tare-cli 0.2.0__tar.gz → 0.3.0__tar.gz

{tare_cli-0.2.0 → tare_cli-0.3.0}/CONCEPT.md

@@ -4,7 +4,7 @@ tare starts a coding agent in an isolated room without your personal setup, and
 clean before the run. It prints `tare: 0.00`, names every leak and where it came from, or says
 that it could not see your setup (`tare: not proven (blind)`). It refuses to start the agent
 until the reading is `tare: 0.00`, unless you pass `--allow-dirty`. It supports Claude Code, Codex, Pi
-and the Antigravity CLI (`agy`) on Linux and WSL.
+and the Antigravity CLI (`agy`) on Linux and WSL, and Claude Code, Codex and Pi on macOS.
 
 This document describes the design and the measurements behind it. The [README](README.md)
 explains the words this document uses: room, probe, reading, leak, declared, dirty twin, check, tail and
@@ -64,7 +64,9 @@ your instructions, memories, plugins, hooks and skills. That is not enough.
   credential files, and called it reconnaissance. That is correct behaviour, but useless for a
   probe. The probe must not depend on the agent's cooperation or honesty.
 - **Reach:** a plain script runs inside the room and looks for your files and inherited
-  environment variables.
+  environment variables. On macOS it also looks for `~/Library` (Keychains, Preferences,
+  Application Support), your directory under `/var/folders`, Claude Code's temporary files in
+  `/private/tmp`, and whether the pasteboard can be read.
 - **Context:** tare points the real agent CLI at a fake model server on your machine. The
   server keeps the request, which is the context the agent CLI put together, and answers "ok".
   The idea is the blank run from analytical chemistry, which runs the whole procedure without a
@@ -83,13 +85,38 @@ your instructions, memories, plugins, hooks and skills. That is not enough.
 
 ### Room
 
-A room is a bubblewrap sandbox for one agent run: an empty `/home` with the room's own home
+A backend builds the room, and every path the agent sees comes from the room it built: its
+home, the project and a run's store. On Linux and WSL the backend is bubblewrap, which mounts
+them at fixed paths. A backend that cannot mount, such as Seatbelt on macOS, uses the host paths
+instead, and the adapters follow (the trust entry, the session directories, the config
+variables).
+
+A bubblewrap room is a sandbox for one agent run: an empty `/home` with the room's own home
 directory at `/home/tare`, a fresh copy of the login, the agent's executable, the project at
 `/work`, and the environment allowlist. `tare claude` and the other agent commands mount your
 project directly, so the agent changes your real files. Calibrate, Swap and Cliff give every run
 its own copy of the project. The room has network access and a working login. It keeps your setup out of the measurement. It does not protect your machine from a hostile
 agent.
 
