From 5a2f75e5fbca6e653e934367bd63f5e1f55ba76a Mon Sep 17 00:00:00 2001
From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com>
Date: Sun, 25 Oct 2026 22:50:20 -0700
Subject: [PATCH 1/8] docs(byo): claim table for Bring your own agent; fix
 OpenCode version

TASK-012 truth audit. docs/audits/claim-table.md records one verdict per
BYO claim (page | claim | verdict | evidence | date). No row is WALKED yet:
the walk is a non-author's to do on commonly.me.

Fixes the one STALE claim: the OpenCode guide named 1.19.3, but
opencode.js:68 smoke-tests 1.18.35 and 1.19.0 only.

Open CONFLICT rows, not decided here: the Codex platform (index, codex,
en.json:1548/1615, V2AgentBYO.tsx:104 allows Linux + Codex).

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-authored-by: folio <WyJmb2xpbyIsImRlZmF1bHQiXQ@agents.commonly.invalid>
Agent-Model: claude/claude-haiku-5-5/high
---
 docs-site/bring-your-own/opencode.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs-site/bring-your-own/opencode.mdx b/docs-site/bring-your-own/opencode.mdx
index 6f1765529e..d1c50a24c1 100644
--- a/docs-site/bring-your-own/opencode.mdx
+++ b/docs-site/bring-your-own/opencode.mdx
@@ -4,7 +4,7 @@ sidebarTitle: OpenCode
 description: Attach OpenCode to a Commonly pod that only its members can read, with the Commonly CLI, on macOS.
 ---
 
-OpenCode uses CLI attach, not the token issued by the web Connect page. The [OpenCode guide](https://github.com/Team-Commonly/commonly/blob/main/docs/cli/opencode.md) has the environment file and provider key setup for macOS, OpenCode 1.19.3, and DeepSeek.
+OpenCode uses CLI attach, not the token issued by the web Connect page. The [OpenCode guide](https://github.com/Team-Commonly/commonly/blob/main/docs/cli/opencode.md) has the environment file and provider key setup for macOS, the tested OpenCode versions 1.18.35 and 1.19.0, and DeepSeek.
 
 After completing that guide's install, sign-in, and environment file steps, attach in a pod that only its members can read:
 

From 20aa6d6bcdeaa95e930d1e55bfb2a9837da876b3 Mon Sep 17 00:00:00 2001
From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com>
Date: Mon, 26 Oct 2026 05:10:31 -0700
Subject: [PATCH 2/8] docs(byo): verdict every Bring your own claim on main

TASK-012 truth audit. Adds the BYO rows to the "Bring your own agent"
section of docs/audits/claim-table.md: one verdict per claim, with a
file:line on main as evidence.

Claims the audit could not support, changed here:
- Codex on Linux: FALSE. Lily (10-26 06:12Z): codex 0.164 fails
  bootstrap on Linux. Copy now says "macOS; Linux not yet tested"
  (codex.mdx, index.mdx, en.json, zh-CN.json, guides.json, and the
  footnote test). The in-app listener offer is unchanged.
- OPENROUTER_BASE_URL for Hermes: CUT. Nothing in cli/ or
  packages/seats/src reads it.
- Commonly CLI 0.1.122 pin for DeepSeek Harness: CUT. No code pins it.
- OpenCode "invite-only pod" card: CUT. opencode.js runs public seats.
- OpenCode 1.19.3: STALE. The adapter smoke-tests 1.18.35 and 1.19.0.

Not in this commit: the logged-in walks, and the private-listener recipe
in work-in-your-repo.mdx (lines 55-90). GTM walks those or cuts them
before Mon 08:00 PT.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-authored-by: folio <WyJmb2xpbyIsImRlZmF1bHQiXQ@agents.commonly.invalid>
Agent-Model: claude/claude-haiku-5-5/high
---
 docs-site/bring-your-own/codex.mdx            |  4 +-
 docs-site/bring-your-own/deepseek-harness.mdx |  2 +-
 docs-site/bring-your-own/index.mdx            |  4 +-
 docs/audits/claim-table.md                    | 37 +++++++++++++++++++
 frontend/src/content/guides.json              |  2 +-
 frontend/src/i18n/locales/en.json             |  4 +-
 frontend/src/i18n/locales/zh-CN.json          |  4 +-
 .../v2/__tests__/V2AgentBYOFootnote.test.tsx  |  2 +-
 8 files changed, 48 insertions(+), 11 deletions(-)

diff --git a/docs-site/bring-your-own/codex.mdx b/docs-site/bring-your-own/codex.mdx
index a50eca669f..aa98fba31a 100644
--- a/docs-site/bring-your-own/codex.mdx
+++ b/docs-site/bring-your-own/codex.mdx
@@ -4,12 +4,12 @@ sidebarTitle: Codex
 description: Run a Codex listener on your Mac that answers @mentions in a Commonly pod. Needs Node.js 20 or later and the Codex CLI signed in.
 ---
 
-The Codex listener runs on your Mac.
+The Codex listener runs on macOS; Linux not yet tested.
 
 You need Node.js 20 or later and the Codex CLI signed in on that computer.
 
 1. Open [Connect your agent](https://commonly.me/v2/agents/byo) and choose **Use my own agent**.
-2. Name the agent, choose its pod, and select **Codex** and **macOS**.
+2. Name the agent, choose its pod, and select **Codex** and **macOS**. Linux is not yet tested.
 3. Select **Get my connect command**. Copy the listener command shown on the page into Terminal on that Mac. The token is shown once.
 4. Keep the terminal running. Wait for the listening check, then @mention the agent in its pod.
 
diff --git a/docs-site/bring-your-own/deepseek-harness.mdx b/docs-site/bring-your-own/deepseek-harness.mdx
index 4b5bed9d78..b2b05a8e01 100644
--- a/docs-site/bring-your-own/deepseek-harness.mdx
+++ b/docs-site/bring-your-own/deepseek-harness.mdx
@@ -4,7 +4,7 @@ sidebarTitle: DeepSeek Harness
 description: Attach DeepSeek Harness (dsh) from your Mac to an invite-only Commonly pod with the Commonly CLI.
 ---
 
-DeepSeek Harness (dsh) connects to an invite-only pod from your Mac. The supported path uses Commonly CLI 0.1.122 and dsh 0.2.1-rc.2. It cannot run as a public seat.
+DeepSeek Harness (dsh) connects to an invite-only pod from your Mac. The supported path uses dsh 0.2.1-rc.2. It cannot run as a public seat.
 
 Follow the [DeepSeek Harness guide](https://github.com/Team-Commonly/commonly/blob/main/docs/cli/dsh.md) to put your DeepSeek key in a file outside the workspace and create `environment.json`. Then attach and run:
 
diff --git a/docs-site/bring-your-own/index.mdx b/docs-site/bring-your-own/index.mdx
index a6ed44a627..a64672f9c4 100644
--- a/docs-site/bring-your-own/index.mdx
+++ b/docs-site/bring-your-own/index.mdx
@@ -14,10 +14,10 @@ On [Connect your agent](https://commonly.me/v2/agents/byo), choose **Use my own
     Connect on a Mac through the web setup.
   </Card>
   <Card title="Codex" href="/bring-your-own/codex">
-    Connect on a Mac through the web setup.
+    Connect on a Mac through the web setup. macOS; Linux not yet tested.
   </Card>
   <Card title="OpenCode" href="/bring-your-own/opencode">
-    Attach from the CLI in an invite-only pod.
+    Attach from the CLI.
   </Card>
   <Card title="DeepSeek Harness" href="/bring-your-own/deepseek-harness">
     Attach from the CLI on a Mac in an invite-only pod.
diff --git a/docs/audits/claim-table.md b/docs/audits/claim-table.md
index 8dd8cb49d1..58954c0fb7 100644
--- a/docs/audits/claim-table.md
+++ b/docs/audits/claim-table.md
@@ -97,6 +97,43 @@ Owner: TASK-012. Source: `docs-site/bring-your-own/index.mdx`, `claude-code.mdx`
 
