@agentbridge1/cli 0.0.4 → 0.0.6

package/dist/commands/watch.js

@@ -4,6 +4,7 @@ exports.getDirtyWorkingTreeFiles = void 0;
 exports.renderScopedApprovalConfirmation = renderScopedApprovalConfirmation;
 exports.renderCrossingContext = renderCrossingContext;
 exports.shouldRenderSupervisionSummary = shouldRenderSupervisionSummary;
+exports.finalizeWatchSupervision = finalizeWatchSupervision;
 exports.syncAndBuildSupervisionSnapshot = syncAndBuildSupervisionSnapshot;
 exports.renderWatchTaskScopeUsage = renderWatchTaskScopeUsage;
 exports.renderWatchStartupHeader = renderWatchStartupHeader;
@@ -14,6 +15,7 @@ exports.isHandoffRequiredCloseError = isHandoffRequiredCloseError;
 exports.renderIdleCloseFailure = renderIdleCloseFailure;
 exports.openOrResumeServerSessionForWatch = openOrResumeServerSessionForWatch;
 exports.normalizeDirtyWorkingTreeFiles = normalizeDirtyWorkingTreeFiles;
+exports.startupDirtyClassification = startupDirtyClassification;
 exports.ensureWatchRepoClean = ensureWatchRepoClean;
 exports.runWatch = runWatch;
 const node_fs_1 = require("node:fs");
@@ -35,9 +37,12 @@ const watch_packet_handshake_1 = require("../watch-packet-handshake");
 const work_context_resolver_1 = require("../work-context-resolver");
 const test_runner_1 = require("../test-runner");
 const revert_crossing_1 = require("../revert-crossing");
+const local_proof_1 = require("../local-proof");
 const supervision_1 = require("../supervision");
+const preflight_changed_files_1 = require("../preflight-changed-files");
 const http_1 = require("../http");
 const error_catalog_1 = require("../error-catalog");
+const proof_obligations_1 = require("../proof-obligations");
 const session_state_2 = require("../session-state");
 const file_fingerprints_1 = require("../file-fingerprints");
 const start_1 = require("./start");
@@ -119,19 +124,22 @@ function shouldRenderSupervisionSummary(lastSignature, snapshot) {
         nextSignature,
     };
 }
+function finalizeWatchSupervision(state, supervision) {
+    return (0, supervision_1.enrichSupervisionWithLocalState)(state, supervision);
+}
 async function syncAndBuildSupervisionSnapshot(input) {
     const { ctx, state, cfgDomains, changedFile, outcome, changeRequestId, unresolvedProtectedCrossing, rollout, timing, } = input;
     const contextError = (err) => (err instanceof Error ? err.message : String(err));
     if (!state.serverSessionId || !ctx) {
         return {
-            supervision: (0, supervision_1.fallbackSupervisionSnapshot)({
+            supervision: finalizeWatchSupervision(state, (0, supervision_1.fallbackSupervisionSnapshot)({
                 workSessionId: state.serverSessionId ?? state.id,
                 changeRequestId,
                 changedFiles: [...state.changedFiles],
                 domains: cfgDomains,
                 unresolvedProtectedCrossing,
                 blocked: state.status === "blocked",
-            }),
+            })),
             acceptanceReport: null,
         };
     }
@@ -191,14 +199,14 @@ async function syncAndBuildSupervisionSnapshot(input) {
             ? await timing.trackAsync("acceptance_check_fetch", fetchAcceptance)
             : await fetchAcceptance();
         return {
-            supervision: overlayLocalChangedFilesOnSupervision((0, supervision_1.supervisionFromAcceptance)(report, cfgDomains), state.changedFiles),
+            supervision: finalizeWatchSupervision(state, overlayLocalChangedFilesOnSupervision((0, supervision_1.supervisionFromAcceptance)(report, cfgDomains), state.changedFiles)),
             syncError,
             acceptanceReport: report,
         };
     }
     catch (err) {
         return {
-            supervision: (0, supervision_1.fallbackSupervisionSnapshot)({
+            supervision: finalizeWatchSupervision(state, (0, supervision_1.fallbackSupervisionSnapshot)({
                 workSessionId: state.serverSessionId ?? state.id,
                 changeRequestId,
                 changedFiles: [...state.changedFiles],
@@ -206,7 +214,7 @@ async function syncAndBuildSupervisionSnapshot(input) {
                 unresolvedProtectedCrossing,
                 blocked: state.status === "blocked",
                 serverAcceptanceUnavailable: contextError(err),
-            }),
+            })),
             syncError,
             acceptanceReport: null,
         };
@@ -218,9 +226,6 @@ function normalizeInline(value) {
 function normalizeTaskSummary(value) {
     return value.trim().replace(/\s+/g, " ").toLowerCase();
 }
-function isActiveLocalSession(state) {
-    return Boolean(state && state.status !== "closed" && state.id !== "none");
-}
 function renderWatchTaskScopeUsage() {
     return [
         "Usage:",
@@ -256,23 +261,172 @@ function inferTaskFromFiles(files, domains) {
     }
     return "Inferred from changed files/current work";
 }
+const NOISY_PATH_PREFIXES = [
+    "node_modules/",
+    "dist/",
+    "build/",
+    "coverage/",
+    ".next/",
+    ".turbo/",
+    ".cache/",
+    ".git/",
+];
+const HIGH_RISK_PATH_HINTS = [
+    "auth",
+    "security",
+    "payment",
+    "billing",
+    "database",
+    "db",
+    "migration",
+    "prisma",
+    "supabase",
+    "package.json",
+    "package-lock.json",
+    "pnpm-lock.yaml",
+    "yarn.lock",
+    "config",
+    "agentbridge",
+    "session",
+    "proof",
+    "protocol",
+];
+function isGeneratedOrNoisyPath(file) {
+    const normalized = normalizeInline(file);
+    if (NOISY_PATH_PREFIXES.some((prefix) => normalized.startsWith(prefix)))
+        return true;
+    if (normalized.endsWith(".tmp") || normalized.endsWith(".cache"))
+        return true;
+    return false;
+}
+function classifyDirtyWorkspace(input) {
+    const localChanged = new Set(input.localState?.changedFiles ?? []);
+    const mtimeByFile = new Map();
+    let newestMtime = null;
+    for (const file of input.files) {
+        const mtime = mtimeMsForFile(file);