+A Seatbelt room (macOS) cannot mount anything. It is one directory under `/private/tmp` that
+holds the room's home, an APFS clone of the project and clones of the agent's executable, placed
+where bubblewrap would mount them (`opt/agent/...`). A clone shares the original's disk blocks,
+so it costs next to nothing. The profile (`sandbox-exec`) denies your home directory, your
+directory under `/var/folders` (other programs' temporary files and caches), the rest of
+`/private/tmp` (where Claude Code keeps its temporary files), `/private/var/tmp`,
+`/Users/Shared` and the pasteboard. Then it allows the room. When the room closes, the run's
+changes to the clone are copied back to the project. A file the run did not touch stays as it
+is. On macOS, Claude Code keeps its login in the Keychain. tare reads it there the way Claude
+Code does and gives the room a copy as a file, which Claude Code uses when the room has no
+Keychain item. No further Seatbelt profile can start inside a Seatbelt room, so the agents' own
+sandboxes do not work there. Codex runs without its sandbox anyway, and tare turns Claude Code's
+off in a macOS room, because a project that turns it on would make every Bash call fail there.
+On macOS, `tar` stores extended attributes as `._` files, so the snapshot hook runs it with
+`COPYFILE_DISABLE=1`. **Measured** on macOS 27.0 (Claude Code 2.1.289, Codex CLI 0.159.0,
+Pi 0.99.1): each agent answered in such a room with its real login. Afterwards the room was
+gone and the Keychain item unchanged, and nothing under the home directory was readable from
+inside (epic #85).
+
 Claude Code may replace its login token when it renews it, which could log out your real
 session. This has not been tested, so tare refuses to start when the copy would need renewal
 within the next hour. **Measured:** the Antigravity CLI's Google login keeps its refresh token
@@ -121,7 +148,7 @@ lines of your own files that the probe looks for in a request.
 | Agent | How the room is set up | Way to the fake model server | Kinds of context the dirty twin showed on the measuring machine |
 |---|---|---|---|
 | Claude Code | `CLAUDE_CONFIG_DIR` and `HOME` in the room, a copy of `.credentials.json`, `--strict-mcp-config --setting-sources project,local` | `ANTHROPIC_BASE_URL` | instructions, home path, MCP servers, skills, plugins, email, reach |
-| Codex | `CODEX_HOME` and `HOME` in the room, a copy of `auth.json` only, `--disable remote_plugin` | `-c openai_base_url=<server>/v1` keeps the ChatGPT login | instructions, memories, home path, skills, reach |
+| Codex | `CODEX_HOME` and `HOME` in the room, a copy of `auth.json` only, `--disable remote_plugin` | `-c openai_base_url=<server>/v1` keeps the ChatGPT login | instructions, memories, home path, skills, plugins, custom agents, reach |
 | Pi | `PI_CODING_AGENT_DIR` and `HOME` in the room, copies of `auth.json` and `models.json`, a minimal `settings.json`, no flags | a provider of its own (`tare`, api `anthropic-messages`), because Pi has no base-URL variable | instruction files above the project, extensions, home path, reach |
 | Antigravity CLI | `HOME` in the room, a copy of `antigravity-oauth-token` and the chosen model, no flags | `CLOUD_CODE_URL` | home path, reach. Global rules (`~/.gemini/GEMINI.md`) and global skills (`~/.gemini/config/skills/`) showed after copies were placed in the setup for the test, because the measuring machine had none. |
 
@@ -132,9 +159,16 @@ What each agent needed:
   of its built-in provider that would stop this. So each Codex probe waits about 8 seconds. **Measured:** the captured
   request holds more than `codex debug prompt-input` shows, because Codex's own view leaves out
   the memories. Memories load only when your `config.toml` enables `[features] memories`. Hooks
-  did not fire in one-shot runs, and the first request offered no tools from configured MCP
-  servers, so the probe cannot check those two kinds of context for Codex. The room has no
-  `config.toml` or `hooks.json` of yours, so neither can come in. A fresh `CODEX_HOME` means
+  did not fire in one-shot runs, so the probe cannot check hooks for Codex. On the measuring
+  machine the first request offered no tools from configured MCP servers. On a Mac (Codex
+  0.159.0) it offered one server's tools grouped as `mcp__<server>`, and the probe reads such a
+  group as that server's MCP tools (#109). The room has no `config.toml` or `hooks.json` of
+  yours, so neither can come in. Codex reports nothing like Claude Code's init event, so the
+  probe finds your plugins in the request's skills listing, where each plugin skill is a line
+  `- <plugin>:<skill>: …`. Your custom agents (`~/.codex/agents/`, a `.toml` file each) appear
+  as roles of the `spawn_agent` tool, `<name>: {` and the description. The probe matches the
+  name and the description's first line, so a built-in agent of the same name is not taken for
+  yours. A fresh `CODEX_HOME` means
   Codex's default model. Pass `-m` when you compare runs.
 - **Pi:** a fresh agent directory is clean on its own and keeps the project's `AGENTS.md`, so the
   room uses no flags. `--no-context-files` would drop the project's `AGENTS.md`. tare finds Pi's
@@ -190,7 +224,9 @@ read `tare: 0.00`, including a skill that started `claude -p` inside the room (s
 
