@method-ai-hq/sdk 0.14.3 → 0.14.5

package/README.md

@@ -3,7 +3,7 @@
 MIT-licensed JavaScript API and the `method` CLI. Source and releases: https://github.com/method-ai-hq/method-sdk
 
 ```sh
-npm install https://github.com/method-ai-hq/method-sdk/releases/download/v0.14.3/method-ai-hq-sdk-0.14.3.tgz
+npm install https://github.com/method-ai-hq/method-sdk/releases/download/v0.14.5/method-ai-hq-sdk-0.14.5.tgz
 npx method --version
 ```
 

package/dist/packages/sdk/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@method-ai-hq/sdk",
-    "version": "0.14.3",
+    "version": "0.14.5",
     "description": "Build and run reusable .method files with checked steps and saved results.",
     "license": "MIT",
     "type": "module",

package/dist/packages/sdk/src/authoring-instructions.d.ts

@@ -5,7 +5,7 @@ export declare const designProcedure = "# Choose the design\n\n| Requirement | S
 /** The full check rules; in concepts. */
 export declare const checkRules = "# Checks\n\nAdd a check only when it catches a concrete failure that matters to the result. Output types and the runtime already validate shapes; do not repeat them. Do not check wording, headings, keywords, lengths, or counts unless the task requires them: \"write accurate prose\" is not a reason to match strings.\n\nUse the simplest check that proves the fact: a built-in equals, count, present, or file check, a script, or an agent check. Local file writes need no check: the runtime observes files connections itself. A change to a service, an API, email, or a browser that sends needs an effect that reads the result back, because a receipt or a 200 status shows only that the request was accepted. Use a built-in observer (http, sqlite, file) when one fits. When a change cannot or need not be observed, such as a browser step that only reads, write no_effect_reason instead.\n\nExisting checks and tests are implementation choices, not user requirements. Remove a check that is unnecessary, repeats other validation, or enforces a requirement that nobody asked for. Delete the tests and instructions that exist only for it, and do not replace it. Do not change useful output only to satisfy a check.\n";
 /** The rules that make a first Method work quickly. They come before every other part of the guide. */
-export declare const firstMethodRules = "# Build a Method\n\n1. **Sign in first.** Run `method status`. If it is not signed in, run `method login` and let the user approve in the browser. Signed in, model and classification steps need no keys, each run saves a version when the file changed, and runs appear on the dashboard.\n2. **Each model or classifier request is its own step**: `call`, `agent`, or `classify`, with its prompt in the Method, so the user can change one prompt, run again, and compare. A script never calls a model API. When the user already has code that does the work, keep its fixed logic as `run` steps and move each prompt and rubric into its own step; do not wrap the code. \"The same thing\" means the same behavior in steps. If a request cannot become a step because Method lacks a feature, tell the user what is missing.\n3. **Show the design, then build it in the same turn.** Show each step with its type, purpose, and output, and a table of the prompts and rubrics in the user's existing work, each with the step that holds it. Do not wait for approval unless the user asked to approve first. Ask only for information that you cannot find and that would change the design.\n4. **Run early and often.** Write the first steps, validate, run, then add the next steps. Fix errors. Fix each warning, or accept it with the user's reason. Never add a check only to remove a warning. A new run reuses every step whose definition and inputs did not change, so each run executes only what changed. `--rerun STEP` runs a step again anyway; `--fresh` runs every step.\n5. **Keep the inputs of the existing code.** If the code takes an ID and looks up the record, the Method takes the same ID and looks it up the same way.\n6. **Use the defaults without asking.** Model steps use the account's hosted models and `classify` uses Method's classifier, so no model or classifier keys are needed. To keep the model that existing code uses, add `models: {writer: provider/model}` to the Method and use `model: writer` in the steps (or `model: provider/model` on the step); it needs no key. Keep the models that the Method or the existing code names: when a model step fails, show the error and ask before you change its model. Run records go to the user's account. When the user asks that run data stay on this computer or not be uploaded, set `run_data: device`: the run's inputs, outputs, and files stay here, and the account keeps only each step's status and timing. Model steps still send each step's input to the model to answer it; nothing is kept. Tell the user that in one line, then run again.\n7. **Keys stay out of chat.** Declare each key that a script needs under `secrets:` with its purpose; every script of the Method receives all of its declared secrets. Run `method secret find` in the Method's folder: it lists the key files nearby and the names in each, never the values, and prints the import command. Run that command and tell the user which file each key came from: the key stays on this computer, so there is nothing to ask. If it finds nothing, ask the user to run `method secret set NAME`, which opens a private form in their browser. Never open, print, or search a key file (`cat`, `grep`, an editor), including Method's own secret store, and never ask for a value in chat: the values would go into the chat. When a run says Method's model credit is used up, run `method config model-key` yourself: it takes the user's own OpenRouter key from the one nearby key file that holds it, or opens a private form for it. Then run again.\n8. **Choose a sample yourself** from the user's data, and check that it has the sources the Method needs. Ask only when there is no good sample.\n9. **Iterate.** After a good run, show the result and the dashboard link, and ask what to change. Change the step and run again. Show only results that a run made: never write or edit a result by hand, and fix a wrong result in the Method, not in the data it reads. If you cannot run, say so.\n10. **Publish** with `method publish FILE --reason TEXT` when the user wants to share or schedule a version. It runs the Method's cases first.\n\nWhen a run fails, read its `fix` and `diagnostics`, change the step, and run again.\n";
+export declare const firstMethodRules = "# Build a Method\n\n1. **Sign in first.** Run `method status`. If it is not signed in, run `method login` and let the user approve in the browser. Signed in, model and classification steps need no keys, each run saves a version when the file changed, and runs appear on the dashboard.\n2. **Each model or classifier request is its own step**: `call`, `agent`, or `classify`, with its prompt in the Method, so the user can change one prompt, run again, and compare. A script never calls a model API. When the user already has code that does the work, keep its fixed logic as `run` steps and move each prompt and rubric into its own step; do not wrap the code. \"The same thing\" means the same behavior in steps. If a request cannot become a step because Method lacks a feature, tell the user what is missing.\n3. **Show the design, then build it in the same turn.** Show each step with its type, purpose, and output, and a table of the prompts and rubrics in the user's existing work, each with the step that holds it. Do not wait for approval unless the user asked to approve first. Ask only for information that you cannot find and that would change the design.\n4. **Run early and often.** Write the first steps, validate, run, then add the next steps. Fix errors. Fix each warning, or accept it with the user's reason. Never add a check only to remove a warning. A new run reuses every step whose definition and inputs did not change, so each run executes only what changed. `--rerun STEP` runs a step again anyway; `--fresh` runs every step.\n5. **Keep the inputs of the existing code.** If the code takes an ID and looks up the record, the Method takes the same ID and looks it up the same way.\n6. **Use the defaults without asking.** Model steps use the account's hosted models and `classify` uses Method's classifier, so no model or classifier keys are needed. To keep the model that existing code uses, add `models: {writer: provider/model}` to the Method and use `model: writer` in the steps (or `model: provider/model` on the step); it needs no key. Keep the models that the Method or the existing code names: when a model step fails, show the error and ask before you change its model. Run records go to the user's account. When the user asks that run data stay on this computer or not be uploaded, set `run_data: device`: the run's inputs, outputs, and files stay here, and the account keeps only each step's status and timing. Model steps still send each step's input to the model to answer it; nothing is kept. Tell the user that in one line, then run again.\n7. **Keys stay out of chat.** Declare each key that a script needs under `secrets:` with its purpose; every script of the Method receives all of its declared secrets. Run `method secret find` in the Method's folder: it lists the key files nearby and the names in each, never the values, and prints the import command. Run that command and tell the user which file each key came from: the key stays on this computer, so there is nothing to ask. If it finds nothing, ask the user to run `method secret set NAME`, which opens a private form in their browser. Never open, print, or search a key file (`cat`, `grep`, an editor), including Method's own secret store, and never ask for a value in chat: the values would go into the chat. When a run says Method's model credit is used up, run `method config model-key` yourself: it takes the user's own OpenRouter key from the one nearby key file that holds it, or opens a private form for it. Then run again.\n8. **Choose a sample yourself** from the user's data, and check that it has the sources the Method needs. Ask only when there is no good sample.\n9. **Iterate.** After a good run, show the result and the dashboard link, and ask what to change. Change the step and run again. Show only results that a run made: never write or edit a result by hand, and fix a wrong result in the Method, not in the data it reads. If you cannot run, say so.\n10. **Publish** with `method publish FILE --reason TEXT` when the user wants to share or schedule a version. It runs the Method's cases first.\n11. **Talk about the work, not about Method.** Unless the user asks, do not mention Method's versions, formats, settings files, or other internal files, and do not ask the user about them, about models, or about which saved version to use. Method updates itself and converts older Method files when it runs them. When the user asks whether a Method works, or asks you to make it work, run it with the inputs of a recent run and show the result and the dashboard link in a few sentences. Say that it works only after a run completed.\n12. **One file for each Method.** Change and run a Method in its own file. Do not copy it to a temporary or other folder to change it: Method does not run or save the copy while the Method's file exists, and names that file.\n13. **Questions in a run are for the user.** When a run stops with `needs_input`, ask the user its `question` in plain words, wait for the answer, and continue the run with it as the output says. Never answer it yourself.\n\nWhen a run fails, read its `fix` and `diagnostics`, change the step, and run again.\n";
 /** How to write the prompt inside a call, agent, or classify step. */
 export declare const promptRules = "# Write each prompt\n\n- **One task per prompt.** If a prompt says \"then\" or has several jobs, make several steps.\n- **Say what to do.** Leave out background that does not change the output.\n- **Show 1 to 3 examples of good output.** Take them from the user's work: examples in an existing prompt, a past output that the user approved, or the first run that the user accepts. Pass a long example as an input, not as text in the prompt.\n- **Put the output shape in `out`**, not in the prompt.\n- **Say what to do when the input does not have the answer**, for example \"leave due empty\". For classify, add an option such as `unclear`.\n\nBefore:\n\n```text\nYou are an expert support analyst with years of experience. Our company values clear\ncommunication. Read the tickets, decide which ones are urgent, write a summary, and\nreturn JSON with a \"summary\" key. Make it good.\n```\n\nAfter (urgency is a classify step before this one; the shape is in `out`):\n\n```text\nWrite a five-sentence summary of this week's support tickets for the team.\nStart with the high-urgency tickets. Quote no customer names.\nWrite it in the style of this summary from an earlier week:\n\n{{example}}\n```\n";
 /** Enough of the format to write a Method without reading the JSON schema. */

