specpi 0.36.1 → 0.36.2

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.36.2 - 2026-09-29
+
+- Pin `specpi-lancet-guard` 0.4.0, which scores with LANCET Nano v0.4.2, a newly trained model. Its architecture, tokenizer and `classify.py` are identical to v0.4.1, so the runtime is unchanged; the archive, model and `model.json` digests move, and so do the thresholds the model carries (`review` 0.527, `risky` 0.960). On LANCET's release benchmark it catches 92.4% of risky commands, against 91.7%, and 78% of risky secrets commands, against 77%, while stopping 9.9% of safe ones, against 9.4%. On LANCET's 513-command neutral set it stops 7.0% of safe commands, against 16.9%, and catches 91.0% of risky ones, against 66.5%. On ShellRisk-Bench's test split it catches less, 60.1% against 70.5%, at 2.7% of safe commands stopped. More of what it catches comes back as `review` rather than `risky`. The parity fixture is re-recorded with v0.4.2's `classify.py`: token ids are unchanged and 26 of 58 decisions keep their band. Users who update must run `/lancet-guard setup` again; a guard saved as on fails closed until they do. The README, security model, third-party notes and website carry v0.4.2's figures. SpecPi Chat stays at 0.18.0.
+
 ## 0.36.1 - 2026-09-27
 
 - Pin `specpi-lancet-guard` 0.3.0, which scores with LANCET Nano v0.4.1. Its weights, tokenizer and `classify.py` are identical to v0.4.0; only the `review` threshold drops from 0.819 to 0.303, so it asks about more borderline commands and blocks nothing v0.4.0 did not. On LANCET's release benchmark it catches 91.7% of risky commands, against 89.0%, and 77% of risky secrets commands, against 72%, while stopping 9.4% of safe ones, against 6.2%. The parity fixture is re-recorded with v0.4.1's `classify.py`: ids and scores are unchanged and two of 58 cases move from `not_flagged` to `review`. Users who update must run `/lancet-guard setup` again; a guard saved as on fails closed until they do. The root security model, third-party notes, README and website describe v0.4.1, and the website no longer says the guard stops fewer safe commands than Jev (9.4% against 7.8%). SpecPi Chat stays at 0.18.0.

package/NPM_RELEASE.md

@@ -6,7 +6,7 @@ Publishing, tags, deprecation, ownership changes and GitHub Releases require exp
 
 ## Prepare
 
-1. This candidate is SpecPi **0.36.1**, paired with the Chat **0.18.0** VSIX. Browser QA **0.3.0** and LANCET guard **0.3.0** are already independently published; do not republish or edit their source as part of this release. Choose an unused version; update `package.json`, the dated `CHANGELOG.md` entry, README, and the website. Check Chat's version and VSIX download links. Preserve historical changelog entries.
+1. This candidate is SpecPi **0.36.2**, paired with the Chat **0.18.0** VSIX. Browser QA **0.3.0** and LANCET guard **0.4.0** are already independently published; do not republish or edit their source as part of this release. Choose an unused version; update `package.json`, the dated `CHANGELOG.md` entry, README, and the website. Check Chat's version and VSIX download links. Preserve historical changelog entries.
 2. Validate:
 
     ```sh

package/README.md

@@ -28,7 +28,7 @@
 
 ---
 
-SpecPi 0.36.1 is a small starting point for the [Pi coding agent](https://pi.dev/). It is one opinionated setup for how the agent should work, not a marketplace of plugins.
+SpecPi 0.36.2 is a small starting point for the [Pi coding agent](https://pi.dev/). It is one opinionated setup for how the agent should work, not a marketplace of plugins.
 
 At the center are two built-in extensions. **Scope control** keeps each task to the files it said it would touch. The **improvement loop** turns repeated friction into small, tested changes to the setup, instead of letting prompts and workarounds pile up. Around those are eight hand-picked packages, each locked to an exact version and checked before anything installs, plus **SpecPi Chat**, a VS Code panel for working alongside the agent.
 