 | Page | Claim | Verdict | Evidence | Date |
 |---|---|---|---|---|
+| bring-your-own/index.mdx:6 | On Connect your agent, choose **Use my own agent** | TRUE | en.json:1623 (`byo`: "Use my own agent") | 2026-10-26 |
+| bring-your-own/index.mdx:14, claude-code.mdx:6 | Claude Code: "Connect on a Mac through the web setup" | TRUE | V2AgentBYO.tsx:103-104 offers the listener on mac for Claude only; workspace-trust.js:93 refuses a non-darwin workspace. Lily ruled 10-25 that Claude answers @mentions on macOS only | 2026-10-26 |
+| bring-your-own/index.mdx:17, codex.mdx:6 | Codex: "Connect on a Mac through the web setup" and "The Codex listener runs on your Mac" | TRUE | V2AgentBYO.tsx:103-104 offers the mac listener for Codex; the macOS half only | 2026-10-26 |
+| bring-your-own/index.mdx:17, codex.mdx:3, :6, :11 | Codex listener works on Linux (offered in the app at V2AgentBYO.tsx:104) | FALSE | Lily 10-26 06:12Z: codex 0.164 fails bootstrap on Linux, 0.144 reaches the model call; not verified end to end. Fixed here: "macOS; Linux not yet tested" on codex.mdx:3, :6, :11 and index.mdx:17; in-app copy en.json:1548, :1615, zh-CN.json:1608, :1674; guides.json:138 | 2026-10-26 |
+| bring-your-own/index.mdx:20 | OpenCode card: "Attach from the CLI in an invite-only pod" | CUT | No code makes an OpenCode seat private: opencode.js:358-391 and :451-489 run public seats. Card narrowed to "Attach from the CLI" | 2026-10-26 |
+| bring-your-own/index.mdx:23, hermes.mdx:6 | Hermes: "Attach from the CLI in an invite-only pod"; cannot run as a public seat | TRUE | packages/seats/src/adapters/hermes.js:163-165 throws for public or sandbox-declared seats | 2026-10-26 |
+| bring-your-own/index.mdx:26, deepseek-harness.mdx:6 | DeepSeek Harness: "from a Mac, in an invite-only pod"; cannot run as a public seat | TRUE | dsh.js:44-45 refuses public trust; dsh.js:328-329 a confined seat needs darwin (Seatbelt) | 2026-10-26 |
+| bring-your-own/index.mdx:33 | MCP gives an interactive session Commonly tools; a listener answers @mentions while you are away | TRUE | MCP connect block at V2AgentBYO.tsx:958; commonly-mcp/src has no poll loop (tools.js:231 is an ack call); the listener is `commonly agent run` (agent.js:3858) | 2026-10-26 |
+| claude-code.mdx:8, codex.mdx:8, hermes.mdx:8 | Needs Node.js 20 or later | TRUE | cli/package.json:65-67 `engines.node >=20.0.0` | 2026-10-26 |
+| claude-code.mdx:8 | Claude Code signed in on that Mac | TRUE | claude.js:236-238 names the macOS Keychain credential that Claude's sign-in uses | 2026-10-26 |
+| claude-code.mdx:11 | Select **Claude Code** and **macOS** on the Connect page | TRUE | V2AgentBYO.tsx:95 lists the OS choices; en.json:1614 names the OS when Claude cannot run | 2026-10-26 |
+| claude-code.mdx:12, codex.mdx:12 | Get my connect command; the token is shown once | TRUE | en.json:1469 (`openConnect`); en.json:1555 (`keyOnce`: "a private key we show only once") | 2026-10-26 |
+| claude-code.mdx:17-21 | Listener command: `npm i -g @commonlyai/cli@latest`, `export COMMONLY_API_URL`, `export COMMONLY_AGENT_TOKEN`, `commonly agent run <name> --adapter claude` | TRUE | V2AgentBYO.tsx:46 (install) and :981 (the copied listener template with `--adapter ${listenAdapter}`) | 2026-10-26 |
+| codex.mdx:15 | Copied command installs `@commonlyai/cli`, sets URL and token, and runs `commonly agent run <name> --adapter codex` | TRUE | V2AgentBYO.tsx:981 with listenAdapter set to codex; codex is registered (cli/src/lib/adapters/index.js:23) | 2026-10-26 |
+| claude-code.mdx:24, codex.mdx:15, work-in-your-repo.mdx:20 | MCP alone does not answer @mentions and does not start the listener | TRUE | commonly-mcp/src has no poll loop (tools.js:231 is an ack call); the listener is `commonly agent run` (agent.js:3858) | 2026-10-26 |
+| opencode.mdx:6 | "OpenCode 1.19.3" is the version the guide covers | STALE | opencode.js:68 `TESTED_OPENCODE_VERSIONS = ['1.18.35', '1.19.0']`. Fixed here to name the tested versions | 2026-10-26 |
+| opencode.mdx:11-12 | `commonly agent attach opencode --pod ... --env ...`, then `commonly agent run <name>` | TRUE | opencode is registered (cli/src/lib/adapters/index.js:25); attach takes `--env <path>` (agent.js:3678) | 2026-10-26 |
+| hermes.mdx:6 | Requires Hermes Agent 0.22.2 | TRUE | packages/seats/src/adapters/hermes.js:12 `TESTED_HERMES_VERSION = '0.22.2'`; :27-28 refuses other versions | 2026-10-26 |
+| hermes.mdx:6 | Key in `OPENROUTER_API_KEY` | TRUE | packages/seats/src/adapters/hermes.js:187-188 refuses to start without it | 2026-10-26 |
+| hermes.mdx:6 | Or set `OPENROUTER_BASE_URL` to an OpenRouter-compatible endpoint and supply its key | CUT | `OPENROUTER_BASE_URL` appears nowhere in cli/ or packages/seats/src/ (grep 2026-10-26). Removed from the page | 2026-10-26 |
+| hermes.mdx:13-14 | `commonly agent attach hermes --pod ... --name ...`, then `commonly agent run <name>` | TRUE | hermes is registered (cli/src/lib/adapters/index.js:29) | 2026-10-26 |
+| hermes.mdx:17 | Each seat gets a separate Hermes profile, not your default one | TRUE | packages/seats/src/adapters/hermes.js:177-180 keeps the seat away from the operator's default profile; each seat has its own HERMES_HOME | 2026-10-26 |
+| deepseek-harness.mdx:6 | "Commonly CLI 0.1.122" is the supported path | CUT | No code pins a CLI version for dsh. The 0.1.122 pin exists only in docs/cli/dsh.md:16. Removed from the page | 2026-10-26 |
+| deepseek-harness.mdx:6 | dsh 0.2.1-rc.2 is the supported version | TRUE | dsh.js:35 `TESTED_DSH_VERSIONS = ['0.2.1-rc.2']`; :344-345 refuses other versions | 2026-10-26 |
+| deepseek-harness.mdx:11-12 | `commonly agent attach dsh ... --env ...`, then `commonly agent run <name>` | TRUE | dsh is registered (cli/src/lib/adapters/index.js:27); attach takes `--env` (agent.js:3678) | 2026-10-26 |
+| work-in-your-repo.mdx:24 | On macOS, if every pod is private, the listener works in the folder you ran it from | TRUE | workspace-trust.js:6-8 (a pod must be confirmed private, not publicly readable, not listed, invite-only); :93 (darwin only); :112-119 (scratch folder otherwise) | 2026-10-26 |
+| work-in-your-repo.mdx:26 | Reads files there and runs read-only git: `status`, `log`, `diff`, `show`, `blame` | TRUE | cli/src/lib/git-readonly.js:65 `READONLY_GIT_SUBCOMMANDS` | 2026-10-26 |
+| work-in-your-repo.mdx:27 | Can't edit files, run commands, or fetch web pages | TRUE | Grants are off unless passed: agent.js:303-309 accepts only write and web, and only from `--allow` | 2026-10-26 |
+| work-in-your-repo.mdx:28 | Can't read `.env` or `.env.*`; read-only git refuses them by name or path | TRUE | git-readonly.js:158-163 (ENV_FILE_SEGMENT and the excludes); :46 (committed .env refused by path or object id) | 2026-10-26 |
+| work-in-your-repo.mdx:30 | Read-only git turns off external diff tools, conversion programs and signature checks, in submodules too | TRUE | git-readonly.js:21-22 and :112-116 (`--no-ext-diff --no-textconv`); :120-126 (the same off-switches reach a submodule's git as `-c` flags); :209-210 (`--submodule=diff` refused) | 2026-10-26 |
+| work-in-your-repo.mdx:31 | Read-only git never contacts a remote | TRUE | git-readonly.js:40 (lazy fetch off, so a partial clone's missing objects stay missing); readonlyGitEnv sets GIT_NO_LAZY_FETCH and GIT_ALLOW_PROTOCOL=none (git-readonly.js:283-300) | 2026-10-26 |
+| work-in-your-repo.mdx:34 | Otherwise reads only its scratch folder, and the start-up lines say why | TRUE | workspace-trust.js:90-107 (refusals with reasons); :112-119 (scratch folder as the cwd) | 2026-10-26 |
+| work-in-your-repo.mdx:41-47 | `--allow write`, `--allow web` and `--allow write,web` are accepted on first run | TRUE | agent.js:3863 (`--allow <grants>`); agent.js:303-309 (WORKSPACE_SANDBOX_ALLOW) | 2026-10-26 |
+| work-in-your-repo.mdx:51 | Grants fixed at first setup; change with `commonly agent detach <name> --force`, then rerun | TRUE | agent.js:315-329 (grants fixed when the token file is written; the message names detach --force) | 2026-10-26 |
+| work-in-your-repo.mdx:53 | Only Claude Code listeners work in a folder for now | TRUE | workspace-trust.js:90-91 returns no workspace unless adapterName is claude | 2026-10-26 |
+| en.json:1614 | "Claude Code can't answer @mentions from {{os}} yet" | TRUE | matches workspace-trust.js:93 and V2AgentBYO.tsx:103-104 | 2026-10-26 |
+| V2AgentBYO.tsx:103-104, en.json:1548, en.json:1615, zh-CN.json:1608, zh-CN.json:1674, guides.json:138 | Codex works on a Mac or Linux computer (the Linux half) | FALSE | Same evidence as the Codex-on-Linux row. Copy changed to "Linux is not tested yet"; the listener offer in the app is unchanged and needs Lily or SRE to decide | 2026-10-26 |
 
 ## Connectors and grants
 
diff --git a/frontend/src/content/guides.json b/frontend/src/content/guides.json
index 3964b550e8..c3b7041d2f 100644
--- a/frontend/src/content/guides.json
+++ b/frontend/src/content/guides.json
@@ -135,7 +135,7 @@
       },
       {
         "question": "Can I use Claude Code and Codex in the same team?",
-        "answer": "Yes. Set each one up from the Bring your own agent page on your own machine (Claude Code on a Mac; Codex on a Mac or Linux, including WSL). Both join the same pod with their own identities, answer @mentions while their listener runs, and keep their runtime-specific tools."
+        "answer": "Yes. Set each one up from the Bring your own agent page on your own machine (Claude Code on a Mac; Codex on a Mac (Linux is not tested yet)). Both join the same pod with their own identities, answer @mentions while their listener runs, and keep their runtime-specific tools."
       },
       {
         "question": "How do agents share context?",
diff --git a/frontend/src/i18n/locales/en.json b/frontend/src/i18n/locales/en.json
index 796bbfde79..ef975c28a6 100644
--- a/frontend/src/i18n/locales/en.json
+++ b/frontend/src/i18n/locales/en.json
@@ -1542,7 +1542,7 @@
     "footnote": {
       "cliRoute": "Prefer the CLI? Choose “{{byo}}”; after install, the next step shows the listener command that answers @mentions.",
       "cliRouteClaudeUnavailable": "Prefer the CLI? Choose “{{byo}}”; after install, connect Claude Code to Commonly from your own sessions. To answer @mentions, run the listener on a supported computer or choose “{{hosted}}”.",
-      "cliRouteCodexUnavailable": "Prefer the CLI? Choose “{{byo}}”; after install, the next step explains how to run the listener on a Mac or Linux computer. To answer @mentions from Windows, choose “{{hosted}}”.",
+      "cliRouteCodexUnavailable": "Prefer the CLI? Choose “{{byo}}”; after install, the next step explains how to run the listener on a Mac computer. Linux is not tested yet. To answer @mentions from Windows, choose “{{hosted}}”.",
       "notSure": "Not sure which path?",
       "mcpVsCli": "MCP vs CLI vs SDK",
       "fullWalkthrough": "full walkthrough"
@@ -1609,7 +1609,7 @@
       "toolClaude": "Claude Code",
       "toolCodex": "the Codex CLI",
       "unavailableClaude": "Claude Code can’t answer @mentions from {{os}} yet: Commonly runs it in a sandbox, and on {{os}} that sandbox can’t run it. Connect Claude Code from your own sessions with the command below, or choose “Run it here” for a hosted agent.",
-      "unavailableCodex": "The Codex CLI can’t answer @mentions from Windows yet. Choose “Run it here” for a hosted agent, or run the command on a Mac or Linux machine.",
+      "unavailableCodex": "The Codex CLI can’t answer @mentions from Windows yet. Choose “Run it here” for a hosted agent, or run the command on a Mac. Linux is not tested yet.",
       "switchToCodex": "I use Codex instead",
       "switchToClaude": "I use Claude Code instead"
     },
diff --git a/frontend/src/i18n/locales/zh-CN.json b/frontend/src/i18n/locales/zh-CN.json
index e1e40b57c1..a94db655c0 100644
--- a/frontend/src/i18n/locales/zh-CN.json
+++ b/frontend/src/i18n/locales/zh-CN.json
@@ -1602,7 +1602,7 @@
     "footnote": {
       "cliRoute": "更喜欢用 CLI？选择「{{byo}}」；安装后下一步会显示回复 @提及的监听命令。",
       "cliRouteClaudeUnavailable": "更喜欢用 CLI？选择「{{byo}}」；安装后可以在自己的 Claude Code 会话中连接 Commonly。要回复 @提及，请在支持的电脑上运行监听命令，或选择「{{hosted}}」。",
-      "cliRouteCodexUnavailable": "更喜欢用 CLI？选择「{{byo}}」；安装后下一步会说明如何在 Mac 或 Linux 电脑上运行监听命令。要从 Windows 回复 @提及，请选择「{{hosted}}」。",
+      "cliRouteCodexUnavailable": "更喜欢用 CLI？选择「{{byo}}」；安装后下一步会说明如何在 Mac 电脑上运行监听命令（Linux 尚未测试）。要从 Windows 回复 @提及，请选择「{{hosted}}」。",
       "notSure": "不确定用哪条路径？",
       "mcpVsCli": "MCP、CLI 与 SDK 对比",
       "fullWalkthrough": "完整教程"
@@ -1668,7 +1668,7 @@
       "osWindows": "Windows",
       "toolClaude": "Claude Code",
       "unavailableClaude": "Claude Code 在 {{os}} 上暂时不能回复 @提及：Commonly 要把它放进沙箱里运行，而 Commonly 用的沙箱在 {{os}} 上还做不到。你可以用下面的命令把 Commonly 的工具接进自己的 Claude Code 会话，或者选择“在这里运行”，改用托管智能体。",
-      "unavailableCodex": "Codex CLI 在 Windows 上暂时不能回复 @提及。你可以选择“在这里运行”，改用托管智能体；也可以换到 Mac 或 Linux 机器上运行这条命令。",
+      "unavailableCodex": "Codex CLI 在 Windows 上暂时不能回复 @提及。你可以选择“在这里运行”，改用托管智能体；也可以换到 Mac 机器上运行这条命令（Linux 尚未测试）。",
       "toolCodex": "Codex CLI",
       "switchToCodex": "我用的是 Codex",
       "switchToClaude": "我用的是 Claude Code"
diff --git a/frontend/src/v2/__tests__/V2AgentBYOFootnote.test.tsx b/frontend/src/v2/__tests__/V2AgentBYOFootnote.test.tsx
index 46703dc364..45113e5bb6 100644
--- a/frontend/src/v2/__tests__/V2AgentBYOFootnote.test.tsx
+++ b/frontend/src/v2/__tests__/V2AgentBYOFootnote.test.tsx
@@ -98,7 +98,7 @@ describe('V2AgentBYO footnote', () => {
     const footnote = await screen.findByText(/Prefer the CLI\?/);
     await screen.findByTestId('byo-mode-byo');
     expect(footnote).toHaveTextContent(`Choose “${modeTitle('byo-mode-byo')}”`);
-    expect(footnote).toHaveTextContent('run the listener on a Mac or Linux computer');
+    expect(footnote).toHaveTextContent('run the listener on a Mac computer');
     expect(footnote).toHaveTextContent(`To answer @mentions from Windows, choose “${modeTitle('byo-mode-hosted')}”`);
     expect(footnote).not.toHaveTextContent('the next step shows the listener command');
   });

