@method-ai-hq/sdk 0.16.0 → 0.17.0

package/README.md

@@ -3,7 +3,7 @@
 MIT-licensed JavaScript API and the `method` CLI. Source and releases: https://github.com/method-ai-hq/method-sdk
 
 ```sh
-npm install https://github.com/method-ai-hq/method-sdk/releases/download/v0.16.0/method-ai-hq-sdk-0.16.0.tgz
+npm install https://github.com/method-ai-hq/method-sdk/releases/download/v0.17.0/method-ai-hq-sdk-0.17.0.tgz
 npx method --version
 ```
 

package/dist/packages/sdk/examples/outbound-management/README.md

@@ -24,7 +24,7 @@ The `draft_tasks` prompt shows two tasks written the way they should be, for
 contacts that are not in the CRM: a reply to a pricing question and an
 introduction request. Replace them with two drafts that you sent and liked.
 
-The three browser steps accept the `untrusted_content_can_act` warning: each
+The three browser steps accept the `untrusted_reaches_action` warning: each
 agent reads pages with a signed-in browser that could also send, and the
 `accept:` line on each step gives the reason to keep it. Nothing is sent until
 you review the tasks.

package/dist/packages/sdk/examples/outbound-management/outbound.method

@@ -58,7 +58,7 @@ steps:
     name: Read campaign email
     no_effect_reason: Reads the mailbox in the browser; sends, replies to, and deletes nothing.
     accept:
-      untrusted_content_can_act: The agent needs the signed-in mailbox to read campaign email. The prompt asks it only to search and read; nothing is sent until a person reviews the tasks.
+      untrusted_reaches_action: The agent needs the signed-in mailbox to read campaign email. The prompt asks it only to search and read; nothing is sent until a person reviews the tasks.
     changes: [environment.browser]
     in:
       mailbox_url: target.mailbox_url
@@ -94,7 +94,7 @@ steps:
     name: Find prospects in Happenstance
     no_effect_reason: Searches Happenstance in the browser; sends no messages or introduction requests.
     accept:
-      untrusted_content_can_act: The agent needs the signed-in Happenstance account to search the network. The prompt asks it only to search; no message or introduction request is sent.
+      untrusted_reaches_action: The agent needs the signed-in Happenstance account to search the network. The prompt asks it only to search; no message or introduction request is sent.
     changes: [environment.browser]
     after: read_email
     in:
@@ -132,7 +132,7 @@ steps:
     name: Check each prospect's pages
     no_effect_reason: Reads company and LinkedIn pages in the browser; sends no messages or connection requests.
     accept:
-      untrusted_content_can_act: The agent needs the signed-in browser to read LinkedIn profiles. The prompt asks it only to read pages; no message or connection request is sent.
+      untrusted_reaches_action: The agent needs the signed-in browser to read LinkedIn profiles. The prompt asks it only to read pages; no message or connection request is sent.
     changes: [environment.browser]
     after: find_prospects
     each: {prospect: prospects}

package/dist/packages/sdk/examples/social-briefing/README.md

@@ -29,7 +29,7 @@ default connection copies the last-used Chrome profile and runs headless. Run
 
 - `no_effect_reason`: the browser step only reads. It sends, posts, and submits
   nothing, so there is no change to read back.
-- `accept: {untrusted_content_can_act: ...}`: `validate` warns when an agent that
+- `accept: {untrusted_reaches_action: ...}`: `validate` warns when an agent that
   reads web pages could also change things with the same browser. Here the agent
   needs the signed-in browser to read, and a person reads the briefing before it
   is shared, so the warning is accepted with that reason.

package/dist/packages/sdk/examples/social-briefing/social-briefing.method

@@ -18,7 +18,7 @@ steps:
   gather_sources:
     no_effect_reason: Reads posts and papers in the browser; sends, posts and submits nothing.
     accept:
-      untrusted_content_can_act: The agent needs the signed-in browser to read Grok, alphaXiv, and LinkedIn. The prompt asks it only to search and read, and a person reads the briefing before it is shared.
+      untrusted_reaches_action: The agent needs the signed-in browser to read Grok, alphaXiv, and LinkedIn. The prompt asks it only to search and read, and a person reads the briefing before it is shared.
     name: Find and read sources
     changes:
       - environment.browser

package/dist/packages/sdk/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@method-ai-hq/sdk",
-    "version": "0.16.0",
+    "version": "0.17.0",
     "description": "Build and run reusable .method files with checked steps and saved results.",
     "license": "MIT",
     "type": "module",
@@ -35,7 +35,7 @@
         "prepack": "npm --prefix ../.. run build"
     },
     "dependencies": {
-        "@withmethod/runtime": "https://codeload.github.com/method-ai-hq/method-spec/tar.gz/6020ed9208670972df60a27a602885bcad947c8c",
+        "@withmethod/runtime": "https://codeload.github.com/method-ai-hq/method-spec/tar.gz/54461cb387d8f10813db05bb0cea29c0a3a53504",
         "fflate": "^0.8.3",
         "yaml": "^2.9.0",
         "zod": "^3.25.76"

package/dist/packages/sdk/src/authoring-instructions.d.ts

@@ -16,5 +16,5 @@ export declare const costRules = "Before describing execution cost, check how th
 /** What to watch after a Method works. */
 export declare const watchRules = "# Watch it\n\n- Look at failed and unconfirmed runs on the dashboard. A run that needs attention says which step failed and why.\n- For classify, watch how often the choice is `unclear` or below your threshold. A rise means the inputs changed.\n- For slow effects such as email delivery, schedule `method observe --pending`.\n";
 /** What to do after a Method works: production, improvement, and script cards. */
-export declare const afterRules = "# After it works\n\n- **Put it in an app:** `method connect APP_FOLDER` publishes it and prints the code to add.\n- **Improve the results:** when the user wants the results changed, `method improve FILE --note TEXT` makes a proposal from the recent runs; `method apply FILE` merges it.\n- **Explain the scripts:** `method explain FILE` writes a card for each script step.\n";
+export declare const afterRules = "# After it works\n\n- **Put it in an app:** `method connect APP_FOLDER` publishes it and prints the code to add.\n- **Record each reaction:** after you show a result, run `method judge RUN_ID wrong --note \"THEIR WORDS\"` (with `--corrected FILE` when they gave the right result) when the user corrects it or asks to change the Method because of it, and `method judge RUN_ID right` when they use or approve it. Do not ask them to confirm it. Method fixes the Method from wrong judgments; `method changes FILE` lists what it changed. For a Method that keeps run content on this computer, `method improve FILE --note TEXT` makes a local proposal and `method apply FILE` merges it.\n- **Explain the scripts:** `method explain FILE` writes a card for each script step.\n";
 export declare const exampleSelection = "After choosing the step types, read the examples that fit the design. Use their syntax; choose the steps for this task yourself.";

package/dist/packages/sdk/src/authoring-instructions.js

@@ -150,7 +150,7 @@ export const watchRules = `# Watch it
 export const afterRules = `# After it works
 
