@archme/cli 0.15.1 → 0.17.0

package/dist/cli.js

@@ -13691,6 +13691,89 @@ var init_repoContainer = __esm({
   }
 });
 
+// ../shared/seedArchitecture.ts
+function seedArchitectureFromRows(rows) {
+  const components = [];
+  const stories = [];
+  for (const row of rows) {
+    const compPath = componentPathFromFilePath(row.path);
+    if (compPath !== null) {
+      const parsed = tryParse(row.content);
+      components.push({
+        path: compPath,
+        anchors: parsed?.anchors ?? [],
+        unanchored: parsed?.unanchored === true ? true : void 0
+      });
+      continue;
+    }
+    const scope = storyScopeFromFilePath(row.path);
+    if (scope !== null) {
+      const parsed = tryParse(row.content);
+      if (!parsed) continue;
+      collectSeedStories(parsed, scope, row.path, stories);
+    }
+  }
+  return { components, stories };
+}
+function tryParse(s) {
+  try {
+    return JSON.parse(s);
+  } catch {
+    return null;
+  }
+}
+function componentPathFromFilePath(p) {
+  if (!p.endsWith("/component.json")) return null;
+  const inner = p.slice(0, -"/component.json".length);
+  if (inner.length === 0) return null;
+  const segments = inner.split("/");
+  if (segments.length % 2 !== 0) return null;
+  const ids = [];
+  for (let i2 = 0; i2 < segments.length; i2 += 2) {
+    if (segments[i2] !== "components") return null;
+    const id = segments[i2 + 1];
+    if (!id) return null;
+    ids.push(id);
+  }
+  return `root.${ids.join(".")}`;
+}
+function storyScopeFromFilePath(p) {
+  if (!STORY_PATH_RE.test(p)) return null;
+  const prefix = p.slice(0, p.lastIndexOf("stories/"));
+  if (prefix.length === 0) return [];
+  const segments = prefix.split("/").filter(Boolean);
+  const ids = [];
+  for (let i2 = 0; i2 < segments.length; i2 += 2) {
+    if (segments[i2] !== "components") return null;
+    const id = segments[i2 + 1];
+    if (!id) return null;
+    ids.push(id);
+  }
+  return ids;
+}
+function collectSeedStories(raw, scope, fileFallbackId, out, parentId) {
+  const id = raw.id ?? fileFallbackId;
+  out.push({
+    id,
+    title: raw.title ?? id,
+    sequence: raw.sequence ?? "",
+    draft: raw.draft === true ? true : void 0,
+    scope,
+    parentId
+  });
+  if (Array.isArray(raw.userStories)) {
+    for (const child of raw.userStories) {
+      collectSeedStories(child, scope, fileFallbackId, out, id);
+    }
+  }
+}
+var STORY_PATH_RE;
+var init_seedArchitecture = __esm({
+  "../shared/seedArchitecture.ts"() {
+    STORY_PATH_RE = /^(?:components\/[^/]+\/)*stories\/[^/]+\.json$/;
+  }
+});
+
 // src/scan/affected.ts
 function normalizePath(p) {
   return p.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+/g, "/").replace(/\/$/, "");
@@ -13904,42 +13987,6 @@ function formatAffectedSeed(result, removedSymbols = [], allStories) {
   }
   return lines.join("\n");
 }
-function tryParse(s) {
-  try {
-    return JSON.parse(s);
-  } catch {
-    return null;
-  }
-}
-function componentPathFromFilePath(p) {
-  if (!p.endsWith("/component.json")) return null;
-  const inner = p.slice(0, -"/component.json".length);
-  if (inner.length === 0) return null;
-  const segments = inner.split("/");
-  if (segments.length % 2 !== 0) return null;
-  const ids = [];
-  for (let i2 = 0; i2 < segments.length; i2 += 2) {
-    if (segments[i2] !== "components") return null;
-    const id = segments[i2 + 1];
-    if (!id) return null;
-    ids.push(id);
-  }
-  return `root.${ids.join(".")}`;
-}
-function storyScopeFromFilePath(p) {
-  if (!STORY_PATH_RE.test(p)) return null;
-  const prefix = p.slice(0, p.lastIndexOf("stories/"));
-  if (prefix.length === 0) return [];
-  const segments = prefix.split("/").filter(Boolean);
-  const ids = [];
-  for (let i2 = 0; i2 < segments.length; i2 += 2) {
-    if (segments[i2] !== "components") return null;
-    const id = segments[i2 + 1];
-    if (!id) return null;
-    ids.push(id);
-  }
-  return ids;
-}
 async function loadArchitectureForSeeding(supabase, projectId, branch) {
   const PAGE_SIZE2 = 1e3;
   const rows = [];
@@ -13950,54 +13997,18 @@ async function loadArchitectureForSeeding(supabase, projectId, branch) {
     rows.push(...data);
     if (data.length < PAGE_SIZE2) break;
   }
