@commonlyai/cli 0.1.69 → 0.1.70

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.69",
+  "version": "0.1.70",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -34,6 +34,7 @@ import { detectMemorySources, composeImport, importMemory } from '../lib/memory-
 import { detectSkills, importSkills } from '../lib/skills-import.js';
 import { parseEnvironmentFile, resolveWorkspace, validateEnvironmentSpec } from '../lib/environment.js';
 import { ADAPTERS_WITH_DEFAULT_MCP, defaultMcpServers } from '../lib/default-environment.js';
+import { withholdGrantBroker } from '../lib/grant-broker-guard.js';
 import {
   FOCUS_FRAME_MAX_CODE_POINTS,
   formatPodFocusFrame,
@@ -872,6 +873,27 @@ export const performRun = ({
   sleepImpl = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); }),
 }) => {
   const client = createClient({ instance: instanceUrl, token });
+
+  // THE SEAT'S OWN RECORD IS THE ONLY DECLARATION THERE IS. The broker reaches a
+  // seat as an injected MCP entry written by hand into its environment — no
+  // server projection puts it there (`GRANT_BROKER_URL` is imported by one
+  // route, the daemon assignment, and that one already refuses). So a seat run
+  // by `commonly agent run` under launchd spawns the entry verbatim, and the
+  // confinement it promises is declared in a different field (`sandbox`), which
+  // can disagree. The daemon half of this refusal already runs
+  // (`daemon-supervisor.js`); this is the same predicate at the only other site
+  // that can see the record — same code, so one refusal with two emitters.
+  //
+  // IN MEMORY, RECORD UNTOUCHED (wren 71641): the withheld environment is what
+  // the adapter spawns with, and the stored record keeps its broker, so the
+  // daemon stays the layer that judges a host it knows. Applied once for the
+  // run rather than per turn: `agent run` reads its record once at boot.
+  const seatEnvironment = withholdGrantBroker(environment, adapter?.name, {
+    instanceUrl,
+    onRefuse: (refusal, names) => log(
+      `${refusal.code} (${refusal.reason}) — withholding ${names.join(', ')}: ${refusal.detail}`,
+    ),
+  });
   let running = true;
   // Stop-after-N-auth-failures: without this, a revoked token leaves the
   // poller hammering 401s forever at 60s backoff — invisible to the user.
@@ -1195,7 +1217,7 @@ export const performRun = ({
       cwd: agentCwd,
       env: process.env,
       memoryLongTerm,
-      environment,
+      environment: seatEnvironment,
       // Runtime context the Claude/Codex adapters expose only to their
       // per-spawn MCP environment. Claude keeps ${COMMONLY_*} placeholders
       // literal on disk and lets its native MCP parser expand them, so the

package/src/lib/environment.js

@@ -69,6 +69,22 @@ export const normalizeSandboxTrust = (sandbox) => (
     ? { ...sandbox, trust: LEGACY_SANDBOX_TRUST[sandbox.trust] }
     : sandbox
 );
+/**
+ * A declared trust resolved THROUGH the legacy table: `internal` → `public`,
+ * anything else (including absent) is itself.
+ *
+ * Exported so every gate reads the mapping once. `normalizeSandboxTrust` above
+ * rewrites a whole sandbox object; this is the scalar form for a site that only
+ * compares the trust and must not write anything back. The server spells the
+ * same predicate `effectiveSandboxTrust` (`grantBrokerConfinement.ts`) — the two
+ * sides have to read `internal` the same way or one of them confines a seat the
+ * other withholds from (Wren 71662).
+ */
+export const effectiveSandboxTrust = (trust) => (
+  typeof trust === 'string' && Object.prototype.hasOwnProperty.call(LEGACY_SANDBOX_TRUST, trust)
+    ? LEGACY_SANDBOX_TRUST[trust]
+    : trust
+);
 
 const expandHome = (p) => {
   if (!p || typeof p !== 'string') return p;

package/src/lib/grant-broker-guard.js

@@ -74,7 +74,7 @@
  */
 import { isGrantBrokerUrl } from './adapters/pi-mcp-client.mjs';
 import { ADAPTERS_WITH_DEFAULT_SANDBOX } from './default-environment.js';
-import { LEGACY_SANDBOX_TRUST } from './environment.js';
+import { effectiveSandboxTrust } from './environment.js';
 import { PUBLIC_SANDBOX_MODES, resolvePublicSandboxMode } from './sandbox/mode.js';
 
