specpi 0.36.2 → 0.36.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +9 -0
- package/NPM_RELEASE.md +1 -1
- package/README.md +9 -9
- package/SECURITY_MODEL.md +2 -2
- package/THIRD_PARTY.md +3 -3
- package/package.json +1 -1
- package/scripts/lancet-guard.mjs +1 -1
- package/templates/settings.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,14 @@
|
|
|
1
1
|
# Changelog
|
|
2
2
|
|
|
3
|
+
## 0.36.4 - 2026-10-01
|
|
4
|
+
|
|
5
|
+
- Pin `specpi-lancet-guard` 0.6.0, which adds `/lancet-guard mode <ask|block>`. Choosing what a `risky` verdict does used to mean editing `~/.pi/lancet-guard.json` by hand; the command saves `risky` there and keeps the rest of the file. Ask stays the default. Block mode blocks a `risky` verdict and stops the agent, as the hard-deny rules do; `review` asks in both modes, and the local rules and a missing model block in both. Status shows the mode, and setting one warns when a trusted project's `.pi/lancet-guard.json` overrides it there. The model is unchanged, LANCET Nano v0.4.3, so updating needs no new `/lancet-guard setup`.
|
|
6
|
+
- The README's command guard section gives LANCET Nano v0.4.3's Triage Score across its three release benchmarks, 68.3 with 9.0% of safe commands stopped, as the LANCET page does, in place of its lancet-bench-2-next comparison with Jev. The README, the LANCET and Jev pages and the security model point to `/lancet-guard mode block` instead of the raw setting, and the LANCET page lists the command. SpecPi Chat stays at 0.18.0.
|
|
7
|
+
|
|
8
|
+
## 0.36.3 - 2026-09-30
|
|
9
|
+
|
|
10
|
+
- Pin `specpi-lancet-guard` 0.5.0, which scores with LANCET Nano v0.4.3, a newly trained model in a new format. The guard's runtime is ported to v0.4.3's `classify.py`: the tokenizer loads `vocab.json` and `merges.txt`, a command longer than one 512-token window is read as overlapping windows, and bands come from the risk logit. PowerShell and cmd are now scored rather than always asking, so a PowerShell command LANCET does not flag runs; commands over 8,192 bytes still ask. A command longer than one window is scored but never cleared: review found that harmless lines put in front of a risky command pull it to `not_flagged` once it spans a second window, so a `not_flagged` verdict there asks, as every command that long did before. On lancet-bench-2-next, LANCET's new 3,204-command release benchmark, it catches 78.0% of risky commands, as v0.4.2 did, while stopping 12.4% of safe ones, against 20.0%; its Triage Score across three benchmarks is 68.3, against 54.4. On ShellRisk-Bench's test split it catches 64.8%, against 60.1%, at 3.0% stopped; on the neutral set it catches 85.8%, against 91.0%. Long commands cost about 0.3 s per window, 5 to 8 s at the byte limit; within one window, padding still moves some risky commands to `not_flagged`. The parity fixture is re-recorded with v0.4.3's runtime and gains PowerShell, cmd, window-boundary and byte-limit cases; the port matches it within 6.7e-16 in score and 1.8e-14 in risk logit, and CI decisions match on Linux, Windows and macOS. Users who update must run `/lancet-guard setup` again; a guard saved as on fails closed until they do. The README, security model, third-party notes and website now report lancet-bench-2-next, because lancet-bench-1 is retired and part of v0.4.3's training data. SpecPi Chat stays at 0.18.0.
|
|
11
|
+
|
|
3
12
|
## 0.36.2 - 2026-09-29
|
|
4
13
|
|
|
5
14
|
- Pin `specpi-lancet-guard` 0.4.0, which scores with LANCET Nano v0.4.2, a newly trained model. Its architecture, tokenizer and `classify.py` are identical to v0.4.1, so the runtime is unchanged; the archive, model and `model.json` digests move, and so do the thresholds the model carries (`review` 0.527, `risky` 0.960). On LANCET's release benchmark it catches 92.4% of risky commands, against 91.7%, and 78% of risky secrets commands, against 77%, while stopping 9.9% of safe ones, against 9.4%. On LANCET's 513-command neutral set it stops 7.0% of safe commands, against 16.9%, and catches 91.0% of risky ones, against 66.5%. On ShellRisk-Bench's test split it catches less, 60.1% against 70.5%, at 2.7% of safe commands stopped. More of what it catches comes back as `review` rather than `risky`. The parity fixture is re-recorded with v0.4.2's `classify.py`: token ids are unchanged and 26 of 58 decisions keep their band. Users who update must run `/lancet-guard setup` again; a guard saved as on fails closed until they do. The README, security model, third-party notes and website carry v0.4.2's figures. SpecPi Chat stays at 0.18.0.
