@commonlyai/cli 0.1.56 → 0.1.58

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.56",
+  "version": "0.1.58",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/daemon.js

@@ -34,6 +34,24 @@ import {
 import { daemonLogsDir, daemonSeatLogPath, readLogTail } from '../lib/daemon-logs.js';
 import { loadDaemonState, saveDaemonState } from '../lib/daemon-state.js';
 
+// One supervised seat, as `commonly daemon status --verbose` names it. Two of these
+// fields are worth reading closely: the seat's `instanceId` (the identity the
+// platform routes by, so a seat attached to the wrong instance is otherwise
+// invisible) and the supervisor's `restarts` flap counter — which is written,
+// persisted and served, and was shown by no surface at all, so a seat that had
+// been crash-looping looked exactly like a healthy one (TASK-072, 2026-09-19).
+//
+// `restarts` distinguishes 0 from absent on purpose: a state file written by an
+// older daemon has no such field, and printing 0 for it would claim a reading the
+// file does not carry.
+export const formatSeatLine = (seat = {}) => {
+  const model = seat.model || 'default model';
+  const effort = seat.effort ? `/${seat.effort}` : '';
+  const error = seat.lastError ? ` error=${seat.lastError}` : '';
+  const restarts = seat.restarts === undefined || seat.restarts === null ? '-' : seat.restarts;
+  return `  ${seat.agentName}: ${seat.state} instance=${seat.instanceId || '-'} adapter=${seat.adapter || 'unknown'} model=${model}${effort} pid=${seat.pid || '-'} restarts=${restarts} lastTurn=${seat.lastTurnAt || 'never'}${error}`;
+};
+
 const requireDaemonRecord = () => {
   const record = loadDaemonRecord();
   if (!record) {
@@ -397,12 +415,7 @@ Examples:
             console.log('Local supervisor state: no supervised seats.');
           } else {
             console.log('Local supervised seats:');
-            for (const seat of local.seats) {
-              const model = seat.model || 'default model';
-              const effort = seat.effort ? `/${seat.effort}` : '';
-              const error = seat.lastError ? ` error=${seat.lastError}` : '';
-              console.log(`  ${seat.agentName}: ${seat.state} adapter=${seat.adapter || 'unknown'} model=${model}${effort} pid=${seat.pid || '-'} lastTurn=${seat.lastTurnAt || 'never'}${error}`);
-            }
+            for (const seat of local.seats) console.log(formatSeatLine(seat));
           }
         }
       } catch (error) {

package/src/lib/adapters/pi-commonly-mcp.mjs

@@ -1,8 +1,9 @@
 /**
  * pi extension: Commonly's tools for a pi seat, over MCP.
  *
- * Loaded by adapters/pi.js with `-e`. Reads COMMONLY_PI_MCP — a JSON list of
- * `{ name, command: [...], env: {...} }` for stdio servers and
+ * Loaded by adapters/pi.js with `-e`. Reads fd 3 — a pipe the adapter writes the
+ * JSON into and ends at spawn, never the environment (see takeServers) — a JSON
+ * list of `{ name, command: [...], env: {...} }` for stdio servers and
  * `{ name, url, headers: {...} }` for Streamable HTTP ones — connects to each,
  * asks it for its tools, and registers every one with pi under its own name, so
  * a pi seat calls `commonly_post_message` exactly as a claude or codex seat
@@ -20,9 +21,16 @@ import { Type } from 'typebox';
 import { connectMcp, takeServers, toPiResult } from './pi-mcp-client.mjs';
 
 export default async function commonlyMcpBridge(pi) {
-  // Read once and remove: the list carries the seat token, and pi's bash tool
-  // inherits this process's env (see takeServers).
-  const servers = takeServers(process.env);
+  // Read once and consume: the read drains the pipe, so the list (which carries
+  // the seat token) does not survive anywhere in this process that a child could
+  // reach — not the environment, which is why it does not arrive that way.
+  const servers = takeServers();
+  // The adapter loads this extension only when it has a list to hand over, so an
+  // empty read means the channel itself failed. Say so: the symptom otherwise is
+  // a seat that silently has no commonly_* tools at all.
+  if (!servers.length) {
+    process.stderr.write('[commonly-pi-bridge] no server list on fd 3 — this seat has no commonly_* tools\n');
+  }
   const clients = [];
   for (const server of servers) {
     const client = connectMcp(server);

package/src/lib/adapters/pi-mcp-client.mjs

@@ -18,6 +18,7 @@
  */
 
 import { spawn } from 'node:child_process';
+import { closeSync, readFileSync } from 'node:fs';
 
