@commonlyai/cli 0.1.48 → 0.1.50

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.48",
+  "version": "0.1.50",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/lib/adapters/pi-commonly-mcp.mjs

@@ -12,10 +12,12 @@
  */
 
 import { Type } from 'typebox';
-import { connectMcp, readServers, toPiResult } from './pi-mcp-client.mjs';
+import { connectMcp, takeServers, toPiResult } from './pi-mcp-client.mjs';
 
 export default async function commonlyMcpBridge(pi) {
-  const servers = readServers(process.env.COMMONLY_PI_MCP);
+  // Read once and remove: the list carries the seat token, and pi's bash tool
+  // inherits this process's env (see takeServers).
+  const servers = takeServers(process.env);
   const clients = [];
   for (const server of servers) {
     const client = connectMcp(server);

package/src/lib/adapters/pi-mcp-client.mjs

@@ -78,6 +78,19 @@ export const toPiResult = (result) => {
   return { content: [{ type: 'text', text: result?.isError ? `error: ${text}` : text }], details: { isError: !!result?.isError } };
 };
 
+/**
+ * Read the server list and REMOVE it from the environment. The list carries each
+ * server's substituted env — the seat's bearer token among it — and pi's `bash`
+ * tool spawns with `{ ...process.env }` (pi's getShellEnv), so leaving it in place
+ * lets one `env` from the model print the token. The MCP children already hold
+ * their own env from spawn time; nothing else reads this variable.
+ */
+export const takeServers = (env = process.env) => {
+  const servers = readServers(env.COMMONLY_PI_MCP);
+  delete env.COMMONLY_PI_MCP;
+  return servers;
+};
+
 export const readServers = (raw) => {
   if (!raw) return [];
   try { return JSON.parse(raw).filter((s) => s?.name && Array.isArray(s.command) && s.command.length); } catch { return []; }

package/src/lib/adapters/pi.js

@@ -145,6 +145,17 @@ export const sessionExists = async (sessionDir, sessionId) => {
   }
 };
 
+/** Fail closed: pi cannot enforce `environment.sandbox`, so a seat that declares one does not start. */
+export const assertNoSandboxDeclared = (environment = {}) => {
+  const sandbox = environment?.sandbox || {};
+  if (sandbox.trust === 'public') {
+    throw new Error('pi adapter: public-trust seats are not supported — pi has no enforced sandbox; do not attach a pi seat to a stranger-readable pod');
+  }
+  if (sandbox.mode && sandbox.mode !== 'none') {
+    throw new Error(`pi adapter: sandbox.mode=${sandbox.mode} cannot be enforced by pi; remove it or use the claude/codex adapter`);
+  }
+};
+
 export const buildArgs = ({
   prompt, provider, model, thinking, sessionId, isResume, sessionDir, bridge,
 }) => [
@@ -214,6 +225,10 @@ export default {
   },
 
   async spawn(prompt, ctx = {}) {
+    // pi has no enforced sandbox. claude.js and codex.js refuse a public-trust
+    // seat they cannot confine; so does this adapter, and it refuses any declared
+    // sandbox mode rather than run unconfined under a spec that promised one.
+    assertNoSandboxDeclared(ctx.environment);
     const provider = resolveProvider(ctx.environment);
     const model = ctx.environment?.model || DEFAULT_MODEL;
     const thinking = thinkingFor(ctx.environment?.effort);