@commonlyai/cli 0.1.96 → 0.1.98

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.96",
+  "version": "0.1.98",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -49,6 +49,7 @@ import {
 import {
   ADAPTERS_WITH_DEFAULT_MCP,
   ADAPTERS_WITH_GRANT_BROKER,
+  ADAPTERS_WITH_DEFAULT_SANDBOX,
   defaultMcpServers,
 } from '../lib/default-environment.js';
 import { withholdGrantBroker } from '../lib/grant-broker-guard.js';
@@ -621,8 +622,8 @@ export const updateAgentConfiguration = async ({
     environment = { ...environmentRuntime };
   }
   if (environment?.provider !== undefined
-    && String(runtime.adapter || record.adapter || '').trim().toLowerCase() !== 'opencode') {
-    throw new Error('environment.provider is supported only by the opencode adapter');
+    && !adapterRegistry.getAdapter(String(runtime.adapter || record.adapter || '').trim().toLowerCase())?.supportsProvider) {
+    throw new Error('environment.provider requires a provider-capable adapter');
   }
   if (environment) config.environment = environmentForServer(environment);
   if (!Object.keys(config).length) {
@@ -700,10 +701,9 @@ export const resolveAttachSandbox = ({
   // pure — a mode and an adapter name — so it belongs with the derivation, and
   // its witnesses live beside it.
   if ((mode === 'workspace' || mode === 'read-only')
-    && (trust !== 'public' || !['codex', 'claude', 'opencode'].includes(adapterName))) {
+    && (trust !== 'public' || !ADAPTERS_WITH_DEFAULT_SANDBOX.has(adapterName))) {
     throw new Error(
-      `sandbox.mode=${mode} is currently implemented only for public `
-      + 'Claude, Codex, or OpenCode adapters',
+      `sandbox.mode=${mode} requires public trust and an adapter with sandbox enforcement`,
     );
   }
   return { mode, trust };
@@ -743,8 +743,8 @@ export const performAttach = async ({
   let workspace = null;
   if (envPath) {
     environment = await parseEnvironmentFile(envPath);
-    if (environment?.provider !== undefined && adapterName !== 'opencode') {
-      throw new Error('environment.provider is supported only by the opencode adapter');
+    if (environment?.provider !== undefined && !adapter.supportsProvider) {
+      throw new Error('environment.provider requires a provider-capable adapter');
     }
     workspace = await resolveWorkspace(environment, agentName, dirname(envPath));
     if (typeof adapter.validateEnvironment === 'function') {
@@ -784,7 +784,8 @@ export const performAttach = async ({
             + `${seatbelt.error}. On Linux use sandbox.mode=bwrap.`,
           );
         }
-        const adapterLabel = adapterName === 'opencode' ? 'OpenCode' : 'Claude';
+        const adapterLabel = ({ opencode: 'OpenCode', qwen: 'Qwen', claude: 'Claude' })[adapterName]
+          || adapterName;
         log(
           `sandbox: public ${sandboxMode} via macOS Seatbelt `
           + `(deny-by-default host filesystem; ${adapterLabel}/MCP network retained)`,
@@ -793,7 +794,7 @@ export const performAttach = async ({
     } else if (sandboxMode !== 'none' && sandboxMode !== undefined) {
       throw new Error(
         `sandbox.mode=${sandboxMode} is not yet implemented in the local-CLI driver. `
-        + `Supported locally: none, bwrap, and public Codex/Claude/OpenCode workspace/read-only.`,
+        + `Supported locally: none, bwrap, and public Codex/Claude/OpenCode/Qwen workspace/read-only.`,
       );
     }
   } else {
@@ -1106,8 +1107,8 @@ export const performRun = ({
   revokeOrphansImpl = revokeOrphanedSpawnCredentials,
   sleepImpl = (ms) => new Promise((resolve) => { setTimeout(resolve, ms); }),
 }) => {
-  if (environment?.provider !== undefined && adapter?.name !== 'opencode') {
-    throw new Error('environment.provider is supported only by the opencode adapter');
+  if (environment?.provider !== undefined && !adapter?.supportsProvider) {
+    throw new Error('environment.provider requires a provider-capable adapter');
   }
   const client = createClient({ instance: instanceUrl, token });
 
@@ -2711,7 +2712,7 @@ Docs:
   // ── attach (ADR-005, ADR-008) ─────────────────────────────────────────────
   agent
     .command('attach <adapter>')
-    .description('Wrap a local CLI as a Commonly agent (stub|claude|codex|opencode|…)')
+    .description('Wrap a local CLI as a Commonly agent (stub|claude|codex|opencode|qwen|…)')
     .requiredOption('--pod <podId>', 'Pod ID to install into')
     .requiredOption('--name <name>', 'Agent name (e.g. my-claude)')
     .option('--display <name>', 'Display name shown in the pod')
@@ -2893,7 +2894,7 @@ Docs:
     .command('run <name>')
     .description('Run the local-CLI wrapper loop for an attached agent')
     .option('--interval <ms>', 'Poll interval in ms', '5000')
-    .option('--adapter <name>', 'CLI to wrap on first-run bootstrap (claude|codex|pi|opencode); an existing token file bound to a different adapter stops the run')
+    .option('--adapter <name>', 'CLI to wrap on first-run bootstrap (claude|codex|pi|opencode|qwen); an existing token file bound to a different adapter stops the run')
     .option('--cascade-cap <n>', `Consecutive agent-triggered turns allowed per pod (env ${CASCADE_ENV_VARS.cap}, default ${CASCADE_DEFAULTS.cap})`)
     .option('--cascade-grace <n>', `Extra turns allowed when this seat was directly addressed; 0 disables the grace (env ${CASCADE_ENV_VARS.addressedGrace}, default ${CASCADE_DEFAULTS.addressedGrace})`)
     .option('--cascade-reset <ms>', `Silence window that clears the streak (env ${CASCADE_ENV_VARS.resetMs}, default ${CASCADE_DEFAULTS.resetMs})`)

package/src/lib/adapters/index.js

@@ -12,6 +12,7 @@ import claude from './claude.js';
 import codex from './codex.js';
 import pi from './pi.js';
 import opencode from './opencode.js';
+import qwen from './qwen.js';
 
 const ADAPTERS = {
   [stub.name]: stub,
@@ -19,6 +20,7 @@ const ADAPTERS = {
   [codex.name]: codex,
   [pi.name]: pi,
   [opencode.name]: opencode,
+  [qwen.name]: qwen,
 };
 
 export const listAdapterNames = () => Object.keys(ADAPTERS);

