@commonlyai/cli 0.1.47 → 0.1.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.47",
+  "version": "0.1.50",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/lib/adapters/pi-commonly-mcp.mjs

@@ -12,10 +12,12 @@
  */
 
 import { Type } from 'typebox';
-import { connectMcp, readServers, toPiResult } from './pi-mcp-client.mjs';
+import { connectMcp, takeServers, toPiResult } from './pi-mcp-client.mjs';
 
 export default async function commonlyMcpBridge(pi) {
-  const servers = readServers(process.env.COMMONLY_PI_MCP);
+  // Read once and remove: the list carries the seat token, and pi's bash tool
+  // inherits this process's env (see takeServers).
+  const servers = takeServers(process.env);
   const clients = [];
   for (const server of servers) {
     const client = connectMcp(server);

package/src/lib/adapters/pi-mcp-client.mjs

@@ -78,6 +78,19 @@ export const toPiResult = (result) => {
   return { content: [{ type: 'text', text: result?.isError ? `error: ${text}` : text }], details: { isError: !!result?.isError } };
 };
 
+/**
+ * Read the server list and REMOVE it from the environment. The list carries each
+ * server's substituted env — the seat's bearer token among it — and pi's `bash`
+ * tool spawns with `{ ...process.env }` (pi's getShellEnv), so leaving it in place
+ * lets one `env` from the model print the token. The MCP children already hold
+ * their own env from spawn time; nothing else reads this variable.
+ */
+export const takeServers = (env = process.env) => {
+  const servers = readServers(env.COMMONLY_PI_MCP);
+  delete env.COMMONLY_PI_MCP;
+  return servers;
+};
+
 export const readServers = (raw) => {
   if (!raw) return [];
   try { return JSON.parse(raw).filter((s) => s?.name && Array.isArray(s.command) && s.command.length); } catch { return []; }

package/src/lib/adapters/pi.js

@@ -34,7 +34,7 @@
 
 import { spawn as childSpawn, spawnSync } from 'child_process';
 import { createHash, randomUUID } from 'crypto';
-import { mkdir, writeFile } from 'fs/promises';
+import { mkdir, readdir, writeFile } from 'fs/promises';
 import { homedir } from 'os';
 import { dirname, join } from 'path';
 import { fileURLToPath } from 'url';
@@ -127,6 +127,35 @@ export const seatHome = (ctx) => {
   return ctx._piHome || join(homedir(), '.commonly', 'pi-homes', hash);
 };
 
+/**
+ * Only a session pi wrote can be resumed. The wrapper persists one id per
+ * (agent, pod) across adapters, so a seat switched from codex hands pi the
+ * codex thread id on its first turn — pi answers `No session found` and the
+ * turn fails (sprint-impl's first spawn, 2026-09-18 05:06Z). pi's session
+ * files are `<timestamp>_<id>.jsonl` under the seat's session dir; an id with
+ * no file starts a fresh session under a new id, which the wrapper persists.
+ */
+export const sessionExists = async (sessionDir, sessionId) => {
+  if (!sessionId) return false;
+  try {
+    const files = await readdir(sessionDir);
+    return files.some((name) => name.endsWith(`_${sessionId}.jsonl`) || name === `${sessionId}.jsonl`);
+  } catch {
+    return false;
+  }
+};
+
+/** Fail closed: pi cannot enforce `environment.sandbox`, so a seat that declares one does not start. */
+export const assertNoSandboxDeclared = (environment = {}) => {
+  const sandbox = environment?.sandbox || {};
+  if (sandbox.trust === 'public') {
+    throw new Error('pi adapter: public-trust seats are not supported — pi has no enforced sandbox; do not attach a pi seat to a stranger-readable pod');
+  }
+  if (sandbox.mode && sandbox.mode !== 'none') {
+    throw new Error(`pi adapter: sandbox.mode=${sandbox.mode} cannot be enforced by pi; remove it or use the claude/codex adapter`);
+  }
+};
+
 export const buildArgs = ({
   prompt, provider, model, thinking, sessionId, isResume, sessionDir, bridge,
 }) => [
@@ -196,9 +225,10 @@ export default {
   },
 
   async spawn(prompt, ctx = {}) {
-    const isResume = !!ctx.sessionId;
-    const sessionId = ctx.sessionId || randomUUID();
-    const fullPrompt = buildMemoryPreamble(prompt, ctx.memoryLongTerm, { freshSession: !isResume });
+    // pi has no enforced sandbox. claude.js and codex.js refuse a public-trust
+    // seat they cannot confine; so does this adapter, and it refuses any declared
+    // sandbox mode rather than run unconfined under a spec that promised one.
+    assertNoSandboxDeclared(ctx.environment);
     const provider = resolveProvider(ctx.environment);
     const model = ctx.environment?.model || DEFAULT_MODEL;
     const thinking = thinkingFor(ctx.environment?.effort);
@@ -213,6 +243,12 @@ export default {
     const sessionDir = join(home, 'sessions');
     await mkdir(agentDir, { recursive: true, mode: 0o700 });
     await mkdir(sessionDir, { recursive: true, mode: 0o700 });
+
+    // Resume only what pi wrote; anything else (a codex thread id from before
+    // the switch, a wiped home) starts fresh under a new id.
+    const isResume = await sessionExists(sessionDir, ctx.sessionId);
+    const sessionId = isResume ? ctx.sessionId : randomUUID();
+    const fullPrompt = buildMemoryPreamble(prompt, ctx.memoryLongTerm, { freshSession: !isResume });
     await writeFile(join(agentDir, 'models.json'), `${JSON.stringify(buildModelsJson(provider, model), null, 2)}\n`, { mode: 0o600 });
 
     const servers = resolveMcpServers(ctx.environment?.mcp, ctx);