@commonlyai/cli 0.1.234 → 0.1.236

package/node_modules/@commonlyai/seats/src/wire/provider-proxy.js

@@ -169,10 +169,14 @@ const readProviderKey = async (keyFile, adapterLabel) => {
 
 // The routes a CLI on each wire may call, relative to the configured base
 // path, and the header the real key goes out in. Anything else is refused.
+// `search` lists the exact query strings a wire's client sends, forwarded as
+// sent: Claude Code calls `/v1/messages?beta=true` (F96). Any other query is
+// refused.
 const WIRES = Object.freeze({
   'openai-chat': { routes: [['POST', 'chat/completions'], ['GET', 'models']], auth: 'bearer' },
   'anthropic-messages': {
     routes: [['POST', 'v1/messages'], ['POST', 'v1/messages/count_tokens'], ['GET', 'v1/models']],
+    search: ['?beta=true'],
     auth: 'x-api-key',
   },
   'openai-responses': { routes: [['POST', 'responses'], ['GET', 'models']], auth: 'bearer' },
@@ -276,7 +280,8 @@ export const startProviderProxy = async ({
       // This keeps a CLI request from turning the proxy into an arbitrary
       // path/URL fetcher (including paths on a local provider host).
       const requested = new URL(requestPath, 'http://127.0.0.1');
-      if (requested.origin !== 'http://127.0.0.1' || requested.search || requested.hash) {
+      if (requested.origin !== 'http://127.0.0.1' || requested.hash
+        || (requested.search && !(wireSpec.search || []).includes(requested.search))) {
         rejectRoute(requested.pathname);
         return;
       }
@@ -289,7 +294,7 @@ export const startProviderProxy = async ({
       }
       const endpoint = route[1];
       target = {
-        path: `${configuredPath}/${endpoint}`,
+        path: `${configuredPath}/${endpoint}${requested.search}`,
         protocol: upstream.protocol,
         hostname: upstream.hostname,
         port: upstream.port || undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.234",
+  "version": "0.1.236",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -89,7 +89,7 @@ import { createClaimedWorkGate } from '../lib/claimed-work-gate.js';
 import { prepareCommitAttribution } from '../lib/commit-attribution.js';
 import { detectBwrap } from '../lib/sandbox/bwrap.js';
 import { resolvePublicSandboxMode } from '../lib/sandbox/mode.js';
-import { hostSandboxRefusal, windowsSandboxMessage } from '../lib/sandbox/host-check.js';
+import { UNSANDBOXED_FLAG, hostSandboxRefusal, windowsSandboxMessage } from '../lib/sandbox/host-check.js';
 import {
   UNSANDBOXED_NOTICE, hostUnconfinedForRun, runOptedInUnsandboxed, unsandboxedFlagRefusal,
 } from '../lib/sandbox/windows-unsandboxed.js';
@@ -1176,6 +1176,8 @@ export const performAttach = async ({
   log = () => {},
   adapterRegistry = { getAdapter, listAdapterNames },
   seatbelt: probeSeatbelt = detectSeatbelt,
+  bwrap: probeBwrap = detectBwrap,
+  platform = process.platform,
 }) => {
   const adapter = adapterRegistry.getAdapter(adapterName);
   if (!adapter) {
@@ -1210,10 +1212,37 @@ export const performAttach = async ({
     }
     log(`workspace: ${workspace.path}${workspace.created ? ' (created)' : ''}`);
 
