@reticlehq/init 3.5.0 → 3.6.0

package/dist/detect/detect.d.ts

@@ -194,6 +194,14 @@ export declare const ANGULAR_WORKSPACE_FILE = "angular.json";
 interface FrameworkSignals {
     /** `package.json` dependency names that name this framework outright. */
     readonly deps: readonly string[];
+    /**
+     * Dependencies that disprove this framework's dependency signal, without affecting an explicit
+     * config-file signal.
+     *
+     * Vinext carries `next` for API compatibility but builds through Vite, so treating `next` as
+     * conclusive there would install wiring that Vinext never evaluates.
+     */
+    readonly depsUnless?: readonly string[];
     /** Root config-file basenames that name it when the dependency is absent. */
     readonly configs: readonly string[];
     /**

package/dist/detect/detect.js

@@ -164,7 +164,7 @@ const VITE_INDEX_HTML = 'index.html';
  * asserted in `framework-adapter.test.ts`.
  */
 export const FRAMEWORK_SIGNALS = {
-    [Framework.NEXT]: { deps: ['next'], configs: NEXT_CONFIGS },
+    [Framework.NEXT]: { deps: ['next'], depsUnless: ['vinext'], configs: NEXT_CONFIGS },
     [Framework.NUXT]: { deps: ['nuxt'], configs: NUXT_CONFIGS },
     [Framework.SVELTEKIT]: {
         deps: ['@sveltejs/kit'],
@@ -201,7 +201,7 @@ export const FRAMEWORK_SIGNALS = {
         deps: ['@tanstack/react-start', '@tanstack/start'],
         configs: [],
     },
-    [Framework.VITE]: { deps: ['vite'], configs: VITE_CONFIGS },
+    [Framework.VITE]: { deps: ['vite', 'vinext'], configs: VITE_CONFIGS },
     /** CRA has no config file at all, so the dependency is the only signal. */
     [Framework.CRA]: { deps: ['react-scripts'], configs: [] },
     /** Nothing identifies plain HTML; it is where the chain below ends. */
@@ -325,8 +325,11 @@ function declaredDependencies(pkg) {
 function detectFramework(input) {
     for (const framework of DETECTION_ORDER) {
         const signals = FRAMEWORK_SIGNALS[framework];
-        if (signals.deps.some((d) => depVersion(input.pkg, d) !== undefined))
+        const hasDisqualifyingDependency = true === signals.depsUnless?.some((d) => depVersion(input.pkg, d) !== undefined);
+        if (signals.deps.some((d) => depVersion(input.pkg, d) !== undefined) &&
+            !hasDisqualifyingDependency) {
             return framework;
+        }
         if (hasAnyConfig(input.configFiles, signals.configs) &&
             !hasAnyConfig(input.configFiles, signals.configsUnless ?? [])) {
             return framework;

package/dist/detect/non-js-project.d.ts

@@ -34,6 +34,22 @@ export declare function detectDjangoProject(exists: (file: string) => boolean, r
 export declare function djangoSetupMessage(): string;
 /** The ecosystem this directory looks like, or undefined when nothing says. */
 export declare function detectNonJsEcosystem(exists: (file: string) => boolean): string | undefined;
+/** Which answer `init` gives when there is no package.json. */
+export declare const NoPackageJsonCase: {
+    /** No ecosystem marker and no page: the only honest answer is "run `init` somewhere else". */
+    readonly WRONG_DIRECTORY: "wrong_directory";
+    /** A page with no build step, which takes the script-tag snippet. */
+    readonly STATIC_PAGE: "static_page";
+    /** Flutter web paints into a canvas, so there is nothing to instrument. */
+    readonly FLUTTER: "flutter";
+    /** A recognised non-JS ecosystem, which can load the SDK from a URL. */
+    readonly NON_JS: "non_js";
+};
+export type NoPackageJsonCase = (typeof NoPackageJsonCase)[keyof typeof NoPackageJsonCase];
+export interface NoPackageJsonAnswer {
+    kind: NoPackageJsonCase;
+    message: string;
+}
 /**
  * What `init` should say when there is no package.json.
  *
@@ -42,3 +58,10 @@ export declare function detectNonJsEcosystem(exists: (file: string) => boolean):
  * second needs to know that no path exists and why.
  */
 export declare function noPackageJsonMessage(exists: (file: string) => boolean, rootFiles?: readonly string[]): string;
+/**
+ * {@link noPackageJsonMessage}, plus which case it picked.
+ *
+ * `init` acts on the case (it writes nothing for {@link NoPackageJsonCase.WRONG_DIRECTORY}), so the
+ * choice is made here once rather than re-derived beside the message and kept in sync by hand.
+ */
+export declare function noPackageJsonAnswer(exists: (file: string) => boolean, rootFiles?: readonly string[]): NoPackageJsonAnswer;

