@commonlyai/cli 0.1.233 → 0.1.235

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.233",
+  "version": "0.1.235",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -89,7 +89,7 @@ import { createClaimedWorkGate } from '../lib/claimed-work-gate.js';
 import { prepareCommitAttribution } from '../lib/commit-attribution.js';
 import { detectBwrap } from '../lib/sandbox/bwrap.js';
 import { resolvePublicSandboxMode } from '../lib/sandbox/mode.js';
-import { hostSandboxRefusal, windowsSandboxMessage } from '../lib/sandbox/host-check.js';
+import { UNSANDBOXED_FLAG, hostSandboxRefusal, windowsSandboxMessage } from '../lib/sandbox/host-check.js';
 import {
   UNSANDBOXED_NOTICE, hostUnconfinedForRun, runOptedInUnsandboxed, unsandboxedFlagRefusal,
 } from '../lib/sandbox/windows-unsandboxed.js';
@@ -134,6 +134,7 @@ import {
   peerHoldsFrame,
   resolveCascadeSettings,
 } from '../lib/enforcement.js';
+import { buildReplyReceipt } from '../lib/reply-receipt.js';
 
 const isPodFocusDiagnostic = (error) => (
   typeof error?.code === 'string'
@@ -1175,6 +1176,8 @@ export const performAttach = async ({
   log = () => {},
   adapterRegistry = { getAdapter, listAdapterNames },
   seatbelt: probeSeatbelt = detectSeatbelt,
+  bwrap: probeBwrap = detectBwrap,
+  platform = process.platform,
 }) => {
   const adapter = adapterRegistry.getAdapter(adapterName);
   if (!adapter) {
@@ -1209,10 +1212,37 @@ export const performAttach = async ({
     }
     log(`workspace: ${workspace.path}${workspace.created ? ' (created)' : ''}`);
 
-    const { mode: sandboxMode } = resolveAttachSandbox({ environment, adapterName, adapter });
+    const { mode: sandboxMode } = resolveAttachSandbox({ environment, adapterName, adapter, platform });
+    // D245: native Windows has neither sandbox, so its refusal names Windows
+    // and the user's own opt-in, never Seatbelt or bwrap advice. Attach still
+    // refuses there, as before; only the words differ.
+    const windowsRefusal = () => new Error(adapterName === 'dsh'
+      ? `confined dsh sandbox.mode=${sandboxMode} needs a sandbox, and Commonly has no sandbox for Windows yet, `
+        + 'so dsh cannot run confined on native Windows. Choose "Run it here" on the Connect page for a hosted agent.'
+      : `This environment file asks for sandbox.mode=${sandboxMode}, which Commonly cannot enforce on Windows, `
+        + 'so attach stops here.\n'
+        // This attach made no agent, so Claude's options name the path that works on
+        // Windows: the Connect page's commands, which set the two env vars and run with
+        // the flag, keeping the public trust and policy (#3407 review B1). Other
+        // adapters keep the shared Windows text.
+        + (adapterName === 'claude' ? [
+          'Instead:',
+          '  - Run it without an OS sandbox, which is your choice: use the commands on the Connect page.'
+            + ' They set COMMONLY_API_URL and COMMONLY_AGENT_TOKEN, then run'
+            + ` commonly agent run <name> --adapter claude ${UNSANDBOXED_FLAG}.`
+            + " It keeps Commonly's restricted tool settings and gets no shell, but nothing at the OS level"
+            + ' confines it, and it gets no connector grants.'
+            // agent run prefers a saved record over the page's env vars, so an
+            // older record of that name would run with its own settings (#3407).
+            + ' If this computer already has an agent saved under that name, the run uses that one and its'
+            + ' settings instead: remove it first with commonly agent detach <name> --force.',
+          '  - Use Commonly from your own Claude Code sessions: the Connect page shows a PowerShell `claude mcp add` command.',
+          '  - A hosted agent: choose "Run it here" on the Connect page. Nothing runs on this machine.',
+        ].join('\n') : windowsSandboxMessage(adapterName)));
     if (sandboxMode === 'bwrap') {
-      const bwrap = detectBwrap();
+      const bwrap = probeBwrap();
       if (!bwrap.available) {
+        if (platform === 'win32') throw windowsRefusal();
         throw new Error(`sandbox.mode=bwrap requested but unavailable: ${bwrap.error}`);
       }
       if (environment.sandbox?.network?.policy === 'restricted') {
@@ -1238,6 +1268,7 @@ export const performAttach = async ({
           || adapterName;
         const seatbelt = probeSeatbelt();
         if (!seatbelt.available) {
+          if (platform === 'win32') throw windowsRefusal();
           // dsh refuses bwrap, so it gets no Linux hint that leads to a second refusal.
           throw new Error(adapterName === 'dsh'
             ? `confined dsh sandbox.mode=${sandboxMode} requires macOS Seatbelt: ${seatbelt.error}.`
@@ -2296,6 +2327,8 @@ export const performRun = ({
       ? { mounted: serverSkills.mounted, conflicted: serverSkills.conflicted, ...(skillReadUnavailable ? { status: 'unavailable' } : {}) }
       : null;
     let spawnCompleted = false;
+    // D245 item 4: how long the runtime ran, for the reply receipt.
+    let spawnDurationMs;
     let observedSpawn = false;
     let commitAttribution = null;
     try {
@@ -2364,7 +2397,9 @@ export const performRun = ({
       };
       // Supervised or plain, a failure is thrown exactly as the adapter's own
       // would be, so the run loop's classification and retry apply unchanged.
+      const spawnStartedAt = Date.now();
       result = await turn.run(adapter, spawnPrompt, spawnCtx);
+      spawnDurationMs = Date.now() - spawnStartedAt;
       spawnCompleted = true;
     } finally {
       try {
@@ -2551,6 +2586,12 @@ export const performRun = ({
           maxChunks: maxChatChunks,
           uploadName: `${agentName}-reply-${event._id}.md`,
           log: (line) => log(`[${event.type}] ${line}`),
+          // D245 item 4: the wrapper's own account of this turn.
+          receipt: buildReplyReceipt({
+            adapterName: adapter.name,
+            stats: result.stats,
+            durationMs: spawnDurationMs,
+          }),
         });
       } catch (deliveryError) {
         // TASK-535: every rung threw, so the reply reached nobody. The throw

