specpi 0.35.0 → 0.36.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## 0.36.1 - 2026-09-27
+
+- Pin `specpi-lancet-guard` 0.3.0, which scores with LANCET Nano v0.4.1. Its weights, tokenizer and `classify.py` are identical to v0.4.0; only the `review` threshold drops from 0.819 to 0.303, so it asks about more borderline commands and blocks nothing v0.4.0 did not. On LANCET's release benchmark it catches 91.7% of risky commands, against 89.0%, and 77% of risky secrets commands, against 72%, while stopping 9.4% of safe ones, against 6.2%. The parity fixture is re-recorded with v0.4.1's `classify.py`: ids and scores are unchanged and two of 58 cases move from `not_flagged` to `review`. Users who update must run `/lancet-guard setup` again; a guard saved as on fails closed until they do. The root security model, third-party notes, README and website describe v0.4.1, and the website no longer says the guard stops fewer safe commands than Jev (9.4% against 7.8%). SpecPi Chat stays at 0.18.0.
+
+## 0.36.0 - 2026-09-27
+
+- Give the LANCET command guard its own page on the website, covering how it decides, what it costs to run, how it compares with Jev, and its limits. It is linked from every page header and from the package list. The README gains a section on it. The header moves its links onto their own row from 900 px, so ten links still fit at tablet widths.
+- Pin `specpi-lancet-guard` 0.2.0, which scores with LANCET Nano v0.4.0 (CodeT5+ 220M base, same tokenizer and runtime). On LANCET's release benchmark it catches 89.0% of risky commands, against 85.8%, and 72% of risky secrets commands, against 66%, while wrongly stopping 6.2% of safe ones, against 5.5%. The parity fixture is re-recorded with v0.4.0's `classify.py`. Users who update must run `/lancet-guard setup` again; a guard saved as on fails closed until they do. The root security model, third-party notes, README and website describe v0.4.0. SpecPi Chat stays at 0.18.0.
+
 ## 0.35.0 - 2026-09-26
 
 - Replace the Jev command guard with a local one. `specpi-lancet-guard` 0.1.0, new in `packages/lancet-guard`, takes the eighth pin from `specpi-jev-guard` 0.4.0. It scores shell commands with LANCET Nano v0.3.0, a 110M-parameter CodeT5-base classifier, on the CPU through ONNX Runtime: no API key, and commands never leave the machine. It keeps the Jev guard's local rules in front of the model. A risky verdict asks, Nano's unsure band asks, PowerShell and commands LANCET cannot read ask, and protected writes ask. A missing or damaged model fails closed.

package/NPM_RELEASE.md

@@ -6,7 +6,7 @@ Publishing, tags, deprecation, ownership changes and GitHub Releases require exp
 
 ## Prepare
 
-1. This candidate is SpecPi **0.35.0**, paired with the Chat **0.18.0** VSIX. Browser QA **0.3.0** and LANCET guard **0.1.0** are already independently published; do not republish or edit their source as part of this release. Choose an unused version; update `package.json`, the dated `CHANGELOG.md` entry, README, and the website. Check Chat's version and VSIX download links. Preserve historical changelog entries.
+1. This candidate is SpecPi **0.36.1**, paired with the Chat **0.18.0** VSIX. Browser QA **0.3.0** and LANCET guard **0.3.0** are already independently published; do not republish or edit their source as part of this release. Choose an unused version; update `package.json`, the dated `CHANGELOG.md` entry, README, and the website. Check Chat's version and VSIX download links. Preserve historical changelog entries.
 2. Validate:
 
     ```sh

package/README.md

@@ -28,7 +28,7 @@
 
 ---
 
-SpecPi 0.35.0 is a small starting point for the [Pi coding agent](https://pi.dev/). It is one opinionated setup for how the agent should work, not a marketplace of plugins.
+SpecPi 0.36.1 is a small starting point for the [Pi coding agent](https://pi.dev/). It is one opinionated setup for how the agent should work, not a marketplace of plugins.
 
 At the center are two built-in extensions. **Scope control** keeps each task to the files it said it would touch. The **improvement loop** turns repeated friction into small, tested changes to the setup, instead of letting prompts and workarounds pile up. Around those are eight hand-picked packages, each locked to an exact version and checked before anything installs, plus **SpecPi Chat**, a VS Code panel for working alongside the agent.
 
@@ -43,6 +43,19 @@ It focuses on five things:
 
 Everything it touches is written down, versioned, and easy to undo.
 