@@ -49,8 +49,8 @@ Before the agent runs a shell command, [LANCET Nano](https://github.com/TannerMi
 
 | | LANCET Nano (local) | Jev (hosted, previous guard) |
 | --- | ---: | ---: |
-| Risky commands caught | 91.7% | 96.8% |
-| Safe commands wrongly stopped | 9.4% | 7.8% |
+| Risky commands caught | 92.4% | 96.8% |
+| Safe commands wrongly stopped | 9.9% | 7.8% |
 | Cost per check | $0 | per request |
 | Network | none | every check |
 

package/SECURITY_MODEL.md

@@ -62,7 +62,7 @@ Settings live in `<agent-dir>/specpi/jev/settings.json`, written atomically with
 
 `specpi-lancet-guard` is pinned in the base set and ships **off**. SpecPi writes nothing into its configuration: the package's own default is off, and only its own `/lancet-guard on` (this session) or `/lancet-guard on --global` (saved in `<home>/.pi/lancet-guard.json`) turns it on. An installer run never arms or disarms it, so a saved choice survives every update. `@gotgenes/pi-permission-system` stays pinned and decides every tool call whether the guard is on or off; the guard is a second, independent check: either one can block a call, so the guard never allows what the permission system would refuse.
 
-When on, local rules copied from `specpi-jev-guard` decide first -- hard-deny patterns block, provably read-only commands and the user's allow globs pass -- and LANCET Nano v0.4.1, a 110M-parameter CodeT5+ 220M classifier, scores the rest of `bash`, `powershell` and `background` commands in-process on the CPU through ONNX Runtime. `risky` asks (or blocks, if configured), `review` -- the band Nano is unsure about -- asks, `not_flagged` runs, and what LANCET cannot read (PowerShell, over-long input) asks. Writes and edits to protected or out-of-workspace paths ask without a model call. With no UI, an ask becomes a block unless `uncertain` is `allow`. A missing, damaged or unloadable model blocks what the rules leave open: switching the guard on accepts that, and `/lancet-guard on` is refused until the model is installed. `not_flagged` is not a safety claim; on LANCET's own 793-command release benchmark the classifier alone caught 91.7% of risky commands and 77% of risky secrets commands, against 96.8% and 98% for Jev. Updating the guard to a release that pins a new model leaves the old model unused: a guard saved as on fails closed until `/lancet-guard setup` fetches the new one.
+When on, local rules copied from `specpi-jev-guard` decide first -- hard-deny patterns block, provably read-only commands and the user's allow globs pass -- and LANCET Nano v0.4.2, a 110M-parameter CodeT5+ 220M classifier, scores the rest of `bash`, `powershell` and `background` commands in-process on the CPU through ONNX Runtime. `risky` asks (or blocks, if configured), `review` -- the band Nano is unsure about -- asks, `not_flagged` runs, and what LANCET cannot read (PowerShell, over-long input) asks. Writes and edits to protected or out-of-workspace paths ask without a model call. With no UI, an ask becomes a block unless `uncertain` is `allow`. A missing, damaged or unloadable model blocks what the rules leave open: switching the guard on accepts that, and `/lancet-guard on` is refused until the model is installed. `not_flagged` is not a safety claim; on LANCET's own 793-command release benchmark the classifier alone caught 92.4% of risky commands and 78% of risky secrets commands, against 96.8% and 98% for Jev. Updating the guard to a release that pins a new model leaves the old model unused: a guard saved as on fails closed until `/lancet-guard setup` fetches the new one.
 
 Commands never leave the machine and are never executed by the guard. The only network access is `/lancet-guard setup`, run by a human: it downloads one ZIP from the pinned `TannerMidd/LANCET-model` GitHub release into a private staging directory, capped at its pinned size, and refuses it unless its SHA-256 matches the digest compiled into the package. Only then does the package's own small ZIP reader extract the three model files, each inflated to its pinned size and refused unless its own SHA-256 matches. GitHub is the only host involved, so it works where Hugging Face is blocked. The digests are checked again on every load. The package's one production dependency, `onnxruntime-node` 1.30.0, is pinned exactly; its install script would fetch CUDA libraries on Linux x64, so the installer sets `ONNXRUNTIME_NODE_INSTALL=skip`.
 