-  const components = [];
-  const stories = [];
-  for (const row of rows) {
-    const compPath = componentPathFromFilePath(row.path);
-    if (compPath !== null) {
-      const parsed = tryParse(row.content);
-      components.push({
-        path: compPath,
-        anchors: parsed?.anchors ?? [],
-        unanchored: parsed?.unanchored === true ? true : void 0
-      });
-      continue;
-    }
-    const scope = storyScopeFromFilePath(row.path);
-    if (scope !== null) {
-      const parsed = tryParse(row.content);
-      if (!parsed) continue;
-      collectSeedStories(parsed, scope, row.path, stories);
-    }
-  }
-  return { components, stories };
-}
-function collectSeedStories(raw, scope, fileFallbackId, out, parentId) {
-  const id = raw.id ?? fileFallbackId;
-  out.push({
-    id,
-    title: raw.title ?? id,
-    sequence: raw.sequence ?? "",
-    draft: raw.draft === true ? true : void 0,
-    scope,
-    parentId
-  });
-  if (Array.isArray(raw.userStories)) {
-    for (const child of raw.userStories) {
-      collectSeedStories(child, scope, fileFallbackId, out, id);
-    }
-  }
+  return seedArchitectureFromRows(rows);
 }
-var MESSAGE_RE, PARTICIPANT_RE, DISPLAY_FILE_CAP, STORY_PATH_RE;
+var MESSAGE_RE, PARTICIPANT_RE, DISPLAY_FILE_CAP;
 var init_affected = __esm({
   "src/scan/affected.ts"() {
     "use strict";
     init_esm3();
     init_repoContainer();
+    init_seedArchitecture();
     MESSAGE_RE = /^\s*(\{[^}]+\}|\S+?)\s*(--?>>|--?>|->|-->|-x|-\))\s*(\{[^}]+\}|\S+?)\s*:\s*(.*)$/;
     PARTICIPANT_RE = /^\s*participant\s+(\S+?)(?:\s+as\s+.+)?$/;
     DISPLAY_FILE_CAP = 200;
-    STORY_PATH_RE = /^(?:components\/[^/]+\/)*stories\/[^/]+\.json$/;
   }
 });
 
@@ -16251,10 +16262,11 @@ function buildBugReportGuidance(bugsFolderId) {
 
 ${folderMechanic}`;
 }
-var BUGS_FOLDER_TITLE, BUG_REPORT_CORE;
+var BUGS_FOLDER_TITLE, BUGS_FOLDER_DESCRIPTION, BUG_REPORT_CORE;
 var init_bugReport = __esm({
   "../shared/bugReport.ts"() {
     BUGS_FOLDER_TITLE = "Bugs found by ArchMe";
+    BUGS_FOLDER_DESCRIPTION = "Bugs noticed by scan/diff agents in the code while updating the architecture. Prose-only proposals; humans triage.";
     BUG_REPORT_CORE = "**Bugs you happen to notice.** Don't hunt for bugs \u2014 stay on the architecture task \u2014 but don't ignore an obvious, real one that surfaces while you read the code (a null-deref, a missing `await`, an unhandled error path, a broken invariant). Have any sub-agents you dispatch report a suspect back to you (a one-line `possible bug: <what> at <file:line>`) rather than filing it themselves. When suspects come back, dispatch ONE bug-validation sub-agent \u2014 it reads code and calls `create_proposal`, exactly like the build sub-agent, and never modifies the user's code \u2014 and have it: verify each suspect against the code, and for every one it confirms as a real defect, FILE it itself as a prose-only proposal (`create_proposal` with `kind: 'proposal'`, `stage: 'backlog'`, an empty graph delta, and a one-paragraph `body`: what is wrong, where by file:line or symbol, and why), `about` the component it lives in (`{ component: '<root.\u2026 path>' }` \u2014 find_components_for_paths maps the file to it), else the user story whose flow it breaks (`{ story: '<id>' }`). It skips anything it can't confirm, and searches the folder by title first to skip anything already logged. Keep the bar high \u2014 obvious, confirmed defects only, a few per run at most, never speculation, style, or a design opinion; record, never fix. Logging a bug is orthogonal to your architecture task and does NOT replace your completion signal \u2014 still call `update_architecture` or `report_no_change` exactly as you otherwise would.";
   }
 });
@@ -16685,7 +16697,11 @@ var init_validationCodes = __esm({
       WALKTHROUGH_COVERAGE_CHAPTER_NOT_COVERED: "walkthrough.coverage.chapter-not-covered",
       /** The delta added, removed or modified a component no step names. */
       WALKTHROUGH_COVERAGE_COMPONENT_NOT_COVERED: "walkthrough.coverage.component-not-covered",
-      /** The delta changed a connection no step names, joins, or draws. */
+      /**
+       * The delta changed a connection no step names, joins, or draws.
