pando-ai 1.1.7 → 1.2.0

package/README.md

@@ -91,56 +91,18 @@ Shell remains available for tests, builds, package managers, generated files,
 unsupported languages, and tasks where a structured Pando operation is not the
 right tool.
 
-### Workspace sandbox and privileged helper
+### MCP process model
 
-Supervised launches split Pando into two MCP roles:
-
-- `pando` runs trusted read/search/planning/index operations.
-- `pando` runs model-triggered workspace mutation and shell commands.
-
-The workspace role re-execs into the OS sandbox before serving mutating tools.
-On macOS this uses Seatbelt; on Linux it uses bubblewrap. The sandbox is
-configured to allow the project root, sandbox-local home/cache/temp directories,
-and the minimal runtime/toolchain paths needed to start common commands. Network
-and local sockets are allowed. There is no silent unsandboxed fallback for workspace
-mutation.
-
-Install-time security setup provisions dedicated local users (`pando-ai-ws` and
-`pando-ai-core`), grants access to Pando's data root, and installs a root-owned
-helper daemon. It does not recursively ACL the shell's current directory, so the
-installer can be run from anywhere.
-
-On the first supervised launch from a project, Pando automatically configures
-that repo's tracked ACLs before starting Codex or Claude. There is no older
-direct MCP fallback in supervised mode: role-scoped MCP servers always start via
-the security helper. The helper is intentionally narrow: it can only launch
-Pando's known roles for validated project roots over stdio. It is not a general
-command runner and does not accept custom argv, shells, or arbitrary commands.
-
-The helper entrypoint is:
-
-```bash
-pando-ai security launch --role <core|workspace> --project-root <path> --stdio
-```
-
-The unprivileged CLI validates the request, connects to the local helper socket,
-and sends only the fixed launch request. The root-owned daemon validates again,
-selects the role's dedicated user when privilege is available, starts the fixed
-Pando MCP server invocation, and lets the normal workspace sandbox apply before
-mutating tools are served.
-
-Security setup is normally invoked by install and launch, but can be run
-directly for diagnostics or admin automation:
-
-```bash
-pando-ai security setup-users --data-root ~/.pando-data --real-root /path/to/repo
-```
+Supervised launches register one `pando` MCP server per project. That single
+process owns indexing, file watching, read/search tools, snapshot operations,
+workspace edits, and shell execution. Pando no longer provisions dedicated
+local users, launches a privileged helper, or splits tools across core and
+workspace MCP roles.
 
 Diagnostics use the same JSONL log as the gateway and installer:
 `~/.pando-data/gateway-debug.jsonl` by default, or `PANDO_GATEWAY_LOG_FILE` when
 set. Logging is on by default and can be forced with `PANDO_DEBUG=1`; set
-`PANDO_DEBUG=0` to disable default helper logging. Useful event prefixes include
-`security_helper_client_*` and `security_helper_daemon_*`.
+`PANDO_DEBUG=0` to disable default logging.
 
 ### Supported model APIs
 
@@ -291,8 +253,6 @@ pando-ai serve [path]    # stdio MCP server for MCP clients
 pando-ai serve-http      # explicit HTTP MCP server for debugging/integrations
 pando-ai gateway         # run the firewall gateway in the foreground (debug)
 pando-ai proxy status|enable|disable [codex|claude]
-pando-ai security setup-users [--data-root <path>] [--real-root <path>]
-pando-ai security launch --role <core|workspace> --project-root <path> --stdio
 pando-ai login|logout|whoami
 pando-ai config set telemetry false
 ```
@@ -328,34 +288,10 @@ Use stdio MCP for agents:
 pando-ai serve /path/to/project
 ```
 
-Supervised Codex and Claude launches register two Pando MCP server entries for
-the same project:
-
-- `pando` exposes read, search, indexing, graph, planning, and snapshot
-  inspection tools.
-- `pando` exposes workspace-mutating tools such as rename, replace,
-  insert, delete, signature changes, filter-map-reduce, shell execution,
-  restore operations, and exclude-dir changes.
-
-The split is process-level. Each server process starts with a
-`PANDO_PROCESS_ROLE` value, and tools outside that role are not registered. A
-manual `pando-ai serve /path/to/project` command without `PANDO_PROCESS_ROLE`
-starts a combined server for direct integrations; supervised Codex and Claude
-launches use the split servers.
-
-The `pando` process re-execs into a local workspace sandbox by
-default. In that sandbox:
-
-- `HOME`, temp, and package-manager cache paths point under `.pando-sandbox/`.
-- Network and local sockets are allowed.
-- The process can read and write the project root.
-- Pando workspace data created by the sandboxed process stays sandbox-local.
-
-Auth is handled separately from the sandbox home. The launcher passes the user's
-real auth home through `PANDO_AUTH_HOME_OVERRIDE`, so the sandboxed workspace
-process can read the existing `~/.pando-ai/session.json` without making the
-real home its writable `HOME` and without opening network login inside the
-sandbox.
+Supervised Codex and Claude launches register one `pando` MCP server for the
+project. The same process exposes read, search, indexing, graph, planning,
+snapshot inspection, workspace mutation, shell execution, restore operations,
+and root/exclude-dir management.
 
 `serve-http` remains available as an explicit command for debugging or
 integrations that need HTTP: