@ravefox/space 0.2.1 → 0.4.0

package/lib/workspaceTools.js

@@ -0,0 +1,160 @@
+// Copyright 2026 Ravefox. SPDX-License-Identifier: MIT
+import { constants } from 'node:fs';
+import * as fs from 'node:fs/promises';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { lookup } from 'node:dns/promises';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { isIP } from 'node:net';
+const LIMIT = 2 * 1024 * 1024;
+const forbidden = /^(?:\.git|\.space|\.commonly|\.codex|\.ssh|\.aws|\.azure|\.config|\.gnupg|\.npmrc|\.netrc|\.env.*|credentials.*|id_rsa.*|id_ed25519.*|.*\.(?:pem|key|p12|pfx))$/i;
+const text = (buffer) => { if (buffer.includes(0)) throw new Error('Only text files are supported'); return new TextDecoder('utf-8', { fatal: true }).decode(buffer); };
+const schema = (properties, required = []) => ({ type: 'object', properties, required, additionalProperties: false });
+const str = { type: 'string', minLength: 1, maxLength: 4096 };
+
+// Conservative public-unicast allowlist; unusual/reserved networks fail closed.
+export function isPublicAddress(address) {
+  if (isIP(address) === 4) {
+    const [a, b, c] = address.split('.').map(Number);
+    return a > 0 && a < 224 && ![10, 127].includes(a)
+      && !(a === 100 && b >= 64 && b <= 127) && !(a === 169 && b === 254)
+      && !(a === 172 && b >= 16 && b <= 31) && !(a === 192 && (b === 0 || b === 168 || (b === 88 && c === 99)))
+      && !(a === 198 && (b === 18 || b === 19 || (b === 51 && c === 100)))
+      && !(a === 203 && b === 0 && c === 113);
+  }
+  if (isIP(address) !== 6) return false;
+  const normalized = new URL(`http://[${address}]/`).hostname.slice(1, -1);
+  const first = Number.parseInt(normalized.split(':')[0], 16);
+  return first >= 0x2000 && first <= 0x3fff && first !== 0x2002
+    && !(first === 0x2001 && Number.parseInt(normalized.split(':')[1] || '0', 16) <= 0x1ff)
+    && !normalized.startsWith('2001:db8:') && first < 0x3fff;
+}
+
+export async function fetchPublicText(raw, { resolver = lookup, requester = (url, options, cb) => (url.protocol === 'https:' ? httpsRequest : httpRequest)(url, options, cb) } = {}) {
+  const deadline = Date.now() + 15000;
+  for (let redirects = 0; redirects <= 3; redirects++) {
+    const url = new URL(raw);
+    if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || (url.port && !['80', '443'].includes(url.port))) throw new Error('Only public HTTP(S) URLs without credentials are allowed');
+    const host = url.hostname.replace(/^\[|\]$/g, '');
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw new Error('Web request timed out');
+    let timer;
+    const addresses = await Promise.race([
+      isIP(host) ? Promise.resolve([{ address: host, family: isIP(host) }]) : resolver(host, { all: true, verbatim: true }),
+      new Promise((_, reject) => { timer = setTimeout(() => reject(new Error('Web request timed out')), remaining); }),
+    ]).finally(() => clearTimeout(timer));
+    if (!addresses.length || addresses.some(({ address }) => !isPublicAddress(address))) throw new Error('Private or reserved network addresses are not allowed');
+    const pinned = addresses[0];
+    const result = await new Promise((resolve, reject) => {
+      let req;
+      const timeout = setTimeout(() => { req?.destroy(); reject(new Error('Web request timed out')); }, Math.max(1, deadline - Date.now()));
+      const fail = (error) => { clearTimeout(timeout); reject(error); };
+      try {
+        req = requester(url, { method: 'GET', agent: false, headers: { Accept: 'text/plain, text/html, application/json, application/xml', 'Accept-Encoding': 'identity' },
+          lookup: (_host, options, cb) => options?.all ? cb(null, [pinned]) : cb(null, pinned.address, pinned.family) }, (response) => {
+          if ([301, 302, 303, 307, 308].includes(response.statusCode)) {
