lilyshen0722 · Oct 27, 2026 · Oct 26, 2026 · Oct 26, 2026 · Oct 26, 2026 · Oct 26, 2026
diff --git a/backend/__tests__/unit/config/nativeAgents.scoutKnowledge.test.js b/backend/__tests__/unit/config/nativeAgents.scoutKnowledge.test.js
@@ -122,7 +122,7 @@ describe('Scout onboarding knowledge', () => {
   // Linux run 38982219348: a Claude Code listener cannot run on Linux, WSL or
   // Windows (#2288 refuses it), so a connect card for it there is a dead end.
   test('offers a connect card for Claude Code on a Mac only, and says what works elsewhere', () => {
-    expect(prompt).toMatch(/Claude Code on a Mac; Codex on Mac or Linux \(WSL included\)/);
+    expect(prompt).toMatch(/Claude Code on a Mac; Codex on a Mac \(Linux and WSL not yet tested\)/);
     expect(prompt).toMatch(/DeepSeek Harness \(dsh\) through its attach guide, walked on macOS with other OSs unverified/);
     expect(prompt).not.toMatch(/On Linux \(WSL included\), Codex only/);
     expect(prompt).toMatch(/For Claude Code on Linux, WSL or Windows, do not propose a connect card/);
@@ -153,9 +153,9 @@ describe('Scout onboarding knowledge', () => {
 
   // Rhea on #2765: the prompt is the only guard before the card, so the pairs
   // it may go out for are listed, not inferred.
-  test('proposes the card only for Claude Code on macOS and Codex on macOS, Linux or WSL', () => {
-    expect(prompt).toMatch(/The card may go out for exactly these pairs: Claude Code on macOS; Codex on macOS, Linux or WSL\./);
-    expect(prompt).toMatch(/Any other OS, such as native Windows, ChromeOS, iPad or iPhone, Android or FreeBSD, gets a text answer and no card/);
+  test('proposes the card only for Claude Code on macOS and Codex on macOS', () => {
+    expect(prompt).toMatch(/The card may go out for exactly these pairs: Claude Code on macOS; Codex on macOS\./);
+    expect(prompt).toMatch(/Any other OS, such as Linux, WSL, native Windows, ChromeOS, iPad or iPhone, Android or FreeBSD, gets a text answer and no card/);
     ['ChromeOS', 'iPad', 'Android'].forEach((os) => expect(prompt).toContain(os));
   });
 
@@ -179,10 +179,10 @@ describe('Scout onboarding knowledge', () => {
     // CodeRabbit on #2765: the no-card rule must not deny tools that do connect.
     expect(prompt).not.toMatch(/For any other tool, or an OS where it does not run yet, never propose the card; answer in text and say plainly that it does not run there yet/);
     expect(prompt).toMatch(/For Claude Code on Linux, WSL or Windows, do not propose a connect card: offer "Run it here" with commonly_offer_hosted_agent, and also say they can use the pod from their own Claude Code sessions with the MCP command on the connect page \(on Windows the page gives it as two PowerShell lines\)/);
-    expect(prompt).toMatch(/For Codex on native Windows, do not propose a connect card either: offer "Run it here", or running Codex on a Mac or Linux machine/);
+    expect(prompt).toMatch(/For Codex on native Windows, do not propose a connect card either: offer "Run it here", or running Codex on a Mac\. Say plainly why/);
     const en = JSON.parse(fs.readFileSync(path.resolve(__dirname, '../../../../frontend/src/i18n/locales/en.json'), 'utf8'));
     expect(en.agentByo.listen.unavailableClaude).toMatch(/Connect Claude Code from your own sessions with the command below, or choose “Run it here”/);
-    expect(en.agentByo.listen.unavailableCodex).toMatch(/Choose “Run it here” for a hosted agent, or run the command on a Mac or Linux machine/);
+    expect(en.agentByo.listen.unavailableCodex).toMatch(/Choose “Run it here” for a hosted agent, or run the command on a Mac\. Linux is not tested yet\./);
   });
 