package/dist/packages/sdk/src/authoring-instructions.js

@@ -39,6 +39,9 @@ export const firstMethodRules = `# Build a Method
 8. **Choose a sample yourself** from the user's data, and check that it has the sources the Method needs. Ask only when there is no good sample.
 9. **Iterate.** After a good run, show the result and the dashboard link, and ask what to change. Change the step and run again. Show only results that a run made: never write or edit a result by hand, and fix a wrong result in the Method, not in the data it reads. If you cannot run, say so.
 10. **Publish** with \`method publish FILE --reason TEXT\` when the user wants to share or schedule a version. It runs the Method's cases first.
+11. **Talk about the work, not about Method.** Unless the user asks, do not mention Method's versions, formats, settings files, or other internal files, and do not ask the user about them, about models, or about which saved version to use. Method updates itself and converts older Method files when it runs them. When the user asks whether a Method works, or asks you to make it work, run it with the inputs of a recent run and show the result and the dashboard link in a few sentences. Say that it works only after a run completed.
+12. **One file for each Method.** Change and run a Method in its own file. Do not copy it to a temporary or other folder to change it: Method does not run or save the copy while the Method's file exists, and names that file.
+13. **Questions in a run are for the user.** When a run stops with \`needs_input\`, ask the user its \`question\` in plain words, wait for the answer, and continue the run with it as the output says. Never answer it yourself.
 
 When a run fails, read its \`fix\` and \`diagnostics\`, change the step, and run again.
 `;

package/dist/packages/sdk/src/authoring.js

@@ -185,11 +185,13 @@ export async function localAuthoring(args) {
                 const runs = step.ask ? "asks the user"
                     : exec.kind === "run" ? `${exec.runtime} ${exec.entrypoint}`
                         : exec.kind === "classify" ? (config.classification?.api_key_env || ownKey ? "Jev through OpenRouter with your own key" : "Method's classifier")
-                            : profile?.backend === "method" ? (ownKey && !agent ? `${profile.model} through OpenRouter with your own key` : `the hosted model ${profile.model}`)
-                                : profile ? `${profile.backend}${profile.model ? ` ${profile.model}` : ""}`
-                                    : signedIn ? (ownKey && !agent ? "the account's default model through OpenRouter with your own key" : "the account's hosted model") : "a local Codex or Claude agent";
+                            // The computer's agent setting (or --agent) runs every model step, whatever model the Method names.
+                            : agent && ["call", "agent"].includes(exec.kind) ? agent
+                                : profile?.backend === "method" ? (ownKey && !agent ? `${profile.model} through OpenRouter with your own key` : `the hosted model ${profile.model}`)
+                                    : profile ? `${profile.backend}${profile.model ? ` ${profile.model}` : ""}`
+                                        : signedIn ? (ownKey && !agent ? "the account's default model through OpenRouter with your own key" : "the account's hosted model") : "a local Codex or Claude agent";
                 const needs = [...(exec?.kind === "run" ? missingSecrets.map(name => `secret ${name}`) : []),
-                    ...(!signedIn && (exec?.kind === "classify" && !config.classification?.api_key_env && !ownKey || ["call", "agent"].includes(exec?.kind) && !profile) ? [`method login (for ${exec.kind === "classify" ? "classification" : "hosted models"})`] : [])];
+                    ...(!signedIn && (exec?.kind === "classify" && !config.classification?.api_key_env && !ownKey || ["call", "agent"].includes(exec?.kind) && !profile && !agent) ? [`method login (for ${exec.kind === "classify" ? "classification" : "hosted models"})`] : [])];
                 return { id, runs, ...(needs.length ? { needs } : {}) };
             });
             print({ valid: true, definition, local_setup: missingSetup.length ? "needs_preparation" : "valid", ...(missingSetup.length ? { missing_setup: [...new Set(missingSetup)] } : {}), workspace: sourceRoot, files: files.length, steps, executed: false, ...shown });

package/dist/packages/sdk/src/current-runtime.d.ts

@@ -5,6 +5,8 @@ import type { parse } from "./local-cli.js";
 export { executeMethod as runCurrentMethod };
 /** Recent run folders on this computer, newest first. The runtime reuses only iterations whose key matches. */
 export declare function recentRuns(exclude: string, limit?: number): string[];
+/** Answers for ask steps: a key without an iteration ("confirm") answers its first iteration ("confirm:0"). */
+export declare function answers(human: any): any;
 /**
  * Run a local Method file. The run starts at once: saving and run records go through the outbox and never stop or fail
  * the run. baseConfig is a configuration the SDK made (a saved version's package); otherwise localSetup builds it.

