@ravefox/space 0.2.1 → 0.3.0

package/src/lib/adapters/qwen.js

@@ -1,523 +0,0 @@
-/** Qwen Code 0.25.1 and 0.26.2 wrapper. Public turns have fresh HOME, config and keys. */
-import { requireSeatModel } from './seat-model.js';
-import { isPatchAfterNewestTested, probeVersion } from './tested-version.js';
-import * as childProcess from 'child_process';
-import { spawn as childSpawn, spawnSync } from 'child_process';
-import { lstatSync, realpathSync } from 'fs';
-import {
-  chmod, mkdir, mkdtemp, readFile, rm, writeFile,
-} from 'fs/promises';
-import { tmpdir } from 'os';
-import { basename, dirname, isAbsolute, join } from 'path';
-import { buildMemoryPreamble } from '../memory-bridge.js';
-import { deliverSeatCredential } from '../mcp-credential-delivery.js';
-import { prepareMcpSpawn, publicMcpUnavailableError, selectedMcpVersionDir } from '../mcp-home.js';
-import { armCredentialRelease, writeCredentialFile } from '../credential-file.js';
-import { MCP_READY_FILE_ENV, bridgeReadyFile, commonlyMcpReadyFile } from '../mcp-ready.js';
-import { normalizeSandboxTrust, refuseWorkspaceTrust, validateEnvironmentSpec } from '../environment.js';
-import { resolvePublicSandboxMode } from '../sandbox/mode.js';
-import { detectBwrap, wrapArgvWithBwrap } from '../sandbox/bwrap.js';
-import { wrapArgvWithSeatbelt } from '../sandbox/seatbelt.js';
-import { refuseWorkspaceHoldingTurnDirs } from '../sandbox/turn-dir.js';
-import { resolveProviderKeyFile, startProviderProxy } from '../provider-proxy.js';
-import { adapterFailure, spawnCredentials } from '../upstream-refusal.js';
-import { publicSeatWithheldTools } from '../public-withheld-tools.js';
-import { isOurGrantBroker } from '../grant-broker-guard.js';
-import { brokerBridgeEntry } from './broker-bridge-entry.js';
-import { describeMcpCommand } from '../mcp-server-version.js';
-
-// Add a version only with a passing real clean-box sandbox smoke that names it.
-const TESTED_QWEN_VERSIONS = Object.freeze(['0.25.1', '0.26.2']);
-// What keeps a broker-holding seat off its credential is a list of denied
-// built-ins, so a version with a file-reading tool the list doesn't name could
-// reach it. A broker rides only a version that passed the grant proof
-// (qwen.grant-broker.public-smoke.test.mjs), compared exactly: no later patch
-// and no host override. Narrower than TESTED_QWEN_VERSIONS on purpose.
-export const GRANT_TESTED_QWEN_VERSIONS = Object.freeze(['0.26.2']);
-const ALLOW_UNTESTED_QWEN_VERSION_ENV = 'COMMONLY_QWEN_ALLOW_UNTESTED_VERSION';
-const DEFAULT_TIMEOUT_MS = 15 * 60 * 1000;
-const TERMINATION_GRACE_MS = 5000;
-const PUBLIC_SAFE_ENV = /^(?:PATH|LANG|LC_[A-Z_]+|TERM|USER|LOGNAME|NO_COLOR|CI|SSL_CERT_FILE|SSL_CERT_DIR)$/;
-const PROXY_ENV = [
-  'HTTP_PROXY', 'HTTPS_PROXY', 'ALL_PROXY', 'NO_PROXY',
-  'http_proxy', 'https_proxy', 'all_proxy', 'no_proxy',
-];
-const EXCLUDED_TOOLS = [
-  'run_shell_command', 'exec', 'edit', 'notebook_edit', 'write_file',
-  'agent', 'create_sub_session', 'task_create', 'team_create',
-  'workflow', 'advisor',
-  // Legacy aliases. Deny both names even if Qwen changes when it canonicalizes.
-  'replace', 'task',
-  'web_fetch', 'web_search',
-];
-// Qwen can read its own config directory. That directory also contains the
-// per-spawn MCP credential file, so public turns cannot expose OS read tools.
-const PUBLIC_READ_TOOLS = ['read_file', 'grep_search', 'search_file_content', 'glob', 'list_directory', 'lsp'];
-
-// What a public turn adds to --exclude-tools. Both spellings of a Commonly MCP
-// tool, under the usual server name and any this turn declares, as with the
-// aliases above (public-withheld-tools.js; self-install and memory writes, F118,
-// F145).
