@reticlehq/server 2.14.0 → 3.2.0

package/dist/http-server.d.ts

@@ -1,52 +0,0 @@
-import * as http from 'node:http';
-import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export interface SharedServer {
-    readonly httpServer: http.Server;
-    /**
-     * Register a factory that creates a fresh McpServer per SSE connection.
-     * The MCP SDK's Protocol layer only supports one transport per Server instance,
-     * so each concurrent Claude Code client needs its own McpServer.
-     * Must be called before listen.
-     */
-    attachMcp(factory: () => McpServer): void;
-    /** Register the JSON the daemon returns from GET /status (live sessions + health for `reticle status`). */
-    attachStatus(provider: () => unknown): void;
-    /**
-     * Register the handler behind POST /drive: open a driveable browser at `url` and answer with the
-     * session it registered.
-     *
-     * This is how `reticle drive` stops fighting the daemon for the bridge port. The daemon already
-     * owns the browser plane, so driving is a request to it — see cli/drive-attach.ts. Left
-     * unattached, the route 404s, which is exactly what a newer CLI needs to hear from an older daemon.
-     */
-    attachDrive(provider: (url: string) => Promise<unknown>): void;
-    /**
-     * Register a callback fired when the AGENT presence changes — true when the first MCP client (any
-     * agent: Codex/OpenCode/Claude/Hermes) connects, false when the last one disconnects. Agent-
-     * independent: the MCP connection lives exactly as long as the agent session, so its presence IS
-     * "is an agent attached?". The daemon uses this to tell the panel "agent live" vs "agent stopped".
-     */
-    attachAgentPresence(cb: (connected: boolean) => void): void;
-    /**
-     * Tell every attached MCP proxy that this daemon is retiring, BEFORE the sockets go.
-     *
-     * The proxy sees a clean stream end whether the daemon shut down on schedule or died under it, so
-     * without this the two are one row and the transport-stability metric is dominated by the designed
-     * case. Separate from `close()` because it must run before the shutdown work rather than during it:
-     * `close()` is also the cleanup path of a start that failed, where there is nobody to tell.
-     */
-    announceShutdown(): void;
-    close(): Promise<void>;
-}
-/**
- * Creates a shared HTTP server that handles both the WebSocket bridge (browser SDK) and the
- * SSE MCP transport (Claude/agent). Does NOT call listen — caller controls that.
- *
- * Routes:
- * GET /mcp/sse → establishes SSE MCP session
- * POST /mcp/message → routes MCP messages to an active SSE session
- * WS /reticle → browser SDK connections (via WebSocketServer)
- */
-export declare function createSharedServer(options?: {
-    token?: string;
-}): SharedServer;

package/dist/http-server.js

@@ -1,381 +0,0 @@
-import * as http from 'node:http';
-import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
-import { MCP_SSE_PATH, MCP_MESSAGE_PATH, MCP_SHUTDOWN_EVENT, STATUS_PATH, DRIVE_PATH, } from '@reticlehq/core';
-import { getSessionMetrics } from './telemetry/session-metrics.js';
-import { noteAgentPeer, PEER_VERSION_PARAM, PEER_CONTRACT_PARAM } from './version/peer-announce.js';
-import { log } from './log.js';
-import { reportMcpConnected } from './telemetry/mcp-connection.js';
-import { isLoopbackHost, isLocalWebOrigin, isLoopbackPeer, requestToken, tokensMatch, } from './bridge/token-auth.js';
-import { LOOPBACK_IDLE_MS } from './loopback-agent.js';
-/**
- * Creates a shared HTTP server that handles both the WebSocket bridge (browser SDK) and the
- * SSE MCP transport (Claude/agent). Does NOT call listen — caller controls that.
- *
- * Routes:
- * GET /mcp/sse → establishes SSE MCP session
- * POST /mcp/message → routes MCP messages to an active SSE session
- * WS /reticle → browser SDK connections (via WebSocketServer)
- */
-export function createSharedServer(options = {}) {
-    let mcpFactory;
-    let statusProvider;
-    let driveProvider;
-    let agentPresence;
-    const transports = new Map();
-    /**
-     * The raw response behind each SSE session, so the shutdown announcement can be written as an SSE
-     * frame the proxy reads and the agent never sees. `SSEServerTransport.send` only speaks JSON-RPC,
-     * and this message is addressed to the proxy rather than to the client behind it.
