tare-cli 0.2.0__tar.gz → 0.3.1__tar.gz

{tare_cli-0.2.0 → tare_cli-0.3.1}/CONCEPT.md

@@ -4,12 +4,13 @@ tare starts a coding agent in an isolated room without your personal setup, and
 clean before the run. It prints `tare: 0.00`, names every leak and where it came from, or says
 that it could not see your setup (`tare: not proven (blind)`). It refuses to start the agent
 until the reading is `tare: 0.00`, unless you pass `--allow-dirty`. It supports Claude Code, Codex, Pi
-and the Antigravity CLI (`agy`) on Linux and WSL.
+and the Antigravity CLI (`agy`) on Linux and WSL, and Claude Code, Codex and Pi on macOS.
 
-This document describes the design and the measurements behind it. The [README](README.md)
-explains the words this document uses: room, probe, reading, leak, declared, dirty twin, check, tail and
-handoff. Every claim marked **measured** was observed on WSL2. The section
-[Measurements](#measurements) lists the agent versions and links each result.
+This document describes the design and the measurements behind it. The documentation explains the
+words this document uses: room, probe, reading, leak, declared and dirty twin in
+[docs/words.md](docs/words.md), check, tail and handoff in [docs/measuring.md](docs/measuring.md).
+Every claim marked **measured** was observed on WSL2. The section [Measurements](#measurements)
+lists the agent versions and links each result.
 
 ## Why
 
@@ -64,7 +65,9 @@ your instructions, memories, plugins, hooks and skills. That is not enough.
   credential files, and called it reconnaissance. That is correct behaviour, but useless for a
   probe. The probe must not depend on the agent's cooperation or honesty.
 - **Reach:** a plain script runs inside the room and looks for your files and inherited
-  environment variables.
+  environment variables. On macOS it also looks for `~/Library` (Keychains, Preferences,
+  Application Support), your directory under `/var/folders`, Claude Code's temporary files in
+  `/private/tmp`, and whether the pasteboard can be read.
 - **Context:** tare points the real agent CLI at a fake model server on your machine. The
   server keeps the request, which is the context the agent CLI put together, and answers "ok".
   The idea is the blank run from analytical chemistry, which runs the whole procedure without a
@@ -83,18 +86,51 @@ your instructions, memories, plugins, hooks and skills. That is not enough.
 
 ### Room
 
-A room is a bubblewrap sandbox for one agent run: an empty `/home` with the room's own home
+A backend builds the room, and every path the agent sees comes from the room it built: its
+home, the project and a run's store. On Linux and WSL the backend is bubblewrap, which mounts
+them at fixed paths. A backend that cannot mount, such as Seatbelt on macOS, uses the host paths
+instead, and the adapters follow (the trust entry, the session directories, the config
+variables).
+
+A bubblewrap room is a sandbox for one agent run: an empty `/home` with the room's own home
 directory at `/home/tare`, a fresh copy of the login, the agent's executable, the project at
 `/work`, and the environment allowlist. `tare claude` and the other agent commands mount your
 project directly, so the agent changes your real files. Calibrate, Swap and Cliff give every run
 its own copy of the project. The room has network access and a working login. It keeps your setup out of the measurement. It does not protect your machine from a hostile
 agent.
 
+A Seatbelt room (macOS) cannot mount anything. It is one directory under `/private/tmp` that
+holds the room's home, an APFS clone of the project and clones of the agent's executable, placed
+where bubblewrap would mount them (`opt/agent/...`). A clone shares the original's disk blocks,
+so it costs next to nothing. The profile (`sandbox-exec`) denies your home directory, your
+directory under `/var/folders` (other programs' temporary files and caches), the rest of
+`/private/tmp` (where Claude Code keeps its temporary files), `/private/var/tmp`,
+`/Users/Shared` and the pasteboard. Then it allows the room. When the room closes, the run's
+changes to the clone are copied back to the project. A file the run did not touch stays as it
+is. On macOS, Claude Code keeps its login in the Keychain. tare reads it there the way Claude
+Code does and gives the room a copy as a file, which Claude Code uses when the room has no
+Keychain item. No further Seatbelt profile can start inside a Seatbelt room, so the agents' own
+sandboxes do not work there. Codex runs without its sandbox anyway, and tare turns Claude Code's
+off in a macOS room, because a project that turns it on would make every Bash call fail there.
+On macOS, `tar` stores extended attributes as `._` files, so the snapshot hook runs it with
+`COPYFILE_DISABLE=1`. **Measured** on macOS 27.0 (Claude Code 2.1.289, Codex CLI 0.159.0,
+Pi 0.99.1): each agent answered in such a room with its real login. Afterwards the room was
+gone and the Keychain item unchanged, and nothing under the home directory was readable from
+inside (epic #85).
+
 Claude Code may replace its login token when it renews it, which could log out your real
 session. This has not been tested, so tare refuses to start when the copy would need renewal
 within the next hour. **Measured:** the Antigravity CLI's Google login keeps its refresh token
 when it renews, so a room may renew its own copy.
 