-export const publicExcludedTools = (serverNames, ctx) => {
-  const names = [...new Set(['commonly', ...serverNames])];
-  return [
-    ...PUBLIC_READ_TOOLS,
-    ...publicSeatWithheldTools(ctx).flatMap((tool) => [tool, ...names.map((name) => `mcp__${name}__${tool}`)]),
-  ];
-};
-
-const parseVersion = (output) => {
-  const match = String(output || '').trim().match(/^(?:qwen(?:\s+code|-code)?\s+)?v?(\d+\.\d+\.\d+)$/i);
-  return match ? match[1] : null;
-};
-
-// Async and cached per binary (tested-version.js probeVersion): a synchronous
-// probe stalled every other seat's provider proxy on the daemon's loop. The
-// namespace import is read at call time, so a suite that mocks child_process
-// without execFile falls back to the real one.
-const readVersion = (binary, env) => probeVersion(binary, {
-  env, timeoutMs: 5000, parse: parseVersion, execFileImpl: childProcess.execFile,
-});
-
-const resolvedBinary = (env) => {
-  const where = spawnSync('which', ['qwen'], { encoding: 'utf8', env });
-  return where.status === 0 ? (where.stdout || '').trim() || 'qwen' : 'qwen';
-};
-
-const withProbeEnv = async (source, run) => {
-  const home = await mkdtemp(join(tmpdir(), 'commonly-qwen-version-'));
-  try {
-    const settingsPath = join(home, 'settings.json');
-    await writeFile(settingsPath, JSON.stringify({
-      privacy: { usageStatisticsEnabled: false },
-    }), { mode: 0o600 });
-    const env = Object.fromEntries(Object.entries(source)
-      .filter(([name]) => PUBLIC_SAFE_ENV.test(name)));
-    env.HOME = home;
-    env.QWEN_HOME = home;
-    env.QWEN_RUNTIME_DIR = home;
-    env.QWEN_CODE_SYSTEM_SETTINGS_PATH = settingsPath;
-    env.QWEN_USAGE_STATISTICS_ENABLED = 'false';
-    for (const name of PROXY_ENV) env[name] = '';
-    // Awaited here, so the probe home outlives an async probe.
-    return await run(env);
-  } finally {
-    await rm(home, { recursive: true, force: true });
-  }
-};
-
-const substitute = (value, ctx) => String(value).replace(/\$\{(COMMONLY_[A-Z_]+)\}/g, (whole, name) => ({
-  COMMONLY_TOKEN_FILE: ctx.credentialFile,
-  COMMONLY_API_URL: ctx.instanceUrl,
-  COMMONLY_INSTANCE_URL: ctx.instanceUrl,
-}[name] || whole));
-
-const isCommonlyStdio = (server) => server?.name === 'commonly'
-  && (server.transport || 'stdio') === 'stdio'
-  && Boolean(describeMcpCommand(server.command)?.isCommonly);
-
-/**
- * The turn's servers. A public seat holds a broker only on a proven version,
- * with the Commonly server as its one other entry, as Goose requires: a second
- * server could read the credential file from the jail, or replace an entry by
- * name and inherit its tool approval. Otherwise the broker goes and the turn runs.
