@commonlyai/cli 0.1.234 → 0.1.235

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.234",
+  "version": "0.1.235",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -89,7 +89,7 @@ import { createClaimedWorkGate } from '../lib/claimed-work-gate.js';
 import { prepareCommitAttribution } from '../lib/commit-attribution.js';
 import { detectBwrap } from '../lib/sandbox/bwrap.js';
 import { resolvePublicSandboxMode } from '../lib/sandbox/mode.js';
-import { hostSandboxRefusal, windowsSandboxMessage } from '../lib/sandbox/host-check.js';
+import { UNSANDBOXED_FLAG, hostSandboxRefusal, windowsSandboxMessage } from '../lib/sandbox/host-check.js';
 import {
   UNSANDBOXED_NOTICE, hostUnconfinedForRun, runOptedInUnsandboxed, unsandboxedFlagRefusal,
 } from '../lib/sandbox/windows-unsandboxed.js';
@@ -1176,6 +1176,8 @@ export const performAttach = async ({
   log = () => {},
   adapterRegistry = { getAdapter, listAdapterNames },
   seatbelt: probeSeatbelt = detectSeatbelt,
+  bwrap: probeBwrap = detectBwrap,
+  platform = process.platform,
 }) => {
   const adapter = adapterRegistry.getAdapter(adapterName);
   if (!adapter) {
@@ -1210,10 +1212,37 @@ export const performAttach = async ({
     }
     log(`workspace: ${workspace.path}${workspace.created ? ' (created)' : ''}`);
 
-    const { mode: sandboxMode } = resolveAttachSandbox({ environment, adapterName, adapter });
+    const { mode: sandboxMode } = resolveAttachSandbox({ environment, adapterName, adapter, platform });
+    // D245: native Windows has neither sandbox, so its refusal names Windows
+    // and the user's own opt-in, never Seatbelt or bwrap advice. Attach still
+    // refuses there, as before; only the words differ.
+    const windowsRefusal = () => new Error(adapterName === 'dsh'
+      ? `confined dsh sandbox.mode=${sandboxMode} needs a sandbox, and Commonly has no sandbox for Windows yet, `
+        + 'so dsh cannot run confined on native Windows. Choose "Run it here" on the Connect page for a hosted agent.'
+      : `This environment file asks for sandbox.mode=${sandboxMode}, which Commonly cannot enforce on Windows, `
+        + 'so attach stops here.\n'
+        // This attach made no agent, so Claude's options name the path that works on
+        // Windows: the Connect page's commands, which set the two env vars and run with
+        // the flag, keeping the public trust and policy (#3407 review B1). Other
+        // adapters keep the shared Windows text.
+        + (adapterName === 'claude' ? [
+          'Instead:',
+          '  - Run it without an OS sandbox, which is your choice: use the commands on the Connect page.'
+            + ' They set COMMONLY_API_URL and COMMONLY_AGENT_TOKEN, then run'
+            + ` commonly agent run <name> --adapter claude ${UNSANDBOXED_FLAG}.`
+            + " It keeps Commonly's restricted tool settings and gets no shell, but nothing at the OS level"
+            + ' confines it, and it gets no connector grants.'
+            // agent run prefers a saved record over the page's env vars, so an
+            // older record of that name would run with its own settings (#3407).
+            + ' If this computer already has an agent saved under that name, the run uses that one and its'
+            + ' settings instead: remove it first with commonly agent detach <name> --force.',
+          '  - Use Commonly from your own Claude Code sessions: the Connect page shows a PowerShell `claude mcp add` command.',
+          '  - A hosted agent: choose "Run it here" on the Connect page. Nothing runs on this machine.',
+        ].join('\n') : windowsSandboxMessage(adapterName)));
     if (sandboxMode === 'bwrap') {
-      const bwrap = detectBwrap();
+      const bwrap = probeBwrap();
       if (!bwrap.available) {
+        if (platform === 'win32') throw windowsRefusal();
         throw new Error(`sandbox.mode=bwrap requested but unavailable: ${bwrap.error}`);
       }
       if (environment.sandbox?.network?.policy === 'restricted') {
@@ -1239,6 +1268,7 @@ export const performAttach = async ({
           || adapterName;
         const seatbelt = probeSeatbelt();
         if (!seatbelt.available) {
+          if (platform === 'win32') throw windowsRefusal();
           // dsh refuses bwrap, so it gets no Linux hint that leads to a second refusal.
           throw new Error(adapterName === 'dsh'
             ? `confined dsh sandbox.mode=${sandboxMode} requires macOS Seatbelt: ${seatbelt.error}.`