+        mtimeByFile.set(file, mtime);
+        if (typeof mtime === "number" && (newestMtime == null || mtime > newestMtime)) {
+            newestMtime = mtime;
+        }
+    }
+    const classified = input.files.map((file) => {
+        const normalized = normalizeInline(file);
+        const noisy = isGeneratedOrNoisyPath(normalized);
+        const resolved = (0, domain_resolution_1.resolveDomainForFile)(normalized, input.domains);
+        const tier = resolved.tier ?? null;
+        const isHighRiskTier = tier === "tier_a" || tier === "tier_b";
+        const isHighRiskPath = HIGH_RISK_PATH_HINTS.some((hint) => normalized.includes(hint));
+        const risk = isHighRiskTier || isHighRiskPath ? "high" : "normal";
+        const reasons = [];
+        let bucket = "background_dirty";
+        if (noisy) {
+            bucket = "generated_noisy";
+            reasons.push("generated/noisy path");
+        }
+        else if (localChanged.has(normalized)) {
+            bucket = "likely_current_work";
+            reasons.push("already tracked in local session");
+        }
+        else {
+            const mtime = mtimeByFile.get(normalized) ?? null;
+            const RECENT_WINDOW_MS = 15 * 60 * 1000;
+            if (newestMtime != null && mtime != null && newestMtime - mtime <= RECENT_WINDOW_MS) {
+                bucket = "likely_current_work";
+                reasons.push("recently modified");
+            }
+            else if (/^(src|app|server|modules|cli|docs|config|scripts)\//.test(normalized)) {
+                bucket = "likely_current_work";
+                reasons.push("source/docs/config path");
+            }
+            else {
+                reasons.push("pre-existing or unrelated dirty background");
+            }
+        }
+        if (risk === "high")
+            reasons.push("high-risk path/domain");
+        return {
+            file: normalized,
+            bucket,
+            reasons,
+            domain: resolved.domain ?? null,
+            tier,
+            risk,
+            mtimeMs: mtimeByFile.get(normalized) ?? null,
+        };
+    });
+    const rankScore = (entry) => {
+        const riskScore = entry.risk === "high" ? 1000 : 0;
+        const bucketScore = entry.bucket === "likely_current_work" ? 200 : entry.bucket === "background_dirty" ? 100 : 0;
+        const mtimeScore = entry.mtimeMs ?? 0;
+        return riskScore + bucketScore + mtimeScore;
+    };
+    const sortedRelevant = classified
+        .filter((entry) => entry.bucket !== "generated_noisy")
+        .sort((a, b) => rankScore(b) - rankScore(a));
+    const topRelevant = sortedRelevant.slice(0, 10).map((entry) => entry.file);
+    const hiddenCount = Math.max(0, classified.length - topRelevant.length);
+    const highRiskTop = sortedRelevant.filter((entry) => entry.risk === "high").slice(0, 3).map((entry) => entry.file);
+    return { classified, topRelevant, hiddenCount, highRiskTop };
+}
+function renderDirtyWorkspaceDetails(classified) {
+    const renderBucket = (bucket, title) => {
+        const entries = classified.filter((entry) => entry.bucket === bucket);
+        if (entries.length === 0)
+            return [];
+        return [
+            `${title}:`,
+            ...entries.map((entry) => `- ${entry.file} [risk=${entry.risk}; domain=${entry.domain ?? "Unknown"}; reason=${entry.reasons.join("; ")}]`),
+            "",
+        ];
+    };
+    return [
+        "Details (dirty workspace classification):",
+        ...renderBucket("likely_current_work", "Likely current work"),
+        ...renderBucket("background_dirty", "Background dirty"),
+        ...renderBucket("generated_noisy", "Generated/noisy"),
+    ].join("\n");
+}
 function renderBrainstormingStatus() {
     return [
-        "No coding changes detected yet.",
+        "No coding changes detected.",
         "Mode: brainstorming/planning",
         "Next: When your agent starts changing files, AgentBridge will review proof/scope risk.",
         "",
     ].join("\n");
 }
-function renderCodingDetection(changedFiles, inferredTask) {
-    return [
-        "AgentBridge detected coding work.",
-        `Task: ${inferredTask}`,
-        "Mode: coding/implementation",
+function renderCodingDetection(input) {
+    const summary = classifyDirtyWorkspace({
+        files: input.changedFiles,
+        localState: input.localState,
+        domains: input.domains,
+    });
+    const hasBaseline = Boolean(input.localState && input.localState.id !== "none" && input.localState.status !== "closed");
+    const lines = [
+        "AgentBridge is watching.",
+        "Mode:",
+        "Coding changes detected",
+        `Task: ${input.inferredTask}`,
         "Changed files:",
-        ...changedFiles.map((file) => `- ${file}`),
-        "",
-    ].join("\n");
+        ...summary.topRelevant.map((file) => `- ${file}`),
+        ...(summary.hiddenCount > 0
+            ? [
+                `+ ${summary.hiddenCount} more changed files hidden.`,
+                "Run `agentbridge watch --details` to inspect everything.",
+            ]
+            : []),
+    ];
+    if (!hasBaseline && input.changedFiles.length > 0) {
+        lines.push("", "AgentBridge found existing changes.", "If these changes happened before AgentBridge started, verify them or clean them up before trusting the work.", "AgentBridge found an already-dirty workspace.", "Some changes may be from before AgentBridge started.", "AgentBridge will still flag proof/drift risk, but this may include older work.");
+    }
+    if (summary.highRiskTop.length > 0) {
+        lines.push("", `High-risk changes prioritized: ${summary.highRiskTop.join(", ")}`);
+    }
+    if (input.details) {
+        lines.push("", renderDirtyWorkspaceDetails(summary.classified));
+    }
+    lines.push("");
+    return lines.join("\n");
 }
 function detectInferredDomainDrift(files, domains) {
