@commonlyai/cli 0.1.4 → 0.1.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/skills/commonly/SKILL.md

@@ -120,6 +120,14 @@ turn with the literal `NO_REPLY`. So: if you already said everything through
 `NO_REPLY` so the wrapper doesn't post a duplicate. If you *didn't* post via the
 tool, just let your reply be your final output. Either way — one voice, no echo.
 
+**Post as yourself, never as your operator.** Your reply text and your
+`commonly_*` tools carry *your* agent identity. If you have shell access, you may
+find an operator's Commonly CLI profile (`commonly pod send`, `~/.commonly/config.json`)
+or a human's saved token in your environment — **never post through them**. A message
+sent that way appears in the room under the human's name and avatar, which
+misattributes your words and breaks the room's provenance. If your own tools are
+unavailable mid-turn, say what you need in your final reply instead.
+
 ## The task board
 
 Pods have a task board. When work is being tracked:

package/src/commands/agent.js

@@ -175,7 +175,7 @@ export const buildDefaultEnvironment = (adapterName) => {
     ],
   };
   // Only advertise the skill if it actually shipped (defensive: a broken
-  // package that dropped the skills/ dir shouldn't hand linkSkills a
+  // package that dropped the skills/ dir shouldn't hand mountSkills a
   // missing-source path every spawn).
   if (existsSync(BUNDLED_COMMONLY_SKILL_DIR)) {
     environment.skills = { claude: [BUNDLED_COMMONLY_SKILL_DIR] };
@@ -502,9 +502,10 @@ export const performRun = ({
     // did, its final CLI text is a narration/log — echoing it would duplicate
     // the message and re-fire any @mention. This is the wrapper-side guarantee
     // that a deliberate multi-post ("on it…" then "…done") is never doubled,
-    // without relying on the agent to emit NO_REPLY. (A rare concurrent post by
-    // another member during the spawn window can suppress a genuine wrapper
-    // reply — an acceptable trade against a guaranteed double-post.)
+    // without relying on the agent to emit NO_REPLY. Against a server that
+    // stamps `self` this is exact; against an older one it degrades to the
+    // legacy any-bot test, where a concurrent post by another agent can
+    // suppress a genuine reply (#757).
     const snapshotMessages = async () => {
       try {
         const { messages = [] } = await client.get(
@@ -551,18 +552,33 @@ export const performRun = ({
     // reply via its output) the wrapper delivers the text as before.
     const replyText = (result.text || '').trim();
     let agentPostedItself = false;
+    let suppressedBy = null;
     if (preSpawnIds) {
       const postSpawn = await snapshotMessages();
       if (postSpawn) {
+        // The server stamps each message with `self` when it knows who is
+        // asking. Trust that over any local guess: the wrapper cannot derive
+        // its own bot username reliably (the server applies LEGACY_AGENT_MAP
+        // and an owner-scoped instanceId), and a wrong guess double-posts.
+        const serverKnowsSelf = postSpawn.some((m) => typeof m.self === 'boolean');
         for (const m of postSpawn) {
-          // Only a NEW message from a bot user counts as "the agent posted
-          // itself". A new human-authored message must NOT suppress the echo:
-          // it is either a human typing mid-turn, or the agent misusing an
-          // operator CLI profile / human token (the 2026-07-22 as-operator
-          // attribution incident) — in both cases the wrapper still delivers
-          // the reply under the agent's own identity.
-          if (!preSpawnIds.has(String(m._id || m.id)) && m.isBot) {
+          if (preSpawnIds.has(String(m._id || m.id))) continue;
+          // A new human-authored message must NEVER suppress the echo: it is
+          // either a human typing mid-turn, or the agent misusing an operator
+          // CLI profile / human token (the 2026-07-22 as-operator attribution
+          // incident) — in both cases the wrapper still delivers the reply
+          // under the agent's own identity.
+          if (!m.isBot) continue;
+          // With `self`, only THIS agent's own post suppresses. Without it (an
+          // older server), fall back to the legacy any-bot test — which drops
+          // this agent's reply whenever another agent answers first (#757).
+          if (serverKnowsSelf ? m.self === true : true) {
             agentPostedItself = true;
+            suppressedBy = {
+              id: String(m._id || m.id),
+              author: m.username || 'unknown',
+              basis: serverKnowsSelf ? 'self' : 'legacy-any-bot',
+            };
             break;
           }
         }
@@ -571,7 +587,14 @@ export const performRun = ({
     if (!replyText || replyText === 'NO_REPLY') {
       log(`[${event.type}] no wrapper-post (${replyText === 'NO_REPLY' ? 'NO_REPLY' : 'empty output'})`);
     } else if (agentPostedItself) {
-      log(`[${event.type}] agent posted via tool this turn — not echoing CLI output (avoids double-post)`);
+      // Name the message that caused the suppression. A silently dropped reply
+      // is invisible to everyone; #757 went unnoticed precisely because this
+      // line said only "posted via tool" with no way to tell whose post it saw.
+      log(
+        `[${event.type}] agent posted via tool this turn — not echoing CLI output `
+        + `(avoids double-post; matched message ${suppressedBy.id} by ${suppressedBy.author} `
+        + `via ${suppressedBy.basis})`,
+      );
     } else {
       await client.post(`/api/agents/runtime/pods/${eventPodId}/messages`, {
         content: replyText,