   // Stranger journey 2026-10-26: Scout wrote the Terminal steps and asked

diff --git a/backend/config/native-agents/scout.ts b/backend/config/native-agents/scout.ts
@@ -144,7 +144,7 @@ export const scoutApp = {
     // agent to its own folder cannot start Claude Code on Linux or WSL, and
     // the CLI refuses to try (#2288). Codex does not run in it.
     + '- Where their own agent can be connected as a teammate that answers '
-    + '@mentions: Claude Code on a Mac; Codex on Mac or Linux (WSL included); '
+    + '@mentions: Claude Code on a Mac; Codex on a Mac (Linux and WSL not yet tested); '
     + 'DeepSeek Harness (dsh) through its attach guide, walked on macOS with '
     + 'other OSs unverified. On native Windows, Claude Code and Codex are not '
     + 'supported; Codex inside WSL counts as Linux. For '
@@ -153,7 +153,7 @@ export const scoutApp = {
     + 'from their own Claude Code sessions with the MCP command on the connect '
     + 'page (on Windows the page gives it as two PowerShell lines). For Codex on '
     + 'native Windows, do not propose a connect card either: offer "Run it here", '
-    + 'or running Codex on a Mac or Linux machine. Say plainly why: it does not '
+    + 'or running Codex on a Mac. Say plainly why: it does not '
     + 'run there yet.\n'
     // A new person asked (2026-10-17) for Claude, GPT and Gemini in one group
     // chat and was told there was no way to bring GPT in. Codex runs GPT.
@@ -201,7 +201,7 @@ export const scoutApp = {
     // and adapter only).
     + '- You can SET UP their own agent for them, and the connect card is the '
     + 'answer whenever it can work. The card may go out for exactly these pairs: '
-    + 'Claude Code on macOS; Codex on macOS, Linux or WSL. Any other OS, such as '
+    + 'Claude Code on macOS; Codex on macOS. Any other OS, such as Linux, WSL, '
     + 'native Windows, ChromeOS, iPad or iPhone, Android or FreeBSD, gets a text '
     + 'answer and no card. The tool must be the command-line one they run in a '
     + 'terminal: the Claude app (desktop or phone) and claude.ai are not Claude '

diff --git a/docs-site/agents/on-my-computer.mdx b/docs-site/agents/on-my-computer.mdx
@@ -26,7 +26,7 @@ not show an agent runtime key for this path.
 Choose **On my computer**, select the computer and a pod, and name the agent.
 Leave the adapter on **Auto-detect on that computer**, or choose one explicitly.
 Auto-detect tries Claude Code, then Codex. Claude Code is supported on Mac;
-Codex runs on Mac and Linux, including WSL. Select **Add to this computer**.
+Codex runs on a Mac; Linux is not tested yet. Select **Add to this computer**.
 The daemon picks up the request, starts the agent, and the page
 waits for it to report that it is running. Then open the pod and mention the
 agent.

diff --git a/docs-site/bring-your-own/codex.mdx b/docs-site/bring-your-own/codex.mdx
@@ -4,12 +4,12 @@ sidebarTitle: Codex
 description: Run a Codex listener on your Mac that answers @mentions in a Commonly pod. Needs Node.js 20 or later and the Codex CLI signed in.
 ---
 
-The Codex listener runs on your Mac.
+The Codex listener runs on macOS; Linux not yet tested.
 
 You need Node.js 20 or later and the Codex CLI signed in on that computer.
 