package/dist/packages/sdk/src/current-runtime.js

@@ -38,6 +38,12 @@ export function recentRuns(exclude, limit = 20) {
     }
     return [...found].sort((a, b) => b[1] - a[1]).slice(0, limit).map(([dir]) => dir);
 }
+/** Answers for ask steps: a key without an iteration ("confirm") answers its first iteration ("confirm:0"). */
+export function answers(human) {
+    if (!human?.steps)
+        return human;
+    return { ...human, steps: Object.fromEntries(Object.entries(human.steps).map(([key, value]) => [key.includes(':') ? key : `${key}:0`, value])) };
+}
 /**
  * Run a local Method file. The run starts at once: saving and run records go through the outbox and never stop or fail
  * the run. baseConfig is a configuration the SDK made (a saved version's package); otherwise localSetup builds it.
@@ -125,7 +131,7 @@ export async function runCurrentFile(file, flags, syncFactory, onEvent, client =
             cacheFrom: flags.resume ? [] : recentRuns(authoringPath(flags['run-dir'])),
             fresh: flags.fresh ? true : flags.rerun?.length ? flags.rerun.flatMap(step => step.split(',')).map(step => step.trim()).filter(Boolean) : undefined,
             secrets: { ...resolveSecrets(Object.keys(method.secrets ?? {})), ...Object.fromEntries(Object.entries(runSecrets).filter(([key]) => Object.hasOwn(method.secrets ?? {}, key))) }, ...(hostedModels ? { hostedModels } : {}),
-            human: json(flags.human), signal: controller.signal,
+            human: answers(json(flags.human)), signal: controller.signal,
             ...(browser ? { connections: browser.connections } : {}),
             sourceRoot, ...(classification ? { classification } : {}),
             processPath: prepared.processPath,
@@ -139,7 +145,11 @@ export async function runCurrentFile(file, flags, syncFactory, onEvent, client =
         });
         runFailed = !['completed', 'unconfirmed'].includes(result.status);
         const synced = await sync?.finish();
-        const display = synced ? { ...result, dashboard_sync: synced } : result;
+        let display = synced ? { ...result, dashboard_sync: synced } : result;
+        // A run that waits for a person shows the question itself, so the agent can ask the user and pass on the answer.
+        const question = result.status === 'needs_input' ? (await import('./worker.js')).lastQuestion(authoringPath(flags['run-dir'])) : null;
+        if (question)
+            display = { ...display, question, fix: `Ask the user this question in plain words and wait for the answer; do not answer it yourself. Then write {"steps": {"${question.step}": {"outputs": {...}}}} with the user's answer (the fields are in question.form) to a file, and run the same command again with --resume --run-dir ${JSON.stringify(flags['run-dir'])} --human FILE.` };
         process.stdout.write(JSON.stringify(display, null, 2) + "\n");
         // 3: every step finished, but an observer could not confirm an external change.
         if (result.status !== "completed")

package/dist/packages/sdk/src/home.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Each Method has one home file on this computer: the file its versions are saved from. A copy in a temporary folder,
+ * or in another folder while the home file still exists, is not saved, so one Method never grows two histories.
+ * Git worktrees and clones of one repository share a home. The home record also holds what the last save or checkout
+ * wrote, so an unchanged home file can take a newer version from the account.
+ */
+export type Home = {
+    path: string;
+    key: string;
+    version_id?: string;
+    files?: Record<string, string>;
+};
+export declare function readHome(server: string, methodId: string): Home | undefined;
+export declare const temporary: (path: string) => boolean;
+/** The same file in every checkout of one repository has the same key. */
+export declare function homeKey(file: string): string;
+/** What a save or checkout wrote: the Method file and each package file, by hash. */
+export declare function writtenFiles(file: string, packageFiles: Array<{
+    path: string;
+    sha256: string;
+}>): {
+    [x: string]: string;
+};
+export declare function recordHome(server: string, methodId: string, file: string, version?: {
+    version_id: string;
+    files: Record<string, string>;
+}): void;
+/**
+ * Throws, with the home file named, when this file may not save the Method. Otherwise this file is the home after
+ * the call. A home that is gone, holds another Method, or is a temporary copy gives way to a file outside a
+ * temporary folder.
+ */
+export declare function claimHome(server: string, methodId: string, file: string): void;
+/** True when every file that the last save or checkout wrote is still unchanged in the home folder. */
+export declare function unchangedSinceSave(home: Home): boolean;
+/**
+ * Before a run of the home file: when nothing in it changed since the last save or checkout on this computer and the
+ * account has a newer version (saved from another computer or folder), write that version here first. Says nothing;
+ * any problem leaves the files as they are.
+ */
+export declare function followAccount(client: {
+    server: string;
+    token(): string | null | undefined;
+    request<T>(path: string): Promise<T>;
+    transfer(path: string): Promise<Uint8Array>;
+}, file: string): Promise<boolean>;