 The judge scores results that no test can decide, such as a web page. tare opens the page in
 headless Google Chrome inside a room with the workspace read-only and no home directory, and
-takes a screenshot. A judge agent (Claude Code with Sonnet by default) then scores the page from
+takes a screenshot. On macOS it uses Chrome, Chromium or Microsoft Edge from `/Applications`, in
+a Seatbelt room with a browser profile of its own and a mock keychain. Edge keeps running after
+its screenshot, so tare ends it once the file is written. A judge agent (Claude Code with Sonnet by default) then scores the page from
 the screenshot, the source and a rubric, in a fresh room without any agent or model names.
 **Measured:** one test page scored 55, 60, 58, 58, 66 and 62 in six judgements. `tare judge-noise`
 therefore refuses a threshold that lies inside a page's range of scores. On the same page the
@@ -249,7 +285,8 @@ names what has changed since.
 
 ## Measurements
 
-All measurements ran on WSL2 on 2026-10-04 and 2026-10-05.
+All measurements ran on WSL2 on 2026-10-04 and 2026-10-05. The rows that name macOS ran on
+macOS 27.0 (arm64) on 2026-10-05 and 2026-10-06.
 
 | What | Agent and version | Result | Source |
 |---|---|---|---|
@@ -262,6 +299,10 @@ All measurements ran on WSL2 on 2026-10-04 and 2026-10-05.
 | Real task 1: a data migration | Claude Code with Sonnet and Haiku, Codex | Deleting the source file after a wrong-encoding import was planned as the point of no return. Swap showed that the workspace could still be repaired. Haiku passed about 1 in 14 runs, Codex with gpt-6.1-sol 4 of 4 | [results](experiments/migration/RESULTS.md) |
 | Real task 2: a web page judged by Sonnet | Claude Code with Haiku, Codex with gpt-6.1-sol | Swap confirmed all four predictions of the plan written before the runs. Cliff called a failed run unlucky, and a later rescoring of the same page confirmed it | [results](experiments/html/RESULTS.md) |
 | Field test: two ideation skills compared | Claude Code 2.1.289 with Opus 5.5 | all 18 rooms read `tare: 0.00`, including a skill that started `claude -p` inside the room | not published |
+| macOS: what a Seatbelt room has to handle | Claude Code 2.1.289, Codex CLI 0.159.0, Pi 0.99.1 | Claude Code's login is in the Keychain. With only the home directory denied, `/var/folders`, `/private/tmp` and the pasteboard stayed readable. Agents' own sandboxes fail inside a room (`sandbox_apply: Operation not permitted`) | comments on epic #85 |
+| macOS: a Seatbelt room with the real login | same | each agent answered one prompt. The room and its login copy were removed afterwards, and the Keychain item was unchanged (digest before and after). `tare probe` read `tare: 0.00` for all three | comments on epic #85 |
+| macOS: dirty twin, Seatbelt room, and parts of the real setup copied into the room | same | every room read `tare: 0.00`. Each copied part that reached the request was named with its source, and nothing under the home directory, under `/var/folders`, in `/private/tmp` or on the pasteboard was reachable from inside. Two kinds of Codex context are invisible to the probe on any system (#109) | [results](experiments/dirty-twin-macos/RESULTS.md) |
+| macOS: scripted Cliff and Swap, the judge | Claude Code 2.1.290 against scripted models; Microsoft Edge for the judge's screenshot | Cliff found step 4. Swap passed the null check and found the blame passing from the model to the workspace between cut 0 and cut 0.5. `tare judge` rendered a page and scored it. With a project that turns Claude Code's sandbox on, every Bash call failed in a Seatbelt room until tare turned it off | comments on epic #85 |
 
 ## Open questions and ideas
 
@@ -274,8 +315,9 @@ All measurements ran on WSL2 on 2026-10-04 and 2026-10-05.
 - **Codex handoffs:** Codex can run several commands in one tool call, which makes its handoffs
   long.
 - **Cost:** every tail is a full agent run, so a Cliff search or a Swap costs as much as its tails.
-- **macOS:** a room built on Seatbelt (`sandbox-exec`), which Claude Code and Codex already use
-  for their own sandboxes. In progress (epic #85), not in a release yet.
+- **macOS:** the room is built on Seatbelt, released in 0.3.0 (epic #85). Not done: the
+  Antigravity CLI, whose dirty twin needs Linux's overlay, so tare stops with a message there.
+  Not tested: whether a program started through launchd or XPC runs outside the room's profile.
 - **Other probes, not built:** weighing the first request's input tokens before and after adding
   junk to the real setup, and file tripwires that report which secret files a run opened.
 - **Docker:** could contain files where bubblewrap is missing, but does nothing against context