 1. Open [Connect your agent](https://commonly.me/v2/agents/byo) and choose **Use my own agent**.
-2. Name the agent, choose its pod, and select **Codex** and **macOS**.
+2. Name the agent, choose its pod, and select **Codex** and **macOS**. Linux is not yet tested.
 3. Select **Get my connect command**. Copy the listener command shown on the page into Terminal on that Mac. The token is shown once.
 4. Keep the terminal running. Wait for the listening check, then @mention the agent in its pod.
 

diff --git a/docs-site/bring-your-own/deepseek-harness.mdx b/docs-site/bring-your-own/deepseek-harness.mdx
@@ -4,7 +4,7 @@ sidebarTitle: DeepSeek Harness
 description: Attach DeepSeek Harness (dsh) from your Mac to an invite-only Commonly pod with the Commonly CLI.
 ---
 
-DeepSeek Harness (dsh) connects to an invite-only pod from your Mac. The supported path uses Commonly CLI 0.1.122 and dsh 0.2.1-rc.2. It cannot run as a public seat.
+DeepSeek Harness (dsh) connects to an invite-only pod from your Mac. The supported path uses dsh 0.2.1-rc.2. It cannot run as a public seat.
 
 Follow the [DeepSeek Harness guide](https://github.com/Team-Commonly/commonly/blob/main/docs/cli/dsh.md) to put your DeepSeek key in a file outside the workspace and create `environment.json`. Then attach and run:
 

diff --git a/docs-site/bring-your-own/index.mdx b/docs-site/bring-your-own/index.mdx
@@ -14,10 +14,10 @@ On [Connect your agent](https://commonly.me/v2/agents/byo), choose **Use my own
     Connect on a Mac through the web setup.
   </Card>
   <Card title="Codex" href="/bring-your-own/codex">
-    Connect on a Mac through the web setup.
+    Connect on a Mac through the web setup. Linux not yet tested.
   </Card>
   <Card title="OpenCode" href="/bring-your-own/opencode">
-    Attach from the CLI in an invite-only pod.
+    Attach from the CLI.
   </Card>
   <Card title="DeepSeek Harness" href="/bring-your-own/deepseek-harness">
     Attach from the CLI on a Mac in an invite-only pod.

diff --git a/docs-site/bring-your-own/opencode.mdx b/docs-site/bring-your-own/opencode.mdx
@@ -4,7 +4,7 @@ sidebarTitle: OpenCode
 description: Attach OpenCode to a Commonly pod that only its members can read, with the Commonly CLI, on macOS.
 ---
 
-OpenCode uses CLI attach, not the token issued by the web Connect page. The [OpenCode guide](https://github.com/Team-Commonly/commonly/blob/main/docs/cli/opencode.md) has the environment file and provider key setup for macOS, OpenCode 1.19.3, and DeepSeek.
+OpenCode uses CLI attach, not the token issued by the web Connect page. The [OpenCode guide](https://github.com/Team-Commonly/commonly/blob/main/docs/cli/opencode.md) has the environment file and provider key setup for macOS, the tested OpenCode versions 1.18.35 and 1.19.0, and DeepSeek.
 
 After completing that guide's install, sign-in, and environment file steps, attach in a pod that only its members can read:
 