package/dist/packages/sdk/src/home.js

@@ -0,0 +1,137 @@
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { sha256 } from '../../contracts/src/identity.js';
+import { writePrivateJson } from './files.js';
+import { methodCache } from './prepare.js';
+import { authoringPath, readDocument } from './authoring.js';
+import { fileHash } from './method-files.js';
+const homeFile = (server, methodId) => join(methodCache(), 'homes', `${sha256(`${server}\n${methodId}`).slice(0, 24)}.json`);
+export function readHome(server, methodId) {
+    try {
+        return JSON.parse(readFileSync(homeFile(server, methodId), 'utf8'));
+    }
+    catch {
+        return undefined;
+    }
+}
+const real = (path) => { try {
+    return realpathSync(path);
+}
+catch {
+    return resolve(path);
+} };
+const temporaryRoots = () => [...new Set([tmpdir(), '/tmp', '/private/tmp', '/var/folders', '/private/var/folders'].map(real))];
+export const temporary = (path) => temporaryRoots().some(root => real(path).startsWith(root + sep));
+/** The checkout folder that holds path, and the main folder of its Git repository (a worktree points to it). */
+function repository(path) {
+    for (let dir = dirname(path);; dir = dirname(dir)) {
+        const git = join(dir, '.git');
+        if (existsSync(git)) {
+            if (statSync(git).isDirectory())
+                return { root: dir, main: dir };
+            const pointer = /^gitdir:\s*(.+)$/m.exec(readFileSync(git, 'utf8'))?.[1]?.trim();
+            const main = pointer ? /^(.*)[\\/]\.git[\\/]worktrees[\\/][^\\/]+$/.exec(resolve(dir, pointer))?.[1] : undefined;
+            return { root: dir, main: main ?? dir };
+        }
+        if (dirname(dir) === dir)
+            return undefined;
+    }
+}
+/** The same file in every checkout of one repository has the same key. */
+export function homeKey(file) {
+    const path = real(authoringPath(file)), repo = repository(path);
+    return repo ? `${repo.main}:${relative(repo.root, path)}` : path;
+}
+/** What a save or checkout wrote: the Method file and each package file, by hash. */
+export function writtenFiles(file, packageFiles) {
+    const path = authoringPath(file);
+    return { [relative(dirname(path), path)]: fileHash(readFileSync(path)), ...Object.fromEntries(packageFiles.map(f => [f.path, f.sha256])) };
+}
+export function recordHome(server, methodId, file, version) {
+    writePrivateJson(homeFile(server, methodId), { path: authoringPath(file), key: homeKey(file), ...version });
+}
+/**
+ * Throws, with the home file named, when this file may not save the Method. Otherwise this file is the home after
+ * the call. A home that is gone, holds another Method, or is a temporary copy gives way to a file outside a
+ * temporary folder.
+ */
+export function claimHome(server, methodId, file) {
+    const home = readHome(server, methodId), key = homeKey(file);
+    if (home && home.key === key) {
+        if (home.path !== authoringPath(file))
+            recordHome(server, methodId, file, home.version_id ? { version_id: home.version_id, files: home.files ?? {} } : undefined);
+        return;
+    }
+    const homeLives = (() => { try {
+        return !!home && readDocument(home.path).id === methodId;
+    }
+    catch {
+        return false;
+    } })();
+    if (home && homeLives && (temporary(file) || !temporary(home.path)))
+        throw Object.assign(Error(`This Method is saved from ${home.path}. Make the change in that file and run it there; this copy was not run or saved.`), { code: 'other_home', home: home.path });
+    recordHome(server, methodId, file);
+}
+/** True when every file that the last save or checkout wrote is still unchanged in the home folder. */
+export function unchangedSinceSave(home) {
+    if (!home.version_id || !home.files)
+        return false;
+    const root = dirname(home.path);
+    return Object.entries(home.files).every(([name, hash]) => { try {
+        return fileHash(readFileSync(join(root, name))) === hash;
+    }
+    catch {
+        return false;
+    } });
+}
+/**
+ * Before a run of the home file: when nothing in it changed since the last save or checkout on this computer and the
+ * account has a newer version (saved from another computer or folder), write that version here first. Says nothing;
+ * any problem leaves the files as they are.
+ */
+export async function followAccount(client, file) {
+    const path = authoringPath(file);
+    try {
+        const id = (await import('./authoring.js')).readDocument(path).id;
+        if (typeof id !== 'string' || !client.token())
+            return false;
+        const home = readHome(client.server, id);
+        if (!home || home.key !== homeKey(path) || !unchangedSinceSave(home))
+            return false;
+        const latest = await client.request(`/api/cli/methods/${encodeURIComponent(id)}`);
+        if (!latest?.version_id || latest.version_id === home.version_id)
+            return false;
+        const { mkdtempSync, rmSync, copyFileSync, mkdirSync } = await import('node:fs');
+        const { restorePackage } = await import('./method-files.js');
+        const staging = mkdtempSync(join(methodCache(), 'follow-'));
+        try {
+            await restorePackage(latest, staging, client);
+            const root = dirname(path), incoming = latest.package?.files ?? [];
+            // A local file that the last save did not write, and that differs, is the user's: then nothing changes.
+            for (const f of incoming) {
+                const local = join(root, f.path);
+                if (existsSync(local) && !home.files?.[f.path] && fileHash(readFileSync(local)) !== f.sha256)
+                    return false;
+            }
+            for (const f of incoming) {
+                mkdirSync(dirname(join(root, f.path)), { recursive: true, mode: 0o700 });
+                copyFileSync(join(staging, f.path), join(root, f.path));
+            }
+        }
+        finally {
+            rmSync(staging, { recursive: true, force: true });
+        }
+        const { writeDocument } = await import('./authoring.js');
+        const { methodContent, writeMethodId } = await import('./versions.js');
+        writeDocument(path, methodContent(latest.workflow));
+        (await import('./legacy.js')).convertLegacy(path);
+        writeMethodId(path, id);
+        (await import('./outbox.js')).recordCheckout(client.server, id, latest.version_id, latest.version_number, methodContent(latest.workflow));
+        recordHome(client.server, id, path, { version_id: latest.version_id, files: writtenFiles(path, latest.package?.files ?? []) });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/packages/sdk/src/legacy.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Convert a Method folder of an older format in place: runtime.json moves into the Method (models, limits, tools),
+ * its folder paths become this computer's bindings, and FILE.method.json becomes the id: line. Both old files are
+ * deleted. Returns true when it changed something. When the result does not validate, every file is left as it was.
+ */
+export declare function convertLegacy(file: string): boolean;
+/** Convert before a command reads the file. A folder that cannot be converted is a plain error for the agent to fix. */
+export declare function convertLegacyOrThrow(file: string): boolean;