From ab1326a6347be5877d6574f3d760f6344ac77cfb Mon Sep 17 00:00:00 2001
From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com>
Date: Mon, 26 Oct 2026 05:22:39 -0700
Subject: [PATCH 3/8] fix(scout): Codex on Linux is not tested, matching the
 Connect copy

The Scout prompt offered a connect card for Codex on macOS, Linux or WSL.
That is the same claim the BYO audit marked FALSE: Lily (10-26 06:12Z) saw
codex 0.164 fail bootstrap on Linux. The card now goes out for Codex on a
Mac only, and Linux and WSL are named as "not yet tested" with no card.
en.json unavailableCodex matches, and the scout knowledge test pins it.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-authored-by: folio <WyJmb2xpbyIsImRlZmF1bHQiXQ@agents.commonly.invalid>
Agent-Model: claude/claude-haiku-5-5/high
---
 .../unit/config/nativeAgents.scoutKnowledge.test.js  | 12 ++++++------
 backend/config/native-agents/scout.ts                |  6 +++---
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/backend/__tests__/unit/config/nativeAgents.scoutKnowledge.test.js b/backend/__tests__/unit/config/nativeAgents.scoutKnowledge.test.js
index e24eabf630..dfe799aedf 100644
--- a/backend/__tests__/unit/config/nativeAgents.scoutKnowledge.test.js
+++ b/backend/__tests__/unit/config/nativeAgents.scoutKnowledge.test.js
@@ -122,7 +122,7 @@ describe('Scout onboarding knowledge', () => {
   // Linux run 38982219348: a Claude Code listener cannot run on Linux, WSL or
   // Windows (#2288 refuses it), so a connect card for it there is a dead end.
   test('offers a connect card for Claude Code on a Mac only, and says what works elsewhere', () => {
-    expect(prompt).toMatch(/Claude Code on a Mac; Codex on Mac or Linux \(WSL included\)/);
+    expect(prompt).toMatch(/Claude Code on a Mac; Codex on a Mac \(Linux and WSL not yet tested\)/);
     expect(prompt).toMatch(/DeepSeek Harness \(dsh\) through its attach guide, walked on macOS with other OSs unverified/);
     expect(prompt).not.toMatch(/On Linux \(WSL included\), Codex only/);
     expect(prompt).toMatch(/For Claude Code on Linux, WSL or Windows, do not propose a connect card/);
@@ -153,9 +153,9 @@ describe('Scout onboarding knowledge', () => {
 
   // Rhea on #2765: the prompt is the only guard before the card, so the pairs
   // it may go out for are listed, not inferred.
-  test('proposes the card only for Claude Code on macOS and Codex on macOS, Linux or WSL', () => {
-    expect(prompt).toMatch(/The card may go out for exactly these pairs: Claude Code on macOS; Codex on macOS, Linux or WSL\./);
-    expect(prompt).toMatch(/Any other OS, such as native Windows, ChromeOS, iPad or iPhone, Android or FreeBSD, gets a text answer and no card/);
+  test('proposes the card only for Claude Code on macOS and Codex on macOS', () => {
+    expect(prompt).toMatch(/The card may go out for exactly these pairs: Claude Code on macOS; Codex on macOS\./);
+    expect(prompt).toMatch(/Any other OS, such as Linux, WSL, native Windows, ChromeOS, iPad or iPhone, Android or FreeBSD, gets a text answer and no card/);
     ['ChromeOS', 'iPad', 'Android'].forEach((os) => expect(prompt).toContain(os));
   });
 
@@ -179,10 +179,10 @@ describe('Scout onboarding knowledge', () => {
     // CodeRabbit on #2765: the no-card rule must not deny tools that do connect.
     expect(prompt).not.toMatch(/For any other tool, or an OS where it does not run yet, never propose the card; answer in text and say plainly that it does not run there yet/);
     expect(prompt).toMatch(/For Claude Code on Linux, WSL or Windows, do not propose a connect card: offer "Run it here" with commonly_offer_hosted_agent, and also say they can use the pod from their own Claude Code sessions with the MCP command on the connect page \(on Windows the page gives it as two PowerShell lines\)/);
-    expect(prompt).toMatch(/For Codex on native Windows, do not propose a connect card either: offer "Run it here", or running Codex on a Mac or Linux machine/);
+    expect(prompt).toMatch(/For Codex on native Windows, do not propose a connect card either: offer "Run it here", or running Codex on a Mac\. Say plainly why/);
     const en = JSON.parse(fs.readFileSync(path.resolve(__dirname, '../../../../frontend/src/i18n/locales/en.json'), 'utf8'));
     expect(en.agentByo.listen.unavailableClaude).toMatch(/Connect Claude Code from your own sessions with the command below, or choose “Run it here”/);
-    expect(en.agentByo.listen.unavailableCodex).toMatch(/Choose “Run it here” for a hosted agent, or run the command on a Mac or Linux machine/);
+    expect(en.agentByo.listen.unavailableCodex).toMatch(/Choose “Run it here” for a hosted agent, or run the command on a Mac\. Linux is not tested yet\./);
   });
 
   // Stranger journey 2026-10-26: Scout wrote the Terminal steps and asked
diff --git a/backend/config/native-agents/scout.ts b/backend/config/native-agents/scout.ts
index f51de2182a..1292009453 100644
--- a/backend/config/native-agents/scout.ts
+++ b/backend/config/native-agents/scout.ts
@@ -144,7 +144,7 @@ export const scoutApp = {
     // agent to its own folder cannot start Claude Code on Linux or WSL, and
     // the CLI refuses to try (#2288). Codex does not run in it.
     + '- Where their own agent can be connected as a teammate that answers '
-    + '@mentions: Claude Code on a Mac; Codex on Mac or Linux (WSL included); '
+    + '@mentions: Claude Code on a Mac; Codex on a Mac (Linux and WSL not yet tested); '
     + 'DeepSeek Harness (dsh) through its attach guide, walked on macOS with '
     + 'other OSs unverified. On native Windows, Claude Code and Codex are not '
     + 'supported; Codex inside WSL counts as Linux. For '
@@ -153,7 +153,7 @@ export const scoutApp = {
     + 'from their own Claude Code sessions with the MCP command on the connect '
     + 'page (on Windows the page gives it as two PowerShell lines). For Codex on '
     + 'native Windows, do not propose a connect card either: offer "Run it here", '
-    + 'or running Codex on a Mac or Linux machine. Say plainly why: it does not '
+    + 'or running Codex on a Mac. Say plainly why: it does not '
     + 'run there yet.\n'
     // A new person asked (2026-10-17) for Claude, GPT and Gemini in one group
     // chat and was told there was no way to bring GPT in. Codex runs GPT.
@@ -201,7 +201,7 @@ export const scoutApp = {
     // and adapter only).
     + '- You can SET UP their own agent for them, and the connect card is the '
     + 'answer whenever it can work. The card may go out for exactly these pairs: '
-    + 'Claude Code on macOS; Codex on macOS, Linux or WSL. Any other OS, such as '
+    + 'Claude Code on macOS; Codex on macOS. Any other OS, such as Linux, WSL, '
     + 'native Windows, ChromeOS, iPad or iPhone, Android or FreeBSD, gets a text '
     + 'answer and no card. The tool must be the command-line one they run in a '
     + 'terminal: the Claude app (desktop or phone) and claude.ai are not Claude '

From 5424c0f3dc441a1d5aa4f327797355f7db0200fb Mon Sep 17 00:00:00 2001
From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com>
Date: Mon, 26 Oct 2026 05:38:32 -0700
Subject: [PATCH 4/8] fix(byo): Codex on Linux is not tested; narrow the in-app
 offer to Mac

Lily (10-26): "macOS; Linux not yet tested" wherever Codex's platform is
stated. Sable's HOLD (90335) named three remaining Linux claims.

- guides.json:803, :5734 and on-my-computer.mdx:29 now say Mac only,
  "Linux is not tested yet", matching guides.json:138.
- listenerRunsOn narrows to os === 'mac', so the listener and compact
  card no longer appear for Codex on Linux.
- unavailableCodex hardcoded "from Windows"; it now takes {{os}} in en and
  zh-CN, so Linux does not read as Windows.
- Tests follow the gate; the claim table records the narrowed offer.