 /**
  * The grant broker's path. wren's ruling for the daemon-side half of TASK-063:
@@ -166,14 +167,10 @@ const parseMessages = (text, contentType) => {
  *
  * `headers` is where a declared `Authorization` arrives, already substituted
  * with the seat's runtime token by the adapter. The token therefore rides in an
- * HTTP header built from the JSON list the bridge takes out of its own
- * environment (see takeServers) and never on argv. NOT on argv is the whole of
- * that guarantee: deleting the variable from the bridge's own process scrubs
- * Node's copy, not the kernel's, so a same-user child of this process can still
- * read the parent's environment (`ps eww $PPID`, `/proc/$PPID/environ`) and find
- * both the token and the server list. Treat this as "not in argv" and not as a
- * secrecy boundary; the fix is to hand the list over a 0600 file the bridge
- * unlinks on load (row filed against the bridge's env channel, Vera, Connectors).
+ * HTTP header built from the JSON list the bridge reads off its own fd 3 (see
+ * takeServers) — never on argv, and never in this process's environment, which a
+ * same-user child of this process can read back whole (`ps eww $PPID`,
+ * `/proc/$PPID/environ`) no matter what this process deletes from its own copy.
  */
 export const connectHttpMcp = ({ name, url, headers }, { fetchImpl = globalThis.fetch, timeoutMs = 60_000 } = {}) => {
   if (typeof fetchImpl !== 'function') throw new Error(`${name}: no fetch implementation for the HTTP MCP transport`);
@@ -278,23 +275,58 @@ export const toPiResult = (result) => {
 };
 
 /**
- * Read the server list and REMOVE it from the environment. The list carries every
- * server's substituted secrets — a stdio server's env and an HTTP server's
- * `Authorization` header, the seat's bearer token among them — and pi's `bash`
- * tool spawns with `{ ...process.env }` (pi's getShellEnv), so leaving it in place
- * lets one `env` from the model print the token. The clients already hold what
- * they need from spawn time; nothing else reads this variable.
+ * Read the server list off the inherited pipe on `fd` and CONSUME it.
  *
- * What this does NOT do is hide the value from a process that reads the parent's
- * environment directly: `delete` removes the key from this process's own copy,
- * while the kernel keeps the copy this process was started with, so
- * `ps eww $PPID` on macOS and `/proc/$PPID/environ` on Linux still show it to a
- * same-user child. This closes the accidental vector, not a determined one.
+ * The list carries every server's substituted secrets — a stdio server's env and
+ * an HTTP server's `Authorization` header, the seat's bearer token among them —
+ * and pi's `bash` tool spawns with `{ ...process.env }` (pi's getShellEnv), so it
+ * has to arrive by a channel pi's children do not inherit and must not outlive
+ * the read. It arrives here as fd 3: a pipe the adapter writes the JSON into and
+ * ends at spawn (pi.js runPi). This reads it to EOF and closes the descriptor.
+ *
+ * WHY NOT THE ENVIRONMENT, which is what this replaced: deleting the variable
+ * scrubbed Node's copy only, while the kernel keeps the environment this process
+ * was STARTED with, so a same-user child still read the token back with
+ * `ps eww $PPID` on macOS and `/proc/$PPID/environ` on Linux. Unsetting it at
+ * spawn cannot help either, because this runs inside the pi process that holds
+ * it. WHY NOT a 0600 file the bridge unlinks on load: the mode protects nothing
+ * against a same-user reader, and that shape needs both the unlink and a close
+ * to leave no window, since `/proc/<pid>/fd` on Linux still reaches an unlinked
+ * inode. A pipe has neither a path nor a stored copy.
+ *
+ * THE READ IS WHAT REMOVES THE SECRET, not the close: a pipe is consumed, so a
+ * second reader gets nothing. Measured against pi 0.84.1 — after a read to EOF
+ * a second read of the same descriptor returned zero bytes, while a 5-byte
+ * partial read left the remainder readable. Closing afterwards is hygiene.
+ *
+ * Two further measurements this rests on, both against pi 0.84.1: pi does not
+ * close inherited descriptors before loading extensions, so fd 3 is still open
+ * here (this runs at extension load, before the first model turn — and before
+ * any bash tool can run); and pi's own spawns (`dist/core/tools/bash.js`,
+ * `dist/core/exec.js`) pass a THREE-element stdio list, so a shell tool child
+ * does not inherit fd 3 at all.
+ *
+ * An unreadable descriptor yields no servers rather than throwing: a seat whose
+ * bridge cannot read its list should run without Commonly tools, not fail to
+ * start. The bridge logs that empty result (pi-commonly-mcp.mjs).
+ *
+ * The descriptor is closed only after a successful read, and that is not
+ * tidiness: on macOS, `closeSync` on the descriptor Node opens for an `'ignore'`
+ * stdio entry aborts the process — measured 2026-09-19, Node 20 — with
+ * `Assertion failed: (errno == EINTR), function uv__io_poll, file kqueue.c`,
+ * where the read itself had already failed harmlessly with `ENXIO`. A close in
+ * `finally` therefore turns "no channel" into a SIGABRT in the seat.
  */
-export const takeServers = (env = process.env) => {
-  const servers = readServers(env.COMMONLY_PI_MCP);
-  delete env.COMMONLY_PI_MCP;
-  return servers;
+export const takeServers = (fd = 3) => {
+  let raw = null;
+  try {
+    raw = readFileSync(fd, 'utf8');
+  } catch {
+    // Nothing to close: the read failed, so this was not a descriptor we consumed.
+    return [];
+  }
+  try { closeSync(fd); } catch { /* already closed */ }
+  return readServers(raw);
 };
 