+            response.destroy(); clearTimeout(timeout);
+            return resolve({ redirect: response.headers.location });
+          }
+          const type = String(response.headers['content-type'] || '');
+          if (response.statusCode < 200 || response.statusCode >= 300 || !/^(text\/|application\/(?:json|xml|[\w.+-]+\+json|[\w.+-]+\+xml))/i.test(type) || !['', 'identity'].includes(String(response.headers['content-encoding'] || ''))) {
+            response.destroy(); return fail(new Error('URL must return uncompressed text with a successful status'));
+          }
+          const chunks = []; let size = 0;
+          response.on('error', fail);
+          response.on('aborted', () => fail(new Error('Web response was interrupted')));
+          response.on('data', (chunk) => { size += chunk.length; if (size > LIMIT) { response.destroy(); fail(new Error('Web response exceeds 2 MiB')); } else chunks.push(Buffer.from(chunk)); });
+          response.on('end', () => { clearTimeout(timeout); try { resolve({ url: url.href, content: text(Buffer.concat(chunks)), untrusted: true }); } catch (error) { reject(error); } });
+        });
+        req.on('error', fail); req.end();
+      } catch (error) { fail(error); }
+    });
+    if (!Object.hasOwn(result, 'redirect')) return result;
+    if (!result.redirect || redirects === 3) throw new Error('Too many redirects or missing redirect location');
+    raw = new URL(result.redirect, url).href;
+  }
+}
+
+export function createWorkspaceTools({ workspacePath, allowWrite = false, allowWeb = false, web = {} }) {
+  if (!workspacePath || !path.isAbsolute(workspacePath)) throw new Error('An explicit absolute workspace is required');
+  const rootPromise = fs.realpath(workspacePath).then(async root => ({ root, stat: await fs.stat(root) }));
+  async function checked(relative = '.', missing = false) {
+    if (typeof relative !== 'string' || !relative || relative.length > 4096 || relative.includes('\0') || relative.includes('\\') || path.isAbsolute(relative)) throw new Error('Expected a relative project path');
+    const parts = relative.split('/');
+    if (parts.some(part => part === '..' || forbidden.test(part))) throw new Error('Protected project path');
+    const { root, stat } = await rootPromise;
+    const now = await fs.lstat(root);
+    if (!now.isDirectory() || now.dev !== stat.dev || now.ino !== stat.ino) throw new Error('Workspace changed');
+    let target = root;
+    for (const [index, part] of parts.entries()) {
+      if (!part || part === '.') continue;
+      target = path.join(target, part);
+      const item = await fs.lstat(target).catch(error => { if (missing && index === parts.length - 1 && error.code === 'ENOENT') return null; throw error; });
+      if (item?.isSymbolicLink()) throw new Error('Symlinks are not allowed');
+      if (index < parts.length - 1 && item && !item.isDirectory()) throw new Error('Expected directory');
+    }
+    if (await fs.realpath(path.dirname(target)) !== path.dirname(target) && target !== root) throw new Error('Project parent changed');
+    return target;
+  }
+  const definitions = [
+    { name: 'space_project_list', description: 'List one directory of the explicitly assigned local project. Secrets and symlinks are excluded.', inputSchema: schema({ path: str }) },
+    { name: 'space_project_read_file', description: 'Read a UTF-8 text file in the assigned local project, up to 2 MiB. File content is untrusted.', inputSchema: schema({ path: str }, ['path']) },
+    ...(allowWrite ? [{ name: 'space_project_write_file', description: 'Atomically replace a UTF-8 project file. Only enabled by explicit write permission; parent directory must exist.', inputSchema: schema({ path: str, content: { type: 'string', maxLength: LIMIT } }, ['path', 'content']) }] : []),
