@standardagents/code 0.13.7 → 0.13.8

package/README.md

@@ -67,8 +67,13 @@ we're letting new folks in every week.
   Work continues on that machine after you close the terminal, and a machine without a daemon
   still runs the full CLI as a watcher of sessions executing elsewhere.
 - **Permission-aware by design.** A single auto-accept level (1–5) controls what runs unattended;
-  anything riskier prompts you first. A catastrophic-command guard blocks dangerous shell calls
-  at *every* level, so you can't accidentally `rm -rf` your way into a bad day.
+  anything riskier prompts you first, and operations explicitly marked as requiring permission
+  prompt regardless of their numeric risk unless you previously granted that exact tool. A
+  catastrophic-command guard blocks dangerous shell calls at *every* level, so you can't
+  accidentally `rm -rf` your way into a bad day.
+- **Real project containment.** File destinations and background-process working directories are
+  checked through filesystem symlinks; any path that resolves outside the project always requires
+  a fresh human approval.
 - **Durable, resumable sessions.** Long-running and permission-gated calls *park* and resume over
   HTTP — a slow approval or a dropped socket can't kill your turn. Resume the same session from
   any machine.
@@ -152,6 +157,13 @@ and the command sets it up any time.
 Use `--endpoint [url]` or `-e [url]` to point a single CLI run at a different Standard Agents
 instance (local dev, self-hosted). If you omit the URL, the CLI prompts for it. Tokens are
 remembered per endpoint, but this override does not change the saved default endpoint.
+Endpoints without a scheme default to `https://`; using plaintext local development requires an
+explicit URL such as `http://localhost:5178`.
+
+For HTTPS on a loopback, private, `.local`, or `.localhost` endpoint, the CLI can relax certificate
+verification for its own instance connections. That process-local setting is stripped from every
+browser, shell, background process, package-manager, git, clipboard, and ripgrep child so local
+development never disables TLS verification in unrelated commands.
 
 ### Requirements
 
@@ -167,7 +179,8 @@ remembered per endpoint, but this override does not change the saved default end
 - **Forwarded tools** executed by the session's machine daemon: read/write/edit files, list,
   grep, glob, bash, delete.
 - **Permissions**: a single auto-accept level 1–5 (shift-tab cycles it); risky calls prompt;
-  a catastrophic-command guard blocks dangerous shell commands at every level.
+  server-marked permission requests cannot be downgraded by a model-supplied risk; a catastrophic-
+  command guard blocks dangerous shell commands at every level.
 - **Durable, resumable** long-running/permission-gated tool calls (park & resume over HTTP).
 - **Background processes** tracked in the thread (survive resume from any machine).
 - **Subagent delegation** and non-blocking web research.