{tare_cli-0.2.0 → tare_cli-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: tare-cli
-Version: 0.2.0
+Version: 0.3.0
 Summary: Prove your coding agent starts without your personal setup before you measure it.
 Project-URL: Homepage, https://github.com/a-ratz/tare
 Project-URL: Repository, https://github.com/a-ratz/tare
@@ -13,6 +13,7 @@ Keywords: agent-evaluation,ai-agents,claude-code,codex,coding-agents,evals,llm-e
 Classifier: Development Status :: 3 - Alpha
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS
 Classifier: Operating System :: POSIX :: Linux
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
@@ -37,7 +38,7 @@ Description-Content-Type: text/markdown
 [![License: MIT][license-shield]][license-url]
 [![PyPI][version-shield]][version-url]
 [![Python 3.11+][python-shield]][python-url]
-[![Linux | WSL][platform-shield]][platform-url]
+[![Linux | WSL | macOS][platform-shield]][platform-url]
 [![Claude Code | Codex | Pi | Antigravity][agent-shield]][agent-url]
 
 </div>
@@ -71,7 +72,7 @@ environment, and none of them checks it.
 tare starts the agent in a clean environment and proves that it is clean before every run. It
 works with four coding agents on Linux and WSL: Claude Code, Codex, Pi
 ([`@earendil-works/pi-coding-agent`](https://www.npmjs.com/package/@earendil-works/pi-coding-agent))
-and Google's Antigravity CLI (`agy`).
+and Google's Antigravity CLI (`agy`). On macOS it works with Claude Code, Codex and Pi.
 
 ## The words tare uses
 
@@ -80,7 +81,7 @@ something. tare does the same for an agent before you measure it.
 
 | Word | Meaning |
 |---|---|
-| room | An isolated environment for one agent run. It has an empty home directory, a fresh copy of your login (the file in which the agent keeps your sign-in) and only four basic environment variables from your shell (an allowlist), plus its own `HOME` and `PATH`. Your project appears at `/work`. tare builds the room with [bubblewrap](https://github.com/containers/bubblewrap). |
+| room | An isolated environment for one agent run. It has an empty home directory, a fresh copy of your login (the file in which the agent keeps your sign-in) and only four basic environment variables from your shell (an allowlist), plus its own `HOME` and `PATH`. Your project appears at `/work`. tare builds the room with [bubblewrap](https://github.com/containers/bubblewrap). On macOS it builds the room with Seatbelt, the sandbox built into macOS: the agent works on a copy of your project inside the room, and its changes are copied back to your project when the room closes. |
 | probe | The test that tare runs before an agent starts. It makes no paid model calls. The agent talks to a fake model server on your machine, which records what the agent sends. |
 | reading | The result of a probe, one of three. A clean room reads `tare: 0.00`, the zeroed scale. A room with leaks reads, for example, `tare: 4 leaks`. A probe that could not see your setup reads `tare: not proven (blind)`. There are no values in between. |
 | leak | Something of your personal setup that reaches the room, for example your global instructions. The reading names each leak and the file it came from. |
@@ -123,7 +124,7 @@ something. tare does the same for an agent before you measure it.
 | Use tare when | Look elsewhere when |
 |---|---|
 | you compare agent runs with and without a skill, plugin or prompt | you need protection from a hostile agent, because the room has network access and a working login |
-| you benchmark agents on your own machine | you are on macOS (a room is in progress, not released yet) |
+| you benchmark agents on your own machine | you use the Antigravity CLI on macOS (not supported there yet) |
 | you want a fresh-machine run without a fresh machine | you log in with an API key only (untested) |
 | an agent failed a task and you want to know which step lost it | you want a single run explained without running the agent again, because Cliff runs it many times |
 
