@reticlehq/server 2.11.0 → 2.13.0

package/dist/cli.js

@@ -5,23 +5,31 @@ import { realpathSync } from 'node:fs';
 import { join } from 'node:path';
 import { stateDirProblem } from './daemon/state-dir.js';
 import { statusNextAction } from './cli/status-next-action.js';
-import { hasConnectedBefore } from './session/connection-memory.js';
+import { readDevServers } from './daemon/dev-servers.js';
+import { hasConnectedBefore, hasProjectConnectedBefore } from './session/connection-memory.js';
+import { attachStatusFields } from './mcp/attach-memory.js';
 import { reticleStateHome } from './daemon/daemon.js';
+import { handleMcp } from './cli/mcp-command.js';
+import { daemonSpawnArgs, daemonStartOptions } from './cli/daemon-start-options.js';
+import { daemonsServingProjectElsewhere, resolveDaemonForProject, splitBrainNote, wrongDaemonNote, } from './daemon/daemon-resolve.js';
 import { handleWatch, handleCapsules, handleGate, loadNamedFlows, resolveChangedFiles, } from './cli/cli-flow-commands.js';
-import { RETICLE_DEFAULT_PORT, ReticleDir, ReticleEnv } from '@reticlehq/core';
+import { RETICLE_DEFAULT_PORT, ReticleDir, ReticleEnv, devServersForProject, } from '@reticlehq/core';
 import { loadDotEnv } from './telemetry/dev-repo.js';
+import { licenseKeyFromEnvFiles } from './license/license-env.js';
+import { LICENSE_KEY_ENV } from './license/license.js';
 import { createNodeFileSystem } from './project/fs-port.js';
 import { affectedSavedFlows } from './flows/flow-sources.js';
 import { availableUpdate } from './update/update-nudge.js';
 import { handleUpdate, handleRollback } from './cli/cli-update-commands.js';
-import { startDaemon } from './index.js';
+import { startDaemon, RETICLE_VERIFY_DEFAULT_PORT } from './index.js';
+import { verifyEndpointMismatch } from './status-payload.js';
 import { isCloudCommand, runCloudCommand } from './cli/cloud-cli.js';
 import { SERVER_VERSION } from './version/server-version.js';
 import { log } from './log.js';
 import { readPid, isAlive, removePid, spawnDaemon, discoverDaemonPort, writeDaemonRegistry, logPath, } from './daemon/daemon.js';
 import { PortPresence, probePresence, presenceIsUsable, describePresence, } from './daemon/port-presence.js';
-import { waitForDaemon, startMcpProxy, probeDaemon, proxyLog, setProxyLogPort, } from './mcp/mcp-proxy.js';
-import { installDaemonResilience, installProxyResilience, recordExitReason, DaemonExitReason, } from './daemon/daemon-resilience.js';
+import { waitForDaemon, probeDaemon } from './mcp/mcp-proxy.js';
+import { installDaemonResilience, recordExitReason, DaemonExitReason, } from './daemon/daemon-resilience.js';
 import { IdleShutdown, resolveIdleShutdownMs, resolveIdleCheckMs } from './daemon/idle-shutdown.js';
 import { DaemonHeartbeat, resolveHeartbeatMs } from './daemon/heartbeat.js';
 import { everServedToolCall } from './daemon/daemon-usefulness.js';
@@ -31,12 +39,12 @@ import { handleVerify } from './cli/cli-verify.js';
 import { runKill } from './cli/cli-kill.js';
 import { summarizeHunt } from './hunt/hunt-report.js';
 import { runInit } from './init/run.js';
-import { confirmInstall, nodeConfirmDeps } from './init/confirm.js';
+import { continueAfterInit } from './setup/init-runtime.js';
 import { handleDoctor } from './cli/cli-doctor.js';
 import { buildNodeIo } from './init/node-io.js';
 import { describeLicense } from './license/license.js';
 import { isLikelyDevServerPort, devServerPortWarning, readProjectPort, readProjectId, } from './cli/cli-port.js';
-import { DAEMON_INNER_COMMAND, PORT_FLAG, DRIVE_FLAG, HEADED_FLAG, HTTP_FLAG, HTTP_PORT_FLAG, HTTP_TOKEN_FLAG, parseCliArgs, CLI_USAGE, } from './cli/cli-parse.js';
+import { DAEMON_INNER_COMMAND, PORT_FLAG, parseCliArgs, CLI_USAGE } from './cli/cli-parse.js';
 import { handleFeedback, handleIdentify, handleTelemetry } from './telemetry/feedback-cli.js';
 import { installDaemonTelemetry } from './telemetry/daemon-telemetry.js';
 import { reportCliRun } from './telemetry/cli-telemetry.js';
@@ -52,14 +60,13 @@ function handleInit(parsed) {
         dryRun: parsed.dryRun,
         install: parsed.install,
         ...(parsed.app === undefined ? {} : { app: parsed.app }),
+        captureBodies: true === parsed.captureBodies,
         // The outcome is reported by confirmInstall instead, once it knows whether an app connected —
         // `init` writing files was never the same thing as `init` working (#269).