package/dist/packages/sdk/src/legacy.js

@@ -0,0 +1,72 @@
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
+import { loadWorkflow, parseDocumentValue, serializeWorkflow } from '../../workflow-language/src/validate.js';
+import { authoringPath } from './authoring.js';
+import { bindConnectionValue } from './computer-settings.js';
+import { newMethodId } from './versions.js';
+const runLimitKeys = ['timeout_ms', 'max_model_requests', 'max_invocations', 'max_tool_calls', 'max_output_bytes', 'max_request_bytes', 'max_concurrency'];
+const stepLimitKeys = ['timeout_ms', 'max_agent_turns', 'max_model_requests'];
+const efforts = ['minimal', 'low', 'medium', 'high'];
+const pick = (value, keys) => Object.fromEntries(keys.filter(key => value?.[key] !== undefined).map(key => [key, value[key]]));
+/** A runtime.json model profile as a format 3.4 models entry. Direct API profiles become the same model, hosted. */
+function modelEntry(profile) {
+    if (profile.backend === 'codex' || profile.backend === 'claude')
+        return { agent: profile.backend, ...pick(profile, ['model', 'reasoning_effort']) };
+    const provider = { 'openai-responses': 'openai/', 'anthropic-messages': 'anthropic/' }[profile.backend] ?? '';
+    const model = String(profile.model).includes('/') ? profile.model : `${provider}${profile.model}`;
+    const effort = profile.reasoning_effort ?? profile.effort;
+    const options = { ...(profile.max_output_tokens ? { max_output_tokens: profile.max_output_tokens } : {}), ...(efforts.includes(effort) ? { reasoning_effort: effort } : {}) };
+    return Object.keys(options).length ? { model, ...options } : model;
+}
+/**
+ * Convert a Method folder of an older format in place: runtime.json moves into the Method (models, limits, tools),
+ * its folder paths become this computer's bindings, and FILE.method.json becomes the id: line. Both old files are
+ * deleted. Returns true when it changed something. When the result does not validate, every file is left as it was.
+ */
+export function convertLegacy(file) {
+    const path = authoringPath(file), folder = dirname(path);
+    const runtimeFile = join(folder, 'runtime.json'), sidecarFile = `${path}.method.json`;
+    const hasRuntime = existsSync(runtimeFile), hasSidecar = existsSync(sidecarFile);
+    if (!hasRuntime && !hasSidecar)
+        return false;
+    const original = readFileSync(path, 'utf8');
+    const document = parseDocumentValue(original);
+    const config = hasRuntime ? JSON.parse(readFileSync(runtimeFile, 'utf8')) : {};
+    const sidecar = hasSidecar ? JSON.parse(readFileSync(sidecarFile, 'utf8')) : {};
+    const { format: _format, id: oldId, ...content } = document;
+    // Folder paths become bindings of this computer, which belong to a Method ID.
+    const id = oldId ?? sidecar.workflow_id ?? (Object.keys(config.environment ?? {}).length ? newMethodId() : undefined);
+    const models = Object.fromEntries(Object.entries(config.models ?? {}).map(([name, profile]) => [name, modelEntry(profile)]));
+    const limits = { ...pick(config.limits, runLimitKeys), ...(config.step_defaults ? { step: pick(config.step_defaults, stepLimitKeys) } : {}) };
+    const files = (content.files ?? []).filter((name) => name !== 'runtime.json');
+    const next = {
+        format: 'method/3.4', ...(id ? { id } : {}), ...content,
+        ...(Object.keys(models).length ? { models: { ...models, ...content.models } } : {}),
+        ...(Object.keys(limits).length ? { limits: { ...limits, ...content.limits, ...(limits.step || content.limits?.step ? { step: { ...limits.step, ...content.limits?.step } } : {}) } } : {}),
+        ...(config.tools ? { tools: { ...config.tools, ...content.tools } } : {}),
+    };
+    if (files.length)
+        next.files = files;
+    else
+        delete next.files;
+    const { id: _id, ...checked } = next;
+    loadWorkflow(checked);
+    writeFileSync(path, /^\s*\{/.test(original) ? JSON.stringify(next, null, 2) + '\n' : serializeWorkflow(next), { mode: 0o600 });
+    if (id)
+        for (const [name, value] of Object.entries(config.environment ?? {}))
+            bindConnectionValue(id, name, isAbsolute(String(value)) ? String(value) : resolve(folder, String(value)));
+    if (hasRuntime)
+        unlinkSync(runtimeFile);
+    if (hasSidecar)
+        unlinkSync(sidecarFile);
+    return true;
+}
+/** Convert before a command reads the file. A folder that cannot be converted is a plain error for the agent to fix. */
+export function convertLegacyOrThrow(file) {
+    try {
+        return convertLegacy(file);
+    }
+    catch (error) {
+        throw Error(`${basename(authoringPath(file))} uses an older format, and its runtime.json could not be moved into it: ${error.message}`);
+    }
+}

package/dist/packages/sdk/src/local-cli.js

@@ -29,16 +29,13 @@ export function parse(args) {
 }
 export async function run(target, flags, syncFactory) {
     const path = isWorkflowLink(target) ? (await saveWorkflowLink(target, process.cwd())).path : resolve(target);
-    const legacy = (await import("./method-issues.js")).legacyIssues(path);
-    if (legacy.length)
-        throw Error(legacy.map(issue => `${issue.code}: ${issue.message} ${issue.fix}`).join('\n'));
+    (await import("./legacy.js")).convertLegacyOrThrow(path);
+    if (!syncFactory)
+        await (await import("./home.js")).followAccount(new MethodClient(flags.server), path);
     loadWorkflow(methodContent(readDocument(path)));
     const notice = await (await import("./quality.js")).casesNotice(path);
     if (notice)
         process.stderr.write(notice + "\n");
-    const update = await (await import("./update.js")).updateNotice();
-    if (update)
-        process.stderr.write(update + "\n");
     (await import("./prepare.js")).pruneCachedRuns();
     flags = { ...flags, "run-dir": flags["run-dir"] ?? join(process.cwd(), ".method-runs", randomUUID()) };
     const account = syncFactory ? undefined : await accountSync(path, flags);
@@ -88,6 +85,9 @@ async function accountSync(path, flags) {
         return { client, outbox, version, sync: () => new Sync(client, runDir, version.method_id, version.version_id, undefined, method.run_data === "device", outbox) };
     }
     catch (error) {
+        // A copy of a Method that is saved from another file must not run: the change belongs in that file.
+        if (error.code === 'other_home')
+            throw error;
         process.stderr.write(`Not saved to your Method account: ${error.message} The run continues on this computer.\n`);
         return undefined;
     }

package/dist/packages/sdk/src/method-help.js

@@ -63,7 +63,7 @@ export const commandHelp = {
 --resume: continue the same saved run with its saved agent.
 --rerun STEP: run this step again even when an earlier run can be reused. Repeat for more steps.
 --fresh: run every step; reuse nothing.
---human FILE: answers for ask steps, as {steps: {"STEP:ITERATION": {outputs: {...}}}}.
+--human FILE: answers for ask steps, as {steps: {"STEP": {outputs: {...}}}} (STEP:ITERATION, counted from 0, for a step with each or repeat).
 --verbose: print runtime events.
 Use method doctor to check the installed Node and configured tools.`, result: "Progress and final status text; local result.json and run evidence; dashboard run link when synced. The runtime executes the method's declared scripts, calls, agents, and checks. Executes trusted local processes; changes declarations do not enforce permissions. Runs exit 0 on completion, 1 on failure, 2 when human input is needed, and 3 when an observer could not confirm an external change (unconfirmed).", errors: "Missing inputs/access, failed check, timeout, unsafe resume/version mismatch, upload failure. See recovery. Never retry a business write without inspecting its saved changes.", example: "method run wf_example --version v_example --inputs inputs.json", remote: true },
     observe: { usage: "method observe [RUN_DIRECTORY...] [--pending ROOT]...", purpose: "Make the effect observations that are due for finished runs.", arguments: "Without directories, checks runs with open effects under .method-runs and the Method cache. Runs only observers and judges; never repeats an action. Schedule it, for example hourly, so late evidence such as a bounce reaches the run.", result: "JSON with each run's new verdicts, status, and next observation time. A synced run whose status changed is uploaded again.", errors: "Locked run, changed bundle, or a missing observer credential.", example: "method observe --pending .method-runs" },
@@ -331,12 +331,11 @@ const recovery = `# Recovery
 For a stopped run, read summary.json, events.jsonl, and checkpoint.json. Resume with the original method, --run-dir DIR, and --resume. Accepted steps and iterations are reused.
 An unfinished action needs --retry STEP:ITERATION after inspection of its external effects. A retry consumes the remaining run budget. Budgets do not reset on resume. Resume always uses the run's saved bundle, so a code fix needs a new run.
 To fix a failed or wrong step, change it and run the Method again. The new run reuses every iteration whose step definition, inputs, model, tools, runtime, and (for script steps) bundle files match an earlier accepted run on this computer, and copies their declared file outputs. Steps with ask or effects, steps that change state or a service, and tools with effects are never reused. Use --rerun STEP to run a step again anyway, or --fresh to reuse nothing.
-For ask, supply --human FILE containing {steps: {"STEP:ITERATION": {outputs: {NAME: VALUE}}}}. Use the user's actual answer. Checks still run.
+For ask, supply --human FILE containing {steps: {"STEP": {outputs: {NAME: VALUE}}}} (STEP:ITERATION, counted from 0, for a step with each or repeat). Use the user's actual answer. Checks still run.
 A save never blocks a run: a run that cannot save says "Will save when online", and any later method command sends the outbox.
 State commits after checks. A local checkpoint cannot roll back an external write. Inspect external state before an explicit retry.
-Two computers can save different content of one Method; each becomes a version with its parent. Going back to earlier content finds its existing version. The id: line keeps a renamed or moved file on its Method; method new-id FILE makes a copy a new Method.
+Two computers can save different content of one Method; each becomes a version with its parent. Going back to earlier content finds its existing version. The id: line keeps a renamed or moved file on its Method; method new-id FILE makes a copy a new Method. On one computer a Method is saved from one file (every checkout of one Git repository counts as one): a copy in another folder or a temporary folder does not run while that file exists, and the error names the file to change. When that file is unchanged since its last save and the account has a newer version, a run takes that version first.
 Use method sync RUN_DIRECTORY to repair a dashboard upload without executing the method again.
-New Methods use format method/3.4. A signed-in run moves a method/3.1 to 3.3 file to 3.4 when it writes the id: line.
 After a failed action with effects, the failure lists what the observers saw. A confirmed effect means the change happened: do not retry the action. A run that is unconfirmed finished all its steps; inspect effects.jsonl and the external system before relying on its result.
 `;
 export const guideTopics = ["start", "concepts", "execution", "examples", "example", "recipes", "recovery", "commands"];