package/dist/detect/non-js-project.js

@@ -97,6 +97,17 @@ export function detectNonJsEcosystem(exists) {
     }
     return undefined;
 }
+/** Which answer `init` gives when there is no package.json. */
+export const NoPackageJsonCase = {
+    /** No ecosystem marker and no page: the only honest answer is "run `init` somewhere else". */
+    WRONG_DIRECTORY: 'wrong_directory',
+    /** A page with no build step, which takes the script-tag snippet. */
+    STATIC_PAGE: 'static_page',
+    /** Flutter web paints into a canvas, so there is nothing to instrument. */
+    FLUTTER: 'flutter',
+    /** A recognised non-JS ecosystem, which can load the SDK from a URL. */
+    NON_JS: 'non_js',
+};
 /**
  * What `init` should say when there is no package.json.
  *
@@ -105,38 +116,59 @@ export function detectNonJsEcosystem(exists) {
  * second needs to know that no path exists and why.
  */
 export function noPackageJsonMessage(exists, rootFiles = []) {
+    return noPackageJsonAnswer(exists, rootFiles).message;
+}
+/**
+ * {@link noPackageJsonMessage}, plus which case it picked.
+ *
+ * `init` acts on the case (it writes nothing for {@link NoPackageJsonCase.WRONG_DIRECTORY}), so the
+ * choice is made here once rather than re-derived beside the message and kept in sync by hand.
+ */
+export function noPackageJsonAnswer(exists, rootFiles = []) {
     const ecosystem = detectNonJsEcosystem(exists);
     if (ecosystem === undefined) {
         if (exists('index.html') || rootFiles.some((name) => name.endsWith('.html'))) {
-            return ('This is a static page with no build step, so there is nothing for `reticle init` to wire. ' +
-                'Add the script-tag snippet below to the page while you develop, then reload it. Remove the ' +
-                'snippet before publishing: a static file has no development build to keep it out of production.');
+            return {
+                kind: NoPackageJsonCase.STATIC_PAGE,
+                message: 'This is a static page with no build step, so there is nothing for `reticle init` to wire. ' +
+                    'Add the script-tag snippet below to the page while you develop, then reload it. Remove the ' +
+                    'snippet before publishing: a static file has no development build to keep it out of production.',
+            };
         }
-        return ('No package.json found here, and no app directory beneath it either. Run `reticle init` from ' +
-            "your app's directory, or from a repo root that contains it.");
+        return {
+            kind: NoPackageJsonCase.WRONG_DIRECTORY,
+            message: 'No package.json found here, and no app directory beneath it either. Run `reticle init` from ' +
+                "your app's directory, or from a repo root that contains it.",
+        };
     }
     if (ecosystem === FLUTTER) {
         // An agent on a Flutter workspace asked us to "support Flutter, or clearly identify it as
         // unsupported during init". The second is the truthful one, and saying it by name in one line
         // is the difference between an agent that stops and an agent that spends an hour looking for
         // the package.json we told it was missing.
-        return ('This is a Flutter project. Reticle cannot instrument it, and no directory or flag will ' +
-            'change that: Reticle reads the DOM of a running page, and Flutter web paints its entire UI ' +
-            'into a single canvas element with no DOM behind it. Nothing here is missing or misconfigured. ' +
-            'If this repo also contains an ordinary web app with its own package.json, run `reticle init` ' +
-            'inside that directory instead.');
+        return {
+            kind: NoPackageJsonCase.FLUTTER,
+            message: 'This is a Flutter project. Reticle cannot instrument it, and no directory or flag will ' +
+                'change that: Reticle reads the DOM of a running page, and Flutter web paints its entire UI ' +
+                'into a single canvas element with no DOM behind it. Nothing here is missing or misconfigured. ' +
+                'If this repo also contains an ordinary web app with its own package.json, run `reticle init` ' +
+                'inside that directory instead.',
+        };
     }
-    return (`This looks like a ${ecosystem} project, and there is no package.json here or in any app ` +
-        'directory beneath it. That is not a blocker: Reticle needs its SDK loaded by the page, not ' +
-        'built by npm, and a page with no build step can load it from a URL. ' +
-        // The old message ended at "there is no directory you could run this from that would change
-        // that", which read as a refusal and was acted on as one — agents went looking for a bundler,
-        // or for a standalone build to inject by hand, or gave up and used a different tool. The
-        // capability was there the whole time; only the sentence was missing. Proven end to end on a
-        // page served by `python3 -m http.server` before this line was written.
-        'Add the script-tag snippet below to a template you only serve in development, then reload the ' +
-        'page. ' +
-        'If this project ALSO has a JS front end (a `frontend/`, `client/` or `assets/` directory with ' +
-        'its own package.json), running `reticle init` there instead gives you source mapping and ' +
-        'framework state as well: point at it with `--app <dir>`.');
+    return {
+        kind: NoPackageJsonCase.NON_JS,
+        message: `This looks like a ${ecosystem} project, and there is no package.json here or in any app ` +
+            'directory beneath it. That is not a blocker: Reticle needs its SDK loaded by the page, not ' +
+            'built by npm, and a page with no build step can load it from a URL. ' +
+            // The old message ended at "there is no directory you could run this from that would change
+            // that", which read as a refusal and was acted on as one — agents went looking for a bundler,
+            // or for a standalone build to inject by hand, or gave up and used a different tool. The
+            // capability was there the whole time; only the sentence was missing. Proven end to end on a
+            // page served by `python3 -m http.server` before this line was written.
+            'Add the script-tag snippet below to a template you only serve in development, then reload the ' +
+            'page. ' +
+            'If this project ALSO has a JS front end (a `frontend/`, `client/` or `assets/` directory with ' +
+            'its own package.json), running `reticle init` there instead gives you source mapping and ' +
+            'framework state as well: point at it with `--app <dir>`.',
+    };
 }

package/dist/detect/workspace-apps.d.ts

@@ -26,6 +26,11 @@ export declare function workspaceParents(sources: WorkspaceSources): string[];
  */
 /** Deps that mark a directory as a runnable web app even when it has no bundler config file. */
 export declare const APP_DEPS: readonly ["next", "vite", "electron-vite"];
+/**
+ * Whether `dir` is itself an app with a page: what the daemon asks before wiring a folder unasked,
+ * so a library or API package it happens to run in is left alone.
+ */
+export declare function isWebApp(dir: string, io: Pick<InitIo, 'exists' | 'readFile'>): boolean;
 /**
  * App directories under a workspace root.
  *