         deferOutcome: true,
+        continuesToRuntime: true !== parsed.filesOnly && true !== parsed.dryRun,
     }, io);
-    void confirmInstall(result, io, nodeConfirmDeps(parsed.port ?? RETICLE_DEFAULT_PORT)).then(() => {
-        if (!result.ok)
-            process.exit(1);
-    });
+    void continueAfterInit(parsed, result, io, cwd);
 }
 function handleServe(parsed) {
     void serveWithHonestExit(parsed);
@@ -81,6 +88,20 @@ async function serveWithHonestExit(parsed) {
         status: fetchStatus,
     });
     if (presence === PortPresence.DAEMON) {
+        // A daemon that is already up was started with ITS flags, not these — `serve` only attaches.
+        // Exiting 0 here regardless is how `--http-port` came to be accepted and ignored (#687): the
+        // running daemon kept serving whatever it was started with, and the flag vanished without a
+        // word. Ask the daemon which verify port it actually serves and refuse when it is not the one
+        // requested — a flag that cannot be honoured must say so, not report success.
+        if (parsed.http) {
+            const mismatch = verifyEndpointMismatch(await fetchStatus(parsed.port), parsed.httpPort ?? RETICLE_VERIFY_DEFAULT_PORT);
+            if (mismatch !== undefined) {
+                log('reticle_daemon_start_refused', { port: parsed.port, reason: mismatch });
+                process.stderr.write(`${mismatch}\n`);
+                process.exit(1);
+                return;
+            }
+        }
         log('reticle_daemon_already_running', { port: parsed.port });
         return;
     }
@@ -100,19 +121,7 @@ async function serveWithHonestExit(parsed) {
         process.exit(1);
         return;
     }
-    const daemonArgs = [DAEMON_INNER_COMMAND, PORT_FLAG, String(parsed.port)];
-    if (parsed.driveUrl !== undefined) {
-        daemonArgs.push(DRIVE_FLAG, parsed.driveUrl);
-        if (!parsed.headless)
-            daemonArgs.push(HEADED_FLAG);
-    }
-    if (parsed.http) {
-        daemonArgs.push(HTTP_FLAG);
-        if (parsed.httpPort !== undefined)
-            daemonArgs.push(HTTP_PORT_FLAG, String(parsed.httpPort));
-        if (parsed.httpToken !== undefined)
-            daemonArgs.push(HTTP_TOKEN_FLAG, parsed.httpToken);
-    }
+    const daemonArgs = daemonSpawnArgs(parsed);
     spawnDaemon(process.execPath, scriptPath, daemonArgs, parsed.port);
     // The child binds asynchronously and, when it cannot, exits 1 long after this process would have
     // reported success. Wait for it to ANSWER — `/status` responding is the only evidence a daemon
@@ -229,7 +238,20 @@ function withNextAction(facts) {
     const next = statusNextAction(facts);
     return next === undefined ? {} : { nextAction: next };
 }
-function handleStatus(port) {
+/**
+ * What `status` says about a project whose daemons have split in two.
+ *
+ * Both halves in one place because they are one condition asked from two positions, and a command
+ * can be standing on either. Silent — no key at all — when there is nothing to report, so a healthy
+ * run reads exactly as it did.