 /**

package/src/lib/adapters/pi.js

@@ -110,15 +110,13 @@ const originOf = (value) => {
  * is a Streamable HTTP server (`agentBinding.ts` grantBrokerServer), so before
  * this pi dropped the one entry that carries a grant to a seat, silently.
  * Filling the headers here reuses the same substitution as the stdio env, and
- * the result rides in COMMONLY_PI_MCP — which the bridge removes from its own
- * process environment at load (see takeServers). That closes the direct vector
- * (pi's `bash` spawns with `{ ...process.env }`, so a bare `env` used to print
- * the token); it is not a secrecy boundary, because deleting the variable
- * scrubs Node's copy and not the kernel's — a same-user child of the bridge can
- * still read this process's environment via `ps eww` / `/proc/$PPID/environ`.
- * The durable fix is to hand the list over a 0600 file the bridge unlinks on
- * load, which is a row against this env channel, not against this PR (Vera,
- * Connectors).
+ * the result is written into pi's fd 3 at spawn — a pipe the bridge reads to EOF
+ * and closes (see takeServers), never the child's environment and never argv. The
+ * environment is not usable for this: the kernel keeps the copy the process was
+ * started with, so a same-user child could read the token back with
+ * `ps eww $PPID` / `/proc/$PPID/environ` even after the bridge deleted its own
+ * copy — which is what the previous channel did, and the row this closes
+ * (Vera, Connectors).
  *
  * WHICH shape an entry becomes is decided by `transport` — the same field, read
  * with the same default and the same exact comparison the daemon's
@@ -314,11 +312,24 @@ export const extractReply = (stdout) => {
   return { text, sawAssistant, errors };
 };
 
-const runPi = ({ args, cwd, env, timeoutMs, spawnImpl = childSpawn }) => new Promise((resolve, reject) => {
+const runPi = ({ args, cwd, env, payload, timeoutMs, spawnImpl = childSpawn }) => new Promise((resolve, reject) => {
   let stdout = '';
   let stderr = '';
   let timedOut = false;
-  const proc = spawnImpl('pi', args, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'] });
+  // fd 3 carries the MCP server list, so the 4th pipe exists exactly when there
+  // is a list to hand over. The bridge reads it at extension load (takeServers).
+  const withList = typeof payload === 'string';
+  const proc = spawnImpl('pi', args, { cwd, env, stdio: withList ? ['ignore', 'pipe', 'pipe', 'pipe'] : ['ignore', 'pipe', 'pipe'] });
+  if (withList) {
+    const channel = proc.stdio && proc.stdio[3];
+    // A missing pipe is an invariant break, not a degraded mode: the bridge would
+    // read EBADF and the seat would silently have no commonly_* tools.
+    if (!channel) { reject(new Error('pi adapter: no fd 3 pipe to carry the MCP server list')); return; }
+    // The child may exit before draining; that surfaces on 'close', so a write
+    // error here must not become an unhandled error event.
+    channel.on('error', () => {});
+    channel.end(payload);
+  }
   const timer = setTimeout(() => { timedOut = true; proc.kill('SIGTERM'); }, timeoutMs);
   proc.stdout.on('data', (chunk) => { stdout += chunk.toString(); });
   proc.stderr.on('data', (chunk) => { stderr += chunk.toString(); });
@@ -378,7 +389,6 @@ export default {
       ...baseEnv,
       PI_CODING_AGENT_DIR: agentDir,
       PI_SKIP_VERSION_CHECK: '1',
-      ...(servers.length ? { COMMONLY_PI_MCP: JSON.stringify(servers) } : {}),
     };
     const args = buildArgs({
       prompt: fullPrompt, provider: provider.name, model, thinking, sessionId, isResume, sessionDir,
@@ -389,6 +399,7 @@ export default {
       args,
       cwd: ctx.cwd,
       env: childEnv,
+      payload: servers.length ? JSON.stringify(servers) : undefined,
       timeoutMs: ctx.timeoutMs || DEFAULT_TIMEOUT_MS,
       spawnImpl: ctx._spawnImpl, // test seam only — do not use in production
     });