-    const { mode: sandboxMode } = resolveAttachSandbox({ environment, adapterName, adapter });
+    const { mode: sandboxMode } = resolveAttachSandbox({ environment, adapterName, adapter, platform });
+    // D245: native Windows has neither sandbox, so its refusal names Windows
+    // and the user's own opt-in, never Seatbelt or bwrap advice. Attach still
+    // refuses there, as before; only the words differ.
+    const windowsRefusal = () => new Error(adapterName === 'dsh'
+      ? `confined dsh sandbox.mode=${sandboxMode} needs a sandbox, and Commonly has no sandbox for Windows yet, `
+        + 'so dsh cannot run confined on native Windows. Choose "Run it here" on the Connect page for a hosted agent.'
+      : `This environment file asks for sandbox.mode=${sandboxMode}, which Commonly cannot enforce on Windows, `
+        + 'so attach stops here.\n'
+        // This attach made no agent, so Claude's options name the path that works on
+        // Windows: the Connect page's commands, which set the two env vars and run with
+        // the flag, keeping the public trust and policy (#3407 review B1). Other
+        // adapters keep the shared Windows text.
+        + (adapterName === 'claude' ? [
+          'Instead:',
+          '  - Run it without an OS sandbox, which is your choice: use the commands on the Connect page.'
+            + ' They set COMMONLY_API_URL and COMMONLY_AGENT_TOKEN, then run'
+            + ` commonly agent run <name> --adapter claude ${UNSANDBOXED_FLAG}.`
+            + " It keeps Commonly's restricted tool settings and gets no shell, but nothing at the OS level"
+            + ' confines it, and it gets no connector grants.'
+            // agent run prefers a saved record over the page's env vars, so an
+            // older record of that name would run with its own settings (#3407).
+            + ' If this computer already has an agent saved under that name, the run uses that one and its'
+            + ' settings instead: remove it first with commonly agent detach <name> --force.',
+          '  - Use Commonly from your own Claude Code sessions: the Connect page shows a PowerShell `claude mcp add` command.',
+          '  - A hosted agent: choose "Run it here" on the Connect page. Nothing runs on this machine.',
+        ].join('\n') : windowsSandboxMessage(adapterName)));
     if (sandboxMode === 'bwrap') {
-      const bwrap = detectBwrap();
+      const bwrap = probeBwrap();
       if (!bwrap.available) {
+        if (platform === 'win32') throw windowsRefusal();
         throw new Error(`sandbox.mode=bwrap requested but unavailable: ${bwrap.error}`);
       }
       if (environment.sandbox?.network?.policy === 'restricted') {
@@ -1239,6 +1268,7 @@ export const performAttach = async ({
           || adapterName;
         const seatbelt = probeSeatbelt();
         if (!seatbelt.available) {
+          if (platform === 'win32') throw windowsRefusal();
           // dsh refuses bwrap, so it gets no Linux hint that leads to a second refusal.
           throw new Error(adapterName === 'dsh'
             ? `confined dsh sandbox.mode=${sandboxMode} requires macOS Seatbelt: ${seatbelt.error}.`
@@ -1595,6 +1625,8 @@ export const performRun = ({
   setTimeoutImpl = setTimeout,
   setIntervalImpl = setInterval,
   clearIntervalImpl = clearInterval,
+  // The host's bubblewrap probe, for a turn placed public; tests pin it.
+  detectBwrapImpl,
   setDeadlineTimeoutImpl = setTimeout,
   clearDeadlineTimeoutImpl = clearTimeout,
   turnTimeoutMs,
@@ -2109,14 +2141,19 @@ export const performRun = ({
     const placement = await placeTurn();
     // A workspace turn placed public (its pod turned public, or its pods could
     // not be read) is confined as a public seat, which this host may not be
-    // able to do: Claude Code on Linux has only the workspace jail. Refuse it
-    // as the run start would, before anything is read or spawned. The model
+    // able to do (a Linux host without bubblewrap). Refuse it as the run start
+    // would, before anything is read or spawned. The model
     // never runs and nothing is posted. A public pod is a settled answer, so a
     // human's message is handed to another listener (claim-outcome.js). A
     // failed read is not: it throws, so the event stays unacked and comes back
     // through the spawn-retry backoff instead of being refused for good.
     if (placement.reason) {
-      const turnRefusal = hostSandboxRefusal({ environment: placement.environment, adapterName: adapter.name, hostUnconfined });
+      const turnRefusal = hostSandboxRefusal({
+        environment: placement.environment,
+        adapterName: adapter.name,
+        hostUnconfined,
+        ...(detectBwrapImpl ? { detectBwrap: detectBwrapImpl } : {}),
+      });
       if (turnRefusal && placement.readError) {
         throw Object.assign(
           new Error(`turn deferred, because its pods could not be read: ${placement.readError.message}`, {

package/src/commands/daemon.js

@@ -300,6 +300,34 @@ export const resolveAdapterForRuntime = async (runtime, registry = { getAdapter
   return null;
 };
 
+/**
+ * The daemon's first poll and heartbeat, with the Windows launcher watch armed
+ * BEFORE them (D245). Arming first puts the EPIPE guard on stdout and stderr
+ * before any supervision log line, and a launcher that is already gone stops
+ * the daemon here instead of after a tick logged into a dead pipe. Returns
+ * false when the daemon should not go on to its timers.
+ */
+export const firstSupervisionPass = async ({
+  supervisor,
+  onLauncherGone,
+  isEnded = () => false,
+  armLauncherWatch = watchWindowsLauncher,
+}) => {
+  let launcherGone = false;
+  armLauncherWatch({
+    onGone: (pid) => {
+      launcherGone = true;
+      onLauncherGone(pid);
+    },
+  });
+  const stopped = () => launcherGone || isEnded();
+  if (stopped()) return false;
+  await supervisor.tick();
+  if (stopped()) return false;
+  await supervisor.heartbeat();
+  return !stopped();
+};
+
 export const registerDaemon = (program) => {
   const daemon = program.command('daemon').description('Manage the local Commonly daemon');
 
@@ -654,10 +682,26 @@ Examples:
         });
 
         stampLog(`daemon supervising for ${record.machineName} — poll ${opts.poll}ms, heartbeat ${opts.heartbeat}ms (ctrl+c to stop)`);
-        await supervisor.tick();
-        if (terminalEnded) return;
-        await supervisor.heartbeat();
-        if (terminalEnded) return;
+        const shutdown = () => {
+          stampLog('daemon stopping — terminating supervised agents');
+          clearInterval(pollTimer);
+          clearInterval(heartbeatTimer);
+          supervisor.stop();
+          process.exit(0);
+        };
+        // D245: under the Windows launcher, the launcher's exit is the stop
+        // signal. Armed before the first tick, so the EPIPE guard covers its
+        // log lines and a launcher already gone stops the daemon at once.
+        const started = await firstSupervisionPass({
+          supervisor,
+          onLauncherGone: (pid) => {
+            // stdout and stderr already swallow EPIPE (armed with the watch).
+            try { stampLog(`launcher ${pid} has exited`); } catch { /* stdout is gone */ }
+            shutdown();
+          },
+          isEnded: () => terminalEnded,
+        });
+        if (!started) return;
         const runtimeFailure = (error) => {
           if (terminalEnded) return;
           terminalEnded = true;
@@ -669,23 +713,8 @@ Examples:
         };
         pollTimer = setInterval(() => { void supervisor.tick().catch(runtimeFailure); }, Number(opts.poll) || DEFAULT_POLL_MS);
         heartbeatTimer = setInterval(() => { void supervisor.heartbeat().catch(runtimeFailure); }, Number(opts.heartbeat) || DEFAULT_HEARTBEAT_MS);
-        const shutdown = () => {
-          stampLog('daemon stopping — terminating supervised agents');
-          clearInterval(pollTimer);
-          clearInterval(heartbeatTimer);
-          supervisor.stop();
-          process.exit(0);
-        };
         process.on('SIGINT', shutdown);
         process.on('SIGTERM', shutdown);
-        // D245: under the Windows launcher, the launcher's exit is the stop signal.
-        watchWindowsLauncher({
-          onGone: (pid) => {
-            // stdout and stderr already swallow EPIPE (armed with the watch).
-            try { stampLog(`launcher ${pid} has exited`); } catch { /* stdout is gone */ }
-            shutdown();
-          },
-        });
       } catch (error) {
         console.error(`Daemon run failed: ${error.message}`);
         const badConfig = !record || error.message.startsWith('Daemon credential file');

