@shadowclone/cli 0.0.25 → 0.0.26

package/PRIVACY.md

@@ -1,25 +1,26 @@
 # Privacy
 
-Shadowclone runs on your machine. It does not operate a collection service and does not add telemetry.
+Shadowclone runs on your machine. It has no collection service and no telemetry.
 
-## What it reads
-
-Each session, memory, repository, and skill source is disabled until you consent to that source. Setup asks separately about session learning, skill maintenance, and background learning. You can use the browser build editor without enabling learning.
-
-Shadowclone excludes tool results, tool-returned file contents, thinking blocks, and data-access results from learning. It resolves eligible text through its redaction boundary before model work. Redaction reduces exposure but does not guarantee anonymity, so use only material you are authorized to send.
+Each session, memory, repository, and skill source is off until you consent to it. Setup asks three separate questions: session learning, skill maintenance, and background learning. Learning excludes tool results, tool-returned file contents, thinking blocks, and data-access results. Shadowclone redacts eligible text before any model work. Redaction does not guarantee anonymity, so send only material that you may send.
 
 ## What leaves your machine
 
-Opening the browser editor and using the local MCP server do not send data to Shadowclone. Optional learning, skill drafting, and build descriptions use an agent CLI you choose. Consented, redacted inputs go directly through that provider and are governed by its terms.
+The wizard and the local MCP server send nothing to Shadowclone. These features send data to the provider that you choose:
 
-The build description action sends selected skill titles and redacted summaries. It does not send skill bodies, file paths, repository names, or ownership metadata.
+- **Learning, skill maintenance, and build naming:** selected redacted text, or skill titles and redacted summaries.
+- **Voice capture:** your redacted GitHub writing, after you turn on `github-writing`.
+- **Pull request review:** the pull request, its diff, and related files. `--offline` stops web search and the OSV lookup of lockfile package names.
+- **Cloud bot:** your reviewed skills, the repository, and the task. You enter tokens on GitHub, and Shadowclone never reads them.
 
-## Local storage and removal
+The provider and GitHub govern retention of what they receive. [Data handling](docs/data-handling.md) lists every source, request, and file.
 
-Configuration, evidence, revisions, generated skills, and installation records stay in Shadowclone's local state directory or in files you review before applying. Disable background learning with `shadowclone learning disable`, stop automatic skill edits with `shadowclone skills automatic off`, or remove recorded state with `shadowclone forget --all`.
+## Removal
 
-Uninstalling the plugin removes its packaged setup workflow. Use the CLI removal commands for locally installed guidance and state.
+- `shadowclone learning disable` stops background learning.
+- `shadowclone skills automatic off` stops automatic skill edits.
+- `shadowclone forget --all` removes the recorded state.
 
-## Questions and reports
+Local state stays in the state folder. Uninstalling the plugin removes only its setup workflow.
 
-Use [GitHub issues](https://github.com/theonly1me/shadowclone/issues) for privacy questions that contain no sensitive data. Follow [the security policy](SECURITY.md) when a report needs private material.
+Ask privacy questions that hold no sensitive data in [GitHub issues](https://github.com/theonly1me/shadowclone/issues). Report private material under the [security policy](SECURITY.md).

package/README.md

@@ -1,102 +1,127 @@
-![Shadowclone: your engineering instincts, as portable skills for every coding agent](docs/assets/shadowclone-banner.png)
+<div align="center">
 
-# Shadowclone
+<img src="docs/assets/shadowclone-banner.png" alt="Shadowclone: Your engineering taste, in every coding agent." width="1280">
 