 /** One typed code, two emitters (`decidedBy` says which one spoke). */
@@ -92,13 +92,6 @@ export const ENFORCING_MODES = new Set([...PUBLIC_SANDBOX_MODES, 'bwrap']);
 const URL_PLACEHOLDERS = ['${COMMONLY_API_URL}', '${COMMONLY_INSTANCE_URL}'];
 const PARSE_ANCHOR = 'https://grant-declaration.invalid';
 
-/** `internal` → `public`; anything else (including absent) is itself. */
-const effectiveTrust = (trust) => (
-  typeof trust === 'string' && Object.prototype.hasOwnProperty.call(LEGACY_SANDBOX_TRUST, trust)
-    ? LEGACY_SANDBOX_TRUST[trust]
-    : trust
-);
-
 /**
  * A bound instance is only trimmed here (`agent.js` does the same). Any
  * trailing slash it carries is deliberately left alone: the doubled slash it
@@ -190,7 +183,7 @@ export const confinementReason = (environment, adapter, platform = process.platf
   if (sandbox === null || typeof sandbox !== 'object' || Array.isArray(sandbox)) return 'sandbox_absent';
   const declared = sandbox;
   if (declared.mode === 'none') return 'sandbox_mode_none';
-  if (effectiveTrust(declared.trust) !== 'public') return 'sandbox_trust_not_public';
+  if (effectiveSandboxTrust(declared.trust) !== 'public') return 'sandbox_trust_not_public';
   const mode = resolvePublicSandboxMode(declared, platform);
   if (typeof mode !== 'string' || !ENFORCING_MODES.has(mode)) return 'sandbox_mode_unenforceable';
   return null;
@@ -220,7 +213,7 @@ const detailFor = (reason, adapter, environment) => {
   }
   const trust = environment?.sandbox?.trust;
   const shown = trust === undefined ? 'absent' : `'${String(trust)}'`;
-  return `the declared sandbox.trust is ${shown}${shown === 'absent' ? '' : ` (effective '${String(effectiveTrust(trust))}')`},`
+  return `the declared sandbox.trust is ${shown}${shown === 'absent' ? '' : ` (effective '${String(effectiveSandboxTrust(trust))}')`},`
     + " and no host confines a seat whose trust is not 'public'; declare sandbox.trust 'public'" + ` ${drop}`;
 };
 

package/src/lib/sandbox/mode.js

@@ -12,23 +12,30 @@
  *   darwin  → 'workspace' (the claude adapter maps it to Seatbelt)
  *   else    → 'bwrap'     (bubblewrap; attach checks it is installed)
  *
- * Resolution is PUBLIC-only on purpose. A non-public declaration keeps whatever
- * mode it wrote, and an adapter that cannot enforce it is expected to refuse
- * rather than quietly spawn unconfined. An explicit mode on a public
- * declaration still wins — including a wrong one, which the caller then
- * refuses (Vera 69548: an unresolvable public mode must not fall through to a
- * bare, unconfined spawn).
+ * Resolution is PUBLIC-only on purpose, and PUBLIC IS THE EFFECTIVE TRUST: a
+ * legacy `internal` declaration reads as `public` (environment.js, Wren 69585),
+ * so the mapping is applied before this comparison. Comparing the raw value
+ * made `{ trust: 'internal' }` resolve to no mode at all — the mapping was
+ * applied in `confinementReason` and not here, which is half a rule, and the
+ * half that failed was the one that WITHHOLDS: the grant broker was taken from
+ * a seat this daemon would have confined. A non-public declaration keeps
+ * whatever mode it wrote, and an adapter that cannot enforce it is expected to
+ * refuse rather than quietly spawn unconfined. An explicit mode on a public
+ * declaration still wins — including a wrong one, which the caller then refuses
+ * (Vera 69548: an unresolvable public mode must not fall through to a bare,
+ * unconfined spawn).
  *
  * NOT used by the codex adapter. Codex's `mode` is read-vs-write access, not a
  * host mechanism — its permission profiles run on both platforms — so its
  * derived default is 'workspace' everywhere.
  */
+import { effectiveSandboxTrust } from '../environment.js';
 
 export const PUBLIC_SANDBOX_MODES = new Set(['workspace', 'read-only']);
 
 export const resolvePublicSandboxMode = (sandbox, platform = process.platform) => {
   const declared = sandbox?.mode;
-  if (sandbox?.trust !== 'public') return declared;
+  if (effectiveSandboxTrust(sandbox?.trust) !== 'public') return declared;
   if (declared !== undefined && declared !== null) return declared;
   return platform === 'darwin' ? 'workspace' : 'bwrap';
 };