|
package/NPM_RELEASE.md
CHANGED
|
@@ -6,7 +6,7 @@ Publishing, tags, deprecation, ownership changes and GitHub Releases require exp
|
|
|
6
6
|
|
|
7
7
|
## Prepare
|
|
8
8
|
|
|
9
|
-
1. This candidate is SpecPi **0.36.
|
|
9
|
+
1. This candidate is SpecPi **0.36.4**, paired with the Chat **0.18.0** VSIX. Browser QA **0.3.0** and LANCET guard **0.6.0** are already independently published; do not republish or edit their source as part of this release. Choose an unused version; update `package.json`, the dated `CHANGELOG.md` entry, README, and the website. Check Chat's version and VSIX download links. Preserve historical changelog entries.
|
|
10
10
|
2. Validate:
|
|
11
11
|
|
|
12
12
|
```sh
|
package/README.md
CHANGED
|
@@ -28,7 +28,7 @@
|
|
|
28
28
|
|
|
29
29
|
---
|
|
30
30
|
|
|
31
|
-
SpecPi 0.36.
|
|
31
|
+
SpecPi 0.36.4 is a small starting point for the [Pi coding agent](https://pi.dev/). It is one opinionated setup for how the agent should work, not a marketplace of plugins.
|
|
32
32
|
|
|
33
33
|
At the center are two built-in extensions. **Scope control** keeps each task to the files it said it would touch. The **improvement loop** turns repeated friction into small, tested changes to the setup, instead of letting prompts and workarounds pile up. Around those are eight hand-picked packages, each locked to an exact version and checked before anything installs, plus **SpecPi Chat**, a VS Code panel for working alongside the agent.
|
|
34
34
|
|
|
@@ -45,16 +45,16 @@ Everything it touches is written down, versioned, and easy to undo.
|
|
|
45
45
|
|
|
46
46
|
## A local command guard
|
|
47
47
|
|
|
48
|
-
Before the agent runs a shell command, [LANCET Nano](https://github.com/TannerMidd/LANCET-model), a
|
|
48
|
+
Before the agent runs a shell command, [LANCET Nano](https://github.com/TannerMidd/LANCET-model), a 111M-parameter classifier, can check it on your own CPU. It reads Bash, PowerShell and cmd, takes about 10 ms for a typical command, needs no API key, sends nothing over the network, and costs nothing per check. Fixed rules settle the obvious cases first, blocking `rm -rf /` and passing `git status`, and the model scores the rest. A risky or uncertain verdict asks you before anything runs; `/lancet-guard mode block` blocks risky ones outright instead.
|
|
49
49
|
|
|
50
|
-
| | LANCET Nano
|
|
51
|
-
| --- | ---: |
|
|
52
|
-
|
|
|
53
|
-
| Safe commands wrongly stopped | 9.
|
|
54
|
-
| Cost per check | $0 |
|
|
55
|
-
| Network | none |
|
|
50
|
+
| | LANCET Nano v0.4.3 |
|
|
51
|
+
| --- | ---: |
|
|
52
|
+
| Triage Score | 68.3 |
|
|
53
|
+
| Safe commands wrongly stopped | 9.0% |
|
|
54
|
+
| Cost per check | $0 |
|
|
55
|
+
| Network | none |
|
|
56
56
|
|
|
57
|
-
|
|
57
|
+
Both figures are taken across three benchmarks, 7,911 commands in total, weighted by size: lancet-bench-2-next (1,602 risky commands and their safe look-alikes), the ShellRisk-Bench test split, and a 513-command neutral set. The [Triage Score](https://github.com/TannerMidd/LANCET-model) gives a guard a point for each risky command it asks about or blocks, and shrinks in proportion once it stops more than 10% of safe commands. The guard ships off. Run `/lancet-guard setup` in Pi once to download the model (about 109 MB, verified by SHA-256) and switch it on. [How it works, what it costs, and its limits](https://tannermidd.github.io/SpecPi/lancet/).