diff --git a/docs/audits/claim-table.md b/docs/audits/claim-table.md
@@ -40,11 +40,11 @@ Owner: TASK-010. Source: `README.md`.
 | README | Sign up with GitHub, Google or email (L62) | TRUE | backend/controllers/authController.ts:615–625 (`registrationOpen`); backend/routes/auth.ts:237 (`/registration-policy`); live `https://api.commonly.me/api/auth/registration-policy` on 10-25 returned `inviteOnly:false, registrationOpen:true`. Invite-only is the production default when `REGISTRATION_INVITE_ONLY` is unset (authController.ts:36–40), so this depends on that env var being off. Providers: frontend/src/i18n/locales/en.json:116–117, :380 (Google, GitHub). | 2026-10-25 |
 | README | Install the CLI with `npm i -g @commonlyai/cli@latest` (L71) | TRUE | cli/package.json:2 (name), :9 (bin `commonly`) | 2026-10-25 |
 | README | `commonly agent run <name> --adapter claude` (L74) | TRUE | cli/src/commands/agent.js:295 (`agent run --adapter`), :361 | 2026-10-25 |
-| README | Bring your own → Use my own agent → Get my connect command (L68) | TRUE | frontend/src/i18n/locales/en.json:1623 ("Use my own agent"), :1469 ("Get my connect command") | 2026-10-25 |
-| README | The connect page gives four lines with your token filled in (L68–75) | TRUE | frontend/src/v2/components/V2AgentBYO.tsx:981 (install, two exports, `commonly agent run`) | 2026-10-25 |
+| README | Bring your own → Use my own agent → Get my connect command (L68) | TRUE | frontend/src/i18n/locales/en.json:1620 ("Use my own agent"), :1469 ("Get my connect command") | 2026-10-25 |
+| README | The connect page gives four lines with your token filled in (L68–75) | TRUE | frontend/src/v2/components/V2AgentBYO.tsx:980 (install, two exports, `commonly agent run`) | 2026-10-25 |
 | README | The page shows **is listening** once running (L77) | TRUE | frontend/src/i18n/locales/en.json:1640 ("{{name}} is listening.") | 2026-10-25 |
 | README | Claude Code answers @mentions on macOS (L79) | TRUE | cli/src/lib/adapters/claude.js:760 (workspace trust refused under bwrap: "run on macOS only for now"). Linux support for invite-only pods is in review (#2820) and will change this row when it ships | 2026-10-25 |
-| README | On Linux and Windows, the page connects Claude Code over MCP (L79) | TRUE | frontend/src/v2/components/V2AgentBYO.tsx:958 (`claude mcp add … npx -y @commonlyai/mcp`), :965 (Windows `cmd /c commonly-mcp`) | 2026-10-25 |
+| README | On Linux and Windows, the page connects Claude Code over MCP (L79) | TRUE | frontend/src/v2/components/V2AgentBYO.tsx:957 (`claude mcp add … npx -y @commonlyai/mcp`), :964 (Windows `cmd /c commonly-mcp`) | 2026-10-25 |
 | README | Codex answers @mentions on macOS (L80, macOS half) | TRUE | cli/src/lib/adapters/codex.js:487 (Codex's permission-profile boundary runs on macOS). The adapter has no platform gate. The mention path itself is not walked; GTM's walk can still cut it. | 2026-10-26 |
 | README | Codex answers @mentions on Linux (L80, Linux half) | CUT | frontend/src/v2/components/V2AgentBYO.tsx:103–105 offers Codex on Linux, and nobody has walked it. The line reads "Linux not yet tested". | 2026-10-26 |
 | README | OpenCode guide "(walked on macOS)" (was L80; L81 has no parenthetical) | CUT | Nothing shows the walk did not happen, so this is CUT rather than FALSE. The parenthetical is removed in this PR (README.md:81). | 2026-10-27 |
@@ -97,6 +97,37 @@ Owner: TASK-012. Source: `docs-site/bring-your-own/index.mdx`, `claude-code.mdx`
 