package/src/lib/adapters/claude.js

@@ -64,9 +64,11 @@ import {
   mkdtemp,
   open,
   readFile,
+  readdir,
   readlink,
   rename,
   rm,
+  rmdir,
   symlink,
   unlink,
   writeFile,
@@ -84,6 +86,7 @@ import {
 } from '../environment.js';
 import { detectBwrap, wrapArgvWithBwrap } from '../sandbox/bwrap.js';
 import { PUBLIC_SANDBOX_MODES, resolvePublicSandboxMode } from '../sandbox/mode.js';
+import { UNSANDBOXED_FLAG } from '../sandbox/host-check.js';
 import {
   publicClaudeStateRoot,
   wrapArgvWithSeatbelt,
@@ -97,11 +100,12 @@ import {
 import { BACKGROUND_PROCESS_CUE, buildMemoryPreamble, ROW_SLICING_CUE } from '../memory-bridge.js';
 import { claudeConfigDirFor, claudeContextTokens, claudeTranscriptPath } from '../session-recycle.js';
 import { skillsAsText } from '../skill-prompt.js';
-import { adapterFailure, spawnCredentials } from '../upstream-refusal.js';
+import { adapterFailure, redactKnownCredentials, spawnCredentials } from '../upstream-refusal.js';
 import { PUBLIC_WITHHELD_TOOLS } from '../public-withheld-tools.js';
 import { isShippedCommonlyMcpCommand } from '../declared-mcp-guard.js';
 import { isAnswerableToolError, PUBLIC_MCP_NOT_READY_CODE, PUBLIC_TOOL_FAILED_CODE } from '../public-tool-error.js';
 import { resolveLaunch, resolveMcpCommand, resolveWindowsCommandWithReason } from '../windows-command.js';
+import { startProviderProxy } from '../provider-proxy.js';
 
 // See codex.js for the rationale on bumping the default + env override.
 // Keeping both adapters in lockstep so any wrapper agent runtime has the
@@ -324,14 +328,71 @@ const replacePrivateFile = async (dir, name, content) => {
   return target;
 };
 
-// A workspace seat on Linux runs under bwrap, which has no keychain. Claude
-// Code on Linux keeps its login in <config dir>/.credentials.json, so the
-// seat's own state dir gets a copy of the person's, taken fresh each spawn:
-// their own credential on their own machine, the exposure the macOS keychain
-// arm already has. Only the copy is inside the jail. Nothing is written back:
-// the jail can write its copy, and a write-back would let it replace the
-// person's login with one of its choosing. A missing login removes the copy,
-// so a person who logged out is not still signed in here.
+// The host's ANTHROPIC_BASE_URL, for a seat that reaches the model on the
+// person's login. Only when it is the route the login uses: with an
+// ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN beside it, it is that key's
+// gateway, and the jail (which never gets the key) would send the person's
+// subscription token there instead. A URL carrying a user or password is not
+// forwarded either.
+export const loginRouteBaseUrl = (source = {}) => {
+  if (!source.ANTHROPIC_BASE_URL || source.ANTHROPIC_API_KEY || source.ANTHROPIC_AUTH_TOKEN) return null;
+  try {
+    const url = new URL(source.ANTHROPIC_BASE_URL);
+    return url.username || url.password ? null : source.ANTHROPIC_BASE_URL;
+  } catch {
+    return null;
+  }
+};
+
+// Two turns of one public agent share its folder (a daemon and a separate
+// `agent run`, or two events at once). Each registers itself in a sibling of
+// that folder, outside the jail's writable bind so a turn cannot forge one,
+// and the login copy is removed only by the last live turn to finish.
+const registerLoginTurn = async (statePath) => {
+  const dir = `${statePath}.login-turns`;
+  await mkdir(dir, { recursive: true, mode: 0o700 });
+  const marker = join(dir, `${process.pid}-${randomUUID()}`);
+  await writeFile(marker, '', { mode: 0o600, flag: 'wx' });
+  return marker;
+};
+const pidAlive = (pid) => {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err?.code === 'EPERM';
+  }
+};
+const releaseLoginTurn = async (marker, loginPath) => {
+  await rm(marker, { force: true });
+  const dir = dirname(marker);
+  let others = [];
+  try {
+    others = await readdir(dir);
+  } catch { /* gone: nobody else is registered */ }
+  let live = 0;
+  for (const name of others) {
+    const pid = Number(name.split('-')[0]);
+    if (Number.isInteger(pid) && pid > 0 && pidAlive(pid)) live += 1;
+    else await rm(join(dir, name), { force: true });
+  }
+  if (!live) {
+    await rm(loginPath, { force: true });
+    // Only an empty folder goes: a turn registering at this moment keeps it.
+    try { await rmdir(dir); } catch { /* not empty, or already gone */ }
+  }
+};
+
+// A seat on Linux runs under bwrap, which has no keychain. Claude Code on
+// Linux keeps its login in <config dir>/.credentials.json, so the seat's own
+// state dir gets a copy of the person's, taken fresh each spawn. Only the copy
+// is inside the jail. Nothing is written back: the jail can write its copy, and
+// a write-back would let it replace the person's login with one of its
+// choosing. Since F96 the copy is access-only for every seat, workspace ones
+// included: a jail that refreshed would spend the host's refresh token and
+// leave the person signed out (CI, 11-04: Claude Code rewrites the jail's copy
+// when its session check fails). A missing login removes the copy, so a person
+// who logged out is not still signed in here.
 const claudeLoginSource = (env) => join(
   env?.CLAUDE_CONFIG_DIR || process.env.CLAUDE_CONFIG_DIR || join(homedir(), '.claude'),
   '.credentials.json',
@@ -339,7 +400,39 @@ const claudeLoginSource = (env) => join(
 