+ */
+function splitBrainFields(port, projectId) {
+    const home = reticleStateHome();
+    const elsewhere = splitBrainNote(port, daemonsServingProjectElsewhere(projectId, port, home, isAlive, (other) => hasProjectConnectedBefore(home, other, projectId)));
+    const note = elsewhere ?? wrongDaemonNote(port, resolveDaemonForProject(projectId, home, isAlive));
+    return note === undefined ? {} : { splitBrain: note };
+}
+export async function handleStatus(port) {
     const pid = readPid(port);
     // Durable, so it survives the daemon idling out — which is the state `status` is most often run in.
     const projectId = readProjectId(process.cwd());
@@ -238,49 +260,94 @@ function handleStatus(port) {
     // path does the first without the second — so this is the commonest reason `status` has nothing to
     // report, and it was not among the facts this command could state.
     const initialized = projectId !== undefined;
-    if (null === pid || !isAlive(pid)) {
-        // `running: false` on its own has been reported about a port that was demonstrably occupied,
-        // because the pid file is not the port. Ask the port before answering.
-        void probePresence(port, { tcpOpen: probeDaemon, status: fetchStatus }).then((presence) => {
-            const running = presenceIsUsable(presence);
-            log('reticle_status', {
-                port,
-                running,
-                presence,
-                ...(presence === PortPresence.FOREIGN ? { reason: describePresence(presence, port) } : {}),
-                // `init` promises this command says why the app has not connected. Without it the answer was
-                // `running: false` and nothing else, which reads as "Reticle is broken" for what is usually
-                // just a daemon that has not been asked to do anything yet.
-                ...withNextAction({ running, sessionCount: 0, previouslyConnected, initialized }),
-            });
+    // The OTHER half of the install, and the half this command could not see. A host that registers
+    // Reticle and never lists its tools looks exactly like an abandoned install from here — same idle
+    // daemon, same zero sessions — and the user sees a tool that does nothing. See attach-memory.ts.
+    const client = attachStatusFields(reticleStateHome(), port);
+    // What the dev servers themselves said. The reason this command could previously only guess at
+    // whether the app was running is that it had no way to see one; now the ones carrying Reticle
+    // announce, and the advice below stops contradicting the terminal the reader is looking at.
+    // Scoped to THIS project: the registry is machine-wide, and an unrelated app's dev server must
+    // not make this project look like it is running.
+    const devServerPorts = devServersForProject(readDevServers(reticleStateHome()), {
+        projectId,
+        root: process.cwd(),
+    }).map((d) => d.port);
+    // The failure where every individual check is green and the chain is broken: the agent's proxy and
+    // the app resolved their ports independently and landed on two different daemons. Reported from
+    // BOTH stances, because neither one can see it alone.
+    const split = splitBrainFields(port, projectId);
+    // Doctor and status must answer the same liveness question. A live pid only says that some
+    // process exists; a Reticle daemon is running only when the shared port probe reaches /status.
+    const presence = await probePresence(port, { tcpOpen: probeDaemon, status: fetchStatus });
+    if (!presenceIsUsable(presence)) {
+        log('reticle_status', {
+            port,
+            running: false,
+            presence,
+            ...(presence === PortPresence.FOREIGN ? { reason: describePresence(presence, port) } : {}),
+            // `init` promises this command says why the app has not connected. Without it the answer was
+            // `running: false` and nothing else, which reads as "Reticle is broken" for what is usually
+            // just a daemon that has not been asked to do anything yet.
+            ...withNextAction({
+                running: false,
+                sessionCount: 0,
+                previouslyConnected,
+                initialized,
+                devServerPorts,
+            }),
+            ...client,
+            ...split,
         });
         return;
     }
-    // The daemon is up — ask it for live sessions + health so status is at-a-glance, not just a pid.
-    void fetchStatus(port).then((payload) => {
-        // `status` is the second-most-run command and the one a HUMAN types. The update nudge otherwise
-        // only rides a tool result, which the majority of daemons never produce — so the people most in
-        // need of an upgrade were the ones with no path to hearing about it.
-        const update = availableUpdate();
-        const nudge = update === undefined ? {} : { updateAvailable: update };
-        if (payload === undefined) {
-            log('reticle_status', {
-                port,
+    // The daemon answered the same probe doctor trusts — ask it for live sessions + health.
+    const payload = await fetchStatus(port);
+    // `status` is the second-most-run command and the one a HUMAN types. The update nudge otherwise
+    // only rides a tool result, which the majority of daemons never produce — so the people most in
+    // need of an upgrade were the ones with no path to hearing about it.