@@ -131,10 +132,10 @@ something. tare does the same for an agent before you measure it.
 
 | Requirement | Notes |
 |---|---|
-| Linux or WSL2 | tare builds the room with user namespaces |
-| [bubblewrap](https://github.com/containers/bubblewrap) | `sudo apt install bubblewrap` |
-| at least one of the four agents | on `PATH` and logged in. Codex must resolve to a path under `/usr` for now, because tare mounts Codex's npm package and Node.js from there. If `which codex` points elsewhere, for example into nvm, install it with the system's npm (`sudo npm install -g @openai/codex`) and put `/usr/bin` first on `PATH`. The other agents can live anywhere on `PATH`. |
-| Google Chrome, only for `tare judge` | `google-chrome` on `PATH`, installed under `/usr` or `/opt`. `tare judge` scores web pages and takes their screenshots with it. |
+| Linux or WSL2, or macOS | on Linux tare builds the room with user namespaces, on macOS with Seatbelt (`sandbox-exec`, part of macOS). On macOS the project must be on an APFS volume for the room's copy to be instant; elsewhere tare copies it in full. |
+| [bubblewrap](https://github.com/containers/bubblewrap), Linux and WSL only | `sudo apt install bubblewrap` |
+| at least one of the agents | on `PATH` and logged in. On Linux, Codex must resolve to a path under `/usr` for now, because tare mounts Codex's npm package and Node.js from there. If `which codex` points elsewhere, for example into nvm, install it with the system's npm (`sudo npm install -g @openai/codex`) and put `/usr/bin` first on `PATH`. The other agents, and every agent on macOS, can live anywhere on `PATH`. On macOS, Claude Code keeps its login in the Keychain: tare reads it there the way Claude Code does and gives the room a copy. |
+| a Chromium browser, only for `tare judge` | Linux: `google-chrome` on `PATH`, installed under `/usr` or `/opt`. macOS: Google Chrome, Chromium or Microsoft Edge in `/Applications`. `tare judge` scores web pages and takes their screenshots with it. |
 | [uv](https://docs.astral.sh/uv/) or [pipx](https://pipx.pypa.io/) | Python 3.11 or newer |
 
 Install tare from PyPI. The package is `tare-cli`, the command is `tare`:
@@ -472,12 +473,12 @@ real setup, so tare knows that it can see your setup at all. Third, a plain scri
 room looks for your files and for secret environment variables.
 
 → [Concept: the design and the measurements behind it](https://github.com/a-ratz/tare/blob/main/CONCEPT.md)
-→ [The dirty-twin experiments that decided the probe design: Claude Code](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin/RESULTS.md), [Codex](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-codex/RESULTS.md), [Pi](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-pi/RESULTS.md), [Antigravity CLI](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-agy/RESULTS.md)
+→ [The dirty-twin experiments that decided the probe design: Claude Code](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin/RESULTS.md), [Codex](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-codex/RESULTS.md), [Pi](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-pi/RESULTS.md), [Antigravity CLI](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-agy/RESULTS.md), [the three agents on macOS](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-macos/RESULTS.md)
 
 ## Roadmap
 
-A room for macOS, built on Seatbelt, is in progress ([epic #85](https://github.com/a-ratz/tare/issues/85)).
-Until it is released, tare runs on Linux and WSL.
+The Antigravity CLI on macOS: its dirty twin uses an overlay over `~/.gemini`, which macOS does not
+have, so tare stops with a message there for now.
 
 ## Contributing
 
@@ -499,7 +500,7 @@ Crafted with [Readme Craft](https://github.com/motiful/readme-craft)
 [version-url]: https://github.com/a-ratz/tare/blob/main/pyproject.toml
 [python-shield]: https://img.shields.io/badge/python-3.11%2B-3776AB.svg
 [python-url]: https://www.python.org/
-[platform-shield]: https://img.shields.io/badge/platform-Linux%20%7C%20WSL-555555.svg
+[platform-shield]: https://img.shields.io/badge/platform-Linux%20%7C%20WSL%20%7C%20macOS-555555.svg
 [platform-url]: #install
 [agent-shield]: https://img.shields.io/badge/agents-Claude%20Code%20%7C%20Codex%20%7C%20Pi%20%7C%20Antigravity-D97757.svg
 [agent-url]: #install