- */
-export const withoutUnprovenBroker = (servers, { version, isPublic, instanceUrl }) => {
-  if (!isPublic || !Array.isArray(servers)) return servers;
-  const brokers = servers.filter((server) => isOurGrantBroker(server, { instanceUrl }));
-  if (!brokers.length) return servers;
-  const others = servers.filter((server) => !brokers.includes(server));
-  const proven = GRANT_TESTED_QWEN_VERSIONS.includes(version);
-  const alone = others.every(isCommonlyStdio);
-  if (proven && alone) return servers;
-  const why = proven
-    ? 'another MCP server is declared beside it'
-    : `not on Qwen ${version || 'unknown'}, which hasn't passed the grant proof (${GRANT_TESTED_QWEN_VERSIONS.join(', ')})`;
-  for (const broker of brokers) {
-    // eslint-disable-next-line no-console
-    console.warn(`[qwen] grant broker ${broker.name}: ${why}, so this turn runs without it.`);
-  }
-  return others;
-};
-
-export const buildQwenMcpConfig = (servers, ctx) => {
-  const mcpServers = {};
-  for (const server of servers || []) {
-    if (!/^[A-Za-z0-9_-]+$/.test(server?.name || '')) continue;
-    const transport = server.transport || 'stdio';
-    if (transport === 'stdio') {
-      if (!Array.isArray(server.command) || !server.command.length) continue;
-      const command = prepareMcpSpawn(server.command, {
-        apiUrl: ctx.instanceUrl, publicSeat: ctx.publicSeat,
-      });
-      if (!command) {
-        ctx.unavailableMcp?.push(server.name);
-        continue;
-      }
-      const delivery = deliverSeatCredential({ ...server, command }, {
-        credentialFile: ctx.credentialFile,
-        label: 'qwen',
-      });
-      const args = command.slice(1).map((part) => substitute(part, ctx));
-      const env = Object.fromEntries(Object.entries(delivery.env)
-        .map(([name, value]) => [name, substitute(value, ctx)]));
-      // F460: on a public seat our server names the file it writes once it has
-      // read the credential (a path, not a secret). An older warm build refuses.
-      const readyPath = commonlyMcpReadyFile(server, command, ctx, { env });
-      if (readyPath) env[MCP_READY_FILE_ENV] = readyPath;
-      const serialized = JSON.stringify({ command: command[0], args, env });
-      if (serialized.includes('${COMMONLY_AGENT_TOKEN}')
-        || (ctx.runtimeToken && serialized.includes(ctx.runtimeToken))) {
-        throw new Error(`Qwen MCP server ${server.name} has no file-backed credential delivery`);
-      }
-      mcpServers[server.name] = {
-        command: command[0], args, env,
-        ...(server.cwd ? { cwd: server.cwd } : {}),
-        // `--exclude-tools` refuses these at the call and still lists them for
-        // the model (measured on 0.26.2), so the server entry drops them too.
-        ...(ctx.publicSeat ? { excludeTools: [...publicSeatWithheldTools(ctx)] } : {}),
-      };
-      const versionDir = ctx.publicSeat && selectedMcpVersionDir(command);
-      if (versionDir) ctx.mcpReadDirectories?.push(versionDir);
-      continue;
-    }
-    if (transport !== 'http' || typeof server.url !== 'string') {
-      throw new Error(`Qwen MCP server ${server.name} has unsupported transport`);
-    }
-    // F175d: Qwen sends these headers literally (no `${VAR}`, no file), so the
-    // broker runs behind the stdio bridge. Public seats only: a private seat
-    // has no jail, so the guard withholds its broker, and an entry that reaches
-    // here anyway falls through to the refusal below.
-    if (ctx.publicSeat && isOurGrantBroker(server, { instanceUrl: ctx.instanceUrl })) {
-      const entry = brokerBridgeEntry(server, ctx);
-      if (entry.skip) {
-        // eslint-disable-next-line no-console
-        console.warn(`[qwen] grant broker ${server.name}: ${entry.skip}, so it is not wired for this spawn.`);
-        continue;
-      }
-      const readyPath = bridgeReadyFile(server, ctx);
-      mcpServers[server.name] = {
-        command: entry.command,
-        args: entry.args,
