile, rm, writeFile } from 'fs/promises';
@@ -259,11 +260,15 @@ export default {
     });
     if (!TESTED_QWEN_VERSIONS.includes(version)) {
       const versions = TESTED_QWEN_VERSIONS.join(', ');
-      if (isPublic && process.env[ALLOW_UNTESTED_QWEN_VERSION_ENV] !== '1') {
+      const allowOverride = process.env[ALLOW_UNTESTED_QWEN_VERSION_ENV] === '1';
+      const patchAfterTested = isPatchAfterNewestTested(version, TESTED_QWEN_VERSIONS);
+      if (isPublic && !allowOverride && !patchAfterTested) {
         throw new Error(`Public Qwen seats refuse version ${version || 'unknown'}; smoke-tested: ${versions}. Set ${ALLOW_UNTESTED_QWEN_VERSION_ENV}=1 in the host process to override.`);
       }
+      let outcome = 'trusted seat continues';
+      if (isPublic) outcome = allowOverride ? 'host override accepted' : 'a patch release on the newest smoke-tested line, so the public seat continues';
       // eslint-disable-next-line no-console
-      console.warn(`[qwen] installed ${version || 'unknown'} differs from smoke-tested ${versions}; ${isPublic ? 'host override accepted' : 'trusted seat continues'}`);
+      console.warn(`[qwen] installed ${version || 'unknown'} differs from smoke-tested ${versions}; ${outcome}`);
     }
     // npm launches through a symlink into the package. Qwen loads chunks next
     // to that entry file, so public sandboxes need that exact read-only tree.

package/src/lib/adapters/tested-version.js

@@ -0,0 +1,16 @@
+// Public seats run only on a harness version smoke-tested in its sandbox, with
+// one tolerance: a stable patch release after the newest tested one, on that
+// same major.minor line. Harnesses ship patches every few days, and refusing
+// them refused every new BYO user on the current npm release (D245, 11-04).
+// A newer minor or major, an older patch, an older line, or a prerelease still
+// refuses until it is smoke-tested and added to the adapter's list.
+const STABLE = /^(\d+)\.(\d+)\.(\d+)$/;
+
+export const isPatchAfterNewestTested = (version, tested) => {
+  const installed = STABLE.exec(String(version || ''));
+  const newest = STABLE.exec(String(tested[tested.length - 1] || ''));
+  if (!installed || !newest) return false;
+  return Number(installed[1]) === Number(newest[1])
+    && Number(installed[2]) === Number(newest[2])
+    && Number(installed[3]) > Number(newest[3]);
+};

package/src/lib/git-remote-commonly.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+/** Push-only Git remote helper for a confined host seat. No provider credential enters this process. */
+import { spawn } from 'child_process';
+import { connect } from 'net';
+import { mkdtemp, readFile, rm } from 'fs/promises';
+import { createInterface } from 'readline';
+import { join } from 'path';
+
+const MAX_BUNDLE_BYTES = 6 * 1024 * 1024;
+const OID = /^[0-9a-f]{40}$/;
+const REF = /^refs\/heads\/seat\/[A-Za-z0-9._/-]+$/;
+const grantId = String(process.argv[3] || '').replace(/^commonly::/, '');
+
+const git = (args) => new Promise((resolve, reject) => {
+  const child = spawn('git', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+  let stdout = '';
+  let stderr = '';
+  child.stdout.on('data', (chunk) => { stdout += chunk; if (stdout.length > 4096) child.kill(); });
+  child.stderr.on('data', (chunk) => { stderr += chunk; if (stderr.length > 4096) child.kill(); });
+  child.on('error', reject);
+  child.on('close', (code) => (code === 0 ? resolve(stdout.trim()) : reject(new Error(stderr.trim() || 'git command failed'))));
+});
+
+const broker = (args) => new Promise((resolve, reject) => {
+  const path = process.env.COMMONLY_GH_SOCKET;
