@specset/cli 2.0.1 → 2.1.0

package/README.md

@@ -101,7 +101,7 @@ specset harness install codex           # once, for Codex; Claude uses the runti
 specset agent serve --host <deployment> --org <slug>
 ```
 
-Turn on **Native tools** in the conversation's Settings to let the harness run shell commands and edit files in a private per-run workspace; every command and edit is mirrored into the conversation, the `specset` CLI is logged in there for downloading project material, and files written under `out/` are attached to the thread. With Permissions Auto or Full, document and drawing reads may also run code over their own attachments (crop and enlarge a detail), sandboxed in a scratch directory holding only those files (plus your temp directory), with no network or credentials; the terminal prints each action. Requires Node.js 22 or newer.
+With **Native tools** (on for a thread that starts running locally; turn them off in the conversation's Settings), the harness runs shell commands and edits files in a private per-run workspace, sealed there; every command and edit is mirrored into the conversation, project material comes through Specset tools, and files written under `out/` are attached to the thread. With Permissions Auto or Full, document and drawing reads may also run code over their own attachments (crop and enlarge a detail), sandboxed in a scratch directory holding only those files (plus your temp directory), with no network or credentials; the terminal prints each action. Requires Node.js 22 or newer.
 
 ## MCP transports and files
 
@@ -123,9 +123,11 @@ CLI 1.x requires a Specset deployment that serves public source links (the `/go`
 
 CLI 2.0 requires Node.js 22 or newer and a Specset deployment from 2026-10-10 or later, which app.specset.com is. Existing commands depend on the newer server too: `org list`, `org use` and every command's `--org` resolution query `me.organizationChoices` (PR #972), and the new commands (personal runners, project seeding, submittal reviews, the superadmin namespace) call APIs deployed by that date. On Node.js 20, or against an older deployment, stay on CLI 1.0.0 until both are upgraded.
 
+`org security show`, added in CLI 2.1.0, needs a deployment that serves `Org.secureConfiguration` (PR #1403). CLI 2.1.0 is published before that field is deployed, so the command fails against app.specset.com until the next deploy after the release. `org members list` uses `orgMembers` and works against any deployment CLI 2.0 supports.
+
 `agent start --type ProjectReview` requires the server's Project Review agent registration. Project Review has no separate project toggle or superadmin launch requirement. These command and skill additions ride the next CLI release; no npm version is bumped here.
 
-Local execution requires this branch's personal-runner and local-inference API, including the `AddRunnerOutputIdentity` migration (run outputs attach with their workspace path and checksum). Deploy these server changes before releasing this CLI. With native tools on, the thread's Permissions setting maps to Claude's permission modes and to Codex's sandbox (Read only, workspace-write for Edits and Auto, full access for Full).
+Local execution requires this branch's personal-runner and local-inference API, including the `AddRunnerOutputIdentity` migration (run outputs attach with their workspace path and checksum). Deploy these server changes before releasing this CLI. With native tools on, the thread's Permissions setting picks the harness's tools (Read only: reads; Accept edits: and edits; Auto or Full: and the shell), sealed in the run's workspace in every mode; Codex runs under a permissions profile the runner builds.
 
 ## Configuration
 
@@ -156,7 +158,17 @@ Each process serves one host and organization. For separate worktrees, run `spec
 
 Temporal owns agent execution, workflow fan-out, tool dispatch and approvals. The personal runner executes individual model calls, including drawing-coordination assessments, using the native Claude SDK or Codex app-server. Images and structured output cross the same model boundary. Independent calls use separate native sessions; a session stays alive across a tool batch until the server supplies all authorized results. For a bounded review, `--stopAfterIssues 2` stops the root and its children after two newly filed issues; an in-flight batch can exceed the threshold. `--concurrency` defaults to 5 active model calls. Tool and approval waits release compute capacity, so `--concurrency 1` can process children and nested assessment calls. `--maxThreads` (default 100) and `--maxRunSeconds` (default 3600) bound each authorization. `specset harness limits` saves all three in config.yml, so a plain `agent serve` uses them. Stop cancels the subtree, queued jobs and workflow tools; it never falls back to cloud execution. A lost native continuation fails instead of replaying possible writes. Restarting the command registers a new machine session and requires a new root assignment.
 
-At startup the runner lists each account's models (Codex's app-server catalog, Claude's supported models, `agy models`), which tell it which accounts offer each tier's model, and reports them with its registration, with its accounts and tiers; the conversation's Settings shows them under the harness model and pins a class or one model per harness for the thread, with an effort level from the chosen model's reported levels. Specset's `--autoApprove` message setting controls server tool approval. Specset tools execute on the server, with approvals in the web app; the native harness receives their results through the runner. Native tools are off unless the conversation's **Native tools** setting is on; then the harness may run shell commands and read or edit files in the run's workspace within the thread's Permissions setting, every action is mirrored into the conversation as a local action, and native sub-agents stay off. Each run (root thread and its children) gets one workspace under `--directory` (`~/.specset/personal-runs/<runner>/runs/<thread>/` by default) with `specs/`, `drawings/`, `docs/`, `inputs/` and `out/`; the harness downloads what it needs with the `specset` CLI, which is logged in as you for that host and organization inside the session's private home, and `.specset/manifest.json` records each file's Specset link, version id and checksum so a repeated download is skipped unless the version changed. Files under `out/` are uploaded and attached to the root thread after each turn that used native tools and when the run ends; the workspace is removed once its run has ended (checked when the runner starts and stops and every ten minutes), or after seven untouched days. Jobs receive a minimal environment and private harness configuration. Claude shares the selected native credential store and refresh lock while settings stay private. Codex uses an authentication-only native process for the selected login; inference sessions receive temporary access tokens and never copy refresh credentials. User settings, hooks, plugins, and other MCP servers are not loaded into inference sessions. Log in with `claude auth login` before starting a Claude runner. Antigravity runs `agy` in print mode with a private home: the Specset tools reach it as an MCP server on a loopback port with a per-session token, the instructions as a system message, attachments as files it reads with `view_file`, and a pre-tool hook refuses everything else (shell, edits, browser, web search), so it never takes a call with Native tools on. agy gives up on a tool call after three minutes; a Specset tool still running then answers that it is, and the model waits for it with `specset_wait_for_result`. This is a personal runner executing selected project content as the local OS user, **not an OS sandbox**: native harness permissions and the host remain security boundaries. Use a separate OS account or isolated host when that content is untrusted. Do not treat this as an organization-wide shared runner.