-     */
-    const sseStreams = new Map();
-    const token = options.token;
-    // The agent control plane (MCP transport) and /status carry the same trust as the browser WS: a
-    // loopback peer is trusted (the local stdio proxy and `reticle status` always dial 127.0.0.1), but any
-    // non-loopback peer must present the pairing token. Without this, binding the daemon beyond loopback
-    // (RETICLE_HOST) would expose reticle_act/reticle_navigate and session enumeration to the whole network even
-    // though the WS demanded a token. When no token is configured the bind is loopback-only anyway.
-    //
-    // Loopback-peer trust alone is not enough: a DNS-rebound webpage reaches us AS a loopback peer while
-    // its browser sends the attacker's original Host/Origin. So the loopback-trust tier additionally
-    // requires a loopback Host header and a loopback-or-absent Origin/Referer — the same rebinding
-    // defense the WS bridge has (#originAllowed). A rebound page fails those and falls through to the
-    // token check (which it cannot satisfy). Legitimate remote clients on a RETICLE_HOST bind present the
-    // token instead of relying on loopback trust, so this never breaks them.
-    const authorized = (req, url) => {
-        const localClient = isLoopbackPeer(req.socket.remoteAddress) &&
-            isLoopbackHost(req.headers.host) &&
-            isLocalWebOrigin(req.headers.origin, req.headers.referer);
-        if (localClient)
-            return true;
-        if (token === undefined)
-            return false;
-        return tokensMatch(token, requestToken(req, url));
-    };
-    const httpServer = http.createServer((req, res) => {
-        const rawUrl = req.url ?? '/';
-        // Node's HTTP parser accepts request targets the WHATWG URL parser refuses (`//` among them), and
-        // a throw in a `request` listener is an uncaughtException — which the daemon answers by exiting,
-        // taking every agent and every browser session on this port with it, from whichever project. One
-        // malformed line on a loopback socket, and it lands BEFORE the authorization check below, so
-        // nothing had to be trusted to send it.
-        const url = parseRequestTarget(rawUrl);
-        if (null === url) {
-            log('http_bad_request_target', {});
-            res.writeHead(400, { 'Content-Type': 'text/plain' });
-            res.end('bad request target');
-            return;
-        }
-        const path = url.pathname;
-        if (path === STATUS_PATH ||
-            path === DRIVE_PATH ||
-            path === MCP_SSE_PATH ||
-            path === MCP_MESSAGE_PATH) {
-            if (!authorized(req, url)) {
-                res.writeHead(401, { 'Content-Type': 'text/plain' });
-                res.end('unauthorized');
-                return;
-            }
-        }
-        if ('GET' === req.method && path === STATUS_PATH) {
-            const body = JSON.stringify(statusProvider?.() ?? { running: true });
-            res.writeHead(200, { 'Content-Type': 'application/json' });
-            res.end(body);
-            return;
-        }
-        if ('POST' === req.method && path === DRIVE_PATH) {
-            if (driveProvider === undefined) {
-                res.writeHead(404, { 'Content-Type': 'text/plain' });
-                res.end('not found');
-                return;
-            }
-            // A state-changing route must require a content type that a browser cannot send without a
-            // preflight. `text/plain`, `application/x-www-form-urlencoded` and `multipart/form-data` make
-            // a POST a CORS SIMPLE request: the browser sends it cross-origin with no preflight, and
-            // blocking the response afterwards does not un-drive the browser. Since loopback origins are
-            // authorized here by design, any page on any localhost port could otherwise reach this route
-            // by guessing ours, and drive a browser to a URL it chose.
-            //
-            // Requiring `application/json` forces a preflight, which the browser will not complete without
-            // our opt-in, and we do not opt in. One header check closes the whole class.