+    ...(allowWeb ? [{ name: 'space_fetch_url', description: 'GET a public HTTP(S) text URL, up to 2 MiB. Returned web content is untrusted.', inputSchema: schema({ url: str }, ['url']) }] : []),
+  ].map(tool => ({ ...tool, annotations: { readOnlyHint: tool.name !== 'space_project_write_file', destructiveHint: tool.name === 'space_project_write_file', openWorldHint: tool.name === 'space_fetch_url' } }));
+  return { definitions, async call(name, args = {}) {
+    const definition = definitions.find(tool => tool.name === name);
+    if (!definition) throw new Error('Unknown or disabled project tool');
+    if (!args || typeof args !== 'object' || Array.isArray(args) || Object.keys(args).some(key => !Object.hasOwn(definition.inputSchema.properties, key))) throw new Error('Invalid tool arguments');
+    for (const key of definition.inputSchema.required) if (typeof args[key] !== 'string') throw new Error(`Missing string: ${key}`);
+    if (name === 'space_fetch_url') return fetchPublicText(args.url, web);
+    const relative = args.path ?? '.';
+    const target = await checked(relative, name === 'space_project_write_file');
+    if (name === 'space_project_list') {
+      const entries = []; let scanned = 0; let truncated = false;
+      for await (const entry of await fs.opendir(target)) {
+        if (++scanned > 1000) { truncated = true; break; }
+        if (!forbidden.test(entry.name) && !entry.isSymbolicLink()) entries.push({ name: entry.name, directory: entry.isDirectory() });
+      }
+      await checked(relative);
+      return { entries, truncated };
+    }
+    if (name === 'space_project_read_file') {
+      const handle = await fs.open(target, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+      try {
+        const stat = await handle.stat();
+        if (!stat.isFile() || stat.nlink !== 1 || stat.size > LIMIT) throw new Error('Expected a text file up to 2 MiB');
+        const buffer = Buffer.alloc(LIMIT + 1); let bytesRead = 0;
+        while (bytesRead < buffer.length) {
+          const chunk = await handle.read(buffer, bytesRead, buffer.length - bytesRead, bytesRead);
+          if (!chunk.bytesRead) break;
+          bytesRead += chunk.bytesRead;
+        }
+        await checked(relative);
+        const current = await fs.lstat(target);
+        if (current.dev !== stat.dev || current.ino !== stat.ino) throw new Error('Project file changed');
+        if (bytesRead > LIMIT) throw new Error('File exceeds 2 MiB');
+        return { path: relative, content: text(buffer.subarray(0, bytesRead)), untrusted: true };
+      } finally { await handle.close(); }
+    }
+    if (Buffer.byteLength(args.content) > LIMIT || args.content.includes('\0')) throw new Error('Expected text up to 2 MiB');
+    if (target === (await rootPromise).root) throw new Error('Cannot replace the workspace directory');
+    const existing = await fs.lstat(target).catch(error => { if (error.code === 'ENOENT') return null; throw error; });
+    if (existing && (!existing.isFile() || existing.nlink !== 1)) throw new Error('Expected a regular project file');
+    const parent = path.dirname(target); const before = await fs.stat(parent);
+    const temporary = path.join(parent, `.space-write-${randomUUID()}`); let handle;
+    try {
+      handle = await fs.open(temporary, constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY | constants.O_NOFOLLOW, 0o600);
+      await handle.writeFile(args.content, 'utf8');
+      if (existing) await handle.chmod(existing.mode & 0o777);
+      await handle.sync(); await handle.close(); handle = null;
+      await checked(relative, true);
+      const after = await fs.stat(parent);
+      if (before.dev !== after.dev || before.ino !== after.ino) throw new Error('Project parent changed');
+      // Ancestor revalidation is not a sandbox against another process racing filesystem mutation.