{tare_cli-0.2.0 → tare_cli-0.3.0}/README.md

@@ -13,7 +13,7 @@
 [![License: MIT][license-shield]][license-url]
 [![PyPI][version-shield]][version-url]
 [![Python 3.11+][python-shield]][python-url]
-[![Linux | WSL][platform-shield]][platform-url]
+[![Linux | WSL | macOS][platform-shield]][platform-url]
 [![Claude Code | Codex | Pi | Antigravity][agent-shield]][agent-url]
 
 </div>
@@ -47,7 +47,7 @@ environment, and none of them checks it.
 tare starts the agent in a clean environment and proves that it is clean before every run. It
 works with four coding agents on Linux and WSL: Claude Code, Codex, Pi
 ([`@earendil-works/pi-coding-agent`](https://www.npmjs.com/package/@earendil-works/pi-coding-agent))
-and Google's Antigravity CLI (`agy`).
+and Google's Antigravity CLI (`agy`). On macOS it works with Claude Code, Codex and Pi.
 
 ## The words tare uses
 
@@ -56,7 +56,7 @@ something. tare does the same for an agent before you measure it.
 
 | Word | Meaning |
 |---|---|
-| room | An isolated environment for one agent run. It has an empty home directory, a fresh copy of your login (the file in which the agent keeps your sign-in) and only four basic environment variables from your shell (an allowlist), plus its own `HOME` and `PATH`. Your project appears at `/work`. tare builds the room with [bubblewrap](https://github.com/containers/bubblewrap). |
+| room | An isolated environment for one agent run. It has an empty home directory, a fresh copy of your login (the file in which the agent keeps your sign-in) and only four basic environment variables from your shell (an allowlist), plus its own `HOME` and `PATH`. Your project appears at `/work`. tare builds the room with [bubblewrap](https://github.com/containers/bubblewrap). On macOS it builds the room with Seatbelt, the sandbox built into macOS: the agent works on a copy of your project inside the room, and its changes are copied back to your project when the room closes. |
 | probe | The test that tare runs before an agent starts. It makes no paid model calls. The agent talks to a fake model server on your machine, which records what the agent sends. |
 | reading | The result of a probe, one of three. A clean room reads `tare: 0.00`, the zeroed scale. A room with leaks reads, for example, `tare: 4 leaks`. A probe that could not see your setup reads `tare: not proven (blind)`. There are no values in between. |
 | leak | Something of your personal setup that reaches the room, for example your global instructions. The reading names each leak and the file it came from. |
@@ -99,7 +99,7 @@ something. tare does the same for an agent before you measure it.
 | Use tare when | Look elsewhere when |
 |---|---|
 | you compare agent runs with and without a skill, plugin or prompt | you need protection from a hostile agent, because the room has network access and a working login |
-| you benchmark agents on your own machine | you are on macOS (a room is in progress, not released yet) |
+| you benchmark agents on your own machine | you use the Antigravity CLI on macOS (not supported there yet) |
 | you want a fresh-machine run without a fresh machine | you log in with an API key only (untested) |
 | an agent failed a task and you want to know which step lost it | you want a single run explained without running the agent again, because Cliff runs it many times |
 
@@ -107,10 +107,10 @@ something. tare does the same for an agent before you measure it.
 