 | Page | Claim | Verdict | Evidence | Date |
 |---|---|---|---|---|
+| bring-your-own/index.mdx:6 | On Connect your agent, choose **Use my own agent** | TRUE | en.json:1620 (`byo`: "Use my own agent") | 2026-10-26 |
+| bring-your-own/index.mdx:14 | Claude Code: "Connect on a Mac through the web setup" | TRUE | V2AgentBYO.tsx:104 offers the listener on mac for Claude only; workspace-trust.js:93 refuses a non-darwin workspace. Lily ruled 10-25 that Claude answers @mentions on macOS only | 2026-10-26 |
+| bring-your-own/index.mdx:17, codex.mdx:7 | Codex: "Connect on a Mac through the web setup" and "The Codex listener runs on macOS" | TRUE | V2AgentBYO.tsx:104 offers the mac listener for Codex; the macOS half only | 2026-10-26 |
+| bring-your-own/index.mdx:17, codex.mdx:7, :12 (pre-fix :3, :6, :11) | Codex listener works on Linux (was offered in the app at V2AgentBYO.tsx:104) | FALSE | Lily 10-26 06:12Z: codex 0.164 fails bootstrap on Linux, 0.144 reaches the model call; not verified end to end. Fixed here: "macOS; Linux not yet tested" on codex.mdx:7 and :12 (were :3, :6, :11) and index.mdx:17; in-app copy en.json:1545, en.json:1612, zh-CN.json:1605, zh-CN.json:1671; guides.json:138, :795, :5726; on-my-computer.mdx:29. The in-app offer is narrowed to mac (V2AgentBYO.tsx:104) | 2026-10-26 |
+| bring-your-own/index.mdx:20 | OpenCode card: "Attach from the CLI in an invite-only pod" | CUT | No code makes an OpenCode seat private: opencode.js:358-391 and :451-489 run public seats. Card narrowed to "Attach from the CLI" | 2026-10-26 |
+| bring-your-own/index.mdx:23, deepseek-harness.mdx:7 | DeepSeek Harness: "Attach from the CLI on a Mac in an invite-only pod"; cannot run as a public seat | TRUE | dsh.js:44-45 refuses public trust; dsh.js:328-329 a confined seat needs darwin (Seatbelt) | 2026-10-26 |
+| bring-your-own/index.mdx:30 | MCP gives an interactive session Commonly tools; a listener answers @mentions while you are away | TRUE | MCP connect block at V2AgentBYO.tsx:957; commonly-mcp/src has no poll loop (tools.js:231 is an ack call); the listener is `commonly agent run` (agent.js:3858) | 2026-10-26 |
+| claude-code.mdx:9, codex.mdx:9, codex.mdx:4 | Needs Node.js 20 or later | TRUE | cli/package.json:65-67 `engines.node >=20.0.0` | 2026-10-26 |
+| claude-code.mdx:9 | Claude Code signed in on that Mac | TRUE | claude.js:236-238 names the macOS Keychain credential that Claude's sign-in uses | 2026-10-26 |
+| claude-code.mdx:12 | Select **Claude Code** and **macOS** on the Connect page | TRUE | V2AgentBYO.tsx:95 lists the OS choices; en.json:1611 names the OS when Claude cannot run | 2026-10-26 |
+| claude-code.mdx:13, codex.mdx:13 | Get my connect command; the token is shown once | TRUE | en.json:1466 (`openConnect`); en.json:1552 (`keyOnce`: "a private key we show only once") | 2026-10-26 |
+| claude-code.mdx:19-22 | Listener command: `npm i -g @commonlyai/cli@latest`, `export COMMONLY_API_URL`, `export COMMONLY_AGENT_TOKEN`, `commonly agent run <name> --adapter claude` | TRUE | V2AgentBYO.tsx:46 (install) and :980 (the copied listener template with `--adapter ${listenAdapter}`) | 2026-10-26 |
+| codex.mdx:16 | Copied command installs `@commonlyai/cli`, sets URL and token, and runs `commonly agent run <name> --adapter codex` | TRUE | V2AgentBYO.tsx:980 with listenAdapter set to codex; codex is registered (cli/src/lib/adapters/index.js:23) | 2026-10-26 |
+| claude-code.mdx:25, codex.mdx:16, work-in-your-repo.mdx:21 | MCP alone does not answer @mentions and does not start the listener | TRUE | commonly-mcp/src has no poll loop (tools.js:231 is an ack call); the listener is `commonly agent run` (agent.js:3858) | 2026-10-26 |
+| opencode.mdx:7 | "OpenCode 1.19.3" is the version the guide covers | STALE | opencode.js:68 `TESTED_OPENCODE_VERSIONS = ['1.18.35', '1.19.0']`. Fixed here to name the tested versions | 2026-10-26 |