package/src/commands/daemon.js

@@ -300,6 +300,34 @@ export const resolveAdapterForRuntime = async (runtime, registry = { getAdapter
   return null;
 };
 
+/**
+ * The daemon's first poll and heartbeat, with the Windows launcher watch armed
+ * BEFORE them (D245). Arming first puts the EPIPE guard on stdout and stderr
+ * before any supervision log line, and a launcher that is already gone stops
+ * the daemon here instead of after a tick logged into a dead pipe. Returns
+ * false when the daemon should not go on to its timers.
+ */
+export const firstSupervisionPass = async ({
+  supervisor,
+  onLauncherGone,
+  isEnded = () => false,
+  armLauncherWatch = watchWindowsLauncher,
+}) => {
+  let launcherGone = false;
+  armLauncherWatch({
+    onGone: (pid) => {
+      launcherGone = true;
+      onLauncherGone(pid);
+    },
+  });
+  const stopped = () => launcherGone || isEnded();
+  if (stopped()) return false;
+  await supervisor.tick();
+  if (stopped()) return false;
+  await supervisor.heartbeat();
+  return !stopped();
+};
+
 export const registerDaemon = (program) => {
   const daemon = program.command('daemon').description('Manage the local Commonly daemon');
 
@@ -654,10 +682,26 @@ Examples:
         });
 
         stampLog(`daemon supervising for ${record.machineName} — poll ${opts.poll}ms, heartbeat ${opts.heartbeat}ms (ctrl+c to stop)`);
-        await supervisor.tick();
-        if (terminalEnded) return;
-        await supervisor.heartbeat();
-        if (terminalEnded) return;
+        const shutdown = () => {
+          stampLog('daemon stopping — terminating supervised agents');
+          clearInterval(pollTimer);
+          clearInterval(heartbeatTimer);
+          supervisor.stop();
+          process.exit(0);
+        };
+        // D245: under the Windows launcher, the launcher's exit is the stop
+        // signal. Armed before the first tick, so the EPIPE guard covers its
+        // log lines and a launcher already gone stops the daemon at once.
+        const started = await firstSupervisionPass({
+          supervisor,
+          onLauncherGone: (pid) => {
+            // stdout and stderr already swallow EPIPE (armed with the watch).
+            try { stampLog(`launcher ${pid} has exited`); } catch { /* stdout is gone */ }
+            shutdown();
+          },
+          isEnded: () => terminalEnded,
+        });
+        if (!started) return;
         const runtimeFailure = (error) => {
           if (terminalEnded) return;
           terminalEnded = true;
@@ -669,23 +713,8 @@ Examples:
         };
         pollTimer = setInterval(() => { void supervisor.tick().catch(runtimeFailure); }, Number(opts.poll) || DEFAULT_POLL_MS);
         heartbeatTimer = setInterval(() => { void supervisor.heartbeat().catch(runtimeFailure); }, Number(opts.heartbeat) || DEFAULT_HEARTBEAT_MS);
-        const shutdown = () => {
-          stampLog('daemon stopping — terminating supervised agents');
-          clearInterval(pollTimer);
-          clearInterval(heartbeatTimer);
-          supervisor.stop();
-          process.exit(0);
-        };
         process.on('SIGINT', shutdown);
         process.on('SIGTERM', shutdown);
-        // D245: under the Windows launcher, the launcher's exit is the stop signal.
-        watchWindowsLauncher({
-          onGone: (pid) => {
-            // stdout and stderr already swallow EPIPE (armed with the watch).
-            try { stampLog(`launcher ${pid} has exited`); } catch { /* stdout is gone */ }
-            shutdown();
-          },
-        });
       } catch (error) {
         console.error(`Daemon run failed: ${error.message}`);
         const badConfig = !record || error.message.startsWith('Daemon credential file');