Co-Authored-By: Claude Haiku 5.5 <noreply@anthropic.com>
Co-authored-by: folio <WyJmb2xpbyIsImRlZmF1bHQiXQ@agents.commonly.invalid>
Agent-Model: claude/claude-haiku-5-5/high
---
 docs-site/agents/on-my-computer.mdx                   |  2 +-
 docs/audits/claim-table.md                            | 10 +++++-----
 frontend/src/content/guides.json                      |  4 ++--
 frontend/src/i18n/locales/en.json                     |  2 +-
 frontend/src/i18n/locales/zh-CN.json                  |  2 +-
 frontend/src/v2/__tests__/V2AgentBYOFromCard.test.tsx | 11 ++++++-----
 .../src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx |  6 +++---
 frontend/src/v2/components/V2AgentBYO.tsx             |  9 ++++-----
 8 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/docs-site/agents/on-my-computer.mdx b/docs-site/agents/on-my-computer.mdx
index 2f5be28239..859bc57cc0 100644
--- a/docs-site/agents/on-my-computer.mdx
+++ b/docs-site/agents/on-my-computer.mdx
@@ -26,7 +26,7 @@ not show an agent runtime key for this path.
 Choose **On my computer**, select the computer and a pod, and name the agent.
 Leave the adapter on **Auto-detect on that computer**, or choose one explicitly.
 Auto-detect tries Claude Code, then Codex. Claude Code is supported on Mac;
-Codex runs on Mac and Linux, including WSL. Select **Add to this computer**.
+Codex runs on a Mac; Linux is not tested yet. Select **Add to this computer**.
 The daemon picks up the request, starts the agent, and the page
 waits for it to report that it is running. Then open the pod and mention the
 agent.
diff --git a/docs/audits/claim-table.md b/docs/audits/claim-table.md
index 58954c0fb7..1e00a41f33 100644
--- a/docs/audits/claim-table.md
+++ b/docs/audits/claim-table.md
@@ -98,9 +98,9 @@ Owner: TASK-012. Source: `docs-site/bring-your-own/index.mdx`, `claude-code.mdx`
 | Page | Claim | Verdict | Evidence | Date |
 |---|---|---|---|---|
 | bring-your-own/index.mdx:6 | On Connect your agent, choose **Use my own agent** | TRUE | en.json:1623 (`byo`: "Use my own agent") | 2026-10-26 |
-| bring-your-own/index.mdx:14, claude-code.mdx:6 | Claude Code: "Connect on a Mac through the web setup" | TRUE | V2AgentBYO.tsx:103-104 offers the listener on mac for Claude only; workspace-trust.js:93 refuses a non-darwin workspace. Lily ruled 10-25 that Claude answers @mentions on macOS only | 2026-10-26 |
-| bring-your-own/index.mdx:17, codex.mdx:6 | Codex: "Connect on a Mac through the web setup" and "The Codex listener runs on your Mac" | TRUE | V2AgentBYO.tsx:103-104 offers the mac listener for Codex; the macOS half only | 2026-10-26 |
-| bring-your-own/index.mdx:17, codex.mdx:3, :6, :11 | Codex listener works on Linux (offered in the app at V2AgentBYO.tsx:104) | FALSE | Lily 10-26 06:12Z: codex 0.164 fails bootstrap on Linux, 0.144 reaches the model call; not verified end to end. Fixed here: "macOS; Linux not yet tested" on codex.mdx:3, :6, :11 and index.mdx:17; in-app copy en.json:1548, :1615, zh-CN.json:1608, :1674; guides.json:138 | 2026-10-26 |
+| bring-your-own/index.mdx:14, claude-code.mdx:6 | Claude Code: "Connect on a Mac through the web setup" | TRUE | V2AgentBYO.tsx:104 offers the listener on mac for Claude only; workspace-trust.js:93 refuses a non-darwin workspace. Lily ruled 10-25 that Claude answers @mentions on macOS only | 2026-10-26 |
+| bring-your-own/index.mdx:17, codex.mdx:6 | Codex: "Connect on a Mac through the web setup" and "The Codex listener runs on your Mac" | TRUE | V2AgentBYO.tsx:104 offers the mac listener for Codex; the macOS half only | 2026-10-26 |
+| bring-your-own/index.mdx:17, codex.mdx:3, :6, :11 | Codex listener works on Linux (was offered in the app at V2AgentBYO.tsx:104) | FALSE | Lily 10-26 06:12Z: codex 0.164 fails bootstrap on Linux, 0.144 reaches the model call; not verified end to end. Fixed here: "macOS; Linux not yet tested" on codex.mdx:3, :6, :11 and index.mdx:17; in-app copy en.json:1548, :1615, zh-CN.json:1608, :1674; guides.json:138, :803, :5734; on-my-computer.mdx:29. The in-app offer is narrowed to mac (V2AgentBYO.tsx:104) | 2026-10-26 |
 | bring-your-own/index.mdx:20 | OpenCode card: "Attach from the CLI in an invite-only pod" | CUT | No code makes an OpenCode seat private: opencode.js:358-391 and :451-489 run public seats. Card narrowed to "Attach from the CLI" | 2026-10-26 |
 | bring-your-own/index.mdx:23, hermes.mdx:6 | Hermes: "Attach from the CLI in an invite-only pod"; cannot run as a public seat | TRUE | packages/seats/src/adapters/hermes.js:163-165 throws for public or sandbox-declared seats | 2026-10-26 |
 | bring-your-own/index.mdx:26, deepseek-harness.mdx:6 | DeepSeek Harness: "from a Mac, in an invite-only pod"; cannot run as a public seat | TRUE | dsh.js:44-45 refuses public trust; dsh.js:328-329 a confined seat needs darwin (Seatbelt) | 2026-10-26 |
@@ -132,8 +132,8 @@ Owner: TASK-012. Source: `docs-site/bring-your-own/index.mdx`, `claude-code.mdx`
 | work-in-your-repo.mdx:41-47 | `--allow write`, `--allow web` and `--allow write,web` are accepted on first run | TRUE | agent.js:3863 (`--allow <grants>`); agent.js:303-309 (WORKSPACE_SANDBOX_ALLOW) | 2026-10-26 |
 | work-in-your-repo.mdx:51 | Grants fixed at first setup; change with `commonly agent detach <name> --force`, then rerun | TRUE | agent.js:315-329 (grants fixed when the token file is written; the message names detach --force) | 2026-10-26 |
 | work-in-your-repo.mdx:53 | Only Claude Code listeners work in a folder for now | TRUE | workspace-trust.js:90-91 returns no workspace unless adapterName is claude | 2026-10-26 |
-| en.json:1614 | "Claude Code can't answer @mentions from {{os}} yet" | TRUE | matches workspace-trust.js:93 and V2AgentBYO.tsx:103-104 | 2026-10-26 |
-| V2AgentBYO.tsx:103-104, en.json:1548, en.json:1615, zh-CN.json:1608, zh-CN.json:1674, guides.json:138 | Codex works on a Mac or Linux computer (the Linux half) | FALSE | Same evidence as the Codex-on-Linux row. Copy changed to "Linux is not tested yet"; the listener offer in the app is unchanged and needs Lily or SRE to decide | 2026-10-26 |
+| en.json:1614 | "Claude Code can't answer @mentions from {{os}} yet" | TRUE | matches workspace-trust.js:93 and V2AgentBYO.tsx:104 | 2026-10-26 |
+| V2AgentBYO.tsx:104, en.json:1548, en.json:1615, zh-CN.json:1608, zh-CN.json:1674, guides.json:138, :803, :5734, on-my-computer.mdx:29 | Codex works on a Mac or Linux computer (the Linux half) | FALSE | Same evidence as the Codex-on-Linux row. Copy changed to "Linux is not tested yet"; the in-app listener offer narrowed to mac (`listenerRunsOn`), per Lily's "macOS; Linux not yet tested" | 2026-10-26 |
 
 ## Connectors and grants
 
diff --git a/frontend/src/content/guides.json b/frontend/src/content/guides.json
index c3b7041d2f..f91f1189d6 100644
--- a/frontend/src/content/guides.json
+++ b/frontend/src/content/guides.json
@@ -792,7 +792,7 @@
       },
       {
         "question": "Will an MCP-connected agent respond automatically when mentioned?",
-        "answer": "An MCP-connected agent is reactive: it acts when you invoke it in its host tool. To have @mentions answered while you are away, run the listener command the Bring your own agent page gives you, commonly agent run <name>. While it runs, Claude Code (Mac only) or Codex (Mac or Linux, including WSL) answers on your machine. Start with MCP when you use Claude Code or Codex interactively."
+        "answer": "An MCP-connected agent is reactive: it acts when you invoke it in its host tool. To have @mentions answered while you are away, run the listener command the Bring your own agent page gives you, commonly agent run <name>. While it runs, Claude Code (Mac only) or Codex (Mac only; Linux is not tested yet) answers on your machine. Start with MCP when you use Claude Code or Codex interactively."
       },
       {
         "question": "Can this replace GitHub, tests, or source control?",
@@ -5723,7 +5723,7 @@
     },
     "intro": [
       "An AI agent CLI wrapper turns a local command-line agent into a participant in a shared workspace: it polls collaboration events and drives the local CLI to respond. It does not move the agent into the workspace, make a laptop a hosted runtime, or give the agent permissions its runtime and connected systems did not already have.",
-      "Commonly (commonly.me), the shared workspace where humans and AI agents work together, offers a CLI path for the case where a team wants a local agent to stay present in a pod while the operator is away. The listener runs Claude Code (Mac only) or Codex (Mac or Linux, including WSL), set up from the Bring your own agent page, or OpenCode, attached from the command line with commonly agent attach opencode. The agent still runs on the machine that starts it. Commonly supplies the pod identity, collaboration surface, runtime events, memory, and task record; the local CLI supplies the reasoning and any host-level capabilities its operator has configured.",
+      "Commonly (commonly.me), the shared workspace where humans and AI agents work together, offers a CLI path for the case where a team wants a local agent to stay present in a pod while the operator is away. The listener runs Claude Code (Mac only) or Codex (Mac only; Linux is not tested yet), set up from the Bring your own agent page, or OpenCode, attached from the command line with commonly agent attach opencode. The agent still runs on the machine that starts it. Commonly supplies the pod identity, collaboration surface, runtime events, memory, and task record; the local CLI supplies the reasoning and any host-level capabilities its operator has configured.",
       "That split is the useful part of the design, and the part worth being explicit about. A local agent can collaborate continuously without a public inbound endpoint, but a wrapper is not a security boundary, a repository permission system, or a substitute for review. This guide explains how to attach and run a CLI agent, where its authority begins and ends, how heartbeats fit into the operating model, and how to test one small workflow before handing the agent a larger role."
     ],
     "sections": [
diff --git a/frontend/src/i18n/locales/en.json b/frontend/src/i18n/locales/en.json
index ef975c28a6..1ebd966ea3 100644
--- a/frontend/src/i18n/locales/en.json
+++ b/frontend/src/i18n/locales/en.json
@@ -1609,7 +1609,7 @@
       "toolClaude": "Claude Code",
       "toolCodex": "the Codex CLI",
       "unavailableClaude": "Claude Code can’t answer @mentions from {{os}} yet: Commonly runs it in a sandbox, and on {{os}} that sandbox can’t run it. Connect Claude Code from your own sessions with the command below, or choose “Run it here” for a hosted agent.",
-      "unavailableCodex": "The Codex CLI can’t answer @mentions from Windows yet. Choose “Run it here” for a hosted agent, or run the command on a Mac. Linux is not tested yet.",
+      "unavailableCodex": "The Codex CLI can’t answer @mentions from {{os}} yet. Choose “Run it here” for a hosted agent, or run the command on a Mac. Linux is not tested yet.",
       "switchToCodex": "I use Codex instead",
       "switchToClaude": "I use Claude Code instead"
     },
diff --git a/frontend/src/i18n/locales/zh-CN.json b/frontend/src/i18n/locales/zh-CN.json
index a94db655c0..2a8627b436 100644
--- a/frontend/src/i18n/locales/zh-CN.json
+++ b/frontend/src/i18n/locales/zh-CN.json
@@ -1668,7 +1668,7 @@
       "osWindows": "Windows",
       "toolClaude": "Claude Code",
       "unavailableClaude": "Claude Code 在 {{os}} 上暂时不能回复 @提及：Commonly 要把它放进沙箱里运行，而 Commonly 用的沙箱在 {{os}} 上还做不到。你可以用下面的命令把 Commonly 的工具接进自己的 Claude Code 会话，或者选择“在这里运行”，改用托管智能体。",
-      "unavailableCodex": "Codex CLI 在 Windows 上暂时不能回复 @提及。你可以选择“在这里运行”，改用托管智能体；也可以换到 Mac 机器上运行这条命令（Linux 尚未测试）。",
+      "unavailableCodex": "Codex CLI 在 {{os}} 上暂时不能回复 @提及。你可以选择“在这里运行”，改用托管智能体；也可以换到 Mac 机器上运行这条命令（Linux 尚未测试）。",
       "toolCodex": "Codex CLI",
       "switchToCodex": "我用的是 Codex",
       "switchToClaude": "我用的是 Claude Code"
diff --git a/frontend/src/v2/__tests__/V2AgentBYOFromCard.test.tsx b/frontend/src/v2/__tests__/V2AgentBYOFromCard.test.tsx
index db96709fe4..ae638b33fb 100644
--- a/frontend/src/v2/__tests__/V2AgentBYOFromCard.test.tsx
+++ b/frontend/src/v2/__tests__/V2AgentBYOFromCard.test.tsx
@@ -187,9 +187,9 @@ describe('BYO from an approved connect card', () => {
   });
 });
 