+At startup the runner lists each account's models (Codex's app-server catalog, Claude's supported models, `agy models`), which tell it which accounts offer each tier's model, and reports them with its registration, with its accounts and tiers; the conversation's Settings shows them under the harness model and pins a class or one model per harness for the thread, with an effort level from the chosen model's reported levels. Specset's `--autoApprove` message setting controls server tool approval. Specset tools execute on the server, with approvals in the web app; the native harness receives their results through the runner. With the conversation's **Native tools** setting on (the default for a thread that starts running locally), the harness may run shell commands and read or edit files in the run's workspace within the thread's Permissions setting, sealed there in every mode (no network, nothing of the machine readable but the system and its developer tools, no credentials; macOS only; Claude Code's own file tools are held to the workspace by a check made before it opens the path, which a command left running in the background can race), every action is mirrored into the conversation as a local action, and native sub-agents stay off. Each run (root thread and its children) gets one workspace under `--directory` (`~/.specset/personal-runs/<runner>/runs/<thread>/` by default) with `specs/`, `drawings/`, `docs/`, `inputs/` and `out/`; project material comes through Specset tools, and the harness writes what it needs from their results into the workspace. Files under `out/` are uploaded and attached to the root thread after each turn that used native tools and when the run ends; the workspace is removed once its run has ended (checked when the runner starts and stops and every ten minutes), or after seven untouched days. Jobs receive a minimal environment and private harness configuration. Claude shares the selected native credential store and refresh lock while settings stay private. Codex uses an authentication-only native process for the selected login; inference sessions receive temporary access tokens and never copy refresh credentials. User settings, hooks, plugins, and other MCP servers are not loaded into inference sessions. Log in with `claude auth login` before starting a Claude runner. Antigravity runs `agy` in print mode with a private home: the Specset tools reach it as an MCP server on a loopback port with a per-session token, the instructions as a system message, attachments as files it reads with `view_file`, and a pre-tool hook refuses everything else (shell, edits, browser, web search) unless the native-tool checks below hold. A runner lets Antigravity run native tools only once its own check holds: macOS, an `agy --version` this CLI's sandbox settings were checked against (1.4.2), and the owner's sign-off, set by hand in config.yml after running the sandbox escape tests on that release:
+
+```yaml
+runner:
+  antigravityNativeTools:
+    escapeTestedVersion: "1.4.2"   # the agy release the escape tests passed on; quote it
+```
+
+Then a native-tool step runs `agy --sandbox`: commands run in agy's Seatbelt sandbox with a private `TMPDIR`, no network and no Specset CLI, and the shared and user temp directories, `~/.config`, Homebrew's `var` and the credential paths above stay closed to them; the pre-tool hook holds agy's file tools to absolute, real paths in the run's workspace and refuses writes to agy's own configuration (`.agents/`, `AGENTS.md`, `GEMINI.md`). Attachments and the documents Specset tools return are saved outside the shared workspace in private, read-only input storage; copy them into the workspace to edit them. agy launches from a separate read-only project directory beneath its private HOME, so hooks or MCP configuration another harness plants in the shared workspace are not loaded, including during a tool wait. Recursive native searches (`grep_search`, `find_by_name`) are disabled because checking the search root cannot constrain symlinks encountered during an unsandboxed traversal; search through sandboxed commands is available in Auto/Full modes. Its file tools run outside the command sandbox: a concurrent command can still race the path check by replacing a checked path with a symlink, as with Claude Code's file tools. A different agy release, which agy can install by updating itself, or a sign-off for another release, turns native tools off again until the escape tests pass on it and the sign-off names it. The app's tier labels still report Antigravity as lacking native tools, and helper document reads still run there without code execution; the runner's checked capability controls native tools on agent steps. The clipboard and macOS services stay reachable from agy's sandbox (an accepted risk; Claude Code's Bash has the same exposure). agy gives up on a tool call after three minutes; a Specset tool still running then answers that it is, and the model waits for it with `specset_wait_for_result`. This is a personal runner executing selected project content as the local OS user, **not an OS sandbox**: native harness permissions and the host remain security boundaries. Use a separate OS account or isolated host when that content is untrusted. Do not treat this as an organization-wide shared runner.
+
+To repeat the repository's opt-in live sandbox check on macOS with Homebrew Python and an existing agy login, run `ANTIGRAVITY_SANDBOX_TEST=1 CI=true yarn nx run cli:test -- antigravitySandbox.live`. It uses synthetic files under the real home in the production runner/session layout and the real session/MCP continuation, tests shared-workspace hooks and symlinks, and verifies filesystem and loopback denials inside an actual native command, including a synthetic home file outside the runner when the broad home denial is omitted. It does not change the owner's sign-off.
 
 Personal inference sessions set Claude's `persistSession: false` and Codex's `ephemeral: true`, keeping them out of the respective desktop histories. Specset remains the transcript and approval record.