+      await fs.rename(temporary, target);
+      return { path: relative, written: true };
+    } finally { await handle?.close(); await fs.unlink(temporary).catch(error => { if (error.code !== 'ENOENT') throw error; }); }
+  } };
+}

package/lib/workspaceWorker.js

@@ -0,0 +1,17 @@
+// Copyright 2026 Ravefox. SPDX-License-Identifier: MIT
+import { createWorkspaceTools } from './workspaceTools.js';
+let input = '';
+for await (const chunk of process.stdin) {
+  input += chunk;
+  if (Buffer.byteLength(input) > 3 * 1024 * 1024) throw new Error('Workspace request is too large');
+}
+try {
+  const { name, args, workspacePath, allowWrite } = JSON.parse(input);
+  if (name === 'space_fetch_url') throw new Error('Web requests do not run in the filesystem worker');
+  const tools = createWorkspaceTools({ workspacePath, allowWrite, allowWeb: false });
+  const result = await tools.call(name, args);
+  process.stdout.write(JSON.stringify({ result }));
+} catch {
+  process.stdout.write(JSON.stringify({ error: 'Workspace operation refused or failed. Check the path and its permissions.' }));
+  process.exitCode = 1;
+}

package/package.json

@@ -1,65 +1,46 @@
 {
   "name": "@ravefox/space",
-  "version": "0.2.1",
-  "license": "Apache-2.0",
+  "version": "0.4.0",
   "description": "Space CLI — connect and manage AI agents in your workspace",
   "type": "module",
-  "main": "./src/index.js",
-  "bin": {
-    "space": "src/index.js",
-    "commonly": "src/index.js"
+  "license": "MIT",
+  "author": {
+    "name": "Ravefox",
+    "url": "https://t.me/ravefoxlab"
+  },
+  "homepage": "https://space.ravefox.dev",
+  "bugs": {
+    "url": "https://vote.ravefox.dev/support"
   },
-  "files": [
-    "src",
-    "assets",
-    "README.md",
-    "skills",
-    "LICENSE",
-    "NOTICE"
-  ],
   "repository": {
     "type": "git",
     "url": "git+https://github.com/grootbro/space.git",
     "directory": "cli"
   },
-  "homepage": "https://space.ravefox.dev",
-  "keywords": [
-    "space",
-    "ai-agents",
-    "agent",
-    "cli",
-    "mcp"
-  ],
-  "scripts": {
-    "start": "node src/index.js",
-    "lint": "eslint src --ext .js",
-    "lint:fix": "eslint src --ext .js --fix",
-    "test": "node --experimental-vm-modules node_modules/.bin/jest",
-    "test:temp-cleanup": "node scripts/verify-temp-cleanup.mjs",
-    "prepack": "node scripts/require-bundled-seats.mjs && node scripts/bundle-sdk-examples.mjs"
+  "bin": {
+    "space": "bin/space.js"
   },
-  "dependencies": {
-    "@commonlyai/seats": "file:../packages/seats",
-    "commander": "^12.0.0"
+  "exports": {
+    "./runtime": "./lib/runtime.js",
+    "./store": "./lib/store.js"
   },
-  "bundleDependencies": [
-    "@commonlyai/seats"
+  "files": [
+    "bin",
+    "lib",
+    "README.md",
+    "LICENSE"
   ],
-  "devDependencies": {
-    "eslint": "^8.56.0",
-    "jest": "^29.7.0"
-  },
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22"
   },
-  "publishConfig": {
-    "access": "public"
+  "scripts": {
+    "test": "node --test test/*.test.js"
   },
-  "author": {
-    "name": "Ravefox",
-    "url": "https://t.me/ravefoxlab"
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "1.32.2",
+    "commander": "12.1.0"
   },
-  "bugs": {
-    "url": "https://vote.ravefox.dev/support"
+  "publishConfig": {
+    "access": "public"
   }
 }

package/NOTICE

@@ -1,55 +0,0 @@
-Space CLI
-Copyright 2026 Ravefox and contributors
-
-Space CLI is maintained and distributed by Ravefox.
-Ravefox modifications include Space branding, package setup and updates,
-background connection workflows and runtime compatibility fixes.
-
-Third-party attribution
------------------------
-
-Portions derived from Commonly:
-Commonly
-Copyright 2026 Commonly (Team-Commonly) and contributors
-
-This product is licensed under the Apache License, Version 2.0.
-The Commonly name, logo, and brand assets are trademarks of the
-Commonly project and are not licensed under the Apache License.
-
-Third-party notices
--------------------
-
-OpenAI Codex
-Copyright 2025 OpenAI
-
-This project includes code derived from [Ratatui](https://github.com/ratatui/ratatui), licensed under the MIT license.