package/dist/detect/workspace-apps.js

@@ -179,6 +179,13 @@ function appSignal(dir, io) {
     // backend. A package with a dev script and no page is only a candidate when nothing else is.
     return hasPage(dir, pkgRaw, io) ? AppSignal.UI : AppSignal.SERVED;
 }
+/**
+ * Whether `dir` is itself an app with a page: what the daemon asks before wiring a folder unasked,
+ * so a library or API package it happens to run in is left alone.
+ */
+export function isWebApp(dir, io) {
+    return AppSignal.UI === appSignal(dir, io);
+}
 /**
  * App directories under a workspace root.
  *

package/dist/detect/workspace-redirect.d.ts

@@ -11,6 +11,18 @@
 import type { InitIo, InitOptions, InitResult } from '../run-types.js';
 /** Re-enter `init`, scoped to one directory of the workspace. */
 type RunInit = (options: InitOptions, io: InitIo) => InitResult;
+declare const POWERSHELL_ONLY_LABEL: "PowerShell only:";
+interface DisplayedWorkspaceAppCommand {
+    command: string;
+    label?: typeof POWERSHELL_ONLY_LABEL;
+}
+/**
+ * Render one discovered workspace app as a command the user can paste back into a shell.
+ *
+ * Plain paths need no quoting. Complex Windows paths are explicitly PowerShell-only because
+ * cmd.exe and PowerShell use different quoting grammars.
+ */
+export declare function displayedWorkspaceAppCommand(app: string, platform: NodeJS.Platform): DisplayedWorkspaceAppCommand;
 /**
  * When the current directory is a workspace root with no app of its own, wire the app instead of the
  * root. One candidate is wired silently (there is nothing to ask about); several are listed, because

package/dist/detect/workspace-redirect.js

@@ -29,7 +29,36 @@ function appNamedByRootConfig(io) {
     const named = workspacePackageDirs(io).filter((dir) => projectIdOf(io.readFile(`${dir}/${RETICLE_CONFIG_FILE}`)) === wanted);
     return 1 === named.length ? named[0] : undefined;
 }
-const AMBIGUOUS_HEADER = 'Several apps found in this workspace. Re-run `reticle init` inside the one you want:';
+const AMBIGUOUS_HEADER = 'Several apps found in this workspace. Re-run `reticle init` for the one you want:';
+const WORKSPACE_APP_COMMAND = 'reticle init --app';
+const POWERSHELL_ONLY_LABEL = 'PowerShell only:';
+const PLAIN_SHELL_ARG = /^[A-Za-z0-9_./-]+$/;
+function posixShellArg(arg) {
+    return `'${arg.replaceAll("'", "'\"'\"'")}'`;
+}
+function powerShellArg(arg) {
+    return `'${arg.replaceAll("'", "''")}'`;
+}
+/**
+ * Render one discovered workspace app as a command the user can paste back into a shell.
+ *
+ * Plain paths need no quoting. Complex Windows paths are explicitly PowerShell-only because
+ * cmd.exe and PowerShell use different quoting grammars.
+ */
+export function displayedWorkspaceAppCommand(app, platform) {
+    if (PLAIN_SHELL_ARG.test(app)) {
+        return { command: `${WORKSPACE_APP_COMMAND} ${app}` };
+    }
+    if ('win32' === platform) {
+        return {
+            label: POWERSHELL_ONLY_LABEL,
+            command: `${WORKSPACE_APP_COMMAND} ${powerShellArg(app)}`,
+        };
+    }
+    return {
+        command: `${WORKSPACE_APP_COMMAND} ${posixShellArg(app)}`,
+    };
+}
 /**
  * When the current directory is a workspace root with no app of its own, wire the app instead of the
  * root. One candidate is wired silently (there is nothing to ask about); several are listed, because
@@ -89,10 +118,12 @@ export function redirectToWorkspaceApp(options, io, pkg, runInit) {
         if (0 === apps.length)
             return null; // not a workspace — fall through to the normal HTML plan
         io.print(AMBIGUOUS_HEADER);
-        for (const a of apps)
-            io.print(`  ${a}`);
-        io.print('');
-        io.print(`Or name one without changing directory:  reticle init --app ${apps[0] ?? '<dir>'}`);
+        for (const a of apps) {
+            const displayed = displayedWorkspaceAppCommand(a, process.platform);
+            if (displayed.label !== undefined)
+                io.print(`  ${displayed.label}`);
+            io.print(`  ${displayed.command}`);
+        }
         return { ok: false, applied: 0, manual: apps.length };
     }
     return enterApp(options, io, target, 'No app in this directory — wiring', runInit);

package/dist/diagnose/closing-hint.d.ts

@@ -31,4 +31,10 @@ export declare const FEEDBACK_HINT: string;
  */
 export declare function restartHint(mcpStatus: StepStatus | undefined, 
 /** The project's own dev command, when package.json named one. */
-devCommand?: string): string;
+devCommand?: string, 
+/**
+ * Titles of other clients' registration steps this run left for the reader (the `⚠` rows). The
+ * Claude Code row says nothing about them, so without these the closing line contradicts the
+ * report above it.
+ */
+manualClients?: readonly string[]): string;

