@reticlehq/server 3.1.0 → 3.2.0

package/dist/features/harness/openai-driver.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The harness driver for OpenAI's Chat Completions API.
+ *
+ * Third driver, and the reason it exists is comparison rather than capability: people want to know
+ * whether the cheap typed-decision model is good enough for THEIR app, and "cheap versus one
+ * frontier model" is a weaker answer than "cheap versus the two they might otherwise reach for".
+ *
+ * A translation layer, exactly like `driver.ts` — the loop lives in `harness.ts` against
+ * `ModelDriver` and knows nothing about any wire. Chat Completions is a genuinely different shape
+ * from the Messages API, and translating OpenAI into Anthropic's wire on the platform side was
+ * considered and rejected there: it would put a second, undeclared model-shaped transformation
+ * inside the thing being measured. So this speaks the native format and the arm measures OpenAI.
+ *
+ * NOT cache-annotated, and that is a real asymmetry to hold in mind when reading a cost comparison
+ * against the Anthropic arm. OpenAI caches long prefixes automatically and reports it back in
+ * `usage.prompt_tokens_details.cached_tokens`, so the saving is not something this driver arranges;
+ * it is reported below so the number is visible rather than assumed.
+ */
+import type { ModelDriver } from './harness.js';
+import type { HarnessFetch } from './driver.js';
+/**
+ * The default model.
+ *
+ * Deliberately not the largest available, for the same reason `DEFAULT_HARNESS_MODEL` is not: the
+ * driver is choosing what to touch next, and the engine decides the verdict from evidence. A driver
+ * that needed a frontier model would be evidence the engine was not doing its job.
+ */
+export declare const DEFAULT_OPENAI_MODEL = "gpt-5.6-luna";
+export declare const DEFAULT_OPENAI_BASE_URL = "https://api.openai.com";
+export interface OpenAiDriverOptions {
+    apiKey: string;
+    model?: string;
+    baseUrl?: string;
+    /** Injected for tests. Defaults to the platform `fetch`. */
+    fetch?: HarnessFetch;
+}
+/**
+ * Read this driver's configuration out of the environment.
+ *
+ * A real OpenAI key goes to OpenAI. The platform key goes to the platform, which forwards with its
+ * own — so somebody who has run `reticle link` can drive with this model having never held an
+ * OpenAI key, which is the entire point of the proxy.
+ */
+export declare function openAiOptionsFromEnv(env: Record<string, string | undefined>): OpenAiDriverOptions | undefined;
+/** Build a driver backed by Chat Completions. */
+export declare function openAiDriver(options: OpenAiDriverOptions): ModelDriver;

package/dist/features/harness/openai-driver.js

@@ -0,0 +1,197 @@
+/**
+ * The harness driver for OpenAI's Chat Completions API.
+ *
+ * Third driver, and the reason it exists is comparison rather than capability: people want to know
+ * whether the cheap typed-decision model is good enough for THEIR app, and "cheap versus one
+ * frontier model" is a weaker answer than "cheap versus the two they might otherwise reach for".
+ *
+ * A translation layer, exactly like `driver.ts` — the loop lives in `harness.ts` against
+ * `ModelDriver` and knows nothing about any wire. Chat Completions is a genuinely different shape
+ * from the Messages API, and translating OpenAI into Anthropic's wire on the platform side was
+ * considered and rejected there: it would put a second, undeclared model-shaped transformation
+ * inside the thing being measured. So this speaks the native format and the arm measures OpenAI.
+ *
+ * NOT cache-annotated, and that is a real asymmetry to hold in mind when reading a cost comparison
+ * against the Anthropic arm. OpenAI caches long prefixes automatically and reports it back in
+ * `usage.prompt_tokens_details.cached_tokens`, so the saving is not something this driver arranges;
+ * it is reported below so the number is visible rather than assumed.
+ */
+import { z } from 'zod';
+import { ReticleEnv, apiKeyFrom } from '@reticlehq/core';
+/**
+ * The default model.