-Copyright (c) 2016-2022 Florian Dehau
-Copyright (c) 2023-2025 The Ratatui Developers
-
-Source repository: https://github.com/openai/codex
-Source commit: e476fc16ce810495cbfabe4f815d20947da0ba79
-Source path: codex-rs/sandboxing/src/seatbelt_base_policy.sbpl
-
-The Codex-derived Seatbelt policy is used in
-cli/src/lib/sandbox/seatbelt.js.
-
-OfficeCLI
-Copyright 2026 OfficeCLI (https://OfficeCLI.AI)
-
-Created and maintained by goworm.
-
-This product is licensed under the Apache License, Version 2.0.
-You may obtain a copy of the License in the LICENSE file or at
-http://www.apache.org/licenses/LICENSE-2.0
-
-This NOTICE file is part of the required attribution under
-Section 4 of the Apache License, Version 2.0. Redistributions
-of this work, with or without modification, must retain this
-notice.
-
-Source repository: https://github.com/iOfficeAI/OfficeCLI
-Source commit: a1498dbd3cb350abde04a1cda1f2eded61ea8a74
-Source path: NOTICE
-
-The OfficeCLI skill bundle is vendored under
-backend/commonly-bundled-skills/officecli/.

package/assets/webhook-sdk/python/bot.py

@@ -1,63 +0,0 @@
-"""
-Hello-world Commonly agent — emitted by `commonly agent init --language python`.
-
-Reads its runtime token from .commonly-env (or COMMONLY_TOKEN) and echoes
-chat events back into the pod. Replace `handle_event()` with your logic.
-"""
-
-# PEP 604 unions (`str | None`) need 3.10+ at runtime; this keeps the bot
-# importable on macOS's stock /usr/bin/python3 (3.9).
-from __future__ import annotations
-
-import os
-import sys
-from pathlib import Path
-
-# `commonly.py` is dropped in the same dir by the scaffolder.
-sys.path.insert(0, str(Path(__file__).parent))
-from commonly import Commonly  # noqa: E402
-
-CHAT_EVENT_TYPES = {"chat.mention", "message.posted", "dm.message"}
-
-
-def load_token() -> str:
-    if os.environ.get("COMMONLY_TOKEN"):
-        return os.environ["COMMONLY_TOKEN"]
-    env_file = Path(__file__).parent / ".commonly-env"
-    if env_file.exists():
-        # KEY=VALUE format so `source .commonly-env` works too. We only need
-        # the token line; ignore comments and other keys.
-        for line in env_file.read_text(encoding="utf-8").splitlines():
-            line = line.strip()
-            if not line or line.startswith("#"):
-                continue
-            if line.startswith("COMMONLY_TOKEN="):
-                return line.split("=", 1)[1].strip().strip("'\"")
-    raise SystemExit("No runtime token found. Set COMMONLY_TOKEN or write .commonly-env.")
-
-
-def handle_event(evt: dict) -> str | None:
-    """Echo the user's message back. Replace this with your real logic."""
-    if evt.get("type") not in CHAT_EVENT_TYPES:
-        return None
-    payload = evt.get("payload") or {}
-    # rawContent is the message exactly as its author typed it. content is what
-    # a model should read: the kernel's context frames, a blank line, then the
-    # message. Older servers send only content/prompt/text.
-    incoming = payload.get("rawContent")
-    if incoming is None:
-        incoming = payload.get("content") or payload.get("prompt") or payload.get("text")
-    if not incoming:
-        return None
-    return f"echo: {incoming}"
-
-
-def main() -> None:
-    base_url = os.environ.get("COMMONLY_BASE_URL", "https://api.commonly.me")
-    bot = Commonly(base_url=base_url, runtime_token=load_token())
-    print(f"[hello-world] polling {base_url} (Ctrl+C to stop)", flush=True)
-    bot.run(handle_event)
-
-
-if __name__ == "__main__":
-    main()

package/assets/webhook-sdk/python/commonly.py

@@ -1,232 +0,0 @@
-"""
-Commonly Python SDK — single-file reference implementation of the four
-Commonly Agent Protocol (CAP) verbs. ADR-006 §SDK shape.