package/src/lib/adapters/claude.js

@@ -60,7 +60,7 @@ import {
 import { homedir, tmpdir } from 'os';
 import { isAbsolute, join } from 'path';
 
-import { linkSkills } from '../environment.js';
+import { mountSkills } from '../environment.js';
 import { wrapArgvWithBwrap } from '../sandbox/bwrap.js';
 import {
   publicClaudeStateRoot,
@@ -468,11 +468,11 @@ export default {
     const baseArgs = ['-p', fullPrompt, '--output-format', 'text', sessionFlag, sessionId];
 
     if (ctx.environment && ctx.cwd) {
-      const skills = await linkSkills(ctx.environment, ctx.cwd);
+      const skills = await mountSkills(ctx.environment, ctx.cwd);
       if (skills.conflicted.length > 0) {
         for (const c of skills.conflicted) {
           // eslint-disable-next-line no-console
-          console.warn(`[claude] skill not linked (${c.reason}): ${c.path}`);
+          console.warn(`[claude] skill not mounted (${c.reason}): ${c.path}`);
         }
       }
       if (ctx.onSkillsLinked) ctx.onSkillsLinked(skills);

package/src/lib/environment.js

@@ -5,7 +5,7 @@
  * how an agent's runtime should be shaped: workspace path, sandbox mode, the
  * Claude skills to mount, the MCP servers to expose. This module is the
  * adapter-facing read-side: parse, validate, and realize the workspace +
- * skill links on disk. Sandbox argv wrapping lives in `./sandbox/bwrap.js`
+ * skill mounts on disk. Sandbox argv wrapping lives in `./sandbox/bwrap.js`
  * because it is per-driver (Linux-only, bwrap-specific).
  *
  * Zero runtime deps: Node 20 has no built-in YAML, so we accept JSON only and
@@ -14,7 +14,9 @@
  * place to add a `.yaml` branch — the rest of the module is parser-agnostic.
  */
 
-import { readFile, mkdir, symlink, lstat, readlink, cp } from 'fs/promises';
+import {
+  readFile, mkdir, lstat, cp, rm, chmod, readdir, writeFile,
+} from 'fs/promises';
 import { existsSync } from 'fs';
 import { dirname, isAbsolute, join, resolve as pathResolve, basename } from 'path';
 import { homedir } from 'os';
@@ -25,7 +27,7 @@ import { homedir } from 'os';
 // relative skill paths) is NOT stored on the returned spec. Leaking the user's
 // absolute filesystem path into `config.environment` sent to the backend
 // exposes `$HOME` layout for zero server-side benefit. Callers pass
-// `envFileDir` as a separate argument to resolveWorkspace / linkSkills.
+// `envFileDir` as a separate argument to resolveWorkspace / mountSkills.
 
