@tendrilapp/cli 0.1.55 → 0.1.56

package/dist/SKILL.md

@@ -20,48 +20,25 @@ Non-negotiables (the CLI enforces these; do not fight them):
 - Sub-bar results are honest, not failures to hide: exit 5 ships the
   bundle with real scores. Report them as they are.
 
-Permissions, FIRST THING in every pipeline run (the trigger is a FILE
-CHECK, not prompt-watching — you cannot observe permission prompts, so
-never condition on them; a measured session full of prompts had a
-prompt-conditioned offer never fire): check whether ANY Claude
-settings file the host merges — the project's
-`.claude/settings.local.json` or `.claude/settings.json`, or the
-user's `~/.claude/settings.json` — contains tendril MCP entries
-(plugin installs use `mcp__plugin_tendril_tendril__*`; direct
-`claude mcp add` installs use `mcp__<server-name>__*`) AND shell-
-surface entries (`Bash(ls:*)`-style prefixes plus `Write`/`Edit`)
-AND Figma entries under the prefix THIS session's Figma tools
-actually carry — take a Figma tool you can see (e.g. get_metadata)
-and check its full `mcp__…` name against the allowlist; entries
-under a different server's prefix are dead and DO NOT count (a
-measured session held six such entries while every Figma call
-prompted).
-THE MCP LIST ALONE IS NOT "PERMISSIONS ARE FINE": a run is mostly
-shell — mkdir, evidence reads, log writes, the printed npx commands —
-and a measured session whose every MCP call was covered still put
-~300 shell decisions to the user because this check certified only
-the MCP half. If either half is missing, BEFORE the first recording
-call, tell the user one approval can replace every pipeline prompt
-and offer `tendril_permissions` with `write: true` — it merges the
-per-tool allowlist PLUS the run's shell surface and project-scoped
-Write/Edit (with deny guards so that grant can never touch
-`./.claude/**` or `./.git/**`) into the project's
-settings.local.json (idempotent, touches nothing else). PREFIXES:
-pass `figmaPrefix` (and `tendrilPrefix` for non-plugin installs)
-spelled exactly as THIS session names those tools — the part before
-`__get_metadata` — whenever they differ from the plugin defaults; a
-measured figma-remote session got six entries that could never
-match because the write assumed the plugin shape. These are
-CONVENIENCE grants, not a security boundary — the command's output
-names what they trade (read verbs read any file without prompting;
-host Bash patterns are best-effort prefix matches; the CLI
-subcommand grants carry the CLI's own write surface). RELAY that
-note to the user with the offer, never soften it, and say BOTH that
-a reload is required AND that the current session keeps prompting
-until then — the savings land next session; that is expected, not a
-failure. Offer ONCE per session; never run it unoffered (it edits
-the user's settings), and if declined, proceed without mentioning
-it again.
+Permissions: do nothing up front. Hosts now default to auto/allow
+modes where pipeline calls never prompt, and an unprompted consent
+dialog is itself the alarm it claims to prevent. Act ONLY on
+observable evidence of the ask-mode case — you cannot see the host's
+permission prompts (measured: a session full of prompts had a
+prompt-conditioned offer never fire), but you CAN see a denied or
+long-pending tool call, and the user can tell you they are being
+prompted for everything. When that evidence exists, name the
+one-command fix ONCE and let them decide: `tendril_permissions` with
+`write: true` merges the pipeline's per-tool allowlist plus the run's
+shell surface and project-scoped Write/Edit (deny guards keep the
+grant out of `./.claude/**` and `./.git/**`) into the project's
+settings.local.json — idempotent, touches nothing else. Pass
+`figmaPrefix`/`tendrilPrefix` exactly as THIS session names those
+tools when they differ from the plugin defaults. These are
+CONVENIENCE grants, not a security boundary — relay the command's own
+trade-off note unsoftened, and say that a reload is required and the
+current session keeps prompting until then. Never run it unasked; if
+declined, proceed and drop the subject.
 
 Long generator/score waits: silence is not a health signal, and POLL
 cadence is not RELAY cadence (run 13: rounds landed 6–11 minutes apart,