+[![npm](https://img.shields.io/npm/v/@shadowclone/cli)](https://www.npmjs.com/package/@shadowclone/cli)
+[![CI](https://img.shields.io/github/actions/workflow/status/theonly1me/shadowclone/ci.yml?branch=main&label=CI)](https://github.com/theonly1me/shadowclone/actions/workflows/ci.yml)
+[![license](https://img.shields.io/github/license/theonly1me/shadowclone)](LICENSE)
 [![HOL Guard](https://img.shields.io/endpoint?url=https%3A%2F%2Fhol.org%2Fapi%2Fregistry%2Fbadges%2Fplugin%3Fslug%3Dtheonly1me%252Fshadowclone%26metric%3Dtrust)](https://hol.org/registry/plugins/theonly1me%2Fshadowclone)
-[![Shadowclone trust badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fhol.org%2Fapi%2Fregistry%2Fbadges%2Fplugin%3Fslug%3Dshadowclone%252Fshadowclone%26metric%3Dtrust%26style%3Dflat)](https://hol.org/registry/plugins/shadowclone%2Fshadowclone)
 
-Shadowclone maintains the skills, instructions, and checks that help **Claude Code, Codex, Pi, Cursor, and Antigravity** follow your engineering preferences. It works with the coding agents you already use and keeps you in control of what it reads and changes.
+[Quick start](#quick-start) · [What you get](#what-you-get) · [Skills](#skills-in-the-box) · [Cloud bot](docs/guides/cloud-bot.md) · [Docs](#docs)
 
-## Get started
+</div>
 
-### Let your agent set it up
+**Shadowclone makes coding agents follow your engineering taste, or any rules you configure, whatever the harness, agent, or model.** It works in Claude Code, Codex, Cursor, Pi, and Antigravity on your machine. It also runs on GitHub as a cloud bot with your Claude Code or Codex token. The bot works on issues, answers mentions, and reviews pull requests, like an agent with your engineering taste.
 
-In Claude Code, add and install the plugin:
+## Quick start
 
-```text
-/plugin marketplace add theonly1me/shadowclone
-/plugin install shadowclone@shadowclone
-```
+Paste this into Claude Code, Codex, Cursor, Pi, or Antigravity:
 
-In Codex, add the marketplace and install **Shadowclone** from the Plugins Directory:
-
-```bash
-codex plugin marketplace add theonly1me/shadowclone
-codex plugin add shadowclone@shadowclone
+```text
+Set up Shadowclone: https://raw.githubusercontent.com/theonly1me/shadowclone/main/plugins/shadowclone/skills/setup-shadowclone/SKILL.md
 ```
 
-Then tell the agent: **Set up Shadowclone.** The packaged setup skill checks the CLI version, offers installation or an upgrade when needed, asks you for three separate consent choices, installs native guidance for detected agents, and prints the local build URL. This setup flow requires CLI 0.0.13 or newer. It never uses elevated privileges or chooses data access for you.
-
-Cursor, Antigravity, and other skill-compatible agents can use the portable [`setup-shadowclone` skill](plugins/shadowclone/skills/setup-shadowclone/SKILL.md). Once any supported agent completes setup, Shadowclone synchronizes native guidance across the detected agents on your machine.
+The agent does the setup in about 5 minutes:
 
-### Set it up manually
+1. It installs the CLI, and the plugin in Claude Code or Codex.
+2. It asks if Shadowclone can learn from your past sessions, keep skills in sync, and keep learning in the background.
+3. It opens the skill wizard, where you pick skills and select **Equip**.
+4. It learns from your past sessions while you pick skills, if you agreed.
 
-Install the CLI:
+<details>
+<summary>Install by hand</summary>
 
