@tendrilapp/cli 0.1.26 → 0.1.28

package/dist/SKILL.md

@@ -28,16 +28,29 @@ settings file the host merges — the project's
 `.claude/settings.local.json` or `.claude/settings.json`, or the
 user's `~/.claude/settings.json` — contains tendril MCP entries
 (plugin installs use `mcp__plugin_tendril_tendril__*`; direct
-`claude mcp add` installs use `mcp__<server-name>__*`). If none does,
-BEFORE the first recording call, tell the user one approval can
-replace every pipeline prompt and offer `tendril_permissions` with
-`write: true` — it merges the per-tool allowlist into the project's
-settings.local.json (idempotent, touches nothing else; note it writes
-PLUGIN-prefixed names — a direct-install user should run
-`tendril permissions --claude` and adapt the prefix instead) and the
-user must reload the session to apply; say that out loud. Offer ONCE
-per session; never run it unoffered (it edits the user's settings),
-and if declined, proceed without mentioning it again.
+`claude mcp add` installs use `mcp__<server-name>__*`) AND shell-
+surface entries (`Bash(ls:*)`-style prefixes plus `Write`/`Edit`).
+THE MCP LIST ALONE IS NOT "PERMISSIONS ARE FINE": a run is mostly
+shell — mkdir, evidence reads, log writes, the printed npx commands —
+and a measured session whose every MCP call was covered still put
+~300 shell decisions to the user because this check certified only
+the MCP half. If either half is missing, BEFORE the first recording
+call, tell the user one approval can replace every pipeline prompt
+and offer `tendril_permissions` with `write: true` — it merges the
+per-tool allowlist PLUS the run's shell surface and project-scoped
+Write/Edit (with deny guards so that grant can never touch
+`./.claude/**` or `./.git/**`) into the project's
+settings.local.json (idempotent, touches nothing else; note it
+writes PLUGIN-prefixed names — a direct-install user should run
+`tendril permissions --claude` and adapt the prefix instead). These
+are CONVENIENCE grants, not a security boundary — the command's
+output names what they trade (read verbs read any file without
+prompting; host Bash patterns are best-effort prefix matches; the
+CLI subcommand grants carry the CLI's own write surface). RELAY that
+note to the user with the offer, never soften it, and say the user
+must reload the session to apply. Offer ONCE per session; never run
+it unoffered (it edits the user's settings), and if declined,
+proceed without mentioning it again.
 
 Long generator/score waits: silence is not a health signal, and POLL
 cadence is not RELAY cadence (run 13: rounds landed 6–11 minutes apart,
@@ -171,11 +184,13 @@ Batch runs (several components in one session):
    Figma MCP calls in protocol order — get_metadata, then
    get_design_context (excludeScreenshot=true), then get_screenshot —
    and then ONE `tendril_record_ingest_rep` carrying all three:
-   metadata and context response text passed VERBATIM — real
-   responses arrive as MULTIPLE output blocks, so
-   `metadataParts`/`contextParts` (every block in order, never
-   hand-joined) is the normal path; `metadata`/`context` only for a
-   genuinely single-block response — plus the screenshot
+   metadata and context response text passed VERBATIM — responses
+   often arrive as MULTIPLE output blocks (block counts vary BY
+   TRANSPORT: the desktop server has been measured at 2-4 blocks per
+   response, the remote server at 1-2 — never treat any count as a
+   sanity check), so `metadataParts`/`contextParts` (every block in
+   order, never hand-joined) is the normal path; `metadata`/`context`
+   only for a genuinely single-block response — plus the screenshot
    `screenshotUrl` — no files
    to write, no envelope to build, and never download the image
    yourself. Every ingest response carries `next` (never call
@@ -278,6 +293,15 @@ Batch runs (several components in one session):
    no prices or percentages (they go stale). Non-interactive runs
    pick the balanced tier and state the reason in the report. Always
    pass the choice via --host/--model (self-reported provenance).
+   CONSENT GATES AUTO-RESOLVED IN A NON-INTERACTIVE RUN — the model
+   pick, the parallel-recording decision — must open the FINAL REPORT,
+   first lines, not sit in a log: the user learns what was decided for
+   them before they read anything else. (Measured: an autonomy setting
+   converted both gates into buried deviations while the user sat
+   present and wanted to be asked. The non-interactive branch is for
+   genuinely headless runs; it cannot tell "nobody is there" from "the
+   harness said nobody is there", so it must at least say what it did,
+   loudly and first.)
    Weak models produce honest sub-bar reports, never false passes.
 6. Tell the user roughly what a run costs them: organism-scale
    components have measured 0.3–0.7M tokens of their plan.