 - **Put it in an app:** \`method connect APP_FOLDER\` publishes it and prints the code to add.
-- **Improve the results:** when the user wants the results changed, \`method improve FILE --note TEXT\` makes a proposal from the recent runs; \`method apply FILE\` merges it.
+- **Record each reaction:** after you show a result, run \`method judge RUN_ID wrong --note "THEIR WORDS"\` (with \`--corrected FILE\` when they gave the right result) when the user corrects it or asks to change the Method because of it, and \`method judge RUN_ID right\` when they use or approve it. Do not ask them to confirm it. Method fixes the Method from wrong judgments; \`method changes FILE\` lists what it changed. For a Method that keeps run content on this computer, \`method improve FILE --note TEXT\` makes a local proposal and \`method apply FILE\` merges it.
 - **Explain the scripts:** \`method explain FILE\` writes a card for each script step.
 `;
 export const exampleSelection = "After choosing the step types, read the examples that fit the design. Use their syntax; choose the steps for this task yourself.";

package/dist/packages/sdk/src/improve.d.ts

@@ -1,5 +1,5 @@
 import { type MethodClient } from './method-client.js';
-/** run_id: the run that the note is about; an account run ID for an account improvement, a run folder for one on this computer. */
+/** run_id: the run folder on this computer that the note is about. */
 export type ImproveRequest = {
     step_id?: string;
     note?: string;
@@ -27,11 +27,14 @@ type ProposalKind = 'change' | 'case' | 'rubric' | 'script' | 'none';
  * proposed workflow; a case or rubric fix has case_suggestion; a script change has script_change; none has neither.
  */
 export declare function readImproveResult(result: unknown): ImproveProposal;
+export declare const judgmentsLine = "Method fixes this Method from your judgments. Record the person's reaction: method judge RUN_ID wrong --note \"...\".";
 /**
- * `method improve FILE`. A Method with account run data starts an improvement run in the account. A Method with device
- * run data runs improve.method on this computer, so its run content stays here, and saves a local proposal.
+ * `method improve FILE`. A Method that keeps run content in the account is fixed from the person's judgments
+ * (method judge), so this prints that and starts nothing. A Method with device run data (run_data: device, or an
+ * organization that keeps run content on devices) runs improve.method on this computer, so its run content stays here,
+ * and saves a local proposal.
  */
-export declare function improveCommand(args: string[], clientFactory: (server: string) => MethodClient, run?: RunFile): Promise<boolean>;
+export declare function improveCommand(args: string[], clientFactory: (server: string) => MethodClient, run?: RunFile): Promise<boolean | undefined>;
 /** Download the published improve.method and its files into the Method cache, once per version. */
 export declare function cachedImproveMethod(client: MethodClient): Promise<{
     file: string;

package/dist/packages/sdk/src/improve.js

@@ -9,7 +9,7 @@ import { DEFAULT_SERVER } from './method-client.js';
 import { fileHash } from './method-files.js';
 import { methodCache } from './prepare.js';
 import { writePrivateJson } from './files.js';
-import { currentVersion, methodContent, methodIdPattern } from './versions.js';
+import { currentVersion, methodContent } from './versions.js';
 import { localRuns, saveLocalProposal } from './proposals.js';
 const kinds = ['change', 'case', 'rubric', 'script', 'none'];
 /**
@@ -50,9 +50,12 @@ const nextStep = (file, id, kind) => ({
     none: 'No safe change was found.',
 })[kind];
 const print = (value) => process.stdout.write(JSON.stringify(value, null, 2) + '\n');
+export const judgmentsLine = 'Method fixes this Method from your judgments. Record the person\'s reaction: method judge RUN_ID wrong --note "...".';
 /**
- * `method improve FILE`. A Method with account run data starts an improvement run in the account. A Method with device
- * run data runs improve.method on this computer, so its run content stays here, and saves a local proposal.
+ * `method improve FILE`. A Method that keeps run content in the account is fixed from the person's judgments
+ * (method judge), so this prints that and starts nothing. A Method with device run data (run_data: device, or an
+ * organization that keeps run content on devices) runs improve.method on this computer, so its run content stays here,
+ * and saves a local proposal.
  */
 export async function improveCommand(args, clientFactory, run) {
     const { values, positionals } = parseArgs({ args, allowPositionals: true, options: { case: { type: 'string' }, note: { type: 'string' }, step: { type: 'string' }, server: { type: 'string' } } });
@@ -66,24 +69,15 @@ export async function improveCommand(args, clientFactory, run) {
     if (values.note !== undefined && !values.note.trim())
         throw Error('Write the correction after --note.');
     const request = { ...(values.step ? { step_id: values.step } : {}), ...(values.note ? { note: values.note.trim() } : {}), ...(values.case ? { case_id: values.case } : {}) };
-    // A note is about the newest run of the Method on this computer.
-    const newest = request.note ? (await localRuns(file))[0] : undefined;
     const client = clientFactory(values.server ?? DEFAULT_SERVER);
     if (!client.token())
         await client.login();
-    if (document.run_data !== 'device') {
-        const id = document.id;
-        if (typeof id !== 'string' || !methodIdPattern.test(id))
-            throw Error(`${positionals[0]} has no id: line, so your account has no version of it. Run method run ${positionals[0]} once while signed in, then run method improve again.`);
-        try {
-            const { improvement } = await client.request(`/api/methods/${encodeURIComponent(id)}/improvements`, 'POST', { ...request, ...(newest?.account_run_id ? { run_id: newest.account_run_id } : {}) });
-            return print({ improvement, url: `${client.server}/methods/${id}`, next: `Method's improvement agent is working; it takes a few minutes. Run method proposals ${positionals[0]} --wait (give the command 10 minutes): it returns with the proposal. Then show it to the user.` });
-        }
-        catch (error) {
-            if (error.code !== 'device_data')
-                throw error;
-        }
+    if (document.run_data !== 'device' && !await (await import('./method-sync.js')).organizationKeepsContent(client)) {
+        process.stdout.write(judgmentsLine + '\n');
+        return;
     }
+    // A note is about the newest run of the Method on this computer.
+    const newest = request.note ? (await localRuns(file))[0] : undefined;
     return print(await improveOnDevice(client, file, { ...request, ...(newest ? { run_id: newest.dir } : {}) }, run));
 }
 /** Download the published improve.method and its files into the Method cache, once per version. */

package/dist/packages/sdk/src/judge.d.ts

@@ -0,0 +1,20 @@
+import { type MethodClient } from './method-client.js';
+export declare const maxNoteLength = 4000;
+export declare const maxCorrectedBytes: number;
+export type Judgment = {
+    id: string;
+    run_id: string;
+    method_id: string;
+    verdict: 'right' | 'wrong';
+    step_id: string | null;
+    created_at: string;
+};
+/** The corrected result in a file: its JSON value when it parses as JSON, or else its text. */
+export declare function correctedValue(path: string): unknown;
+/** The one line that says what was recorded. */
+export declare function judgmentLine(judgment: Pick<Judgment, 'verdict' | 'step_id'>, fixing: boolean): string;
+/**
+ * `method judge RUN_ID right|wrong [--step ID] [--note TEXT] [--corrected FILE] [--json]`: record the person's reaction
+ * to a run's result. RUN_ID is the dashboard run ID or this computer's run ID; the server resolves both.
+ */
+export declare function judgeCommand(args: string[], clientFactory: (server: string) => MethodClient): Promise<void>;