+    const update = availableUpdate();
+    const nudge = update === undefined ? {} : { updateAvailable: update };
+    if (payload === undefined) {
+        log('reticle_status', {
+            port,
+            running: true,
+            pid,
+            ...nudge,
+            ...withNextAction({
                 running: true,
-                pid,
-                ...nudge,
-                ...withNextAction({ running: true, sessionCount: 0, previouslyConnected, initialized }),
-            });
-            return;
-        }
-        const summary = summarizeStatus(payload);
-        // Only when the daemon did NOT already explain itself. It has the whole diagnosis in-process and
-        // puts it on the wire as `why`; printing a second, thinner opinion beside it risks two confident
-        // answers pointing different ways, which is worse than one.
-        const next = summary.why === undefined
-            ? withNextAction({ running: true, ...summary, previouslyConnected, initialized })
-            : {};
-        log('reticle_status', { port, running: true, pid, ...summary, ...next, ...nudge });
+                sessionCount: 0,
+                previouslyConnected,
+                initialized,
+                devServerPorts,
+            }),
+            ...client,
+            ...split,
+        });
+        return;
+    }
+    const summary = summarizeStatus(payload);
+    // Only when the daemon did NOT already explain itself. It has the whole diagnosis in-process and
+    // puts it on the wire as `why`; printing a second, thinner opinion beside it risks two confident
+    // answers pointing different ways, which is worse than one.
+    const next = summary.why === undefined
+        ? withNextAction({
+            running: true,
+            ...summary,
+            previouslyConnected,
+            initialized,
+            devServerPorts,
+        })
+        : {};
+    log('reticle_status', {
+        port,
+        running: true,
+        pid,
+        ...summary,
+        ...next,
+        ...client,
+        ...split,
+        ...nudge,
     });
 }
 /** Print the running package version (resolved once in server-version.ts). */
@@ -398,8 +465,17 @@ async function waitForNewSession(port, before) {
     return false;
 }
 function handleOpen(requestedPort, url) {
+    // Our project's daemon first: `discoverDaemonPort` returns the LOWEST live daemon on the machine,
+    // whoever it belongs to, so on a machine running two projects `reticle open` could drive the other
+    // one's browser. It stays as the last resort for a caller with no project id, where any daemon is
+    // better than none and there is no identity to confuse.
+    const myProject = readProjectId(process.cwd());
     probeDaemon(requestedPort)
-        .then((here) => (here ? requestedPort : (discoverDaemonPort() ?? requestedPort)))
+        .then((here) => here
+        ? requestedPort
+        : (resolveDaemonForProject(myProject, reticleStateHome(), isAlive) ??
+            discoverDaemonPort() ??
+            requestedPort))
         .then(async (port) => {
         await ensureDaemon(port);
         const { sessions } = summarizeStatus(await fetchStatus(port));
@@ -474,25 +550,13 @@ function handleOpen(requestedPort, url) {
     });
 }
 function handleDaemonInner(parsed) {
-    const options = {
-        port: parsed.port,
-        ...(parsed.driveUrl !== undefined
-            ? { driveUrl: parsed.driveUrl, headless: parsed.headless }
-            : {}),
-        ...(parsed.http
-            ? {
-                httpVerify: true,
-                ...(parsed.httpPort !== undefined ? { httpVerifyPort: parsed.httpPort } : {}),
-                ...(parsed.httpToken !== undefined ? { httpVerifyToken: parsed.httpToken } : {}),
-            }
-            : {}),
-    };
+    const options = daemonStartOptions(parsed);
     startDaemon(options)
         .then((server) => {
         log('reticle_daemon_ready', { port: parsed.port, pid: process.pid });
         // Daemon lifecycle telemetry: started, a one-shot project profile, the periodic counter flush,
         // and the rich summary on shutdown. All of it lives in one module — see daemon-telemetry.ts.
-        const daemonTelemetry = installDaemonTelemetry(process.cwd());
+        const daemonTelemetry = installDaemonTelemetry(process.cwd(), undefined, parsed.port);
         // Publish to the discovery registry so a build plugin can find this daemon by projectId — no
         // hand-reconciled port. Written from the child (only it knows its cwd); removePid drops it.
         const registryProjectId = readProjectId(process.cwd());
@@ -585,113 +649,18 @@ function handleDaemonInner(parsed) {
         process.exit(1);
     });
 }
-/**
- * MCP proxy mode: ensures the daemon is running, then bridges Claude Code's
- * stdin/stdout to the daemon's SSE endpoint. This is the recommended way to
- * configure Reticle in.mcp.json — users never need to manage the daemon manually.
- *
- * Pass --drive <url> to have the daemon launch its own Playwright browser at that
- * URL. The agent then has full autonomous control without relying on the user's browser.