+  if (!path?.startsWith('/')) return reject(new Error('seat GitHub broker is unavailable'));
+  const socket = connect(path);
+  const chunks = [];
+  let bytes = 0;
+  socket.setTimeout(185_000, () => socket.destroy(new Error('push broker timed out')));
+  socket.on('connect', () => socket.end(JSON.stringify({ grantId, operation: 'push.branch', args })));
+  socket.on('data', (chunk) => {
+    bytes += chunk.length;
+    if (bytes > 128 * 1024) socket.destroy(new Error('push broker response is too large'));
+    else chunks.push(chunk);
+  });
+  socket.on('error', reject);
+  socket.on('end', () => {
+    try { resolve(JSON.parse(Buffer.concat(chunks).toString('utf8'))); } catch {
+      reject(new Error('push broker response is invalid'));
+    }
+  });
+});
+
+const push = async (commands) => {
+  if (commands.length !== 1 || !commands[0].startsWith('push ')) {
+    throw new Error('exactly one branch push is allowed');
+  }
+  const spec = commands[0].slice(5);
+  if (spec.startsWith('+') || spec.split(':').length !== 2) throw new Error('force and deletion are not allowed');
+  const [source, ref] = spec.split(':');
+  if (!/^(HEAD|refs\/heads\/[A-Za-z0-9._/-]+)$/.test(source)
+    || !REF.test(ref) || ref.includes('..') || ref.endsWith('.lock') || ref.endsWith('.')) {
+    throw new Error('branch ref is not allowed');
+  }
+  const newOid = await git(['rev-parse', '--verify', `${source}^{commit}`]);
+  const baseOid = await git(['merge-base', newOid, 'refs/remotes/origin/main']);
+  if (!OID.test(newOid) || !OID.test(baseOid)) throw new Error('invalid local commit');
+  const gitPath = await git(['rev-parse', '--git-path', 'commonly-push']);
+  const directory = await mkdtemp(`${gitPath}-`);
+  try {
+    const file = join(directory, 'push.bundle');
+    await git(['bundle', 'create', file, source, `^${baseOid}`]);
+    const bundle = await readFile(file);
+    if (bundle.length > MAX_BUNDLE_BYTES) throw new Error('push bundle exceeds 6 MiB');
+    const answer = await broker({ ref, baseOid, newOid, bundle: bundle.toString('base64') });
+    if (answer.status !== 200) throw new Error(answer.body?.error || 'broker refused push');
+    return ref;
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+};
+
+const main = async () => {
+  if (!/^[A-Za-z0-9_-]{1,128}$/.test(grantId)) throw new Error('invalid broker grant id');
+  const lines = createInterface({ input: process.stdin, crlfDelay: Infinity });
+  let batch = [];
+  for await (const line of lines) {
+    if (line === 'capabilities') {
+      process.stdout.write('push\n\n');
+    } else if (line === 'list for-push') {
+      process.stdout.write('\n');
+    } else if (line.startsWith('push ')) {
+      batch.push(line);
+    } else if (line === '' && batch.length) {
+      const ref = batch[0].split(':').at(-1);
+      try {
+        const accepted = await push(batch);
+        process.stdout.write(`ok ${accepted}\n\n`);
+      } catch (error) {
+        process.stdout.write(`error ${ref} ${String(error.message).replace(/[\r\n]/g, ' ')}\n\n`);
+      }
+      batch = [];
+    } else if (line !== '') {
+      throw new Error('unsupported Git remote command');
+    }
+  }
+};
+
+main().catch((error) => { process.stderr.write(`${error.message}\n`); process.exitCode = 2; });

package/src/lib/host-gh-broker.js

@@ -0,0 +1,152 @@
+/**
+ * Per-spawn GitHub command bridge for a confined host seat. The socket carries
+ * no secret: its trusted owner holds the runtime token and chooses the backend
+ * URL. The Codex permission profile must allow only this seat's exact socket.