package/dist/packages/sdk/src/judge.js

@@ -0,0 +1,59 @@
+import { readFileSync, statSync } from 'node:fs';
+import { parseArgs } from 'node:util';
+import { DEFAULT_SERVER } from './method-client.js';
+export const maxNoteLength = 4000;
+export const maxCorrectedBytes = 1024 * 1024;
+/** The corrected result in a file: its JSON value when it parses as JSON, or else its text. */
+export function correctedValue(path) {
+    let size;
+    try {
+        size = statSync(path).size;
+    }
+    catch {
+        throw Error(`Cannot read ${path}.`);
+    }
+    if (size > maxCorrectedBytes)
+        throw Error(`${path} is larger than 1 MB. Give a shorter corrected result.`);
+    const text = readFileSync(path, 'utf8');
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+/** The one line that says what was recorded. */
+export function judgmentLine(judgment, fixing) {
+    return `Recorded: ${judgment.verdict}${judgment.step_id ? ` on step ${judgment.step_id}` : ''}.${fixing ? ' Method is fixing it in the background.' : ''}`;
+}
+/**
+ * `method judge RUN_ID right|wrong [--step ID] [--note TEXT] [--corrected FILE] [--json]`: record the person's reaction
+ * to a run's result. RUN_ID is the dashboard run ID or this computer's run ID; the server resolves both.
+ */
+export async function judgeCommand(args, clientFactory) {
+    const usage = 'Use method judge RUN_ID right|wrong [--step STEP_ID] [--note TEXT] [--corrected FILE].';
+    const { values, positionals } = parseArgs({ args, allowPositionals: true, options: {
+            step: { type: 'string' }, note: { type: 'string' }, corrected: { type: 'string' }, json: { type: 'boolean' }, server: { type: 'string' }
+        } });
+    const [runId, verdict] = positionals;
+    if (!runId || !verdict || positionals.length !== 2)
+        throw Error(usage);
+    if (verdict !== 'right' && verdict !== 'wrong')
+        throw Error(`Judge the result right or wrong, not ${verdict}. ${usage}`);
+    const note = values.note?.trim();
+    if (values.note !== undefined && !note)
+        throw Error('Write the person\'s words after --note.');
+    if (note && note.length > maxNoteLength)
+        throw Error(`The note has ${note.length} characters; the most is ${maxNoteLength}.`);
+    if (values.step !== undefined && !values.step.trim())
+        throw Error('Write the step ID after --step.');
+    const body = { verdict, ...(values.step ? { step_id: values.step.trim() } : {}), ...(note ? { note } : {}),
+        ...(values.corrected !== undefined ? { corrected: correctedValue(values.corrected) } : {}) };
+    const client = clientFactory(values.server ?? DEFAULT_SERVER);
+    const response = await client.request(`/api/cli/runs/${encodeURIComponent(runId)}/judgments`, 'POST', body);
+    if (values.json) {
+        process.stdout.write(JSON.stringify(response, null, 2) + '\n');
+        return;
+    }
+    process.stdout.write(judgmentLine(response.judgment, !!response.fixing) + '\n');
+}

package/dist/packages/sdk/src/method-help.d.ts

@@ -12,7 +12,7 @@ export declare const commandHelp: Record<string, Command>;
 export declare function renderCommand(name: string, includeCommon?: boolean): string;
 export declare const guideTopics: readonly ["start", "concepts", "execution", "examples", "example", "recipes", "recovery", "commands"];
 export declare function authoringGuide(topic?: string, exampleId?: string): string;
-export declare const overviewHelp = "Method \u2014 author, save and run methods with your coding agent.\n\nBefore creating, editing, or proposing a Method, run `method authoring` and read its guidance. Do this before choosing an existing Method as a reference.\n\nLearn: method authoring                 Start the installed guide.\n       method authoring all             Read the full manual offline.\n       method COMMAND --help            Read arguments, results and examples.\n       method help step add             Read help for a subcommand.\n       method schema [TYPE]             Read a formal JSON schema.\n\nLocal drafts: init, show, set, remove, step add/update/remove/move,\n              check set/remove, validate, diff.\nOnline documents: list, get, steps, step, publish, explain.\nImprovements: improve, proposals, apply.\nKeys for scripts: secret find, secret import, secret set, secret list.\nExecution and evidence: run, run-status, wait, cancel, runs, logs, sync, observe.\nEffects and corrections: effect add/list, case new/retire/list, test.\nInputs and shared state: bind, state.\nBrowser and computer setup: browser connect, config.\nAccount access: status, login, logout, devices, revoke.\nProduction runs: connect, answer, keys create/list/revoke, worker.\n\nSign in with method login first. Read the authoring guide, give each prompt its own step, write the files, validate, and run. Each signed-in run saves a version when the file changed. Publish a version when the user wants to share or schedule it.\nUse method run task.method to run it.\nOnline server: https://app.withmethod.ai. Use --server only to select another\nserver. Sign-in uses browser approval. Never send credentials in chat.\n";
+export declare const overviewHelp = "Method \u2014 author, save and run methods with your coding agent.\n\nBefore creating, editing, or proposing a Method, run `method authoring` and read its guidance. Do this before choosing an existing Method as a reference.\n\nLearn: method authoring                 Start the installed guide.\n       method authoring all             Read the full manual offline.\n       method COMMAND --help            Read arguments, results and examples.\n       method help step add             Read help for a subcommand.\n       method schema [TYPE]             Read a formal JSON schema.\n\nLocal drafts: init, show, set, remove, step add/update/remove/move,\n              check set/remove, validate, diff.\nOnline documents: list, get, steps, step, publish, explain.\nResults and improvements: judge, changes, improve, apply.\nKeys for scripts: secret find, secret import, secret set, secret list.\nExecution and evidence: run, run-status, wait, cancel, runs, logs, sync, observe.\nEffects and corrections: effect add/list, case new/retire/list, test.\nInputs and shared state: bind, state.\nBrowser and computer setup: browser connect, config.\nAccount access: status, login, logout, devices, revoke.\nProduction runs: connect, answer, keys create/list/revoke, worker.\n\nSign in with method login first. Read the authoring guide, give each prompt its own step, write the files, validate, and run. Each signed-in run saves a version when the file changed. Publish a version when the user wants to share or schedule it.\nUse method run task.method to run it.\nOnline server: https://app.withmethod.ai. Use --server only to select another\nserver. Sign-in uses browser approval. Never send credentials in chat.\n";
 /** Resolve help before parsing flags, creating a client, or touching any draft. */
 export declare function methodHelp(args: string[]): string | undefined;
 /** The CLI and published reference use this same command inventory. */