package/dist/diagnose/closing-hint.js

@@ -21,6 +21,24 @@ export const FEEDBACK_HINT = 'Anything wrong, missing, or awkward — in this se
     'one thing that decides what gets fixed:\n' +
     `  ${CLI} feedback --agent --kind <bug|gap|ambiguity|feature_request|improvement> "what happened"   (agents)\n` +
     `  ${CLI} feedback "what worked, what didn't"   (humans)`;
+/** User-facing closing copy for `restartHint` — one named home per sentence block. */
+const RestartHintCopy = {
+    DEMO: 'Then drive one real flow of your app end to end and report the verdict — that is the install ' +
+        "proving itself, and it is the agent's job, not a separate command.",
+    PROVE: 'Then run `npx @reticlehq/server status` — it confirms the app connected, or says exactly why ' +
+        'it has not.',
+    ALREADY_REGISTERED_ALL: 'The Reticle MCP server was already registered on this machine, so there is no restart to do ' +
+        'and the tools are available now.',
+    ALREADY_REGISTERED_CLAUDE_HEAD: 'The Reticle MCP server was already registered with Claude Code, so there is no restart to ' +
+        'do and the tools are available there now. They are NOT available in the clients whose ' +
+        'step above still needs a hand edit (',
+    ALREADY_REGISTERED_CLAUDE_TAIL: ') until that is done.',
+    CLOSING_ALREADY_NO_MANUAL: 'Once it shows a session, drive a flow — that is the install finished. Carry straight on; ' +
+        'nothing here is waiting on a human.',
+    CLOSING_ALREADY_WITH_MANUAL: 'Once it shows a session, drive a flow where the tools are already available — that is the ' +
+        'install finished on that client. The hand-edit step above still needs a human for the other ' +
+        'clients named there.',
+};
 /**
  * What to say about the dev server.
  *
@@ -53,7 +71,13 @@ function devServerRestart(devCommand) {
  */
 export function restartHint(mcpStatus, 
 /** The project's own dev command, when package.json named one. */
-devCommand) {
+devCommand, 
+/**
+ * Titles of other clients' registration steps this run left for the reader (the `⚠` rows). The
+ * Claude Code row says nothing about them, so without these the closing line contradicts the
+ * report above it.
+ */
+manualClients = []) {
     const dev = `${devServerRestart(devCommand)}.`;
     // NAME THE COMMAND THAT PROVES IT, not one that merely asks.
     //
@@ -77,10 +101,8 @@ devCommand) {
     // So the close hands the agent the sequence instead. It is deliberately one drive of one real
     // flow ending in a verdict, because an install that ends in "the tools are available" is an
     // install that ends in nothing.
-    const demo = 'Then drive one real flow of your app end to end and report the verdict — that is the install ' +
-        "proving itself, and it is the agent's job, not a separate command.";
-    const prove = 'Then run `npx @reticlehq/server status` — it confirms the app connected, or says exactly why ' +
-        'it has not.';
+    const demo = RestartHintCopy.DEMO;
+    const prove = RestartHintCopy.PROVE;
     // Nothing registered this run (`--no-mcp`, or a client that needs a manual edit): a restart picks
     // up nothing, so advice about one would be advice about something we did not do.
     if (!wasMcpRegistered(mcpStatus))
@@ -92,13 +114,18 @@ devCommand) {
     // agent, the tools only appear after that" — and an agent believes the output in front of it over
     // whatever its skill file said, so it stops with the project wired and nothing driven.
     if (mcpStatus === StepStatus.ALREADY) {
-        return (`${dev}\n` +
-            `${demo}\n` +
-            'The Reticle MCP server was already registered on this machine, so there is no restart to do ' +
-            'and the tools are available now.\n' +
-            `${prove}\n` +
-            'Once it shows a session, drive a flow — that is the install finished. Carry straight on; ' +
-            'nothing here is waiting on a human.');
+        // Only Claude Code's row was read, so "available now" is true for Claude Code and nothing else.
+        // Name the registrations still left, or a Codex user reads two contradicting lines and believes
+        // the last one.
+        const availability = 0 === manualClients.length
+            ? RestartHintCopy.ALREADY_REGISTERED_ALL
+            : RestartHintCopy.ALREADY_REGISTERED_CLAUDE_HEAD +
+                manualClients.join(', ') +
+                RestartHintCopy.ALREADY_REGISTERED_CLAUDE_TAIL;
+        const closing = 0 === manualClients.length
+            ? RestartHintCopy.CLOSING_ALREADY_NO_MANUAL
+            : RestartHintCopy.CLOSING_ALREADY_WITH_MANUAL;
+        return `${dev}\n${demo}\n${availability}\n${prove}\n${closing}`;
     }
     return (`${dev}\n` +
         `${demo}\n` +