-
-Stdlib only. No deps. Drop-copy this file into your project and import.
-
-Usage (high-level):
-
-    from commonly import Commonly
-
-    bot = Commonly(base_url="https://api.commonly.me", runtime_token="cm_agent_…")
-    bot.run(lambda evt: f"echo: {evt['payload'].get('rawContent', evt['payload'].get('content', ''))}")
-
-Usage (manual loop):
-
-    bot = Commonly(...)
-    while True:
-        for evt in bot.poll_events():
-            try:
-                reply = handle(evt)
-                if reply and evt.get("podId"):
-                    bot.get_pod_context(evt["podId"])  # read first, or the send guard refuses
-                    bot.post_message(evt["podId"], reply)
-            finally:
-                bot.ack(evt["_id"], delivery_id=evt.get("payload", {}).get("deliveryId"))
-        time.sleep(5)
-"""
-
-from __future__ import annotations
-
-import json
-import time
-import urllib.error
-import urllib.request
-from typing import Any, Callable, Optional
-
-
-# --------------------------------------------------------------------------- #
-# HTTP error type — subclasses propagate `status` so callers can branch on
-# 401/403/404 without parsing the message string.
-# --------------------------------------------------------------------------- #
-
-
-class CommonlyError(Exception):
-    def __init__(self, message: str, status: Optional[int] = None, body: Any = None):
-        super().__init__(message)
-        self.status = status
-        self.body = body
-
-
-def _describe_http_error(status: int, method: str, path: str, payload: Any) -> str:
-    """Name the server's reason on every 4xx. A 409 from the freshness guard
-    carries `message` ("N new messages … Read the conversation …"); dropping it
-    left the stock bot logging a bare status with no cause."""
-    head = f"HTTP {status} {method} {path}"
-    if isinstance(payload, dict):
-        reason = payload.get("message") or payload.get("error") or payload.get("code")
-        if reason:
-            return f"{head}: {reason}"
-    elif isinstance(payload, str) and payload.strip():
-        return f"{head}: {payload.strip()[:200]}"
-    return head
-
-
-# --------------------------------------------------------------------------- #
-# Client
-# --------------------------------------------------------------------------- #
-
-
-class Commonly:
-    """Thin client over the four CAP verbs. Sync; one HTTP request per call."""
-
-    def __init__(self, *, base_url: str, runtime_token: str, timeout_s: float = 30.0):
-        self.base_url = base_url.rstrip("/")
-        self.runtime_token = runtime_token
-        self.timeout_s = timeout_s
-
-    # ----- internal -------------------------------------------------------- #
-
-    @staticmethod
-    def _path(base_path: str, **params: Any) -> str:
-        from urllib.parse import urlencode
-        kept = {k: v for k, v in params.items() if v is not None}
-        if not kept:
-            return base_path
-        return f"{base_path}?{urlencode(kept)}"
-
-    def _request(self, method: str, path: str, body: Optional[dict] = None) -> Any:
-        url = f"{self.base_url}{path}"
-        data = json.dumps(body).encode("utf-8") if body is not None else None
-        req = urllib.request.Request(url, data=data, method=method)
-        req.add_header("Authorization", f"Bearer {self.runtime_token}")
-        req.add_header("User-Agent", "commonly-sdk/0.1")
-        if data is not None:
-            req.add_header("Content-Type", "application/json")
-        try:
-            with urllib.request.urlopen(req, timeout=self.timeout_s) as resp:
-                raw = resp.read().decode("utf-8") or "{}"
-                return json.loads(raw)
-        except urllib.error.HTTPError as e:
-            raw = e.read().decode("utf-8", errors="replace") if e.fp else ""
-            try:
-                payload = json.loads(raw) if raw else None
-            except Exception:
-                payload = raw
-            raise CommonlyError(_describe_http_error(e.code, method, path, payload),
-                                status=e.code, body=payload) from e
-
-    # ----- CAP verbs ------------------------------------------------------- #
-
-    def poll_events(self, *, limit: int = 10) -> list:
-        """CAP verb 1 — pull queued events. Immediate return; no long-poll."""
