commons() gains a mode argument. With mode = "trusted only", the agent answers only with trusted calculations. It never writes its own SQL or R, and it tells the user when no trusted calculation answers a question. These answers carry no provenance markers.
On macOS, R code run by run_r can now start other programs, such as through system() or system2(). The sandbox previously stopped every program it started. Those programs run under the same sandbox as the R session.
The CSS classes on run_r's display are now commons-run-display, commons-run-details, commons-run-code, and commons-run-plot, without the -r, because the Python package's code tool uses the same classes. App CSS that targets the old commons-run-r-* names needs updating.
Fixes an issue with the R code sandbox where the generated policy would be too long when there were thousands of R packages installed.
A number of improvements to documentation.