- */
-function handleMcp(opts) {
-    const { port, driveUrl, headless, http, httpPort, httpToken } = opts;
-    // The proxy IS the MCP server the editor launched. Nothing respawns it, so an uncaught throw here
-    // is what a user experiences as "the MCP server disconnected — open /mcp and reconnect". Log it,
-    // report it, keep serving: the reconnect and dormant paths already know how to rebuild the only
-    // state this process has. See installProxyResilience for why its rule inverts the daemon's.
-    // The proxy's crash handlers must write to the proxy's LOG FILE, not just stderr. The editor
-    // swallows stderr, so wiring these to `log` meant a crash was handled and then unrecorded — the
-    // failure a user reports as "it disconnected" left nothing behind to read.
-    setProxyLogPort(port);
-    installProxyResilience(process, proxyLog);
-    /**
-     * Make sure a daemon is on the port, spawning one if not.
-     *
-     * Called on first start AND on every reconnect. The proxy used to only retry the socket, so a
-     * daemon that exited — crashed, `reticle stop`, or self-shut-down as idle — meant the retries hit
-     * a dead port until the budget ran out and the agent's MCP server exited with it. Reticle simply
-     * disappeared mid-session with nothing said. Respawning here makes the reconnect self-healing.
-     */
-    const ensure = async () => {
-        // The same question every other surface asks. It used to be a bare TCP connect, so a stranger on
-        // the bridge port answered "a daemon is here" — the proxy connected, the stream ended, and each
-        // client request woke into the identical non-answer. Rejecting here is what puts the proxy
-        // dormant with a reason, instead of pretending the wake succeeded.
-        const presence = await probePresence(port, { tcpOpen: probeDaemon, status: fetchStatus });
-        if (presenceIsUsable(presence))
-            return;
-        if (PortPresence.FREE !== presence)
-            throw new Error(describePresence(presence, port));
-        const scriptPath = process.argv[1];
-        if (scriptPath === undefined) {
-            log('reticle_mcp_no_script', {});
-            process.exit(1);
-        }
-        const daemonArgs = [DAEMON_INNER_COMMAND, PORT_FLAG, String(port)];
-        if (driveUrl !== undefined) {
-            daemonArgs.push(DRIVE_FLAG, driveUrl);
-            if (!headless)
-                daemonArgs.push(HEADED_FLAG);
-        }
-        // Forward the HTTP-verify flags too (previously silently dropped for `reticle mcp`).
-        if (http) {
-            daemonArgs.push(HTTP_FLAG);
-            if (httpPort !== undefined)
-                daemonArgs.push(HTTP_PORT_FLAG, String(httpPort));
-            if (httpToken !== undefined)
-                daemonArgs.push(HTTP_TOKEN_FLAG, httpToken);
-        }
-        spawnDaemon(process.execPath, scriptPath, daemonArgs, port);
-        // Announce the daemon only once the PORT ACCEPTS. This line used to be written the instant the
-        // child was spawned, which on a Windows first bootstrap meant `reticle_mcp_daemon_started`
-        // followed about ten seconds later by `reticle_mcp_daemon_unavailable` and a first
-        // `reticle_sessions` that expired. A readiness signal that precedes readiness is worse than
-        // none: a client that believes it stops waiting for the thing that has not happened.
-        await waitForDaemon(port);
-        log('reticle_mcp_daemon_started', { port, ...(driveUrl !== undefined ? { driveUrl } : {}) });
-    };
-    // Start the proxy WHATEVER happened to the daemon.
-    //
-    // This used to exit(1) when `ensure` failed, which is the third way an MCP server disappears on a
-    // user: something else is holding the bridge port — a foreign daemon from another project, a
-    // half-dead process, a port a colleague's tool grabbed — the spawned daemon cannot bind, and the
-    // editor shows a server that failed to start. Nothing about that is unrecoverable: the proxy
-    // answers `initialize` itself, serves the cached catalog, and its wake path retries a daemon on
-    // every client request. Present-and-complaining beats absent, because absent needs a human.
-    // `void`: the chain handles its own failure and the process must not wait on it — the proxy is
-    // started from `finally` either way.
-    void ensure()
-        .catch((err) => {
-        log('reticle_mcp_daemon_unavailable', {
-            error: err instanceof Error ? err.message : String(err),
-            note: 'serving anyway — the next tool call will try to start a daemon again',
-        });
-    })
-        .finally(() => {
-        // Also `void`: the proxy runs for the life of the process and is never awaited by anyone.