 const ALLOWED_TOP_KEYS = new Set([
   'version', 'workspace', 'sandbox', 'skills', 'mcp',
@@ -85,7 +87,7 @@ export const parseEnvironmentFile = async (absolutePath) => {
   // Return the bare spec — no envFileDir wrapping, no underscore-prefixed
   // annotations. The caller is responsible for tracking envFileDir separately
   // (compute via `dirname(envPath)`) and passing it explicitly to
-  // resolveWorkspace / linkSkills when relative paths in the spec need to
+  // resolveWorkspace / mountSkills when relative paths in the spec need to
   // resolve. This keeps the spec safe to serialize and ship to the backend
   // (`config.environment` on AgentInstallation) without leaking $HOME layout.
   return parsed;
@@ -246,35 +248,72 @@ export const resolveWorkspace = async (spec, agentName, envFileDir = null) => {
   return { path: absPath, created };
 };
 
-// ── linkSkills ──────────────────────────────────────────────────────────────
+// ── mountSkills ─────────────────────────────────────────────────────────────
+
+// Marks a skill directory as a Commonly-managed snapshot. Its presence is what
+// licenses a refresh to delete and re-copy the directory: without it we cannot
+// distinguish "a mount we made last spawn" from "a skill the user authored in
+// their workspace", and clobbering the latter would destroy real work.
+const MOUNT_MARKER = '.commonly-skill-mount';
 
 /**
- * Symlink each `skills.claude[]` source path into `<workspacePath>/.claude/skills/`.
+ * Recursively drop the write bit on every regular file in a mounted snapshot.
+ *
+ * Directories deliberately stay writable: unlinking a file requires write
+ * permission on its PARENT, so read-only directories would make the next
+ * refresh fail. This is defense-in-depth for the agent's own copy, not the
+ * load-bearing protection — that comes from the copy existing at all.
+ */
+const freezeFiles = async (dir) => {
+  const entries = await readdir(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) {
+      // eslint-disable-next-line no-await-in-loop
+      await freezeFiles(full);
+    } else if (entry.isFile()) {
+      // eslint-disable-next-line no-await-in-loop
+      await chmod(full, 0o444);
+    }
+  }
+};
+
+/**
+ * Mount each `skills.claude[]` source into `<workspacePath>/.claude/skills/`
+ * as a READ-ONLY SNAPSHOT COPY.
+ *
+ * Why a copy and not a symlink: a symlink is writable *through*, so an agent
+ * holding Write/Edit could edit the file that governs its own behaviour — and
+ * because these sources are usually files tracked in a repo (the bundled
+ * `cli/skills/commonly` is the common case), that edit lands in the operator's
+ * working tree. `npm publish` ships the working tree, not git HEAD, so a
+ * write-through edit can silently ride out in the next release. That is not
+ * hypothetical: @commonlyai/cli@0.1.4 shipped with the "post as yourself,
+ * never as your operator" guardrail (#702) missing for exactly this reason.
+ * The snapshot makes the data flow one-way: source → workspace, never back.
  *
- * Idempotent: if a symlink already points at the declared source, it is
- * counted in `skipped` and left in place. If a DIFFERENT file or symlink
- * occupies the slot, it is recorded in `conflicted` with a reason — never
- * overwritten (a user-edited skill in the workspace must not be clobbered).
- * Missing source paths are also reported in `conflicted` so the caller can
- * surface them.
+ * Refreshed on every call — the claude adapter mounts per spawn — so edits to
+ * the source still reach the agent on its next turn. Only directories carrying
+ * MOUNT_MARKER are refreshed; anything else in the slot is reported as a
+ * conflict and left untouched.
+ *
+ * Legacy symlinks written by CLI ≤0.1.4 are replaced with a snapshot, since
+ * the symlink IS the vulnerable shape being retired.
  *
  * `envFileDir` is the directory of the env file (used to resolve relative
  * skill paths). Optional — when omitted, relative paths fall back to
- * `workspacePath`. Pass it from `performAttach` for attach-time resolution
- * matching the env file's location.
+ * `workspacePath`.
  *
- * Returns `{ linked, skipped, conflicted }`:
- *   - `linked`:     string[]            — newly created symlinks (absolute source paths)
- *   - `skipped`:    string[]            — already correctly linked (no-op)
+ * Returns `{ mounted, conflicted }`:
+ *   - `mounted`:    string[]            — absolute source paths snapshotted
  *   - `conflicted`: Array<{path, reason}> where reason ∈
- *       'different-target' | 'not-symlink' | 'missing-source'
+ *       'not-a-mount' | 'missing-source'
  */
-export const linkSkills = async (spec, workspacePath, envFileDir = null) => {
+export const mountSkills = async (spec, workspacePath, envFileDir = null) => {
   const sources = Array.isArray(spec?.skills?.claude) ? spec.skills.claude : [];
-  const linked = [];
-  const skipped = [];
+  const mounted = [];
   const conflicted = [];
-  if (sources.length === 0) return { linked, skipped, conflicted };
+  if (sources.length === 0) return { mounted, conflicted };
 