-            if (!isJsonRequest(req)) {
-                res.writeHead(415, { 'Content-Type': 'text/plain' });
-                res.end('expected content-type: application/json');
-                return;
-            }
-            const provider = driveProvider;
-            readBody(req)
-                .then(async (body) => {
-                const url = urlFromDriveRequest(body);
-                if (url === undefined) {
-                    res.writeHead(400, { 'Content-Type': 'text/plain' });
-                    res.end('drive requires a url');
-                    return;
-                }
-                // Before the browser is asked for anything. See driveSchemeRefusal.
-                const refusal = driveSchemeRefusal(url);
-                if (refusal !== undefined) {
-                    res.writeHead(400, { 'Content-Type': 'text/plain' });
-                    res.end(refusal);
-                    return;
-                }
-                // A refusal is an ANSWER. The caller is a foreground CLI waiting on this socket: a thrown
-                // handler that took the response down with it would hang `reticle drive` on a request
-                // that can never complete — the same shape of silence the raw EADDRINUSE bind had.
-                const payload = await provider(url).catch((err) => ({
-                    error: err instanceof Error ? err.message : String(err),
-                }));
-                res.writeHead(200, { 'Content-Type': 'application/json' });
-                res.end(JSON.stringify(payload));
-            })
-                .catch((err) => {
-                log('drive_request_error', { error: err instanceof Error ? err.message : String(err) });
-                res.writeHead(500, { 'Content-Type': 'text/plain' });
-                res.end('drive failed');
-            });
-            return;
-        }
-        if ('GET' === req.method && path === MCP_SSE_PATH) {
-            // The agent's MCP server announces itself here, on the connect it already makes. The daemon is
-            // the single judge of skew, so this is where the third pair is decided — and unlike the CLI's
-            // own check (a stderr line no agent reads), a nudge queued here rides out on the agent's next
-            // tool result. That is the pair the user hits after `npm update`: a cached npx MCP package
-            // talking to a daemon from a different build.
-            noteAgentPeer(url.searchParams.get(PEER_VERSION_PARAM), url.searchParams.get(PEER_CONTRACT_PARAM));
-            if (mcpFactory === undefined) {
-                res.writeHead(503, { 'Content-Type': 'text/plain' });
-                res.end('MCP server not ready');
-                return;
-            }
-            // Fresh McpServer per connection: the MCP SDK's Protocol layer only supports
-            // one active transport per Server instance, so concurrent clients each need
-            // their own instance backed by the same shared ToolDeps.
-            const mcpServer = mcpFactory();
-            const transport = new SSEServerTransport(MCP_MESSAGE_PATH, res);
-            const sid = transport.sessionId;
-            transports.set(sid, transport);
-            sseStreams.set(sid, res);
-            if (1 === transports.size)
-                agentPresence?.(true); // first agent attached
-            res.on('close', () => {
-                transports.delete(sid);
-                sseStreams.delete(sid);
-                transport.close().catch(() => undefined);
-                mcpServer.close().catch(() => undefined);
-                log('mcp_client_disconnected', { sessionId: sid });
-                // The one part of `endReason` a query cannot derive: "the client detached" and "the agent
-                // stopped asking" produce identical counters and are different findings.
-                try {
-                    getSessionMetrics().recordClientLeft();
-                }
-                catch {
-                    /* a counter must never affect a disconnect path */
-                }
-                if (0 === transports.size)
-                    agentPresence?.(false); // last agent detached → it's the human's turn
-            });
-            mcpServer
-                .connect(transport)
-                .then(() => {
-                log('mcp_client_connected', { sessionId: sid });
-                // The one signal that separates "Reticle is running" from "somebody is USING it": a daemon
-                // can sit up for days with nothing attached. It also exposes reconnect churn, which is
-                // indistinguishable from healthy usage in every other metric.