package/dist/packages/sdk/src/method-help.js

@@ -36,9 +36,10 @@ export const commandHelp = {
     get: { usage: "method get WORKFLOW_ID [--version VERSION_ID] [--out FILE] [--server URL]", purpose: "Read an online method; optionally make a local draft for editing.", arguments: "Default: latest version. --out must name a new file. Use a version ID to read an exact saved version.", result: "Without --out: {workflow_id,version_id,version_number,workflow}. With --out: {workflow_id,version_id,version_number,file}; writes the workflow with its id: line and the saved files.", errors: "Missing method or version; output file already exists.", example: "method get wf_example --out edit.method", remote: true },
     explain: { usage: "method explain FILE [--step ID] [--no-round-trip] [--server URL]", purpose: "Explain each script step of the saved version in a script card.", arguments: "FILE is a local Method whose current content is a saved version (run or publish it while signed in). For each run step whose script has no card, code analysis finds the hosts, secrets, environment variables, files, and commands the script uses; a hosted model writes a one-sentence summary and 3 to 8 steps; every number, quoted name, and host in that text must appear in the code (one retry). The round trip writes a program from the steps alone and replays up to 3 recorded inputs of the step from local runs through both programs without network access. A script that calls the network is not replayed. --step explains one step. --no-round-trip skips the replay. A signed-in run starts this in the background; publish waits for it.", result: "One line per step with its summary and check results. Cards upload to the version; the dashboard shows them beside each script. A failed check is shown on the card and never blocks publish.", errors: "No saved version, local files that differ from the saved version, or no hosted-model credit. Without sign-in it prints one line and makes no card.", example: "method explain leads.method --step score", remote: true },
     publish: { usage: "method publish FILE [--reason TEXT] [--accept-failing-case ID[,ID]] [--cloud|--workers] [--env NAME] [--server URL]", purpose: "Mark a version as published, for sharing, schedules, and production runs.", arguments: "Runs the Method's cases first; a version that breaks an approved case is refused unless --accept-failing-case names it, and the version records that. Uses the version of the file's current content: it finishes that upload (no time limit while bytes move), checks the cases, then marks it published with the reason (default: Published.). --accept-failing-case needs --reason. The first save of a new file creates the Method. --cloud runs the production runs of the environment on Method Cloud; --workers runs them on your workers again. --env NAME selects the environment (default production).", result: "JSON with workflow_id, version_id, url, published_at, the cases line, and the open warnings and notes (issues). With --cloud or --workers: placement. Warnings and notes never block a publish.", errors: "An error issue (nothing is published), failing case, --accept-failing-case without --reason, or no network.", example: "method publish task.method --reason 'Shorter introduction'", remote: true },
-    improve: { usage: "method improve FILE [--case ID] [--note TEXT] [--step ID] [--server URL]", purpose: "Ask Method to propose a better version of a Method.", arguments: "--note: the correction, in your words; it is about the newest run of the Method on this computer, which the improvement reads and a suggested case records. --step: improve only this step. --case: the case the change must pass. A Method with account run data improves in your account; see the progress on the dashboard. A Method with run_data: device improves on this computer, so its run content stays here; the result is a local proposal in .method/proposals/.", result: "JSON with the improvement and the dashboard link, or the local proposal ID. Nothing is published, and the file does not change.", errors: "No id: line (run the file once while signed in), an unknown step, or an improvement that is already running.", example: "method improve task.method --step summary --note 'Name the customer in the first sentence.'", remote: true },
-    proposals: { usage: "method proposals FILE [--wait] [--server URL]", purpose: "List the proposals of a Method.", arguments: "Lists the proposals in your account and the local proposals beside the file. --wait: when an improvement is running, wait until it ends (usually a few minutes), printing each step it reaches.", result: "JSON list of proposals with id, source, status, kind, cause, and steps, and the newest improvement that has no proposal yet, with its status. An improvement that found no safe change has outcome none, and next says what to do instead. No changes.", errors: "", example: "method proposals task.method", remote: true },
-    apply: { usage: "method apply FILE [PROPOSAL_ID] [--resolved] [--server URL]", purpose: "Merge a proposal into the local file.", arguments: "Default: the newest accepted proposal, or else the newest local proposal. The merge is per step: a part that only the proposal changed takes the change; a part that you and the proposal both changed is a conflict. --resolved: you merged a conflict by hand; this marks the proposal applied. Commands that take a signed-in FILE apply an accepted proposal first and print one line.", result: "JSON with status applied and the changed steps; the file changes and the proposal is marked applied. Nothing is published. A conflict lists each part with the base, your, and the proposed value, changes nothing, and exits 1.", errors: "No proposal, a proposal that is not accepted, or a conflict.", example: "method apply task.method", remote: true },
+    judge: { usage: "method judge RUN_ID right|wrong [--step STEP_ID] [--note TEXT] [--corrected FILE] [--json] [--server URL]", purpose: "Record the person's reaction to a run's result.", arguments: "RUN_ID is the run_id of the run's start line, or the run ID on the dashboard. right: the person used or approved the result. wrong: the person corrected it, or asked to change the Method because of it. --note: the person's words (at most 4000 characters). --corrected FILE: the result that the person says is right; JSON is sent as JSON, other text as text (at most 1 MB). --step: the step whose output was wrong. A wrong judgment makes Method fix the Method in the background: it applies a tested change that the person can undo, or changes nothing. Do not ask the person to confirm a judgment.", result: "One line, for example Recorded: wrong on step choose. Method is fixing it in the background. --json prints the judgment and fixing.", errors: "An unknown run, a run of a Method that is not in your account, or no sign-in.", example: "method judge 6f1c… wrong --step summary --note 'Name the customer in the first sentence.'", remote: true },
+    changes: { usage: "method changes FILE [--json] [--server URL]", purpose: "List the changes that Method applied to a Method.", arguments: "Lists the changes that Method made from wrong judgments, newest first, and the local proposals applied on this computer. Commands that take a signed-in FILE merge a new change into the file first and print one line.", result: "One line per change: its date, its version, and its cause. --json prints {file, method_id, changes: [{id, source, cause, date, version_id, steps}]}. No changes.", errors: "No id: line and no local change.", example: "method changes task.method", remote: true },
+    improve: { usage: "method improve FILE [--case ID] [--note TEXT] [--step ID] [--server URL]", purpose: "Improve a Method that keeps its run content on this computer.", arguments: "For a Method with run_data: device, or in an organization that keeps run content on devices: runs Method's improvement on this computer, so the run content stays here. --note: the correction, in the person's words; it is about the newest run of the Method on this computer, which the improvement reads and a suggested case records. --step: improve only this step. --case: the case the change must pass. For a Method that keeps run content in the account, it starts nothing and says to use method judge: Method fixes those Methods from the person's judgments.", result: "JSON with the local proposal ID and the next step; the proposal is in .method/proposals/. Nothing is published, and the file does not change. For an account Method, one line.", errors: "An unknown step, or a step of the improvement that fails.", example: "method improve task.method --step summary --note 'Name the customer in the first sentence.'", remote: true },
+    apply: { usage: "method apply FILE [PROPOSAL_ID] [--resolved] [--server URL]", purpose: "Merge a local proposal from method improve into the file.", arguments: "Default: the newest open local proposal. The merge is per step: a part that only the proposal changed takes the change; a part that you and the proposal both changed is a conflict. --resolved: you merged a conflict by hand; this marks the proposal applied. When a change that Method applied conflicts with your edits, the line before the command names it; give its ID to see both versions.", result: "JSON with status applied and the changed steps; the file changes and the proposal is marked applied. Nothing is published. A conflict lists each part with the base, your, and the proposed value, changes nothing, and exits 1.", errors: "No open proposal, or a conflict.", example: "method apply task.method", remote: true },
     secret: { usage: "method secret find [FILE]\nmethod secret import FILE NAME...\nmethod secret set NAME\nmethod secret list [NAME...]", purpose: "Give this computer the values of a Method's declared secrets.", arguments: "find lists the KEY=VALUE files in this folder (3 levels down) and in the parent folder (2 levels down) with the key names in each, never values; for the Method FILE (or the only Method here) it says which declared secrets each file holds and prints the import command. import copies the named values from a KEY=VALUE file that the user names, without printing them. set opens a private form on 127.0.0.1 in the browser for one value. list shows names and where each value is found (shell, this computer, or missing), never values. Values are kept in ~/.config/method/secrets.json (mode 0600) and are never sent to Method. A value exported in the shell is used first. Every script of the Method receives all of its declared secrets.", result: "JSON with the saved names, or the list.", errors: "A name is missing from the file, or no value was entered.", example: "method secret find\nmethod secret import ../service/.env ARCHIVE_TOKEN" },
     connect: { usage: "method connect [APP_FOLDER] [--file METHOD_FILE]", purpose: "Connect an app to the Method in this folder, so the app runs it in production.", arguments: "Run it in the Method's folder. APP_FOLDER (default: this folder) is the app's folder. It makes a service key named after the app folder and writes METHOD_API_KEY to the app's .env (a new file, or a new or replaced line); it never prints the key. It adds .env to .gitignore in a git repository. When the Method has no published version, it publishes the current file. It detects Node (package.json) or Python (pyproject.toml, requirements.txt), and prints the install line and the code to add. Run it again: an app with a working key keeps it.", result: "JSON with the method_id, the published version, where the key is, install, code, secrets_to_set_on_the_host, and next.", errors: "No or several .method files (give --file), an app folder with no language marker, or a failing case at publish.", example: "method connect ../app", remote: true },
     answer: { usage: "method answer RUN_ID [--answer JSON]", purpose: "Show or answer the question of a production run that waits on an ask step.", arguments: "Without --answer it prints the question and its form (the fields of the answer). With --answer it checks the answer against the form and sends it; the run continues. A run that keeps its content on devices has a sealed question: run this where the app's METHOD_API_KEY is (the environment, or the .env of this folder), or on the laptop that started the run with its sign-in. Local runs (method run FILE) take answers with --human FILE as before.", result: "The question and form, or the run after the answer.", errors: "The run is not waiting, the answer does not match the form, or the key cannot open a sealed question (wrong_key).", example: "method answer 6f1c… --answer '{\"approved\":true}'", remote: true },
@@ -299,7 +300,7 @@ const recipes = `# Recipes
 ## Corrections become cases
 