+ *
+ * Deliberately not the largest available, for the same reason `DEFAULT_HARNESS_MODEL` is not: the
+ * driver is choosing what to touch next, and the engine decides the verdict from evidence. A driver
+ * that needed a frontier model would be evidence the engine was not doing its job.
+ */
+export const DEFAULT_OPENAI_MODEL = 'gpt-5.6-luna';
+export const DEFAULT_OPENAI_BASE_URL = 'https://api.openai.com';
+/** The platform's own path, which forwards with Reticle's key rather than the caller's. */
+const PLATFORM_PATH = '/v1/model/openai';
+const OPENAI_PATH = '/v1/chat/completions';
+/** Output cap per turn. A driving turn is a sentence and a tool call, never an essay. */
+const MAX_TOKENS = 4096;
+/** How much of one tool result the model is allowed to see. Same reasoning as the Anthropic driver. */
+const MAX_RESULT_CHARS = 8000;
+const ToolCall = z.object({
+    id: z.string(),
+    function: z.object({ name: z.string(), arguments: z.string().default('{}') }),
+});
+const ChatResponse = z.object({
+    choices: z
+        .array(z.object({
+        message: z.object({
+            content: z.string().nullish(),
+            tool_calls: z.array(ToolCall).nullish(),
+        }),
+    }))
+        .default([]),
+    usage: z
+        .object({
+        prompt_tokens: z.number().default(0),
+        completion_tokens: z.number().default(0),
+        prompt_tokens_details: z.object({ cached_tokens: z.number().nullish() }).nullish(),
+    })
+        .default({ prompt_tokens: 0, completion_tokens: 0 }),
+});
+/**
+ * Read this driver's configuration out of the environment.
+ *
+ * A real OpenAI key goes to OpenAI. The platform key goes to the platform, which forwards with its
+ * own — so somebody who has run `reticle link` can drive with this model having never held an
+ * OpenAI key, which is the entire point of the proxy.
+ */
+export function openAiOptionsFromEnv(env) {
+    const model = env[ReticleEnv.HARNESS_OPENAI_MODEL];
+    const withModel = (rest) => ({
+        ...rest,
+        ...(model === undefined || 0 === model.length ? {} : { model }),
+    });
+    const direct = env[ReticleEnv.HARNESS_OPENAI_KEY];
+    if (direct !== undefined && 0 < direct.length)
+        return withModel({ apiKey: direct });
+    const cloudKey = apiKeyFrom(env);
+    const cloudUrl = env[ReticleEnv.CLOUD_URL];
+    if (cloudKey === undefined || 0 === cloudKey.length)
+        return undefined;
+    if (cloudUrl === undefined || 0 === cloudUrl.length)
+        return undefined;
+    return withModel({ apiKey: cloudKey, baseUrl: cloudUrl });
+}
+function toWireTool(tool) {
+    return {
+        type: 'function',
+        function: { name: tool.name, description: tool.description, parameters: tool.inputSchema },
+    };
+}
+function truncate(text) {
+    return text.length <= MAX_RESULT_CHARS
+        ? text
+        : `${text.slice(0, MAX_RESULT_CHARS)}\n…[truncated: ${String(text.length - MAX_RESULT_CHARS)} more characters]`;
+}
+/**
+ * The history, in Chat Completions' shape.
+ *
+ * The one structural difference from the Messages API, and it matters: a tool result is its OWN
+ * message carrying `tool_call_id`, where Anthropic puts every result for a turn into one user
+ * message. So a turn with three parallel calls becomes one assistant message and three tool
+ * messages. That is the format's requirement rather than a choice — an unanswered `tool_call_id`
+ * is rejected outright, so every outcome must be emitted, including the failures.