+**Measured** on Ubuntu on WSL2 with Claude Code 2.1.310: Claude Code renews its token only in
+the last minutes before it expires. A session started outside tare with 57 minutes left, and
+another with 7 minutes left, kept the old token; one started with under 6 minutes left renewed
+it, and the new token held for 8 hours. So for most of the refused hour no session outside tare
+can renew the login, and the refusal names the expiry time instead of asking for one. A run
+known to be shorter may ask for less with `TARE_MIN_LOGIN_MINUTES`, never below 10 minutes, so
+the copy does not start inside the renewal window (#126).
+
 ### Probe and reading
 
 The probe has the three parts of layer 3: the agent in the room against the fake model server,
@@ -121,7 +157,7 @@ lines of your own files that the probe looks for in a request.
 | Agent | How the room is set up | Way to the fake model server | Kinds of context the dirty twin showed on the measuring machine |
 |---|---|---|---|
 | Claude Code | `CLAUDE_CONFIG_DIR` and `HOME` in the room, a copy of `.credentials.json`, `--strict-mcp-config --setting-sources project,local` | `ANTHROPIC_BASE_URL` | instructions, home path, MCP servers, skills, plugins, email, reach |
-| Codex | `CODEX_HOME` and `HOME` in the room, a copy of `auth.json` only, `--disable remote_plugin` | `-c openai_base_url=<server>/v1` keeps the ChatGPT login | instructions, memories, home path, skills, reach |
+| Codex | `CODEX_HOME` and `HOME` in the room, a copy of `auth.json` only, `--disable remote_plugin` | `-c openai_base_url=<server>/v1` keeps the ChatGPT login | instructions, memories, home path, skills, plugins, custom agents, reach |
 | Pi | `PI_CODING_AGENT_DIR` and `HOME` in the room, copies of `auth.json` and `models.json`, a minimal `settings.json`, no flags | a provider of its own (`tare`, api `anthropic-messages`), because Pi has no base-URL variable | instruction files above the project, extensions, home path, reach |
 | Antigravity CLI | `HOME` in the room, a copy of `antigravity-oauth-token` and the chosen model, no flags | `CLOUD_CODE_URL` | home path, reach. Global rules (`~/.gemini/GEMINI.md`) and global skills (`~/.gemini/config/skills/`) showed after copies were placed in the setup for the test, because the measuring machine had none. |
 
@@ -132,9 +168,16 @@ What each agent needed:
   of its built-in provider that would stop this. So each Codex probe waits about 8 seconds. **Measured:** the captured
   request holds more than `codex debug prompt-input` shows, because Codex's own view leaves out
   the memories. Memories load only when your `config.toml` enables `[features] memories`. Hooks
-  did not fire in one-shot runs, and the first request offered no tools from configured MCP
-  servers, so the probe cannot check those two kinds of context for Codex. The room has no
-  `config.toml` or `hooks.json` of yours, so neither can come in. A fresh `CODEX_HOME` means
+  did not fire in one-shot runs, so the probe cannot check hooks for Codex. On the measuring
+  machine the first request offered no tools from configured MCP servers. On a Mac (Codex
+  0.159.0) it offered one server's tools grouped as `mcp__<server>`, and the probe reads such a
+  group as that server's MCP tools (#109). The room has no `config.toml` or `hooks.json` of
+  yours, so neither can come in. Codex reports nothing like Claude Code's init event, so the
+  probe finds your plugins in the request's skills listing, where each plugin skill is a line
+  `- <plugin>:<skill>: …`. Your custom agents (`~/.codex/agents/`, a `.toml` file each) appear
+  as roles of the `spawn_agent` tool, `<name>: {` and the description. The probe matches the
+  name and the description's first line, so a built-in agent of the same name is not taken for
+  yours. A fresh `CODEX_HOME` means
   Codex's default model. Pass `-m` when you compare runs.
 - **Pi:** a fresh agent directory is clean on its own and keeps the project's `AGENTS.md`, so the
   room uses no flags. `--no-context-files` would drop the project's `AGENTS.md`. tare finds Pi's
@@ -190,7 +233,9 @@ read `tare: 0.00`, including a skill that started `claude -p` inside the room (s
 