 When the user says a result was wrong:
-1. Read the run (result.json, events.jsonl) and fix the Method. Run it again and show the user the new result.
+1. Record it: method judge RUN_ID wrong --note "the user's words" (--corrected FILE when they gave the right result). Do not ask them to confirm it. Then read the run (result.json, events.jsonl) and fix the Method. Run it again and show the user the new result.
 2. If the user wants the fix to stay, ask once: "Keep this as a rule: <the rule in plain words>?"
 3. On yes, record it: method case new FILE --id ID --run BAD_RUN --passing-run NEW_RUN --note "the user's words" --rubric "plain sentence that must be true" (repeat --rubric for each rule). --ref names the output to judge (default: the Method's result; a path to a file that the run saved is judged by that file's contents). When a rule compares the output with the sources, add --context with the step output that holds them, for example --context outputs.material. Make each sentence fail on the bad run; case new warns about one that does not. For an exact value, use --expect instead.
 4. Run method test FILE. Every case must pass. method publish refuses a version that breaks a case.
@@ -370,7 +371,7 @@ Learn: method authoring                 Start the installed guide.
 Local drafts: init, show, set, remove, step add/update/remove/move,
               check set/remove, validate, diff.
 Online documents: list, get, steps, step, publish, explain.
-Improvements: improve, proposals, apply.
+Results and improvements: judge, changes, improve, apply.
 Keys for scripts: secret find, secret import, secret set, secret list.
 Execution and evidence: run, run-status, wait, cancel, runs, logs, sync, observe.
 Effects and corrections: effect add/list, case new/retire/list, test.

package/dist/packages/sdk/src/method.js

@@ -62,7 +62,9 @@ export async function methodMain(args = process.argv.slice(2), clientFactory = s
         process.stdout.write(earlyHelp);
         return;
     }
-    if (['improve', 'proposals', 'apply'].includes(args[0] ?? ''))
+    if (args[0] === 'judge')
+        return (await import('./judge.js')).judgeCommand(args.slice(1), clientFactory);
+    if (['improve', 'changes', 'apply'].includes(args[0] ?? ''))
         return (await import('./proposals.js')).proposalCommand(args, clientFactory);
     await (await import('./proposals.js')).autoApply(args, clientFactory);
     if (args[0] === 'worker' || args[0] === 'keys')

package/dist/packages/sdk/src/model-checks.d.ts

@@ -25,11 +25,21 @@ type Check = {
     /** Which part of the step the check reads; undefined when the check does not apply to the step. */
     script?: (step: Step) => string | undefined;
     applies: (step: Step) => boolean;
+    /** More inputs for Jev, from the Method (for example the definitions of an agent step's tools). */
+    context?: (step: Step, method: any) => Record<string, string>;
+    /** A finding (true) or none (false) that code analysis decides without a question to Jev; undefined asks Jev. */
+    decide?: (inputs: Record<string, string>) => boolean | undefined;
     field: string;
     message: (id: string) => string;
     fix: string;
 };
 export declare const checks: Record<string, Check>;
+/**
+ * The script scan of a run step (explain-effects): a network host or a write is a finding with no model call. No host,
+ * no write, and no library that can send: no finding. A library that can send or a subprocess with no host found:
+ * undefined, so Jev answers.
+ */
+export declare function scanDecision(stepYaml: string, script: string): boolean | undefined;
 /**
  * Checks shown to the user. A check moves here from shadow mode only with a results.json that shows its precision
  * on the frozen held-out set meets its level (warning >= 0.90, note >= 0.75). Run npm run eval:checks first.
@@ -78,7 +88,14 @@ export declare function askCheck(provider: ClassificationProvider, question: str
     probability: number;
     model: string;
 }>;
-export declare function evaluateTarget(provider: ClassificationProvider, target: Target, signal: AbortSignal): Promise<Result>;
+/** The answer of code analysis, when the check has one for these inputs. */
+export declare function decided(check: string, inputs: Record<string, string>): {
+    answer: boolean;
+    probability: number;
+    model: string;
+} | undefined;
+/** Answer one target: code analysis when it decides, or else Jev. scanned: code analysis already found it cannot decide. */
+export declare function evaluateTarget(provider: ClassificationProvider | undefined, target: Target, signal: AbortSignal, scanned?: boolean): Promise<Result>;
 /**
  * Run the targets in parallel. Cached answers come at once; new ones get waitMs in all. The others are returned as
  * pending, so the caller can finish them in the background. A failed check is left out and is tried again next time.