     if (files.length <= 1)
@@ -330,6 +484,10 @@ function renderWatchStartupHeader(input) {
         `Current status: ${input.currentStatus}`,
         `Next guidance: ${input.nextGuidance}`,
         "",
+        "Live supervision: keep this watch session running beside Cursor.",
+        "Task checkpoint/close: agentbridge start",
+        "Record proof: agentbridge verify -- <test command>",
+        "",
     ].join("\n");
 }
 function renderStartupPhase(step, status) {
@@ -358,6 +516,15 @@ async function flushStdout() {
     await new Promise((resolveTick) => setImmediate(resolveTick));
 }
 function buildWatchBlockingIssue(report, options) {
+    const summarizePromptFiles = (files) => {
+        const unique = [...new Set(files)];
+        if (unique.length === 0)
+            return "current files";
+        const visible = unique.slice(0, 3);
+        if (unique.length <= 3)
+            return visible.join(", ");
+        return `${visible.join(", ")} (+${unique.length - visible.length} more)`;
+    };
     if (options.strictScope && (report.out_of_scope_files ?? []).length > 0) {
         const files = [...new Set(report.out_of_scope_files ?? [])];
         return {
@@ -368,9 +535,9 @@ function buildWatchBlockingIssue(report, options) {
             suggestedPrompt: [
                 "You changed files outside the allowed scope.",
                 "Revert them, justify why they are required and ask to expand scope, or split them into a separate task.",
-                `Out-of-scope files: ${files.join(", ")}`,
+                `Out-of-scope files: ${summarizePromptFiles(files)}`,
             ].join("\n"),
-            nextAction: "Revert out-of-scope files, then run: agentbridge check",
+            nextAction: "Revert out-of-scope files, then rerun: agentbridge watch",
         };
     }
     if (report.decision === "stale_evidence") {
@@ -378,12 +545,12 @@ function buildWatchBlockingIssue(report, options) {
         return {
             errorCode: "PROOF_STALE_AFTER_CHANGE",
             whatHappened: "Verification proof is stale because files changed after the last passing verify.",
-            whyItMatters: "Acceptance needs proof that matches the final edited files.",
+            whyItMatters: "Proof must match the final edited files before you can trust the agent is done.",
             files: staleFiles,
             suggestedPrompt: [
                 "Your proof is stale because files changed after verification.",
                 "Rerun verification after your final edit, then rerun AgentBridge watch.",
-                `Files: ${staleFiles.join(", ")}`,
+                `Files: ${summarizePromptFiles(staleFiles)}`,
             ].join("\n"),
             nextAction: "Run a verification command for the final changed files.",
         };
@@ -392,26 +559,30 @@ function buildWatchBlockingIssue(report, options) {
         return {
             errorCode: "VERIFICATION_FAILED",
             whatHappened: "verification failed",
-            whyItMatters: "Failed verification cannot be used as acceptance proof.",
+            whyItMatters: "Failed verification cannot count as proof.",
             files: [...new Set(report.changed_files)],
             suggestedPrompt: [
                 "The last verification command failed.",
-                "Please fix the failure and rerun verification with a passing result before handoff.",
+                "Please fix the failure and rerun verification with a passing result, then rerun AgentBridge watch.",
             ].join("\n"),
             nextAction: "Fix verification failures, then rerun verification on final files.",
         };
     }
+    const blockingObligation = (0, proof_obligations_1.primaryBlockingObligation)(report);
+    if (blockingObligation) {
+        return (0, proof_obligations_1.buildWatchBlockingIssueFromObligation)(report, blockingObligation);
+    }
     if (report.decision === "needs_proof") {
         const files = [...new Set(report.changed_files)];
         return {
             errorCode: "PROOF_MISSING",
             whatHappened: "No valid verification proof is attached to the current work.",
-            whyItMatters: "Work cannot be accepted without fresh proof for the current scope.",
+            whyItMatters: "Coding changes need AgentBridge-recorded proof before they are safe to trust.",
             files,
             suggestedPrompt: [
-                "Your work is not ready. AgentBridge found changed files with no proof attached.",
+                `AgentBridge found ${files.length} changed files without proof.`,
                 "Run verification for the changed files, then rerun AgentBridge watch.",
-                `Files: ${files.join(", ") || "current files"}`,
+                `Files: ${summarizePromptFiles(files)}`,
             ].join("\n"),
             nextAction: "Run a verification command for the changed files.",
         };
@@ -419,16 +590,25 @@ function buildWatchBlockingIssue(report, options) {
     return null;
 }
 function buildFallbackWatchBlockingIssue(supervision) {
+    const summarizePromptFiles = (files) => {
+        const unique = [...new Set(files)];
+        if (unique.length === 0)
+            return "current files";
+        const visible = unique.slice(0, 3);
+        if (unique.length <= 3)
+            return visible.join(", ");
+        return `${visible.join(", ")} (+${unique.length - visible.length} more)`;
+    };
     if (supervision.decision === "needs_proof") {
         return {
             errorCode: "PROOF_MISSING",
             whatHappened: "No valid verification proof is attached to the current work.",
-            whyItMatters: "Work cannot be accepted without fresh proof for the current scope.",
+            whyItMatters: "Coding changes need AgentBridge-recorded proof before they are safe to trust.",
             files: [],
             suggestedPrompt: [