+## A local command guard
+
+Before the agent runs a shell command, [LANCET Nano](https://github.com/TannerMidd/LANCET-model), a 110M-parameter classifier, can check it on your own CPU. It takes about 23 ms, needs no API key, sends nothing over the network, and costs nothing per check. Fixed rules settle the obvious cases first, blocking `rm -rf /` and passing `git status`, and the model scores the rest. A risky or uncertain verdict asks you before anything runs.
+
+| | LANCET Nano (local) | Jev (hosted, previous guard) |
+| --- | ---: | ---: |
+| Risky commands caught | 91.7% | 96.8% |
+| Safe commands wrongly stopped | 9.4% | 7.8% |
+| Cost per check | $0 | per request |
+| Network | none | every check |
+
+Scores are from LANCET's 793-command release benchmark, classifier alone. The guard ships off. Run `/lancet-guard setup` in Pi once to download the model (about 100 MB, verified by SHA-256) and switch it on. [How it works, what it costs, and its limits](https://tannermidd.github.io/SpecPi/lancet/).
+
 ## Measured context
 
 This chart shows first-call context from a clean install: all eight pinned packages, the working agreement, and the skills Pi finds, in an interactive session with wishlist collection undecided. A headless session, or one with collection off, also leaves out the gap report and capability request tools. "Enabled" means browser QA, delegation, and web access are switched on, with no goal, scope, or improvement selection active.
@@ -135,6 +148,7 @@ Full setup options, package details, and requirements: [website](https://tannerm
 | --- | --- |
 | [Packages](https://tannermidd.github.io/SpecPi/#packages) | The eight pinned packages and what each provides |
 | [Scope control](https://tannermidd.github.io/SpecPi/wiki/#scope) | `/scope` commands and drift monitoring |
+| [Command guard](https://tannermidd.github.io/SpecPi/lancet/) | LANCET, the local classifier that checks shell commands before they run |
 | [Improvement loop](https://tannermidd.github.io/SpecPi/#loop) | Local wishlist, `/harness-improvement`, and retirement with evidence |
 | [SpecPi Chat](https://tannermidd.github.io/SpecPi/#vscode-chat) | VS Code frontend and VSIX install · [Chat guide](https://github.com/TannerMidd/SpecPi/blob/main/vscode/README.md) |
 | [Updating](https://tannermidd.github.io/SpecPi/#updating) | Update, uninstall, and migration notes |

package/SECURITY_MODEL.md

@@ -62,7 +62,7 @@ Settings live in `<agent-dir>/specpi/jev/settings.json`, written atomically with
 
 `specpi-lancet-guard` is pinned in the base set and ships **off**. SpecPi writes nothing into its configuration: the package's own default is off, and only its own `/lancet-guard on` (this session) or `/lancet-guard on --global` (saved in `<home>/.pi/lancet-guard.json`) turns it on. An installer run never arms or disarms it, so a saved choice survives every update. `@gotgenes/pi-permission-system` stays pinned and decides every tool call whether the guard is on or off; the guard is a second, independent check: either one can block a call, so the guard never allows what the permission system would refuse.
 
-When on, local rules copied from `specpi-jev-guard` decide first -- hard-deny patterns block, provably read-only commands and the user's allow globs pass -- and LANCET Nano v0.3.0, a 110M-parameter CodeT5-base classifier, scores the rest of `bash`, `powershell` and `background` commands in-process on the CPU through ONNX Runtime. `risky` asks (or blocks, if configured), `review` -- the band Nano is unsure about -- asks, `not_flagged` runs, and what LANCET cannot read (PowerShell, over-long input) asks. Writes and edits to protected or out-of-workspace paths ask without a model call. With no UI, an ask becomes a block unless `uncertain` is `allow`. A missing, damaged or unloadable model blocks what the rules leave open: switching the guard on accepts that, and `/lancet-guard on` is refused until the model is installed. `not_flagged` is not a safety claim; on LANCET's own 793-command release benchmark the classifier alone caught 85.8% of risky commands and 66% of risky secrets commands, against 96.8% and 98% for Jev.
+When on, local rules copied from `specpi-jev-guard` decide first -- hard-deny patterns block, provably read-only commands and the user's allow globs pass -- and LANCET Nano v0.4.1, a 110M-parameter CodeT5+ 220M classifier, scores the rest of `bash`, `powershell` and `background` commands in-process on the CPU through ONNX Runtime. `risky` asks (or blocks, if configured), `review` -- the band Nano is unsure about -- asks, `not_flagged` runs, and what LANCET cannot read (PowerShell, over-long input) asks. Writes and edits to protected or out-of-workspace paths ask without a model call. With no UI, an ask becomes a block unless `uncertain` is `allow`. A missing, damaged or unloadable model blocks what the rules leave open: switching the guard on accepts that, and `/lancet-guard on` is refused until the model is installed. `not_flagged` is not a safety claim; on LANCET's own 793-command release benchmark the classifier alone caught 91.7% of risky commands and 77% of risky secrets commands, against 96.8% and 98% for Jev. Updating the guard to a release that pins a new model leaves the old model unused: a guard saved as on fails closed until `/lancet-guard setup` fetches the new one.
 