package/dist/packages/sdk/src/model-checks.js

@@ -8,7 +8,11 @@ import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, writeFile
 import { join } from 'node:path';
 import { serializeWorkflow } from '../../workflow-language/src/validate.js';
 import { methodCache } from './prepare.js';
+import { scriptLanguage, staticEffects } from './explain-effects.js';
 const promptKinds = ['call', 'agent'];
+/** A step that declares a change outside the run: a connection or service in changes, or an effect. */
+const declaresWorldChange = (step) => (step.changes ?? []).some((ref) => typeof ref === 'string' && ref.startsWith('environment.')) || Object.keys(step.effects ?? {}).length > 0;
+const agentWithTools = (step) => step.do?.kind === 'agent' && ((step.do.tools ?? []).length > 0 || !!step.do.browser);
 export const checks = {
     script_calls_model: {
         version: 1, level: 'warning', field: 'do',
@@ -52,7 +56,48 @@ export const checks = {
         message: id => `The prompt of ${id} appears to need information that the step does not give it.`,
         fix: 'Add the missing value to in: from an input or an earlier step, or write it in the prompt.',
     },
+    undeclared_change: {
+        version: 1, level: 'warning', field: 'do',
+        question: 'Can this step send, post, or change something outside its own output folder, for example send an email or a message, create or update a record in a service or an API, submit a form, or write files elsewhere, while its changes: and effects: declare no such change? Reading, searching, downloading, and returning a result are not changes.',
+        applies: step => !declaresWorldChange(step) && (step.do?.kind === 'run' || agentWithTools(step)),
+        script: step => step.do?.kind === 'run' ? step.do.entrypoint : undefined,
+        context: (step, method) => step.do?.kind === 'agent' && (step.do.tools ?? []).length
+            ? { tools: limit(serializeWorkflow(Object.fromEntries(step.do.tools.map(name => [name, method.tools?.[name] ?? null]))), 16_000) } : {},
+        decide: inputs => inputs.script === undefined ? undefined : scanDecision(inputs.step ?? "", inputs.script),
+        message: id => `${id} can send or change things that it does not declare.`,
+        fix: 'Declare what it changes in changes:, so Method can check where its data goes.',
+    },
 };
+/** Libraries and calls that can send or change something, but whose target code analysis may not find. */
+const senders = {
+    python: /^\s*(?:import|from)\s+(?:requests|httpx|aiohttp|urllib3?|http\.client|smtplib|email\.mime|boto3|slack_sdk|twilio|sendgrid|googleapiclient|subprocess)\b|\bos\.(?:system|popen)\(/m,
+    node: /\bfetch\(|\brequire\(\s*['"](?:node:)?(?:https?|child_process|axios|node-fetch|got|undici|nodemailer|@sendgrid\/mail|@slack\/web-api|twilio)['"]|\bfrom\s+['"](?:node:)?(?:https?|child_process|axios|node-fetch|got|undici|nodemailer|@sendgrid\/mail|@slack\/web-api|twilio)['"]/,
+};
+/** Temporary files are not a change in the world. */
+const temporaryPath = (path) => /^(?:\/tmp\/|\/var\/folders\/|\/private\/tmp\/)/.test(path);
+/**
+ * The script scan of a run step (explain-effects): a network host or a write is a finding with no model call. No host,
+ * no write, and no library that can send: no finding. A library that can send or a subprocess with no host found:
+ * undefined, so Jev answers.
+ */
+export function scanDecision(stepYaml, script) {
+    const entrypoint = /^\s*entrypoint:\s*["']?([^\s"']+)/m.exec(stepYaml)?.[1];
+    const language = entrypoint ? scriptLanguage(entrypoint) : undefined;
+    if (!language || !script.trim())
+        return undefined;
+    let effects;
+    try {
+        effects = staticEffects(language, [{ path: entrypoint, text: script }], undefined).effects;
+    }
+    catch {
+        return undefined;
+    }
+    if (effects.network.length || effects.writes.some(path => !temporaryPath(path)))
+        return true;
+    if (effects.runs.length || senders[language].test(script))
+        return undefined;
+    return false;
+}
 /**
  * Checks shown to the user. A check moves here from shadow mode only with a results.json that shows its precision
  * on the frozen held-out set meets its level (warning >= 0.90, note >= 0.75). Run npm run eval:checks first.
@@ -78,7 +123,7 @@ export function checkTargets(method, readText, steps) {
             if (!check.applies(step))
                 continue;
             const path = check.script?.(step);
-            const inputs = { step: stepText(id, step) };
+            const inputs = { step: stepText(id, step), ...check.context?.(step, method) };
             if (path)
                 inputs.script = limit(readText(path) ?? '', 40_000);
             targets.push({ check: name, version: check.version, step: id, inputs, key: checkKey(name, check.version, inputs) });
@@ -86,7 +131,7 @@ export function checkTargets(method, readText, steps) {
     }
     return targets;
 }
-export const checkKey = (check, version, inputs) => createHash('sha256').update(JSON.stringify([check, version, inputs.step, inputs.script ?? ''])).digest('hex');
+export const checkKey = (check, version, inputs) => createHash('sha256').update(JSON.stringify([check, version, inputs.step, inputs.script ?? '', ...(inputs.tools !== undefined ? [inputs.tools] : [])])).digest('hex');
 export const checksDir = () => join(methodCache(), 'checks');
 export function cached(key) {
     const file = join(checksDir(), `${key}.json`);
@@ -108,14 +153,24 @@ function store(result) {
  * probability is that of yes.
  */
 export const answerOptions = { yes: 'Yes: the question describes this step.', no: 'No: the question does not describe this step.' };
+const noProvider = () => { throw Error('Model checks need sign-in.'); };
 export async function askCheck(provider, question, inputs, signal) {
     const { model } = await provider.resolve(signal);
     const answer = await provider.evaluate({ request_id: randomUUID(), model, question, options: answerOptions, inputs }, signal);
     const probability = answer.probabilities.yes ?? 0;
     return { answer: probability >= findingThreshold, probability, model };
 }
-export async function evaluateTarget(provider, target, signal) {
-    const answer = await askCheck(provider, checks[target.check].question, target.inputs, signal);
+/** The answer of code analysis, when the check has one for these inputs. */
+export function decided(check, inputs) {
+    const answer = checks[check]?.decide?.(inputs);
+    return answer === undefined ? undefined : { answer, probability: answer ? 1 : 0, model: 'script-scan' };
+}
+/** Answer one target: code analysis when it decides, or else Jev. scanned: code analysis already found it cannot decide. */
+export async function evaluateTarget(provider, target, signal, scanned = false) {
+    const answer = (scanned ? undefined : decided(target.check, target.inputs)) ?? await askCheck(provider ?? noProvider(), checks[target.check].question, target.inputs, signal);
+    return record(target, answer);
+}
+function record(target, answer) {
     const result = { check: target.check, version: target.version, step: target.step, key: target.key, answer: answer.probability >= findingThreshold,
         probability: answer.probability, model: answer.model, at: new Date().toISOString() };
     store(result);
@@ -127,15 +182,20 @@ export async function evaluateTarget(provider, target, signal) {
  */
 export async function runChecks(provider, targets, waitMs = 3000) {
     const done = [], pending = [];
-    const open = targets.filter(target => { const hit = cached(target.key); if (hit)
-        done.push(hit); return !hit; });
+    // Answers that code analysis decides need no provider and no wait.
+    const open = targets.filter(target => {
+        const hit = cached(target.key) ?? (() => { const answer = decided(target.check, target.inputs); return answer && record(target, answer); })();
+        if (hit)
+            done.push(hit);
+        return !hit;
+    });
     if (!open.length)
         return { done, pending };
     if (!provider)
         return { done, pending: open };
     const controller = new AbortController();
     const settled = new Set();
-    const work = open.map(target => evaluateTarget(provider, target, controller.signal)
+    const work = open.map(target => evaluateTarget(provider, target, controller.signal, true)
         .then(result => { done.push(result); }).catch(() => { }).finally(() => settled.add(target.key)));
     let timer;
     await Promise.race([Promise.all(work), new Promise(resolve => { timer = setTimeout(resolve, waitMs); })]);

package/dist/packages/sdk/src/proposals.d.ts

@@ -58,9 +58,9 @@ type Applied = {
 /** Merge a proposal into the file. A clean merge writes the file and marks the proposal applied. Never publishes. */
 export declare function applyProposal(client: MethodClient | undefined, file: string, proposal: ProposalRecord, options?: RequestOptions): Promise<Applied>;
 /**
- * Before a command that takes a .method FILE: when this computer is signed in and the Method has an accepted proposal,
- * merge it into the file and print one line. A conflict prints what the coding agent must resolve; the command goes on.
- * Offline, signed out, or on any error, it does nothing.
+ * Before a command that takes a .method FILE: when this computer is signed in and Method applied a change to the Method
+ * (an accepted proposal, from the person's judgments), merge it into the file and print one line. A conflict prints
+ * what the coding agent must resolve; the command goes on. Offline, signed out, or on any error, it does nothing.
  */
 export declare function autoApply(args: string[], clientFactory: (server: string) => MethodClient): Promise<void>;
 /** Run folders of this Method on this computer, newest first, with the account run ID of each run that was saved to the account. */
@@ -68,6 +68,6 @@ export declare function localRuns(file: string): Promise<{
     dir: string;
     account_run_id: string | null;
 }[]>;
-/** `method improve`, `method proposals`, and `method apply`. */
+/** `method improve`, `method changes`, and `method apply`. */
 export declare function proposalCommand(args: string[], clientFactory: (server: string) => MethodClient): Promise<boolean | undefined>;
 export {};