package/src/lib/adapters/opencode.js

@@ -20,17 +20,13 @@
  */
 
 import { spawn as childSpawn, spawnSync } from 'child_process';
-import { createHash, randomBytes, timingSafeEqual } from 'crypto';
+import { createHash } from 'crypto';
 import { realpathSync } from 'fs';
-import { constants as fsConstants } from 'fs';
-import { createServer, request as httpRequest } from 'http';
-import { request as httpsRequest } from 'https';
 import {
   chmod,
   lstat,
   mkdir,
   mkdtemp,
-  open,
   readlink,
   rm,
   unlink,
@@ -39,7 +35,7 @@ import {
 } from 'fs/promises';
 import { homedir, tmpdir } from 'os';
 import {
-  dirname, isAbsolute, join, relative, resolve as pathResolve, sep,
+  dirname, join, resolve as pathResolve,
 } from 'path';
 import { writeCredentialFile } from '../credential-file.js';
 import { deliverSeatCredential, withholdRuntimeCredential } from '../mcp-credential-delivery.js';
@@ -54,6 +50,7 @@ import { adapterFailure, spawnCredentials } from '../upstream-refusal.js';
 import { detectBwrap, wrapArgvWithBwrap } from '../sandbox/bwrap.js';
 import { wrapArgvWithSeatbelt } from '../sandbox/seatbelt.js';
 import { resolvePublicSandboxMode } from '../sandbox/mode.js';
+import { resolveProviderKeyFile, startProviderProxy } from '../provider-proxy.js';
 
 const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
 const TERMINATION_GRACE_MS = 5000;
@@ -273,221 +270,6 @@ const buildProviderConfig = (provider, model, keyFile) => {
   };
 };
 
-const isPathWithin = (parent, candidate) => {
-  const fromParent = relative(parent, candidate);
-  return fromParent === '' || (fromParent !== '..'
-    && !fromParent.startsWith(`..${sep}`)
-    && !isAbsolute(fromParent));
-};
-
-/** Validate without reading the key; OpenCode resolves its value from the file reference. */
-const resolveProviderKeyFile = async (provider, workspacePath) => {
-  if (!provider) return null;
-  const keyFile = provider.keyFile;
-  if (typeof keyFile !== 'string' || !isAbsolute(keyFile)) {
-    throw new Error('OpenCode provider.keyFile must be an absolute path');
-  }
-  if (/[\r\n}]/.test(keyFile)) {
-    throw new Error('OpenCode provider.keyFile contains characters unsafe for a file reference');
-  }
-  let details;
-  try {
-    details = await lstat(keyFile);
-  } catch (err) {
-    throw new Error(`OpenCode provider key file is unavailable: ${err.message}`);
-  }
-  if (details.isSymbolicLink() || !details.isFile()) {
-    throw new Error('OpenCode provider.keyFile must be a regular, non-symlink file');
-  }
-  if ((details.mode & 0o777) !== 0o600) {
-    throw new Error('OpenCode provider.keyFile must have mode 0600');
-  }
-  if (typeof workspacePath !== 'string' || !isAbsolute(workspacePath)) {
-    throw new Error('OpenCode provider.keyFile requires an absolute workspace path');
-  }
-  let realKeyFile;
-  let realWorkspace;
-  try {
-    realKeyFile = realpathSync(keyFile);
-    realWorkspace = realpathSync(workspacePath);
-  } catch (err) {
-    throw new Error(`OpenCode provider key path could not be resolved: ${err.message}`);
-  }
-  if (isPathWithin(realWorkspace, realKeyFile)) {
-    throw new Error('OpenCode provider.keyFile must be outside the workspace');
-  }
-  return realKeyFile;
-};
-
-const readProviderKey = async (keyFile) => {
-  const noFollow = fsConstants.O_NOFOLLOW || 0;
-  const handle = await open(keyFile, fsConstants.O_RDONLY | noFollow);
-  try {
-    const details = await handle.stat();
-    if (!details.isFile() || (details.mode & 0o777) !== 0o600) {
-      throw new Error('OpenCode provider.keyFile changed after validation; expected a regular mode-0600 file');
-    }
-    const value = (await handle.readFile()).toString('utf8').trim();
-    if (!value) throw new Error('OpenCode provider.keyFile must not be empty');
-    return value;
-  } finally {
-    await handle.close();
-  }
-};
-
-const startProviderProxy = async ({ provider, keyFile, tokenFile }) => {
-  const upstream = new URL(provider.baseURL);
-  if (!['http:', 'https:'].includes(upstream.protocol)
-    || upstream.username || upstream.password || upstream.search || upstream.hash) {
-    throw new Error('OpenCode provider.baseURL must be an http(s) URL without embedded credentials or query data');
-  }
-  const basePath = upstream.pathname.replace(/\/+$/, '') || '/';
-  const upstreamKey = await readProviderKey(keyFile);
-  const proxyToken = randomBytes(32).toString('base64url');
-  await writeFile(tokenFile, proxyToken, { encoding: 'utf8', mode: 0o600 });
-  await chmod(tokenFile, 0o600);
-
-  const logRefusedRequest = (method, requestPath) => {
-    let normalizedPath = '/';
-    try {
-      normalizedPath = new URL(requestPath || '/', 'http://127.0.0.1').pathname || '/';
-    } catch {
-      // Do not include an unparseable raw request target in logs.
-    }
-    const safeMethod = typeof method === 'string' && /^[A-Z]+$/.test(method)
-      ? method : 'UNKNOWN';
-    process.stderr.write(`[opencode] provider proxy refused ${safeMethod} ${normalizedPath}\n`);
-  };
-
-  const server = createServer((incoming, outgoing) => {
-    const supplied = Buffer.from(incoming.headers.authorization || '');
-    const expected = Buffer.from(`Bearer ${proxyToken}`);
-    if (supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) {
-      incoming.resume();
-      outgoing.writeHead(401).end();
-      return;
-    }
-    if (!['GET', 'POST'].includes(incoming.method || '')) {
-      incoming.resume();
-      outgoing.writeHead(405).end();
-      return;
-    }
-    const rejectRoute = (path) => {
-      logRefusedRequest(incoming.method, path);
-      incoming.resume();
-      outgoing.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' });
-      outgoing.end(`Unsupported provider request: ${incoming.method || 'UNKNOWN'} ${path}`);
-    };
-    const rejectBadRequest = () => {
-      logRefusedRequest(incoming.method, incoming.url);
-      incoming.resume();
-      outgoing.writeHead(400).end();
-    };
-
-    let target;
-    try {
-      const requestPath = incoming.url || '/';
-      if (!requestPath.startsWith('/') || requestPath.startsWith('//')) {
-        rejectBadRequest();
-        return;
-      }
-      if (/%(?:2f|5c|2e)/i.test(requestPath)) {
-        rejectBadRequest();
-        return;
-      }
-      // OpenCode owns this local request path, so never use it as an outbound
-      // URL. The OpenAI-compatible chat provider needs only these fixed routes;
-      // parse the incoming URL against a loopback sentinel, then select a
-      // constant endpoint after matching the configured base path exactly.
-      // This keeps an OpenCode request from turning the proxy into an arbitrary
-      // path/URL fetcher (including paths on a local provider host).
-      const requested = new URL(requestPath, 'http://127.0.0.1');
-      if (requested.origin !== 'http://127.0.0.1' || requested.search || requested.hash) {
-        rejectRoute(requested.pathname);
-        return;
-      }
-      const configuredPath = basePath === '/' ? '' : basePath;
-      let endpoint;
-      if (incoming.method === 'POST'
-        && requested.pathname === `${configuredPath}/chat/completions`) {
-        endpoint = 'chat/completions';
-      } else if (incoming.method === 'GET'
-        && requested.pathname === `${configuredPath}/models`) {
-        endpoint = 'models';
-      } else {
-        rejectRoute(requested.pathname);
-        return;
-      }
-      target = {
-        path: `${configuredPath}/${endpoint}`,
-        protocol: upstream.protocol,
-        hostname: upstream.hostname,
-        port: upstream.port || undefined,
-        host: upstream.host,
-      };
-    } catch {
-      rejectBadRequest();
-      return;
-    }
-
-    const headers = Object.fromEntries(Object.entries(incoming.headers)
-      .filter(([name]) => ![
-        'authorization', 'connection', 'host', 'keep-alive', 'proxy-authenticate',
-        'proxy-authorization', 'te', 'trailer', 'transfer-encoding', 'upgrade',
-        'x-api-key',
-      ].includes(name.toLowerCase())));
-    headers.authorization = `Bearer ${upstreamKey}`;
-    headers.host = target.host;
-    const request = (target.protocol === 'https:' ? httpsRequest : httpRequest)({
-      protocol: target.protocol,
-      hostname: target.hostname,
-      port: target.port,
-      path: target.path,
-      method: incoming.method,
-      headers,
-    }, (response) => {
-      if (response.statusCode >= 300 && response.statusCode < 400) {
-        response.resume();
-        outgoing.writeHead(502).end('Provider redirects are not supported');
-        return;
-      }
-      const responseHeaders = Object.fromEntries(Object.entries(response.headers)
-        .filter(([name]) => ![
-          'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
-          'te', 'trailer', 'transfer-encoding', 'upgrade',
-        ].includes(name.toLowerCase())));
-      outgoing.writeHead(response.statusCode || 502, responseHeaders);
-      response.pipe(outgoing);
-    });
-    request.on('error', () => {
-      if (!outgoing.headersSent) outgoing.writeHead(502);
-      outgoing.end('Provider request failed');
-    });
-    outgoing.on('close', () => request.destroy());
-    incoming.on('aborted', () => request.destroy());
-    incoming.pipe(request);
-  });
-
-  await new Promise((resolve, reject) => {
-    server.once('error', reject);
-    server.listen(0, '127.0.0.1', () => {
-      server.removeListener('error', reject);
-      resolve();
-    });
-  });
-  const { port } = server.address();
-  const proxyBaseURL = new URL(upstream.pathname, `http://127.0.0.1:${port}`).toString();
-  return {
-    baseURL: proxyBaseURL,
-    tokenFile,
-    port,
-    close: () => new Promise((resolve) => {
-      server.close(() => resolve());
-      server.closeAllConnections?.();
-    }),
-  };
-};
-
 const validateProviderEnvironment = async (environment, workspacePath) => {
   if (environment?.provider === undefined) return null;
   const validation = validateEnvironmentSpec({
@@ -767,6 +549,7 @@ const describeOpenCodeVersionMismatch = (installedVersion) => {
 export default {
   name: 'opencode',
   runtimeType: 'opencode',
+  supportsProvider: true,
 