 // Opened once, without following a symlink, and checked on the open handle,
 // so the file read is the file checked (a FIFO cannot hold the open either).
-const carryClaudeLogin = async (env, configDir) => {
+// A public seat's copy (F96) holds the access token alone. Claude Code
+// rotates the refresh token when it refreshes, so a jail holding one could
+// spend it and leave the host signed out; without one it cannot refresh at
+// all, so a login that would expire mid-turn is refused here instead.
+// What a public seat's access-only login keeps: the token and the account
+// metadata Claude Code reads beside it.
+const ACCESS_ONLY_LOGIN_FIELDS = ['accessToken', 'expiresAt', 'scopes', 'subscriptionType', 'rateLimitTier'];
+
+const accessOnlyLogin = (text, { source, mustOutlastMs, apiKeyHint = true }) => {
+  let login;
+  try {
+    login = JSON.parse(text);
+  } catch {
+    throw new Error(`refusing a Claude login that is not JSON: ${source}`);
+  }
+  const oauth = login?.claudeAiOauth;
+  if (!oauth || typeof oauth.accessToken !== 'string' || !oauth.accessToken) {
+    throw new Error(`refusing a Claude login with no access token: ${source}`);
+  }
+  if (typeof oauth.expiresAt === 'number' && oauth.expiresAt - Date.now() < mustOutlastMs) {
+    const minutes = Math.max(0, Math.floor((oauth.expiresAt - Date.now()) / 60000));
+    throw new Error(`the Claude login on this machine expires in ${minutes} min, before this turn could end. `
+      + `Sign in again on this machine (\`claude\`, then /login)${apiKeyHint ? ', or set ANTHROPIC_API_KEY for the agent' : ''}.`);
+  }
+  // An allowlist, not "everything but refreshToken": a field the host record
+  // gains later, secret or not, never reaches the seat's writable HOME.
+  const access = Object.fromEntries(ACCESS_ONLY_LOGIN_FIELDS
+    .filter((field) => oauth[field] !== undefined)
+    .map((field) => [field, oauth[field]]));
+  return `${JSON.stringify({ claudeAiOauth: access })}\n`;
+};
+
+const carryClaudeLogin = async (env, configDir, { accessOnly = false, mustOutlastMs = 0, apiKeyHint = true } = {}) => {
   const source = claudeLoginSource(env);
   const refuse = () => new Error(`refusing a Claude login that is not a regular file: ${source}`);
   let handle;
@@ -355,20 +448,33 @@ const carryClaudeLogin = async (env, configDir) => {
   }
   try {
     if (!(await handle.stat()).isFile()) throw refuse();
-    return replacePrivateFile(configDir, '.credentials.json', await handle.readFile('utf8'));
+    const text = await handle.readFile('utf8');
+    return replacePrivateFile(configDir, '.credentials.json', accessOnly
+      ? accessOnlyLogin(text, { source, mustOutlastMs, apiKeyHint })
+      : text);
   } finally {
     await handle.close();
   }
 };
 