package/dist/packages/sdk/src/method-issues.d.ts

@@ -13,11 +13,6 @@ export declare function hostedModelUses(method: any): {
 }[];
 /** model_not_private: a step names a hosted model that has no private endpoint. Deterministic from the saved list. */
 export declare function privacyIssues(method: any, privateIds: Set<string>): Issue[];
-/**
- * legacy_runtime_json and legacy_sidecar: an old runtime.json or FILE.method.json is next to the Method. Method files
- * no longer read them, so a run would lose their settings. The fix says what to move where; nothing is changed here.
- */
-export declare function legacyIssues(file: string): Issue[];
 export type IssueReport = {
     issues: Issue[];
     changed?: Set<string>;

package/dist/packages/sdk/src/method-issues.js

@@ -2,7 +2,7 @@
  * The issues of a local Method: the runtime's methodIssues (format and code checks, with this computer's secret
  * values and the files that will be uploaded), the model privacy check, and the model checks. Only errors block.
  */
-import { existsSync, mkdirSync, openSync, closeSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { mkdirSync, openSync, closeSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
 import { spawn } from 'node:child_process';
 import { basename, dirname, join, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
@@ -68,29 +68,20 @@ export function privacyIssues(method, privateIds) {
         fix: 'Choose a model from method models.',
     }));
 }
-/**
- * legacy_runtime_json and legacy_sidecar: an old runtime.json or FILE.method.json is next to the Method. Method files
- * no longer read them, so a run would lose their settings. The fix says what to move where; nothing is changed here.
- */
-export function legacyIssues(file) {
-    const path = authoringPath(file), folder = dirname(path), issues = [];
-    if (existsSync(join(folder, 'runtime.json')))
-        issues.push({ code: 'legacy_runtime_json', level: 'error',
-            message: `runtime.json is next to ${basename(path)}. Methods no longer read runtime.json, so its settings would be lost.`,
-            fix: 'Move each part into the Method, then delete runtime.json. models -> top-level models: (NAME: provider/model, or {model, max_output_tokens, reasoning_effort}); a profile with backend codex or claude -> NAME: {agent: codex|claude, model, reasoning_effort} (keep its model and reasoning_effort). limits -> top-level limits:. step_defaults -> limits.step. tools -> top-level tools:. environment paths -> method bind ID NAME --file FOLDER (a folder beside the Method with the connection name needs nothing). classification.api_key_env -> method config model-key. runtimes and allow_local_processes need nothing. Set format: method/3.4 and remove runtime.json from files:.' });
-    if (existsSync(`${path}.method.json`))
-        issues.push({ code: 'legacy_sidecar', level: 'error',
-            message: `${basename(path)}.method.json is next to ${basename(path)}. Methods keep their ID in the file now.`,
-            fix: `Put its workflow_id as the line id: wf_... directly after format: method/3.4 in ${basename(path)}, then delete ${basename(path)}.method.json.` });
-    return issues;
-}
 /**
  * All issues of a Method file. With changed, model checks run for the steps whose text changed since the last
  * validate (in parallel, waitMs in all; the rest finish in the background). Without it, only cached answers are used.
  */
 export async function collectIssues(file, options = {}) {
-    const path = authoringPath(file), text = readFileSync(path, 'utf8');
-    const legacy = legacyIssues(path), first = [...legacy, ...methodIssues(text)];
+    const path = authoringPath(file);
+    try {
+        (await import('./legacy.js')).convertLegacyOrThrow(path);
+    }
+    catch (error) {
+        return { issues: [{ code: 'older_format', level: 'error', message: error.message, fix: 'Fix what the message names in runtime.json or the Method, then validate again.' }], pending: 0, notChecked: [], invalid: true };
+    }
+    const text = readFileSync(path, 'utf8');
+    const first = methodIssues(text);
     if (first.some(issue => issue.level === 'error'))
         return { issues: first, pending: 0, notChecked: [], invalid: true };
     const method = parseDocumentValue(text), read = folderReader(path);

package/dist/packages/sdk/src/method.js

@@ -45,6 +45,13 @@ async function dispatchRunWorker(args, flags, extra = []) {
     return true;
 }
 export async function methodMain(args = process.argv.slice(2), clientFactory = server => new MethodClient(server)) {
+    const resumed = (await import('./resume-release.js')).resumeWithOriginalRelease(args);
+    if (resumed !== undefined) {
+        process.exitCode = resumed;
+        return;
+    }
+    // An installed CLI keeps itself current in the background, with no output; this command is not delayed.
+    void (await import('./update.js')).updateInBackground();
     const earlyHelp = methodHelp(args);
     if (earlyHelp !== undefined) {
         process.stdout.write(earlyHelp);
@@ -215,8 +222,7 @@ export async function methodMain(args = process.argv.slice(2), clientFactory = s
                     throw error;
             }
         }
-        const update = await (await import("./update.js")).updateNotice();
-        process.stdout.write(JSON.stringify({ installed: true, server: client.server, signed_in: signedIn, ...(!signedIn ? { next: "Run method login to sign in with browser approval." } : {}), ...(update ? { update } : {}) }, null, 2) + "\n");
+        process.stdout.write(JSON.stringify({ installed: true, server: client.server, signed_in: signedIn, ...(!signedIn ? { next: "Run method login to sign in with browser approval." } : {}) }, null, 2) + "\n");
         return;
     }
     // Without sign-in, explain prints one line and stops: script cards need a hosted model.
@@ -333,8 +339,17 @@ export async function methodMain(args = process.argv.slice(2), clientFactory = s
             // The id: line links the file to its Method; its content is the saved version.
             const { methodContent, writeMethodId } = await import("./versions.js");
             writeDocument(out, methodContent(workflow));
+            // An older saved version carries runtime.json; the file gets it in the Method, as in format 3.4.
+            (await import("./legacy.js")).convertLegacyOrThrow(out);
             writeMethodId(out, saved.workflow_id);
             (await import("./outbox.js")).recordCheckout(client.server, saved.workflow_id, saved.version_id, saved.version_number, methodContent(workflow));
+            // The new file becomes the Method's home on this computer unless another file already is.
+            const home = await import("./home.js");
+            try {
+                home.claimHome(client.server, saved.workflow_id, out);
+                home.recordHome(client.server, saved.workflow_id, out, { version_id: saved.version_id, files: home.writtenFiles(out, saved.package?.files ?? []) });
+            }
+            catch { /* a copy for reading */ }
             print({
                 workflow_id: saved.workflow_id,
                 version_id: saved.version_id,