+       * @deprecated Retired: connections show up through the stories that draw
+       * them, so coverage no longer requires them.
+       */
       WALKTHROUGH_COVERAGE_CONNECTION_NOT_COVERED: "walkthrough.coverage.connection-not-covered",
       // ──────────────────────────────────────────────────────────────────────────
       // mcp — request-level rules applied before any tool handler runs
@@ -16742,7 +16758,7 @@ var init_walkthroughGuidance = __esm({
     init_walkthrough();
     WALKTHROUGH_GUIDANCE = `A walkthrough breaks a change into bite-sized chunks a reviewer can step through. Each step names the elements it is about; the review surface filters the sequence diagram and the component graph down to just those, so the reader sees one chunk at a time instead of a forty-element diff at once.
 
-- **Every step must name what it is about** \u2014 the stories, chapters, components and/or connections it covers. A step with only prose is rejected: there is nothing to filter the diagrams by, and an explanation a reader cannot check against the change is exactly what this view exists to avoid.
+- **Every step must name what it is about** \u2014 the stories, chapters, components and/or connections it covers. A step with only prose is rejected: there is nothing to filter the diagrams by, and an explanation a reader cannot check against the change is exactly what this view exists to avoid. Name a connection inside a component as \`<component path>::<id>\` (\`daemon::session_auth->key_account\`); a root connection by its plain id.
 - **Steps are in reading order, not build order.** This is not an implementation plan and not a restatement of your sequencing section \u2014 start where a reviewer should start, and put each step where it makes the next one make sense.
 - **Group by idea.** One step is one coherent change, usually 3\u20138 elements. A one-element step is fine and often valuable: an independent fix that would otherwise be lost among the rest. Aim for a handful of steps; the cap is ${MAX_WALKTHROUGH_STEPS}.
 - **Titles are terse** \u2014 a handle, not a summary. Under ${MAX_STEP_TITLE_CHARS} characters. \`Markers move per-repo\`, not \`This step explains how the source marker moves onto a per-repo table\`.
@@ -16754,7 +16770,7 @@ var init_walkthroughGuidance = __esm({
   - Don't use the change's OWN new vocabulary undefined. If the step introduces a term, say what it means in the same breath or use plain words.
   - Bad: \`A correctness item, not a phase-3 nicety: anchors are repo-relative paths, so two repos with the same conventional layout collide silently and seed stories from the wrong one.\`
   - Good: \`With two repos in one project a path like src/index.ts exists in both, so looking up which component owns a changed file can return the wrong repo's. Each repo now records the container its code lives under, and lookups search only that subtree.\`
-- **Cover every change** \u2014 every story, component and connection the change touches \u2014 or \`set_walkthrough\` rejects the walkthrough and lists what is missing. Guided mode walks the steps and nothing after them, so anything no step reaches is a change the reviewer never sees. A connection is covered when a step names it, names both of its components, or names a story page that draws it as an arrow. Name a connection inside a component as \`<component path>::<id>\` (\`daemon::session_auth->key_account\`); a root connection by its plain id.
+- **Cover every change** \u2014 every story and component the change touches \u2014 or \`set_walkthrough\` rejects the walkthrough and lists what is missing. Guided mode walks the steps and nothing after them, so anything no step reaches is a change the reviewer never sees. Connections need no step of their own: they show up through the stories that draw them.
 - **Skip it for a small change.** A handful of elements needs no walkthrough; omit it rather than writing a step per element.