package/src/lib/adapters/claude.js

@@ -53,6 +53,7 @@ import { describeTurnReap, markTurn, turnReapEnabled } from '@commonlyai/seats/t
  */
 
 import { requireSeatModel, seatModelRequired } from './seat-model.js';
+import { claudeRunStats } from '../reply-receipt.js';
 import { spawn as childSpawn, spawnSync } from 'child_process';
 import { createHash, randomUUID } from 'crypto';
 import { accessSync, constants, realpathSync } from 'fs';
@@ -83,6 +84,7 @@ import {
 } from '../environment.js';
 import { detectBwrap, wrapArgvWithBwrap } from '../sandbox/bwrap.js';
 import { PUBLIC_SANDBOX_MODES, resolvePublicSandboxMode } from '../sandbox/mode.js';
+import { UNSANDBOXED_FLAG } from '../sandbox/host-check.js';
 import {
   publicClaudeStateRoot,
   wrapArgvWithSeatbelt,
@@ -1153,6 +1155,16 @@ const prepareArgv = async (innerArgv, ctx) => {
   // unconfined seat with a public record, which is how a record can claim
   // confinement it never applies.
   if (isConfinedTrust(sandboxTrust) && !publicNativeSandbox && sandboxMode !== 'bwrap') {
+    // D245: on native Windows, name Windows and the user's own opt-in, never
+    // macOS or bwrap advice (host-check passes an unrecognised mode through).
+    if ((ctx._platform || process.platform) === 'win32') {
+      throw new Error(
+        `${sandboxTrust} Claude agents run inside a sandbox, and Commonly has no sandbox it can enforce on Windows `
+        + `(got sandbox.mode=${JSON.stringify(sandboxMode)}). To run this agent without one, which is your choice, `
+        + `run commonly agent run <name> ${UNSANDBOXED_FLAG} (or commonly daemon install ${UNSANDBOXED_FLAG} for the agents `
+        + 'this computer\'s daemon runs), or choose "Run it here" on the Connect page for a hosted agent.',
+      );
+    }
     throw new Error(
       `${sandboxTrust} Claude agents require an enforced sandbox mode `
       + `(workspace or read-only on macOS, bwrap elsewhere), got ${JSON.stringify(sandboxMode)}`,
@@ -1521,6 +1533,8 @@ export default {
         text: turnReply(stdout, { credentials: spawnCredentials(spawnCtx), publicMcp: witnessedMcp }),
         newSessionId: sessionId,
         contextTokens,
+        // D245 item 4: what the run said about itself, for the reply receipt.
+        stats: claudeRunStats(stdout),
       };
     } catch (err) {
       // A public seat's refusal is not a session-store failure, whatever its
@@ -1591,6 +1605,7 @@ export default {
           text: turnReply(stdout, { credentials: spawnCredentials(retryCtx), publicMcp: witnessedMcp }),
           newSessionId: freshId,
           contextTokens,
+          stats: claudeRunStats(stdout),
         };
       }
       throw err;