 ```bash
 npm install -g @shadowclone/cli
+shadowclone init
+shadowclone wizard
 ```
 
-| Step | Command                                                         | What happens                                                        |                    Time |
-| ---- | --------------------------------------------------------------- | ------------------------------------------------------------------- | ----------------------: |
-| 1    | `shadowclone init`                                              | Answer three questions about learning and skill maintenance         |          About 1 minute |
-| 2    | `shadowclone learn --deep`                                      | Learn from enabled past sessions; repeat if more history remains    | Up to 5 minutes per run |
-| 3    | `shadowclone learning pending` and `shadowclone skills pending` | Review learned rules, scope, and publication before relying on them |          About 1 minute |
+To add the plugin, run `/plugin install shadowclone@shadowclone` after `/plugin marketplace add theonly1me/shadowclone` in Claude Code. In Codex, run `codex plugin marketplace add theonly1me/shadowclone` and then `codex plugin add shadowclone@shadowclone`.
 
-Setup takes about two to three minutes, excluding learning. Deep learning needs an installed and configured `claude`, `codex`, `cursor-agent`, or `pi` CLI. [Pi setup](docs/guides/pi.md) uses any suitable model configured in Pi, including local providers. Claude Code learning on Linux needs `bwrap` and `socat` for its sandbox.
+</details>
 
-**Skip learning.** Run `shadowclone wizard` by itself if you do not want Shadowclone to read sessions or call a model. It starts from an empty active environment and lets you choose a build locally.
+## What you get
 
-Run `shadowclone` to see the current result and next action. Use `shadowclone wizard` to browse optional workflow skills in a browser.
+- **Learning from your corrections.** Rules that you repeat in allowed sessions become skills and short native instructions.
+- **One setup for every agent and model.** The same skills reach all five agents. Pi can use any model that you configure.
+- **Agent builds.** Pick workflow skills on a browser skill map. Equip a personal build, a private build for one repository, or a shared build that your team commits. [Agent builds guide](docs/guides/agent-builds.md).
+- **Cloud bot.** A GitHub account that you name runs in GitHub Actions with your Claude Code or Codex token. It works on issues, answers mentions, and reviews pull requests. You merge each pull request. [Cloud bot guide](docs/guides/cloud-bot.md).
+- **Reviews and delegated work.** `shadowclone review 123` reviews a pull request on your machine. The `shadowclone-work` skill takes a change to ready for review.
 
-**Delegate a pull request.** The optional `shadowclone-work` skill takes a request, an issue, or an existing PR to ready for review: green checks, conflicts resolved, and review comments fixed or left for you. It replies to fixed comments with commit SHAs only and never merges. [Use delegated work](docs/guides/delegated-work.md).
+![The Skill constellation in the build wizard, with skills grouped by source and category, a named build, and skill details](docs/assets/agent-builds.jpg)
 
-**Use a personal GitHub clone.** Run `shadowclone bot setup` from a repository checkout. Name your App, select its repositories, and review the exact guidance before connecting your Claude subscription. The clone handles owner issues and tagged PR requests. Live installation qualification is pending. [Set up a GitHub clone](docs/guides/github-clones.md).
+## Skills in the box
 
-## Evaluations
+Shadowclone bundles 14 workflow skills. Pick them in the wizard.
 
-We tested 24 fixed engineering tasks across eight preference families, with three repetitions per setup and model. Scores measure preference adherence, with each family weighted equally.
+| Skill                         | Loads when                              |
+| ----------------------------- | --------------------------------------- |
+| `choose-by-consequence`       | A change adds a skip or fallback        |
+| `design-deep-modules`         | You design a module                     |
+| `diagnose-before-editing`     | The cause of a failure is unknown       |
+| `plan-with-review-page`       | A change has many steps                 |
+| `research-primary-sources`    | A decision needs outside facts          |
+| `resolve-conflicts-by-intent` | A merge or rebase has conflicts         |
+| `scope-confirmed-changes`     | You fix a bug or review finding         |
+| `shadowclone-review`          | A pull request needs a review           |