 - **Prefer CHAPTERS to narrow a diagram.** If a story's sequence carries \`%% chapter: <id> | <Label>\` markers, name the ones your step covers as \`chapters: [{ story, chapter }]\`, using the **id**, never the label \u2014 ids are stable across a rename, labels are not. A chapter is a page break the story's author already wrote, so it is sharper than naming components, where one hub the step mentions decides the whole view.`;
   }
@@ -16865,12 +16881,11 @@ async function ensureBugsFolder(client, projectId) {
     return null;
   }
 }
-var BUGS_FOLDER_DESCRIPTION, cache;
+var cache;
 var init_bugsFolder = __esm({
   "src/daemon/bugsFolder.ts"() {
     "use strict";
     init_bugReport();
-    BUGS_FOLDER_DESCRIPTION = "Bugs noticed by scan/diff agents in the code while updating the architecture. Prose-only proposals; humans triage.";
     cache = /* @__PURE__ */ new Map();
   }
 });
@@ -19496,7 +19511,7 @@ var init_setting = __esm({
   }
 });
 
-// src/scan/architectureCounts.ts
+// ../shared/architectureCounts.ts
 function countFromPaths(paths) {
   let components = 0;
   let stories = 0;
@@ -19510,6 +19525,12 @@ function countFromPaths(paths) {
   }
   return { components, stories, rootStories };
 }
+var init_architectureCounts = __esm({
+  "../shared/architectureCounts.ts"() {
+  }
+});
+
+// src/scan/architectureCounts.ts
 async function countArchitecture(supabase, projectId, branch) {
   const PAGE_SIZE2 = 1e3;
   const paths = [];
@@ -19529,9 +19550,10 @@ function firstScanGate(counts) {
     reason: `first scan incomplete: the branch holds ${counts.components} component(s) and ${counts.rootStories} root story(ies); needs at least one of each`
   };
 }
-var init_architectureCounts = __esm({
+var init_architectureCounts2 = __esm({
   "src/scan/architectureCounts.ts"() {
     "use strict";
+    init_architectureCounts();
   }
 });
 
@@ -19607,6 +19629,142 @@ var init_claimStance = __esm({
   }
 });
 
+// src/daemon/platformDevices.ts
+async function readPlatformDevices(client, userId) {
+  const { data, error } = await client.from("agent_devices").select("id, name").eq("user_id", userId).is("org_id", null).eq("is_platform", true).eq("status", "enabled");
+  if (error) throw new Error(error.message);
+  return data ?? [];
+}
+function withPlatformDevices(devices, platform3) {
+  const out = [...devices];
+  for (const p of platform3) {
+    if (!out.some((d) => d.deviceId === p.id)) out.push({ orgId: null, deviceId: p.id });
+  }
+  return out;
+}
+function deviceForOrgLookup(devices) {
+  const members = devices.filter((d) => d.orgId !== null);
+  const byOrg = new Map(members.map((d) => [d.orgId, d.deviceId]));
+  return (orgId) => byOrg.get(orgId) ?? members[0]?.deviceId ?? null;
+}
+function poolBootLine(platform3, mode) {
+  if (platform3.length === 0) return "not in managed pool";
+  const names = platform3.map((p) => `${p.name} (${p.id})`).join(", ");
+  return `in managed pool: platform device ${names}, ${mode === "required" ? "active" : "inactive unless sandbox=required"}`;
+}
+async function discoverClaimDevices(client, userId, devices, mode, out = console) {
+  let platform3 = [];
+  try {
+    platform3 = await readPlatformDevices(client, userId);
+  } catch (e) {
+    out.warn(`platform device read failed, starting member-only until restart: ${e.message}`);
+  }
+  out.log(`  ${poolBootLine(platform3, mode)}`);
+  return { devices: withPlatformDevices(devices, platform3), platform: platform3 };
+}
+var init_platformDevices = __esm({
+  "src/daemon/platformDevices.ts"() {
+    "use strict";
+  }
+});
+
+// src/daemon/jobReads.ts
+async function lookupProjectSlug(client, projectId) {
+  const { data, error } = await client.from("projects").select("slug, organizations(slug)").eq("id", projectId).single();
+  if (error || !data) throw new Error(`Project ${projectId} not found: ${error?.message}`);
+  const orgSlug = data.organizations?.slug;
+  if (!orgSlug) throw new Error(`Project ${projectId} has no org slug`);
+  return `${orgSlug}/${data.slug}`;
+}
+async function detectWritesByPhase(client, projectId, archmeBranch, jobId) {
+  const { data, error } = await client.from("commits").select("structural_changeset").eq("project_id", projectId).eq("branch", archmeBranch).eq("metadata->source->>job_id", jobId);
+  if (error) {
+    console.error("commits lookup error:", error.message);