package/src/lib/daemon-service-windows.js

@@ -201,7 +201,8 @@ const pidAlive = (pid) => {
  * keep running, unsupervised and invisible to the task (seen on windows-latest,
  * 11-04: a stopped task left its daemon checking in). A daemon started by the
  * launcher therefore polls the launcher's pid and calls `onGone` once it has
- * exited. Returns a stop function; does nothing outside the launcher.
+ * exited, at once if it is already gone when the watch is armed. Returns a
+ * stop function; does nothing outside the launcher.
  */
 export const watchWindowsLauncher = ({
   env = process.env,
@@ -221,6 +222,12 @@ export const watchWindowsLauncher = ({
   // swallow errors from the moment the watch is armed, not only after the
   // launcher's exit is noticed up to two seconds later.
   for (const stream of streams) stream?.on?.('error', () => {});
+  // Already gone when armed (the daemon is armed before its first tick): say
+  // so now, rather than after a poll and a heartbeat logged into a dead pipe.
+  if (!isAlive(pid)) {
+    onGone(pid);
+    return () => {};
+  }
   const timer = setIntervalFn(() => {
     if (isAlive(pid)) return;
     clearIntervalFn(timer);

package/src/lib/enforcement.js

@@ -668,6 +668,9 @@ export const deliverChatReply = async ({
   attachThreshold = 800,
   uploadName = 'reply.md',
   log = () => {},
+  // D245 item 4: how this reply was made (lib/reply-receipt.js). It rides
+  // the first message that actually reaches the pod and no later one.
+  receipt = null,
 }) => {
   const messagesPath = `/api/agents/runtime/pods/${podId}/messages`;
   const chunks = splitForChat(text, { limit });
@@ -697,7 +700,14 @@ export const deliverChatReply = async ({
   // override per delivery; a post that still fails throws to the next rung as
   // before. Nothing here loops.
   let freshnessOverride = false;
-  const postMessage = async (body) => {
+  let receiptDelivered = !receipt;
+  const postOnce = async (rawBody) => {
+    const body = receiptDelivered ? rawBody : { ...rawBody, receipt };
+    const response = await postGuarded(body);
+    if (response?.refused !== true && response?.skipped !== true) receiptDelivered = true;
+    return response;
+  };
+  const postGuarded = async (body) => {
     if (freshnessOverride) return client.post(messagesPath, { ...body, continueAnyway: true });
     try {
       return await client.post(messagesPath, body);
@@ -774,7 +784,7 @@ export const deliverChatReply = async ({
   // the gate (found by the fleet's implementation audit).
   const hasIndivisibleOversize = chunks.some((c) => c.length > attachThreshold);
   if (chunks.length <= 1 && !hasIndivisibleOversize) {
-    const response = await postMessage({ content: chunks[0] ?? text });
+    const response = await postOnce({ content: chunks[0] ?? text });
     if (undelivered(response)) return nonDelivery(response, 0, 1);
     return { mode: 'single', messages: 1 };
   }
@@ -782,7 +792,7 @@ export const deliverChatReply = async ({
     let messages = 0;
     for (const chunk of chunks) {
       // eslint-disable-next-line no-await-in-loop
-      const response = await postMessage({ content: chunk }); // in order, so the reply reads top-down
+      const response = await postOnce({ content: chunk }); // in order, so the reply reads top-down
       if (undelivered(response)) return nonDelivery(response, messages, chunks.length);
       messages += 1;
     }
@@ -802,7 +812,7 @@ export const deliverChatReply = async ({
     // fail at the root-id step before any continuation has posted.
     let posted = 0;
     try {
-      const rootRes = await postMessage({ content: chunks[0] });
+      const rootRes = await postOnce({ content: chunks[0] });
       if (undelivered(rootRes)) return nonDelivery(rootRes, 0, chunks.length);
       posted = 1;
       // The runtime route answers `res.json(result)` with the created row on
@@ -814,7 +824,7 @@ export const deliverChatReply = async ({
       if (!rootId) throw new Error('no message id in post response — cannot root the thread');
       for (const chunk of chunks.slice(1)) {
         // eslint-disable-next-line no-await-in-loop
-        const response = await postMessage({ content: chunk, threadRootId: String(rootId) });
+        const response = await postOnce({ content: chunk, threadRootId: String(rootId) });
         if (undelivered(response)) return nonDelivery(response, posted, chunks.length);
         posted += 1;
       }
@@ -829,7 +839,7 @@ export const deliverChatReply = async ({
         log(`thread continuation failed (${err.message}) — posting the remainder top-level`);
         for (const chunk of chunks.slice(posted)) {
           // eslint-disable-next-line no-await-in-loop
-          const response = await postMessage({ content: chunk });
+          const response = await postOnce({ content: chunk });
           if (undelivered(response)) return nonDelivery(response, posted, chunks.length);
           posted += 1;
         }
@@ -855,7 +865,7 @@ export const deliverChatReply = async ({
     const lead = chunks[0] && chunks[0].length <= limit
       ? chunks[0]
       : '(reply too large for chat — attached in full)';
-    const response = await postMessage({ content: `${lead}\n\n${directive}` });
+    const response = await postOnce({ content: `${lead}\n\n${directive}` });
     if (undelivered(response)) return nonDelivery(response, 0, 1);
     return { mode: 'attach', messages: 1 };
   } catch (err) {
@@ -863,7 +873,7 @@ export const deliverChatReply = async ({
     let messages = 0;
     for (const chunk of chunks) {
       // eslint-disable-next-line no-await-in-loop
-      const response = await postMessage({ content: chunk });
+      const response = await postOnce({ content: chunk });
       if (undelivered(response)) return nonDelivery(response, messages, chunks.length);
       messages += 1;
     }