-        env: readyPath ? { ...entry.env, [MCP_READY_FILE_ENV]: readyPath } : entry.env,
-      };
-      ctx.mcpReadDirectories?.push(entry.readPath);
-      ctx.bridgedBrokers?.push(server.name);
-      continue;
-    }
-    const httpUrl = substitute(server.url, ctx);
-    const headers = Object.fromEntries(Object.entries(server.headers || {})
-      .map(([name, value]) => [name, substitute(value, ctx)]));
-    const serialized = JSON.stringify({ httpUrl, headers });
-    if (serialized.includes('${COMMONLY_AGENT_TOKEN}')
-      || (ctx.runtimeToken && serialized.includes(ctx.runtimeToken))) {
-      throw new Error(`Qwen MCP server ${server.name} requires a credential transport Qwen can keep out of config`);
-    }
-    mcpServers[server.name] = { httpUrl, headers };
-  }
-  return { mcpServers };
-};
-
-const makeChildEnv = (source, home, settingsPath, proxy) => {
-  const env = Object.fromEntries(Object.entries(source)
-    .filter(([name]) => PUBLIC_SAFE_ENV.test(name)));
-  for (const name of PROXY_ENV) env[name] = '';
-  env.HOME = home;
-  env.QWEN_HOME = home;
-  env.QWEN_RUNTIME_DIR = home;
-  env.QWEN_CODE_SYSTEM_SETTINGS_PATH = settingsPath;
-  env.QWEN_USAGE_STATISTICS_ENABLED = 'false';
-  env.OPENAI_BASE_URL = proxy.baseURL;
-  env.OPENAI_API_KEY = proxy.bearer;
-  return env;
-};
-
-const parseStream = (line, state) => {
-  let event;
-  try { event = JSON.parse(line); } catch { return; }
-  if (event.type === 'assistant' && Array.isArray(event.message?.content)) {
-    state.text = event.message.content
-      .filter((part) => part.type === 'text' && typeof part.text === 'string')
-      .map((part) => part.text).join('');
-  }
-  if (event.type === 'result') {
-    if (typeof event.result === 'string') state.text = event.result;
-    if (event.is_error) state.error = event.result || 'Qwen returned an error result';
-  }
-};
-
-const runQwen = ({ cmd, args, cwd, env, timeoutMs, spawnImpl, credentials }) => new Promise((resolve, reject) => {
-  const child = (spawnImpl || childSpawn)(cmd, args, {
-    cwd, env, stdio: ['ignore', 'pipe', 'pipe'],
-  });
-  const state = { text: '', error: null, buffer: '' };
-  let stderr = '';
-  let timedOut = false;
-  let settled = false;
-  const finish = (error, result) => {
-    if (settled) return;
-    settled = true;
-    clearTimeout(timer);
-    clearTimeout(killTimer);
-    if (error) reject(error); else resolve(result);
-  };
-  const timer = setTimeout(() => {
-    timedOut = true;
-    child.kill('SIGTERM');
-    killTimer = setTimeout(() => child.kill('SIGKILL'), TERMINATION_GRACE_MS);
-  }, timeoutMs);
-  let killTimer;
-  child.stdout?.on('data', (chunk) => {
-    state.buffer += chunk.toString();
-    if (state.buffer.length > 1024 * 1024) {
-      finish(new Error('Qwen stream line exceeded 1 MiB'));
-      child.kill('SIGTERM');
-      return;
-    }
-    while (state.buffer.includes('\n')) {
-      const end = state.buffer.indexOf('\n');
-      parseStream(state.buffer.slice(0, end), state);
-      state.buffer = state.buffer.slice(end + 1);
-    }
-  });
-  child.stderr?.on('data', (chunk) => { stderr = (stderr + chunk.toString()).slice(-8192); });
-  child.on('error', (error) => finish(error));
-  child.on('close', (code) => {
-    if (state.buffer) parseStream(state.buffer, state);
-    if (timedOut) return finish(new Error(`qwen timed out after ${timeoutMs}ms`));
-    if (code !== 0 || state.error) {
-      return finish(adapterFailure('qwen', state.error || stderr.trim() || `exit ${code}`, {
-        credentials, exitCode: code, limit: 500,
-      }));
-    }
-    return finish(null, { text: state.text.trim() });
-  });
-});
-
-export default {
-  requiresModel: true,
-  name: 'qwen',
-  runtimeType: 'qwen',
-  supportsProvider: true,
-
-  async validateEnvironment(environment, workspacePath) {
-    const validation = validateEnvironmentSpec(environment);
-    if (!validation.ok) throw new Error(validation.errors.join('; '));
-    if (!environment?.provider || !environment?.model) {