package/src/commands/daemon.js

@@ -300,6 +300,34 @@ export const resolveAdapterForRuntime = async (runtime, registry = { getAdapter
   return null;
 };
 
+/**
+ * The daemon's first poll and heartbeat, with the Windows launcher watch armed
+ * BEFORE them (D245). Arming first puts the EPIPE guard on stdout and stderr
+ * before any supervision log line, and a launcher that is already gone stops
+ * the daemon here instead of after a tick logged into a dead pipe. Returns
+ * false when the daemon should not go on to its timers.
+ */
+export const firstSupervisionPass = async ({
+  supervisor,
+  onLauncherGone,
+  isEnded = () => false,
+  armLauncherWatch = watchWindowsLauncher,
+}) => {
+  let launcherGone = false;
+  armLauncherWatch({
+    onGone: (pid) => {
+      launcherGone = true;
+      onLauncherGone(pid);
+    },
+  });
+  const stopped = () => launcherGone || isEnded();
+  if (stopped()) return false;
+  await supervisor.tick();
+  if (stopped()) return false;
+  await supervisor.heartbeat();
+  return !stopped();
+};
+
 export const registerDaemon = (program) => {
   const daemon = program.command('daemon').description('Manage the local Commonly daemon');
 
@@ -654,10 +682,26 @@ Examples:
         });
 
         stampLog(`daemon supervising for ${record.machineName} — poll ${opts.poll}ms, heartbeat ${opts.heartbeat}ms (ctrl+c to stop)`);
-        await supervisor.tick();
-        if (terminalEnded) return;
-        await supervisor.heartbeat();
-        if (terminalEnded) return;
+        const shutdown = () => {
+          stampLog('daemon stopping — terminating supervised agents');
+          clearInterval(pollTimer);
+          clearInterval(heartbeatTimer);
+          supervisor.stop();
+          process.exit(0);
+        };
+        // D245: under the Windows launcher, the launcher's exit is the stop
+        // signal. Armed before the first tick, so the EPIPE guard covers its
+        // log lines and a launcher already gone stops the daemon at once.
+        const started = await firstSupervisionPass({
+          supervisor,
+          onLauncherGone: (pid) => {
+            // stdout and stderr already swallow EPIPE (armed with the watch).
+            try { stampLog(`launcher ${pid} has exited`); } catch { /* stdout is gone */ }
+            shutdown();
+          },
+          isEnded: () => terminalEnded,
+        });
+        if (!started) return;
         const runtimeFailure = (error) => {
           if (terminalEnded) return;
           terminalEnded = true;
@@ -669,23 +713,8 @@ Examples:
         };
         pollTimer = setInterval(() => { void supervisor.tick().catch(runtimeFailure); }, Number(opts.poll) || DEFAULT_POLL_MS);
         heartbeatTimer = setInterval(() => { void supervisor.heartbeat().catch(runtimeFailure); }, Number(opts.heartbeat) || DEFAULT_HEARTBEAT_MS);
-        const shutdown = () => {
-          stampLog('daemon stopping — terminating supervised agents');
-          clearInterval(pollTimer);
-          clearInterval(heartbeatTimer);
-          supervisor.stop();
-          process.exit(0);
-        };
         process.on('SIGINT', shutdown);
         process.on('SIGTERM', shutdown);
-        // D245: under the Windows launcher, the launcher's exit is the stop signal.
-        watchWindowsLauncher({
-          onGone: (pid) => {
-            // stdout and stderr already swallow EPIPE (armed with the watch).
-            try { stampLog(`launcher ${pid} has exited`); } catch { /* stdout is gone */ }
-            shutdown();
-          },
-        });
       } catch (error) {
         console.error(`Daemon run failed: ${error.message}`);
         const badConfig = !record || error.message.startsWith('Daemon credential file');