-// State for a workspace seat under bwrap: the same per-seat folder the macOS
-// path uses, outside the person's project, with the auth metadata whitelist
-// and the login copy. The jail binds this folder writable and makes it HOME,
-// so transcripts land here rather than in the project.
-const prepareWorkspaceBwrapClaudeState = async (ctx) => {
+// The per-seat folder a bwrap seat runs in. A public seat (F96) gets its own,
+// never the workspace seat's: that one holds the transcripts of private-pod
+// turns, and the same agent can run both kinds of
+// turn, even at once (a daemon and a separate `agent run`).
+export const bwrapClaudeStatePath = (ctx, seat = 'workspace') => {
+  if (ctx._publicClaudeState) return ctx._publicClaudeState;
   const identity = ctx.agentName || ctx.cwd || 'anonymous';
   const identityHash = createHash('sha256').update(identity).digest('hex').slice(0, 20);
-  const statePath = ctx._publicClaudeState || publicClaudeStateRoot(identityHash);
+  return publicClaudeStateRoot(seat === 'public' ? `${identityHash}-public` : identityHash);
+};
+
+// State for a seat under bwrap, outside the person's project, with the auth
+// metadata whitelist and the login copy. The jail binds this folder writable
+// and makes it HOME, so transcripts land here rather than in the project.
+// Every seat carries an access-only copy of the login, or a public seat none
+// when an API key reaches the model through the provider proxy instead.
+const prepareWorkspaceBwrapClaudeState = async (ctx, { login = 'carry', seat = 'workspace' } = {}) => {
+  const statePath = bwrapClaudeStatePath(ctx, seat);
   const tmpPath = join(statePath, 'tmp');
   const configDir = join(statePath, '.claude');
   await mkdir(statePath, { recursive: true, mode: 0o700 });
@@ -385,7 +491,15 @@ const prepareWorkspaceBwrapClaudeState = async (ctx) => {
   const configPath = await replacePrivateFile(
     statePath, '.claude.json', `${JSON.stringify(await claudeAuthMetadata(), null, 2)}\n`,
   );
-  const loginPath = await carryClaudeLogin(ctx.env, configDir);
+  if (login === 'none') {
+    await rm(join(configDir, '.credentials.json'), { force: true });
+    return { statePath, tmpPath, configPath, loginPath: null };
+  }
+  const loginPath = await carryClaudeLogin(ctx.env, configDir, login === 'access-only'
+    // A workspace seat's jail never sees the host's API key, so only a public
+    // seat is told to set one.
+    ? { accessOnly: true, mustOutlastMs: ctx.timeoutMs || DEFAULT_TIMEOUT_MS, apiKeyHint: seat === 'public' }
+    : {});
   return { statePath, tmpPath, configPath, loginPath };
 };
 
@@ -639,12 +753,14 @@ const publicWitnessError = ({ code, tool, error }) => {
 };
 
 // The reply a turn posts. A public seat's turn is witnessed first (TASK-256).
+// Both ways out of a turn are redacted: a reply that echoes a credential the
+// child was handed (the per-turn proxy token included), and the witness error.
 const turnReply = (stdout, { credentials, publicMcp }) => {
   if (publicMcp) {
     const failure = claudePublicMcpWitness(stdout, publicMcp);
-    if (failure) throw publicWitnessError(failure);
+    if (failure) throw publicWitnessError({ ...failure, error: redactKnownCredentials(String(failure.error), credentials) });
   }
-  return claudeResultText(stdout, { credentials });
+  return redactKnownCredentials(claudeResultText(stdout, { credentials }), credentials);
 };
 
 // The failure tail for a non-zero exit. Stream events are mostly system init
@@ -1062,7 +1178,7 @@ const resolveClaudeInstall = (env) => {
 
 // A jail that cannot carry claude would fail inside at every spawn.
 const claudeInstallRefusal = (claudeBin) => new Error(
-  'workspace Claude agents on Linux need Claude Code on PATH, so the sandbox can carry its install; '
+  'Claude agents on Linux need Claude Code on PATH, so the sandbox can carry its install; '
   + `\`${claudeBin}\` could not be resolved`,
 );
 
@@ -1154,6 +1270,16 @@ const prepareArgv = async (innerArgv, ctx) => {
   // unconfined seat with a public record, which is how a record can claim
   // confinement it never applies.
   if (isConfinedTrust(sandboxTrust) && !publicNativeSandbox && sandboxMode !== 'bwrap') {
+    // D245: on native Windows, name Windows and the user's own opt-in, never
+    // macOS or bwrap advice (host-check passes an unrecognised mode through).
+    if ((ctx._platform || process.platform) === 'win32') {
+      throw new Error(
+        `${sandboxTrust} Claude agents run inside a sandbox, and Commonly has no sandbox it can enforce on Windows `
+        + `(got sandbox.mode=${JSON.stringify(sandboxMode)}). To run this agent without one, which is your choice, `
+        + `run commonly agent run <name> ${UNSANDBOXED_FLAG} (or commonly daemon install ${UNSANDBOXED_FLAG} for the agents `
+        + 'this computer\'s daemon runs), or choose "Run it here" on the Connect page for a hosted agent.',
+      );
+    }
     throw new Error(
       `${sandboxTrust} Claude agents require an enforced sandbox mode `
       + `(workspace or read-only on macOS, bwrap elsewhere), got ${JSON.stringify(sandboxMode)}`,
@@ -1220,8 +1346,8 @@ const prepareArgv = async (innerArgv, ctx) => {
     if (!bwrap.available) {
       throw new Error(`${sandboxTrust} Claude agents require bwrap: ${bwrap.error}`);
     }
-    if (workspaceBwrapSandbox && !ctx.publicClaudeState) {
-      throw new Error('workspace Claude state was not prepared before argv construction');
+    if (!ctx.publicClaudeState) {
+      throw new Error(`${sandboxTrust} Claude state was not prepared before argv construction`);
     }
     innerArgv = [
       ...innerArgv,
@@ -1233,7 +1359,7 @@ const prepareArgv = async (innerArgv, ctx) => {
   } else if (allowedPatterns.length > 0) {
     innerArgv = [...innerArgv, '--allowedTools', ...allowedPatterns];
   }
-  if (workspaceBwrapSandbox) {
+  if (workspaceBwrapSandbox || publicBwrapSandbox) {
     // Seatbelt denies writes under .git by path, present or not. A bwrap mount
     // needs the path to exist, so a writable project without a .git could get
     // one from the child, hooks included, that the person's next git command
@@ -1421,6 +1547,10 @@ export default {
 