+ */
+import { createServer } from 'net';
+import { chmod, lstat, mkdir, mkdtemp, readFile, rm, writeFile } from 'fs/promises';
+import { homedir } from 'os';
+import { fileURLToPath } from 'url';
+import { join, resolve } from 'path';
+
+const MAX_REQUEST_BYTES = 64 * 1024;
+const MAX_RESPONSE_BYTES = 128 * 1024;
+const SHIM_SOURCE = fileURLToPath(new URL('./host-gh-shim.mjs', import.meta.url));
+const PUSH_HELPER_SOURCE = fileURLToPath(new URL('./git-remote-commonly.mjs', import.meta.url));
+const MAX_PUSH_REQUEST_BYTES = 9 * 1024 * 1024;
+
+const reply = (socket, status, body) => {
+  if (!socket.destroyed) socket.end(JSON.stringify({ status, body }));
+};
+
+export const startSeatGhBroker = async ({
+  runtimeToken, instanceUrl, shimRoot, fetchImpl = fetch,
+  root = join(homedir(), '.commonly', 'host-gh'),
+}) => {
+  if (typeof runtimeToken !== 'string' || !runtimeToken.startsWith('cm_agent_')) {
+    throw new Error('host GitHub broker requires a runtime token');
+  }
+  const endpoint = new URL(instanceUrl);
+  if (!['https:', 'http:'].includes(endpoint.protocol) || endpoint.username || endpoint.password) {
+    throw new Error('host GitHub broker requires an HTTP instance URL');
+  }
+  if (endpoint.protocol === 'http:' && !['localhost', '127.0.0.1', '[::1]'].includes(endpoint.hostname)) {
+    throw new Error('host GitHub broker requires HTTPS outside localhost');
+  }
+  if (typeof shimRoot !== 'string' || !shimRoot) {
+    throw new Error('host GitHub broker requires a seat-visible shim root');
+  }
+  if (resolve(shimRoot) === resolve(root)) {
+    throw new Error('host GitHub shims cannot share the protected socket root');
+  }
+  await mkdir(root, { recursive: true, mode: 0o700 });
+  const rootStats = await lstat(root);
+  if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) {
+    throw new Error('host GitHub broker root must be a real directory');
+  }
+  await chmod(root, 0o700);
+  const shimRootStats = await lstat(shimRoot);
+  if (!shimRootStats.isDirectory() || shimRootStats.isSymbolicLink()) {
+    throw new Error('host GitHub shim root must be a real directory');
+  }
+  let socketDirectory;
+  let directory;
+  let server;
+  const connections = new Set();
+  try {
+    socketDirectory = await mkdtemp(join(root, 'seat-'));
+    directory = await mkdtemp(join(shimRoot, '.commonly-gh-'));
+    const socketPath = join(socketDirectory, 'broker.sock');
+    const shimPath = join(directory, 'gh');
+    const pushHelperPath = join(directory, 'git-remote-commonly');
+    const shimSource = await readFile(SHIM_SOURCE, 'utf8');
+    await writeFile(shimPath, `#!${process.execPath}\n${shimSource.replace(/^#![^\n]*\n/, '')}`, { mode: 0o500 });
+    await chmod(shimPath, 0o555);
+    const helperSource = await readFile(PUSH_HELPER_SOURCE, 'utf8');
+    await writeFile(pushHelperPath, `#!${process.execPath}\n${helperSource.replace(/^#![^\n]*\n/, '')}`, { mode: 0o500 });
+    await chmod(pushHelperPath, 0o555);
+    server = createServer({ allowHalfOpen: true }, (socket) => {
+      connections.add(socket);
+      socket.on('close', () => connections.delete(socket));
+      let chunks = [];
+      let size = 0;
+      socket.setTimeout(15_000, () => socket.destroy());
+      socket.on('error', () => {});
+      socket.on('data', (chunk) => {
+        size += chunk.length;
+        if (size > MAX_PUSH_REQUEST_BYTES) {
+          reply(socket, 413, { error: 'request_too_large' });
+          chunks = [];
+        } else {
+          chunks.push(chunk);
+        }
+      });
+      socket.on('end', async () => {