|
|
58
58
|
|
|
59
59
|
## Measured context
|
|
60
60
|
|
package/SECURITY_MODEL.md
CHANGED
|
@@ -62,9 +62,9 @@ Settings live in `<agent-dir>/specpi/jev/settings.json`, written atomically with
|
|
|
62
62
|
|
|
63
63
|
`specpi-lancet-guard` is pinned in the base set and ships **off**. SpecPi writes nothing into its configuration: the package's own default is off, and only its own `/lancet-guard on` (this session) or `/lancet-guard on --global` (saved in `<home>/.pi/lancet-guard.json`) turns it on. An installer run never arms or disarms it, so a saved choice survives every update. `@gotgenes/pi-permission-system` stays pinned and decides every tool call whether the guard is on or off; the guard is a second, independent check: either one can block a call, so the guard never allows what the permission system would refuse.
|
|
64
64
|
|
|
65
|
-
When on, local rules copied from `specpi-jev-guard` decide first -- hard-deny patterns block, provably read-only commands and the user's allow globs pass -- and LANCET Nano v0.4.
|
|
65
|
+
When on, local rules copied from `specpi-jev-guard` decide first -- hard-deny patterns block, provably read-only commands and the user's allow globs pass -- and LANCET Nano v0.4.3, a 111M-parameter CodeT5+ 220M classifier, scores the rest of `bash`, `powershell` and `background` commands in-process on the CPU through ONNX Runtime, reading Bash and PowerShell alike, so a PowerShell command it does not flag runs. `risky` asks (or blocks, after `/lancet-guard mode block` saves `"risky": "block"`), `review` -- the band Nano is unsure about -- asks, `not_flagged` runs, and what LANCET cannot read (input over 8,192 bytes) asks. Longer commands are read in full, as overlapping 512-token windows, but never cleared: a `not_flagged` verdict on one asks, because harmless lines in front of a risky command pull it under the threshold once it spans a second window. Writes and edits to protected or out-of-workspace paths ask without a model call. With no UI, an ask becomes a block unless `uncertain` is `allow`. A missing, damaged or unloadable model blocks what the rules leave open: switching the guard on accepts that, and `/lancet-guard on` is refused until the model is installed. `not_flagged` is not a safety claim; on lancet-bench-2-next, LANCET's 3,204-command release benchmark, the classifier alone caught 78.0% of risky commands and stopped 12.4% of safe ones, against 95.1% and 21.8% for Jev, and credentials are among its weakest areas. Updating the guard to a release that pins a new model leaves the old model unused: a guard saved as on fails closed until `/lancet-guard setup` fetches the new one.
|
|
66
66
|
|
|
67
|
-
Commands never leave the machine and are never executed by the guard. The only network access is `/lancet-guard setup`, run by a human: it downloads one ZIP from the pinned `TannerMidd/LANCET-model` GitHub release into a private staging directory, capped at its pinned size, and refuses it unless its SHA-256 matches the digest compiled into the package. Only then does the package's own small ZIP reader extract the
|
|
67
|
+
Commands never leave the machine and are never executed by the guard. The only network access is `/lancet-guard setup`, run by a human: it downloads one ZIP from the pinned `TannerMidd/LANCET-model` GitHub release into a private staging directory, capped at its pinned size, and refuses it unless its SHA-256 matches the digest compiled into the package. Only then does the package's own small ZIP reader extract the six model files, each inflated to its pinned size and refused unless its own SHA-256 matches. GitHub is the only host involved, so it works where Hugging Face is blocked. The digests are checked again on every load. The package's one production dependency, `onnxruntime-node` 1.30.0, is pinned exactly; its install script would fetch CUDA libraries on Linux x64, so the installer sets `ONNXRUNTIME_NODE_INSTALL=skip`.
|
|
68
68
|
|
|
69
69
|
The guard publishes a per-session counter as a Pi status item under the key `lancet-guard`: the number of commands LANCET scored, the number blocked once there are any, and the last verdict. SpecPi Chat renders that line in its footer and does nothing else with it. The key is absent whenever the guard is off or its `auditDisplay` is. Every decision is also written to Pi's own session file by the package.
|
|
70
70
|
|
package/THIRD_PARTY.md
CHANGED
|
@@ -11,7 +11,7 @@ Development formatting uses Prettier **3.9.6** (MIT), ESLint **10.9.1** (MIT), `
|
|
|
11
11
|
|
|
12
12
|
## Default packages
|
|
13
13
|
|
|
14
|
-
Reviewed on 2026-09-16 against published npm metadata and integrity-verified source archives, and `specpi-lancet-guard` 0.
|
|
14
|
+
Reviewed on 2026-09-16 against published npm metadata and integrity-verified source archives, and `specpi-lancet-guard` 0.6.0, which replaces `specpi-jev-guard` 0.4.0, from source in this repository. All eight top-level packages declare the MIT license. Pins are authoritative in `templates/settings.json`.