   async validateEnvironment(environment, workspacePath) {
     return validateProviderEnvironment(environment, workspacePath);

package/src/lib/adapters/qwen.js

@@ -0,0 +1,347 @@
+/** Qwen Code 0.25.1 wrapper. Public turns have fresh HOME, config and keys. */
+import { spawn as childSpawn, spawnSync } from 'child_process';
+import { lstatSync, realpathSync } from 'fs';
+import { chmod, mkdtemp, readFile, rm, writeFile } from 'fs/promises';
+import { tmpdir } from 'os';
+import { basename, dirname, isAbsolute, join } from 'path';
+import { buildMemoryPreamble } from '../memory-bridge.js';
+import { deliverSeatCredential } from '../mcp-credential-delivery.js';
+import { prepareMcpSpawn } from '../mcp-home.js';
+import { writeCredentialFile } from '../credential-file.js';
+import { normalizeSandboxTrust, validateEnvironmentSpec } from '../environment.js';
+import { resolvePublicSandboxMode } from '../sandbox/mode.js';
+import { detectBwrap, wrapArgvWithBwrap } from '../sandbox/bwrap.js';
+import { wrapArgvWithSeatbelt } from '../sandbox/seatbelt.js';
+import { resolveProviderKeyFile, startProviderProxy } from '../provider-proxy.js';
+import { adapterFailure, spawnCredentials } from '../upstream-refusal.js';
+
+// Add a version only with a passing real clean-box sandbox smoke that names it.
+const TESTED_QWEN_VERSIONS = Object.freeze(['0.25.1']);
+const ALLOW_UNTESTED_QWEN_VERSION_ENV = 'COMMONLY_QWEN_ALLOW_UNTESTED_VERSION';
+const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
+const TERMINATION_GRACE_MS = 5000;
+const PUBLIC_SAFE_ENV = /^(?:PATH|LANG|LC_[A-Z_]+|TERM|USER|LOGNAME|NO_COLOR|CI|SSL_CERT_FILE|SSL_CERT_DIR)$/;
+const PROXY_ENV = [
+  'HTTP_PROXY', 'HTTPS_PROXY', 'ALL_PROXY', 'NO_PROXY',
+  'http_proxy', 'https_proxy', 'all_proxy', 'no_proxy',
+];
+const EXCLUDED_TOOLS = [
+  'run_shell_command', 'exec', 'edit', 'notebook_edit', 'write_file',
+  'agent', 'create_sub_session', 'task_create', 'team_create',
+  'workflow', 'advisor',
+  // Legacy aliases. Deny both names even if Qwen changes when it canonicalizes.
+  'replace', 'task',
+  'web_fetch', 'web_search',
+];
+// Qwen can read its own config directory. That directory also contains the
+// per-spawn MCP credential file, so public turns cannot expose OS read tools.
+const PUBLIC_READ_TOOLS = [
+  'read_file', 'grep_search', 'search_file_content', 'glob', 'list_directory', 'lsp',
+];
+
+const parseVersion = (output) => {
+  const match = String(output || '').trim().match(/^(?:qwen(?:\s+code|-code)?\s+)?v?(\d+\.\d+\.\d+)$/i);
+  return match ? match[1] : null;
+};
+
+const readVersion = (binary, env) => {
+  const result = spawnSync(binary, ['--version'], { encoding: 'utf8', env, timeout: 5000 });
+  return result.status === 0 && !result.error ? parseVersion(result.stdout) : null;
+};
+
+const resolvedBinary = (env) => {
+  const where = spawnSync('which', ['qwen'], { encoding: 'utf8', env });
+  return where.status === 0 ? (where.stdout || '').trim() || 'qwen' : 'qwen';
+};
+
+const withProbeEnv = async (source, run) => {
+  const home = await mkdtemp(join(tmpdir(), 'commonly-qwen-version-'));
+  try {
+    const settingsPath = join(home, 'settings.json');
+    await writeFile(settingsPath, JSON.stringify({
+      privacy: { usageStatisticsEnabled: false },
+    }), { mode: 0o600 });
+    const env = Object.fromEntries(Object.entries(source)
+      .filter(([name]) => PUBLIC_SAFE_ENV.test(name)));
+    env.HOME = home;
+    env.QWEN_HOME = home;
+    env.QWEN_RUNTIME_DIR = home;
+    env.QWEN_CODE_SYSTEM_SETTINGS_PATH = settingsPath;
+    env.QWEN_USAGE_STATISTICS_ENABLED = 'false';
+    for (const name of PROXY_ENV) env[name] = '';
+    return run(env);
+  } finally {
+    await rm(home, { recursive: true, force: true });
+  }
+};
+
+const substitute = (value, ctx) => String(value).replace(/\$\{(COMMONLY_[A-Z_]+)\}/g, (whole, name) => ({
+  COMMONLY_TOKEN_FILE: ctx.credentialFile,
+  COMMONLY_API_URL: ctx.instanceUrl,
+  COMMONLY_INSTANCE_URL: ctx.instanceUrl,
+}[name] || whole));
+
+export const buildQwenMcpConfig = (servers, ctx) => {
+  const mcpServers = {};
+  for (const server of servers || []) {
+    if (!/^[A-Za-z0-9_-]+$/.test(server?.name || '')) continue;
+    const transport = server.transport || 'stdio';
+    if (transport === 'stdio') {
+      if (!Array.isArray(server.command) || !server.command.length) continue;
+      const command = prepareMcpSpawn(server.command, { apiUrl: ctx.instanceUrl });
+      const delivery = deliverSeatCredential({ ...server, command }, {
+        credentialFile: ctx.credentialFile,
+        label: 'qwen',
+      });
+      const args = command.slice(1).map((part) => substitute(part, ctx));
+      const env = Object.fromEntries(Object.entries(delivery.env)
+        .map(([name, value]) => [name, substitute(value, ctx)]));
+      const serialized = JSON.stringify({ command: command[0], args, env });
+      if (serialized.includes('${COMMONLY_AGENT_TOKEN}')
+        || (ctx.runtimeToken && serialized.includes(ctx.runtimeToken))) {
+        throw new Error(`Qwen MCP server ${server.name} has no file-backed credential delivery`);
+      }
+      mcpServers[server.name] = {
+        command: command[0], args, env,
+        ...(server.cwd ? { cwd: server.cwd } : {}),
+      };
+      continue;
+    }
+    if (transport !== 'http' || typeof server.url !== 'string') {
+      throw new Error(`Qwen MCP server ${server.name} has unsupported transport`);