+ */
+function toWireMessages(history) {
+    const messages = [];
+    for (const entry of history) {
+        if ('user' === entry.role) {
+            messages.push({ role: 'user', content: entry.text });
+            continue;
+        }
+        if ('assistant' === entry.role) {
+            messages.push({
+                role: 'assistant',
+                content: 0 === entry.text.length ? null : entry.text,
+                ...(0 === entry.calls.length
+                    ? {}
+                    : {
+                        tool_calls: entry.calls.map((call) => ({
+                            id: call.id,
+                            type: 'function',
+                            function: { name: call.name, arguments: JSON.stringify(call.args) },
+                        })),
+                    }),
+            });
+            continue;
+        }
+        for (const outcome of entry.outcomes) {
+            messages.push({
+                role: 'tool',
+                tool_call_id: outcome.id,
+                content: truncate(JSON.stringify(outcome.result)),
+            });
+        }
+    }
+    return messages;
+}
+/** Arguments arrive as a JSON STRING here, not an object — a malformed one is empty, never a throw. */
+function parseArgs(raw) {
+    try {
+        const parsed = JSON.parse(raw);
+        return 'object' === typeof parsed && null !== parsed ? parsed : {};
+    }
+    catch {
+        return {};
+    }
+}
+/** Build a driver backed by Chat Completions. */
+export function openAiDriver(options) {
+    const model = options.model ?? DEFAULT_OPENAI_MODEL;
+    const baseUrl = options.baseUrl ?? DEFAULT_OPENAI_BASE_URL;
+    const doFetch = options.fetch ?? ((url, init) => fetch(url, init));
+    // The platform does not expose `/v1/chat/completions`; it exposes its own path and forwards. A
+    // base URL that is not OpenAI's is the platform's, which is the only other thing this talks to.
+    const path = DEFAULT_OPENAI_BASE_URL === baseUrl ? OPENAI_PATH : PLATFORM_PATH;
+    return {
+        async turn(input) {
+            const response = await doFetch(`${baseUrl}${path}`, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    authorization: `Bearer ${options.apiKey}`,
+                },
+                body: JSON.stringify({
+                    model,
+                    max_completion_tokens: MAX_TOKENS,
+                    tools: input.tools.map(toWireTool),
+                    messages: [{ role: 'system', content: input.system }, ...toWireMessages(input.history)],
+                }),
+            });
+            const body = await response.text();
+            // Thrown, not returned: a model that will not answer is a BROKEN drive, and a broken drive is
+            // never reported as clean. Swallowing it would be a verdict about an app nobody drove.
+            if (!response.ok)
+                throw new Error(`the model refused the request (HTTP ${String(response.status)}): ${body}`);
+            const parsed = ChatResponse.parse(JSON.parse(body));
+            const message = parsed.choices[0]?.message;
+            const calls = (message?.tool_calls ?? []).map((call) => ({
+                id: call.id,
+                name: call.function.name,
+                args: parseArgs(call.function.arguments),
+            }));
+            const cached = parsed.usage.prompt_tokens_details?.cached_tokens ?? 0;
+            return {
+                text: message?.content ?? '',
+                calls,
+                usage: {
+                    // `prompt_tokens` INCLUDES the cached ones here, unlike the Messages API where the two are
+                    // disjoint. Subtracting keeps `input` meaning the same thing in both drivers: what was
+                    // processed at full price. A cost comparison that summed them would charge the arm that
+                    // cached well for the tokens it did not pay full price for.
+                    input: Math.max(parsed.usage.prompt_tokens - cached, 0),
+                    output: parsed.usage.completion_tokens,
+                    cacheRead: cached,
+                    cacheWrite: 0,
+                },
+            };
+        },
+    };
+}

package/dist/features/harness/platform-config.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The driver preference a person set on the platform, read by the daemon that has to honour it.
+ *
+ * Choosing a model in a web UI is worth nothing if the thing doing the driving never asks. This is
+ * the one call that closes that loop: the console writes a per-project preference, and the daemon
+ * reads it before it builds a driver.
+ *
+ * Three rules shape all of it, and they are the difference between a preference and an outage:
+ *
+ *   - it is a PREFERENCE, not a credential. Every failure — no key, no host, a timeout, a 500, a
+ *     body that does not parse — answers `undefined`, and the caller falls back to what the
+ *     environment says. A drive must never fail because a settings endpoint was slow.
