@commonlyai/cli 0.1.71 → 0.1.72

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.71",
+  "version": "0.1.72",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/lib/adapters/pi.js

@@ -43,6 +43,7 @@ import {
   spawnCredentials,
 } from '../upstream-refusal.js';
 import { buildMemoryPreamble } from '../memory-bridge.js';
+import { effectiveSandboxTrust } from '../environment.js';
 import { GRANT_BROKER_REFUSAL, isGrantBrokerUrl } from './pi-mcp-client.mjs';
 import { deliverSeatCredential, withholdRuntimeCredential } from '../mcp-credential-delivery.js';
 import { removeCredentialFile, writeCredentialFile } from '../credential-file.js';
@@ -283,10 +284,23 @@ export const sessionExists = async (sessionDir, sessionId) => {
   }
 };
 
-/** Fail closed: pi cannot enforce `environment.sandbox`, so a seat that declares one does not start. */
+/**
+ * Fail closed: pi cannot enforce `environment.sandbox`, so a seat that declares
+ * one does not start.
+ *
+ * The trust is read THROUGH the legacy table (`effectiveSandboxTrust`), not
+ * raw. A stored `internal` means `public` (Vera 69592, Wren 69585) and every
+ * other gate in this package resolves it that way: the attach path
+ * (`agent.js`), the mode resolver (`sandbox/mode.js`) and the grant-broker
+ * guard. Reading it raw here made this gate the one site that failed OPEN — a
+ * legacy record passed both checks and the seat started unconfined, which is
+ * the exact outcome that was refused for the record it was migrated from.
+ * The mode clause needs no mapping: `internal` and the derived mode are
+ * independent, and a public-meaning record is refused before the mode is read.
+ */
 export const assertNoSandboxDeclared = (environment = {}) => {
   const sandbox = environment?.sandbox || {};
-  if (sandbox.trust === 'public') {
+  if (effectiveSandboxTrust(sandbox.trust) === 'public') {
     throw new Error('pi adapter: public-trust seats are not supported — pi has no enforced sandbox; do not attach a pi seat to a stranger-readable pod');
   }
   if (sandbox.mode && sandbox.mode !== 'none') {

package/src/lib/default-environment.js

@@ -32,8 +32,9 @@ export const ADAPTERS_WITH_DEFAULT_MCP = new Set(['claude', 'codex', 'pi']);
  *
  * `pi` is absent deliberately. It has no sandbox path until #1740's transport
  * work gives it one, and since #1727 it REFUSES TO START on a spec that
- * declares one: `assertNoSandboxDeclared` in adapters/pi.js throws on
- * `trust: 'public'` and on any `mode` other than 'none'. So handing pi this
+ * declares one: `assertNoSandboxDeclared` in adapters/pi.js throws on an
+ * effective `trust: 'public'` (a legacy `internal` resolves to it) and on any
+ * `mode` other than 'none'. So handing pi this
  * block is not a harmless no-op — it is an unspawnable seat. A pi seat gets the
  * `mcp[]` half only, and the residual is that such a seat runs unconfined: that
  * belongs to the row that owns pi confinement, not to a declaration written