+    }
+    const httpUrl = substitute(server.url, ctx);
+    const headers = Object.fromEntries(Object.entries(server.headers || {})
+      .map(([name, value]) => [name, substitute(value, ctx)]));
+    const serialized = JSON.stringify({ httpUrl, headers });
+    if (serialized.includes('${COMMONLY_AGENT_TOKEN}')
+      || (ctx.runtimeToken && serialized.includes(ctx.runtimeToken))) {
+      throw new Error(`Qwen MCP server ${server.name} requires a credential transport Qwen can keep out of config`);
+    }
+    mcpServers[server.name] = { httpUrl, headers };
+  }
+  return { mcpServers };
+};
+
+const makeChildEnv = (source, home, settingsPath, proxy) => {
+  const env = Object.fromEntries(Object.entries(source)
+    .filter(([name]) => PUBLIC_SAFE_ENV.test(name)));
+  for (const name of PROXY_ENV) env[name] = '';
+  env.HOME = home;
+  env.QWEN_HOME = home;
+  env.QWEN_RUNTIME_DIR = home;
+  env.QWEN_CODE_SYSTEM_SETTINGS_PATH = settingsPath;
+  env.QWEN_USAGE_STATISTICS_ENABLED = 'false';
+  env.OPENAI_BASE_URL = proxy.baseURL;
+  env.OPENAI_API_KEY = proxy.bearer;
+  return env;
+};
+
+const parseStream = (line, state) => {
+  let event;
+  try { event = JSON.parse(line); } catch { return; }
+  if (event.type === 'assistant' && Array.isArray(event.message?.content)) {
+    state.text = event.message.content
+      .filter((part) => part.type === 'text' && typeof part.text === 'string')
+      .map((part) => part.text).join('');
+  }
+  if (event.type === 'result') {
+    if (typeof event.result === 'string') state.text = event.result;
+    if (event.is_error) state.error = event.result || 'Qwen returned an error result';
+  }
+};
+
+const runQwen = ({ cmd, args, cwd, env, timeoutMs, spawnImpl, credentials }) => new Promise((resolve, reject) => {
+  const child = (spawnImpl || childSpawn)(cmd, args, {
+    cwd, env, stdio: ['ignore', 'pipe', 'pipe'],
+  });
+  const state = { text: '', error: null, buffer: '' };
+  let stderr = '';
+  let timedOut = false;
+  let settled = false;
+  const finish = (error, result) => {
+    if (settled) return;
+    settled = true;
+    clearTimeout(timer);
+    clearTimeout(killTimer);
+    if (error) reject(error); else resolve(result);
+  };
+  const timer = setTimeout(() => {
+    timedOut = true;
+    child.kill('SIGTERM');
+    killTimer = setTimeout(() => child.kill('SIGKILL'), TERMINATION_GRACE_MS);
+  }, timeoutMs);
+  let killTimer;
+  child.stdout?.on('data', (chunk) => {
+    state.buffer += chunk.toString();
+    if (state.buffer.length > 1024 * 1024) {
+      finish(new Error('Qwen stream line exceeded 1 MiB'));
+      child.kill('SIGTERM');
+      return;
+    }
+    while (state.buffer.includes('\n')) {
+      const end = state.buffer.indexOf('\n');
+      parseStream(state.buffer.slice(0, end), state);
+      state.buffer = state.buffer.slice(end + 1);
+    }
+  });
+  child.stderr?.on('data', (chunk) => { stderr = (stderr + chunk.toString()).slice(-8192); });
+  child.on('error', (error) => finish(error));
+  child.on('close', (code) => {
+    if (state.buffer) parseStream(state.buffer, state);
+    if (timedOut) return finish(new Error(`qwen timed out after ${timeoutMs}ms`));
+    if (code !== 0 || state.error) {
+      return finish(adapterFailure('qwen', state.error || stderr.trim() || `exit ${code}`, {
+        credentials, exitCode: code, limit: 500,
+      }));
+    }
+    return finish(null, { text: state.text.trim() });
+  });
+});
+
+export default {
+  name: 'qwen',
+  runtimeType: 'qwen',
+  supportsProvider: true,
+
+  async validateEnvironment(environment, workspacePath) {
+    const validation = validateEnvironmentSpec(environment);
+    if (!validation.ok) throw new Error(validation.errors.join('; '));
+    if (!environment?.provider || !environment?.model) {
+      throw new Error('Qwen requires environment.provider and environment.model');
+    }
+    return resolveProviderKeyFile(environment.provider, workspacePath, 'Qwen');
+  },
+
+  async detect() {
+    return withProbeEnv(process.env, (env) => {
+      const result = spawnSync('qwen', ['--version'], { encoding: 'utf8', timeout: 5000, env });
+      if (result.status !== 0 || result.error) return null;
+      return { path: resolvedBinary(env), version: parseVersion(result.stdout) || 'unknown' };
+    });
+  },
+
+  async spawn(prompt, ctx = {}) {
+    const sandbox = normalizeSandboxTrust(ctx.environment?.sandbox);
+    const isPublic = sandbox?.trust === 'public';
+    const mode = isPublic ? resolvePublicSandboxMode(sandbox) : null;
+    if (isPublic && !['workspace', 'read-only', 'bwrap'].includes(mode)) {
+      throw new Error('public Qwen seats require an enforced sandbox');
+    }
+    const provider = ctx.environment?.provider;
+    if (!provider || !ctx.environment?.model) {
+      throw new Error('Qwen seats require environment.provider and environment.model');
+    }
+    if (isPublic && mode === 'bwrap' && sandbox?.network?.policy === 'restricted') {
+      throw new Error('public Qwen provider proxy requires shared bwrap networking');
+    }
+    const keyFile = await this.validateEnvironment(ctx.environment, ctx.cwd);
+    const sourceEnv = ctx.env || process.env;
+    const { binary, version } = await withProbeEnv(sourceEnv, (probeEnv) => {
+      const path = ctx._binaryPath || resolvedBinary(probeEnv);
+      return { binary: path, version: readVersion(path, probeEnv) };