-                "Your work is not ready. AgentBridge found changed files with no proof attached.",
+                `AgentBridge found ${supervision.changedFiles.length} changed files without proof.`,
                 "Run verification for the changed files, then rerun AgentBridge watch.",
-                `Files: ${supervision.changedFiles.length > 0 ? supervision.changedFiles.join(", ") : "current files"}`,
+                `Files: ${summarizePromptFiles(supervision.changedFiles)}`,
             ].join("\n"),
             nextAction: "Run a verification command for the changed files.",
         };
@@ -437,11 +617,11 @@ function buildFallbackWatchBlockingIssue(supervision) {
         return {
             errorCode: "VERIFICATION_FAILED",
             whatHappened: "Current task run is blocked and cannot complete.",
-            whyItMatters: "Blocked runs must be resolved before the task can be marked done.",
+            whyItMatters: "Blocked proof or scope issues must be resolved before the work is safe to trust.",
             files: supervision.changedFiles,
             suggestedPrompt: [
-                "Resolve the problem in this run before completing the task.",
-                `Files in current blocked state: ${supervision.changedFiles.join(", ") || "none listed"}`,
+                "Resolve the verification or scope problem, then rerun AgentBridge watch.",
+                `Files in current blocked state: ${summarizePromptFiles(supervision.changedFiles)}`,
             ].join("\n"),
             nextAction: "Resolve proof/scope problems, then rerun watch.",
         };
@@ -449,12 +629,16 @@ function buildFallbackWatchBlockingIssue(supervision) {
     return null;
 }
 function renderWatchBlockingIssue(issue) {
-    const filesLine = issue.files.length > 0 ? issue.files.join(", ") : "none listed";
+    const files = [...new Set(issue.files)];
+    const visibleFiles = files.slice(0, 10);
+    const hiddenCount = Math.max(0, files.length - visibleFiles.length);
+    const filesLine = visibleFiles.length > 0 ? visibleFiles.join(", ") : "none listed";
     return [
         "AgentBridge caught an issue",
         `What happened: ${issue.whatHappened}`,
         `Why it matters: ${issue.whyItMatters}`,
         `Files: ${filesLine}`,
+        ...(hiddenCount > 0 ? [`+ ${hiddenCount} more files hidden (run \`agentbridge watch --details\`).`] : []),
         `Error code: ${issue.errorCode}`,
         "Suggested prompt to send back to agent:",
         "```text",
@@ -662,9 +846,11 @@ function fileWithinScopedPaths(file, scopedPaths) {
 function startupDirtyClassification(input) {
     const workspaceDirtySnapshot = [...new Set(input.dirtyFiles)].sort();
     const localChanged = new Set(input.localState?.changedFiles ?? []);
-    const localClaimedPaths = [...new Set(input.localState?.claimedPaths ?? [])]
-        .map((claim) => claim.trim())
-        .filter(Boolean);
+    const localClaimedPaths = input.serverReportedEmptyScope
+        ? []
+        : [...new Set(input.localState?.claimedPaths ?? [])]
+            .map((claim) => claim.trim())
+            .filter(Boolean);
     const lanePatterns = input.localState?.laneDomain != null
         ? (input.domains.find((domain) => domain.domain === input.localState?.laneDomain)?.pathPatterns ?? [])
         : [];
@@ -672,20 +858,25 @@ function startupDirtyClassification(input) {
         .map((claim) => claim.trim())
         .filter(Boolean);
     const scopeProven = claimedPaths.length > 0 || lanePatterns.length > 0 || (input.localState?.changedFiles.length ?? 0) > 0;
-    if (input.inferredMode) {
+    if (input.inferredMode && claimedPaths.length === 0) {
+        const postBaseline = input.localState?.startedAt != null
+            ? (0, preflight_changed_files_1.computeCurrentWorkFiles)(input.localState, workspaceDirtySnapshot)
+            : workspaceDirtySnapshot;
         return {
-            acceptanceCandidateFiles: workspaceDirtySnapshot,
+            acceptanceCandidateFiles: postBaseline,
             workspaceDirtySnapshot,
             unscopedStartupDirty: [],
-            scopeProven: workspaceDirtySnapshot.length > 0,
+            scopeProven: postBaseline.length > 0,
         };
     }
     const acceptanceCandidateFiles = workspaceDirtySnapshot.filter((file) => {
-        if (localChanged.has(file))
+        if (!input.inferredMode && localChanged.has(file))
             return true;
         if (claimedPaths.length > 0) {
             return fileWithinScopedPaths(file, claimedPaths);
         }
+        if (localChanged.has(file))
+            return true;
         if (fileWithinScopedPaths(file, lanePatterns))
             return true;
         return false;
@@ -750,7 +941,7 @@ function buildStartupScopeDriftIssue(input) {
     return {
         errorCode: "SCOPE_DRIFT_OUT_OF_SCOPE_FILE",
         whatHappened: "Outside promised scope.",
-        whyItMatters: "Out-of-scope edits break the declared task boundary and block acceptance.",
+        whyItMatters: "Out-of-scope edits break the declared scope boundary and are not safe to trust.",
         files,
         suggestedPrompt: [
             "You changed files outside the allowed scope.",
@@ -856,7 +1047,7 @@ async function runWatchOnceFastPath(input) {
             category: "WATCH_ERROR",
             what: "Watch startup timed out while running the one-shot review.",
             why: "The server did not return the consolidated review in time.",
-            next: "Run `agentbridge doctor`, then retry `agentbridge start`.",
+            next: "Run `agentbridge doctor`, then retry `agentbridge watch`.",
             suggestedPrompt: "AgentBridge could not start watching this task quickly. Run doctor, confirm project access, then retry.",
         })));
     }
@@ -872,7 +1063,7 @@ async function runWatchOnceFastPath(input) {
         // surface the structured catalog error instead of crashing with a raw throw.