     let mcpConfig = null;
     let publicClaudeState = null;
+    let providerProxy = null;
+    // A login seat's gateway, when the host names one: config, not a secret.
+    let publicLoginBaseUrl = null;
+    let loginTurn = null;
     let publicSkillArgs = [];
     // D245: no jail to prepare for on a policy-only Windows host.
     const jailed = !policyOnlyHost(ctx);
@@ -1430,6 +1560,18 @@ export default {
       && resolvePublicSandboxMode(ctx.environment?.sandbox) === 'bwrap';
     const workspaceBwrapSandbox = jailed && ctx.environment?.sandbox?.trust === 'workspace'
       && resolvePublicSandboxMode(ctx.environment?.sandbox) === 'bwrap';
+    // The proxy's address and per-turn token, never the host's key.
+    const withProvider = (env) => {
+      if (providerProxy) {
+        return Object.assign(env, { ANTHROPIC_BASE_URL: providerProxy.baseURL, ANTHROPIC_API_KEY: providerProxy.token });
+      }
+      return publicLoginBaseUrl ? Object.assign(env, { ANTHROPIC_BASE_URL: publicLoginBaseUrl }) : env;
+    };
+    // The values a failure tail or reply must never echo: the seat's own, and
+    // the per-turn proxy token the child was handed in place of the host key.
+    const turnCredentials = (spawnContext) => [
+      ...spawnCredentials(spawnContext), providerProxy?.token,
+    ].filter(Boolean);
     try {
       // Trust is normalized at entry (legacy `internal` reads as public). The
       // MCP policy follows trust alone, whatever confines the seat: a public
@@ -1444,7 +1586,50 @@ export default {
         if (!bwrap.available) throw new Error(`workspace Claude agents require bwrap: ${bwrap.error}`);
         const { claudeBin, claudeInstall } = resolveClaudeInstall(withClaudePath(ctx.env));
         if (!claudeInstall) throw claudeInstallRefusal(claudeBin);
-        publicClaudeState = await prepareWorkspaceBwrapClaudeState(ctx);
+        publicClaudeState = await prepareWorkspaceBwrapClaudeState(ctx, { login: 'access-only' });
+        // The host's model route, when it is the one the login uses.
+        publicLoginBaseUrl = loginRouteBaseUrl(ctx.env || process.env);
+      } else if (publicBwrapSandbox) {
+        // F96: the workspace tier's jail, reaching the model one of two ways.
+        // An API key stays on the host behind a per-turn proxy; without one,
+        // the seat gets an access-only copy of the login, deleted after the turn.
+        // Either way the model is across the network: restricted networking
+        // (--unshare-net) cuts off the host proxy and the vendor alike, so the
+        // seat is refused before a proxy starts or a login is copied.
+        if (ctx.environment?.sandbox?.network?.policy === 'restricted') {
+          throw new Error('public Claude agents on Linux need shared bwrap networking to reach the model; '
+            + 'sandbox.network.policy "restricted" cuts it off.');
+        }
+        // A public seat sees its project and its own folder, nothing more: the
+        // server's environment cannot bind more of the host into a jail that
+        // strangers drive (goose refuses the same).
+        for (const key of ['read-outside', 'write-outside']) {
+          if (ctx.environment?.sandbox?.filesystem?.[key]?.length) {
+            throw new Error(`public Claude agents on Linux do not allow sandbox.filesystem.${key}`);
+          }
+        }
+        const bwrap = (ctx._detectBwrap || detectBwrap)();
+        if (!bwrap.available) throw new Error(`public Claude agents require bwrap: ${bwrap.error}`);
+        const { claudeBin, claudeInstall } = resolveClaudeInstall(withClaudePath(ctx.env));
+        if (!claudeInstall) throw claudeInstallRefusal(claudeBin);
+        const source = ctx.env || process.env;
+        if (source.ANTHROPIC_API_KEY) {
+          publicClaudeState = await prepareWorkspaceBwrapClaudeState(ctx, { login: 'none', seat: 'public' });
+          providerProxy = await (ctx._startProviderProxy || startProviderProxy)({
+            provider: { baseURL: source.ANTHROPIC_BASE_URL || 'https://api.anthropic.com' },
+            keyMaterial: source.ANTHROPIC_API_KEY,
+            wire: 'anthropic-messages',
+            adapterLabel: 'Claude',
+          });
+        } else {
+          publicClaudeState = await prepareWorkspaceBwrapClaudeState(ctx, { login: 'access-only', seat: 'public' });
+          publicLoginBaseUrl = loginRouteBaseUrl(source);
+          if (!publicClaudeState.loginPath) {
+            throw new Error('public Claude agents on Linux need ANTHROPIC_API_KEY in the agent\'s environment, '
+              + 'or sign in with `claude` on this machine first.');
+          }
+          loginTurn = await registerLoginTurn(publicClaudeState.statePath);
+        }
       }
       if (publicTrust) {
         const prompt = await publicSkillPromptArgs(mountedSkills);
@@ -1469,14 +1654,14 @@ export default {
         });
       }
       if (mcpConfig?.unavailableMcp.length) throw publicMcpUnavailableError(mcpConfig.unavailableMcp);
-      const claudeEnv = buildClaudeEnv(
+      const claudeEnv = withProvider(buildClaudeEnv(
         ctx.env,
         publicClaudeState,
         mcpConfig?.expansionEnv,
         mcpConfig?.credential?.path || null,
         publicTrust,
         ctx._platform || process.platform,
-      );
+      ));
       if ((publicNativeSandbox || publicBwrapSandbox) && ctx.commitAttributionEnv) {
         Object.assign(claudeEnv, ctx.commitAttributionEnv);
       }
@@ -1500,7 +1685,7 @@ export default {
         // check. Snapshot before the spawn: claude is subscription-authenticated
         // and its provider key is not an env var here, so the seat credential is
         // the value a tail can echo back.
-        credentials: spawnCredentials(spawnCtx),
+        credentials: turnCredentials(spawnCtx),
         spawnImpl: ctx._spawnImpl, onSpawn: ctx.onSpawn, controls: controlsFromArguments(modelArgs, { modelFlag: '--model', effortFlag: '--effort' }), // test seam only — do not use in production
         ownGroup: wantsOwnProcessGroup(ctx),
         transcriptPath: claudeTranscriptPath({
@@ -1519,7 +1704,7 @@ export default {
         cwd: physicalPath(ctx.cwd), sessionId, configDir: claudeConfigDirFor({ ...env, HOME: childHome || env?.HOME }),
       });
       return {
-        text: turnReply(stdout, { credentials: spawnCredentials(spawnCtx), publicMcp: witnessedMcp }),
+        text: turnReply(stdout, { credentials: turnCredentials(spawnCtx), publicMcp: witnessedMcp }),
         newSessionId: sessionId,
         contextTokens,
         // D245 item 4: what the run said about itself, for the reply receipt.
@@ -1553,14 +1738,14 @@ export default {
           mcpReadDirectories: mcpConfig?.mcpReadDirectories || [],
           publicClaudeState,
           publicSkillArgs,
-          claudeEnv: buildClaudeEnv(
+          claudeEnv: withProvider(buildClaudeEnv(
             ctx.env,
             publicClaudeState,
             mcpConfig?.expansionEnv,
             mcpConfig?.credential?.path || null,
             publicTrust,
             ctx._platform || process.platform,
-          ),
+          )),
         };
         if ((publicNativeSandbox || publicBwrapSandbox) && ctx.commitAttributionEnv) {
           Object.assign(retryCtx.claudeEnv, ctx.commitAttributionEnv);
@@ -1572,7 +1757,7 @@ export default {
           cwd: ctx.cwd,
           env: retry.env,
           timeoutMs: ctx.timeoutMs || DEFAULT_TIMEOUT_MS,
-          credentials: spawnCredentials(retryCtx),
+          credentials: turnCredentials(retryCtx),
           spawnImpl: ctx._spawnImpl, onSpawn: ctx.onSpawn, controls: controlsFromArguments(modelArgs, { modelFlag: '--model', effortFlag: '--effort' }),
           ownGroup: wantsOwnProcessGroup(ctx),
           transcriptPath: claudeTranscriptPath({
@@ -1591,7 +1776,7 @@ export default {
           configDir: claudeConfigDirFor({ ...retry.env, HOME: retry.childHome || retry.env?.HOME }),
         });
         return {
-          text: turnReply(stdout, { credentials: spawnCredentials(retryCtx), publicMcp: witnessedMcp }),
+          text: turnReply(stdout, { credentials: turnCredentials(retryCtx), publicMcp: witnessedMcp }),
           newSessionId: freshId,
           contextTokens,
           stats: claudeRunStats(stdout),
@@ -1602,6 +1787,13 @@ export default {
       if (mcpConfig?.dir) {
         try { await rm(mcpConfig.dir, { recursive: true, force: true }); } catch { /* ignore */ }
       }
+      try { await providerProxy?.close(); } catch { /* ignore */ }
+      // A public seat's login copy lives for its turns (F96): the last live
+      // turn of the agent to finish removes it.
+      if (publicBwrapSandbox && !workspaceBwrapSandbox && publicClaudeState?.loginPath) {
+        if (loginTurn) await releaseLoginTurn(loginTurn, publicClaudeState.loginPath);
+        else await rm(publicClaudeState.loginPath, { force: true });
+      }
     }
   },
 };