-                reportMcpConnected();
-            })
-                .catch((err) => {
-                const message = err instanceof Error ? err.message : String(err);
-                log('mcp_connect_error', { error: message });
-            });
-            return;
-        }
-        if ('POST' === req.method && path === MCP_MESSAGE_PATH) {
-            const sessionId = url.searchParams.get('sessionId');
-            if (null === sessionId) {
-                res.writeHead(400, { 'Content-Type': 'text/plain' });
-                res.end('missing sessionId');
-                return;
-            }
-            const transport = transports.get(sessionId);
-            if (transport === undefined) {
-                res.writeHead(404, { 'Content-Type': 'text/plain' });
-                res.end('session not found');
-                return;
-            }
-            transport.handlePostMessage(req, res).catch((err) => {
-                const message = err instanceof Error ? err.message : String(err);
-                log('mcp_message_error', { error: message });
-            });
-            return;
-        }
-        res.writeHead(404, { 'Content-Type': 'text/plain' });
-        res.end('not found');
-    });
-    function attachStatus(provider) {
-        statusProvider = provider;
-    }
-    function attachDrive(provider) {
-        driveProvider = provider;
-    }
-    function attachAgentPresence(cb) {
-        agentPresence = cb;
-    }
-    function attachMcp(factory) {
-        mcpFactory = factory;
-    }
-    function announceShutdown() {
-        for (const [sid, stream] of sseStreams) {
-            try {
-                stream.write(`event: ${MCP_SHUTDOWN_EVENT}\ndata: {}\n\n`);
-            }
-            catch {
-                // A stream we cannot write to is a proxy that already left. Announcing a shutdown must never
-                // be the reason a shutdown fails.
-                log('mcp_shutdown_announce_failed', { sessionId: sid });
-            }
-        }
-    }
-    async function close() {
-        for (const transport of transports.values()) {
-            await transport.close();
-        }
-        transports.clear();
-        sseStreams.clear();
-        await new Promise((resolve, reject) => {
-            httpServer.close((err) => {
-                // A server that never listened is already closed, and saying so is not an error worth
-                // propagating. It matters because this close() runs on the CLEANUP path of a failed
-                // `--drive`: when the app URL is unreachable, the daemon tears down before `listen()` has
-                // been called, Node rejects with ERR_SERVER_NOT_RUNNING, and that rejection REPLACES the
-                // real cause. The user's app is down and the message they read is "Server is not running",
-                // which blames Reticle for their dev server — traced live, where swallowing this turned the
-                // same failure back into "net::ERR_CONNECTION_REFUSED at http://localhost:4312/".
-                if (err !== undefined &&
-                    err !== null &&
-                    'ERR_SERVER_NOT_RUNNING' !== err.code) {
-                    reject(err);
-                }
-                else
-                    resolve();
-            });
-        });
-    }
-    /**
-     * The daemon's half of the keep-alive pact with `loopbackAgent`.
-     *
-     * Node's default is 5 seconds, and the proxy's POST leg is one request per JSON-RPC message. An
-     * agent thinks for longer than 5s between tool calls essentially always, so with the default every
-     * tool call had to open a fresh socket however the client was configured — which on Windows ends
-     * in `ENOBUFS`. This has to stay ABOVE `LOOPBACK_IDLE_MS` so the CLIENT is always the side that
-     * retires an idle socket: if the server closed first, the proxy would keep picking up sockets that
-     * were already gone. It also has to stay below Node's 60s default `headersTimeout`.
-     */
-    httpServer.keepAliveTimeout = LOOPBACK_IDLE_MS + 10_000;
-    return {
-        httpServer,
-        attachMcp,
-        attachStatus,
-        attachDrive,
-        attachAgentPresence,
-        announceShutdown,
-        close,
-    };
-}
-/** Cap on a drive request body. A url is short; anything larger is not one. */
-const MAX_DRIVE_BODY_BYTES = 8 * 1024;
-/** Collect a request body, refusing one too large to be what this route accepts. */
-/**
- * Is this a request a cross-origin page could NOT have sent without a preflight?
- *
- * The three CORS "simple" content types are the whole attack surface here, so anything that is not
- * JSON is refused rather than sniffed. Parameters are allowed (`application/json; charset=utf-8`)
- * because real clients send them.
- */
-const JSON_MEDIA_TYPE = 'application/json';
-function isJsonRequest(req) {
-    // Read through the typed accessor rather than indexing the header bag: the index signature is
-    // `any`-shaped, and narrowing after an unsafe read is narrowing a lie.