-      throw new Error('Qwen requires environment.provider and environment.model');
-    }
-    return resolveProviderKeyFile(environment.provider, workspacePath, 'Qwen', { environment });
-  },
-
-  async detect() {
-    return withProbeEnv(process.env, (env) => {
-      const result = spawnSync('qwen', ['--version'], { encoding: 'utf8', timeout: 5000, env });
-      if (result.status !== 0 || result.error) return null;
-      return { path: resolvedBinary(env), version: parseVersion(result.stdout) || 'unknown' };
-    });
-  },
-
-  async spawn(prompt, ctx = {}) {
-    const seatModel = requireSeatModel(ctx.environment, 'qwen', true);
-    const sandbox = normalizeSandboxTrust(ctx.environment?.sandbox);
-    refuseWorkspaceTrust(sandbox, 'qwen');
-    const isPublic = sandbox?.trust === 'public';
-    const mode = isPublic ? resolvePublicSandboxMode(sandbox) : null;
-    if (isPublic && !['workspace', 'read-only', 'bwrap'].includes(mode)) {
-      throw new Error('public Qwen seats require an enforced sandbox');
-    }
-    const provider = ctx.environment?.provider;
-    if (!provider || !ctx.environment?.model) {
-      throw new Error('Qwen seats require environment.provider and environment.model');
-    }
-    if (isPublic && mode === 'bwrap' && sandbox?.network?.policy === 'restricted') {
-      throw new Error('public Qwen provider proxy requires shared bwrap networking');
-    }
-    const keyFile = await this.validateEnvironment(ctx.environment, ctx.cwd);
-    const sourceEnv = ctx.env || process.env;
-    const { binary, version } = await withProbeEnv(sourceEnv, async (probeEnv) => {
-      const path = ctx._binaryPath || resolvedBinary(probeEnv);
-      return { binary: path, version: await readVersion(path, probeEnv) };
-    });
-    if (!TESTED_QWEN_VERSIONS.includes(version)) {
-      const versions = TESTED_QWEN_VERSIONS.join(', ');
-      const allowOverride = process.env[ALLOW_UNTESTED_QWEN_VERSION_ENV] === '1';
-      const patchAfterTested = isPatchAfterNewestTested(version, TESTED_QWEN_VERSIONS);
-      if (isPublic && !allowOverride && !patchAfterTested) {
-        throw new Error(`Public Qwen seats refuse version ${version || 'unknown'}; smoke-tested: ${versions}. Set ${ALLOW_UNTESTED_QWEN_VERSION_ENV}=1 in the host process to override.`);
-      }
-      let outcome = 'trusted seat continues';
-      if (isPublic) outcome = allowOverride ? 'host override accepted' : 'a patch release on the newest smoke-tested line, so the public seat continues';
-      // eslint-disable-next-line no-console
-      console.warn(`[qwen] installed ${version || 'unknown'} differs from smoke-tested ${versions}; ${outcome}`);
-    }
-    // npm launches through a symlink into the package. Qwen loads chunks next
-    // to that entry file, so public sandboxes need that exact read-only tree.
-    const symlinkedBinary = isPublic && lstatSync(binary).isSymbolicLink();
-    const executable = symlinkedBinary
-      ? join(realpathSync(dirname(binary)), basename(binary)) : binary;
-    const packageDir = symlinkedBinary ? dirname(realpathSync(executable)) : null;
-    if (isPublic) await refuseWorkspaceHoldingTurnDirs({ workspace: ctx.cwd, seat: 'public Qwen agents' });
-    const tempDir = await mkdtemp(join(tmpdir(), 'commonly-qwen-'));
-    await chmod(tempDir, 0o700);
-    // Keep child-writable state separate from adapter-owned config and keys.
-    const home = await mkdtemp(join(tmpdir(), 'commonly-qwen-home-'));
-    await chmod(home, 0o700);
-    const settingsPath = join(tempDir, 'settings.json');
-    const mcpPath = join(tempDir, 'mcp.json');
-    let proxy;
-    let credentialRelease = null;
-    let reply = null;
-    let cleanupFailure = null;
-    try {
-      const credential = writeCredentialFile(ctx.runtimeToken, {
-        agentName: ctx.agentName || 'agent', root: tempDir,
-      });
-      // F460: the jail writes only the seat's home, so a public seat's MCP
-      // servers write their ready files there.