+    });
+    if (!TESTED_QWEN_VERSIONS.includes(version)) {
+      const versions = TESTED_QWEN_VERSIONS.join(', ');
+      if (isPublic && process.env[ALLOW_UNTESTED_QWEN_VERSION_ENV] !== '1') {
+        throw new Error(`Public Qwen seats refuse version ${version || 'unknown'}; smoke-tested: ${versions}. Set ${ALLOW_UNTESTED_QWEN_VERSION_ENV}=1 in the host process to override.`);
+      }
+      // eslint-disable-next-line no-console
+      console.warn(`[qwen] installed ${version || 'unknown'} differs from smoke-tested ${versions}; ${isPublic ? 'host override accepted' : 'trusted seat continues'}`);
+    }
+    // npm launches through a symlink into the package. Qwen loads chunks next
+    // to that entry file, so public sandboxes need that exact read-only tree.
+    const symlinkedBinary = isPublic && lstatSync(binary).isSymbolicLink();
+    const executable = symlinkedBinary
+      ? join(realpathSync(dirname(binary)), basename(binary)) : binary;
+    const packageDir = symlinkedBinary ? dirname(realpathSync(executable)) : null;
+    const tempDir = await mkdtemp(join(tmpdir(), 'commonly-qwen-'));
+    await chmod(tempDir, 0o700);
+    // Keep child-writable state separate from adapter-owned config and keys.
+    const home = await mkdtemp(join(tmpdir(), 'commonly-qwen-home-'));
+    await chmod(home, 0o700);
+    const settingsPath = join(tempDir, 'settings.json');
+    const mcpPath = join(tempDir, 'mcp.json');
+    let proxy;
+    try {
+      const credential = writeCredentialFile(ctx.runtimeToken, {
+        agentName: ctx.agentName || 'agent', root: tempDir,
+      });
+      proxy = await startProviderProxy({
+        provider, keyFile, tokenFile: join(tempDir, 'provider-proxy-token'), adapterLabel: 'Qwen',
+      });
+      const proxyWithBearer = { ...proxy, bearer: (await readFile(proxy.tokenFile, 'utf8')).trim() };
+      const mcp = buildQwenMcpConfig(ctx.environment?.mcp, {
+        credentialFile: credential?.path || '',
+        instanceUrl: ctx.instanceUrl || '',
+        runtimeToken: ctx.runtimeToken || '',
+      });
+      await Promise.all([
+        writeFile(settingsPath, JSON.stringify({
+          privacy: { usageStatisticsEnabled: false },
+          general: { enableAutoUpdate: false },
+        }), { mode: 0o600 }),
+        writeFile(mcpPath, JSON.stringify(mcp), { mode: 0o600 }),
+      ]);
+      const env = makeChildEnv(sourceEnv, home, settingsPath, proxyWithBearer);
+      // QWEN_HOME is discarded after every turn, so Qwen session ids cannot
+      // be resumed. The kernel memory preamble supplies continuity instead.
+      const fullPrompt = buildMemoryPreamble(prompt, ctx.memoryLongTerm, {
+        freshSession: true,
+      });
+      const args = [
+        '--bare', '--safe-mode', '--auth-type', 'openai', '-m', ctx.environment.model,
+        '--mcp-config', mcpPath, '--exclude-tools', [
+          ...EXCLUDED_TOOLS, ...(isPublic ? PUBLIC_READ_TOOLS : []),
+        ].join(','),
+        '-o', 'stream-json', '-p', fullPrompt,
+      ];
+      let cmd = executable;
+      let spawnArgs = args;
+      if (isPublic && mode === 'bwrap') {
+        if (!isAbsolute(executable)) throw new Error('public Qwen seats require an absolute qwen executable path');
+        const bwrap = (ctx._detectBwrap || detectBwrap)();
+        if (!bwrap.available) throw new Error(`public Qwen seats require bwrap: ${bwrap.error}`);
+        [cmd, ...spawnArgs] = (ctx._wrapArgvWithBwrap || wrapArgvWithBwrap)([executable, ...args], {
+          ...ctx.environment,
+          sandbox: {
+            ...sandbox,
+            filesystem: {
+              ...(sandbox?.filesystem || {}),
+              'write-outside': [
+                ...(sandbox?.filesystem?.['write-outside'] || []), home,
+              ],
+            },
+          },
+        }, { workspacePath: ctx.cwd, homePath: home, readOnlyPaths: [tempDir, executable, packageDir, process.execPath].filter(Boolean) });
+      } else if (isPublic) {
+        if ((ctx._platform || process.platform) !== 'darwin') {
+          throw new Error(`public Qwen sandbox.mode=${mode} requires Seatbelt on macOS or bwrap on Linux`);
+        }
+        [cmd, ...spawnArgs] = (ctx._wrapArgvWithSeatbelt || wrapArgvWithSeatbelt)([executable, ...args], {
+          workspacePath: ctx.cwd,
+          workspaceAccess: mode === 'read-only' ? 'read' : 'write',
+          executablePath: executable,
+          statePath: home,
+          mcpConfigDir: tempDir,
+          loopbackNetworkPorts: [proxy.port],
+          readOnlyDirectories: packageDir ? [packageDir] : [],
+        });
+      }
+      const requestedTimeout = Number(ctx.timeoutMs);
+      const timeoutMs = Number.isFinite(requestedTimeout) && requestedTimeout > 0
+        ? Math.min(requestedTimeout, DEFAULT_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS;
+      const result = await runQwen({
+        cmd, args: spawnArgs, cwd: ctx.cwd, env, timeoutMs,
+        spawnImpl: ctx._spawnImpl,
+        credentials: [...spawnCredentials(ctx, []), proxyWithBearer.bearer],
+      });
+      return { text: result.text, newSessionId: null };
+    } finally {
+      try { await proxy?.close(); } catch { /* best effort */ }
+      await Promise.all([tempDir, home].map((path) => rm(path, { recursive: true, force: true })));
+    }
+  },
+};
+
+export { TESTED_QWEN_VERSIONS, ALLOW_UNTESTED_QWEN_VERSION_ENV, makeChildEnv, parseVersion };