+ *   - it is BOUNDED. The fetch is aborted rather than awaited indefinitely. A drive that hangs
+ *     holds a leased browser context with nothing anywhere saying why, and "the preferences API was
+ *     unreachable" is the worst possible reason for that to happen.
+ *   - it never overrides someone who was EXPLICIT. A driver named in the call, or set in the
+ *     environment, wins over the stored preference. Precedence lives in the caller.
+ */
+/** The subset of the platform's answer the harness acts on. */
+export interface PlatformModelConfig {
+    /** `jev` | `anthropic` | `openai`, as the platform spells it. Not validated here. */
+    provider: string;
+    /** Whether the person wants autonomous driving at all. */
+    harnessEnabled: boolean;
+    /**
+     * Whether this workspace may drive on OUR model spend — a claimed free period, or a paid plan.
+     *
+     * Deliberately a second boolean rather than folded into `harnessEnabled`. One is a switch a person
+     * set, the other is a fact about their account, and a daemon that could not tell them apart would
+     * report "you turned this off" to somebody whose free months quietly ran out.
+     */
+    harnessEntitled: boolean;
+}
+/** A GET, narrowed to what this file uses, so a test can answer it without a network. */
+export type ConfigFetch = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    signal?: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    text(): Promise<string>;
+}>;
+/**
+ * Ask the platform which model this project wants driving with.
+ *
+ * `undefined` means "no answer", and every caller must treat that as "carry on with the
+ * environment" rather than as a failure worth reporting. There is deliberately no error channel:
+ * an unreachable settings endpoint is not something the person running a drive can act on, and a
+ * warning printed on a path that then works correctly is how people learn to ignore stderr.
+ */
+export declare function fetchPlatformConfig(env: Record<string, string | undefined>, doFetch?: ConfigFetch, timeoutMs?: number): Promise<PlatformModelConfig | undefined>;

package/dist/features/harness/platform-config.js

@@ -0,0 +1,89 @@
+/**
+ * The driver preference a person set on the platform, read by the daemon that has to honour it.
+ *
+ * Choosing a model in a web UI is worth nothing if the thing doing the driving never asks. This is
+ * the one call that closes that loop: the console writes a per-project preference, and the daemon
+ * reads it before it builds a driver.
+ *
+ * Three rules shape all of it, and they are the difference between a preference and an outage:
+ *
+ *   - it is a PREFERENCE, not a credential. Every failure — no key, no host, a timeout, a 500, a
+ *     body that does not parse — answers `undefined`, and the caller falls back to what the
+ *     environment says. A drive must never fail because a settings endpoint was slow.
+ *   - it is BOUNDED. The fetch is aborted rather than awaited indefinitely. A drive that hangs
+ *     holds a leased browser context with nothing anywhere saying why, and "the preferences API was
+ *     unreachable" is the worst possible reason for that to happen.
+ *   - it never overrides someone who was EXPLICIT. A driver named in the call, or set in the
+ *     environment, wins over the stored preference. Precedence lives in the caller.
+ */
+import { ReticleEnv, apiKeyFrom } from '@reticlehq/core';
+const CONFIG_PATH = '/v1/model/config';
+/**
+ * How long the daemon will wait for a preference before driving without it.
+ *
+ * Short on purpose. This runs before a drive that takes tens of seconds, so a second of budget is
+ * affordable and a stall is not — and the fallback is not a degraded mode, it is the behaviour
+ * everybody had before this endpoint existed.
+ */
+const TIMEOUT_MS = 2_000;
+function parse(body) {
+    try {
+        const parsed = JSON.parse(body);
+        if ('object' !== typeof parsed || null === parsed)
+            return undefined;
+        const record = parsed;
+        const provider = record['provider'];
+        if ('string' !== typeof provider || 0 === provider.length)
+            return undefined;
+        // Absent reads as enabled: the platform's own default is on, and a daemon that treated a
+        // missing field as "off" would silently disable the feature for anyone on an older API.