 The judge scores results that no test can decide, such as a web page. tare opens the page in
 headless Google Chrome inside a room with the workspace read-only and no home directory, and
-takes a screenshot. A judge agent (Claude Code with Sonnet by default) then scores the page from
+takes a screenshot. On macOS it uses Chrome, Chromium or Microsoft Edge from `/Applications`, in
+a Seatbelt room with a browser profile of its own and a mock keychain. Edge keeps running after
+its screenshot, so tare ends it once the file is written. A judge agent (Claude Code with Sonnet by default) then scores the page from
 the screenshot, the source and a rubric, in a fresh room without any agent or model names.
 **Measured:** one test page scored 55, 60, 58, 58, 66 and 62 in six judgements. `tare judge-noise`
 therefore refuses a threshold that lies inside a page's range of scores. On the same page the
@@ -249,7 +294,8 @@ names what has changed since.
 
 ## Measurements
 
-All measurements ran on WSL2 on 2026-10-04 and 2026-10-05.
+All measurements ran on WSL2 on 2026-10-04 and 2026-10-05. The rows that name macOS ran on
+macOS 27.0 (arm64) on 2026-10-05 and 2026-10-06.
 
 | What | Agent and version | Result | Source |
 |---|---|---|---|
@@ -262,6 +308,10 @@ All measurements ran on WSL2 on 2026-10-04 and 2026-10-05.
 | Real task 1: a data migration | Claude Code with Sonnet and Haiku, Codex | Deleting the source file after a wrong-encoding import was planned as the point of no return. Swap showed that the workspace could still be repaired. Haiku passed about 1 in 14 runs, Codex with gpt-6.1-sol 4 of 4 | [results](experiments/migration/RESULTS.md) |
 | Real task 2: a web page judged by Sonnet | Claude Code with Haiku, Codex with gpt-6.1-sol | Swap confirmed all four predictions of the plan written before the runs. Cliff called a failed run unlucky, and a later rescoring of the same page confirmed it | [results](experiments/html/RESULTS.md) |
 | Field test: two ideation skills compared | Claude Code 2.1.289 with Opus 5.5 | all 18 rooms read `tare: 0.00`, including a skill that started `claude -p` inside the room | not published |
+| macOS: what a Seatbelt room has to handle | Claude Code 2.1.289, Codex CLI 0.159.0, Pi 0.99.1 | Claude Code's login is in the Keychain. With only the home directory denied, `/var/folders`, `/private/tmp` and the pasteboard stayed readable. Agents' own sandboxes fail inside a room (`sandbox_apply: Operation not permitted`) | comments on epic #85 |
+| macOS: a Seatbelt room with the real login | same | each agent answered one prompt. The room and its login copy were removed afterwards, and the Keychain item was unchanged (digest before and after). `tare probe` read `tare: 0.00` for all three | comments on epic #85 |
+| macOS: dirty twin, Seatbelt room, and parts of the real setup copied into the room | same | every room read `tare: 0.00`. Each copied part that reached the request was named with its source, and nothing under the home directory, under `/var/folders`, in `/private/tmp` or on the pasteboard was reachable from inside. Two kinds of Codex context are invisible to the probe on any system (#109) | [results](experiments/dirty-twin-macos/RESULTS.md) |
+| macOS: scripted Cliff and Swap, the judge | Claude Code 2.1.290 against scripted models; Microsoft Edge for the judge's screenshot | Cliff found step 4. Swap passed the null check and found the blame passing from the model to the workspace between cut 0 and cut 0.5. `tare judge` rendered a page and scored it. With a project that turns Claude Code's sandbox on, every Bash call failed in a Seatbelt room until tare turned it off | comments on epic #85 |
 