+        if (socket.destroyed || size > MAX_PUSH_REQUEST_BYTES) return;
+        let request;
+        try { request = JSON.parse(Buffer.concat(chunks).toString('utf8')); } catch {
+          reply(socket, 400, { error: 'invalid_request' });
+          return;
+        }
+        const { grantId, operation, args } = request || {};
+        if (!/^[A-Za-z0-9_-]{1,128}$/.test(grantId)
+          || typeof operation !== 'string' || !args || typeof args !== 'object'
+          || Array.isArray(args) || Object.keys(request).some((key) => !['grantId', 'operation', 'args'].includes(key))) {
+          reply(socket, 400, { error: 'invalid_request' });
+          return;
+        }
+        if (operation !== 'push.branch' && size > MAX_REQUEST_BYTES) {
+          reply(socket, 413, { error: 'request_too_large' });
+          return;
+        }
+        if (operation === 'push.branch') socket.setTimeout(180_000, () => socket.destroy());
+        try {
+          const suffix = operation === 'push.branch' ? 'push' : 'cli';
+          const url = new URL(`/api/mcp/grants/${encodeURIComponent(grantId)}/${suffix}`, endpoint);
+          const response = await fetchImpl(url, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${runtimeToken}`, 'Content-Type': 'application/json' },
+            body: JSON.stringify(operation === 'push.branch' ? args : { operation, args }),
+            signal: AbortSignal.timeout(operation === 'push.branch' ? 180_000 : 15_000),
+          });
+          const bodyText = await response.text();
+          if (Buffer.byteLength(bodyText, 'utf8') > MAX_RESPONSE_BYTES) {
+            reply(socket, 502, { error: 'broker_response_too_large' });
+            return;
+          }
+          let body;
+          try { body = JSON.parse(bodyText); } catch { body = { error: 'broker_response_invalid' }; }
+          reply(socket, response.status, body);
+        } catch {
+          reply(socket, 502, { error: 'broker_unavailable' });
+        }
+      });
+    });
+    await new Promise((resolve, reject) => {
+      server.once('error', reject);
+      server.listen(socketPath, () => {
+        server.off('error', reject);
+        resolve();
+      });
+    });
+    return {
+      socketPath,
+      shimPath,
+      pushHelperPath,
+      directory,
+      socketDirectory,
+      async close() {
+        for (const socket of connections) socket.destroy();
+        await new Promise((resolve) => server.close(resolve));
+        await rm(directory, { recursive: true, force: true });
+        await rm(socketDirectory, { recursive: true, force: true });
+      },
+    };
+  } catch (error) {
+    for (const socket of connections) socket.destroy();
+    if (server?.listening) await new Promise((resolve) => server.close(resolve));
+    if (directory) await rm(directory, { recursive: true, force: true });
+    if (socketDirectory) await rm(socketDirectory, { recursive: true, force: true });
+    throw error;
+  }
+};

package/src/lib/host-gh-shim.mjs

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+/** Narrow gh-compatible entrypoint for confined Commonly host seats. */
+import { connect } from 'net';
+
+const fail = (message) => {
+  process.stderr.write(`${message}\n`);
+  process.exitCode = 2;
+};
+
+const parse = (argv) => {
+  const parts = [...argv];
+  const grantFlag = parts.indexOf('--grant-id');
+  if (grantFlag < 0 || grantFlag + 1 >= parts.length) throw new Error('pass --grant-id <grant>');
+  const [grantId] = parts.splice(grantFlag + 1, 1);
+  parts.splice(grantFlag, 1);