-// #2289: the listener runs on a Mac with either tool and on Linux with Codex
-// only. The compact page promises "One command in Terminal", so it opens only
-// where that command will be shown.
+// #2289: the listener runs on a Mac with either tool only (Linux is not tested
+// yet, 10-26). The compact page promises "One command in Terminal", so it opens
+// only where that command will be shown.
 describe('the compact page opens only where the command exists', () => {
   const realUserAgent = window.navigator.userAgent;
   const setUserAgent = (value) => Object.defineProperty(window.navigator, 'userAgent', { value, configurable: true });
@@ -204,10 +204,11 @@ describe('the compact page opens only where the command exists', () => {
     expect(screen.queryByTestId('byo-card-compact')).toBeNull();
   });
 
-  test('a Codex card opened on Linux is compact: the listener runs there', async () => {
+  test('a Codex card opened on Linux gets the full page: Codex on Linux is not tested yet', async () => {
     setUserAgent(LINUX);
     renderAt('/v2/agents/byo?pod=bbb222&name=lee-codex&from=card&adapter=codex');
-    expect(await screen.findByTestId('byo-card-compact')).toBeInTheDocument();
+    expect(await screen.findByTestId('byo-mode-byo')).toHaveAttribute('aria-pressed', 'true');
+    expect(screen.queryByTestId('byo-card-compact')).toBeNull();
   });
 
   test('on Windows no card is compact, Codex included', async () => {
diff --git a/frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx b/frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx
index d80394ffbc..977d8658e4 100644
--- a/frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx
+++ b/frontend/src/v2/__tests__/V2AgentBYOListenSnippet.test.tsx
@@ -253,7 +253,7 @@ describe('BYO listener snippet', () => {
       expect(screen.getByTestId('byo-mcp-claude')).not.toHaveTextContent(/command above/);
     });
 
-    test('Linux with Claude Code: no listener command, and the bash MCP command; with Codex the listener is back', async () => {
+    test('Linux with Claude Code or Codex: no listener command, and the bash MCP command; Codex says it is not tested yet', async () => {
       setUserAgent(LINUX);
       await issueToken();
       expect(screen.getByTestId('byo-setup-os-linux')).toHaveAttribute('aria-pressed', 'true');
@@ -263,8 +263,8 @@ describe('BYO listener snippet', () => {
       expect(mcpBox()).toMatch(/-- npx -y @commonlyai\/mcp$/);
       expect(screen.getByTestId('byo-mcp-claude')).not.toHaveTextContent(/command above|Optional/);
       fireEvent.click(screen.getByTestId('byo-listen-adapter-switch'));
-      expect((listener()?.textContent || '').split('\n')[3]).toMatch(/ --adapter codex$/);
-      expect(screen.getByTestId('byo-listen-needs')).toHaveTextContent(/the Codex CLI signed in/);
+      expect(listener()).toBeUndefined();
+      expect(screen.getByTestId('byo-listen-unavailable')).toHaveTextContent(/The Codex CLI can’t answer @mentions from Linux yet\. .*Linux is not tested yet\./);
     });
 
     test('Codex on Windows says so, and offers hosted or another machine', async () => {
diff --git a/frontend/src/v2/components/V2AgentBYO.tsx b/frontend/src/v2/components/V2AgentBYO.tsx
index 9daf273ec8..76c56b0f9f 100644
--- a/frontend/src/v2/components/V2AgentBYO.tsx
+++ b/frontend/src/v2/components/V2AgentBYO.tsx
@@ -99,10 +99,9 @@ const SETUP_OS_OPTIONS: Array<{ os: SetupOs; labelKey: string }> = [
 // host check leaves Codex alone (it confines with its own profiles, not
 // Seatbelt or bubblewrap), but this page's command is bash `export` lines,
 // which PowerShell cannot run, and Codex on native Windows is unmeasured.
-// Not drift: the page only offers what it has seen work.
-const listenerRunsOn = (os: SetupOs, adapter: 'claude' | 'codex'): boolean => (
-  os === 'mac' || (os === 'linux' && adapter === 'codex')
-);
+// Not drift: the page only offers what it has seen work. Codex on Linux is
+// not walked yet (Lily, 10-26: "macOS; Linux not yet tested"), so no listener.
+const listenerRunsOn = (os: SetupOs): boolean => os === 'mac';
 type ModelOption = { value: string; labelKey: string };
 const CLAUDE_MODEL_OPTIONS: ModelOption[] = [
   { value: 'opus', labelKey: 'agentByo.form.modelOpus' },
@@ -199,7 +198,7 @@ const V2AgentBYO: React.FC = () => {
   // Where the person sets up, defaulted from this browser. They can switch:
   // the machine they browse on is not always the one they set up.
   const [setupOs, setSetupOs] = useState<SetupOs>(browserOs);
-  const listenerAvailable = listenerRunsOn(setupOs, listenAdapter);
+  const listenerAvailable = listenerRunsOn(setupOs);
   // Live listening verification (#887 class, second half). #888 made the
   // listening step legible; this makes it CHECKABLE — the page polls the
   // kernel until THIS agent's runtime token authenticates for the first time

From 31fa87a5c8ee0847949e2b2e1ffbfc7deea9e041 Mon Sep 17 00:00:00 2001
From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com>
Date: Tue, 27 Oct 2026 10:23:32 -0700
Subject: [PATCH 5/8] docs(faq): Codex FAQ answer says Linux is not tested yet
 (TASK-012)

Co-authored-by: folio <WyJmb2xpbyIsImRlZmF1bHQiXQ@agents.commonly.invalid>
Agent-Model: claude/claude-haiku-5-5/high
---
 frontend/src/content/guides.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/frontend/src/content/guides.json b/frontend/src/content/guides.json
index f91f1189d6..4fb837b56c 100644
--- a/frontend/src/content/guides.json
+++ b/frontend/src/content/guides.json
@@ -135,7 +135,7 @@
       },
       {
         "question": "Can I use Claude Code and Codex in the same team?",
-        "answer": "Yes. Set each one up from the Bring your own agent page on your own machine (Claude Code on a Mac; Codex on a Mac (Linux is not tested yet)). Both join the same pod with their own identities, answer @mentions while their listener runs, and keep their runtime-specific tools."
+        "answer": "Yes. Set each one up from the Bring your own agent page on your own machine (Claude Code on a Mac; Codex on a Mac; Linux is not tested yet). Both join the same pod with their own identities, answer @mentions while their listener runs, and keep their runtime-specific tools."
       },
       {
         "question": "How do agents share context?",

From f0397e8e51edb22408a6f948d0bb908d05d29d00 Mon Sep 17 00:00:00 2001
From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com>
Date: Tue, 27 Oct 2026 10:34:22 -0700
Subject: [PATCH 6/8] docs(byo): footnote names the visitor's OS; claim table
 re-pointed after Hermes removal (TASK-012)

Co-authored-by: folio <WyJmb2xpbyIsImRlZmF1bHQiXQ@agents.commonly.invalid>
Agent-Model: claude/claude-haiku-5-5/high
---
 docs/audits/claim-table.md                | 40 ++++++++++-------------
 frontend/src/i18n/locales/en.json         |  2 +-
 frontend/src/i18n/locales/zh-CN.json      |  2 +-
 frontend/src/v2/components/V2AgentBYO.tsx |  1 +
 4 files changed, 20 insertions(+), 25 deletions(-)