-    const value = req.headersDistinct['content-type']?.[0];
-    if (undefined === value)
-        return false;
-    return JSON_MEDIA_TYPE === value.split(';')[0]?.trim().toLowerCase();
-}
-function readBody(req) {
-    return new Promise((resolve, reject) => {
-        let body = '';
-        req.setEncoding('utf8');
-        req.on('data', (chunk) => {
-            body += chunk;
-            if (body.length > MAX_DRIVE_BODY_BYTES) {
-                req.destroy();
-                reject(new Error('body too large'));
-            }
-        });
-        req.on('end', () => resolve(body));
-        req.on('error', reject);
-    });
-}
-/** The `url` out of a drive request body, or undefined when there isn't a usable one. Pure. */
-/**
- * The schemes the daemon will open in a browser it owns.
- *
- * `drive` exists to drive a running web app, and nothing in the product hands this route anything
- * else — the desktop paths have their own runtimes and never come through here. So the allowlist
- * costs nothing real and closes a class outright.
- *
- * Kept deliberately small. `file:` reads the disk through a browser context WE opened, `data:` is a
- * page that came from nowhere, and `javascript:` is not a document at all. None of them is a thing
- * anybody drives.
- *
- * Worth stating what this is NOT: the CORS defence on the route already keeps a web page off it,
- * because a JSON content type forces a preflight nobody opts into. The caller reaching this check is
- * a local process, which already has broader access than the check removes. It is hygiene about what
- * the daemon will open on request, not a security boundary — and a refusal here should read as a
- * refusal, not an alarm.
- */
-const DRIVEABLE_SCHEMES = ['http:', 'https:'];
-/** The scheme of `url`, or undefined when it is not a URL at all. */
-function schemeOf(url) {
-    try {
-        return new URL(url).protocol;
-    }
-    catch {
-        return undefined;
-    }
-}
-function driveSchemeRefusal(url) {
-    const scheme = schemeOf(url);
-    if (scheme !== undefined && DRIVEABLE_SCHEMES.includes(scheme))
-        return undefined;
-    // Names what it got, because the caller is a CLI printing this to somebody who typed the url and
-    // needs to see which part of it was the problem.
-    return (`unsupported scheme ${scheme ?? '(unparseable url)'} — reticle drive opens a running web app, ` +
-        `so it accepts ${DRIVEABLE_SCHEMES.join(' and ')} only`);
-}
-function urlFromDriveRequest(body) {
-    let parsed;
-    try {
-        parsed = JSON.parse(body);
-    }
-    catch {
-        return undefined;
-    }
-    if (typeof parsed !== 'object' || null === parsed)
-        return undefined;
-    const url = parsed['url'];
-    return 'string' === typeof url && url.length > 0 ? url : undefined;
-}
-/**
- * The one URL parse on the daemon's request path, and the only place allowed to do it.
- *
- * `null` for anything the parser refuses, so the caller answers rather than throwing. Exported for
- * nothing — it is here, next to its single caller, because a second copy of this parse elsewhere in
- * the handler would reintroduce the crash the guard exists to remove.
- */
-function parseRequestTarget(rawUrl) {
-    try {
-        return new URL(rawUrl, 'http://localhost');
-    }
-    catch {
-        return null;
-    }
-}

package/dist/impact/impact-recorder.d.ts

@@ -1,46 +0,0 @@
-import { type ImpactCounts, type ImpactDefect, type ImpactSnapshot } from '@reticlehq/core';
-import { ImpactStore, type ImpactFoldMeta } from './impact-store.js';
-/**
- * Wire the DEFAULT root — the daemon's own. Idempotent; the first one wins.
- *
- * Still idempotent, and still first-wins, because the daemon's own root genuinely does not change
- * while it runs. What changed is that this is no longer the ONLY root: a call that knows its
- * project passes one, and this is the fallback for calls that do not.