+    return { total: 0, diffWrites: 0, structuralWrites: 0 };
+  }
+  let diffWrites = 0;
+  let structuralWrites = 0;
+  for (const row of data ?? []) {
+    if (row.structural_changeset == null) diffWrites++;
+    else structuralWrites++;
+  }
+  return { total: diffWrites + structuralWrites, diffWrites, structuralWrites };
+}
+async function detectMcpActivity(client, jobId) {
+  const { data, error } = await client.from("archme_jobs").select("meaningful_tool_calls, no_change_reason").eq("id", jobId).maybeSingle();
+  if (error) {
+    console.error("mcp_activity lookup error:", error.message);
+    return { reads: void 0, noChange: false };
+  }
+  if (!data) return { reads: void 0, noChange: false };
+  const row = data;
+  return { reads: row.meaningful_tool_calls, noChange: row.no_change_reason != null };
+}
+function sessionJobReads(client, job) {
+  return {
+    projectSlug: () => lookupProjectSlug(client, job.project_id),
+    marker: (repo) => readBranchMarker(client, job.project_id, job.archme_branch, repo),
+    repoMappings: (log) => loadRepoMappings(client, job.project_id, log),
+    seedArchitecture: () => loadArchitectureForSeeding(client, job.project_id, job.archme_branch),
+    bugsFolderId: () => ensureBugsFolder(client, job.project_id),
+    writesByPhase: () => detectWritesByPhase(client, job.project_id, job.archme_branch, job.id),
+    mcpActivity: () => detectMcpActivity(client, job.id),
+    architectureCounts: () => countArchitecture(client, job.project_id, job.archme_branch)
+  };
+}
+function hostedJobReads(post) {
+  let prefetch = null;
+  let outcome = null;
+  const pre = () => prefetch ??= post("prefetch");
+  const out = () => outcome ??= post("outcome");
+  return {
+    projectSlug: async () => {
+      const slug = (await pre()).project_slug;
+      if (typeof slug !== "string") throw new Error("job-context returned no project slug");
+      return slug;
+    },
+    marker: async () => (await pre()).marker,
+    repoMappings: async (log) => {
+      const mappings = (await pre()).repo_mappings;
+      if (mappings === null) log("repo mappings unreadable (proceeding without repo scoping)");
+      return mappings;
+    },
+    seedArchitecture: async () => {
+      const p = await pre();
+      if (!p.seed_architecture) throw new Error(p.seed_error ?? "seed architecture unavailable");
+      return p.seed_architecture;
+    },
+    bugsFolderId: async () => (await pre()).bugs_folder_id,
+    // Fails closed, unlike the session readers: a platform job has no session read to fall back on.
+    writesByPhase: async () => {
+      const { total, diff, structural } = (await out()).writes;
+      return { total, diffWrites: diff, structuralWrites: structural };
+    },
+    mcpActivity: async () => {
+      const { reads, no_change } = (await out()).mcp;
+      return { reads: reads ?? void 0, noChange: no_change };
+    },
+    architectureCounts: async () => {
+      const counts = (await out()).architecture_counts;
+      if (!counts) throw new Error("job-context returned no architecture counts");
+      return counts;
+    }
+  };
+}
+function jobReadsFor(deps, job) {
+  return deps.isPlatformDevice ? hostedJobReads(deps.post) : sessionJobReads(deps.client, job);
+}
+var init_jobReads = __esm({
+  "src/daemon/jobReads.ts"() {
+    "use strict";
+    init_architectureCounts2();
+    init_affected();
+    init_bugsFolder();
+    init_branchMarker();
+    init_repoMappings();
+  }
+});
+
 // src/daemon/sandboxJob/result.ts
 import { readFile as readFile13 } from "node:fs/promises";
 function isValidNonce(nonce) {
@@ -22209,9 +22367,9 @@ var init_run_scan = __esm({
     init_transcript_signals();
     init_report();
     init_github_remote();
-    init_architectureCounts();
+    init_architectureCounts2();
     init_claimDefaultProject();
-    init_architectureCounts();
+    init_architectureCounts2();
     BOOTSTRAP_HEADLESS = `Run the \`scan\` MCP prompt now and follow it to completion. This is a non-interactive automated run \u2014 skip any steps that pause for user confirmation (e.g. "does this hierarchy look right?"). Proceed with your best-judgement decisions rather than waiting for human input.`;
     BOOTSTRAP_INTERACTIVE = `Run the \`scan\` MCP prompt now and follow it to completion. The user is at an interactive terminal \u2014 ask them when the prompt says to, and wait for their answer.