-      const readyFileDir = isPublic && credential ? join(home, 'mcp-ready') : null;
-      if (readyFileDir) await mkdir(readyFileDir, { recursive: true, mode: 0o700 });
-      const readyFiles = [];
-      proxy = await startProviderProxy({
-        provider, keyFile, tokenFile: join(tempDir, 'provider-proxy-token'), adapterLabel: 'Qwen',
-      });
-      const proxyWithBearer = { ...proxy, bearer: (await readFile(proxy.tokenFile, 'utf8')).trim() };
-      const unavailableMcp = [];
-      const mcpReadDirectories = [];
-      const bridgedBrokers = [];
-      const turnServers = withoutUnprovenBroker(ctx.environment?.mcp, {
-        version, isPublic, instanceUrl: ctx.instanceUrl || '',
-      });
-      const mcp = buildQwenMcpConfig(turnServers, {
-        credentialFile: credential?.path || '',
-        instanceUrl: ctx.instanceUrl || '',
-        runtimeToken: ctx.runtimeToken || '',
-        publicSeat: isPublic,
-        ownerWoken: ctx.ownerWoken,
-        unavailableMcp,
-        mcpReadDirectories,
-        bridgedBrokers,
-        readyFileDir,
-        readyFiles,
-      });
-      if (unavailableMcp.length) throw publicMcpUnavailableError(unavailableMcp);
-      await Promise.all([
-        writeFile(settingsPath, JSON.stringify({
-          privacy: { usageStatisticsEnabled: false },
-          general: { enableAutoUpdate: false },
-        }), { mode: 0o600 }),
-        writeFile(mcpPath, JSON.stringify(mcp), { mode: 0o600 }),
-      ]);
-      const env = makeChildEnv(sourceEnv, home, settingsPath, proxyWithBearer);
-      // QWEN_HOME is discarded after every turn, so Qwen session ids cannot
-      // be resumed. The kernel memory preamble supplies continuity instead.
-      const fullPrompt = buildMemoryPreamble(prompt, ctx.memoryLongTerm, {
-        freshSession: true,
-        // F118, F145: a public seat reads its memory, and is offered a write
-        // only on a turn its owner woke.
-        memoryReadOnly: isPublic && ctx.ownerWoken !== true,
-      });
-      const allowedTools = [
-        ...(Object.hasOwn(mcp.mcpServers, 'commonly') ? ['commonly'] : []), ...bridgedBrokers,
-      ].map((name) => `mcp__${name}__*`);
-      const args = [
-        '--bare', '--safe-mode', '--auth-type', 'openai', '-m', seatModel,
-        '--mcp-config', mcpPath, '--exclude-tools', [
-          ...EXCLUDED_TOOLS, ...(isPublic ? publicExcludedTools(Object.keys(mcp.mcpServers), ctx) : []),
-        ].join(','),
-        // Qwen ignores settings permissions in bare/safe mode, but still
-        // honours CLI allow rules. Any seat needs its declared Commonly tools
-        // approved before non-interactive execution begins, public included:
-        // without it a public seat's commonly_post_message was declined
-        // (D247 walk, 11-04). Public parity with Claude's --allowedTools
-        // mcp__commonly__*; the withheld tools stay in --exclude-tools above.
-        // The broker parks every write for the owner itself (F175d).
-        ...(allowedTools.length ? ['--allowed-tools', allowedTools.join(',')] : []),
-        '-o', 'stream-json', '-p', fullPrompt,
-      ];
-      let cmd = executable;
-      let spawnArgs = args;
-      if (isPublic && mode === 'bwrap') {
-        if (!isAbsolute(executable)) throw new Error('public Qwen seats require an absolute qwen executable path');
-        // bwrap binds a symlink's target at the link's path, so npm's `.bin/qwen`
-        // would lose the `./cli.js` beside it. The real entry keeps its package.
-        const bwrapEntry = symlinkedBinary ? realpathSync(executable) : executable;
-        const bwrap = (ctx._detectBwrap || detectBwrap)();
-        if (!bwrap.available) throw new Error(`public Qwen seats require bwrap: ${bwrap.error}`);
-        [cmd, ...spawnArgs] = (ctx._wrapArgvWithBwrap || wrapArgvWithBwrap)([bwrapEntry, ...args], {
-          ...ctx.environment,
-          sandbox: {
-            ...sandbox,
-            filesystem: {
-              ...(sandbox?.filesystem || {}),
-              'write-outside': [
-                ...(sandbox?.filesystem?.['write-outside'] || []), home,
-              ],
-            },
-          },
-        }, {
-          workspacePath: ctx.cwd,
-          homePath: home,
-          readOnlyPaths: [tempDir, bwrapEntry, packageDir, process.execPath, ...mcpReadDirectories].filter(Boolean),
-        });
-      } else if (isPublic) {
-        if ((ctx._platform || process.platform) !== 'darwin') {
-          throw new Error(`public Qwen sandbox.mode=${mode} requires Seatbelt on macOS or bwrap on Linux`);
-        }
-        [cmd, ...spawnArgs] = (ctx._wrapArgvWithSeatbelt || wrapArgvWithSeatbelt)([executable, ...args], {
-          workspacePath: ctx.cwd,
-          workspaceAccess: mode === 'read-only' ? 'read' : 'write',
-          executablePath: executable,
-          statePath: home,
-          // Public seat: the CLI made this workspace, so it is pinned (F197).
