usebeeline 0.0.128 → 0.0.131

package/README.md

@@ -105,8 +105,8 @@ The corner receives a GitHub App token scoped to **that one repository**, instal
 - **The filesystem boundary is the sandbox, not a tool list.** Room sessions run under bubblewrap with a read-only view of the checkout, a private `/tmp`, and an isolated home. Every mounted MCP tool is approved, and so are shell commands while the sandbox wraps the session, because the sandbox — not an allowlist — is what holds the line for both.
 - **When the sandbox cannot be built, the daemon says so and keeps serving.** A host with no `bwrap` gets one automatic install attempt at daemon start (Linux hosts with `apt-get`; the unit's start deadline is extended to cover it, and a failed attempt is remembered for a day rather than retried on every restart). If the sandbox still cannot be built — a kernel that refuses unprivileged user namespaces, no usable package manager, or an operator who turned it off — every session afterwards runs unwrapped: mounted MCP tools stay approved, the agent's session prompt states whether it can run shell commands, and the read-only rule for anything else rests on the harness's own sandbox. Codex keeps its offline read-only mode; a harness that asks, like Claude Code or Grok, is told a shell is unavailable instead of being granted one. Pi does not ask before it writes, so a Pi Room is only as read-only as its sandbox. OpenCode Rooms select its Plan agent; bubblewrap holds the filesystem boundary when available.
 - **Write access requires a corner.** A corner is a separate worktree on its own branch with a repository-scoped GitHub App token, and it is opened by an explicit host-governed call, never inferred.
-- **Reach outside the sandbox is a grant.** Repository cards stay in the requesting Room, where a Workspace owner or admin can answer. Personal-resource cards — host commands, paths, devices, secrets, wallets, apps, and other MCP routes — go to the resource owner's private connector or `@system` DM, and only that owner can answer. Every approval is scoped to the Room and the original human requester, so delegation or an approval resume cannot turn someone else's request into owner consent. Approving a command grant is word-for-word: an approved `npm test` does not approve `npm test && curl …`, and a command carrying shell metacharacters is refused before it is ever offered. An ALWAYS route remains available for the same scope until it is revoked; ONCE is consumed by the first authorized resource call, not by discovery.
-- **Yolo mode** flips a single agent to auto-approval and is settable only by that agent's owner. It bypasses repository prompts for any requester, but bypasses personal-resource prompts only when the original requester is the resource owner. In a public Workspace, yolo is forced off without changing the owner's preference, so it resumes when the Workspace returns to invite-only. Generic budget grants are retired.
+- **Resource authority follows ownership.** An agent uses its own owner's files, secrets, host commands and imported tools without a permission card, regardless of the root requester or yolo. Another person's files or tools outside the sandbox require that person's approval. The wallet retains its separate consent rule. Credential-file and unread-script command hard stops still ask. Every recorded grant retains Room and requester provenance; an approved command remains an exact argv prefix.
+- **Yolo mode** remains owner-only agent configuration. In a public Workspace it is forced off without changing the saved preference. Owner-machine resource access does not depend on yolo; wallet consent keeps its existing rule. Generic budget grants are retired.
 - **Provider keys never reach Beeline's servers.** They live in your config directory at mode `0600` and reach only the harness process you already trust with them.
 - **Honest about what is not built yet:** `command` and `mcp` grants directly gate their corresponding operations. `path`, `secret`, and `device` grants are recorded but are not yet individual sandbox mounts; generic budget requests are rejected.