package/THIRD_PARTY.md

@@ -11,7 +11,7 @@ Development formatting uses Prettier **3.9.6** (MIT), ESLint **10.9.1** (MIT), `
 
 ## Default packages
 
-Reviewed on 2026-09-16 against published npm metadata and integrity-verified source archives, and `specpi-lancet-guard` 0.3.0, which replaces `specpi-jev-guard` 0.4.0, from source in this repository. All eight top-level packages declare the MIT license. Pins are authoritative in `templates/settings.json`.
+Reviewed on 2026-09-16 against published npm metadata and integrity-verified source archives, and `specpi-lancet-guard` 0.4.0, which replaces `specpi-jev-guard` 0.4.0, from source in this repository. All eight top-level packages declare the MIT license. Pins are authoritative in `templates/settings.json`.
 
 SpecPi requests exact npm dependency saves for these pins and checks installed top-level versions before completing installation. The override applies to package acquisition without changing the user's global npm configuration.
 
@@ -42,7 +42,7 @@ Worth stating plainly, because it is the part a reader is most likely to assume
 
 ## LANCET command guard
 
-`packages/lancet-guard` is first-party source, released independently as `specpi-lancet-guard`. Its one production dependency is `onnxruntime-node` 1.30.0 (MIT, Microsoft), pinned exactly, which bundles prebuilt ONNX Runtime CPU libraries; SpecPi's installer sets `ONNXRUNTIME_NODE_INSTALL=skip` so its install script does not fetch the CUDA libraries it would otherwise download on Linux x64. Its local rules are copied under MIT from `specpi-jev-guard` 0.4.0. The model is not bundled: `/lancet-guard setup` downloads LANCET Nano v0.4.1 (Apache-2.0) from the `TannerMidd/LANCET-model` GitHub release, pinned by SHA-256. It was fine-tuned from Salesforce CodeT5+ 220M (BSD-3-Clause); its model card and notices in the release record the training-data sources. The guard makes no other network connection. See its [dependency notices](packages/lancet-guard/THIRD_PARTY.md) and [security boundary](packages/lancet-guard/SECURITY.md).
+`packages/lancet-guard` is first-party source, released independently as `specpi-lancet-guard`. Its one production dependency is `onnxruntime-node` 1.30.0 (MIT, Microsoft), pinned exactly, which bundles prebuilt ONNX Runtime CPU libraries; SpecPi's installer sets `ONNXRUNTIME_NODE_INSTALL=skip` so its install script does not fetch the CUDA libraries it would otherwise download on Linux x64. Its local rules are copied under MIT from `specpi-jev-guard` 0.4.0. The model is not bundled: `/lancet-guard setup` downloads LANCET Nano v0.4.2 (Apache-2.0) from the `TannerMidd/LANCET-model` GitHub release, pinned by SHA-256. It was fine-tuned from Salesforce CodeT5+ 220M (BSD-3-Clause); its model card and notices in the release record the training-data sources. The guard makes no other network connection. See its [dependency notices](packages/lancet-guard/THIRD_PARTY.md) and [security boundary](packages/lancet-guard/SECURITY.md).
 
 ## Standalone delegation and experiments
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "specpi",
-  "version": "0.36.1",
+  "version": "0.36.2",
   "description": "Scope control and a human-selected harness improvement loop for Pi",
   "author": "Tanner Middleton",
   "repository": {

package/scripts/lancet-guard.mjs

@@ -15,7 +15,7 @@ import os from "node:os";
 import path from "node:path";
 
 /** Must match the pin in templates/settings.json. */
-export const GUARD_PIN = "npm:specpi-lancet-guard@0.3.0";
+export const GUARD_PIN = "npm:specpi-lancet-guard@0.4.0";
 
 export const RETIRED_GUARD_PIN = "npm:specpi-jev-guard@0.4.0";
 

package/templates/settings.json

@@ -7,6 +7,6 @@
         "npm:pi-goal-x@0.31.2",
         "npm:@sreetej510/pi-usage@0.10.0",
         "npm:@gotgenes/pi-permission-system@32.0.2",
-        "npm:specpi-lancet-guard@0.3.0"
+        "npm:specpi-lancet-guard@0.4.0"
     ]
 }