package/src/lib/daemon-service-windows.js

@@ -201,7 +201,8 @@ const pidAlive = (pid) => {
  * keep running, unsupervised and invisible to the task (seen on windows-latest,
  * 11-04: a stopped task left its daemon checking in). A daemon started by the
  * launcher therefore polls the launcher's pid and calls `onGone` once it has
- * exited. Returns a stop function; does nothing outside the launcher.
+ * exited, at once if it is already gone when the watch is armed. Returns a
+ * stop function; does nothing outside the launcher.
  */
 export const watchWindowsLauncher = ({
   env = process.env,
@@ -221,6 +222,12 @@ export const watchWindowsLauncher = ({
   // swallow errors from the moment the watch is armed, not only after the
   // launcher's exit is noticed up to two seconds later.
   for (const stream of streams) stream?.on?.('error', () => {});
+  // Already gone when armed (the daemon is armed before its first tick): say
+  // so now, rather than after a poll and a heartbeat logged into a dead pipe.
+  if (!isAlive(pid)) {
+    onGone(pid);
+    return () => {};
+  }
   const timer = setIntervalFn(() => {
     if (isAlive(pid)) return;
     clearIntervalFn(timer);

package/src/lib/sandbox/bwrap.js

@@ -35,9 +35,10 @@ const expandHome = (p) => {
 // mechanisms that do exist are named instead.
 const MACOS_MESSAGE = 'bwrap is Linux-only. On macOS a public seat runs under Seatbelt '
   + '(sandbox.mode workspace or read-only).';
-// D245: Windows has no sandbox for agents, and WSL does not give Claude Code
-// one either (host-check.js linuxClaudeMessage), so the only honest way
-// forward named here is the user's own opt-in (sandbox/windows-unsandboxed.js).
+// D245: native Windows has no sandbox for agents. WSL runs the Linux one,
+// Claude Code included since F96, and host-check.js offers it; this message
+// names the native path, which is the user's own opt-in
+// (sandbox/windows-unsandboxed.js).
 const WINDOWS_MESSAGE = 'bwrap is Linux-only, and native Windows has no sandbox for agents yet. '
   + 'To run this agent without one, with your own access to files and commands, add --unsandboxed.';
 const nonLinuxMessage = (platform) => (platform === 'win32' ? WINDOWS_MESSAGE : MACOS_MESSAGE);