- */
-export declare function initImpact(opts: {
-    reticleRoot: string | undefined;
-    projectName?: string;
-    now?: () => number;
-}): ImpactStore | undefined;
-/** The live store for a root (default when omitted), if one has been initialised. */
-export declare function impactStore(root?: string): ImpactStore | undefined;
-/** Test seam: drop the stores so a suite can start from a clean record. */
-export declare function resetImpactForTest(): void;
-/**
- * Record one delta against a project's ledger. Never throws: stats must not break a tool call.
- *
- * `root` is the `.reticle` directory this call's evidence belongs to. Omitted means "could not tell
- * which project", which falls back to the daemon's own root — the old behaviour, kept for the paths
- * that genuinely have no session to ask.
- */
-export declare function recordImpact(delta: Partial<ImpactCounts>, meta?: ImpactFoldMeta, root?: string): void;
-export declare function impactSnapshot(root?: string): ImpactSnapshot | undefined;
-/**
- * What one tool call did, as counters.
- *
- * Pure and exported so the shape is testable without a dispatch: given a result and a duration, it
- * says what the record should gain. `verified` is the only field that can mint a verdict, which is
- * the same rule the product states to agents - everything else moves or reads the app.
- */
-export declare function deltaForToolResult(raw: unknown, durationMs: number, refused: boolean): Partial<ImpactCounts>;
-/**
- * What one FAILED verdict was, in a line.
- *
- * Only a verified:"no" produces one. That is the same rule the counters follow and the same rule
- * the product states to agents: an "unknown" is not a defect, it is Reticle admitting it could not
- * tell — recording those here would fill the user's short list with the tool's own blind spots.
- *
- * Everything is read from the result the tool already returned, so this costs nothing extra and
- * cannot disagree with the verdict it describes.
- */
-export declare function defectForToolResult(raw: unknown, at: number): ImpactDefect | undefined;

package/dist/impact/impact-recorder.js

@@ -1,159 +0,0 @@
-import { Verified, } from '@reticlehq/core';
-import { estimateTokens } from '../session/output-budget.js';
-import { ImpactStore } from './impact-store.js';
-/**
- * The daemon's impact recorders — ONE PER PROJECT ROOT.
- *
- * This was a single module-level store, and "the first root wins for the daemon's lifetime" was
- * written down as if it were a design decision. It is only correct for a daemon that serves one
- * project, and this daemon has never been that: `artifactRootFor` exists precisely because one
- * daemon serves many, and nine modules already route their artifacts by the SESSION's project.
- *
- * Measured, not theorised: with a daemon rooted at repo A, two verdicts driven against app B landed
- * in A's `impact.json` — B's own ledger never moved — and A's cloud link then carried them to a
- * PRODUCTION dashboard belonging to a different account than B was linked to. The impact ledger is
- * what the whole dashboard is computed from, so this was the one artifact whose misrouting was
- * guaranteed to be visible and billed.
- *
- * Keyed by root path, so two projects driven through one daemon keep separate ledgers, and the
- * daemon's own root remains the answer for anything that cannot name a project.
- */
-/** One store per `.reticle` root. */
-const stores = new Map();
-/** The daemon's own root — used when a call cannot say which project it was for. */
-let defaultRoot;
-/** Held so a per-root store is built with the same clock and project name as the default. */
-let storeOpts = {};
-/** Get-or-create the store for one root. */
-function storeFor(root) {
-    const key = root ?? defaultRoot;
-    if (key === undefined || 0 === key.length)
-        return undefined;
-    let found = stores.get(key);
-    if (found === undefined) {
-        found = new ImpactStore({ ...storeOpts, reticleRoot: key });
-        stores.set(key, found);
-    }
-    return found;
-}
-/**
- * Wire the DEFAULT root — the daemon's own. Idempotent; the first one wins.
- *
- * Still idempotent, and still first-wins, because the daemon's own root genuinely does not change
- * while it runs. What changed is that this is no longer the ONLY root: a call that knows its
- * project passes one, and this is the fallback for calls that do not.
- */
-export function initImpact(opts) {
-    // No root, no record. Programmatic callers and test doubles build their own deps and are not
-    // obliged to carry one, and a courtesy counter must never be the reason a tool call throws.