+| `shadowclone-work`            | You take a change to ready for review   |
+| `tests-that-catch-bugs`       | You add or change a test                |
+| `typescript-type-safety`      | You change TypeScript types             |
+| `verify-and-review`           | Before you say that work is done        |
+| `verify-review-findings`      | A pull request has review comments      |
+| `write-plain-english`         | You write text for a person (always on) |
 
-| Setup                                     | GPT 6.1 Sol | GPT 6 Luna | Claude Sonnet 5.5 | Claude Opus 5.5 |
-| ----------------------------------------- | ----------: | ---------: | ----------------: | --------------: |
-| Agent alone                               |       77.3% |      59.0% |             56.5% |           53.2% |
-| Existing user skills                      |       85.2% |      80.6% |             76.4% |           73.6% |
-| Existing skills + Shadowclone routing     |       86.1% |      72.7% |             76.9% |           75.9% |
-| Existing skills + handwritten preferences |       92.4% |      81.2% |             91.7% |           86.1% |
-| Existing skills + Shadowclone learning    |       89.4% |      83.3% |             90.0% |           82.9% |
+## Results
 
-Shadowclone learning improved recorded adherence over existing skills on all four models. The gain ranges from 2.8 to 13.7 percentage points. Handwritten preferences provide a reference for what agents can follow when the intended rules are supplied directly.
+Across 24 fixed tasks, Shadowclone learning scored above existing user skills on all four models. Scores measure preference adherence on synthetic tasks. See [setups, methods, and limits](evals.md).
 
-The learning setup includes routing and actual learned preferences from synthetic correction sessions. These results measure preference delivery on this task set. [Read the setup definitions, family scores, methods, and measurement limits](evals.md).
+| Setup                                  | GPT 6.1 Sol | GPT 6 Luna | Claude Sonnet 5.5 | Claude Opus 5.5 |
+| -------------------------------------- | ----------: | ---------: | ----------------: | --------------: |
+| Agent alone                            |       77.3% |      59.0% |             56.5% |           53.2% |
+| Existing user skills                   |       85.2% |      80.6% |             76.4% |           73.6% |
+| Existing skills + Shadowclone learning |       89.4% |      83.3% |             90.0% |           82.9% |
 
-## Privacy comes first
+## How it works
+
+```mermaid
+flowchart LR
+  A[Consented sessions] --> B[Learning]
+  B --> C[Skills and native instructions]
+  C --> D[Agents on your machine]
+  C --> E[Cloud bot on GitHub]
+```
 
-**There is no Shadowclone collection service or telemetry.** Learning records, revisions, and original-library snapshots stay on your machine. Model work goes through the authenticated agent CLI you select and is subject to that provider's terms.
+Shadowclone indexes references to enabled sessions and copies no transcript. It redacts text and learns rules. One session can give an explicit rule, and an inferred pattern needs three independent sessions. Rules become skills that you can read, edit, and undo. Shadowclone changes the guidance, not the model. See the [architecture](docs/architecture/README.md).
 
-**You choose what it reads.** Every capture source is off by default and has its own consent setting. Reading sessions does not silently enable memory, repository metadata, or skill editing.
+## Privacy
 
-| Operation                      | What the selected provider can receive                                          |
-| ------------------------------ | ------------------------------------------------------------------------------- |
-| Learning and skill maintenance | Selected redacted instructions, steering, and supporting context                |
-| Personal GitHub clone          | The reviewed skills, native rules, selected repository, and issue or PR task    |
-| Browser editor                 | Nothing merely from opening it; optional AI drafting sends reviewed form fields |
-| Evaluation                     | Synthetic prompts, the tested setup's guidance, and generated code              |
+- **No collection service.** No telemetry. Model work uses the agent CLI that you choose.
+- **Consent.** Every source is off by default and has its own setting.
+- **Redaction.** Tool results, tool-returned file contents, and thinking blocks never enter learning.
+- **Removal.** Run `shadowclone learning disable`, `shadowclone skills automatic off`, or `shadowclone forget --all`.
 