package/src/lib/sandbox/host-check.js

@@ -35,11 +35,13 @@ const HOSTED_LINE = '  - A hosted agent: choose "Run it here" on the Connect pag
 /** What a person on native Windows can do instead. */
 export const windowsSandboxMessage = (adapterName) => {
   const label = ADAPTER_LABELS[adapterName] || adapterName;
-  // WSL is offered only where the Linux sandbox can run the CLI: not Claude
-  // Code (see linuxClaudeMessage).
+  // WSL runs the Linux sandbox, which carries every adapter, Claude Code
+  // included (F96). Claude Code also has the MCP command, which needs none.
   return [
     `Commonly runs a connected ${label} inside a sandbox, and has no sandbox for Windows yet,`,
     'so by default this agent cannot listen for @mentions from native Windows. You can:',
+    `  - WSL 2 (Ubuntu): install Node and ${label} inside WSL, run \`sudo apt install bubblewrap\`,`
+      + ' then run these same commands there.',
     // D245: the user's own choice, never a default (sandbox/windows-unsandboxed.js).
     ...(adapterName === 'claude'
       ? [`  - Run it without an OS sandbox: add ${UNSANDBOXED_FLAG}`
@@ -48,28 +50,11 @@ export const windowsSandboxMessage = (adapterName) => {
       : []),
     ...(adapterName === 'claude'
       ? ['  - Use Commonly from your own Claude Code sessions: the Connect page shows a PowerShell `claude mcp add` command.']
-      : [`  - WSL 2 (Ubuntu): install Node and ${label} inside WSL, run \`sudo apt install bubblewrap\`,`
-        + ' then run these same commands there.']),
+      : []),
     HOSTED_LINE,
   ].join('\n');
 };
 
-/**
- * Claude Code on Linux (WSL included) for any seat but a workspace one. Only
- * the workspace jail (#2784) carries what Claude needs: its install, a HOME
- * of its own and a copy of the login. The public jail binds the system binary
- * folders only, so a confined spawn could not even start Claude (Ubuntu run,
- * 2026-10-16), and giving it the login would hand strangers a jail that holds
- * it. A workspace seat needs every pod it answers in to be invite-only.
- */
-export const linuxClaudeMessage = () => [
-  'Commonly runs a connected Claude Code inside a sandbox. On Linux (WSL included) it does that only',
-  'for an agent whose pods are all invite-only, and this one is not, so it cannot listen for @mentions here. Instead:',
-  '  - From an invite-only pod: run the commands its Connect page shows, from your project\'s folder.',
-  '  - Use Commonly from your own Claude Code sessions: the Connect page shows a `claude mcp add` command.',
-  HOSTED_LINE,
-].join('\n');
-
 /** Why this host cannot confine the seat, or null when it can (or the seat declares no sandbox). */
 export const hostSandboxRefusal = ({
   environment,
@@ -92,11 +77,6 @@ export const hostSandboxRefusal = ({
   if (platform === 'win32') {
     return hostUnconfined === true && adapterName === 'claude' ? null : windowsSandboxMessage(adapterName);
   }
-  // A workspace claude seat falls through to the bubblewrap probe below; the
-  // probe failing, for any reason, is a refusal like any other adapter's.
-  if (mode === 'bwrap' && adapterName === 'claude' && sandbox.trust !== 'workspace') {
-    return linuxClaudeMessage();
-  }
   if (mode === 'bwrap') {
     const bwrap = detectBwrap();
     return bwrap.available ? null : `This seat runs in a bubblewrap sandbox, which is not available here. ${bwrap.error}`;
@@ -107,4 +87,4 @@ export const hostSandboxRefusal = ({
     : `This seat runs in a macOS Seatbelt sandbox (sandbox.mode=${mode}), which is not available here. ${seatbelt.error}`;
 };
 
-export default { hostSandboxRefusal, linuxClaudeMessage, windowsSandboxMessage };
+export default { hostSandboxRefusal, windowsSandboxMessage };

package/src/lib/sandbox/windows-unsandboxed.js

@@ -41,6 +41,7 @@ import { homedir } from 'os';
 import { join } from 'path';
 
 import { writeServiceFile } from '../daemon-service.js';
+import { effectiveSandboxTrust } from '../environment.js';
 import { UNSANDBOXED_FLAG } from './host-check.js';
 
 export { UNSANDBOXED_FLAG };
@@ -100,7 +101,9 @@ export const POLICY_ONLY_ADAPTERS = new Set(['claude']);
 export const hostUnconfinedForRun = ({
   optedIn, adapterName, environment, platform = process.platform,
 }) => {
-  const trust = environment?.sandbox?.trust;
+  // The effective trust, as host-check.js and the claude adapter read it: a
+  // legacy `internal` record means `public`, so it gets the same opt-in.
+  const trust = effectiveSandboxTrust(environment?.sandbox?.trust);
   return platform === 'win32' && optedIn === true && POLICY_ONLY_ADAPTERS.has(adapterName)
     && (trust === 'public' || trust === 'workspace');
 };