package/dist/packages/sdk/src/resume-release.d.ts

@@ -0,0 +1,5 @@
+/**
+ * A run resumes with the runtime that started it. When the CLI updated itself since then, the command runs again with
+ * the installed release that has that runtime (releases are kept), and returns its exit code. Undefined: run here.
+ */
+export declare function resumeWithOriginalRelease(args: string[]): number | undefined;

package/dist/packages/sdk/src/resume-release.js

@@ -0,0 +1,30 @@
+import { spawnSync } from 'node:child_process';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import runtimeInfo from '@withmethod/runtime/package.json' with { type: 'json' };
+const read = (path) => { try {
+    return JSON.parse(readFileSync(path, 'utf8'));
+}
+catch {
+    return undefined;
+} };
+/**
+ * A run resumes with the runtime that started it. When the CLI updated itself since then, the command runs again with
+ * the installed release that has that runtime (releases are kept), and returns its exit code. Undefined: run here.
+ */
+export function resumeWithOriginalRelease(args) {
+    const at = args.indexOf('--run-dir'), releaseRoot = process.env.METHOD_RELEASE_ROOT;
+    if (!args.includes('--resume') || at < 0 || !args[at + 1] || !releaseRoot)
+        return undefined;
+    const wanted = read(join(resolve(args[at + 1]), 'checkpoint.json'))?.executor_version;
+    if (typeof wanted !== 'string' || wanted === runtimeInfo.version)
+        return undefined;
+    const releases = dirname(releaseRoot);
+    const match = readdirSync(releases).filter(name => existsSync(join(releases, name, 'method')))
+        .filter(name => read(join(releases, name, 'sdk', 'node_modules', '@withmethod', 'runtime', 'package.json'))?.version === wanted)
+        .sort((a, b) => b.localeCompare(a, undefined, { numeric: true }))[0];
+    if (!match)
+        return undefined;
+    const result = spawnSync(join(releases, match, 'method'), args, { stdio: 'inherit', env: { ...process.env, METHOD_NO_UPDATE: '1' } });
+    return result.status ?? 1;
+}

package/dist/packages/sdk/src/update.d.ts

@@ -1,5 +1,10 @@
+/** Run the installer in its own process; this command does not wait for it, and it prints nothing. */
+declare function startInstaller(): void;
 /**
- * The newest release, from the version pointer that the installer reads, checked at most once a day.
- * Returns a one-line notice when it is newer than this CLI, or nothing. A network problem is never an error.
+ * Keep an installed CLI current with no message: at most once a day it reads the newest release from the version
+ * pointer that the installer reads, and when that is newer it installs it in the background. The command that started
+ * the check continues on this release; the next command uses the new one, and running commands keep their release.
+ * Only an installed release updates itself (not a development or npm copy). METHOD_NO_UPDATE=1 turns it off.
  */
-export declare function updateNotice(fetcher?: typeof fetch, now?: number): Promise<string | undefined>;
+export declare function updateInBackground(fetcher?: typeof fetch, now?: number, install?: typeof startInstaller): Promise<boolean>;
+export {};

package/dist/packages/sdk/src/update.js

@@ -1,9 +1,10 @@
+import { spawn } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import packageInfo from '../package.json' with { type: 'json' };
 import { methodCache } from './prepare.js';
 import { writePrivateJson } from './files.js';
-const day = 86_400_000;
+const day = 86_400_000, installWindow = 30 * 60_000;
 const newer = (a, b) => {
     const [x, y] = [a, b].map(v => v.split('.').map(Number));
     for (let i = 0; i < 3; i++)
@@ -11,15 +12,30 @@ const newer = (a, b) => {
             return (x[i] ?? 0) > (y[i] ?? 0);
     return false;
 };
+const read = (path) => { try {
+    return existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : undefined;
+}
+catch {
+    return undefined;
+} };
+/** Run the installer in its own process; this command does not wait for it, and it prints nothing. */
+function startInstaller() {
+    const url = process.env.METHOD_INSTALL_URL ?? 'https://app.withmethod.ai/install.sh';
+    spawn('/bin/sh', ['-c', 'curl -fsSL "$1" | sh', 'method-update', url], { detached: true, stdio: 'ignore', env: { ...process.env, METHOD_SKIP_PLUGIN: '1' } }).unref();
+}
 /**
- * The newest release, from the version pointer that the installer reads, checked at most once a day.
- * Returns a one-line notice when it is newer than this CLI, or nothing. A network problem is never an error.
+ * Keep an installed CLI current with no message: at most once a day it reads the newest release from the version
+ * pointer that the installer reads, and when that is newer it installs it in the background. The command that started
+ * the check continues on this release; the next command uses the new one, and running commands keep their release.
+ * Only an installed release updates itself (not a development or npm copy). METHOD_NO_UPDATE=1 turns it off.
  */
-export async function updateNotice(fetcher = fetch, now = Date.now()) {
-    const cache = join(methodCache(), 'latest.json');
+export async function updateInBackground(fetcher = fetch, now = Date.now(), install = startInstaller) {
+    if (process.env.METHOD_NO_UPDATE || !process.env.METHOD_RELEASE_ROOT)
+        return false;
+    const cache = join(methodCache(), 'latest.json'), lock = join(methodCache(), 'update.json');
     let latest;
     try {
-        const saved = existsSync(cache) ? JSON.parse(readFileSync(cache, 'utf8')) : null;
+        const saved = read(cache);
         if (saved && now - saved.checked_at < day)
             latest = saved.version;
         else {
@@ -29,11 +45,17 @@ export async function updateNotice(fetcher = fetch, now = Date.now()) {
             latest = response.ok ? /^version (\S+)$/m.exec(await response.text())?.[1] : undefined;
             writePrivateJson(cache, { checked_at: now, version: latest ?? null });
         }
+        if (!latest || !newer(latest, packageInfo.version))
+            return false;
+        // One installer at a time; a failed one is tried again after the window.
+        const running = read(lock);
+        if (running?.version === latest && now - running.started_at < installWindow)
+            return false;
+        writePrivateJson(lock, { version: latest, started_at: now });
+        install();
+        return true;
     }
     catch {
-        return undefined;
+        return false;
     }
-    if (!latest || !newer(latest, packageInfo.version))
-        return undefined;
-    return `Method ${latest} is available (you have ${packageInfo.version}). Update: curl -fsSL https://app.withmethod.ai/install.sh | sh`;
 }