-          pinWorkspace: true,
-          mcpConfigDir: tempDir,
-          loopbackNetworkPorts: [proxy.port],
-          readOnlyDirectories: [...(packageDir ? [packageDir] : []), ...mcpReadDirectories],
-        });
-      }
-      const requestedTimeout = Number(ctx.timeoutMs);
-      const timeoutMs = Number.isFinite(requestedTimeout) && requestedTimeout > 0
-        ? Math.min(requestedTimeout, DEFAULT_TIMEOUT_MS) : DEFAULT_TIMEOUT_MS;
-      // F460: on a public seat the credential goes once every MCP reader has it
-      // (their ready files), or at the deadline. A delete that fails ends the turn.
-      let releaseFailure = null;
-      let child = null;
-      const spawnImpl = (...spawnArgs) => {
-        child = (ctx._spawnImpl || childSpawn)(...spawnArgs);
-        return child;
-      };
-      if (readyFileDir) {
-        credentialRelease = armCredentialRelease(credential, {
-          readyFiles: readyFiles.map(({ path }) => path),
-          label: 'public Qwen seat',
-          // eslint-disable-next-line no-console
-          warn: (text) => console.warn(`[qwen] ${text}`),
-          onFailure: (err) => { releaseFailure = err; child?.kill?.('SIGKILL'); },
-          ...ctx._credentialRelease,
-        });
-        if (credentialRelease.error) throw credentialRelease.error;
-      }
-      const result = await runQwen({
-        cmd, args: spawnArgs, cwd: ctx.cwd, env, timeoutMs,
-        spawnImpl,
-        credentials: [...spawnCredentials(ctx, []), proxyWithBearer.bearer],
-      }).catch((err) => { throw releaseFailure || err; });
-      if (releaseFailure) throw releaseFailure;
-      reply = { text: result.text, newSessionId: null };
-    } finally {
-      credentialRelease?.stop();
-      try { await proxy?.close(); } catch { /* best effort */ }
-      const removed = await Promise.allSettled([tempDir, home].map((path) => rm(path, { recursive: true, force: true })));
-      cleanupFailure = removed.find((outcome) => outcome.status === 'rejected')?.reason || null;
-    }
-    // Reached only when the turn worked. A cleanup failure is then the turn's
-    // error: on a private seat that rm is the one delete of the credential, so
-    // the turn must not report success over it. When another error ended the
-    // turn (a failed release, say), it propagates past this and is kept.
-    if (cleanupFailure) throw cleanupFailure;
-    return reply;
-  },
-};
-
-export { TESTED_QWEN_VERSIONS, ALLOW_UNTESTED_QWEN_VERSION_ENV, makeChildEnv, parseVersion };

package/src/lib/adapters/seat-model.js

@@ -1,8 +0,0 @@
-import { requireSeatModel as requireDeclaredModel } from '@commonlyai/seats/seat-model';
-
-/** Fleet runners opt in; BYO users retain their own CLI's model default. */
-export const seatModelRequired = () => process.env.COMMONLY_REQUIRE_SEAT_MODEL === '1';
-
-export const requireSeatModel = (environment, adapterName, required = seatModelRequired()) => (
-  requireDeclaredModel(environment, adapterName, required)
-);

package/src/lib/adapters/stub.js

@@ -1 +0,0 @@
-export { default } from '@commonlyai/seats/adapters/stub';

package/src/lib/adapters/tested-version.js

@@ -1,106 +0,0 @@
-// A namespace import, read at call time: suites that mock child_process with
-// only spawn/spawnSync still load this module.
-import * as childProcess from 'node:child_process';
-import { realpathSync, statSync } from 'node:fs';
-import { basename } from 'node:path';
-import { resolveOnPath } from '../resolve-on-path.js';
-
-// Public seats run only on a harness version smoke-tested in its sandbox, with
-// one tolerance: a stable patch release after the newest tested one, on that
-// same major.minor line. Harnesses ship patches every few days, and refusing
-// them refused every new BYO user on the current npm release (D245, 11-04).
-// A newer minor or major, an older patch, an older line, or a prerelease still
-// refuses until it is smoke-tested and added to the adapter's list.