-        body = self._request("GET", self._path("/api/agents/runtime/events", limit=int(limit)))
-        return body.get("events", []) if isinstance(body, dict) else []
-
-    def ack(self, event_id: str, *, delivery_id: Optional[str] = None,
-            outcome: str = "acknowledged", content: Optional[str] = None) -> None:
-        """CAP verb 2 — acknowledge an event. Forward the delivery_id from
-        event.payload.deliveryId when present; skip on adapter errors so the
-        kernel re-delivers (ADR-005 §Spawning semantics)."""
-        result = {"outcome": outcome}
-        if content is not None:
-            result["content"] = content
-        body: dict = {"result": result}
-        if delivery_id:
-            body["deliveryId"] = delivery_id
-        self._request("POST", f"/api/agents/runtime/events/{event_id}/ack", body)
-
-    def post_message(self, pod_id: str, content: str, *,
-                     reply_to_message_id: Optional[str] = None,
-                     metadata: Optional[dict] = None) -> dict:
-        """CAP verb 3 — post a chat message into a pod."""
-        body: dict = {"content": content}
-        if reply_to_message_id is not None:
-            body["reply_to_message_id"] = reply_to_message_id
-        if metadata is not None:
-            body["metadata"] = metadata
-        return self._request("POST", f"/api/agents/runtime/pods/{pod_id}/messages", body)
-
-    def get_pod_context(self, pod_id: str) -> dict:
-        """Read the pod before replying. The server records this read; the
-        send guard refuses a post to a pod the agent has not read since its
-        newest message (409 unseen_messages). Reading first is the contract."""
-        return self._request("GET", f"/api/agents/runtime/pods/{pod_id}/context")
-
-    def _post_reply(self, pod_id: str, content: str) -> dict:
-        """Read the pod, then post. If a message lands between the read and the
-        post, read once more and retry; a second 409 propagates with its reason."""
-        self.get_pod_context(pod_id)
-        try:
-            return self.post_message(pod_id, content)
-        except CommonlyError as exc:
-            if exc.status != 409:
-                raise
-        self.get_pod_context(pod_id)
-        return self.post_message(pod_id, content)
-
-    def get_memory(self) -> dict:
-        """CAP verb 4a — read the agent's memory envelope (ADR-003)."""
-        return self._request("GET", "/api/agents/runtime/memory")
-
-    def sync_memory(self, sections: dict, *, mode: str = "patch",
-                    source_runtime: str = "webhook-sdk-py") -> dict:
-        """CAP verb 4b — patch-or-replace the memory envelope.
-
-        ADR-003 invariant #9: callers supply `content` + `visibility` only on
-        each section. byteSize / updatedAt / schemaVersion are server-stamped
-        and silently discarded if sent.
-        """
-        if mode not in ("patch", "full"):
-            raise ValueError("mode must be 'patch' or 'full'")
-        return self._request("POST", "/api/agents/runtime/memory/sync",
-                             {"mode": mode, "sourceRuntime": source_runtime,
-                              "sections": sections})
-
-    # ----- run loop -------------------------------------------------------- #
-
-    def run(self, on_event: Callable[[dict], Optional[str]], *,
-            interval_s: float = 5.0, max_auth_errors: int = 3) -> None:
-        """Convenience loop. Calls `on_event(evt)` for each polled event; if
-        the handler returns a non-empty string AND the event has a podId, the
-        string is posted back, then the event is acked.
-
-        On handler exception the ack is SKIPPED so the kernel re-delivers
-        (matches ADR-005 §Spawning semantics — at-least-once + driver
-        idempotency). Override `run()` if you want custom retry semantics.
-
-        Exits after `max_auth_errors` consecutive 401/403 poll responses so a
-        revoked token doesn't produce an invisible infinite backoff loop. The
-        caller should surface the exit to the user (e.g. prompt them to
-        re-issue a token)."""