package/dist/tendril-mcp.js

@@ -66,7 +66,7 @@ var TOOLS = [
   },
   {
     name: "tendril_permissions",
-    description: "Install the Claude Code permission allowlist for the Tendril pipeline (write: true \u2014 merges per-tool entries into the project's .claude/settings.local.json, idempotent, never touches other settings), or list the entries without writing. OFFER THIS AT PIPELINE START whenever NO merged Claude settings file (project .claude/settings.local.json or .claude/settings.json, or user ~/.claude/settings.json) contains tendril MCP entries \u2014 plugin installs use mcp__plugin_tendril_tendril__*, direct claude-mcp-add installs use mcp__<server>__* (for those, write:true installs PLUGIN-prefixed names that will not match: list without writing and adapt the prefix instead). A FILE check, never prompt-watching \u2014 agents cannot observe permission prompts. ONE approval here replaces a prompt per pipeline call. Never run it unoffered; the user must reload the session for new settings to apply \u2014 say so.",
+    description: "Install the Claude Code permission allowlist for the Tendril pipeline (write: true \u2014 merges the MCP per-tool entries, the run's shell surface, and project-scoped Write/Edit with deny guards for ./.claude and ./.git into the project's .claude/settings.local.json, idempotent, never touches other keys), or list the entries without writing. The shell/Write grants are CONVENIENCE, not a security boundary \u2014 the output's note names exactly what they trade; RELAY it with the offer. OFFER THIS AT PIPELINE START whenever NO merged Claude settings file (project .claude/settings.local.json or .claude/settings.json, or user ~/.claude/settings.json) contains tendril MCP entries \u2014 plugin installs use mcp__plugin_tendril_tendril__*, direct claude-mcp-add installs use mcp__<server>__* (for those, write:true installs PLUGIN-prefixed names that will not match: list without writing and adapt the prefix instead). A FILE check, never prompt-watching \u2014 agents cannot observe permission prompts. ONE approval here replaces a prompt per pipeline call. Never run it unoffered; the user must reload the session for new settings to apply \u2014 say so.",
     schema: z.object({
       write: z.boolean().optional().describe("true = install into .claude/settings.local.json (the point of this tool); false/absent = just return the entries")
     }),
@@ -226,7 +226,7 @@ var TOOLS = [
   },
   {
     name: "tendril_engine_score",
-    description: "AGENT-HARNESS engine, step 2 (the oracle): scores a candidate bundle directory against recorded truth \u2014 per-config pixels, behaviors, hover parity \u2014 and returns feedback plus evidence artifacts. Iterate until allPass or two non-improving rounds. Only THIS tool's output counts as a score; never claim numbers yourself.",
+    description: "AGENT-HARNESS engine, step 2 (the oracle): scores a candidate bundle directory against recorded truth \u2014 per-config pixels, behaviors, state parity (recording-selected \u2014 a bundle cannot unschedule it) \u2014 and returns feedback plus evidence artifacts. Iterate until allPass or two non-improving rounds. Only THIS tool's output counts as a score; never claim numbers yourself.",
     schema: z.object({
       taskOrSet: str("reference task name or recording-set directory"),
       candidateDir: str("directory containing the proposed bundle files"),