-const STABLE = /^(\d+)\.(\d+)\.(\d+)$/;
-const SEMVER = /^(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?$/;
-
-export const isPatchAfterNewestTested = (version, tested) => {
-  const installed = STABLE.exec(String(version || ''));
-  const newest = STABLE.exec(String(tested[tested.length - 1] || ''));
-  if (!installed || !newest) return false;
-  return Number(installed[1]) === Number(newest[1])
-    && Number(installed[2]) === Number(newest[2])
-    && Number(installed[3]) > Number(newest[3]);
-};
-
-// A floor rather than a list: the version, or anything later, prereleases of a
-// later version included, so the list's prerelease rule above doesn't apply. A
-// prerelease of the floor comes before it, and an unreadable version meets nothing.
-export const meetsMinimumVersion = (version, minimum) => {
-  const installed = SEMVER.exec(String(version ?? ''));
-  const floor = STABLE.exec(String(minimum ?? ''));
-  if (!installed || !floor) return false;
-  for (let part = 1; part <= 3; part += 1) {
-    const difference = Number(installed[part]) - Number(floor[part]);
-    if (difference !== 0) return difference > 0;
-  }
-  return !installed[4];
-};
-
-export const PUBLIC_CODEX_VERSION_CODE = 'public_codex_version';
-
-// `found` stays in this message, which only the seat's log shows. The line a pod
-// sees is built from `requiredVersion` (turn-failure-notice.js).
-// `seat` names which seat refused: a private seat under its permission profile
-// (F387) needs the same tested version as a public one.
-export const publicCodexVersionError = ({ found, required, seat = 'public seat' }) => {
-  const error = new Error(found
-    ? `${seat} refused this turn: Codex ${found} is older than this seat needs. `
-      + `Upgrade Codex to at least ${required} and start the agent again.`
-    : `${seat} refused this turn: could not read the Codex version. `
-      + `Check that \`codex --version\` works for this agent, upgrade Codex to at least ${required} `
-      + 'if it is older, and start the agent again.');
-  error.code = PUBLIC_CODEX_VERSION_CODE;
-  error.requiredVersion = required;
-  return error;
-};
-
-// The harness's own `--version`, asked without blocking the event loop and
-// remembered per binary. A daemon runs every seat in one process, beside the
-// loopback provider proxies of other seats' live turns, so a synchronous probe
-// stalled all of them while a cold harness started (up to its timeout).
-//
-// The cache key is the binary's real path; its mtime decides freshness, so a
-// harness upgraded in place is probed again. Only a parsed version is kept: a
-// failed or unparseable probe is asked again next turn, never remembered.
-//
-// A bare name ('goose', 'qwen') is resolved through the probe env's PATH, as
-// execFile would resolve it, never against the daemon's working directory: a
-// cwd lookup missed the cache every turn and could key it on a same-named file
-// there. What runs is that resolved real path, so the binary that answers is
-// the one the key names. A name that does not resolve runs as given, uncached.
-//
-// `args` come before `--version`, for a launch that is an interpreter and a
-// script (a Windows npm shim). The interpreter's path says nothing about which
-// script it would run, so that probe is never cached.
-const versionCache = new Map();
-
-const resolveBinary = (binary, env) => {
-  const name = String(binary || '');
-  if (!name) return null;
-  const located = basename(name) === name ? resolveOnPath(name, env?.PATH) : name;
-  if (!located) return null;
-  try {
-    const key = realpathSync(located);
-    return { key, mtimeMs: statSync(key).mtimeMs };
-  } catch {
-    return null;
-  }
-};
-
-export const probeVersion = async (binary, {
-  args = [], env, timeoutMs = 30000, parse, execFileImpl = childProcess.execFile, cache = versionCache,
-} = {}) => {
-  const resolved = args.length ? null : resolveBinary(binary, env);
-  const key = resolved?.key || null;
-  const hit = key ? cache.get(key) : null;
-  if (hit && hit.mtimeMs === resolved.mtimeMs) return hit.version;
-  const stdout = await new Promise((resolve) => {
-    execFileImpl(key || binary, [...args, '--version'], { encoding: 'utf8', env, timeout: timeoutMs }, (error, out) => {
-      resolve(error ? null : out);
-    });
-  });
-  const version = stdout === null ? null : parse(stdout);
-  if (version && key) cache.set(key, { mtimeMs: resolved.mtimeMs, version });
-  return version;
-};