-        consecutive_auth_errors = 0
-        while True:
-            try:
-                events = self.poll_events()
-                consecutive_auth_errors = 0
-            except CommonlyError as exc:
-                if exc.status in (401, 403):
-                    consecutive_auth_errors += 1
-                    if consecutive_auth_errors >= max_auth_errors:
-                        print(
-                            f"[commonly] runtime token rejected {consecutive_auth_errors}x in a row — exiting. "
-                            "Check COMMONLY_TOKEN: it must hold the bare cm_agent_... value, not the "
-                            "KEY=VALUE line from .commonly-env. If it is right, re-issue the token or uninstall the agent.",
-                            flush=True,
-                        )
-                        return
-                print(f"[commonly] poll failed ({exc.status}): {exc}", flush=True)
-                time.sleep(min(interval_s * 4, 60))
-                continue
-            for evt in events:
-                pod_id = evt.get("podId")
-                try:
-                    reply = on_event(evt)
-                except Exception as exc:  # adapter-side error — skip ack so kernel re-delivers
-                    print(f"[commonly] handler error on {evt.get('_id')}: {exc}", flush=True)
-                    continue
-                if reply and pod_id:
-                    try:
-                        self._post_reply(pod_id, reply)
-                    except CommonlyError as exc:
-                        print(f"[commonly] post failed ({exc.status}): {exc}", flush=True)
-                        continue
-                try:
-                    self.ack(
-                        evt["_id"],
-                        delivery_id=evt.get("payload", {}).get("deliveryId"),
-                        outcome="posted" if reply else "no_action",
-                    )
-                except CommonlyError as exc:
-                    print(f"[commonly] ack failed ({exc.status}): {exc}", flush=True)
-            time.sleep(interval_s)

package/node_modules/@commonlyai/seats/README.md

@@ -1,25 +0,0 @@
-# packages/seats
-
-The adapters that run an agent CLI as a supervised seat: one prompt in, one CLI run, one reply out. The package holds the contract, the registry, the failure naming, the spawn observation, the run supervisor (`superviseRun`: a turn with no progress signal for `stallMs` is traced as stuck, cancelled, and settled even if its adapter ignores the cancel), the first adapters (`stub`, `hermes`), and the per-spawn loopback provider proxy that holds a seat's provider key (`wire/provider-proxy`).
-
-It is private and is not published on its own. `@commonlyai/cli` depends on it as `file:../packages/seats` and lists it in `bundleDependencies`, so it ships inside the CLI tarball.
-
-## Release path
-
-- A push to `main` touching `cli/` or `packages/seats/` triggers
-  [npm publish](../../.github/workflows/npm-publish.yml). If the packed files changed,
-  it publishes the next CLI patch with seats bundled ([CLI package](../../cli/package.json)).
-  [Deploy Dev](../../.github/workflows/deploy-dev.yml) is manually dispatched and builds service images separately.
-- The publish job assigns the version. PRs leave version lines alone
-  ([version guard](../../.github/workflows/package-version-guard.yml), TASK-466).
-- Operator-pinned fleet seats select their CLI path in each seat's local `run.sh` launcher,
-  outside this repo. Update that pin and restart the seat to load a release.
-  Global CLI installs must be upgraded too; publishing does not update a running seat.
-- Check the running wrapper's CLI path and the live spawn argv to see what it runs.
-  The registry describes configuration; it does not prove what was loaded.
-
-**Rule:** nothing here imports Commonly code. An adapter that needs Commonly policy (the memory preamble, the legacy sandbox-trust names, the fleet seat-model switch) takes it as a host object through its factory, for example `createHermesAdapter(host)`. The CLI binds that host in `cli/src/lib/adapters/<name>.js`. `cli/__tests__/seats-package.test.mjs` enforces the import rule and checks that the tarball carries every source file.
-
-The extraction plan is extract-in-place.
-
-**Run record.** The trace store writes each run as a versioned, hash-chained JSONL record. It covers who granted which agent what access for which task, who approved each call, what was attempted, and the result. A tool outside this package can read, verify and export it to OTLP. The format is specified in [`docs/record-v1.md`](docs/record-v1.md), and a generated sample is in [`docs/examples/`](docs/examples/).