-        //
-        // The `.catch` is load-bearing despite that. `startMcpProxy` rejects when its FIRST connect
-        // fails — which is precisely the case this block exists to tolerate, a daemon that is not
-        // there yet — and with nothing attached that reject became an unhandledRejection. Reported
-        // from a win32 user as a crash reading `connect ECONNREFUSED` with an EMPTY frame list,
-        // because the stack of a refused socket is entirely node internals and the privacy filter
-        // keeps only Reticle frames. So the one path we most want diagnosable arrived as an anonymous
-        // crash. The proxy itself is unaffected — it has already installed its stdin reader and goes
-        // on serving from cache, waking a daemon on the next request — which is exactly why this
-        // must be logged as the expected condition it is rather than reported as a defect.
-        void startMcpProxy(port, ensure).catch((err) => {
-            log('reticle_mcp_proxy_first_connect_failed', {
-                port,
-                error: err instanceof Error ? err.message : String(err),
-                note: 'serving from cache; the next client request will try to start a daemon',
-            });
-        });
-    });
-}
 function main() {
     // Before anything reads process.env — notably the telemetry gate and the bridge's security
     // options — fold in a project-local `.env`. Values already in the environment always win.
     loadDotEnv(process.cwd());
+    // The licence key specifically is searched for HARDER than the rest of the environment, because
+    // the daemon is spawned without an explicit cwd and inherits the editor's. A key in the app's own
+    // `.env` — or in the repo root when the editor started inside the app — was never read, and the
+    // customer then produced events that said `missing`, which is indistinguishable from having no
+    // licence at all. Only the key is taken; see license-env.ts for why nothing else is.
+    const licenseKey = licenseKeyFromEnvFiles(process.cwd());
+    if (licenseKey !== undefined)
+        process.env[LICENSE_KEY_ENV] = licenseKey;
     const argv = process.argv.slice(2);
     // Every invocation passes through here — the single chokepoint for the "how often is it used / how
     // many distinct machines + projects" metrics. Fire-and-forget: a metric must never delay or fail a run.
@@ -718,7 +687,19 @@ function main() {
     if (projectPort !== undefined && isLikelyDevServerPort(projectPort)) {
         process.stderr.write(`${devServerPortWarning(projectPort)}\n`);
     }
-    const defaultPort = envPort ?? projectPort ?? RETICLE_DEFAULT_PORT;
+    // Registry BEFORE the default, and after both explicit sources.
+    //
+    // This is the line that ends the split brain. Build plugins have always asked the registry which
+    // daemon serves this project; the CLI asked a number and then attached to whoever owned it. So
+    // every project on the machine funnelled into one daemon whose identity was whichever project won
+    // the race, and one kill on one well-known port was a machine-wide outage.
+    //
+    // An explicit port still wins, because a person who typed one is answering this question
+    // themselves. Below that, our OWN daemon wherever it is listening. Only then the default, which is
+    // now a starting preference rather than an assumption.
+    const myProjectId = readProjectId(process.cwd());
+    const myDaemonPort = resolveDaemonForProject(myProjectId, reticleStateHome(), isAlive);
+    const defaultPort = envPort ?? projectPort ?? myDaemonPort ?? RETICLE_DEFAULT_PORT;
     // Headed by default; hidden only where there is no display to be headed on. A run nobody can see
     // is a run nobody trusts, and every "did it actually do anything?" cost a human round-trip.