 Commands never leave the machine and are never executed by the guard. The only network access is `/lancet-guard setup`, run by a human: it downloads one ZIP from the pinned `TannerMidd/LANCET-model` GitHub release into a private staging directory, capped at its pinned size, and refuses it unless its SHA-256 matches the digest compiled into the package. Only then does the package's own small ZIP reader extract the three model files, each inflated to its pinned size and refused unless its own SHA-256 matches. GitHub is the only host involved, so it works where Hugging Face is blocked. The digests are checked again on every load. The package's one production dependency, `onnxruntime-node` 1.30.0, is pinned exactly; its install script would fetch CUDA libraries on Linux x64, so the installer sets `ONNXRUNTIME_NODE_INSTALL=skip`.
 

package/THIRD_PARTY.md

@@ -11,7 +11,7 @@ Development formatting uses Prettier **3.9.6** (MIT), ESLint **10.9.1** (MIT), `
 
 ## Default packages
 
-Reviewed on 2026-09-16 against published npm metadata and integrity-verified source archives, and `specpi-lancet-guard` 0.1.0, which replaces `specpi-jev-guard` 0.4.0, from source in this repository. All eight top-level packages declare the MIT license. Pins are authoritative in `templates/settings.json`.
+Reviewed on 2026-09-16 against published npm metadata and integrity-verified source archives, and `specpi-lancet-guard` 0.3.0, which replaces `specpi-jev-guard` 0.4.0, from source in this repository. All eight top-level packages declare the MIT license. Pins are authoritative in `templates/settings.json`.
 
 SpecPi requests exact npm dependency saves for these pins and checks installed top-level versions before completing installation. The override applies to package acquisition without changing the user's global npm configuration.
 
@@ -42,7 +42,7 @@ Worth stating plainly, because it is the part a reader is most likely to assume
 
 ## LANCET command guard
 
-`packages/lancet-guard` is first-party source, released independently as `specpi-lancet-guard`. Its one production dependency is `onnxruntime-node` 1.30.0 (MIT, Microsoft), pinned exactly, which bundles prebuilt ONNX Runtime CPU libraries; SpecPi's installer sets `ONNXRUNTIME_NODE_INSTALL=skip` so its install script does not fetch the CUDA libraries it would otherwise download on Linux x64. Its local rules are copied under MIT from `specpi-jev-guard` 0.4.0. The model is not bundled: `/lancet-guard setup` downloads LANCET Nano v0.3.0 (Apache-2.0) from the `TannerMidd/LANCET-model` GitHub release, pinned by SHA-256. It was fine-tuned from Salesforce CodeT5-base (Apache-2.0); its model card and notices in the release record the training-data sources. The guard makes no other network connection. See its [dependency notices](packages/lancet-guard/THIRD_PARTY.md) and [security boundary](packages/lancet-guard/SECURITY.md).
+`packages/lancet-guard` is first-party source, released independently as `specpi-lancet-guard`. Its one production dependency is `onnxruntime-node` 1.30.0 (MIT, Microsoft), pinned exactly, which bundles prebuilt ONNX Runtime CPU libraries; SpecPi's installer sets `ONNXRUNTIME_NODE_INSTALL=skip` so its install script does not fetch the CUDA libraries it would otherwise download on Linux x64. Its local rules are copied under MIT from `specpi-jev-guard` 0.4.0. The model is not bundled: `/lancet-guard setup` downloads LANCET Nano v0.4.1 (Apache-2.0) from the `TannerMidd/LANCET-model` GitHub release, pinned by SHA-256. It was fine-tuned from Salesforce CodeT5+ 220M (BSD-3-Clause); its model card and notices in the release record the training-data sources. The guard makes no other network connection. See its [dependency notices](packages/lancet-guard/THIRD_PARTY.md) and [security boundary](packages/lancet-guard/SECURITY.md).
 
 ## Standalone delegation and experiments
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specpi",
-  "version": "0.35.0",
+  "version": "0.36.1",
   "description": "Scope control and a human-selected harness improvement loop for Pi",
   "author": "Tanner Middleton",
   "repository": {

package/scripts/lancet-guard.mjs

@@ -15,7 +15,7 @@ import os from "node:os";
 import path from "node:path";
 
 /** Must match the pin in templates/settings.json. */
-export const GUARD_PIN = "npm:specpi-lancet-guard@0.1.0";
+export const GUARD_PIN = "npm:specpi-lancet-guard@0.3.0";
 
 export const RETIRED_GUARD_PIN = "npm:specpi-jev-guard@0.4.0";
 

package/templates/settings.json

@@ -7,6 +7,6 @@
         "npm:pi-goal-x@0.31.2",
         "npm:@sreetej510/pi-usage@0.10.0",
         "npm:@gotgenes/pi-permission-system@32.0.2",
-        "npm:specpi-lancet-guard@0.1.0"
+        "npm:specpi-lancet-guard@0.3.0"
     ]
 }