@commonlyai/cli 0.1.231 → 0.1.232

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.231",
+  "version": "0.1.232",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/lib/adapters/opencode.js

@@ -21,6 +21,7 @@ import { observeSpawn, controlsFromArguments } from '../runtime-observation.js';
  */
 
 import { requireSeatModel, seatModelRequired } from './seat-model.js';
+import { isPatchAfterNewestTested } from './tested-version.js';
 import { spawn as childSpawn, spawnSync } from 'child_process';
 import { createHash } from 'crypto';
 import { realpathSync } from 'fs';
@@ -729,16 +730,21 @@ export default {
     if (!TESTED_OPENCODE_VERSIONS.includes(installedVersion)) {
       const mismatch = describeOpenCodeVersionMismatch(installedVersion);
       const allowOverride = process.env[ALLOW_UNTESTED_OPENCODE_VERSION_ENV] === '1';
-      if (isPublic && !allowOverride) {
+      const patchAfterTested = isPatchAfterNewestTested(installedVersion, TESTED_OPENCODE_VERSIONS);
+      if (isPublic && !allowOverride && !patchAfterTested) {
         throw new Error(
           `Public OpenCode seats refuse to run: ${mismatch}. `
           + `To override from the host process, set ${ALLOW_UNTESTED_OPENCODE_VERSION_ENV}=1.`,
         );
       }
+      let outcome = 'trusted seat continues';
+      if (isPublic) {
+        outcome = allowOverride
+          ? `continuing because the host process set ${ALLOW_UNTESTED_OPENCODE_VERSION_ENV}=1`
+          : 'a patch release on the newest smoke-tested line, so the public seat continues';
+      }
       // eslint-disable-next-line no-console
-      console.warn(isPublic
-        ? `[opencode] ${mismatch}; continuing because the host process set ${ALLOW_UNTESTED_OPENCODE_VERSION_ENV}=1`
-        : `[opencode] ${mismatch}; trusted seat continues`);
+      console.warn(`[opencode] ${mismatch}; ${outcome}`);
     }
 
     const fullPrompt = buildMemoryPreamble(prompt, ctx.memoryLongTerm, {

package/src/lib/adapters/qwen.js

@@ -1,5 +1,6 @@
 /** Qwen Code 0.25.1 and 0.26.2 wrapper. Public turns have fresh HOME, config and keys. */
 import { requireSeatModel } from './seat-model.js';
+import { isPatchAfterNewestTested } from './tested-version.js';
 import { spawn as childSpawn, spawnSync } from 'child_process';
 import { lstatSync, realpathSync } from 'fs';
 import { chmod, mkdtemp, readFile, rm, writeFile } from 'fs/promises';
@@ -259,11 +260,15 @@ export default {
     });
     if (!TESTED_QWEN_VERSIONS.includes(version)) {
       const versions = TESTED_QWEN_VERSIONS.join(', ');
-      if (isPublic && process.env[ALLOW_UNTESTED_QWEN_VERSION_ENV] !== '1') {
+      const allowOverride = process.env[ALLOW_UNTESTED_QWEN_VERSION_ENV] === '1';
+      const patchAfterTested = isPatchAfterNewestTested(version, TESTED_QWEN_VERSIONS);
+      if (isPublic && !allowOverride && !patchAfterTested) {
         throw new Error(`Public Qwen seats refuse version ${version || 'unknown'}; smoke-tested: ${versions}. Set ${ALLOW_UNTESTED_QWEN_VERSION_ENV}=1 in the host process to override.`);
       }
+      let outcome = 'trusted seat continues';
+      if (isPublic) outcome = allowOverride ? 'host override accepted' : 'a patch release on the newest smoke-tested line, so the public seat continues';
       // eslint-disable-next-line no-console
-      console.warn(`[qwen] installed ${version || 'unknown'} differs from smoke-tested ${versions}; ${isPublic ? 'host override accepted' : 'trusted seat continues'}`);
+      console.warn(`[qwen] installed ${version || 'unknown'} differs from smoke-tested ${versions}; ${outcome}`);
     }
     // npm launches through a symlink into the package. Qwen loads chunks next
     // to that entry file, so public sandboxes need that exact read-only tree.

package/src/lib/adapters/tested-version.js

@@ -0,0 +1,16 @@
+// Public seats run only on a harness version smoke-tested in its sandbox, with
+// one tolerance: a stable patch release after the newest tested one, on that
+// same major.minor line. Harnesses ship patches every few days, and refusing
+// them refused every new BYO user on the current npm release (D245, 11-04).
+// A newer minor or major, an older patch, an older line, or a prerelease still
+// refuses until it is smoke-tested and added to the adapter's list.
+const STABLE = /^(\d+)\.(\d+)\.(\d+)$/;
+
+export const isPatchAfterNewestTested = (version, tested) => {
+  const installed = STABLE.exec(String(version || ''));
+  const newest = STABLE.exec(String(tested[tested.length - 1] || ''));
+  if (!installed || !newest) return false;
+  return Number(installed[1]) === Number(newest[1])
+    && Number(installed[2]) === Number(newest[2])
+    && Number(installed[3]) > Number(newest[3]);
+};