     const parsed = parseCliArgs(argv, defaultPort, process.env['CI'] !== undefined);
@@ -750,7 +731,7 @@ function main() {
             void handleRestart(parsed.port, parsed.force);
             break;
         case 'status':
-            handleStatus(parsed.port);
+            void handleStatus(parsed.port);
             break;
         case 'license':
             handleLicense();
@@ -792,7 +773,7 @@ function main() {
             void handleHunt(parsed.dir);
             break;
         case 'gate':
-            void handleGate(parsed.files, parsed.since);
+            void handleGate(parsed.files, parsed.since, parsed.hook);
             break;
         case 'watch':
             handleWatch();
@@ -804,7 +785,7 @@ function main() {
             void handleRollback();
             break;
         case 'mcp':
-            handleMcp(parsed);
+            void handleMcp(parsed);
             break;
         case '_daemon':
             handleDaemonInner(parsed);

package/dist/cloud/cloud-config.d.ts

@@ -1,11 +1,12 @@
 import type { FileSystemPort } from '../project/fs-port.js';
 import { type CloudConfig } from './cloud-sync.js';
 /** `<reticleRoot>/cloud.json` — the project's cloud binding + sync policy (non-secret). */
-export declare const CLOUD_LINK_FILE = "cloud.json";
+/** Re-exported so the existing importers keep working; the string itself lives in core. */
+export declare const CLOUD_LINK_FILE: "cloud.json";
 /** `~/.reticle/credentials.json` — the user's per-cloud-project API keys (the only secret). */
 export declare const CREDENTIALS_FILE = "credentials.json";
 /** What the daemon mirrors to the cloud for a project. Each surface is independently toggleable. */
-export interface SyncPolicy {
+interface SyncPolicy {
     /** Push verification-run artifacts to the dashboard Runs tab. */
     runs: boolean;
     /** Push per-flow project-memory outcomes (the regression history). */
@@ -27,9 +28,30 @@ export interface ProjectCloud {
     /** The cloud project id this project is linked to (for display/logging); null when env-fallback. */
     projectId: string | null;
 }
+/** Look up the API key for a cloud project id in the user credentials map. */
+/**
+ * The API key this machine holds for one project ON ONE CLOUD.
+ *
+ * The store used to be keyed by cloud project id ALONE, which collides in the case that is not rare
+ * at all — it is the default. `reticle link` names every project "default", so a repo linked to a
+ * self-hosted install and a repo linked to the hosted service both claim the slot `default`, and
+ * whichever was linked last wins. Measured: two repos on one machine, and the production key was
+ * being sent to a localhost server, which answered 401.
+ *
+ * That is the same class of defect as sending a session token to a host that did not issue it, and
+ * it deserves the same answer: a credential is scoped to the cloud that minted it, and no credential
+ * at all is better than one belonging to somewhere else.
+ *
+ * Two shapes are accepted. `{ key, url }` is what is written now and is checked against the URL
+ * being dialled. A bare string is the legacy shape, has no URL to check, and is still honoured —
+ * refusing it would silently unlink every repo that predates this change, which is a worse outage
+ * than the collision. Re-linking upgrades a repo to the safe shape.
+ */
+export declare const credentialSlot: (url: string, projectId: string, orgId?: string) => string;
 /**
  * Resolve the cloud picture for a project rooted at `reticleRoot`. Reads the project's link file + the
  * user credential store; if the project isn't linked (no cloud.json), falls back to the global env creds
  * so the single-project / CI flow is unchanged. `homeDir` is injected (testable; `os.homedir()` at call).
  */
 export declare function resolveProjectCloud(fs: FileSystemPort, reticleRoot: string, homeDir: string, env: NodeJS.ProcessEnv): Promise<ProjectCloud>;
+export {};

package/dist/cloud/cloud-config.js

@@ -13,7 +13,8 @@ import { join } from 'node:path';
 import { ReticleDir } from '@reticlehq/core';
 import { resolveCloudConfig } from './cloud-sync.js';
 /** `<reticleRoot>/cloud.json` — the project's cloud binding + sync policy (non-secret). */
-export const CLOUD_LINK_FILE = 'cloud.json';
+/** Re-exported so the existing importers keep working; the string itself lives in core. */
+export const CLOUD_LINK_FILE = ReticleDir.CLOUD_LINK_FILE;
 /** `~/.reticle/credentials.json` — the user's per-cloud-project API keys (the only secret). */
 export const CREDENTIALS_FILE = 'credentials.json';
 const DEFAULT_SYNC_POLICY = { runs: true, memory: true, flows: true };
@@ -43,6 +44,7 @@ function parseLink(raw) {
     const sync = 'object' === typeof o.sync && o.sync !== null ? o.sync : {};
     return {
         projectId: o.projectId,
+        orgId: 'string' === typeof o.orgId && o.orgId.length > 0 ? o.orgId : undefined,
         url: o.url,
         sync: {
             runs: asBool(sync.runs, DEFAULT_SYNC_POLICY.runs),
@@ -53,12 +55,69 @@ function parseLink(raw) {
     };
 }
 /** Look up the API key for a cloud project id in the user credentials map. */
-function credentialFor(raw, projectId) {
+/**
+ * The API key this machine holds for one project ON ONE CLOUD.
