@holostaff/sdk 0.12.8 → 0.12.9

package/README.md

@@ -1,7 +1,10 @@
 # @holostaff/sdk
 
-Lifetime identity, stage detection, custom signal probes, and the
-intervention widget for the Holostaff runtime.
+The Holostaff runtime for your app: the autopilot offer, the handover
+loop, and the safety envelope, in the user's own session. A workflow
+autopilot is a computer-use agent that lives inside your product; this
+SDK is the part that lives in the page. It also carries lifetime
+identity, stage detection, and custom signal probes.
 
 ## Install
 
@@ -31,10 +34,6 @@ holostaff.clearIdentity()
 
 // On host-app events the scan detected as worth observing.
 holostaff.emitSignal('first_resource_created', { kind: 'project' })
-
-// Only needed if you render interventions yourself — the built-in
-// widget reports outcomes automatically.
-holostaff.reportOutcome(interventionId, 'engaged')
 ```
 
 Calls made before `init()` queue and replay once it runs, so import
@@ -42,28 +41,50 @@ order is not load-bearing. All methods are fail-soft — they never throw
 into your code. Errors route to the optional `onError` callback you
 pass to `init()`.
 
-## What this SDK does (and doesn't)
+## The autopilot layer
+
+When a workflow is enabled and certified, the SDK renders everything the
+user sees of its autopilot:
+
+- **The offer card** on the workflow, carrying the task's name (or the
+  display name your team set). Nothing happens unless the user accepts:
+  handover is always the user's explicit act.
+- **The intent overlay**: the few specifics the task needs, collected at
+  handover.
+- **The run itself**: one small action at a time, in the user's own
+  session and tab, with every target highlighted before anything happens.
+- **Questions** anchored beside the field they concern, never a modal
+  over the form.
+- **The Allow pill** on consequential clicks (pay, delete, submit, send,
+  sign). No answer means no.
+- **The progress panel** with an always-visible Stop.
+
+## The safety envelope
+
+Enforced in the executor and the server, never only in a prompt:
+
+- The autopilot runs with the user's own auth and permissions, same
+  origin only. No credentials ever pass through Holostaff.
+- Password, payment, and code fields are hard-refused: the autopilot
+  points, the user types.
+- Any keystroke from the user pauses the run. Per-workflow step budgets
+  cap every run.
+
+## What this SDK also does
 
-**Does**
 - Mint and persist a lifetime device id (localStorage + first-party cookie).
 - Open / close a session bound to page lifecycle.
 - POST identity / stage / signal / outcome events to the Holostaff runtime.
 - Track the current SPA route and last-user-activity time, and forward
   them to the runtime on route changes plus a low-frequency heartbeat.
 - **Record the session with rrweb** (DOM, canvas at ~2 fps, media playback
-  state, inlined images/fonts) and batch it to the runtime, where the
-  vision pipeline watches the session and decides when the copilot should
-  step in. Password / email / tel inputs are always masked; mark rendered
-  PII with the `holostaff-mask` (text) or `holostaff-block` (region) CSS
-  classes; opt out entirely with `init({ observe: { enabled: false } })`.
-- Hold a server-sent-events channel open and render `text` interventions
-  as a shadow-DOM pill (dismiss / engage / 30s auto-ignore), reporting
-  outcomes back automatically.
-
-**Does not (yet)**
-- Render non-text modalities (voice / email / sms / phone /
-  screen automation) — those events are surfaced to `onError` and skipped.
+  state, inlined images/fonts) and batch it to the runtime. Password /
+  email / tel inputs are always masked; mark rendered PII with the
+  `holostaff-mask` (text) or `holostaff-block` (region) CSS classes; opt
+  out entirely with `init({ observe: { enabled: false } })`.
 
 ## References
 
 - [docs.holostaff.ai](https://docs.holostaff.ai)
+- [What a workflow autopilot is](https://docs.holostaff.ai/autopilots/index.html)
+- [The safety envelope](https://docs.holostaff.ai/how-it-works/guarded-actions.html)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@holostaff/sdk",
-  "version": "0.12.8",
-  "description": "Holostaff SDK — lifetime identity, stage detection, custom signal probes, and the living-portrait presence layer (chip, note, Theater, voice Stage) for the Holostaff runtime.",
+  "version": "0.12.9",
+  "description": "The Holostaff runtime for your app: the autopilot offer, the handover loop, and the safety envelope, in the user's own session.",
   "license": "Apache-2.0",
   "homepage": "https://docs.holostaff.ai",
   "type": "module",
@@ -55,4 +55,4 @@
       "optional": true
     }
   }
-}
+}