-**Redaction is a boundary, not an anonymity guarantee.** Tool results, tool-returned file contents, thinking blocks, and data-access results are excluded from learning. Use only sources and repositories you are authorized to send to the selected provider.
+Read the [privacy policy](PRIVACY.md) and [data handling](docs/data-handling.md).
 
-**Removal stays in your control.** Disable background learning with `shadowclone learning disable`, stop automatic skill edits with `shadowclone skills automatic off`, or remove recorded state with `shadowclone forget --all`. See the [privacy policy](PRIVACY.md), [data handling](docs/data-handling.md), and [enterprise controls](docs/architecture/07-enterprise.md) for sources, storage, managed policy, and removal details.
+## Docs
 
-## Guides
+| Guide                                            | Use it to             |
+| ------------------------------------------------ | --------------------- |
+| [Agent builds](docs/guides/agent-builds.md)      | Pick skills and scope |
+| [Learning](docs/guides/learning.md)              | Learn from sessions   |
+| [Skill maintenance](docs/guides/skills.md)       | Review updates, undo  |
+| [Repository setup](docs/guides/repositories.md)  | Share checks          |
+| [Pi setup](docs/guides/pi.md)                    | Use Pi models         |
+| [Delegated work](docs/guides/delegated-work.md)  | Ready a pull request  |
+| [Cloud bot](docs/guides/cloud-bot.md)            | Set up the GitHub bot |
+| [Reviews](docs/guides/reviews.md)                | Review a pull request |
+| [MCP server](docs/guides/mcp.md)                 | Give agents the tools |
+| [Command reference](docs/guides/commands.md)     | Find every command    |
+| [Migration](docs/guides/migration.md)            | Move to skills        |
+| [Enterprise controls](docs/guides/enterprise.md) | Set scope and policy  |
 
-| Guide                                           | Use it to                                                      |
-| ----------------------------------------------- | -------------------------------------------------------------- |
-| [Agent builds](docs/guides/agent-builds.md)     | Choose, create, and equip skills                               |
-| [Learning](docs/guides/learning.md)             | Run deep learning, background learning, or record a preference |
-| [Skill maintenance](docs/guides/skills.md)      | Review updates, conflicts, history, and undo                   |
-| [Repository setup](docs/guides/repositories.md) | Share checks and skills with a repository                      |
-| [How it works](docs/guides/how-it-works.md)     | Follow guidance from consented evidence to coding agents       |
-| [Command reference](docs/guides/commands.md)    | Find everyday and advanced commands                            |
+More: [documentation index](docs/README.md), [motivation](docs/motivation.md), [design history](docs/design/README.md), [security](SECURITY.md).
 
-**Further reading:** [Documentation index](docs/README.md) · [Architecture](docs/architecture/README.md) · [Design history](docs/design/README.md) · [Migration](docs/migration.md) · [Contributing](CONTRIBUTING.md) · [Security](SECURITY.md)
+## Contributing
 
-Shadowclone is MIT licensed.
+Read [CONTRIBUTING.md](CONTRIBUTING.md) before you open a pull request. Shadowclone uses the MIT license. If Shadowclone saves you a correction, star the repository.

package/dist/_.._/{web → _.._/web/src}/client/index.html

@@ -9,7 +9,7 @@
       content="default-src 'self'; connect-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; object-src 'none'; base-uri 'none'; form-action https://github.com"
     />
     <title>Your agent build · Shadowclone</title>
-    <link rel="icon" type="image/svg+xml" href="../../../web/shadowclone-mark-w6a76wqy.svg" />
+    <link rel="icon" type="image/svg+xml" href="../../../../../web/shadowclone-mark-w6a76wqy.svg" />
     
     
     
@@ -23,12 +23,12 @@
     
     
     
-  <link rel="stylesheet" crossorigin href="../../../web/index-t330dg8e.css"><script type="module" crossorigin src="../../../web/index-xsq72pnc.js"></script></head>
+  <link rel="stylesheet" crossorigin href="../../../../../web/index-t330dg8e.css"><script type="module" crossorigin src="../../../../../web/index-cmzs0t91.js"></script></head>
   <body>
     <div class="frame">
       <header class="masthead">
         <a class="brand" href="/" aria-label="Shadowclone agent builder">
-          <img class="brand-mark" src="../../../web/shadowclone-mark-w6a76wqy.svg" alt="" />
+          <img class="brand-mark" src="../../../../../web/shadowclone-mark-w6a76wqy.svg" alt="" />
           shadowclone
         </a>
         <span class="local-badge"><span></span> LOCAL WORKSPACE</span>