+ *
+ * The store used to be keyed by cloud project id ALONE, which collides in the case that is not rare
+ * at all — it is the default. `reticle link` names every project "default", so a repo linked to a
+ * self-hosted install and a repo linked to the hosted service both claim the slot `default`, and
+ * whichever was linked last wins. Measured: two repos on one machine, and the production key was
+ * being sent to a localhost server, which answered 401.
+ *
+ * That is the same class of defect as sending a session token to a host that did not issue it, and
+ * it deserves the same answer: a credential is scoped to the cloud that minted it, and no credential
+ * at all is better than one belonging to somewhere else.
+ *
+ * Two shapes are accepted. `{ key, url }` is what is written now and is checked against the URL
+ * being dialled. A bare string is the legacy shape, has no URL to check, and is still honoured —
+ * refusing it would silently unlink every repo that predates this change, which is a worse outage
+ * than the collision. Re-linking upgrades a repo to the safe shape.
+ */
+export const credentialSlot = (url, projectId, orgId) => orgId === undefined || 0 === orgId.length
+    ? `${normalizeCloudUrl(url)}::${projectId}`
+    : `${normalizeCloudUrl(url)}::org::${orgId}::${projectId}`;
+function credentialFor(raw, projectId, url, orgId) {
     if (typeof raw !== 'object' || null === raw)
         return null;
-    const key = raw[projectId];
-    return 'string' === typeof key && key.length > 0 ? key : null;
+    const store = raw;
+    /*
+     * The ORG slot first, because cloud + project is still not an identity.
+     *
+     * `link` names every project "default", so two ACCOUNTS on one cloud both claimed the slot
+     * `<url>::default` and the last link won. Measured on a laptop: a brand-new workspace ran
+     * `reticle login` and was handed a stored key belonging to a different organisation — valid, so
+     * every validation passed, and every run it pushed would have landed in a stranger's dashboard.
+     * Keying by cloud fixed two clouds colliding; only keying by ORG fixes two tenants colliding.
+     */
+    const orgScoped = orgId === undefined ? undefined : store[credentialSlot(url, projectId, orgId)];
+    if ('string' === typeof orgScoped && orgScoped.length > 0)
+        return orgScoped;
+    /*
+     * Then the cloud+project slot, which is what every repo linked before this change still holds. It
+     * is ambiguous between tenants by construction, which is why it is consulted second and why the
+     * writer above stopped producing it as the only entry.
+     */
+    const composite = store[credentialSlot(url, projectId)];
+    if ('string' === typeof composite && composite.length > 0)
+        return composite;
+    const entry = store[projectId];
+    if ('string' === typeof entry)
+        return entry.length > 0 ? entry : null;
+    if (typeof entry !== 'object' || null === entry)
+        return null;
+    const record = entry;
+    const key = record['key'];
+    const forUrl = record['url'];
+    if ('string' !== typeof key || 0 === key.length)
+        return null;
+    // A credential stamped with a DIFFERENT cloud is not this project's credential, however much the
+    // project ids match. Refuse rather than dial somewhere with somebody else's key.
+    if ('string' === typeof forUrl && normalizeCloudUrl(forUrl) !== normalizeCloudUrl(url))
+        return null;
+    return key;
 }
+/** Trailing slashes are not identity: `https://x/` and `https://x` are one cloud. */
+const normalizeCloudUrl = (url) => url.replace(/\/+$/, '');
 /**
  * Resolve the cloud picture for a project rooted at `reticleRoot`. Reads the project's link file + the
  * user credential store; if the project isn't linked (no cloud.json), falls back to the global env creds
@@ -80,7 +139,7 @@ export async function resolveProjectCloud(fs, reticleRoot, homeDir, env) {
         memory: link.sync.memory ?? DEFAULT_SYNC_POLICY.memory,
         flows: link.sync.flows ?? DEFAULT_SYNC_POLICY.flows,
     };
-    const key = credentialFor(await readJson(fs, join(homeDir, ReticleDir.ROOT, CREDENTIALS_FILE)), link.projectId);
+    const key = credentialFor(await readJson(fs, join(homeDir, ReticleDir.ROOT, CREDENTIALS_FILE)), link.projectId, link.url, link.orgId);
     const config = key !== null ? { url: link.url.replace(/\/+$/, ''), apiKey: key } : null;
     return { config, policy, verify: link.verify, projectId: link.projectId };
 }