package/dist/diagnose/csp-check.js

@@ -24,23 +24,26 @@ const WILDCARDS = ['*', 'ws:', 'wss:', 'ws://*', 'https:'];
 function bridgeOrigins(port) {
     return [`ws://localhost:${String(port)}`, `ws://127.0.0.1:${String(port)}`];
 }
-/**
- * The `connect-src` directive's source list, or undefined when the text declares none.
- *
- * Matches to the end of the directive (`;`) or the end of the enclosing quoted string, which is how
- * these are written in both a Next `headers()` value and a `<meta content="...">`.
- */
+const TERNARY_GAP = /^"\s*:\s*"$/;
+const EXPRESSION_EDGE = /^["'`})\]]+|["'`})\]]+$/g;
 function directiveSources(text, directive) {
     // Stops at the directive separator or the closing double quote of the enclosing string. Single
     // quotes are NOT terminators: `'self'` is a source, not the end of the list.
-    const match = new RegExp(`${directive}([^;"]*)`, 'i').exec(text);
-    const list = match?.[1];
-    if (list === undefined)
+    const matches = [...text.matchAll(new RegExp(`${directive}([^;"]*)`, 'gi'))];
+    if (0 === matches.length)
         return undefined;
-    return list
-        .split(/\s+/)
-        .map((source) => source.trim())
-        .filter((source) => source.length > 0);
+    return matches.map((match, index) => {
+        const previous = matches[index - 1];
+        const previousEnd = previous === undefined ? undefined : (previous.index ?? 0) + previous[0].length;
+        return {
+            sources: (match[1] ?? '')
+                .split(/\s+/)
+                .map((source) => source.trim())
+                .filter((source) => source.length > 0),
+            alternativeWithPrevious: previousEnd !== undefined &&
+                TERNARY_GAP.test(text.slice(previousEnd, match.index ?? previousEnd)),
+        };
+    });
 }
 /**
  * What this policy allows a WebSocket to reach — `connect-src`, or `default-src` when it is absent.
@@ -55,7 +58,11 @@ function directiveSources(text, directive) {
  * Still undefined when NEITHER is present — a policy that constrains neither is not blocking us.
  */
 function connectSrcSources(text) {
-    return directiveSources(text, 'connect-src') ?? directiveSources(text, 'default-src');
+    const sources = directiveSources(text, 'connect-src') ?? directiveSources(text, 'default-src');
+    return sources?.map(({ sources: sourceList, alternativeWithPrevious }) => ({
+        sources: sourceList.map((source) => source.replace(EXPRESSION_EDGE, '')),
+        alternativeWithPrevious,
+    }));
 }
 /**
  * The problem with this app's `connect-src`, or undefined if there is not one.
@@ -67,15 +74,41 @@ export function cspConnectSrcProblem(text, port) {
     const sources = connectSrcSources(text);
     if (sources === undefined || 0 === sources.length)
         return undefined;
-    if (sources.some((source) => WILDCARDS.includes(source)))
-        return undefined;
     const wanted = bridgeOrigins(port);
+    // Separate CSP policies are all enforced, so every group must admit the bridge. Two occurrences
+    // that are alternate branches of one source-level ternary are not enforced together: either
+    // branch admitting the bridge is enough for that group.
+    const missingByPolicyGroup = [];
+    for (const { sources: sourceList, alternativeWithPrevious } of sources) {
+        const missingFromSourceList = sourceList.some((source) => WILDCARDS.includes(source))
+            ? []
+            : wanted.filter((origin) => !sourceList.includes(origin));
+        if (alternativeWithPrevious) {
+            const previousIndex = missingByPolicyGroup.length - 1;
+            const previousMissing = missingByPolicyGroup[previousIndex];
+            if (previousMissing === undefined) {
+                missingByPolicyGroup.push(missingFromSourceList);
+            }
+            else {
+                // Either complete branch makes this conditional group safe. If both branches block, retain
+                // every origin needed to make either possible policy admit the bridge.
+                missingByPolicyGroup[previousIndex] =
+                    0 === previousMissing.length || 0 === missingFromSourceList.length
+                        ? []
+                        : wanted.filter((origin) => previousMissing.includes(origin) || missingFromSourceList.includes(origin));
+            }
+        }
+        else {
+            missingByPolicyGroup.push(missingFromSourceList);
+        }
+    }
     // BOTH, not either: the SDK picks its host from how the page was served, and a policy that admits
     // one is a coin flip. A coin flip that fails is indistinguishable from every other silent
     // non-connect, which is the whole cost being avoided here.
-    if (wanted.every((origin) => sources.includes(origin)))
+    const blockingGroups = missingByPolicyGroup.filter((missing) => 0 < missing.length);
+    if (0 === blockingGroups.length)
         return undefined;
-    const missing = wanted.filter((origin) => !sources.includes(origin));
+    const missing = wanted.filter((origin) => blockingGroups.some((group) => group.includes(origin)));
     return (`this app declares a Content-Security-Policy whose \`connect-src\` does not admit the Reticle ` +
         `bridge: ${missing.join(' and ')} ${1 === missing.length ? 'is' : 'are'} missing. The browser ` +
         `will block the WebSocket and report it in ITS console only — every check on the Reticle side ` +
@@ -125,7 +158,19 @@ export function cspInlineScriptProblem(text, port) {
     const sources = scriptSrcSources(text);
     if (sources === undefined || 0 === sources.length)
         return undefined;
-    if (!blocksInlineScript(sources))
+    // The same CSP composition rule applies here: any independent blocking policy wins, while a
+    // source-level conditional is safe when either of its mutually exclusive branches permits inline.
+    const policiesThatBlockInlineScript = [];
+    for (const { sources: sourceList, alternativeWithPrevious } of sources) {
+        const blocksInline = blocksInlineScript(sourceList);
+        if (alternativeWithPrevious) {
+            policiesThatBlockInlineScript[policiesThatBlockInlineScript.length - 1] &&= blocksInline;
+        }
+        else {
+            policiesThatBlockInlineScript.push(blocksInline);
+        }
+    }
+    if (!policiesThatBlockInlineScript.some(Boolean))
         return undefined;
     return (`this app declares a Content-Security-Policy whose \`script-src\` does not admit an inline ` +
         `script, so the connect snippet never executes. Nothing on the Reticle side can see this: with ` +
@@ -182,7 +227,7 @@ function withBridgeOrigins(policy, port) {
     }
     // No connect-src: the socket falls back to default-src, so the new directive starts from what
     // default-src already allowed — adding it bare would take 'self' away from every fetch the app does.
-    const fallback = directiveSources(policy, 'default-src') ?? [];
+    const fallback = directiveSources(policy, 'default-src')?.[0]?.sources ?? [];
     const added = ` connect-src ${[...fallback, ...origins].join(' ')}`;
     const trimmed = policy.trimEnd();
     return trimmed.endsWith(';') ? `${trimmed}${added};` : `${trimmed};${added}`;