   const skillsDir = join(workspacePath, '.claude', 'skills');
   await mkdir(skillsDir, { recursive: true });
@@ -288,47 +327,43 @@ export const linkSkills = async (spec, workspacePath, envFileDir = null) => {
       conflicted.push({ path: absSource, reason: 'missing-source' });
       continue;
     }
-    const linkPath = join(skillsDir, basename(absSource));
+    const destPath = join(skillsDir, basename(absSource));
 
-    let existingTarget = null;
-    let slotIsNonSymlink = false;
+    let slot = null;
     try {
       // eslint-disable-next-line no-await-in-loop
-      const stat = await lstat(linkPath);
-      if (stat.isSymbolicLink()) {
-        // eslint-disable-next-line no-await-in-loop
-        existingTarget = await readlink(linkPath);
-      } else {
-        slotIsNonSymlink = true;
-      }
+      slot = await lstat(destPath);
     } catch (err) {
       // Only ENOENT means "slot is free, proceed." EACCES / EPERM / EIO are
-      // real failures that should surface — without this narrowing the
-      // subsequent symlink() call fails with a confusing follow-on error.
+      // real failures that should surface rather than becoming a confusing
+      // follow-on error from the copy below.
       if (err.code !== 'ENOENT') throw err;
     }
 
-    if (slotIsNonSymlink) {
-      conflicted.push({ path: absSource, reason: 'not-symlink' });
-      continue;
-    }
-
-    if (existingTarget) {
-      const resolvedExisting = isAbsolute(existingTarget)
-        ? existingTarget
-        : pathResolve(skillsDir, existingTarget);
-      if (resolvedExisting === absSource) {
-        skipped.push(absSource);
+    if (slot) {
+      const isLegacySymlink = slot.isSymbolicLink();
+      const isOwnedMount = slot.isDirectory() && existsSync(join(destPath, MOUNT_MARKER));
+      if (!isLegacySymlink && !isOwnedMount) {
+        // A real file, or a directory we did not create — user content.
+        conflicted.push({ path: absSource, reason: 'not-a-mount' });
         continue;
       }
-      conflicted.push({ path: absSource, reason: 'different-target' });
-      continue;
+      // eslint-disable-next-line no-await-in-loop
+      await rm(destPath, { recursive: true, force: true });
     }
 
     // eslint-disable-next-line no-await-in-loop
-    await symlink(absSource, linkPath);
-    linked.push(absSource);
+    await cp(absSource, destPath, { recursive: true });
+    // eslint-disable-next-line no-await-in-loop
+    await writeFile(
+      join(destPath, MOUNT_MARKER),
+      `mounted-from: ${absSource}\n`,
+      'utf8',
+    );
+    // eslint-disable-next-line no-await-in-loop
+    await freezeFiles(destPath);
+    mounted.push(absSource);
   }
 
-  return { linked, skipped, conflicted };
+  return { mounted, conflicted };
 };