 ## Open questions and ideas
 
@@ -274,8 +324,9 @@ All measurements ran on WSL2 on 2026-10-04 and 2026-10-05.
 - **Codex handoffs:** Codex can run several commands in one tool call, which makes its handoffs
   long.
 - **Cost:** every tail is a full agent run, so a Cliff search or a Swap costs as much as its tails.
-- **macOS:** a room built on Seatbelt (`sandbox-exec`), which Claude Code and Codex already use
-  for their own sandboxes. In progress (epic #85), not in a release yet.
+- **macOS:** the room is built on Seatbelt, released in 0.3.0 (epic #85). Not done: the
+  Antigravity CLI, whose dirty twin needs Linux's overlay, so tare stops with a message there.
+  Not tested: whether a program started through launchd or XPC runs outside the room's profile.
 - **Other probes, not built:** weighing the first request's input tokens before and after adding
   junk to the real setup, and file tripwires that report which secret files a run opened.
 - **Docker:** could contain files where bubblewrap is missing, but does nothing against context

tare_cli-0.3.1/PKG-INFO

@@ -0,0 +1,172 @@
+Metadata-Version: 2.5
+Name: tare-cli
+Version: 0.3.1
+Summary: Prove your coding agent starts without your personal setup before you measure it.
+Project-URL: Homepage, https://github.com/a-ratz/tare
+Project-URL: Repository, https://github.com/a-ratz/tare
+Project-URL: Issues, https://github.com/a-ratz/tare/issues
+Project-URL: Concept, https://github.com/a-ratz/tare/blob/main/CONCEPT.md
+Author: Andre Ratzenberger
+License-Expression: MIT
+License-File: LICENSE
+Keywords: agent-evaluation,ai-agents,claude-code,codex,coding-agents,evals,llm-evaluation,sandbox
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Testing
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+<div align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/a-ratz/tare/main/.github/logo-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/a-ratz/tare/main/.github/logo-light.svg">
+    <img alt="tare" src="https://raw.githubusercontent.com/a-ratz/tare/main/.github/logo-light.svg" width="260">
+  </picture>
+
+  <p><b>Zero the scale before you weigh.</b><br>
+  Prove your coding agent starts without your personal setup, then measure it.</p>
+</div>
+
+<div align="center">
+
+[![License: MIT][license-shield]][license-url]
+[![PyPI][version-shield]][version-url]
+[![Python 3.11+][python-shield]][python-url]
+[![Linux | WSL | macOS][platform-shield]][platform-url]
+[![Claude Code | Codex | Pi | Antigravity][agent-shield]][agent-url]
+
+</div>
+
+<div align="center">
+  <a href="#quick-start">Quick start</a> &middot;
+  <a href="#features">Features</a> &middot;
+  <a href="https://github.com/a-ratz/tare/blob/main/docs/README.md">Documentation</a> &middot;
+  <a href="https://github.com/a-ratz/tare/blob/main/CONCEPT.md">Concept</a> &middot;
+  <a href="https://github.com/a-ratz/tare/issues/new?template=bug_report.md">Report Bug</a>
+</div>
+
+<br>
+
+---
+
+Your coding agent knows you. Every run loads your global instructions, memories, skills, MCP
+servers and connected accounts. At work that is the point. In an evaluation it is noise. Compare
+runs with and without a skill on your own machine, and both runs carry your setup. You measure
+your machine, not the skill.
+
+**tare** starts the agent in a room that holds nothing of yours and proves the room is clean
