@foldspace_npm/harness 0.1.12 → 0.1.13

package/CLAUDE.md

@@ -35,7 +35,7 @@ something they can **see on their own page** — not at "it builds".
 Before an unfamiliar harness operation, `npx foldspace help --json` is the
 current CLI contract — risk, prerequisites, effects, next step.
 
-## Aim at a level, then choose the cheapest experience that reaches it
+## The first session has a fixed order
 
 | Level | Reached when |
 |---|---|
@@ -43,15 +43,28 @@ current CLI contract — risk, prerequisites, effects, next step.
 | **L1 · read settings** | the user's own account, plan or settings in a widget, showing their real values |
 | **L2 · look up entities** | a search from the user's own words, showing rows |
 
-Navigation, uploads, extraction and anything that writes are a later session.
-Say the target out loud, then offer three or four read-only experiences that
-reach it, **cheapest first**: an endpoint the profile already verifies → the
-user's own data with no parameter (L1) → a search with one parameter (L2).
-`discover_actions` gives candidates, not an inventory.
+1. **Get the agent live first (L0) - with no actions.** Straight after
+   orienting: `npm run build`, `npm run inject`, the human signs in to their
+   app, then `npx foldspace attach --daemon`. An empty registry is valid. L0
+   is `registration_ok` with the agent visible on their page - tell them to
+   look at it and say hello to it. **Do not explore the app first**: no
+   reading its bundle, no watching its traffic, no browsing its screens.
+   Nothing about L0 needs any of it, and minutes of silent investigation
+   before the human has seen anything is the wrong first impression.
+2. **Then offer experiences - from what you already have.** With the agent on
+   their screen, offer three or four read-only experiences as a choice,
+   recommended first. Sources: the conversation starters seeded at sign-up,
+   `discover_actions`, and `docs/app-profile.md`. `discover_actions` gives
+   candidates, not an inventory. Do not investigate the app to build this
+   list. Order them cheapest first: the user's own data with no parameter
+   (L1) before a search with one parameter (L2).
+3. **Only then observe - and only what the chosen experience needs** (**Find
+   the call yourself**). Check the row count as part of that: an experience
+   on a resource the account has zero of is a demo of an empty state, so say
+   so and offer the next one. On an empty account the useful first action is
+   one that creates data - say so instead.
 
-**Check row counts before recommending.** An experience on a resource the
-account has zero of is a demo of an empty state. On an empty account the useful
-first action is one that creates data — say so instead.
+Navigation, uploads, extraction and anything that writes are a later session.
 
 ### Ask as a choice, and ask almost nothing
 
@@ -73,10 +86,12 @@ and asking are not the only options — **observing is, and it comes first**:
 
 1. **Already known** — `docs/app-profile.md`. A verified endpoint needs no
    browsing.
-2. **You drive.** `npm run inject`, the human signs in, and *you* go to the
-   screen: read the app's bundle for API paths and watch the requests it makes
-   (chrome-devtools MCP against the inject Chrome, or a page-context `fetch`,
-   **before** `attach` owns the debug port). Read the auth method off a request
+2. **You drive - once they have chosen an experience.** The agent is already
+   attached from L0, and `attach` owns the debug port: `npx foldspace attach
+   --stop` first. Then *you* go to the one screen that experience needs: read
+   the app's bundle for API paths and watch the requests it makes
+   (chrome-devtools MCP against the inject Chrome, or a page-context
+   `fetch`). Attach again when you have the call. Read the auth method off a request
    the page already sent — bearer from `localStorage`, cookie, custom header.
    Delegate the watching to a read-only subagent so the traffic does not flood
    your context.
@@ -172,8 +187,9 @@ npx foldspace attach --daemon
 ```
 
 `inject` launches an isolated Chrome profile and records its debug port; it
-loads nothing. Observe after inject and **before** attach, while chrome-devtools
-MCP can use the same Chrome. `attach` prepares the page and loads the local
+loads nothing. In a first session `attach` comes straight after sign-in (L0);
+to observe afterwards, `attach --stop`, use chrome-devtools MCP against the
+same Chrome, then attach again. `attach` prepares the page and loads the local
 `dist/index.js` over CDP. Coding agents use `--daemon` so the tool returns after
 `[lifecycle] inspect_registration:…`. An empty local registry is valid; `npm run
 build` is still required so `dist/index.js` exists.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foldspace_npm/harness",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "Build and verify portable Foldspace action artifacts against a live app.",
   "type": "module",
   "bin": {