package/dist/packages/sdk/src/proposals.js

@@ -133,11 +133,11 @@ async function markApplied(client, file, proposal, options = {}) {
     }
 }
 const serverFlag = (args) => { const at = args.findIndex(arg => arg === '--server' || arg.startsWith('--server=')); return at < 0 ? undefined : args[at].startsWith('--server=') ? args[at].slice(9) : args[at + 1]; };
-const skipAutoApply = new Set(['apply', 'proposals', 'improve', 'init', 'new-id', 'diff', 'help', 'authoring', 'schema', '__worker', '__checks', 'worker', 'keys', 'secret', 'models', 'login', 'logout', 'sync', 'progress']);
+const skipAutoApply = new Set(['apply', 'changes', 'judge', 'improve', 'init', 'new-id', 'diff', 'help', 'authoring', 'schema', '__worker', '__checks', 'worker', 'keys', 'secret', 'models', 'login', 'logout', 'sync', 'progress']);
 /**
- * Before a command that takes a .method FILE: when this computer is signed in and the Method has an accepted proposal,
- * merge it into the file and print one line. A conflict prints what the coding agent must resolve; the command goes on.
- * Offline, signed out, or on any error, it does nothing.
+ * Before a command that takes a .method FILE: when this computer is signed in and Method applied a change to the Method
+ * (an accepted proposal, from the person's judgments), merge it into the file and print one line. A conflict prints
+ * what the coding agent must resolve; the command goes on. Offline, signed out, or on any error, it does nothing.
  */
 export async function autoApply(args, clientFactory) {
     if (!args[0] || skipAutoApply.has(args[0]) || args.includes('--help') || process.env.METHOD_RUN_WORKER === '1')
@@ -159,12 +159,12 @@ export async function autoApply(args, clientFactory) {
         const result = await applyProposal(client, file, proposal, options);
         if (result.status === 'applied') {
             if (result.steps.length || result.warning)
-                process.stderr.write(`Applied accepted proposal ${proposal.id} to ${target}: ${proposal.cause}${result.steps.length ? ` Changed steps: ${result.steps.join(', ')}.` : ''} Not published.${result.warning ? ` ${result.warning}` : ''}\n`);
+                process.stderr.write(`Method changed ${target} (${proposal.id}): ${proposal.cause}${result.steps.length ? ` Changed steps: ${result.steps.join(', ')}.` : ''}${result.warning ? ` ${result.warning}` : ''}\n`);
         }
         else
             process.stderr.write(result.status === 'conflict'
-                ? `Accepted proposal ${proposal.id} conflicts with your edits of ${target} in ${result.conflicts.map(c => c.path).join(', ')}. The file is not changed. Run method apply ${target} ${proposal.id} to see both versions, merge them in the file, then run method apply ${target} ${proposal.id} --resolved.\n`
-                : `Accepted proposal ${proposal.id} does not merge into a valid Method: ${result.error} The file is not changed. Run method apply ${target} ${proposal.id} to see it.\n`);
+                ? `Method's change ${proposal.id} conflicts with your edits of ${target} in ${result.conflicts.map(c => c.path).join(', ')}. The file is not changed. Run method apply ${target} ${proposal.id} to see both versions, merge them in the file, then run method apply ${target} ${proposal.id} --resolved.\n`
+                : `Method's change ${proposal.id} does not merge into a valid Method: ${result.error} The file is not changed. Run method apply ${target} ${proposal.id} to see it.\n`);
     }
     catch { /* offline or signed out: the command goes on without the proposal. */ }
 }
@@ -196,55 +196,36 @@ function manualStep(file, proposal, runFolder) {
     return 'This proposal has no change to apply.';
 }
 const print = (value) => process.stdout.write(JSON.stringify(value, null, 2) + '\n');
-function summary(p) {
-    return { id: p.id, source: p.source, status: p.status, kind: p.evidence?.kind ?? null, cause: p.cause, steps: p.evidence?.steps ?? [], base_version_id: p.base_version_id, created_at: p.created_at };
+const changeLine = (change) => `${change.date.slice(0, 10)}  ${change.version_id ?? 'not saved as a version'}  ${change.cause}`;
+/** `method changes FILE`: the changes that Method applied to the Method, newest first, and those applied on this computer. */
+async function changesCommand(file, target, methodId, client, json) {
+    const local = localProposals(file).filter(p => p.status === 'applied').map((p) => ({ id: p.id, source: 'local', cause: p.cause, date: String(p.applied_at ?? p.created_at), version_id: p.applied_version_id ?? null, steps: p.evidence?.steps ?? [] }));
+    let account = [];
+    if (methodId) {
+        const { proposals } = await client.request(`/api/methods/${encodeURIComponent(methodId)}/proposals?status=accepted`);
+        account = (proposals ?? []).map(p => ({ id: p.id, source: 'account', cause: String(p.cause ?? ''), date: String(p.created_at ?? ''), version_id: p.published_version_id ?? null, steps: p.evidence?.steps ?? [] }));
+    }
+    else if (!local.length)
+        throw Error(`${target} has no id: line, so Method has not changed it. Run it once while signed in.`);
+    const changes = [...account, ...local].sort((a, b) => b.date.localeCompare(a.date));
+    if (json)
+        return print({ file, method_id: methodId, changes });
+    process.stdout.write(changes.length ? changes.map(changeLine).join('\n') + '\n' : `Method has not changed ${target} yet.\n`);
 }
-/** `method improve`, `method proposals`, and `method apply`. */
+/** `method improve`, `method changes`, and `method apply`. */
 export async function proposalCommand(args, clientFactory) {
     if (args[0] === 'improve')
         return (await import('./improve.js')).improveCommand(args.slice(1), clientFactory);
-    const { values, positionals } = parseArgs({ args: args.slice(1), allowPositionals: true, options: { server: { type: 'string' }, resolved: { type: 'boolean' }, wait: { type: 'boolean' } } });
+    const { values, positionals } = parseArgs({ args: args.slice(1), allowPositionals: true, options: { server: { type: 'string' }, resolved: { type: 'boolean' }, json: { type: 'boolean' } } });
     const [target, wanted] = positionals;
     if (!target || positionals.length > (args[0] === 'apply' ? 2 : 1))
-        throw Error(args[0] === 'apply' ? 'Use method apply FILE [PROPOSAL_ID] [--resolved].' : 'Use method proposals FILE.');
+        throw Error(args[0] === 'apply' ? 'Use method apply FILE [PROPOSAL_ID] [--resolved].' : 'Use method changes FILE [--json].');
     const file = authoringPath(target), id = readDocument(file).id;
     const methodId = typeof id === 'string' && methodIdPattern.test(id) ? id : null;
     const client = clientFactory(values.server ?? DEFAULT_SERVER);
     const signedIn = !!client.token();
-    if (args[0] === 'proposals') {
-        const local = localProposals(file).map(summary);
-        if (!methodId || !signedIn)
-            return print({ file, method_id: methodId, proposals: local, ...(methodId ? { next: 'Run method login to see the proposals in your account too.' } : {}) });
-        const read = async () => {
-            const [{ proposals }, { improvements }] = await Promise.all([
-                client.request(`/api/methods/${encodeURIComponent(methodId)}/proposals`),
-                client.request(`/api/methods/${encodeURIComponent(methodId)}/improvements`)
-            ]);
-            // The newest improvement that has no proposal: still running, failed, or ended with no safe change (outcome none).
-            const latest = (improvements ?? []).find(i => !i.proposal_id);
-            return { proposals, pending: latest && (latest.created_at ?? '') > String((proposals ?? [])[0]?.created_at ?? '') ? latest : undefined };
-        };
-        let { proposals, pending } = await read();
-        // --wait: one line each time the improvement reaches a new step, until it ends.
-        let shown = '';
-        while (values.wait && pending && ['queued', 'running'].includes(pending.status)) {
-            const step = pending.steps?.find((s) => s.status === 'running')?.step_id ?? pending.status;
-            if (step !== shown) {
-                process.stderr.write(`Improvement ${pending.id}: ${step}\n`);
-                shown = step;
-            }
-            await new Promise(resolve => setTimeout(resolve, 5000));
-            ({ proposals, pending } = await read());
-        }
-        const failedStep = pending?.steps?.find((s) => s.status === 'failed')?.step_id;
-        const next = !pending ? undefined
-            : ['queued', 'running'].includes(pending.status) ? `Improvement ${pending.id} is ${pending.status}. Run method proposals ${target} --wait: it returns when the proposal is ready.`
-                : pending.outcome === 'none' ? `The improvement found no safe change. Say what is wrong in a note on a run (method improve ${target} --note TEXT), or record a case with method case new.`
-                    : pending.status === 'failed' || pending.status === 'cancelled' ? `Improvement ${pending.id} ${pending.status}${failedStep ? ` at step ${failedStep}` : ''}${pending.error?.message ? `: ${pending.error.message}` : ''}. Run method improve ${target} again, or record the correction with method case new.`
-                        : undefined;
-        return print({ file, method_id: methodId, proposals: [...(proposals ?? []).map(p => summary({ ...p, source: 'account' })), ...local].sort((a, b) => String(b.created_at).localeCompare(String(a.created_at))),
-            ...(pending ? { improvement: { id: pending.id, status: pending.status, ...(pending.outcome === 'none' ? { outcome: 'none' } : {}), ...(failedStep ? { failed_step: failedStep } : {}), ...(pending.error ? { error: pending.error } : {}) } } : {}), ...(next ? { next } : {}) });
-    }
+    if (args[0] === 'changes')
+        return changesCommand(file, target, methodId, client, !!values.json);
     const local = localProposals(file);
     let proposal = wanted ? local.find(p => p.id === wanted) : undefined;
     if (!proposal && wanted) {
@@ -254,15 +235,13 @@ export async function proposalCommand(args, clientFactory) {
         if (methodId && proposal.method_id !== methodId)
             throw Error(`Proposal ${wanted} is for another Method.`);
     }
-    if (!proposal && methodId && signedIn)
-        proposal = await newestAccepted(client, methodId);
     proposal ??= local.find(p => p.status === 'open');
     if (!proposal)
-        throw Error(`${target} has no accepted proposal. Run method proposals ${target}.`);
+        throw Error(`${target} has no open proposal. Run method improve ${target} --note TEXT first.`);
     if (proposal.status === 'applied')
         return print({ status: 'applied', file, proposal_id: proposal.id, next: 'This proposal is already applied.' });
     if (proposal.source === 'account' && proposal.status !== 'accepted')
-        throw Error(`Proposal ${proposal.id} is ${proposal.status}. Accept it on the dashboard first: ${client.server}/methods/${proposal.method_id}`);
+        throw Error(`Change ${proposal.id} is ${proposal.status}, so it has nothing to merge.`);
     if (proposal.source === 'local' && proposal.status !== 'open')
         throw Error(`Proposal ${proposal.id} is ${proposal.status}.`);
     if (values.resolved)