package/src/lib/daemon-supervisor.js

@@ -7,6 +7,7 @@ import {
 } from './declared-mcp-guard.js';
 
 import { seatBaseline } from './default-environment.js';
+import { getAdapter } from './adapters/index.js';
 import { withholdGrantBroker } from './grant-broker-guard.js';
 
 /**
@@ -233,8 +234,8 @@ export const createDaemonSupervisor = ({
         nextAdapter = declaredAdapter;
         adapterChanged = existing.adapter !== nextAdapter;
       }
-      if (existing.environment?.provider && nextAdapter !== 'opencode') {
-        log(`[${row.agentName}] host-local provider requires the opencode adapter — keeping the current seat`);
+      if (existing.environment?.provider && !getAdapter(nextAdapter)?.supportsProvider) {
+        log(`[${row.agentName}] host-local provider requires a provider-capable adapter — keeping the current seat`);
         return false;
       }
       if (wanted) {
@@ -347,7 +348,7 @@ export const createDaemonSupervisor = ({
     }
     if (!adapter) adapter = await resolveAdapter(row.runtime || null);
     if (!adapter) {
-      log(`[${row.agentName}] no usable CLI adapter on this machine — install claude, codex, or opencode, or attach manually`);
+      log(`[${row.agentName}] no usable CLI adapter on this machine — install claude, codex, opencode, or qwen, or attach manually`);
       return false;
     }
     const environment = environmentFor(row);

package/src/lib/default-environment.js

@@ -17,6 +17,7 @@
  *            it had no commonly_* tool of its own)
  *   pi     — stdio servers from the environment spec (adapters/pi.js)
  *   opencode — per-spawn config file with local/remote MCP entries (adapters/opencode.js)
+ *   qwen — per-spawn --mcp-config with file-backed stdio credentials (adapters/qwen.js)
  * `stub` has no consumption path and must keep being handed `environment: null`.
  *
  * The placeholders are substituted at spawn time by the adapter, so the
@@ -25,7 +26,7 @@
 
 import { normalizeSandboxTrust } from './environment.js';
 
-export const ADAPTERS_WITH_DEFAULT_MCP = new Set(['claude', 'codex', 'pi', 'opencode']);
+export const ADAPTERS_WITH_DEFAULT_MCP = new Set(['claude', 'codex', 'pi', 'opencode', 'qwen']);
 
 /**
  * The adapters that can ENFORCE the default sandbox — a strict subset of the
@@ -42,7 +43,7 @@ export const ADAPTERS_WITH_DEFAULT_MCP = new Set(['claude', 'codex', 'pi', 'open
  * here and hoped for. A derived pi seat used to be exactly this shape and would
  * have failed every spawn with `public-trust seats are not supported`.
  */
-export const ADAPTERS_WITH_DEFAULT_SANDBOX = new Set(['claude', 'codex', 'opencode']);
+export const ADAPTERS_WITH_DEFAULT_SANDBOX = new Set(['claude', 'codex', 'opencode', 'qwen']);
 
 // The server has not yet admitted OpenCode to its grant-broker confinement
 // allowlist. Keep runtime sandbox support separate from the narrower set of
@@ -70,7 +71,7 @@ export const ADAPTERS_WITH_GRANT_BROKER = new Set(['claude', 'codex']);
  * moves a host fact into the database and breaks the day the seat is re-homed.
  * An explicit mode in a record still wins over the derived one.
  *
- * Confinement holds for claude, codex, and opencode, and only they are handed
+ * Confinement holds for claude, codex, opencode, and qwen, and only they are handed
  * this block (ADAPTERS_WITH_DEFAULT_SANDBOX). Grant-broker eligibility is
  * narrower until the server admits OpenCode after its confinement proof.
  * A pi seat must never be handed this block: it fails closed on a declared

package/src/lib/hooks-config.js

@@ -215,7 +215,16 @@ export const forwardHookEvent = async ({
     const body = await response.json().catch(() => ({}));
     if (!response.ok) throw new Error(`HTTP ${response.status}`);
     if (preTool && body.permissionDecision === 'deny') {
-      stdout(JSON.stringify({ permissionDecision: 'deny', ...(body.reason ? { reason: body.reason } : {}) }));
+      // Claude Code reads a PreToolUse decision only from `hookSpecificOutput`. The top-level
+      // `{permissionDecision}` this printed before was ignored and the tool ran (measured on
+      // Claude Code 2.1.296, 2026-10-14, issue #2145).
+      stdout(JSON.stringify({
+        hookSpecificOutput: {
+          hookEventName: 'PreToolUse',
+          permissionDecision: 'deny',
+          ...(body.reason ? { permissionDecisionReason: body.reason } : {}),
+        },
+      }));
     }
     return body;
   } catch (error) {