package/src/lib/reply-receipt.js

@@ -0,0 +1,53 @@
+// D245 item 4: the receipt the wrapper posts with a reply, so a BYO reply
+// carries "how this reply was made" the way a hosted reply has its run trace.
+// It is the wrapper's own account and the server stores it as self-reported
+// (backend/services/byoReceipt.ts), which also bounds and checks every field.
+// This side keeps to what it actually observed: an adapter that reports no
+// stats sends only its name and the measured duration.
+
+const isName = (value) => typeof value === 'string' && value.length > 0;
+const isCount = (value) => Number.isInteger(value) && value >= 0;
+
+const parseLine = (raw) => {
+  try { return JSON.parse(raw); } catch { return null; }
+};
+
+/**
+ * What a Claude Code stream-json run says about itself: the model from the
+ * init event, the turn count from the result event, and each tool it called,
+ * once, in first-use order.
+ */
+export const claudeRunStats = (stdout) => {
+  const events = String(stdout || '').split('\n').map(parseLine).filter(Boolean);
+  const stats = {};
+  const init = events.find((event) => event.type === 'system' && event.subtype === 'init');
+  if (isName(init?.model)) stats.model = init.model;
+  const result = [...events].reverse().find((event) => event.type === 'result');
+  if (isCount(result?.num_turns)) stats.turns = result.num_turns;
+  const tools = [];
+  for (const event of events) {
+    if (event.type !== 'assistant') continue;
+    for (const block of event.message?.content || []) {
+      if (block?.type === 'tool_use' && isName(block.name) && !tools.includes(block.name)) tools.push(block.name);
+    }
+  }
+  if (tools.length) stats.tools = tools;
+  return stats;
+};
+
+/** The receipt for one reply, or null when there is no adapter to name. */
+export const buildReplyReceipt = ({ adapterName, stats = {}, durationMs } = {}) => {
+  if (!isName(adapterName)) return null;
+  const receipt = { adapter: adapterName };
+  // A cloud-hosted model can be named by an ARN or a resource path that
+  // carries the account or project it runs in; that is not this reply's to
+  // publish, so such a model id is left out.
+  if (isName(stats?.model) && !/^arn:|(^|\/)projects\//i.test(stats.model)) receipt.model = stats.model;
+  if (isCount(stats?.turns)) receipt.turns = stats.turns;
+  if (Array.isArray(stats?.tools)) {
+    const tools = stats.tools.filter(isName);
+    if (tools.length) receipt.tools = tools;
+  }
+  if (Number.isFinite(durationMs) && durationMs >= 0) receipt.durationMs = Math.round(durationMs);
+  return receipt;
+};

package/src/lib/sandbox/windows-unsandboxed.js

@@ -41,6 +41,7 @@ import { homedir } from 'os';
 import { join } from 'path';
 
 import { writeServiceFile } from '../daemon-service.js';
+import { effectiveSandboxTrust } from '../environment.js';
 import { UNSANDBOXED_FLAG } from './host-check.js';
 
 export { UNSANDBOXED_FLAG };
@@ -100,7 +101,9 @@ export const POLICY_ONLY_ADAPTERS = new Set(['claude']);
 export const hostUnconfinedForRun = ({
   optedIn, adapterName, environment, platform = process.platform,
 }) => {
-  const trust = environment?.sandbox?.trust;
+  // The effective trust, as host-check.js and the claude adapter read it: a
+  // legacy `internal` record means `public`, so it gets the same opt-in.
+  const trust = effectiveSandboxTrust(environment?.sandbox?.trust);
   return platform === 'win32' && optedIn === true && POLICY_ONLY_ADAPTERS.has(adapterName)
     && (trust === 'public' || trust === 'workspace');
 };