package/src/lib/adapters/claude.js

@@ -84,6 +84,7 @@ import {
 } from '../environment.js';
 import { detectBwrap, wrapArgvWithBwrap } from '../sandbox/bwrap.js';
 import { PUBLIC_SANDBOX_MODES, resolvePublicSandboxMode } from '../sandbox/mode.js';
+import { UNSANDBOXED_FLAG } from '../sandbox/host-check.js';
 import {
   publicClaudeStateRoot,
   wrapArgvWithSeatbelt,
@@ -1154,6 +1155,16 @@ const prepareArgv = async (innerArgv, ctx) => {
   // unconfined seat with a public record, which is how a record can claim
   // confinement it never applies.
   if (isConfinedTrust(sandboxTrust) && !publicNativeSandbox && sandboxMode !== 'bwrap') {
+    // D245: on native Windows, name Windows and the user's own opt-in, never
+    // macOS or bwrap advice (host-check passes an unrecognised mode through).
+    if ((ctx._platform || process.platform) === 'win32') {
+      throw new Error(
+        `${sandboxTrust} Claude agents run inside a sandbox, and Commonly has no sandbox it can enforce on Windows `
+        + `(got sandbox.mode=${JSON.stringify(sandboxMode)}). To run this agent without one, which is your choice, `
+        + `run commonly agent run <name> ${UNSANDBOXED_FLAG} (or commonly daemon install ${UNSANDBOXED_FLAG} for the agents `
+        + 'this computer\'s daemon runs), or choose "Run it here" on the Connect page for a hosted agent.',
+      );
+    }
     throw new Error(
       `${sandboxTrust} Claude agents require an enforced sandbox mode `
       + `(workspace or read-only on macOS, bwrap elsewhere), got ${JSON.stringify(sandboxMode)}`,

package/src/lib/daemon-service-windows.js

@@ -201,7 +201,8 @@ const pidAlive = (pid) => {
  * keep running, unsupervised and invisible to the task (seen on windows-latest,
  * 11-04: a stopped task left its daemon checking in). A daemon started by the
  * launcher therefore polls the launcher's pid and calls `onGone` once it has
- * exited. Returns a stop function; does nothing outside the launcher.
+ * exited, at once if it is already gone when the watch is armed. Returns a
+ * stop function; does nothing outside the launcher.
  */
 export const watchWindowsLauncher = ({
   env = process.env,
@@ -221,6 +222,12 @@ export const watchWindowsLauncher = ({
   // swallow errors from the moment the watch is armed, not only after the
   // launcher's exit is noticed up to two seconds later.
   for (const stream of streams) stream?.on?.('error', () => {});
+  // Already gone when armed (the daemon is armed before its first tick): say
+  // so now, rather than after a poll and a heartbeat logged into a dead pipe.
+  if (!isAlive(pid)) {
+    onGone(pid);
+    return () => {};
+  }
   const timer = setIntervalFn(() => {
     if (isAlive(pid)) return;
     clearIntervalFn(timer);

package/src/lib/sandbox/windows-unsandboxed.js

@@ -41,6 +41,7 @@ import { homedir } from 'os';
 import { join } from 'path';
 
 import { writeServiceFile } from '../daemon-service.js';
+import { effectiveSandboxTrust } from '../environment.js';
 import { UNSANDBOXED_FLAG } from './host-check.js';
 
 export { UNSANDBOXED_FLAG };
@@ -100,7 +101,9 @@ export const POLICY_ONLY_ADAPTERS = new Set(['claude']);
 export const hostUnconfinedForRun = ({
   optedIn, adapterName, environment, platform = process.platform,
 }) => {
-  const trust = environment?.sandbox?.trust;
+  // The effective trust, as host-check.js and the claude adapter read it: a
+  // legacy `internal` record means `public`, so it gets the same opt-in.
+  const trust = effectiveSandboxTrust(environment?.sandbox?.trust);
   return platform === 'win32' && optedIn === true && POLICY_ONLY_ADAPTERS.has(adapterName)
     && (trust === 'public' || trust === 'workspace');
 };