diff --git a/docs/audits/claim-table.md b/docs/audits/claim-table.md
index 1e00a41f33..e969170bbe 100644
--- a/docs/audits/claim-table.md
+++ b/docs/audits/claim-table.md
@@ -98,30 +98,24 @@ Owner: TASK-012. Source: `docs-site/bring-your-own/index.mdx`, `claude-code.mdx`
 | Page | Claim | Verdict | Evidence | Date |
 |---|---|---|---|---|
 | bring-your-own/index.mdx:6 | On Connect your agent, choose **Use my own agent** | TRUE | en.json:1623 (`byo`: "Use my own agent") | 2026-10-26 |
-| bring-your-own/index.mdx:14, claude-code.mdx:6 | Claude Code: "Connect on a Mac through the web setup" | TRUE | V2AgentBYO.tsx:104 offers the listener on mac for Claude only; workspace-trust.js:93 refuses a non-darwin workspace. Lily ruled 10-25 that Claude answers @mentions on macOS only | 2026-10-26 |
-| bring-your-own/index.mdx:17, codex.mdx:6 | Codex: "Connect on a Mac through the web setup" and "The Codex listener runs on your Mac" | TRUE | V2AgentBYO.tsx:104 offers the mac listener for Codex; the macOS half only | 2026-10-26 |
-| bring-your-own/index.mdx:17, codex.mdx:3, :6, :11 | Codex listener works on Linux (was offered in the app at V2AgentBYO.tsx:104) | FALSE | Lily 10-26 06:12Z: codex 0.164 fails bootstrap on Linux, 0.144 reaches the model call; not verified end to end. Fixed here: "macOS; Linux not yet tested" on codex.mdx:3, :6, :11 and index.mdx:17; in-app copy en.json:1548, :1615, zh-CN.json:1608, :1674; guides.json:138, :803, :5734; on-my-computer.mdx:29. The in-app offer is narrowed to mac (V2AgentBYO.tsx:104) | 2026-10-26 |
+| bring-your-own/index.mdx:14 | Claude Code: "Connect on a Mac through the web setup" | TRUE | V2AgentBYO.tsx:104 offers the listener on mac for Claude only; workspace-trust.js:93 refuses a non-darwin workspace. Lily ruled 10-25 that Claude answers @mentions on macOS only | 2026-10-26 |
+| bring-your-own/index.mdx:17, codex.mdx:7 | Codex: "Connect on a Mac through the web setup" and "The Codex listener runs on macOS" | TRUE | V2AgentBYO.tsx:104 offers the mac listener for Codex; the macOS half only | 2026-10-26 |
+| bring-your-own/index.mdx:17, codex.mdx:7, :12 (pre-fix :3, :6, :11) | Codex listener works on Linux (was offered in the app at V2AgentBYO.tsx:104) | FALSE | Lily 10-26 06:12Z: codex 0.164 fails bootstrap on Linux, 0.144 reaches the model call; not verified end to end. Fixed here: "macOS; Linux not yet tested" on codex.mdx:3, :6, :11 and index.mdx:17; in-app copy en.json:1548, :1615, zh-CN.json:1608, :1674; guides.json:138, :803, :5734; on-my-computer.mdx:29. The in-app offer is narrowed to mac (V2AgentBYO.tsx:104) | 2026-10-26 |
 | bring-your-own/index.mdx:20 | OpenCode card: "Attach from the CLI in an invite-only pod" | CUT | No code makes an OpenCode seat private: opencode.js:358-391 and :451-489 run public seats. Card narrowed to "Attach from the CLI" | 2026-10-26 |
-| bring-your-own/index.mdx:23, hermes.mdx:6 | Hermes: "Attach from the CLI in an invite-only pod"; cannot run as a public seat | TRUE | packages/seats/src/adapters/hermes.js:163-165 throws for public or sandbox-declared seats | 2026-10-26 |
-| bring-your-own/index.mdx:26, deepseek-harness.mdx:6 | DeepSeek Harness: "from a Mac, in an invite-only pod"; cannot run as a public seat | TRUE | dsh.js:44-45 refuses public trust; dsh.js:328-329 a confined seat needs darwin (Seatbelt) | 2026-10-26 |
-| bring-your-own/index.mdx:33 | MCP gives an interactive session Commonly tools; a listener answers @mentions while you are away | TRUE | MCP connect block at V2AgentBYO.tsx:958; commonly-mcp/src has no poll loop (tools.js:231 is an ack call); the listener is `commonly agent run` (agent.js:3858) | 2026-10-26 |
-| claude-code.mdx:8, codex.mdx:8, hermes.mdx:8 | Needs Node.js 20 or later | TRUE | cli/package.json:65-67 `engines.node >=20.0.0` | 2026-10-26 |
-| claude-code.mdx:8 | Claude Code signed in on that Mac | TRUE | claude.js:236-238 names the macOS Keychain credential that Claude's sign-in uses | 2026-10-26 |
-| claude-code.mdx:11 | Select **Claude Code** and **macOS** on the Connect page | TRUE | V2AgentBYO.tsx:95 lists the OS choices; en.json:1614 names the OS when Claude cannot run | 2026-10-26 |
-| claude-code.mdx:12, codex.mdx:12 | Get my connect command; the token is shown once | TRUE | en.json:1469 (`openConnect`); en.json:1555 (`keyOnce`: "a private key we show only once") | 2026-10-26 |
-| claude-code.mdx:17-21 | Listener command: `npm i -g @commonlyai/cli@latest`, `export COMMONLY_API_URL`, `export COMMONLY_AGENT_TOKEN`, `commonly agent run <name> --adapter claude` | TRUE | V2AgentBYO.tsx:46 (install) and :981 (the copied listener template with `--adapter ${listenAdapter}`) | 2026-10-26 |
-| codex.mdx:15 | Copied command installs `@commonlyai/cli`, sets URL and token, and runs `commonly agent run <name> --adapter codex` | TRUE | V2AgentBYO.tsx:981 with listenAdapter set to codex; codex is registered (cli/src/lib/adapters/index.js:23) | 2026-10-26 |
-| claude-code.mdx:24, codex.mdx:15, work-in-your-repo.mdx:20 | MCP alone does not answer @mentions and does not start the listener | TRUE | commonly-mcp/src has no poll loop (tools.js:231 is an ack call); the listener is `commonly agent run` (agent.js:3858) | 2026-10-26 |
-| opencode.mdx:6 | "OpenCode 1.19.3" is the version the guide covers | STALE | opencode.js:68 `TESTED_OPENCODE_VERSIONS = ['1.18.35', '1.19.0']`. Fixed here to name the tested versions | 2026-10-26 |
-| opencode.mdx:11-12 | `commonly agent attach opencode --pod ... --env ...`, then `commonly agent run <name>` | TRUE | opencode is registered (cli/src/lib/adapters/index.js:25); attach takes `--env <path>` (agent.js:3678) | 2026-10-26 |
-| hermes.mdx:6 | Requires Hermes Agent 0.22.2 | TRUE | packages/seats/src/adapters/hermes.js:12 `TESTED_HERMES_VERSION = '0.22.2'`; :27-28 refuses other versions | 2026-10-26 |
-| hermes.mdx:6 | Key in `OPENROUTER_API_KEY` | TRUE | packages/seats/src/adapters/hermes.js:187-188 refuses to start without it | 2026-10-26 |
-| hermes.mdx:6 | Or set `OPENROUTER_BASE_URL` to an OpenRouter-compatible endpoint and supply its key | CUT | `OPENROUTER_BASE_URL` appears nowhere in cli/ or packages/seats/src/ (grep 2026-10-26). Removed from the page | 2026-10-26 |
-| hermes.mdx:13-14 | `commonly agent attach hermes --pod ... --name ...`, then `commonly agent run <name>` | TRUE | hermes is registered (cli/src/lib/adapters/index.js:29) | 2026-10-26 |
-| hermes.mdx:17 | Each seat gets a separate Hermes profile, not your default one | TRUE | packages/seats/src/adapters/hermes.js:177-180 keeps the seat away from the operator's default profile; each seat has its own HERMES_HOME | 2026-10-26 |
-| deepseek-harness.mdx:6 | "Commonly CLI 0.1.122" is the supported path | CUT | No code pins a CLI version for dsh. The 0.1.122 pin exists only in docs/cli/dsh.md:16. Removed from the page | 2026-10-26 |
-| deepseek-harness.mdx:6 | dsh 0.2.1-rc.2 is the supported version | TRUE | dsh.js:35 `TESTED_DSH_VERSIONS = ['0.2.1-rc.2']`; :344-345 refuses other versions | 2026-10-26 |
-| deepseek-harness.mdx:11-12 | `commonly agent attach dsh ... --env ...`, then `commonly agent run <name>` | TRUE | dsh is registered (cli/src/lib/adapters/index.js:27); attach takes `--env` (agent.js:3678) | 2026-10-26 |
+| bring-your-own/index.mdx:23, deepseek-harness.mdx:7 | DeepSeek Harness: "Attach from the CLI on a Mac in an invite-only pod"; cannot run as a public seat | TRUE | dsh.js:44-45 refuses public trust; dsh.js:328-329 a confined seat needs darwin (Seatbelt) | 2026-10-26 |
+| bring-your-own/index.mdx:30 | MCP gives an interactive session Commonly tools; a listener answers @mentions while you are away | TRUE | MCP connect block at V2AgentBYO.tsx:958; commonly-mcp/src has no poll loop (tools.js:231 is an ack call); the listener is `commonly agent run` (agent.js:3858) | 2026-10-26 |
+| claude-code.mdx:9, codex.mdx:9, codex.mdx:4 | Needs Node.js 20 or later | TRUE | cli/package.json:65-67 `engines.node >=20.0.0` | 2026-10-26 |
+| claude-code.mdx:9 | Claude Code signed in on that Mac | TRUE | claude.js:236-238 names the macOS Keychain credential that Claude's sign-in uses | 2026-10-26 |
+| claude-code.mdx:12 | Select **Claude Code** and **macOS** on the Connect page | TRUE | V2AgentBYO.tsx:95 lists the OS choices; en.json:1614 names the OS when Claude cannot run | 2026-10-26 |
+| claude-code.mdx:13, codex.mdx:13 | Get my connect command; the token is shown once | TRUE | en.json:1469 (`openConnect`); en.json:1555 (`keyOnce`: "a private key we show only once") | 2026-10-26 |
+| claude-code.mdx:19-22 | Listener command: `npm i -g @commonlyai/cli@latest`, `export COMMONLY_API_URL`, `export COMMONLY_AGENT_TOKEN`, `commonly agent run <name> --adapter claude` | TRUE | V2AgentBYO.tsx:46 (install) and :981 (the copied listener template with `--adapter ${listenAdapter}`) | 2026-10-26 |
+| codex.mdx:16 | Copied command installs `@commonlyai/cli`, sets URL and token, and runs `commonly agent run <name> --adapter codex` | TRUE | V2AgentBYO.tsx:981 with listenAdapter set to codex; codex is registered (cli/src/lib/adapters/index.js:23) | 2026-10-26 |
+| claude-code.mdx:25, codex.mdx:16, work-in-your-repo.mdx:20 | MCP alone does not answer @mentions and does not start the listener | TRUE | commonly-mcp/src has no poll loop (tools.js:231 is an ack call); the listener is `commonly agent run` (agent.js:3858) | 2026-10-26 |
+| opencode.mdx:7 | "OpenCode 1.19.3" is the version the guide covers | STALE | opencode.js:68 `TESTED_OPENCODE_VERSIONS = ['1.18.35', '1.19.0']`. Fixed here to name the tested versions | 2026-10-26 |
+| opencode.mdx:12-13 | `commonly agent attach opencode --pod ... --env ...`, then `commonly agent run <name>` | TRUE | opencode is registered (cli/src/lib/adapters/index.js:25); attach takes `--env <path>` (agent.js:3678) | 2026-10-26 |
+| deepseek-harness.mdx:6 (removed) | "Commonly CLI 0.1.122" is the supported path | CUT | No code pins a CLI version for dsh. The 0.1.122 pin exists only in docs/cli/dsh.md:16. Removed from the page | 2026-10-26 |
+| deepseek-harness.mdx:7 | dsh 0.2.1-rc.2 is the supported version | TRUE | dsh.js:35 `TESTED_DSH_VERSIONS = ['0.2.1-rc.2']`; :344-345 refuses other versions | 2026-10-26 |
+| deepseek-harness.mdx:12-13 | `commonly agent attach dsh ... --env ...`, then `commonly agent run <name>` | TRUE | dsh is registered (cli/src/lib/adapters/index.js:27); attach takes `--env` (agent.js:3678) | 2026-10-26 |
 | work-in-your-repo.mdx:24 | On macOS, if every pod is private, the listener works in the folder you ran it from | TRUE | workspace-trust.js:6-8 (a pod must be confirmed private, not publicly readable, not listed, invite-only); :93 (darwin only); :112-119 (scratch folder otherwise) | 2026-10-26 |
 | work-in-your-repo.mdx:26 | Reads files there and runs read-only git: `status`, `log`, `diff`, `show`, `blame` | TRUE | cli/src/lib/git-readonly.js:65 `READONLY_GIT_SUBCOMMANDS` | 2026-10-26 |
 | work-in-your-repo.mdx:27 | Can't edit files, run commands, or fetch web pages | TRUE | Grants are off unless passed: agent.js:303-309 accepts only write and web, and only from `--allow` | 2026-10-26 |
diff --git a/frontend/src/i18n/locales/en.json b/frontend/src/i18n/locales/en.json
index 1ebd966ea3..8230605dd3 100644
--- a/frontend/src/i18n/locales/en.json
+++ b/frontend/src/i18n/locales/en.json
@@ -1542,7 +1542,7 @@
     "footnote": {
       "cliRoute": "Prefer the CLI? Choose “{{byo}}”; after install, the next step shows the listener command that answers @mentions.",
       "cliRouteClaudeUnavailable": "Prefer the CLI? Choose “{{byo}}”; after install, connect Claude Code to Commonly from your own sessions. To answer @mentions, run the listener on a supported computer or choose “{{hosted}}”.",
-      "cliRouteCodexUnavailable": "Prefer the CLI? Choose “{{byo}}”; after install, the next step explains how to run the listener on a Mac computer. Linux is not tested yet. To answer @mentions from Windows, choose “{{hosted}}”.",
+      "cliRouteCodexUnavailable": "Prefer the CLI? Choose “{{byo}}”; after install, the next step explains how to run the listener on a Mac computer. To answer @mentions from {{os}}, choose “{{hosted}}”.",
       "notSure": "Not sure which path?",
       "mcpVsCli": "MCP vs CLI vs SDK",
       "fullWalkthrough": "full walkthrough"
diff --git a/frontend/src/i18n/locales/zh-CN.json b/frontend/src/i18n/locales/zh-CN.json
index 2a8627b436..a3f190cce2 100644
--- a/frontend/src/i18n/locales/zh-CN.json
+++ b/frontend/src/i18n/locales/zh-CN.json
@@ -1602,7 +1602,7 @@
     "footnote": {
       "cliRoute": "更喜欢用 CLI？选择「{{byo}}」；安装后下一步会显示回复 @提及的监听命令。",
       "cliRouteClaudeUnavailable": "更喜欢用 CLI？选择「{{byo}}」；安装后可以在自己的 Claude Code 会话中连接 Commonly。要回复 @提及，请在支持的电脑上运行监听命令，或选择「{{hosted}}」。",
-      "cliRouteCodexUnavailable": "更喜欢用 CLI？选择「{{byo}}」；安装后下一步会说明如何在 Mac 电脑上运行监听命令（Linux 尚未测试）。要从 Windows 回复 @提及，请选择「{{hosted}}」。",
+      "cliRouteCodexUnavailable": "更喜欢用 CLI？选择「{{byo}}」；安装后下一步会说明如何在 Mac 电脑上运行监听命令。要从 {{os}} 回复 @提及，请选择「{{hosted}}」。",
       "notSure": "不确定用哪条路径？",
       "mcpVsCli": "MCP、CLI 与 SDK 对比",
       "fullWalkthrough": "完整教程"
diff --git a/frontend/src/v2/components/V2AgentBYO.tsx b/frontend/src/v2/components/V2AgentBYO.tsx
index 76c56b0f9f..74c341b0f3 100644
--- a/frontend/src/v2/components/V2AgentBYO.tsx
+++ b/frontend/src/v2/components/V2AgentBYO.tsx
@@ -1351,6 +1351,7 @@ const V2AgentBYO: React.FC = () => {
                 : 'agentByo.footnote.cliRouteCodexUnavailable', {
               byo: t('agentByo.mode.byo'),
               hosted: t('agentByo.mode.hosted'),
+              os: t(SETUP_OS_OPTIONS.find((o) => o.os === setupOs)?.labelKey || 'agentByo.listen.osMac'),
             })}{' '}
             {t('agentByo.footnote.notSure')}{' '}
             <a href="https://github.com/Team-Commonly/commonly/blob/main/docs/agents/CONNECTING_LOCAL_AGENTS.md" target="_blank" rel="noopener noreferrer">{t('agentByo.footnote.mcpVsCli')}</a>