+  if (!/^[A-Za-z0-9_-]{1,128}$/.test(grantId)) throw new Error('invalid grant id');
+
+  const [area, action, ...rest] = parts;
+  let operation;
+  let requiredFlags = [];
+  let allowedFlags = [];
+  let numberField;
+  if (area === 'pr' && action === 'create') {
+    operation = 'pr.create';
+    requiredFlags = ['--title', '--head', '--base'];
+    allowedFlags = [...requiredFlags, '--body', '--draft'];
+  } else if (area === 'pr' && action === 'view') {
+    operation = 'pr.view'; numberField = 'pullNumber';
+  } else if (area === 'pr' && action === 'comment') {
+    operation = 'pr.comment'; numberField = 'pullNumber';
+    requiredFlags = ['--body']; allowedFlags = requiredFlags;
+  } else if (area === 'pr' && action === 'review') {
+    operation = 'pr.review_comment'; numberField = 'pullNumber';
+    requiredFlags = ['--comment', '--body']; allowedFlags = requiredFlags;
+  } else if (area === 'issue' && action === 'comment') {
+    operation = 'issue.comment'; numberField = 'issueNumber';
+    requiredFlags = ['--body']; allowedFlags = requiredFlags;
+  } else {
+    throw new Error('gh operation is not allowed for this seat');
+  }
+
+  const args = {};
+  if (numberField) {
+    const value = rest.shift();
+    if (!/^[1-9][0-9]*$/.test(value || '') || !Number.isSafeInteger(Number(value))) {
+      throw new Error('pass a positive issue or PR number');
+    }
+    args[numberField] = Number(value);
+  }
+  const flags = new Set();
+  while (rest.length) {
+    const flag = rest.shift();
+    if (!allowedFlags.includes(flag) || flags.has(flag)) throw new Error(`flag is not allowed: ${flag}`);
+    flags.add(flag);
+    if (flag === '--draft' || flag === '--comment') continue;
+    const value = rest.shift();
+    if (value === undefined || value.startsWith('--')) throw new Error(`missing value for ${flag}`);
+    if (value.length > 32 * 1024) throw new Error(`value is too long for ${flag}`);
+    args[flag.slice(2)] = value;
+  }
+  if (requiredFlags.some((flag) => !flags.has(flag))) throw new Error('required flag is missing');
+  if (flags.has('--draft')) args.draft = true;
+  return { grantId, operation, args };
+};
+
+const main = async () => {
+  const request = parse(process.argv.slice(2));
+  const socketPath = process.env.COMMONLY_GH_SOCKET;
+  if (!socketPath || !socketPath.startsWith('/')) throw new Error('seat GitHub broker is unavailable');
+  const answer = await new Promise((resolve, reject) => {
+    const socket = connect(socketPath);
+    const chunks = [];
+    let size = 0;
+    socket.setTimeout(20_000, () => socket.destroy(new Error('seat GitHub broker timed out')));
+    socket.on('connect', () => socket.end(JSON.stringify(request)));
+    socket.on('data', (chunk) => {
+      size += chunk.length;
+      if (size > 128 * 1024) socket.destroy(new Error('seat GitHub response is too large'));
+      else chunks.push(chunk);
+    });
+    socket.on('error', reject);
+    socket.on('end', () => {
+      try { resolve(JSON.parse(Buffer.concat(chunks).toString('utf8'))); } catch {
+        reject(new Error('seat GitHub response is invalid'));
+      }
+    });
+  });
+  if (answer.status === 202 && answer.body?.status === 'pending_approval') {
+    process.stdout.write(`${JSON.stringify(answer.body, null, 2)}\n`);
+    return;
+  }
+  if (answer.status < 200 || answer.status >= 300) {
+    throw new Error(answer.body?.error || answer.body?.status || 'GitHub operation refused');
+  }
+  process.stdout.write(`${JSON.stringify(answer.body, null, 2)}\n`);
+};
+
+main().catch((error) => fail(error.message));