+before every run. It works with Claude Code, Codex, Pi and Google's Antigravity CLI on Linux and
+WSL, and with the first three on macOS.
+
+```text
+$ tare probe claude
+tare probe · claude 2.1.289 · /home/me/tare
+  control   dirty twin shows: instructions, home path, mcp, skills, plugins, email, reach
+  leaks     none
+  declared
+    email        account email                                subscription login
+    credentials  /home/tare/.claude-config/.credentials.json  copy of the login, needed by the CLI
+tare: 0.00
+```
+
+`tare: 0.00` is the zeroed scale. Nothing of your setup reached the model except what the reading
+declares. A reading with leaks names each one and the file it came from, and the agent does not
+start.
+
+## Quick start
+
+```bash
+uv tool install tare-cli            # or: pipx install tare-cli
+tare probe claude                   # prove the room is clean
+tare claude -- -p "fix the tests"   # run Claude Code in it
+```
+
+On Linux and WSL, tare also needs bubblewrap (`sudo apt install bubblewrap`). The
+[install guide](https://github.com/a-ratz/tare/blob/main/docs/install.md) has the details per
+platform, and [Reading a probe](https://github.com/a-ratz/tare/blob/main/docs/probe.md) explains
+every line of the output above.
+
+## Features
+
+- **Measures what the model receives.** The probe records the request the agent sends to a fake
+  model server on your machine. It makes no paid calls and never asks the agent about itself,
+  because an agent asked about its own context can refuse or be wrong.
+  [How it works](https://github.com/a-ratz/tare/blob/main/docs/how-it-works.md)
+- **Knows when it cannot see.** A dirty twin runs the agent in your real setup. If the probe could
+  not see your setup there, the reading is `tare: not proven (blind)` instead of a `0.00` that
+  proves nothing. [Reading a probe](https://github.com/a-ratz/tare/blob/main/docs/probe.md)
+- **Keeps your files out and your login working.** The room has no home directory of yours, no
+  credentials of your other tools and no secret environment variables. It gets a fresh copy of
+  your login, which tare deletes after the run.
+  [Running agents in rooms](https://github.com/a-ratz/tare/blob/main/docs/running-agents.md)
+- **Compares skills, plugins and models.** `tare calibrate` starts each side several times from
+  scratch and reports pass rates with their intervals.
+  [Calibrate](https://github.com/a-ratz/tare/blob/main/docs/calibrate.md)
+- **Scores what no test can decide.** `tare judge` lets a second agent score a page by your
+  rubric, without agent or model names, and `tare judge-noise` shows how far its scores vary.
+  [Judge](https://github.com/a-ratz/tare/blob/main/docs/judge.md)
+- **Tells the workspace from the agent.** `tare swap` lets two agents continue each other's
+  unfinished work and reports whether the workspace or the agent decided the outcome.
+  [Swap](https://github.com/a-ratz/tare/blob/main/docs/swap.md)
+- **Finds the step where a failed run was lost** (experimental). `tare cliff` restarts the run
+  from its saved steps and names the step after which it no longer passes.
+  [Cliff](https://github.com/a-ratz/tare/blob/main/docs/cliff.md)
+- **Live dashboard, cost and reruns.** A dashboard follows every run, each report ends with tokens
+  and cost, and `tare rerun` repeats a run from its recipe.
+  [Dashboard and rerun](https://github.com/a-ratz/tare/blob/main/docs/dashboard.md) ·