From a5ff110be48a2f70aa95cdf999a4fae3c82338fa Mon Sep 17 00:00:00 2001
From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com>
Date: Tue, 27 Oct 2026 10:51:15 -0700
Subject: [PATCH 7/8] docs(byo): Codex card says Mac once (TASK-012 lumen
 review)

Co-authored-by: folio <WyJmb2xpbyIsImRlZmF1bHQiXQ@agents.commonly.invalid>
Agent-Model: claude/claude-haiku-5-5/high
---
 docs-site/bring-your-own/index.mdx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs-site/bring-your-own/index.mdx b/docs-site/bring-your-own/index.mdx
index a64672f9c4..59c4aeb77a 100644
--- a/docs-site/bring-your-own/index.mdx
+++ b/docs-site/bring-your-own/index.mdx
@@ -14,7 +14,7 @@ On [Connect your agent](https://commonly.me/v2/agents/byo), choose **Use my own
     Connect on a Mac through the web setup.
   </Card>
   <Card title="Codex" href="/bring-your-own/codex">
-    Connect on a Mac through the web setup. macOS; Linux not yet tested.
+    Connect on a Mac through the web setup. Linux not yet tested.
   </Card>
   <Card title="OpenCode" href="/bring-your-own/opencode">
     Attach from the CLI.

From cac6eaf4b009f617885a2aa54e66b913fc89b4d1 Mon Sep 17 00:00:00 2001
From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com>
Date: Tue, 27 Oct 2026 10:59:40 -0700
Subject: [PATCH 8/8] docs(audit): re-pin TASK-012 claim-table line numbers
 after rebase (lumen review 5671923440)

Co-authored-by: folio <WyJmb2xpbyIsImRlZmF1bHQiXQ@agents.commonly.invalid>
Agent-Model: claude/claude-haiku-5-5/high
---
 docs/audits/claim-table.md | 46 +++++++++++++++++++-------------------
 1 file changed, 23 insertions(+), 23 deletions(-)

diff --git a/docs/audits/claim-table.md b/docs/audits/claim-table.md
index e969170bbe..5d03567da6 100644
--- a/docs/audits/claim-table.md
+++ b/docs/audits/claim-table.md
@@ -40,11 +40,11 @@ Owner: TASK-010. Source: `README.md`.
 | README | Sign up with GitHub, Google or email (L62) | TRUE | backend/controllers/authController.ts:615–625 (`registrationOpen`); backend/routes/auth.ts:237 (`/registration-policy`); live `https://api.commonly.me/api/auth/registration-policy` on 10-25 returned `inviteOnly:false, registrationOpen:true`. Invite-only is the production default when `REGISTRATION_INVITE_ONLY` is unset (authController.ts:36–40), so this depends on that env var being off. Providers: frontend/src/i18n/locales/en.json:116–117, :380 (Google, GitHub). | 2026-10-25 |
 | README | Install the CLI with `npm i -g @commonlyai/cli@latest` (L71) | TRUE | cli/package.json:2 (name), :9 (bin `commonly`) | 2026-10-25 |
 | README | `commonly agent run <name> --adapter claude` (L74) | TRUE | cli/src/commands/agent.js:295 (`agent run --adapter`), :361 | 2026-10-25 |
-| README | Bring your own → Use my own agent → Get my connect command (L68) | TRUE | frontend/src/i18n/locales/en.json:1623 ("Use my own agent"), :1469 ("Get my connect command") | 2026-10-25 |
-| README | The connect page gives four lines with your token filled in (L68–75) | TRUE | frontend/src/v2/components/V2AgentBYO.tsx:981 (install, two exports, `commonly agent run`) | 2026-10-25 |
+| README | Bring your own → Use my own agent → Get my connect command (L68) | TRUE | frontend/src/i18n/locales/en.json:1620 ("Use my own agent"), :1469 ("Get my connect command") | 2026-10-25 |
+| README | The connect page gives four lines with your token filled in (L68–75) | TRUE | frontend/src/v2/components/V2AgentBYO.tsx:980 (install, two exports, `commonly agent run`) | 2026-10-25 |
 | README | The page shows **is listening** once running (L77) | TRUE | frontend/src/i18n/locales/en.json:1640 ("{{name}} is listening.") | 2026-10-25 |
 | README | Claude Code answers @mentions on macOS (L79) | TRUE | cli/src/lib/adapters/claude.js:760 (workspace trust refused under bwrap: "run on macOS only for now"). Linux support for invite-only pods is in review (#2820) and will change this row when it ships | 2026-10-25 |
-| README | On Linux and Windows, the page connects Claude Code over MCP (L79) | TRUE | frontend/src/v2/components/V2AgentBYO.tsx:958 (`claude mcp add … npx -y @commonlyai/mcp`), :965 (Windows `cmd /c commonly-mcp`) | 2026-10-25 |
+| README | On Linux and Windows, the page connects Claude Code over MCP (L79) | TRUE | frontend/src/v2/components/V2AgentBYO.tsx:957 (`claude mcp add … npx -y @commonlyai/mcp`), :964 (Windows `cmd /c commonly-mcp`) | 2026-10-25 |
 | README | Codex answers @mentions on macOS (L80, macOS half) | TRUE | cli/src/lib/adapters/codex.js:487 (Codex's permission-profile boundary runs on macOS). The adapter has no platform gate. The mention path itself is not walked; GTM's walk can still cut it. | 2026-10-26 |
 | README | Codex answers @mentions on Linux (L80, Linux half) | CUT | frontend/src/v2/components/V2AgentBYO.tsx:103–105 offers Codex on Linux, and nobody has walked it. The line reads "Linux not yet tested". | 2026-10-26 |
 | README | OpenCode guide "(walked on macOS)" (was L80; L81 has no parenthetical) | CUT | Nothing shows the walk did not happen, so this is CUT rather than FALSE. The parenthetical is removed in this PR (README.md:81). | 2026-10-27 |
@@ -97,37 +97,37 @@ Owner: TASK-012. Source: `docs-site/bring-your-own/index.mdx`, `claude-code.mdx`
 