 | Requirement | Notes |
 |---|---|
-| Linux or WSL2 | tare builds the room with user namespaces |
-| [bubblewrap](https://github.com/containers/bubblewrap) | `sudo apt install bubblewrap` |
-| at least one of the four agents | on `PATH` and logged in. Codex must resolve to a path under `/usr` for now, because tare mounts Codex's npm package and Node.js from there. If `which codex` points elsewhere, for example into nvm, install it with the system's npm (`sudo npm install -g @openai/codex`) and put `/usr/bin` first on `PATH`. The other agents can live anywhere on `PATH`. |
-| Google Chrome, only for `tare judge` | `google-chrome` on `PATH`, installed under `/usr` or `/opt`. `tare judge` scores web pages and takes their screenshots with it. |
+| Linux or WSL2, or macOS | on Linux tare builds the room with user namespaces, on macOS with Seatbelt (`sandbox-exec`, part of macOS). On macOS the project must be on an APFS volume for the room's copy to be instant; elsewhere tare copies it in full. |
+| [bubblewrap](https://github.com/containers/bubblewrap), Linux and WSL only | `sudo apt install bubblewrap` |
+| at least one of the agents | on `PATH` and logged in. On Linux, Codex must resolve to a path under `/usr` for now, because tare mounts Codex's npm package and Node.js from there. If `which codex` points elsewhere, for example into nvm, install it with the system's npm (`sudo npm install -g @openai/codex`) and put `/usr/bin` first on `PATH`. The other agents, and every agent on macOS, can live anywhere on `PATH`. On macOS, Claude Code keeps its login in the Keychain: tare reads it there the way Claude Code does and gives the room a copy. |
+| a Chromium browser, only for `tare judge` | Linux: `google-chrome` on `PATH`, installed under `/usr` or `/opt`. macOS: Google Chrome, Chromium or Microsoft Edge in `/Applications`. `tare judge` scores web pages and takes their screenshots with it. |
 | [uv](https://docs.astral.sh/uv/) or [pipx](https://pipx.pypa.io/) | Python 3.11 or newer |
 
 Install tare from PyPI. The package is `tare-cli`, the command is `tare`:
@@ -448,12 +448,12 @@ real setup, so tare knows that it can see your setup at all. Third, a plain scri
 room looks for your files and for secret environment variables.
 
 → [Concept: the design and the measurements behind it](https://github.com/a-ratz/tare/blob/main/CONCEPT.md)
-→ [The dirty-twin experiments that decided the probe design: Claude Code](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin/RESULTS.md), [Codex](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-codex/RESULTS.md), [Pi](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-pi/RESULTS.md), [Antigravity CLI](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-agy/RESULTS.md)
+→ [The dirty-twin experiments that decided the probe design: Claude Code](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin/RESULTS.md), [Codex](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-codex/RESULTS.md), [Pi](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-pi/RESULTS.md), [Antigravity CLI](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-agy/RESULTS.md), [the three agents on macOS](https://github.com/a-ratz/tare/blob/main/experiments/dirty-twin-macos/RESULTS.md)
 
 ## Roadmap
 
-A room for macOS, built on Seatbelt, is in progress ([epic #85](https://github.com/a-ratz/tare/issues/85)).
-Until it is released, tare runs on Linux and WSL.
+The Antigravity CLI on macOS: its dirty twin uses an overlay over `~/.gemini`, which macOS does not
+have, so tare stops with a message there for now.
 
 ## Contributing
 
@@ -475,7 +475,7 @@ Crafted with [Readme Craft](https://github.com/motiful/readme-craft)
 [version-url]: https://github.com/a-ratz/tare/blob/main/pyproject.toml
 [python-shield]: https://img.shields.io/badge/python-3.11%2B-3776AB.svg
 [python-url]: https://www.python.org/
-[platform-shield]: https://img.shields.io/badge/platform-Linux%20%7C%20WSL-555555.svg
+[platform-shield]: https://img.shields.io/badge/platform-Linux%20%7C%20WSL%20%7C%20macOS-555555.svg
 [platform-url]: #install
 [agent-shield]: https://img.shields.io/badge/agents-Claude%20Code%20%7C%20Codex%20%7C%20Pi%20%7C%20Antigravity-D97757.svg
 [agent-url]: #install

{tare_cli-0.2.0 → tare_cli-0.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tare-cli"
-version = "0.2.0"
+version = "0.3.0"
 description = "Prove your coding agent starts without your personal setup before you measure it."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -13,6 +13,7 @@ classifiers = [
     "Development Status :: 3 - Alpha",
     "Environment :: Console",
     "Intended Audience :: Developers",
+    "Operating System :: MacOS",
     "Operating System :: POSIX :: Linux",
     "Programming Language :: Python :: 3",
     "Programming Language :: Python :: 3.11",