package/dist/index.d.ts

@@ -29,8 +29,9 @@ export { DEV_SERVER_PORTS, isLikelyDevServerPort, devServerPortWarning, } from '
 export { configWithInstallSource } from './project/install-source-config.js';
 export { projectIdOf, rememberProjectOnDisk, type RegistryIo } from './project/remember-project.js';
 export { detectPackageManager, Framework, installCommandParts, parseMajor, PackageManager, } from './detect/detect.js';
-export { findWorkspaceApps } from './detect/workspace-apps.js';
+export { findWorkspaceApps, isWebApp, workspacePackageDirs } from './detect/workspace-apps.js';
 export { desktopLaunch, type DesktopLaunch } from './detect/dev-script.js';
+export { detectNonJsEcosystem, noPackageJsonMessage } from './detect/non-js-project.js';
 export { deriveProjectId, packageName } from './project/project-id.js';
 export { refreshAgentRules } from './project/refresh-rules.js';
 export { diagnoseDesktop, isDesktopProject } from './diagnose/desktop-doctor.js';

package/dist/index.js

@@ -29,8 +29,9 @@ export { DEV_SERVER_PORTS, isLikelyDevServerPort, devServerPortWarning, } from '
 export { configWithInstallSource } from './project/install-source-config.js';
 export { projectIdOf, rememberProjectOnDisk } from './project/remember-project.js';
 export { detectPackageManager, Framework, installCommandParts, parseMajor, PackageManager, } from './detect/detect.js';
-export { findWorkspaceApps } from './detect/workspace-apps.js';
+export { findWorkspaceApps, isWebApp, workspacePackageDirs } from './detect/workspace-apps.js';
 export { desktopLaunch } from './detect/dev-script.js';
+export { detectNonJsEcosystem, noPackageJsonMessage } from './detect/non-js-project.js';
 export { deriveProjectId, packageName } from './project/project-id.js';
 export { refreshAgentRules } from './project/refresh-rules.js';
 export { diagnoseDesktop, isDesktopProject } from './diagnose/desktop-doctor.js';

package/dist/no-package-json.js

@@ -6,9 +6,8 @@
  * static page it can see whole, or prints the snippet for the stack it recognised (Streamlit,
  * Django, several pages) and stops.
  */
-import { join } from 'node:path';
 import { PackageManager, Framework } from './detect/detect.js';
-import { detectDjangoProject, detectStreamlitProject, djangoSetupMessage, noPackageJsonMessage, streamlitSetupMessage, } from './detect/non-js-project.js';
+import { detectDjangoProject, detectStreamlitProject, djangoSetupMessage, NoPackageJsonCase, noPackageJsonAnswer, streamlitSetupMessage, } from './detect/non-js-project.js';
 import { InitFailure } from './diagnose/init-failure.js';
 import { HTML_INDEX_PATH, STATIC_TOKEN_MODULE, staticTokenFiles, withStaticSnippet, } from './patch/static-page.js';
 import { connectArg, connectArgWithToken, djangoMiddlewareSnippet, reticleConfigContent, staticPageSnippet, streamlitPageSnippet, } from './patch/snippets.js';
@@ -60,9 +59,23 @@ function wireStaticPage(options, io, connect) {
     };
 }
 export function initWithoutPackageJson(options, io) {
+    // Relative to the IO's own root, like every other read here (`readFile` below, `HTML_INDEX_PATH`).
+    // The real IO resolves it to the same file; joining `options.cwd` onto it only made these checks
+    // miss in the in-memory IO the tests use, so no test could tell the branches below apart.
+    const existsHere = (file) => io.exists(file);
     const streamlit = detectStreamlitProject((file) => io.readFile(file), io.rootFiles());
     // Asked only when Streamlit already said no, so the two can never both claim the page.
-    const django = !streamlit && detectDjangoProject((file) => io.exists(join(options.cwd, file)), io.rootFiles());
+    const django = !streamlit && detectDjangoProject(existsHere, io.rootFiles());
+    // "Run init from your app's directory" is the whole answer, so stop at it. This used to fall
+    // through to the shared tail below: it wrote `.reticle.json` into the directory it had just called
+    // wrong, then printed a script-tag snippet under a message that asks for none (#1366).
+    const answer = noPackageJsonAnswer(existsHere, io.rootFiles());
+    if (!streamlit && !django && answer.kind === NoPackageJsonCase.WRONG_DIRECTORY) {
+        io.print(answer.message);
+        if (!options.dryRun)
+            io.host.reportOutcome({ ok: false, reason: InitFailure.NO_PACKAGE_JSON });
+        return { ok: false, applied: 0, manual: 0 };
+    }
     // Scope the project on disk before anything else, so the daemon can serve this page.
     //
     // This path used to print and exit, leaving no `.reticle.json` at all — and the reporter who
@@ -110,11 +123,7 @@ export function initWithoutPackageJson(options, io) {
     // a path problem and goes looking for a directory that cannot exist — reported from a
     // Streamlit app, where the search continued into hunting for a browser bundle to inject by
     // hand before the real answer surfaced.
-    streamlit
-        ? streamlitSetupMessage()
-        : django
-            ? djangoSetupMessage()
-            : noPackageJsonMessage((file) => io.exists(join(options.cwd, file)), io.rootFiles()));
+    streamlit ? streamlitSetupMessage() : django ? djangoSetupMessage() : answer.message);
     writeConfig();
     // The message says "add the snippet below". Print the snippet, or the message is the same broken
     // promise in the other direction.