         if ((0, http_1.isCliHttpError)(err)) {
             const parsed = (0, http_1.parseCliHttpErrorBody)(err);
-            const rawCode = parsed?.["code"] ?? parsed?.["error"] ?? "";
+            const rawCode = (0, http_1.extractHttpErrorCode)(parsed);
             const catalogCode = (0, error_catalog_1.mapServerCodeToCatalog)(rawCode);
             const SESSION_BINDING_ERRORS = new Set([
                 "WORK_CONTEXT_SCOPE_MISMATCH",
@@ -889,7 +1080,7 @@ async function runWatchOnceFastPath(input) {
                     category: entry?.category ?? "WORK_CONTEXT_ERROR",
                     what: entry?.what ?? err.message,
                     why: entry?.why ?? "The server rejected the local session binding.",
-                    next: entry?.next ?? 'Run `agentbridge start` to create a new session.',
+                    next: entry?.next ?? 'Run `agentbridge watch --allow-dirty` to review current changes.',
                     suggestedPrompt: "AgentBridge found a different active task/scope. Do not continue on the wrong task. Clear or resolve the current run, then start the intended task again.",
                 });
             }
@@ -919,7 +1110,10 @@ async function runWatchOnceFastPath(input) {
     await flushStdout();
     let hadBlockingIssue = false;
     const acceptance = result.acceptance;
-    const supervision = (0, supervision_1.supervisionFromAcceptance)(acceptance, cfg.domains ?? []);
+    const persistedState = (0, session_state_1.readSessionState)();
+    const supervision = persistedState
+        ? finalizeWatchSupervision(persistedState, (0, supervision_1.supervisionFromAcceptance)(acceptance, cfg.domains ?? []))
+        : (0, supervision_1.supervisionFromAcceptance)(acceptance, cfg.domains ?? []);
     timing.trackSync("render_output", () => {
         process.stdout.write(`${(0, supervision_1.renderSupervisionSummary)(supervision)}\n`);
     });
@@ -958,7 +1152,7 @@ async function runWatch(options = {}) {
     }
     const gatesState = (0, gates_1.ensureGatesFile)(repoRoot);
     if (gatesState.malformed) {
-        process.stdout.write("[agentbridge] WARNING: .agentbridge/gates.json is unreadable or malformed — treating all gates as warn_only.\n");
+        process.stdout.write("[agentbridge] WARNING: .agentbridge/gates.json is unreadable or malformed — treating all gates as hard_fail.\n");
         process.stderr.write(`[agentbridge:audit] ${JSON.stringify({
             eventType: "GATES_FILE_PARSE_ERROR",
             message: gatesState.parseError ?? "unknown parse error",
@@ -968,7 +1162,11 @@ async function runWatch(options = {}) {
     const acceptanceRolloutOptions = acceptanceRolloutOptionsFromGates(gatesState.gates);
     const taskScopeInput = parseTaskScopeInput(options);
     const localSession = timing.trackSync("local_session_read", () => (0, session_state_1.readSessionState)());
-    const hasActiveLocalSession = isActiveLocalSession(localSession);
+    const hasActiveLocalSession = (0, session_state_1.isActiveLocalSession)(localSession);
+    if (hasActiveLocalSession && localSession && cfg.domains?.length) {
+        localSession.domains = cfg.domains;
+        (0, session_state_1.writeSessionState)(localSession);
+    }
     const explicitStrictMode = Boolean(taskScopeInput.task && taskScopeInput.scope);
     if (hasActiveLocalSession && explicitStrictMode) {
         const activeLocalSession = localSession;
@@ -986,8 +1184,8 @@ async function runWatch(options = {}) {
                 `Current scope: ${(activeLocalSession.claimedPaths ?? []).join(", ") || "(unknown)"}`,
                 "",
                 "Next action:",
-                "- Finish/clear the current task (agentbridge done or agentbridge session abandon --reason \"...\")",
-                '- Or explicitly start a new one: agentbridge start --summary "<new task>" --scope "<new scope>"',
+                "- Finish or clear the current session (agentbridge done or agentbridge session abandon --reason \"...\")",
+                '- Or run watch with a new explicit task: agentbridge watch --task "<new task>" --scope "<new scope>" --allow-dirty',
                 "",
             ].join("\n"));
             process.exitCode = 1;
@@ -1012,27 +1210,27 @@ async function runWatch(options = {}) {
     await flushStdout();
     process.stdout.write(renderStartupPhase("resolving project", "starting"));
     await flushStdout();
+    const hasRecoveredDomainMap = Boolean(cfg.domains && cfg.domains.length > 0);
     timing.trackSync("identity_resolution", () => {
-        if (!cfg.activeAgentId) {
+        if (explicitStrictMode && !cfg.activeAgentId) {
             throw new errors_1.SafeCliError({
                 code: "IDENTITY_NO_ACTIVE_AGENT",
                 category: "IDENTITY_ERROR",
-                what: "No active agent configured.",
-                why: "Watch needs a WorkIdentity selected for this repo.",
+                what: "No active agent configured for strict watch mode.",
+                why: "Strict watch mode needs an internal WorkIdentity selection for scoped task ownership.",
                 next: "Run `agentbridge identity list` then `agentbridge use <agent-id>`.",
             });
         }
-        if (!cfg.domains || cfg.domains.length === 0) {
-            throw new errors_1.SafeCliError({
-                code: "CONFIG_NO_DOMAIN_MAP",
-                category: "CONFIG_ERROR",
-                what: "No recovered domain map found in .agentbridge/config.json.",
-                why: "Watch uses domain boundaries to enforce scoped file tracking.",
-                next: "Run `agentbridge init` to recover domains for this repo.",
-            });
-        }
     });
-    let activeAgentId = cfg.activeAgentId;
+    if (!explicitStrictMode && !cfg.activeAgentId) {
+        process.stdout.write("Startup note: no active internal agent selected. Inferred mode will continue using room-level connection and local supervision.\n");
+        await flushStdout();
+    }
+    if (!hasRecoveredDomainMap) {
+        process.stdout.write("Startup note: domain map is not fully recovered yet. AgentBridge will keep watching with best-effort drift checks.\n");
+        await flushStdout();
+    }
+    let activeAgentId = cfg.activeAgentId ?? "inferred-room-connection";
     if (options.changeRequestId || options.executionSurfaceId) {
         (0, config_1.updateConfig)({
             ...(options.changeRequestId ? { activeChangeRequestId: options.changeRequestId } : {}),
@@ -1058,7 +1256,7 @@ async function runWatch(options = {}) {
                 category: "WATCH_ERROR",
                 what: "Watch startup timed out while resolving project context.",
                 why: "Project/session context could not be resolved in time.",
-                next: "Run `agentbridge doctor`, then retry `agentbridge start`.",
+                next: "Run `agentbridge doctor`, then retry `agentbridge watch`.",
                 suggestedPrompt: "AgentBridge could not start watching this task quickly. Run doctor, confirm project access, then retry.",
             })));
         }
@@ -1076,7 +1274,7 @@ async function runWatch(options = {}) {
     const canUseFastPath = acceptanceRolloutOptions.rolloutProofTooWeak === "warn_only" &&
         acceptanceRolloutOptions.rolloutProofNotRelevant === "warn_only" &&
         acceptanceRolloutOptions.rolloutImpactCoverageGap === "warn_only";
-    if (options.once && explicitStrictMode && canUseFastPath) {
+    if (options.once && explicitStrictMode) {