 
@@ -22700,13 +22858,6 @@ async function routeShutdownInterrupt(id, cancelled2, fail2, exitCode) {
     console.error(`  shutdown retry-route failed for ${id}: ${e instanceof Error ? e.message : e}`);
   }
 }
-async function lookupProjectSlug(client, projectId) {
-  const { data, error } = await client.from("projects").select("slug, organizations(slug)").eq("id", projectId).single();
-  if (error || !data) throw new Error(`Project ${projectId} not found: ${error?.message}`);
-  const orgSlug = data.organizations?.slug;
-  if (!orgSlug) throw new Error(`Project ${projectId} has no org slug`);
-  return `${orgSlug}/${data.slug}`;
-}
 function cloneDirFor(baseDir, owner, name) {
   return join25(baseDir, owner, name);
 }
@@ -23182,30 +23333,6 @@ async function rpcComplete(ctx, jobId, deviceId, summary2, kind, changed, metric
 function affectedFieldForComplete(sourceMode, affected) {
   return sourceMode === "pr_update" && affected ? affected : void 0;
 }
-async function detectWritesByPhase(client, projectId, archmeBranch, jobId) {
-  const { data, error } = await client.from("commits").select("structural_changeset").eq("project_id", projectId).eq("branch", archmeBranch).eq("metadata->source->>job_id", jobId);
-  if (error) {
-    console.error("commits lookup error:", error.message);
-    return { total: 0, diffWrites: 0, structuralWrites: 0 };
-  }
-  let diffWrites = 0;
-  let structuralWrites = 0;
-  for (const row of data ?? []) {
-    if (row.structural_changeset == null) diffWrites++;
-    else structuralWrites++;
-  }
-  return { total: diffWrites + structuralWrites, diffWrites, structuralWrites };
-}
-async function detectMcpActivity(client, jobId) {
-  const { data, error } = await client.from("archme_jobs").select("meaningful_tool_calls, no_change_reason").eq("id", jobId).maybeSingle();
-  if (error) {
-    console.error("mcp_activity lookup error:", error.message);
-    return { reads: void 0, noChange: false };
-  }
-  if (!data) return { reads: void 0, noChange: false };
-  const row = data;
-  return { reads: row.meaningful_tool_calls, noChange: row.no_change_reason != null };
-}
 function setLocalPause(untilMs) {
   if (!Number.isFinite(untilMs) || untilMs <= Date.now()) return;
   if (pauseUntilMs != null && pauseUntilMs >= untilMs) return;
@@ -23236,14 +23363,16 @@ async function rpcSetDaemonPause(ctx, pauseUntil, reason, detail) {
     console.error(`set_daemon_pause failed: ${error.message}`);
   }
 }
-async function rpcReportEvent(ctx, orgId, eventType, payload) {
+async function rpcReportEvent(ctx, job, deviceId, eventType, payload) {
   try {
     const { error } = await withAuthRetry(
       "report_daemon_event",
       () => ctx.supabase.rpc("report_daemon_event", {
-        p_org_id: orgId,
+        p_org_id: job.org_id,
         p_event_type: eventType,
-        p_payload: payload
+        p_payload: payload,
+        p_job_id: job.id,
+        p_device_id: deviceId
       }),
       ctx.reLogin
     );
@@ -23477,11 +23606,36 @@ async function setupDigestMcp(ctx, job, deviceId) {
     return {};
   }
 }
+function readsFor(ctx, job, deviceId) {
+  return jobReadsFor(
+    { client: ctx.supabase, post: (part) => postJobContext(ctx, job.id, deviceId, part), isPlatformDevice: platformDevices.has(deviceId) },
+    job
+  );
+}
+async function postJobContext(ctx, jobId, deviceId, part) {
+  const response = await fetchWithAuthRetry(
+    "job-context",
+    () => {
+      const accessToken = ctx.auth.getAccessToken();
+      if (!accessToken) throw new Error("daemon is not signed in with a registered device");
+      return fetch(`${ctx.supabaseUrl.replace(/\/$/, "")}/functions/v1/agents-device/job-context`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${accessToken}` },
+        body: JSON.stringify({ device_id: deviceId, job_id: jobId, part })
+      });
+    },
+    ctx.reLogin
+  );