package/dist/run.js

@@ -13,10 +13,11 @@ import { preflight } from './plan/preflight.js';
 import { devCommandFrom, devScriptBody } from './detect/dev-script.js';
 import { restartHint, FEEDBACK_HINT } from './diagnose/closing-hint.js';
 import { projectIdOf, rememberProjectOnDisk } from './project/remember-project.js';
-import { ANGULAR_WORKSPACE_FILE, detect, FORGE_RENDERER_CONFIGS, Framework, UiLibrary, } from './detect/detect.js';
+import { ANGULAR_WORKSPACE_FILE, detect, FORGE_RENDERER_CONFIGS, Framework, } from './detect/detect.js';
 import { ANGULAR_PROXY_PATH, angularEntry } from './patch/angular.js';
 import { HTML_INDEX_PATH } from './patch/static-page.js';
 import { initWithoutPackageJson } from './no-package-json.js';
+import { sdkPackagesDeclared, sdkPackagesPresent } from './sdk-packages.js';
 import { wasMcpRegistered } from './register/mcp-registered.js';
 import { pickAstroHost } from './patch/astro-host.js';
 import { ELECTRON_VITE_CONFIG_CANDIDATES, NEXT_CONFIG_CANDIDATES, PACKAGE_JSON, VITE_CONFIG_CANDIDATES, } from './detect/workspace-apps.js';
@@ -42,7 +43,7 @@ function craEntryOf(io) {
     }
     return null;
 }
-import { DEPS_TARGET, RETICLE_CONFIG_FILE, frameworkPackages, MCP_TARGET, buildPlan, StepStatus, } from './plan/plan.js';
+import { DEPS_TARGET, RETICLE_CONFIG_FILE, MCP_TARGET, buildPlan, StepStatus, } from './plan/plan.js';
 import { claudeAvailableProbe, claudeHasReticle } from './register/mcp.js';
 import { reticleDevLocation } from './patch/next-patch.js';
 import { scanTestids, storeHints, scanStores } from './detect/capabilities.js';
@@ -56,7 +57,6 @@ import { InitFailure } from './diagnose/init-failure.js';
 import { resolveLockfiles } from './detect/lockfiles.js';
 // Re-exported: it moved to its own module, and every existing importer says `run.js`.
 export { resolveLockfiles };
-const NODE_MODULES_DIR = 'node_modules';
 const SVELTEKIT_HOOKS = 'src/hooks.client.ts';
 const REACT_ROUTER_ENTRY = 'app/entry.client.tsx';
 const TANSTACK_START_ROOT_CANDIDATES = [
@@ -195,6 +195,8 @@ function resolvedStatus(plan, target, failed, skipped) {
         return StepStatus.MANUAL;
     return step.status;
 }
+/** Every client registration row is titled `MCP server (<client>)`; the closing hint names the unfinished ones. */
+const MCP_CLIENT_TITLE_PREFIX = 'MCP server (';
 const STATUS_SYMBOL = {
     [StepStatus.APPLY]: '✓',
     [StepStatus.MANUAL]: '⚠',
@@ -477,6 +479,8 @@ continuesToRuntime = false) {
     // the app never dials the daemon and every tool answers "no browser session connected". `ok` was
     // hardcoded true, so a run that could not possibly work reported success.
     let connectPending = false;
+    // Other clients' registrations the run left for the reader, named for the closing hint.
+    const manualClients = [];
     for (const s of plan.steps) {
         // A side effect that failed to apply is reported as a manual step with its fallback command.
         const note = degraded.get(s.target);
@@ -504,6 +508,9 @@ continuesToRuntime = false) {
                 manual++;
                 if (isConnectStep(s.title))
                     connectPending = true;
+                if (s.target !== MCP_TARGET && s.title.startsWith(MCP_CLIENT_TITLE_PREFIX)) {
+                    manualClients.push(s.title);
+                }
             }
             for (const line of detail.split('\n'))
                 io.print(`      ${line}`);
@@ -525,7 +532,7 @@ continuesToRuntime = false) {
     }
     const mcpStatus = resolvedStatus(plan, MCP_TARGET, failed, skipped);
     if (!continuesToRuntime) {
-        io.print(restartHint(mcpStatus, devCommand));
+        io.print(restartHint(mcpStatus, devCommand, manualClients));
     }
     // Carried out even when the hint above was printed, because the RUNTIME path needs the same fact
     // and could not reach it: `restartHint` is only printed when this run stops at the files, and the
@@ -547,25 +554,6 @@ continuesToRuntime = false) {
  * MODULE_NOT_FOUND, so the app stops booting *because* Reticle was installed. A skipped step is a
  * message; a half-wired app is a broken project.
  */
-/**
- * Are the SDK packages actually on disk, whatever the install step reported?
- *
- * `dependsOnInstall` exists to stop init writing a `next.config.ts` that imports a package which is
- * not there — that took a dev server down once, and installing Reticle must never be why an app
- * stops booting. The invariant it protects is "the import RESOLVES", but it was gated on "our
- * install subprocess exited 0", and those come apart in exactly the situation the failure creates:
- * init tells the user to install by hand, they do, they re-run init, the install step fails again
- * (wrong package manager, not on PATH) and every wiring step is skipped a second time. Reported from
- * a Next 16 app where npm had already installed both packages successfully — leaving an init that
- * could not be retried into working, which is the shape this guard was written to prevent.
- *
- * Reading node_modules answers the real question and costs one `exists` call per package.
- */
-function sdkPackagesPresent(framework, uiLibrary, io) {
-    const packages = frameworkPackages(framework, uiLibrary);
-    return (packages.length > 0 &&
-        packages.every((p) => io.exists(`${NODE_MODULES_DIR}/${p}/${PACKAGE_JSON}`)));
-}
 function applyEffects(plan, io, packageManager) {
     const why = new Map();
     const failed = new Set();
@@ -635,14 +623,17 @@ function applyEffects(plan, io, packageManager) {
                 continue;
             }
             // Verify, don't re-run: give the install step itself the same sdkPackagesPresent benefit
-            // already given to the wiring it gates below (#683).
-            if (s.target === DEPS_TARGET && sdkPackagesPresent(plan.framework, plan.uiLibrary, io))
+            // already given to the wiring it gates below (#683) — but only when package.json DECLARES
+            // them. Reported from a Tauri + Next app: `pnpm add` died on ERR_PNPM_UNEXPECTED_STORE, the
+            // packages happened to resolve, init printed success, and the manifest never gained them.
+            const present = s.target === DEPS_TARGET && sdkPackagesPresent(plan.framework, plan.uiLibrary, io);
+            if (present && sdkPackagesDeclared(plan.framework, plan.uiLibrary, io))
                 continue;
             failed.add(s.target);
             // A failed install only blocks the wiring when the packages are genuinely ABSENT. See
             // sdkPackagesPresent: the guard protects "the import resolves", not "our subprocess exited 0".
             if (s.target === DEPS_TARGET) {
-                installFailed = true;
+                installFailed = !present;
                 const explained = explainInstallFailure(io, packageManager, exec, s.detail);
                 if (explained !== undefined)
                     why.set(s.target, explained);

