@commonlyai/cli 0.1.240 → 0.1.242

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.240",
+  "version": "0.1.242",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -73,6 +73,7 @@ import {
   ADAPTERS_WITH_DEFAULT_MCP,
   ADAPTERS_WITH_GRANT_BROKER,
   ADAPTERS_WITH_DEFAULT_SANDBOX,
+  ADAPTERS_WITH_SANDBOX_ENFORCEMENT,
   defaultMcpServers,
   seatBaseline,
   withDefaultMcpServer,
@@ -1151,7 +1152,7 @@ export const resolveAttachSandbox = ({
   // pure — a mode and an adapter name — so it belongs with the derivation, and
   // its witnesses live beside it.
   if ((mode === 'workspace' || mode === 'read-only')
-    && (!confined || !ADAPTERS_WITH_DEFAULT_SANDBOX.has(adapterName))) {
+    && (!confined || !ADAPTERS_WITH_SANDBOX_ENFORCEMENT.has(adapterName))) {
     throw new Error(
       `sandbox.mode=${mode} requires public trust and an adapter with sandbox enforcement`,
     );

package/src/lib/adapters/qwen.js

@@ -322,9 +322,12 @@ export default {
           ...EXCLUDED_TOOLS, ...(isPublic ? PUBLIC_READ_TOOLS : []),
         ].join(','),
         // Qwen ignores settings permissions in bare/safe mode, but still
-        // honours CLI allow rules. A private seat needs its declared Commonly
-        // tools approved before non-interactive execution begins.
-        ...(!isPublic && Object.hasOwn(mcp.mcpServers, 'commonly')
+        // honours CLI allow rules. Any seat needs its declared Commonly tools
+        // approved before non-interactive execution begins, public included:
+        // without it a public seat's commonly_post_message was declined
+        // (D247 walk, 11-04). Public parity with Claude's --allowedTools
+        // mcp__commonly__*; the withheld tools stay in --exclude-tools above.
+        ...(Object.hasOwn(mcp.mcpServers, 'commonly')
           ? ['--allowed-tools', 'mcp__commonly__*'] : []),
         '-o', 'stream-json', '-p', fullPrompt,
       ];

package/src/lib/default-environment.js

@@ -49,6 +49,14 @@ export const ADAPTERS_WITH_DEFAULT_MCP = new Set(['claude', 'codex', 'pi', 'open
  */
 export const ADAPTERS_WITH_DEFAULT_SANDBOX = new Set(['claude', 'codex', 'opencode', 'qwen']);
 
+// Adapters that confine a public turn themselves. This is wider than the set
+// above: Goose enforces Seatbelt/bwrap but is not handed the default block,
+// because a default cannot supply its required provider and model. The attach
+// gate (agent.js resolveAttachSandbox) reads this set, not the default one, or
+// an explicitly configured public Goose seat is refused before its adapter runs
+// (D247 walk, 11-04). pi stays out until it has a sandbox path.
+export const ADAPTERS_WITH_SANDBOX_ENFORCEMENT = new Set([...ADAPTERS_WITH_DEFAULT_SANDBOX, 'goose']);
+
 // The server has not yet admitted OpenCode to its grant-broker confinement
 // allowlist. Keep runtime sandbox support separate from the narrower set of
 // adapters that may receive a room grant.