+  const body = await parseJsonResponse(response);
+  if (!response.ok) throw new Error(`job-context ${part} failed: ${responseError(body, `status ${response.status}`)}`);
+  return body;
+}
 async function prefetchJobContext(ctx, job, deviceId, repoCredentials = getRepoCredentials) {
   const log = (msg) => console.log(`[${job.id}] ${msg}`);
   const firstScan = job.job_kind === "first_scan";
   assertLocalJobShape(firstScan ? { ...job, after_sha: job.scan_ref ?? "" } : job);
-  const projectSlug = await lookupProjectSlug(ctx.supabase, job.project_id);
+  const reads = readsFor(ctx, job, deviceId);
+  const projectSlug = await reads.projectSlug();
   const jobToken = await mintJobToken(ctx, job.id, deviceId);
   const probe = await probeMcpAuth(
     `${ctx.mcpBaseUrl}?project=${encodeURIComponent(projectSlug)}&branch=${encodeURIComponent(job.archme_branch)}`,
@@ -23492,15 +23646,15 @@ async function prefetchJobContext(ctx, job, deviceId, repoCredentials = getRepoC
       `MCP auth preflight failed after ${probe.attempts} attempt(s) (last status ${probe.lastStatus ?? "n/a"}): ${probe.detail}. Not starting the sandbox \u2014 failing the job so it retries with a freshly minted token.`
     );
   }
-  const marker = job.source_mode === "pr_update" || firstScan ? { sha: null, repo: null } : await readBranchMarker(ctx.supabase, job.project_id, job.archme_branch, `${job.repo_owner}/${job.repo_name}`);
+  const marker = job.source_mode === "pr_update" || firstScan ? { sha: null, repo: null } : await reads.marker(`${job.repo_owner}/${job.repo_name}`);
   const jobRepo = `${job.repo_owner}/${job.repo_name}`;
-  const mappings = await loadRepoMappings(ctx.supabase, job.project_id, log);
+  const mappings = await reads.repoMappings(log);
   let jobScope = jobRepoScope(mappings, jobRepo);
   if (!jobScope) log("repo mappings unreadable: proceeding unseeded");
   let seedArch = null;
   if (mappings && jobScope && !firstScan) {
     try {
-      seedArch = await loadArchitectureForSeeding(ctx.supabase, job.project_id, job.archme_branch);
+      seedArch = await reads.seedArchitecture();
       if (job.source_mode === "pr_update") {
         jobScope = forkRepoScope(mappings, jobRepo, new Set(seedArch.components.map((c3) => c3.path)));
       }
@@ -23508,7 +23662,7 @@ async function prefetchJobContext(ctx, job, deviceId, repoCredentials = getRepoC
       log(`seed architecture unavailable (the agent runs unseeded): ${e.message}`);
     }
   }
-  const bugsFolderId = await ensureBugsFolder(ctx.supabase, job.project_id);
+  const bugsFolderId = await reads.bugsFolderId();
   const model = await resolveRunnableModel(ctx.supabase, { warn: log });
   const credentials = await repoCredentials(ctx, job.id, deviceId);
   return {
@@ -23562,8 +23716,9 @@ async function completeClaudeRun(ctx, job, deviceId, run) {
   metrics.model_served = runResult.modelServed;
   metrics.usage = runResult.usage;
   metrics.cost_usd = runResult.costUsd;
-  const { total: writes, diffWrites, structuralWrites } = await detectWritesByPhase(ctx.supabase, job.project_id, job.archme_branch, job.id);
-  const { reads, noChange } = await detectMcpActivity(ctx.supabase, job.id);
+  const jobReads = run.reads ?? readsFor(ctx, job, deviceId);
+  const { total: writes, diffWrites, structuralWrites } = await jobReads.writesByPhase();
+  const { reads, noChange } = await jobReads.mcpActivity();
   markPhase("write_detect", {
     commits: writes,
     diff_writes: diffWrites,
@@ -23752,7 +23907,7 @@ async function runJob(ctx, job, claimDeviceId) {
         Object.assign(timings, outcome.metrics.durations_ms);
         Object.assign(metrics, outcome.metrics, { durations_ms: timings });
         const sandboxMetrics = outcome.metrics.sandbox;
-        void rpcReportEvent(ctx, job.org_id, "sandbox_job_metrics", {
+        await rpcReportEvent(ctx, job, deviceId, "sandbox_job_metrics", {