|
|
15
15
|
|
|
16
16
|
SpecPi requests exact npm dependency saves for these pins and checks installed top-level versions before completing installation. The override applies to package acquisition without changing the user's global npm configuration.
|
|
17
17
|
|
|
@@ -24,7 +24,7 @@ SpecPi requests exact npm dependency saves for these pins and checks installed t
|
|
|
24
24
|
| pi-goal-x | 0.31.2 | [tmonk/pi-goal-x](https://github.com/tmonk/pi-goal-x) |
|
|
25
25
|
| @sreetej510/pi-usage | 0.10.0 | [Sreetej510/pi-extensions](https://github.com/Sreetej510/pi-extensions) |
|
|
26
26
|
| @gotgenes/pi-permission-system | 32.0.2 | [gotgenes/pi-packages](https://github.com/gotgenes/pi-packages) |
|
|
27
|
-
| specpi-lancet-guard | 0.
|
|
27
|
+
| specpi-lancet-guard | 0.6.0 | [TannerMidd/SpecPi](https://github.com/TannerMidd/SpecPi/tree/main/packages/lancet-guard) |
|
|
28
28
|
|
|
29
29
|
Transitive dependencies and their notices remain in Pi's npm installation tree. Top-level pins do not freeze upstream dependency ranges or constitute a full transitive security audit. Pi invokes npm with its upstream package-management semantics, including dependency lifecycle scripts. Browser QA has no install hook: confirmed SpecPi install/update explicitly invokes its installed Node setup bin, unless acquisition or browser setup is skipped. It downloads package-pinned Chromium without installing OS libraries. BetterWright is optional/manual and retains its own Bun-based setup; SpecPi neither removes Bun nor deletes user-owned tools. Usage reporting and web packages make their own provider/service connections. Consult upstream licenses and security policies before redistributing their components.
|
|
30
30
|
|
|
@@ -42,7 +42,7 @@ Worth stating plainly, because it is the part a reader is most likely to assume
|
|
|
42
42
|
|
|
43
43
|
## LANCET command guard
|
|
44
44
|
|
|
45
|
-
`packages/lancet-guard` is first-party source, released independently as `specpi-lancet-guard`. Its one production dependency is `onnxruntime-node` 1.30.0 (MIT, Microsoft), pinned exactly, which bundles prebuilt ONNX Runtime CPU libraries; SpecPi's installer sets `ONNXRUNTIME_NODE_INSTALL=skip` so its install script does not fetch the CUDA libraries it would otherwise download on Linux x64. Its local rules are copied under MIT from `specpi-jev-guard` 0.4.0. The model is not bundled: `/lancet-guard setup` downloads LANCET Nano v0.4.
|
|
45
|
+
`packages/lancet-guard` is first-party source, released independently as `specpi-lancet-guard`. Its one production dependency is `onnxruntime-node` 1.30.0 (MIT, Microsoft), pinned exactly, which bundles prebuilt ONNX Runtime CPU libraries; SpecPi's installer sets `ONNXRUNTIME_NODE_INSTALL=skip` so its install script does not fetch the CUDA libraries it would otherwise download on Linux x64. Its local rules are copied under MIT from `specpi-jev-guard` 0.4.0. The model is not bundled: `/lancet-guard setup` downloads LANCET Nano v0.4.3 (Apache-2.0) from the `TannerMidd/LANCET-model` GitHub release, pinned by SHA-256. It was fine-tuned from Salesforce CodeT5+ 220M (BSD-3-Clause); its model card and notices in the release record the training-data sources. The guard makes no other network connection. See its [dependency notices](packages/lancet-guard/THIRD_PARTY.md) and [security boundary](packages/lancet-guard/SECURITY.md).
|
|
46
46
|
|
|
47
47
|
## Standalone delegation and experiments
|
|
48
48
|
|
package/package.json
CHANGED
package/scripts/lancet-guard.mjs
CHANGED
|
@@ -15,7 +15,7 @@ import os from "node:os";
|
|
|
15
15
|
import path from "node:path";
|
|
16
16
|
|
|
17
17
|
/** Must match the pin in templates/settings.json. */
|
|
18
|
-
export const GUARD_PIN = "npm:specpi-lancet-guard@0.
|
|
18
|
+
export const GUARD_PIN = "npm:specpi-lancet-guard@0.6.0";
|
|
19
19
|
|
|
20
20
|
export const RETIRED_GUARD_PIN = "npm:specpi-jev-guard@0.4.0";
|
|
21
21
|
|