package/dist/packages/sdk/src/versions.js

@@ -6,6 +6,7 @@ import { loadWorkflow, parseDocumentValue, serializeWorkflow } from '../../workf
 import { buildPackage } from './method-files.js';
 import { authoringPath, readDocument } from './authoring.js';
 import { Outbox, lastSaved, savedVersions } from './outbox.js';
+import { claimHome, recordHome, writtenFiles } from './home.js';
 export const methodIdPattern = /^wf_[a-f0-9]{32}$/;
 /** A new account Method ID, made on this computer. The first save of this ID creates the Method. */
 export const newMethodId = () => `wf_${randomBytes(16).toString('hex')}`;
@@ -92,10 +93,12 @@ export async function currentVersion(file) {
  */
 export async function prepareVersion(client, outbox, file, reason) {
     const id = ensureMethodId(file);
+    claimHome(client.server, id, file);
     const workflow = loadWorkflow(methodContent(readDocument(file)));
     const { pack, sources, tooLarge } = await buildPackage(file, workflow);
     const versionId = versionIdFor(id, pack.digest);
     const url = `${client.server}/methods/${id}?version=${versionId}`;
+    recordHome(client.server, id, file, { version_id: versionId, files: writtenFiles(file, pack.files) });
     if (savedVersions(client.server)[versionId])
         return { method_id: id, version_id: versionId, url, unchanged: true, workflow };
     const previous = lastSaved(client.server, id);

package/dist/packages/workflow-language/src/inspection.d.ts

@@ -87,9 +87,9 @@ export declare const RunEventSchema: z.ZodObject<{
     kind?: "classify" | undefined;
     child?: string | undefined;
     model?: string | undefined;
+    phase?: "check" | "action" | undefined;
     provider?: string | undefined;
     request_id?: string | undefined;
-    phase?: "check" | "action" | undefined;
     operation_id?: string | undefined;
     confidence?: number | null | undefined;
     usage?: {
@@ -114,9 +114,9 @@ export declare const RunEventSchema: z.ZodObject<{
     kind?: "classify" | undefined;
     child?: string | undefined;
     model?: string | undefined;
+    phase?: "check" | "action" | undefined;
     provider?: string | undefined;
     request_id?: string | undefined;
-    phase?: "check" | "action" | undefined;
     operation_id?: string | undefined;
     confidence?: number | null | undefined;
     usage?: {
@@ -317,9 +317,9 @@ export declare const InspectionSchema: z.ZodObject<{
         kind?: "classify" | undefined;
         child?: string | undefined;
         model?: string | undefined;
+        phase?: "check" | "action" | undefined;
         provider?: string | undefined;
         request_id?: string | undefined;
-        phase?: "check" | "action" | undefined;
         operation_id?: string | undefined;
         confidence?: number | null | undefined;
         usage?: {
@@ -344,9 +344,9 @@ export declare const InspectionSchema: z.ZodObject<{
         kind?: "classify" | undefined;
         child?: string | undefined;
         model?: string | undefined;
+        phase?: "check" | "action" | undefined;
         provider?: string | undefined;
         request_id?: string | undefined;
-        phase?: "check" | "action" | undefined;
         operation_id?: string | undefined;
         confidence?: number | null | undefined;
         usage?: {
@@ -466,9 +466,9 @@ export declare const InspectionSchema: z.ZodObject<{
             kind?: "classify" | undefined;
             child?: string | undefined;
             model?: string | undefined;
+            phase?: "check" | "action" | undefined;
             provider?: string | undefined;
             request_id?: string | undefined;
-            phase?: "check" | "action" | undefined;
             operation_id?: string | undefined;
             confidence?: number | null | undefined;
             usage?: {
@@ -493,9 +493,9 @@ export declare const InspectionSchema: z.ZodObject<{
             kind?: "classify" | undefined;
             child?: string | undefined;
             model?: string | undefined;
+            phase?: "check" | "action" | undefined;
             provider?: string | undefined;
             request_id?: string | undefined;
-            phase?: "check" | "action" | undefined;
             operation_id?: string | undefined;
             confidence?: number | null | undefined;
             usage?: {
@@ -558,9 +558,9 @@ export declare const InspectionSchema: z.ZodObject<{
             kind?: "classify" | undefined;
             child?: string | undefined;
             model?: string | undefined;
+            phase?: "check" | "action" | undefined;
             provider?: string | undefined;
             request_id?: string | undefined;
-            phase?: "check" | "action" | undefined;
             operation_id?: string | undefined;
             confidence?: number | null | undefined;
             usage?: {
@@ -623,9 +623,9 @@ export declare const InspectionSchema: z.ZodObject<{
             kind?: "classify" | undefined;
             child?: string | undefined;
             model?: string | undefined;
+            phase?: "check" | "action" | undefined;
             provider?: string | undefined;
             request_id?: string | undefined;
-            phase?: "check" | "action" | undefined;
             operation_id?: string | undefined;
             confidence?: number | null | undefined;
             usage?: {
@@ -700,9 +700,9 @@ export declare const InspectionSchema: z.ZodObject<{
             kind?: "classify" | undefined;
             child?: string | undefined;
             model?: string | undefined;
+            phase?: "check" | "action" | undefined;
             provider?: string | undefined;
             request_id?: string | undefined;
-            phase?: "check" | "action" | undefined;
             operation_id?: string | undefined;
             confidence?: number | null | undefined;
             usage?: {
@@ -796,9 +796,9 @@ export declare const InspectionSchema: z.ZodObject<{
         kind?: "classify" | undefined;
         child?: string | undefined;
         model?: string | undefined;
+        phase?: "check" | "action" | undefined;
         provider?: string | undefined;
         request_id?: string | undefined;
-        phase?: "check" | "action" | undefined;
         operation_id?: string | undefined;
         confidence?: number | null | undefined;
         usage?: {
@@ -844,9 +844,9 @@ export declare const InspectionSchema: z.ZodObject<{
             kind?: "classify" | undefined;
             child?: string | undefined;
             model?: string | undefined;
+            phase?: "check" | "action" | undefined;
             provider?: string | undefined;
             request_id?: string | undefined;
-            phase?: "check" | "action" | undefined;
             operation_id?: string | undefined;
             confidence?: number | null | undefined;
             usage?: {
@@ -940,9 +940,9 @@ export declare const InspectionSchema: z.ZodObject<{
         kind?: "classify" | undefined;
         child?: string | undefined;
         model?: string | undefined;
+        phase?: "check" | "action" | undefined;
         provider?: string | undefined;
         request_id?: string | undefined;
-        phase?: "check" | "action" | undefined;
         operation_id?: string | undefined;
         confidence?: number | null | undefined;
         usage?: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@method-ai-hq/sdk",
-  "version": "0.14.3",
+  "version": "0.14.5",
   "description": "Build and run reusable .method files with checked steps and saved results.",
   "license": "MIT",
   "type": "module",