@tendrilapp/cli 0.1.27 → 0.1.29

package/dist/SKILL.md

@@ -28,16 +28,40 @@ settings file the host merges — the project's
 `.claude/settings.local.json` or `.claude/settings.json`, or the
 user's `~/.claude/settings.json` — contains tendril MCP entries
 (plugin installs use `mcp__plugin_tendril_tendril__*`; direct
-`claude mcp add` installs use `mcp__<server-name>__*`). If none does,
-BEFORE the first recording call, tell the user one approval can
-replace every pipeline prompt and offer `tendril_permissions` with
-`write: true` — it merges the per-tool allowlist into the project's
-settings.local.json (idempotent, touches nothing else; note it writes
-PLUGIN-prefixed names — a direct-install user should run
-`tendril permissions --claude` and adapt the prefix instead) and the
-user must reload the session to apply; say that out loud. Offer ONCE
-per session; never run it unoffered (it edits the user's settings),
-and if declined, proceed without mentioning it again.
+`claude mcp add` installs use `mcp__<server-name>__*`) AND shell-
+surface entries (`Bash(ls:*)`-style prefixes plus `Write`/`Edit`)
+AND Figma entries under the prefix THIS session's Figma tools
+actually carry — take a Figma tool you can see (e.g. get_metadata)
+and check its full `mcp__…` name against the allowlist; entries
+under a different server's prefix are dead and DO NOT count (a
+measured session held six such entries while every Figma call
+prompted).
+THE MCP LIST ALONE IS NOT "PERMISSIONS ARE FINE": a run is mostly
+shell — mkdir, evidence reads, log writes, the printed npx commands —
+and a measured session whose every MCP call was covered still put
+~300 shell decisions to the user because this check certified only
+the MCP half. If either half is missing, BEFORE the first recording
+call, tell the user one approval can replace every pipeline prompt
+and offer `tendril_permissions` with `write: true` — it merges the
+per-tool allowlist PLUS the run's shell surface and project-scoped
+Write/Edit (with deny guards so that grant can never touch
+`./.claude/**` or `./.git/**`) into the project's
+settings.local.json (idempotent, touches nothing else). PREFIXES:
+pass `figmaPrefix` (and `tendrilPrefix` for non-plugin installs)
+spelled exactly as THIS session names those tools — the part before
+`__get_metadata` — whenever they differ from the plugin defaults; a
+measured figma-remote session got six entries that could never
+match because the write assumed the plugin shape. These are
+CONVENIENCE grants, not a security boundary — the command's output
+names what they trade (read verbs read any file without prompting;
+host Bash patterns are best-effort prefix matches; the CLI
+subcommand grants carry the CLI's own write surface). RELAY that
+note to the user with the offer, never soften it, and say BOTH that
+a reload is required AND that the current session keeps prompting
+until then — the savings land next session; that is expected, not a
+failure. Offer ONCE per session; never run it unoffered (it edits
+the user's settings), and if declined, proceed without mentioning
+it again.
 
 Long generator/score waits: silence is not a health signal, and POLL
 cadence is not RELAY cadence (run 13: rounds landed 6–11 minutes apart,
@@ -171,11 +195,13 @@ Batch runs (several components in one session):
    Figma MCP calls in protocol order — get_metadata, then
    get_design_context (excludeScreenshot=true), then get_screenshot —
    and then ONE `tendril_record_ingest_rep` carrying all three:
-   metadata and context response text passed VERBATIM — real
-   responses arrive as MULTIPLE output blocks, so
-   `metadataParts`/`contextParts` (every block in order, never
-   hand-joined) is the normal path; `metadata`/`context` only for a
-   genuinely single-block response — plus the screenshot
+   metadata and context response text passed VERBATIM — responses
+   often arrive as MULTIPLE output blocks (block counts vary BY
+   TRANSPORT: the desktop server has been measured at 2-4 blocks per
+   response, the remote server at 1-2 — never treat any count as a
+   sanity check), so `metadataParts`/`contextParts` (every block in
+   order, never hand-joined) is the normal path; `metadata`/`context`
+   only for a genuinely single-block response — plus the screenshot
    `screenshotUrl` — no files
    to write, no envelope to build, and never download the image
    yourself. Every ingest response carries `next` (never call
@@ -278,6 +304,15 @@ Batch runs (several components in one session):
    no prices or percentages (they go stale). Non-interactive runs
    pick the balanced tier and state the reason in the report. Always
    pass the choice via --host/--model (self-reported provenance).
+   CONSENT GATES AUTO-RESOLVED IN A NON-INTERACTIVE RUN — the model
+   pick, the parallel-recording decision — must open the FINAL REPORT,
+   first lines, not sit in a log: the user learns what was decided for
+   them before they read anything else. (Measured: an autonomy setting
+   converted both gates into buried deviations while the user sat
+   present and wanted to be asked. The non-interactive branch is for
+   genuinely headless runs; it cannot tell "nobody is there" from "the
+   harness said nobody is there", so it must at least say what it did,
+   loudly and first.)
    Weak models produce honest sub-bar reports, never false passes.
 6. Tell the user roughly what a run costs them: organism-scale
    components have measured 0.3–0.7M tokens of their plan.