+  [Tokens and cost](https://github.com/a-ratz/tare/blob/main/docs/tokens-and-cost.md)
+
+## When to use
+
+| Use tare when | Look elsewhere when |
+|---|---|
+| you compare agent runs with and without a skill, plugin or prompt | you need protection from a hostile agent, because the room has network access and a working login |
+| you benchmark agents on your own machine | you use the Antigravity CLI on macOS (not supported there yet) |
+| you want a fresh-machine run without a fresh machine | you log in with an API key only (untested) |
+| an agent failed a task and you want to know which step lost it | you want a single run explained without running the agent again, because Cliff runs it many times |
+
+## Documentation
+
+| | |
+|---|---|
+| **Getting started** | [Install](https://github.com/a-ratz/tare/blob/main/docs/install.md) · [The words tare uses](https://github.com/a-ratz/tare/blob/main/docs/words.md) · [Running agents in rooms](https://github.com/a-ratz/tare/blob/main/docs/running-agents.md) · [Reading a probe](https://github.com/a-ratz/tare/blob/main/docs/probe.md) |
+| **Measuring** | [Overview](https://github.com/a-ratz/tare/blob/main/docs/measuring.md) · [Calibrate](https://github.com/a-ratz/tare/blob/main/docs/calibrate.md) · [Judge](https://github.com/a-ratz/tare/blob/main/docs/judge.md) · [Swap](https://github.com/a-ratz/tare/blob/main/docs/swap.md) · [Cliff](https://github.com/a-ratz/tare/blob/main/docs/cliff.md) · [Tokens and cost](https://github.com/a-ratz/tare/blob/main/docs/tokens-and-cost.md) · [Dashboard and rerun](https://github.com/a-ratz/tare/blob/main/docs/dashboard.md) |
+| **Background** | [How it works](https://github.com/a-ratz/tare/blob/main/docs/how-it-works.md) · [Concept: the design and every measurement](https://github.com/a-ratz/tare/blob/main/CONCEPT.md) · [Experiments](https://github.com/a-ratz/tare/tree/main/experiments) |
+
+## Status
+
+tare is on PyPI as `tare-cli`. Claude Code, Codex and Pi run on Linux, WSL and macOS; the
+Antigravity CLI runs on Linux and WSL, and stops with a message on macOS for now. What comes next
+is in the [open epics](https://github.com/a-ratz/tare/issues?q=is%3Aissue+is%3Aopen+label%3Atype%3Aepic).
+
+## Contributing
+
+Every change starts as an issue. Larger work is an epic, split into features, and one epic
+becomes one branch and one pull request. [AGENTS.md](https://github.com/a-ratz/tare/blob/main/AGENTS.md)
+describes the process, the checks and the conventions. Run the tests with `uv run pytest`.
+
+## License
+
+MIT. See [LICENSE](https://github.com/a-ratz/tare/blob/main/LICENSE).
+
+---
+
+Crafted with [Readme Craft](https://github.com/motiful/readme-craft)
+
+[license-shield]: https://img.shields.io/badge/license-MIT-blue.svg
+[license-url]: https://github.com/a-ratz/tare/blob/main/LICENSE
+[version-shield]: https://img.shields.io/pypi/v/tare-cli.svg
+[version-url]: https://pypi.org/project/tare-cli/
+[python-shield]: https://img.shields.io/badge/python-3.11%2B-3776AB.svg
+[python-url]: https://www.python.org/
+[platform-shield]: https://img.shields.io/badge/platform-Linux%20%7C%20WSL%20%7C%20macOS-555555.svg
+[platform-url]: https://github.com/a-ratz/tare/blob/main/docs/install.md
+[agent-shield]: https://img.shields.io/badge/agents-Claude%20Code%20%7C%20Codex%20%7C%20Pi%20%7C%20Antigravity-D97757.svg
+[agent-url]: https://github.com/a-ratz/tare/blob/main/docs/install.md