         process.stdout.write(renderStartupPhase("starting task", "starting"));
         await flushStdout();
         startingTaskAnnounced = true;
@@ -1117,7 +1315,7 @@ async function runWatch(options = {}) {
                 category: "WATCH_ERROR",
                 what: "Watch startup timed out while starting scoped task/session.",
                 why: "Internal start did not complete before timeout.",
-                next: "Run `agentbridge start --summary \"...\" --scope \"...\"` manually and retry watch.",
+                next: "Run `agentbridge watch --task \"...\" --scope \"...\" --allow-dirty` for strict mode, or retry watch.",
                 suggestedPrompt: "AgentBridge could not start watching this task quickly. Run doctor, confirm project access, then retry.",
             })));
         }
@@ -1130,7 +1328,7 @@ async function runWatch(options = {}) {
                 category: "WATCH_ERROR",
                 what: "Watch could not create or resume the scoped task/session.",
                 why: reason,
-                next: "Run `agentbridge start --summary \"...\" --scope \"...\"` and retry watch.",
+                next: "Run `agentbridge watch --task \"...\" --scope \"...\" --allow-dirty` and retry.",
             });
         }
         process.stdout.write(renderStartupPhase("starting task", "done"));
@@ -1142,16 +1340,24 @@ async function runWatch(options = {}) {
     const startupSession = (0, session_state_1.readSessionState)();
     if (explicitStrictMode) {
         if (!startupSession || startupSession.status === "closed" || startupSession.id === "none") {
-            throw new errors_1.SafeCliError({
-                code: "WATCH_STARTUP_SESSION_MISSING",
-                category: "WATCH_ERROR",
-                what: "Watch startup could not find an active local session.",
-                why: "Session creation/resume did not complete.",
-                next: "Run `agentbridge start --summary \"...\" --scope \"...\"` and retry watch.",
-            });
+            if (options.once) {
+                process.stdout.write("[startup] session bootstrap unavailable; continuing one-shot strict supervision without local session binding.\n");
+                await flushStdout();
+            }
+            else {
+                throw new errors_1.SafeCliError({
+                    code: "WATCH_STARTUP_SESSION_MISSING",
+                    category: "WATCH_ERROR",
+                    what: "Watch startup could not find an active local session.",
+                    why: "Session creation/resume did not complete.",
+                    next: "Run `agentbridge watch --task \"...\" --scope \"...\" --allow-dirty` and retry.",
+                });
+            }
+        }
+        if (startupSession?.id) {
+            process.stdout.write(`[startup] session created/resumed: ${startupSession.id}\n`);
+            await flushStdout();
         }
-        process.stdout.write(`[startup] session created/resumed: ${startupSession.id}\n`);
-        await flushStdout();
     }
     else {
         process.stdout.write("[startup] session: inferred mode (will start tracking when coding begins)\n");
@@ -1281,29 +1487,34 @@ async function runWatch(options = {}) {
                     : options.changeRequestId ?? state?.changeRequestId;
                 const executionSurfaceId = options.executionSurfaceId ?? cfg.executionSurfaceId;
                 if (changeRequestId && executionSurfaceId) {
-                    try {
-                        const ctx = (0, config_1.contextFromConfig)();
-                        const opened = await openOrResumeServerSessionForWatch({
-                            ctx,
-                            changeRequestId,
-                            executionSurfaceId,
-                            file,
-                            activeAgentId,
-                            inferredLaneDomain: lane.laneDomain,
-                        });
-                        if (opened) {
-                            serverSessionId = opened.workSessionId;
-                            if (opened.resumed) {
-                                process.stdout.write(`Resumed existing run: ${opened.workSessionId}\n`);
+                    if (activeAgentId === "inferred-room-connection") {
+                        process.stdout.write("Server session sync deferred: internal agent selection is unavailable in inferred mode.\n");
+                    }
+                    else {
+                        try {
+                            const ctx = (0, config_1.contextFromConfig)();
+                            const opened = await openOrResumeServerSessionForWatch({
+                                ctx,
+                                changeRequestId,
+                                executionSurfaceId,
+                                file,
+                                activeAgentId,
+                                inferredLaneDomain: lane.laneDomain,
+                            });
+                            if (opened) {
+                                serverSessionId = opened.workSessionId;
+                                if (opened.resumed) {
+                                    process.stdout.write(`Resumed existing run: ${opened.workSessionId}\n`);
+                                }
+                            }
+                            else {
+                                process.stdout.write("Task is already running but no unique active run could be resolved; continuing local-only.\n");
                             }
                         }
-                        else {
-                            process.stdout.write("Task is already running but no unique active run could be resolved; continuing local-only.\n");
+                        catch (err) {
+                            process.stdout.write(`Server session open failed; continuing local-only: ${String(err)}\n`);
                         }
                     }
-                    catch (err) {
-                        process.stdout.write(`Server session open failed; continuing local-only: ${String(err)}\n`);
-                    }
                 }
                 state = (0, session_1.openLocalSession)({
                     agentId: activeAgentId,
@@ -1312,16 +1523,17 @@ async function runWatch(options = {}) {
                     domains: cfg.domains ?? [],
                     serverSessionId,
                 });
-                process.stdout.write([
+                const sessionBannerLines = [
                     "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━",
                     "  AgentBridge session started",
                     "",
-                    `  Identity        ${state.agentId}`,
-                    `  Allowed lane    ${state.laneDomain ?? "unclassified"}`,
-                    `  Server sync     ${state.serverSessionId ? "enabled" : "local-only"}`,
-                    "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━",
-                    "",
-                ].join("\n"));
+                    `  Mode            ${explicitStrictMode ? "strict/scoped" : "inferred"}`,
+                ];
+                if (explicitStrictMode || options.details) {
+                    sessionBannerLines.push(`  Allowed lane    ${state.laneDomain ?? "unclassified"}`, `  Server sync     ${state.serverSessionId ? "enabled" : "local-only"}`);
+                }
+                sessionBannerLines.push("━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━", "");