           job_id: job.id,
           project_id: job.project_id,
           outcome: outcome.kind,
@@ -23832,8 +23987,9 @@ async function runJob(ctx, job, claimDeviceId) {
             verdict
           );
         }
+        const jobReads = readsFor(ctx, job, deviceId);
         if (firstScan) {
-          const gate = firstScanGate(await countArchitecture(ctx.supabase, job.project_id, job.archme_branch));
+          const gate = firstScanGate(await jobReads.architectureCounts());
           if (!gate.ok) throw new Error(gate.reason);
         }
         await completeClaudeRun(ctx, job, deviceId, {
@@ -23844,7 +24000,8 @@ async function runJob(ctx, job, claimDeviceId) {
           affected: outcome.affected,
           startedAt,
           markPhase,
-          log
+          log,
+          reads: jobReads
         });
         return;
       }
@@ -24133,7 +24290,7 @@ ${logs.stderr}`, sentPrompt);
     if (plan) {
       const { parsed, pauseUntil, info } = plan;
       if (!parsed) {
-        void rpcReportEvent(ctx, job.org_id, "rate_limit_unmatched_exit", {
+        await rpcReportEvent(ctx, job, deviceId, "rate_limit_unmatched_exit", {
           job_id: job.id,
           excerpt: [runErr?.claudeError?.text, haystack].filter(Boolean).join("\n").slice(0, 500)
         });
@@ -24476,7 +24633,9 @@ async function runDaemon() {
   const via = usedFallback ? ` (via device ${active.cred.device_id})` : "";
   const accountUserId = auth.getUserId() ?? "OAuth account";
   console.log(`  account ${accountUserId}: ${active.result.user.email ?? "OAuth user"} (${devices.length} org(s))${via}`);
-  const byOrg = new Map(devices.map((d) => [d.orgId, d.deviceId]));
+  const discovered = await discoverClaimDevices(client, auth.getUserId() ?? "", devices, sandboxSettings.mode);
+  platformDevices = new Set(discovered.platform.map((p) => p.id));
+  const claimDevices = discovered.devices;
   const sessions = [{
     supabase: client,
     auth,
@@ -24486,16 +24645,9 @@ async function runDaemon() {
     supabaseUrl: SUPABASE_URL,
     cloneBaseDir: CLONE_BASE_DIR,
     reLogin: () => auth.reauthenticate(),
-    devices,
-    deviceForOrg: (orgId) => byOrg.get(orgId) ?? devices[0]?.deviceId ?? null
+    devices: claimDevices,
+    deviceForOrg: deviceForOrgLookup(claimDevices)
   }];
-  try {
-    const { data, error } = await client.from("agent_devices").select("id, is_platform").in("id", devices.map((d) => d.deviceId));
-    if (error) throw new Error(error.message);
-    platformDevices = new Set((data ?? []).filter((d) => d.is_platform).map((d) => d.id));
-  } catch (e) {
-    console.warn(`agent_devices.is_platform read failed (treating devices as not platform): ${e.message}`);
-  }
   if (sandboxSettings.mode !== "off") {
     try {
       const { createSandboxParts: createSandboxParts2 } = await Promise.resolve().then(() => (init_parts(), parts_exports));
@@ -24730,9 +24882,11 @@ var init_run = __esm({
     init_localPrJob();
     init_localPoller();
     init_setting();
-    init_architectureCounts();
+    init_architectureCounts2();
     init_imageManifest();
     init_claimStance();
+    init_platformDevices();
+    init_jobReads();
     init_claudeVersion();
     init_host();
     init_runSandboxedJob();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archme/cli",
-  "version": "0.15.1",
+  "version": "0.17.0",
   "description": "Map your codebase into a living architecture diagram: run `archme init` in a repo to scan it, `archme daemon start` to keep it current on every commit.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",

package/sandbox-image.json

@@ -1,4 +1,4 @@
 {
   "image": "ghcr.io/architectme/archme-job",
-  "digest": "sha256:a3c757d0dc7608b3c4e45b24e1ba4459c8f7ece2d0551a4633d2f3833a6fdc3e"
+  "digest": "sha256:e82027063082a90ad4e6bf0a551da676bc57d6aad7778c737652acc95eae3999"
 }