-    if (opts.reticleRoot === undefined || 0 === opts.reticleRoot.length)
-        return storeFor(undefined);
-    if (defaultRoot === undefined) {
-        defaultRoot = opts.reticleRoot;
-        const { projectName, now } = opts;
-        storeOpts = {
-            ...(projectName === undefined ? {} : { projectName }),
-            ...(now === undefined ? {} : { now }),
-        };
-    }
-    return storeFor(opts.reticleRoot);
-}
-/** The live store for a root (default when omitted), if one has been initialised. */
-export function impactStore(root) {
-    return storeFor(root);
-}
-/** Test seam: drop the stores so a suite can start from a clean record. */
-export function resetImpactForTest() {
-    stores.clear();
-    defaultRoot = undefined;
-    storeOpts = {};
-}
-/**
- * Record one delta against a project's ledger. Never throws: stats must not break a tool call.
- *
- * `root` is the `.reticle` directory this call's evidence belongs to. Omitted means "could not tell
- * which project", which falls back to the daemon's own root — the old behaviour, kept for the paths
- * that genuinely have no session to ask.
- */
-export function recordImpact(delta, meta = {}, root) {
-    try {
-        storeFor(root)?.record(delta, meta);
-    }
-    catch {
-        // Counting is a courtesy to the user; failing to count is not worth failing their call over.
-    }
-}
-export function impactSnapshot(root) {
-    return storeFor(root)?.snapshot();
-}
-/**
- * What one tool call did, as counters.
- *
- * Pure and exported so the shape is testable without a dispatch: given a result and a duration, it
- * says what the record should gain. `verified` is the only field that can mint a verdict, which is
- * the same rule the product states to agents - everything else moves or reads the app.
- */
-export function deltaForToolResult(raw, durationMs, refused) {
-    const delta = {
-        calls: 1,
-        drivingMs: Math.max(0, Math.round(durationMs)),
-        tokensReturned: estimateTokens(JSON.stringify(raw) ?? ''),
-    };
-    if (refused) {
-        delta.refusals = 1;
-        return delta;
-    }
-    const verified = isRecord(raw) ? raw['verified'] : undefined;
-    if (verified === Verified.YES) {
-        delta.verdicts = 1;
-        delta.passed = 1;
-    }
-    else if (verified === Verified.NO) {
-        delta.verdicts = 1;
-        delta.failed = 1;
-    }
-    else if (verified === Verified.UNKNOWN) {
-        delta.verdicts = 1;
-        delta.unknown = 1;
-    }
-    return delta;
-}
-/**
- * What one FAILED verdict was, in a line.
- *
- * Only a verified:"no" produces one. That is the same rule the counters follow and the same rule
- * the product states to agents: an "unknown" is not a defect, it is Reticle admitting it could not
- * tell — recording those here would fill the user's short list with the tool's own blind spots.
- *
- * Everything is read from the result the tool already returned, so this costs nothing extra and
- * cannot disagree with the verdict it describes.
- */
-export function defectForToolResult(raw, at) {
-    if (!isRecord(raw) || raw['verified'] !== Verified.NO)
-        return undefined;
-    const effect = isRecord(raw['effect']) ? raw['effect'] : undefined;
-    const verdict = isRecord(raw['verdict']) ? raw['verdict'] : undefined;
-    const named = text(effect?.['name']) ?? text(effect?.['testid']) ?? text(effect?.['component']);
-    const why = text(verdict?.['failureReason']) ?? text(raw['because']);
-    const defect = {
-        at,
-        // The control that was acted on, when the result names one — "Sign In did not sign in" is a
-        // sentence somebody can act on; "a verdict failed" is not.
-        title: named === undefined ? (why ?? 'a declared consequence did not hold') : named,
-    };
-    if (named !== undefined && why !== undefined)
-        defect.detail = why;
-    const source = text(raw['source']);
-    if (source !== undefined)
-        defect.source = source;
-    return defect;
-}
-function text(value) {
-    if ('string' !== typeof value)
-        return undefined;
-    const trimmed = value.trim();
-    return 0 === trimmed.length ? undefined : trimmed;
-}
-function isRecord(value) {
-    return 'object' === typeof value && null !== value;
-}