package/src/lib/provider-proxy.js

@@ -0,0 +1,222 @@
+/** The per-spawn loopback proxy shared by OpenAI-compatible CLI adapters. */
+import { randomBytes, timingSafeEqual } from 'crypto';
+import { constants as fsConstants, realpathSync } from 'fs';
+import { createServer, request as httpRequest } from 'http';
+import { request as httpsRequest } from 'https';
+import { chmod, lstat, open, writeFile } from 'fs/promises';
+import { isAbsolute, relative, sep } from 'path';
+
+const isPathWithin = (parent, candidate) => {
+  const fromParent = relative(parent, candidate);
+  return fromParent === '' || (fromParent !== '..'
+    && !fromParent.startsWith(`..${sep}`)
+    && !isAbsolute(fromParent));
+};
+/** Validate the key path without reading the key. The proxy reads it at spawn. */
+export const resolveProviderKeyFile = async (provider, workspacePath, adapterLabel = 'OpenCode') => {
+  if (!provider) return null;
+  const keyFile = provider.keyFile;
+  if (typeof keyFile !== 'string' || !isAbsolute(keyFile)) {
+    throw new Error(`${adapterLabel} provider.keyFile must be an absolute path`);
+  }
+  if (/[\r\n}]/.test(keyFile)) {
+    throw new Error(`${adapterLabel} provider.keyFile contains characters unsafe for a file reference`);
+  }
+  let details;
+  try {
+    details = await lstat(keyFile);
+  } catch (err) {
+    throw new Error(`${adapterLabel} provider key file is unavailable: ${err.message}`);
+  }
+  if (details.isSymbolicLink() || !details.isFile()) {
+    throw new Error(`${adapterLabel} provider.keyFile must be a regular, non-symlink file`);
+  }
+  if ((details.mode & 0o777) !== 0o600) {
+    throw new Error(`${adapterLabel} provider.keyFile must have mode 0600`);
+  }
+  if (typeof workspacePath !== 'string' || !isAbsolute(workspacePath)) {
+    throw new Error(`${adapterLabel} provider.keyFile requires an absolute workspace path`);
+  }
+  let realKeyFile;
+  let realWorkspace;
+  try {
+    realKeyFile = realpathSync(keyFile);
+    realWorkspace = realpathSync(workspacePath);
+  } catch (err) {
+    throw new Error(`${adapterLabel} provider key path could not be resolved: ${err.message}`);
+  }
+  if (isPathWithin(realWorkspace, realKeyFile)) {
+    throw new Error(`${adapterLabel} provider.keyFile must be outside the workspace`);
+  }
+  return realKeyFile;
+};
+
+const readProviderKey = async (keyFile, adapterLabel) => {
+  const noFollow = fsConstants.O_NOFOLLOW || 0;
+  const handle = await open(keyFile, fsConstants.O_RDONLY | noFollow);
+  try {
+    const details = await handle.stat();
+    if (!details.isFile() || (details.mode & 0o777) !== 0o600) {
+      throw new Error(`${adapterLabel} provider.keyFile changed after validation; expected a regular mode-0600 file`);
+    }
+    const value = (await handle.readFile()).toString('utf8').trim();
+    if (!value) throw new Error(`${adapterLabel} provider.keyFile must not be empty`);
+    return value;
+  } finally {
+    await handle.close();
+  }
+};
+
+export const startProviderProxy = async ({ provider, keyFile, tokenFile, adapterLabel = 'OpenCode' }) => {
+  const upstream = new URL(provider.baseURL);
+  if (!['http:', 'https:'].includes(upstream.protocol)
+    || upstream.username || upstream.password || upstream.search || upstream.hash) {
+    throw new Error(`${adapterLabel} provider.baseURL must be an http(s) URL without embedded credentials or query data`);
+  }
+  const basePath = upstream.pathname.replace(/\/+$/, '') || '/';
+  const upstreamKey = await readProviderKey(keyFile, adapterLabel);
+  const proxyToken = randomBytes(32).toString('base64url');
+  await writeFile(tokenFile, proxyToken, { encoding: 'utf8', mode: 0o600 });
+  await chmod(tokenFile, 0o600);
+
+  const logRefusedRequest = (method, requestPath) => {
+    let normalizedPath = '/';
+    try {
+      normalizedPath = new URL(requestPath || '/', 'http://127.0.0.1').pathname || '/';
+    } catch {
+      // Do not include an unparseable raw request target in logs.
+    }
+    const safeMethod = typeof method === 'string' && /^[A-Z]+$/.test(method)
+      ? method : 'UNKNOWN';
+    process.stderr.write(`[${adapterLabel.toLowerCase()}] provider proxy refused ${safeMethod} ${normalizedPath}\n`);
+  };
+
+  const server = createServer((incoming, outgoing) => {
+    const supplied = Buffer.from(incoming.headers.authorization || '');
+    const expected = Buffer.from(`Bearer ${proxyToken}`);
+    if (supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) {
+      incoming.resume();
+      outgoing.writeHead(401).end();
+      return;
+    }
+    if (!['GET', 'POST'].includes(incoming.method || '')) {
+      incoming.resume();
+      outgoing.writeHead(405).end();
+      return;
+    }
+    const rejectRoute = (path) => {
+      logRefusedRequest(incoming.method, path);
+      incoming.resume();
+      outgoing.writeHead(403, { 'content-type': 'text/plain; charset=utf-8' });
+      outgoing.end(`Unsupported provider request: ${incoming.method || 'UNKNOWN'} ${path}`);
+    };
+    const rejectBadRequest = () => {
+      logRefusedRequest(incoming.method, incoming.url);
+      incoming.resume();
+      outgoing.writeHead(400).end();
+    };
+
+    let target;
+    try {
+      const requestPath = incoming.url || '/';
+      if (!requestPath.startsWith('/') || requestPath.startsWith('//')) {
+        rejectBadRequest();
+        return;
+      }
+      if (/%(?:2f|5c|2e)/i.test(requestPath)) {
+        rejectBadRequest();
+        return;
+      }
+      // The CLI owns this local request path, so never use it as an outbound
+      // URL. The OpenAI-compatible chat provider needs only these fixed routes;
+      // parse the incoming URL against a loopback sentinel, then select a
+      // constant endpoint after matching the configured base path exactly.
+      // This keeps a CLI request from turning the proxy into an arbitrary
+      // path/URL fetcher (including paths on a local provider host).
+      const requested = new URL(requestPath, 'http://127.0.0.1');
+      if (requested.origin !== 'http://127.0.0.1' || requested.search || requested.hash) {
+        rejectRoute(requested.pathname);
+        return;
+      }
+      const configuredPath = basePath === '/' ? '' : basePath;
+      let endpoint;
+      if (incoming.method === 'POST'
+        && requested.pathname === `${configuredPath}/chat/completions`) {
+        endpoint = 'chat/completions';
+      } else if (incoming.method === 'GET'
+        && requested.pathname === `${configuredPath}/models`) {
+        endpoint = 'models';
+      } else {
+        rejectRoute(requested.pathname);
+        return;
+      }
+      target = {
+        path: `${configuredPath}/${endpoint}`,
+        protocol: upstream.protocol,
+        hostname: upstream.hostname,
+        port: upstream.port || undefined,
+        host: upstream.host,
+      };
+    } catch {
+      rejectBadRequest();
+      return;
+    }
+
+    const headers = Object.fromEntries(Object.entries(incoming.headers)
+      .filter(([name]) => ![
+        'authorization', 'connection', 'host', 'keep-alive', 'proxy-authenticate',
+        'proxy-authorization', 'te', 'trailer', 'transfer-encoding', 'upgrade',
+        'x-api-key',
+      ].includes(name.toLowerCase())));
+    headers.authorization = `Bearer ${upstreamKey}`;
+    headers.host = target.host;
+    const request = (target.protocol === 'https:' ? httpsRequest : httpRequest)({
+      protocol: target.protocol,
+      hostname: target.hostname,
+      port: target.port,
+      path: target.path,
+      method: incoming.method,
+      headers,
+    }, (response) => {
+      if (response.statusCode >= 300 && response.statusCode < 400) {
+        response.resume();
+        outgoing.writeHead(502).end('Provider redirects are not supported');
+        return;
+      }
+      const responseHeaders = Object.fromEntries(Object.entries(response.headers)
+        .filter(([name]) => ![
+          'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
+          'te', 'trailer', 'transfer-encoding', 'upgrade',
+        ].includes(name.toLowerCase())));
+      outgoing.writeHead(response.statusCode || 502, responseHeaders);
+      response.pipe(outgoing);
+    });
+    request.on('error', () => {
+      if (!outgoing.headersSent) outgoing.writeHead(502);
+      outgoing.end('Provider request failed');
+    });
+    outgoing.on('close', () => request.destroy());
+    incoming.on('aborted', () => request.destroy());
+    incoming.pipe(request);
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => {
+      server.removeListener('error', reject);
+      resolve();
+    });
+  });
+  const { port } = server.address();
+  const proxyBaseURL = new URL(upstream.pathname, `http://127.0.0.1:${port}`).toString();
+  return {
+    baseURL: proxyBaseURL,
+    tokenFile,
+    port,
+    close: () => new Promise((resolve) => {
+      server.close(() => resolve());
+      server.closeAllConnections?.();
+    }),
+  };
+};
+