+| opencode.mdx:12-13 | `commonly agent attach opencode --pod ... --env ...`, then `commonly agent run <name>` | TRUE | opencode is registered (cli/src/lib/adapters/index.js:25); attach takes `--env <path>` (agent.js:3678) | 2026-10-26 |
+| deepseek-harness.mdx:6 (removed) | "Commonly CLI 0.1.122" is the supported path | CUT | No code pins a CLI version for dsh. The 0.1.122 pin exists only in docs/cli/dsh.md:16. Removed from the page | 2026-10-26 |
+| deepseek-harness.mdx:7 | dsh 0.2.1-rc.2 is the supported version | TRUE | dsh.js:35 `TESTED_DSH_VERSIONS = ['0.2.1-rc.2']`; :344-345 refuses other versions | 2026-10-26 |
+| deepseek-harness.mdx:12-13 | `commonly agent attach dsh ... --env ...`, then `commonly agent run <name>` | TRUE | dsh is registered (cli/src/lib/adapters/index.js:27); attach takes `--env` (agent.js:3678) | 2026-10-26 |
+| work-in-your-repo.mdx:25 | On macOS, if every pod is private, the listener works in the folder you ran it from | TRUE | workspace-trust.js:6-8 (a pod must be confirmed private, not publicly readable, not listed, invite-only); :93 (darwin only); :112-119 (scratch folder otherwise) | 2026-10-26 |
+| work-in-your-repo.mdx:27 | Reads files there and runs read-only git: `status`, `log`, `diff`, `show`, `blame` | TRUE | cli/src/lib/git-readonly.js:65 `READONLY_GIT_SUBCOMMANDS` | 2026-10-26 |
+| work-in-your-repo.mdx:28 | Can't edit files, run commands, or fetch web pages | TRUE | Grants are off unless passed: agent.js:303-309 accepts only write and web, and only from `--allow` | 2026-10-26 |
+| work-in-your-repo.mdx:29 | Can't read `.env` or `.env.*`; read-only git refuses them by name or path | TRUE | git-readonly.js:158-163 (ENV_FILE_SEGMENT and the excludes); :46 (committed .env refused by path or object id) | 2026-10-26 |
+| work-in-your-repo.mdx:31 | Read-only git turns off external diff tools, conversion programs and signature checks, in submodules too | TRUE | git-readonly.js:21-22 and :112-116 (`--no-ext-diff --no-textconv`); :120-126 (the same off-switches reach a submodule's git as `-c` flags); :209-210 (`--submodule=diff` refused) | 2026-10-26 |
+| work-in-your-repo.mdx:32 | Read-only git never contacts a remote | TRUE | git-readonly.js:40 (lazy fetch off, so a partial clone's missing objects stay missing); readonlyGitEnv sets GIT_NO_LAZY_FETCH and GIT_ALLOW_PROTOCOL=none (git-readonly.js:283-300) | 2026-10-26 |
+| work-in-your-repo.mdx:35 | Otherwise reads only its scratch folder, and the start-up lines say why | TRUE | workspace-trust.js:90-107 (refusals with reasons); :112-119 (scratch folder as the cwd) | 2026-10-26 |
+| work-in-your-repo.mdx:42-44 | `--allow write`, `--allow web` and `--allow write,web` are accepted on first run | TRUE | agent.js:3863 (`--allow <grants>`); agent.js:303-309 (WORKSPACE_SANDBOX_ALLOW) | 2026-10-26 |
+| work-in-your-repo.mdx:52 | Grants fixed at first setup; change with `commonly agent detach <name> --force`, then rerun | TRUE | agent.js:315-329 (grants fixed when the token file is written; the message names detach --force) | 2026-10-26 |
+| work-in-your-repo.mdx:54 | Only Claude Code listeners work in a folder for now | TRUE | workspace-trust.js:90-91 returns no workspace unless adapterName is claude | 2026-10-26 |
+| en.json:1611 | "Claude Code can't answer @mentions from {{os}} yet" | TRUE | matches workspace-trust.js:93 and V2AgentBYO.tsx:104 | 2026-10-26 |
+| V2AgentBYO.tsx:104, en.json:1545, en.json:1612, zh-CN.json:1605, zh-CN.json:1671, guides.json:138, :795, :5726, on-my-computer.mdx:29 | Codex works on a Mac or Linux computer (the Linux half) | FALSE | Same evidence as the Codex-on-Linux row. Copy changed to "Linux is not tested yet"; the in-app listener offer narrowed to mac (`listenerRunsOn`), per Lily's "macOS; Linux not yet tested" | 2026-10-26 |
 
 ## Connectors and grants