tare_cli-0.3.1/README.md

@@ -0,0 +1,147 @@
+<div align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/a-ratz/tare/main/.github/logo-dark.svg">
+    <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/a-ratz/tare/main/.github/logo-light.svg">
+    <img alt="tare" src="https://raw.githubusercontent.com/a-ratz/tare/main/.github/logo-light.svg" width="260">
+  </picture>
+
+  <p><b>Zero the scale before you weigh.</b><br>
+  Prove your coding agent starts without your personal setup, then measure it.</p>
+</div>
+
+<div align="center">
+
+[![License: MIT][license-shield]][license-url]
+[![PyPI][version-shield]][version-url]
+[![Python 3.11+][python-shield]][python-url]
+[![Linux | WSL | macOS][platform-shield]][platform-url]
+[![Claude Code | Codex | Pi | Antigravity][agent-shield]][agent-url]
+
+</div>
+
+<div align="center">
+  <a href="#quick-start">Quick start</a> &middot;
+  <a href="#features">Features</a> &middot;
+  <a href="https://github.com/a-ratz/tare/blob/main/docs/README.md">Documentation</a> &middot;
+  <a href="https://github.com/a-ratz/tare/blob/main/CONCEPT.md">Concept</a> &middot;
+  <a href="https://github.com/a-ratz/tare/issues/new?template=bug_report.md">Report Bug</a>
+</div>
+
+<br>
+
+---
+
+Your coding agent knows you. Every run loads your global instructions, memories, skills, MCP
+servers and connected accounts. At work that is the point. In an evaluation it is noise. Compare
+runs with and without a skill on your own machine, and both runs carry your setup. You measure
+your machine, not the skill.
+
+**tare** starts the agent in a room that holds nothing of yours and proves the room is clean
+before every run. It works with Claude Code, Codex, Pi and Google's Antigravity CLI on Linux and
+WSL, and with the first three on macOS.
+
+```text
+$ tare probe claude
+tare probe · claude 2.1.289 · /home/me/tare
+  control   dirty twin shows: instructions, home path, mcp, skills, plugins, email, reach
+  leaks     none
+  declared
+    email        account email                                subscription login
+    credentials  /home/tare/.claude-config/.credentials.json  copy of the login, needed by the CLI
+tare: 0.00
+```
+
+`tare: 0.00` is the zeroed scale. Nothing of your setup reached the model except what the reading
+declares. A reading with leaks names each one and the file it came from, and the agent does not
+start.
+
+## Quick start
+
+```bash
+uv tool install tare-cli            # or: pipx install tare-cli
+tare probe claude                   # prove the room is clean
+tare claude -- -p "fix the tests"   # run Claude Code in it
+```
+
+On Linux and WSL, tare also needs bubblewrap (`sudo apt install bubblewrap`). The
+[install guide](https://github.com/a-ratz/tare/blob/main/docs/install.md) has the details per
+platform, and [Reading a probe](https://github.com/a-ratz/tare/blob/main/docs/probe.md) explains
+every line of the output above.
+
+## Features
+
+- **Measures what the model receives.** The probe records the request the agent sends to a fake
+  model server on your machine. It makes no paid calls and never asks the agent about itself,
+  because an agent asked about its own context can refuse or be wrong.
+  [How it works](https://github.com/a-ratz/tare/blob/main/docs/how-it-works.md)
+- **Knows when it cannot see.** A dirty twin runs the agent in your real setup. If the probe could
+  not see your setup there, the reading is `tare: not proven (blind)` instead of a `0.00` that
+  proves nothing. [Reading a probe](https://github.com/a-ratz/tare/blob/main/docs/probe.md)
+- **Keeps your files out and your login working.** The room has no home directory of yours, no
+  credentials of your other tools and no secret environment variables. It gets a fresh copy of
+  your login, which tare deletes after the run.
+  [Running agents in rooms](https://github.com/a-ratz/tare/blob/main/docs/running-agents.md)
+- **Compares skills, plugins and models.** `tare calibrate` starts each side several times from
+  scratch and reports pass rates with their intervals.
+  [Calibrate](https://github.com/a-ratz/tare/blob/main/docs/calibrate.md)
+- **Scores what no test can decide.** `tare judge` lets a second agent score a page by your
+  rubric, without agent or model names, and `tare judge-noise` shows how far its scores vary.
+  [Judge](https://github.com/a-ratz/tare/blob/main/docs/judge.md)
+- **Tells the workspace from the agent.** `tare swap` lets two agents continue each other's
+  unfinished work and reports whether the workspace or the agent decided the outcome.