 | Page | Claim | Verdict | Evidence | Date |
 |---|---|---|---|---|
-| bring-your-own/index.mdx:6 | On Connect your agent, choose **Use my own agent** | TRUE | en.json:1623 (`byo`: "Use my own agent") | 2026-10-26 |
+| bring-your-own/index.mdx:6 | On Connect your agent, choose **Use my own agent** | TRUE | en.json:1620 (`byo`: "Use my own agent") | 2026-10-26 |
 | bring-your-own/index.mdx:14 | Claude Code: "Connect on a Mac through the web setup" | TRUE | V2AgentBYO.tsx:104 offers the listener on mac for Claude only; workspace-trust.js:93 refuses a non-darwin workspace. Lily ruled 10-25 that Claude answers @mentions on macOS only | 2026-10-26 |
 | bring-your-own/index.mdx:17, codex.mdx:7 | Codex: "Connect on a Mac through the web setup" and "The Codex listener runs on macOS" | TRUE | V2AgentBYO.tsx:104 offers the mac listener for Codex; the macOS half only | 2026-10-26 |
-| bring-your-own/index.mdx:17, codex.mdx:7, :12 (pre-fix :3, :6, :11) | Codex listener works on Linux (was offered in the app at V2AgentBYO.tsx:104) | FALSE | Lily 10-26 06:12Z: codex 0.164 fails bootstrap on Linux, 0.144 reaches the model call; not verified end to end. Fixed here: "macOS; Linux not yet tested" on codex.mdx:3, :6, :11 and index.mdx:17; in-app copy en.json:1548, :1615, zh-CN.json:1608, :1674; guides.json:138, :803, :5734; on-my-computer.mdx:29. The in-app offer is narrowed to mac (V2AgentBYO.tsx:104) | 2026-10-26 |
+| bring-your-own/index.mdx:17, codex.mdx:7, :12 (pre-fix :3, :6, :11) | Codex listener works on Linux (was offered in the app at V2AgentBYO.tsx:104) | FALSE | Lily 10-26 06:12Z: codex 0.164 fails bootstrap on Linux, 0.144 reaches the model call; not verified end to end. Fixed here: "macOS; Linux not yet tested" on codex.mdx:7 and :12 (were :3, :6, :11) and index.mdx:17; in-app copy en.json:1545, en.json:1612, zh-CN.json:1605, zh-CN.json:1671; guides.json:138, :795, :5726; on-my-computer.mdx:29. The in-app offer is narrowed to mac (V2AgentBYO.tsx:104) | 2026-10-26 |
 | bring-your-own/index.mdx:20 | OpenCode card: "Attach from the CLI in an invite-only pod" | CUT | No code makes an OpenCode seat private: opencode.js:358-391 and :451-489 run public seats. Card narrowed to "Attach from the CLI" | 2026-10-26 |
 | bring-your-own/index.mdx:23, deepseek-harness.mdx:7 | DeepSeek Harness: "Attach from the CLI on a Mac in an invite-only pod"; cannot run as a public seat | TRUE | dsh.js:44-45 refuses public trust; dsh.js:328-329 a confined seat needs darwin (Seatbelt) | 2026-10-26 |
-| bring-your-own/index.mdx:30 | MCP gives an interactive session Commonly tools; a listener answers @mentions while you are away | TRUE | MCP connect block at V2AgentBYO.tsx:958; commonly-mcp/src has no poll loop (tools.js:231 is an ack call); the listener is `commonly agent run` (agent.js:3858) | 2026-10-26 |
+| bring-your-own/index.mdx:30 | MCP gives an interactive session Commonly tools; a listener answers @mentions while you are away | TRUE | MCP connect block at V2AgentBYO.tsx:957; commonly-mcp/src has no poll loop (tools.js:231 is an ack call); the listener is `commonly agent run` (agent.js:3858) | 2026-10-26 |
 | claude-code.mdx:9, codex.mdx:9, codex.mdx:4 | Needs Node.js 20 or later | TRUE | cli/package.json:65-67 `engines.node >=20.0.0` | 2026-10-26 |
 | claude-code.mdx:9 | Claude Code signed in on that Mac | TRUE | claude.js:236-238 names the macOS Keychain credential that Claude's sign-in uses | 2026-10-26 |
-| claude-code.mdx:12 | Select **Claude Code** and **macOS** on the Connect page | TRUE | V2AgentBYO.tsx:95 lists the OS choices; en.json:1614 names the OS when Claude cannot run | 2026-10-26 |
-| claude-code.mdx:13, codex.mdx:13 | Get my connect command; the token is shown once | TRUE | en.json:1469 (`openConnect`); en.json:1555 (`keyOnce`: "a private key we show only once") | 2026-10-26 |
-| claude-code.mdx:19-22 | Listener command: `npm i -g @commonlyai/cli@latest`, `export COMMONLY_API_URL`, `export COMMONLY_AGENT_TOKEN`, `commonly agent run <name> --adapter claude` | TRUE | V2AgentBYO.tsx:46 (install) and :981 (the copied listener template with `--adapter ${listenAdapter}`) | 2026-10-26 |
-| codex.mdx:16 | Copied command installs `@commonlyai/cli`, sets URL and token, and runs `commonly agent run <name> --adapter codex` | TRUE | V2AgentBYO.tsx:981 with listenAdapter set to codex; codex is registered (cli/src/lib/adapters/index.js:23) | 2026-10-26 |
-| claude-code.mdx:25, codex.mdx:16, work-in-your-repo.mdx:20 | MCP alone does not answer @mentions and does not start the listener | TRUE | commonly-mcp/src has no poll loop (tools.js:231 is an ack call); the listener is `commonly agent run` (agent.js:3858) | 2026-10-26 |
+| claude-code.mdx:12 | Select **Claude Code** and **macOS** on the Connect page | TRUE | V2AgentBYO.tsx:95 lists the OS choices; en.json:1611 names the OS when Claude cannot run | 2026-10-26 |
+| claude-code.mdx:13, codex.mdx:13 | Get my connect command; the token is shown once | TRUE | en.json:1466 (`openConnect`); en.json:1552 (`keyOnce`: "a private key we show only once") | 2026-10-26 |
+| claude-code.mdx:19-22 | Listener command: `npm i -g @commonlyai/cli@latest`, `export COMMONLY_API_URL`, `export COMMONLY_AGENT_TOKEN`, `commonly agent run <name> --adapter claude` | TRUE | V2AgentBYO.tsx:46 (install) and :980 (the copied listener template with `--adapter ${listenAdapter}`) | 2026-10-26 |
+| codex.mdx:16 | Copied command installs `@commonlyai/cli`, sets URL and token, and runs `commonly agent run <name> --adapter codex` | TRUE | V2AgentBYO.tsx:980 with listenAdapter set to codex; codex is registered (cli/src/lib/adapters/index.js:23) | 2026-10-26 |
+| claude-code.mdx:25, codex.mdx:16, work-in-your-repo.mdx:21 | MCP alone does not answer @mentions and does not start the listener | TRUE | commonly-mcp/src has no poll loop (tools.js:231 is an ack call); the listener is `commonly agent run` (agent.js:3858) | 2026-10-26 |
 | opencode.mdx:7 | "OpenCode 1.19.3" is the version the guide covers | STALE | opencode.js:68 `TESTED_OPENCODE_VERSIONS = ['1.18.35', '1.19.0']`. Fixed here to name the tested versions | 2026-10-26 |
 | opencode.mdx:12-13 | `commonly agent attach opencode --pod ... --env ...`, then `commonly agent run <name>` | TRUE | opencode is registered (cli/src/lib/adapters/index.js:25); attach takes `--env <path>` (agent.js:3678) | 2026-10-26 |
 | deepseek-harness.mdx:6 (removed) | "Commonly CLI 0.1.122" is the supported path | CUT | No code pins a CLI version for dsh. The 0.1.122 pin exists only in docs/cli/dsh.md:16. Removed from the page | 2026-10-26 |
 | deepseek-harness.mdx:7 | dsh 0.2.1-rc.2 is the supported version | TRUE | dsh.js:35 `TESTED_DSH_VERSIONS = ['0.2.1-rc.2']`; :344-345 refuses other versions | 2026-10-26 |
 | deepseek-harness.mdx:12-13 | `commonly agent attach dsh ... --env ...`, then `commonly agent run <name>` | TRUE | dsh is registered (cli/src/lib/adapters/index.js:27); attach takes `--env` (agent.js:3678) | 2026-10-26 |
-| work-in-your-repo.mdx:24 | On macOS, if every pod is private, the listener works in the folder you ran it from | TRUE | workspace-trust.js:6-8 (a pod must be confirmed private, not publicly readable, not listed, invite-only); :93 (darwin only); :112-119 (scratch folder otherwise) | 2026-10-26 |
-| work-in-your-repo.mdx:26 | Reads files there and runs read-only git: `status`, `log`, `diff`, `show`, `blame` | TRUE | cli/src/lib/git-readonly.js:65 `READONLY_GIT_SUBCOMMANDS` | 2026-10-26 |
-| work-in-your-repo.mdx:27 | Can't edit files, run commands, or fetch web pages | TRUE | Grants are off unless passed: agent.js:303-309 accepts only write and web, and only from `--allow` | 2026-10-26 |
-| work-in-your-repo.mdx:28 | Can't read `.env` or `.env.*`; read-only git refuses them by name or path | TRUE | git-readonly.js:158-163 (ENV_FILE_SEGMENT and the excludes); :46 (committed .env refused by path or object id) | 2026-10-26 |
-| work-in-your-repo.mdx:30 | Read-only git turns off external diff tools, conversion programs and signature checks, in submodules too | TRUE | git-readonly.js:21-22 and :112-116 (`--no-ext-diff --no-textconv`); :120-126 (the same off-switches reach a submodule's git as `-c` flags); :209-210 (`--submodule=diff` refused) | 2026-10-26 |
-| work-in-your-repo.mdx:31 | Read-only git never contacts a remote | TRUE | git-readonly.js:40 (lazy fetch off, so a partial clone's missing objects stay missing); readonlyGitEnv sets GIT_NO_LAZY_FETCH and GIT_ALLOW_PROTOCOL=none (git-readonly.js:283-300) | 2026-10-26 |
-| work-in-your-repo.mdx:34 | Otherwise reads only its scratch folder, and the start-up lines say why | TRUE | workspace-trust.js:90-107 (refusals with reasons); :112-119 (scratch folder as the cwd) | 2026-10-26 |
-| work-in-your-repo.mdx:41-47 | `--allow write`, `--allow web` and `--allow write,web` are accepted on first run | TRUE | agent.js:3863 (`--allow <grants>`); agent.js:303-309 (WORKSPACE_SANDBOX_ALLOW) | 2026-10-26 |
-| work-in-your-repo.mdx:51 | Grants fixed at first setup; change with `commonly agent detach <name> --force`, then rerun | TRUE | agent.js:315-329 (grants fixed when the token file is written; the message names detach --force) | 2026-10-26 |
-| work-in-your-repo.mdx:53 | Only Claude Code listeners work in a folder for now | TRUE | workspace-trust.js:90-91 returns no workspace unless adapterName is claude | 2026-10-26 |
-| en.json:1614 | "Claude Code can't answer @mentions from {{os}} yet" | TRUE | matches workspace-trust.js:93 and V2AgentBYO.tsx:104 | 2026-10-26 |
-| V2AgentBYO.tsx:104, en.json:1548, en.json:1615, zh-CN.json:1608, zh-CN.json:1674, guides.json:138, :803, :5734, on-my-computer.mdx:29 | Codex works on a Mac or Linux computer (the Linux half) | FALSE | Same evidence as the Codex-on-Linux row. Copy changed to "Linux is not tested yet"; the in-app listener offer narrowed to mac (`listenerRunsOn`), per Lily's "macOS; Linux not yet tested" | 2026-10-26 |
+| work-in-your-repo.mdx:25 | On macOS, if every pod is private, the listener works in the folder you ran it from | TRUE | workspace-trust.js:6-8 (a pod must be confirmed private, not publicly readable, not listed, invite-only); :93 (darwin only); :112-119 (scratch folder otherwise) | 2026-10-26 |
+| work-in-your-repo.mdx:27 | Reads files there and runs read-only git: `status`, `log`, `diff`, `show`, `blame` | TRUE | cli/src/lib/git-readonly.js:65 `READONLY_GIT_SUBCOMMANDS` | 2026-10-26 |
+| work-in-your-repo.mdx:28 | Can't edit files, run commands, or fetch web pages | TRUE | Grants are off unless passed: agent.js:303-309 accepts only write and web, and only from `--allow` | 2026-10-26 |
+| work-in-your-repo.mdx:29 | Can't read `.env` or `.env.*`; read-only git refuses them by name or path | TRUE | git-readonly.js:158-163 (ENV_FILE_SEGMENT and the excludes); :46 (committed .env refused by path or object id) | 2026-10-26 |
+| work-in-your-repo.mdx:31 | Read-only git turns off external diff tools, conversion programs and signature checks, in submodules too | TRUE | git-readonly.js:21-22 and :112-116 (`--no-ext-diff --no-textconv`); :120-126 (the same off-switches reach a submodule's git as `-c` flags); :209-210 (`--submodule=diff` refused) | 2026-10-26 |
+| work-in-your-repo.mdx:32 | Read-only git never contacts a remote | TRUE | git-readonly.js:40 (lazy fetch off, so a partial clone's missing objects stay missing); readonlyGitEnv sets GIT_NO_LAZY_FETCH and GIT_ALLOW_PROTOCOL=none (git-readonly.js:283-300) | 2026-10-26 |
+| work-in-your-repo.mdx:35 | Otherwise reads only its scratch folder, and the start-up lines say why | TRUE | workspace-trust.js:90-107 (refusals with reasons); :112-119 (scratch folder as the cwd) | 2026-10-26 |
+| work-in-your-repo.mdx:42-44 | `--allow write`, `--allow web` and `--allow write,web` are accepted on first run | TRUE | agent.js:3863 (`--allow <grants>`); agent.js:303-309 (WORKSPACE_SANDBOX_ALLOW) | 2026-10-26 |
+| work-in-your-repo.mdx:52 | Grants fixed at first setup; change with `commonly agent detach <name> --force`, then rerun | TRUE | agent.js:315-329 (grants fixed when the token file is written; the message names detach --force) | 2026-10-26 |
+| work-in-your-repo.mdx:54 | Only Claude Code listeners work in a folder for now | TRUE | workspace-trust.js:90-91 returns no workspace unless adapterName is claude | 2026-10-26 |
+| en.json:1611 | "Claude Code can't answer @mentions from {{os}} yet" | TRUE | matches workspace-trust.js:93 and V2AgentBYO.tsx:104 | 2026-10-26 |
+| V2AgentBYO.tsx:104, en.json:1545, en.json:1612, zh-CN.json:1605, zh-CN.json:1671, guides.json:138, :795, :5726, on-my-computer.mdx:29 | Codex works on a Mac or Linux computer (the Linux half) | FALSE | Same evidence as the Codex-on-Linux row. Copy changed to "Linux is not tested yet"; the in-app listener offer narrowed to mac (`listenerRunsOn`), per Lily's "macOS; Linux not yet tested" | 2026-10-26 |
 
 ## Connectors and grants