package/src/lib/sandbox/bwrap.js

@@ -130,7 +130,7 @@ export const wrapArgvWithBwrap = (innerArgv, env, opts = {}) => {
 
   flags.push('--bind', opts.workspacePath, opts.workspacePath);
   flags.push('--chdir', opts.workspacePath);
-  flags.push('--setenv', 'HOME', opts.workspacePath);
+  flags.push('--setenv', 'HOME', opts.homePath || opts.workspacePath);
 
   return ['bwrap', ...flags, '--', ...innerArgv];
 };

package/src/lib/sandbox/seatbelt.js

@@ -20,7 +20,7 @@
  */
 
 import { spawnSync } from 'child_process';
-import { realpathSync } from 'fs';
+import { lstatSync, realpathSync } from 'fs';
 import { homedir } from 'os';
 import { isAbsolute, join } from 'path';
 
@@ -302,6 +302,14 @@ const realpathOrSelf = (path) => {
   }
 };
 
+const isSymlink = (path) => {
+  try {
+    return lstatSync(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+};
+
 export const detectSeatbelt = () => {
   if (process.platform !== 'darwin') {
     return { available: false, error: DARWIN_MESSAGE };
@@ -332,6 +340,7 @@ export const buildSeatbeltProfile = ({
   mcpConfigDir = null,
   executablePaths = [],
   readOnlyPaths = [],
+  readOnlyDirectories = [],
   loopbackNetworkPorts = [],
   allowClaudeRuntimeAccess = false,
 }) => {
@@ -344,6 +353,7 @@ export const buildSeatbeltProfile = ({
   }
   if (mcpConfigDir) assertAbsolutePath(mcpConfigDir, 'mcpConfigDir');
   for (const path of readOnlyPaths) assertAbsolutePath(path, 'readOnlyPaths entry');
+  for (const path of readOnlyDirectories) assertAbsolutePath(path, 'readOnlyDirectories entry');
   for (const port of loopbackNetworkPorts) {
     if (!Number.isInteger(port) || port < 1 || port > 65535) {
       throw new Error('Seatbelt loopbackNetworkPorts entries must be valid TCP ports');
@@ -358,6 +368,7 @@ export const buildSeatbeltProfile = ({
   const resolvedState = realpathOrSelf(statePath);
   const resolvedMcpConfig = mcpConfigDir ? realpathOrSelf(mcpConfigDir) : null;
   const resolvedReadOnlyPaths = [...new Set(readOnlyPaths.map(realpathOrSelf))];
+  const resolvedReadOnlyDirectories = [...new Set(readOnlyDirectories.map(realpathOrSelf))];
   const executables = [...new Set(
     [resolvedExecutable, process.execPath, ...executablePaths]
       .filter(Boolean)
@@ -374,12 +385,19 @@ export const buildSeatbeltProfile = ({
     `(allow file-read* file-test-existence file-map-executable ${literal(executable)})`,
     `(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(executable)}"))`,
   ].join('\n')).join('\n');
+  const executableSymlinkRules = isSymlink(executablePath) ? [
+    `(allow file-read* file-test-existence ${literal(executablePath)})`,
+    `(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(executablePath)}"))`,
+  ].join('\n') : '';
   const mcpRule = resolvedMcpConfig
     ? `(allow file-read* file-test-existence ${subpath(resolvedMcpConfig)})`
     : '';
   const readOnlyRules = resolvedReadOnlyPaths.map((path) => (
     `(allow file-read* file-test-existence ${literal(path)})`
-  )).join('\n');
+  )).concat(resolvedReadOnlyDirectories.map((path) => [
+    `(allow file-read* file-test-existence ${subpath(path)})`,
+    `(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(path)}"))`,
+  ].join('\n'))).join('\n');
   const loopbackNetworkRules = [...new Set(loopbackNetworkPorts)].map((port) => (
     `(allow network-outbound (remote tcp "localhost:${port}"))`
   )).join('\n');
@@ -402,6 +420,7 @@ export const buildSeatbeltProfile = ({
   return [
     PLATFORM_BASELINE.trim(),
     executableRules,
+    executableSymlinkRules,
     `(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(resolvedWorkspace)}"))`,
     `(allow file-read-metadata file-test-existence (path-ancestors "${escapeSbplString(resolvedState)}"))`,
     workspaceRule,