+                process.stdout.write(sessionBannerLines.join("\n"));
             }
             const outcome = (0, watch_core_1.applyFileChange)(state, file);
             (0, session_state_1.writeSessionState)(state);
@@ -1354,20 +1566,28 @@ async function runWatch(options = {}) {
             const nextSummary = shouldRenderSupervisionSummary(lastSupervisionSignature, supervision);
             if (nextSummary.shouldRender) {
                 timing.trackSync("render_output", () => {
-                    process.stdout.write(`${(0, supervision_1.renderSupervisionSummary)(supervision)}\n`);
+                    process.stdout.write(`${(0, supervision_1.renderSupervisionSummary)(supervision, {
+                        compact: !explicitStrictMode && !options.details,
+                    })}\n`);
                 });
                 lastSupervisionSignature = nextSummary.nextSignature;
             }
+            const renderSupervisionProofIssue = explicitStrictMode || !options.once;
             if (supervisionResult.acceptanceReport) {
                 const blockingIssue = timing.trackSync("proof_fingerprint_comparison", () => buildWatchBlockingIssue(supervisionResult.acceptanceReport, {
                     strictScope: explicitStrictMode,
                 }));
                 const issueSignature = blockingIssue ? JSON.stringify(blockingIssue) : null;
-                if (blockingIssue && issueSignature && issueSignature !== lastBlockingIssueSignature) {
+                if (blockingIssue &&
+                    issueSignature &&
+                    issueSignature !== lastBlockingIssueSignature &&
+                    renderSupervisionProofIssue) {
                     timing.trackSync("render_output", () => {
                         process.stdout.write(renderWatchBlockingIssue(blockingIssue));
                     });
-                    hadBlockingIssue = true;
+                    if (explicitStrictMode) {
+                        hadBlockingIssue = true;
+                    }
                     lastBlockingIssueSignature = issueSignature;
                 }
                 else if (!issueSignature) {
@@ -1377,11 +1597,16 @@ async function runWatch(options = {}) {
             else {
                 const blockingIssue = timing.trackSync("proof_fingerprint_comparison", () => buildFallbackWatchBlockingIssue(supervision));
                 const issueSignature = blockingIssue ? JSON.stringify(blockingIssue) : null;
-                if (blockingIssue && issueSignature && issueSignature !== lastBlockingIssueSignature) {
+                if (blockingIssue &&
+                    issueSignature &&
+                    issueSignature !== lastBlockingIssueSignature &&
+                    renderSupervisionProofIssue) {
                     timing.trackSync("render_output", () => {
                         process.stdout.write(renderWatchBlockingIssue(blockingIssue));
                     });
-                    hadBlockingIssue = true;
+                    if (explicitStrictMode) {
+                        hadBlockingIssue = true;
+                    }
                     lastBlockingIssueSignature = issueSignature;
                 }
                 else if (!issueSignature) {
@@ -1407,6 +1632,10 @@ async function runWatch(options = {}) {
             if (!outcome.requiresAuthorityPrompt)
                 return;
             if (outcome.requestType === "handshake") {
+                if (!explicitStrictMode &&
+                    (outcome.crossingTier === "tier_d" || outcome.crossingTier === "tier_c")) {
+                    return;
+                }
                 const crossingDomain = outcome.crossingDomain;
                 if (crossingDomain && !domainPacketsLoaded.has(crossingDomain)) {
                     domainPacketsLoaded.add(crossingDomain);
@@ -1451,9 +1680,13 @@ async function runWatch(options = {}) {
                 file,
                 tier: outcome.crossingTier,
             })}\n`);
-            const response = options.daemon
+            const skipInteractivePrompt = options.daemon || (options.once && !explicitStrictMode);
+            const response = skipInteractivePrompt
                 ? { decision: "deny" }
                 : await promptDecision();
+            if (skipInteractivePrompt && !options.daemon) {
+                return;
+            }
             if (options.daemon) {
                 process.stdout.write(`[daemon] Domain crossing denied automatically (no interactive prompt in daemon mode). Use the dashboard to approve.\n`);
             }
@@ -1585,16 +1818,29 @@ async function runWatch(options = {}) {
             return;
         }
         let startupState = (0, session_state_1.readSessionState)();
+        if (!explicitStrictMode && !(0, session_state_1.isActiveLocalSession)(startupState)) {
+            const lane = (0, domain_resolution_1.inferLaneFromFiles)(startupDirtyFiles, cfg.domains ?? []);
+            startupState = (0, session_1.openLocalSession)({
+                agentId: activeAgentId,
+                laneDomain: lane.laneDomain,
+                claimedPaths: [...(startupState?.claimedPaths ?? [])],
+                domains: cfg.domains ?? [],
+                serverSessionId: startupState?.serverSessionId,
+                changeRequestId: startupState?.changeRequestId,
+            });
+            (0, session_state_1.writeSessionState)(startupState);
+        }
         const changeRequestId = explicitStrictMode
             ? options.changeRequestId ?? cfg.activeChangeRequestId ?? null
             : options.changeRequestId ?? startupState?.changeRequestId ?? null;
         let startupClaimedPaths = [];
         let startupServerSessionId = null;
+        let serverReportedEmptyScope = false;
         startupClaimedPaths = [...(startupState?.claimedPaths ?? [])];
         if (startupState?.serverSessionId) {
             startupServerSessionId = startupState.serverSessionId;
         }
-        else if (changeRequestId) {
+        else if (changeRequestId && explicitStrictMode) {
             try {
                 const ctx = (0, config_1.contextFromConfig)();
                 const resolved = await (0, work_context_resolver_1.findSingleActiveSessionForChangeRequest)(ctx, changeRequestId);
@@ -1606,11 +1852,22 @@ async function runWatch(options = {}) {
                 startupServerSessionId = null;
             }
         }
-        if (startupServerSessionId) {
+        if (startupServerSessionId && (explicitStrictMode || startupState?.serverSessionId)) {
             try {
                 const ctx = (0, config_1.contextFromConfig)();
                 const report = await timing.trackAsync("acceptance_check_fetch", async () => (0, server_sync_1.fetchAcceptanceCheck)(ctx, { workSessionId: startupServerSessionId, ...acceptanceRolloutOptions }));
-                startupClaimedPaths = [...new Set([...startupClaimedPaths, ...(report.claimed_paths ?? [])])];
+                const serverClaimedPaths = report.claimed_paths ?? [];
+                if (serverClaimedPaths.length > 0) {
+                    startupClaimedPaths = [...new Set([...startupClaimedPaths, ...serverClaimedPaths])];
+                }
+                else if (explicitStrictMode) {
+                    startupClaimedPaths = [...new Set(startupClaimedPaths)];
+                }
+                else {
+                    // Server session exists but reports no claimed scope — default mode treats all dirty files as in play.