+  [Swap](https://github.com/a-ratz/tare/blob/main/docs/swap.md)
+- **Finds the step where a failed run was lost** (experimental). `tare cliff` restarts the run
+  from its saved steps and names the step after which it no longer passes.
+  [Cliff](https://github.com/a-ratz/tare/blob/main/docs/cliff.md)
+- **Live dashboard, cost and reruns.** A dashboard follows every run, each report ends with tokens
+  and cost, and `tare rerun` repeats a run from its recipe.
+  [Dashboard and rerun](https://github.com/a-ratz/tare/blob/main/docs/dashboard.md) ·
+  [Tokens and cost](https://github.com/a-ratz/tare/blob/main/docs/tokens-and-cost.md)
+
+## When to use
+
+| Use tare when | Look elsewhere when |
+|---|---|
+| you compare agent runs with and without a skill, plugin or prompt | you need protection from a hostile agent, because the room has network access and a working login |
+| you benchmark agents on your own machine | you use the Antigravity CLI on macOS (not supported there yet) |
+| you want a fresh-machine run without a fresh machine | you log in with an API key only (untested) |
+| an agent failed a task and you want to know which step lost it | you want a single run explained without running the agent again, because Cliff runs it many times |
+
+## Documentation
+
+| | |
+|---|---|
+| **Getting started** | [Install](https://github.com/a-ratz/tare/blob/main/docs/install.md) · [The words tare uses](https://github.com/a-ratz/tare/blob/main/docs/words.md) · [Running agents in rooms](https://github.com/a-ratz/tare/blob/main/docs/running-agents.md) · [Reading a probe](https://github.com/a-ratz/tare/blob/main/docs/probe.md) |
+| **Measuring** | [Overview](https://github.com/a-ratz/tare/blob/main/docs/measuring.md) · [Calibrate](https://github.com/a-ratz/tare/blob/main/docs/calibrate.md) · [Judge](https://github.com/a-ratz/tare/blob/main/docs/judge.md) · [Swap](https://github.com/a-ratz/tare/blob/main/docs/swap.md) · [Cliff](https://github.com/a-ratz/tare/blob/main/docs/cliff.md) · [Tokens and cost](https://github.com/a-ratz/tare/blob/main/docs/tokens-and-cost.md) · [Dashboard and rerun](https://github.com/a-ratz/tare/blob/main/docs/dashboard.md) |
+| **Background** | [How it works](https://github.com/a-ratz/tare/blob/main/docs/how-it-works.md) · [Concept: the design and every measurement](https://github.com/a-ratz/tare/blob/main/CONCEPT.md) · [Experiments](https://github.com/a-ratz/tare/tree/main/experiments) |
+
+## Status
+
+tare is on PyPI as `tare-cli`. Claude Code, Codex and Pi run on Linux, WSL and macOS; the
+Antigravity CLI runs on Linux and WSL, and stops with a message on macOS for now. What comes next
+is in the [open epics](https://github.com/a-ratz/tare/issues?q=is%3Aissue+is%3Aopen+label%3Atype%3Aepic).
+
+## Contributing
+
+Every change starts as an issue. Larger work is an epic, split into features, and one epic
+becomes one branch and one pull request. [AGENTS.md](https://github.com/a-ratz/tare/blob/main/AGENTS.md)
+describes the process, the checks and the conventions. Run the tests with `uv run pytest`.
+
+## License
+
+MIT. See [LICENSE](https://github.com/a-ratz/tare/blob/main/LICENSE).
+
+---
+
+Crafted with [Readme Craft](https://github.com/motiful/readme-craft)
+
+[license-shield]: https://img.shields.io/badge/license-MIT-blue.svg
+[license-url]: https://github.com/a-ratz/tare/blob/main/LICENSE
+[version-shield]: https://img.shields.io/pypi/v/tare-cli.svg
+[version-url]: https://pypi.org/project/tare-cli/
+[python-shield]: https://img.shields.io/badge/python-3.11%2B-3776AB.svg
+[python-url]: https://www.python.org/
+[platform-shield]: https://img.shields.io/badge/platform-Linux%20%7C%20WSL%20%7C%20macOS-555555.svg
+[platform-url]: https://github.com/a-ratz/tare/blob/main/docs/install.md
+[agent-shield]: https://img.shields.io/badge/agents-Claude%20Code%20%7C%20Codex%20%7C%20Pi%20%7C%20Antigravity-D97757.svg
+[agent-url]: https://github.com/a-ratz/tare/blob/main/docs/install.md

{tare_cli-0.2.0 → tare_cli-0.3.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tare-cli"
-version = "0.2.0"
+version = "0.3.1"
 description = "Prove your coding agent starts without your personal setup before you measure it."
 readme = "README.md"
 requires-python = ">=3.11"
@@ -13,6 +13,7 @@ classifiers = [
     "Development Status :: 3 - Alpha",
     "Environment :: Console",
     "Intended Audience :: Developers",
+    "Operating System :: MacOS",
     "Operating System :: POSIX :: Linux",
     "Programming Language :: Python :: 3",
     "Programming Language :: Python :: 3.11",