package/dist/packages/workflow-language/src/inspection.d.ts

@@ -84,16 +84,16 @@ export declare const ObservedEffectsSchema: z.ZodUnion<[z.ZodObject<{
 }, "strict", z.ZodTypeAny, {
     runs: string[];
     network: string[];
+    env: string[];
     reads: string[];
     writes: string[];
-    env: string[];
     truncated?: true | undefined;
 }, {
     runs: string[];
     network: string[];
+    env: string[];
     reads: string[];
     writes: string[];
-    env: string[];
     truncated?: true | undefined;
 }>, z.ZodObject<{
     unavailable: z.ZodString;
@@ -641,16 +641,16 @@ export declare const InspectionSchema: z.ZodObject<{
         }, "strict", z.ZodTypeAny, {
             runs: string[];
             network: string[];
+            env: string[];
             reads: string[];
             writes: string[];
-            env: string[];
             truncated?: true | undefined;
         }, {
             runs: string[];
             network: string[];
+            env: string[];
             reads: string[];
             writes: string[];
-            env: string[];
             truncated?: true | undefined;
         }>, z.ZodObject<{
             unavailable: z.ZodString;
@@ -661,6 +661,7 @@ export declare const InspectionSchema: z.ZodObject<{
         }>]>>;
     }, "strict", z.ZodTypeAny, {
         status: "running" | "waiting_for_you" | "failed" | "returned" | "passed" | "skipped" | "stopped";
+        changes: Record<string, Json>;
         checks: {
             method: string;
             id: string;
@@ -700,7 +701,6 @@ export declare const InspectionSchema: z.ZodObject<{
             attempts?: number | undefined;
         }[];
         step_id: string;
-        changes: Record<string, Json>;
         inputs?: Record<string, Json> | undefined;
         verification?: "checked" | "unchecked" | undefined;
         outputs?: Record<string, Json> | undefined;
@@ -713,15 +713,16 @@ export declare const InspectionSchema: z.ZodObject<{
         observed_effects?: {
             runs: string[];
             network: string[];
+            env: string[];
             reads: string[];
             writes: string[];
-            env: string[];
             truncated?: true | undefined;
         } | {
             unavailable: string;
         } | undefined;
     }, {
         status: "running" | "waiting_for_you" | "failed" | "returned" | "passed" | "skipped" | "stopped";
+        changes: Record<string, Json>;
         checks: {
             method: string;
             id: string;
@@ -761,7 +762,6 @@ export declare const InspectionSchema: z.ZodObject<{
             attempts?: number | undefined;
         }[];
         step_id: string;
-        changes: Record<string, Json>;
         inputs?: Record<string, Json> | undefined;
         verification?: "checked" | "unchecked" | undefined;
         outputs?: Record<string, Json> | undefined;
@@ -774,9 +774,9 @@ export declare const InspectionSchema: z.ZodObject<{
         observed_effects?: {
             runs: string[];
             network: string[];
+            env: string[];
             reads: string[];
             writes: string[];
-            env: string[];
             truncated?: true | undefined;
         } | {
             unavailable: string;
@@ -795,6 +795,7 @@ export declare const InspectionSchema: z.ZodObject<{
     }>;
     invocations: Record<string, {
         status: "running" | "waiting_for_you" | "failed" | "returned" | "passed" | "skipped" | "stopped";
+        changes: Record<string, Json>;
         checks: {
             method: string;
             id: string;
@@ -834,7 +835,6 @@ export declare const InspectionSchema: z.ZodObject<{
             attempts?: number | undefined;
         }[];
         step_id: string;
-        changes: Record<string, Json>;
         inputs?: Record<string, Json> | undefined;
         verification?: "checked" | "unchecked" | undefined;
         outputs?: Record<string, Json> | undefined;
@@ -847,9 +847,9 @@ export declare const InspectionSchema: z.ZodObject<{
         observed_effects?: {
             runs: string[];
             network: string[];
+            env: string[];
             reads: string[];
             writes: string[];
-            env: string[];
             truncated?: true | undefined;
         } | {
             unavailable: string;
@@ -951,6 +951,7 @@ export declare const InspectionSchema: z.ZodObject<{
     }>;
     invocations: Record<string, {
         status: "running" | "waiting_for_you" | "failed" | "returned" | "passed" | "skipped" | "stopped";
+        changes: Record<string, Json>;
         checks: {
             method: string;
             id: string;
@@ -990,7 +991,6 @@ export declare const InspectionSchema: z.ZodObject<{
             attempts?: number | undefined;
         }[];
         step_id: string;
-        changes: Record<string, Json>;
         inputs?: Record<string, Json> | undefined;
         verification?: "checked" | "unchecked" | undefined;
         outputs?: Record<string, Json> | undefined;
@@ -1003,9 +1003,9 @@ export declare const InspectionSchema: z.ZodObject<{
         observed_effects?: {
             runs: string[];
             network: string[];
+            env: string[];
             reads: string[];
             writes: string[];
-            env: string[];
             truncated?: true | undefined;
         } | {
             unavailable: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@method-ai-hq/sdk",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Build and run reusable .method files with checked steps and saved results.",
   "license": "MIT",
   "type": "module",
@@ -35,7 +35,7 @@
     "prepack": "npm --prefix ../.. run build"
   },
   "dependencies": {
-    "@withmethod/runtime": "https://codeload.github.com/method-ai-hq/method-spec/tar.gz/6020ed9208670972df60a27a602885bcad947c8c",
+    "@withmethod/runtime": "https://codeload.github.com/method-ai-hq/method-spec/tar.gz/54461cb387d8f10813db05bb0cea29c0a3a53504",
     "fflate": "^0.8.3",
     "yaml": "^2.9.0",
     "zod": "^3.25.76"