+                    startupClaimedPaths = [];
+                    serverReportedEmptyScope = true;
+                }
             }
             catch {
                 // Keep local claimed paths when server claimed paths are unavailable.
@@ -1622,13 +1879,20 @@ async function runWatch(options = {}) {
             claimedPaths: startupClaimedPaths,
             domains: cfg.domains ?? [],
             inferredMode: !explicitStrictMode,
+            serverReportedEmptyScope,
         }));
         if (startupClassification.workspaceDirtySnapshot.length === 0 && !explicitStrictMode) {
             process.stdout.write(renderBrainstormingStatus());
         }
         else if (!explicitStrictMode) {
             const inferredTask = inferTaskFromFiles(startupClassification.workspaceDirtySnapshot, cfg.domains ?? []);
-            process.stdout.write(renderCodingDetection(startupClassification.workspaceDirtySnapshot, inferredTask));
+            process.stdout.write(renderCodingDetection({
+                changedFiles: startupClassification.workspaceDirtySnapshot,
+                inferredTask,
+                localState: startupState,
+                domains: cfg.domains ?? [],
+                details: options.details,
+            }));
         }
         else {
             process.stdout.write(`Startup dirty snapshot detected ${startupClassification.workspaceDirtySnapshot.length} file(s).\n`);
@@ -1679,8 +1943,59 @@ async function runWatch(options = {}) {
             (0, session_state_1.writeSessionState)(startupState);
             process.stdout.write(`Linked local session ${startupState.id} to server session ${startupServerSessionId} before startup supervision.\n`);
         }
-        for (const file of startupClassification.acceptanceCandidateFiles) {
-            await onAbsolutePathChange((0, node_path_1.resolve)((0, node_process_1.cwd)(), file));
+        if (options.once && !explicitStrictMode) {
+            const postBaselineFiles = startupClassification.acceptanceCandidateFiles;
+            const firstChanged = postBaselineFiles[0];
+            if (firstChanged) {
+                await onAbsolutePathChange((0, node_path_1.resolve)((0, node_process_1.cwd)(), firstChanged));
+            }
+            const seededState = (0, session_state_1.readSessionState)();
+            if (seededState) {
+                seededState.changedFiles = [...postBaselineFiles];
+                (0, session_state_1.writeSessionState)(seededState);
+            }
+        }
+        else {
+            const startupFilesForChangeHandler = startupClassification.acceptanceCandidateFiles;
+            for (const file of startupFilesForChangeHandler) {
+                await onAbsolutePathChange((0, node_path_1.resolve)((0, node_process_1.cwd)(), file));
+            }
+        }
+        if (options.once && !explicitStrictMode && startupClassification.acceptanceCandidateFiles.length > 0) {
+            const localProofEvaluation = timing.trackSync("local_proof_evaluation", () => (0, local_proof_1.evaluateLocalProof)(startupClassification.acceptanceCandidateFiles, (0, session_state_1.readSessionState)()?.lastLocalVerificationRun));
+            const localProofIssue = (0, local_proof_1.buildLocalProofBlockingIssue)(localProofEvaluation);
+            if (localProofIssue) {
+                timing.trackSync("render_output", () => {
+                    process.stdout.write(renderWatchBlockingIssue(localProofIssue));
+                });
+                hadBlockingIssue = true;
+            }
+            const domainDrift = detectInferredDomainDrift(startupClassification.acceptanceCandidateFiles, cfg.domains ?? []);
+            if (domainDrift) {
+                timing.trackSync("render_output", () => {
+                    process.stdout.write(renderWatchBlockingIssue(domainDrift.issue));
+                });
+                if (domainDrift.blocking) {
+                    hadBlockingIssue = true;
+                }
+            }
+        }
+        if (options.once && !explicitStrictMode) {
+            const finalState = (0, session_state_1.readSessionState)();
+            if (finalState && (0, session_state_1.isActiveLocalSession)(finalState)) {
+                const postBaseline = timing.trackSync("baseline_classification", () => (0, preflight_changed_files_1.computeCurrentWorkFiles)(finalState));
+                const supervision = finalizeWatchSupervision(finalState, (0, supervision_1.fallbackSupervisionSnapshot)({
+                    workSessionId: finalState.serverSessionId ?? finalState.id,
+                    changeRequestId: finalState.changeRequestId ?? changeRequestId ?? null,
+                    changedFiles: postBaseline.length > 0 ? postBaseline : [...(finalState.changedFiles ?? [])],
+                    domains: cfg.domains ?? [],
+                    unresolvedProtectedCrossing: false,
+                    blocked: finalState.status === "blocked",
+                }));
+                timing.trackSync("render_output", () => {
+                    process.stdout.write(`${(0, supervision_1.renderSupervisionSummary)(supervision, { compact: true })}\n`);
+                });
+            }
         }
     };
     let stop = null;