package/dist/tendril-mcp.js

@@ -66,11 +66,19 @@ var TOOLS = [
   },
   {
     name: "tendril_permissions",
-    description: "Install the Claude Code permission allowlist for the Tendril pipeline (write: true \u2014 merges per-tool entries into the project's .claude/settings.local.json, idempotent, never touches other settings), or list the entries without writing. OFFER THIS AT PIPELINE START whenever NO merged Claude settings file (project .claude/settings.local.json or .claude/settings.json, or user ~/.claude/settings.json) contains tendril MCP entries \u2014 plugin installs use mcp__plugin_tendril_tendril__*, direct claude-mcp-add installs use mcp__<server>__* (for those, write:true installs PLUGIN-prefixed names that will not match: list without writing and adapt the prefix instead). A FILE check, never prompt-watching \u2014 agents cannot observe permission prompts. ONE approval here replaces a prompt per pipeline call. Never run it unoffered; the user must reload the session for new settings to apply \u2014 say so.",
+    description: "Install the Claude Code permission allowlist for the Tendril pipeline (write: true \u2014 merges the MCP per-tool entries, the run's shell surface, and project-scoped Write/Edit with deny guards for ./.claude and ./.git into the project's .claude/settings.local.json, idempotent, never touches other keys), or list the entries without writing. The shell/Write grants are CONVENIENCE, not a security boundary \u2014 the output's note names exactly what they trade; RELAY it with the offer. OFFER THIS AT PIPELINE START whenever NO merged Claude settings file (project .claude/settings.local.json or .claude/settings.json, or user ~/.claude/settings.json) contains tendril MCP entries \u2014 plugin installs use mcp__plugin_tendril_tendril__*, direct claude-mcp-add installs use mcp__<server>__* \u2014 when this session's tool names differ from the plugin defaults, pass figmaPrefix/tendrilPrefix with the prefixes you actually see, or the written entries never match. A FILE check, never prompt-watching \u2014 agents cannot observe permission prompts. ONE approval here replaces a prompt per pipeline call. Never run it unoffered; the user must reload the session for new settings to apply \u2014 say so.",
     schema: z.object({
-      write: z.boolean().optional().describe("true = install into .claude/settings.local.json (the point of this tool); false/absent = just return the entries")
+      write: z.boolean().optional().describe("true = install into .claude/settings.local.json (the point of this tool); false/absent = just return the entries"),
+      figmaPrefix: z.string().optional().describe("The Figma server's entry prefix AS THIS SESSION NAMES ITS TOOLS \u2014 the part before __get_metadata (e.g. mcp__figma-remote, mcp__plugin_figma_figma). Pass it whenever the session's Figma tools are not mcp__plugin_figma_figma__* \u2014 entries written under the wrong prefix never match anything (measured: six dead entries in a figma-remote session)."),
+      tendrilPrefix: z.string().optional().describe("Same for the tendril server when this session's tendril tools are not mcp__plugin_tendril_tendril__* (e.g. mcp__tendril for claude mcp add installs).")
     }),
-    argv: (i) => ["permissions", "--claude", ...i["write"] === true ? ["--write"] : []]
+    argv: (i) => [
+      "permissions",
+      "--claude",
+      ...i["write"] === true ? ["--write"] : [],
+      ...typeof i["figmaPrefix"] === "string" ? ["--figma-prefix", i["figmaPrefix"]] : [],
+      ...typeof i["tendrilPrefix"] === "string" ? ["--tendril-prefix", i["tendrilPrefix"]] : []
+    ]
   },
   {
     name: "tendril_doctor",
@@ -195,7 +203,7 @@ var TOOLS = [
   {
     name: "tendril_record_status",
     annotations: { readOnlyHint: true },
-    description: "Recording-set completeness: per-rep recorded/missing tools.",
+    description: "Recording-set completeness: per-rep recorded/missing tools, files that exist but are unusable (invalid \u2014 re-record those), and whether the set-level token map is recorded. `complete` means USABLE by the next pipeline step, including the set-level get_variable_defs.",
     schema: z.object({ setDir: str("recording set directory") }),
     argv: (i) => ["record", "status", "--set", i["setDir"]]
   },
@@ -226,7 +234,7 @@ var TOOLS = [
   },
   {
     name: "tendril_engine_score",
-    description: "AGENT-HARNESS engine, step 2 (the oracle): scores a candidate bundle directory against recorded truth \u2014 per-config pixels, behaviors, hover parity \u2014 and returns feedback plus evidence artifacts. Iterate until allPass or two non-improving rounds. Only THIS tool's output counts as a score; never claim numbers yourself.",
+    description: "AGENT-HARNESS engine, step 2 (the oracle): scores a candidate bundle directory against recorded truth \u2014 per-config pixels, behaviors, state parity (recording-selected \u2014 a bundle cannot unschedule it) \u2014 and returns feedback plus evidence artifacts. Iterate until allPass or two non-improving rounds. Only THIS tool's output counts as a score; never claim numbers yourself.",
     schema: z.object({
       taskOrSet: str("reference task name or recording-set directory"),
       candidateDir: str("directory containing the proposed bundle files"),