package/dist/sdk-packages.d.ts

@@ -0,0 +1,19 @@
+import type { Framework, UiLibrary } from './detect/detect.js';
+import type { InitIo } from './run-types.js';
+/**
+ * Are the SDK packages actually on disk, whatever the install step reported?
+ *
+ * `dependsOnInstall` exists to stop init writing a `next.config.ts` that imports a package which is
+ * not there — that took a dev server down once, and installing Reticle must never be why an app
+ * stops booting. The invariant it protects is "the import RESOLVES", but it was gated on "our
+ * install subprocess exited 0", and those come apart in exactly the situation the failure creates:
+ * init tells the user to install by hand, they do, they re-run init, the install step fails again
+ * (wrong package manager, not on PATH) and every wiring step is skipped a second time. Reported from
+ * a Next 16 app where npm had already installed both packages successfully — leaving an init that
+ * could not be retried into working, which is the shape this guard was written to prevent.
+ *
+ * Reading node_modules answers the real question and costs one `exists` call per package.
+ */
+export declare function sdkPackagesPresent(framework: Framework, uiLibrary: UiLibrary, io: Pick<InitIo, 'exists'>): boolean;
+/** Does package.json list every SDK package? On disk without this, the next clean install drops them. */
+export declare function sdkPackagesDeclared(framework: Framework, uiLibrary: UiLibrary, io: Pick<InitIo, 'readFile'>): boolean;

package/dist/sdk-packages.js

@@ -0,0 +1,34 @@
+import { PACKAGE_JSON } from './detect/workspace-apps.js';
+import { frameworkPackages } from './plan/plan.js';
+const NODE_MODULES_DIR = 'node_modules';
+/**
+ * Are the SDK packages actually on disk, whatever the install step reported?
+ *
+ * `dependsOnInstall` exists to stop init writing a `next.config.ts` that imports a package which is
+ * not there — that took a dev server down once, and installing Reticle must never be why an app
+ * stops booting. The invariant it protects is "the import RESOLVES", but it was gated on "our
+ * install subprocess exited 0", and those come apart in exactly the situation the failure creates:
+ * init tells the user to install by hand, they do, they re-run init, the install step fails again
+ * (wrong package manager, not on PATH) and every wiring step is skipped a second time. Reported from
+ * a Next 16 app where npm had already installed both packages successfully — leaving an init that
+ * could not be retried into working, which is the shape this guard was written to prevent.
+ *
+ * Reading node_modules answers the real question and costs one `exists` call per package.
+ */
+export function sdkPackagesPresent(framework, uiLibrary, io) {
+    const packages = frameworkPackages(framework, uiLibrary);
+    return (packages.length > 0 &&
+        packages.every((p) => io.exists(`${NODE_MODULES_DIR}/${p}/${PACKAGE_JSON}`)));
+}
+/** Does package.json list every SDK package? On disk without this, the next clean install drops them. */
+export function sdkPackagesDeclared(framework, uiLibrary, io) {
+    let manifest;
+    try {
+        manifest = JSON.parse(io.readFile(PACKAGE_JSON) ?? '{}');
+    }
+    catch {
+        return false;
+    }
+    const m = (manifest ?? {});
+    return frameworkPackages(framework, uiLibrary).every((p) => m['dependencies']?.[p] !== undefined || m['devDependencies']?.[p] !== undefined);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reticlehq/init",
-  "version": "3.5.0",
+  "version": "3.6.0",
   "description": "Reticle project scaffolder — detects the framework, writes the config, patches the build and registers the MCP server. The build-time half of `reticle init`.",
   "type": "module",
   "main": "./dist/index.js",
@@ -13,7 +13,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@reticlehq/core": "3.5.0"
+    "@reticlehq/core": "3.6.0"
   },
   "license": "FSL-1.1-ALv2",
   "author": "Reticle contributors",