+        const enabled = record['harnessEnabled'];
+        // Same rule for both, for the same reason: an older API that reports neither must not have its
+        // silence read as a refusal.
+        const entitled = record['harnessEntitled'];
+        return {
+            provider,
+            harnessEnabled: 'boolean' === typeof enabled ? enabled : true,
+            harnessEntitled: 'boolean' === typeof entitled ? entitled : true,
+        };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Ask the platform which model this project wants driving with.
+ *
+ * `undefined` means "no answer", and every caller must treat that as "carry on with the
+ * environment" rather than as a failure worth reporting. There is deliberately no error channel:
+ * an unreachable settings endpoint is not something the person running a drive can act on, and a
+ * warning printed on a path that then works correctly is how people learn to ignore stderr.
+ */
+export async function fetchPlatformConfig(env, doFetch = (url, init) => fetch(url, init), timeoutMs = TIMEOUT_MS) {
+    const key = apiKeyFrom(env);
+    const host = env[ReticleEnv.CLOUD_URL];
+    if (key === undefined || 0 === key.length)
+        return undefined;
+    if (host === undefined || 0 === host.length)
+        return undefined;
+    const controller = new AbortController();
+    const timer = setTimeout(() => {
+        controller.abort();
+    }, timeoutMs);
+    try {
+        const res = await doFetch(`${host.replace(/\/+$/, '')}${CONFIG_PATH}`, {
+            method: 'GET',
+            headers: { authorization: `Bearer ${key}` },
+            signal: controller.signal,
+        });
+        if (!res.ok)
+            return undefined;
+        return parse(await res.text());
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}

package/dist/features/visual/visual-tools.js

@@ -6,6 +6,21 @@ import { ratioSchema } from '../../surface/tools/args/numeric-bounds.js';
 import { asNumber, asRecord, asString } from '@reticlehq/core';
 import { diffPng } from './visual-diff.js';
 import { VisualStore } from './visual-store.js';
+/**
+ * The `.reticle` a capture belongs beside: the driven session's own, stamped when it connected.
+ *
+ * Falls back to the daemon's root only when there is no session to ask — the same fallback the
+ * journal and the run artifact use, and for the same reason: a picture of somebody's app has no
+ * business in a directory that has nothing to do with it.
+ */
+function captureRoot(deps, sessionId) {
+    try {
+        return deps.sessions.resolve(sessionId).artifactRoot ?? deps.reticleRoot;
+    }
+    catch {
+        return deps.reticleRoot;
+    }
+}
 import { trackCaptureDirectory } from './capture-cleanup.js';
 import { readFile, unlink } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
@@ -253,7 +268,16 @@ export const VISUAL_TOOLS = [
                 return reason === VisualReason.NO_PROVIDER ? noProvider : { ok: false, reason };
             }
             const name = asString(args['name']) ?? 'default';
-            const store = new VisualStore(deps.fs, deps.reticleRoot);
+            // Beside the app that was captured. The tool RETURNS this path to the agent, so a wrong root
+            // is not only a stray PNG — it is a path the agent is told to look at in a tree that has
+            // nothing to do with the screenshot.
+            //
+            // Taken from the SESSION's own stamp rather than re-resolved, which is what `attach-journal`
+            // and the run artifact already do: the capture came from that session, so the answer is
+            // already in hand, and a second resolution is a second chance to disagree. It also keeps this
+            // directory from reaching into `project` for an address it was deliberately freed from
+            // needing — see `directory-reach`.
+            const store = new VisualStore(deps.fs, captureRoot(deps, sessionId));
             // Scoped to the runtime that produced it: an Electron window, a Tauri webview and a browser
             // tab do not render the same url the same way, and one shared baseline makes every
             // cross-runtime diff wrong. See visualDir.
@@ -292,7 +316,7 @@ export const VISUAL_TOOLS = [
         },
         handler: async (deps, args) => {
             const baseline = asString(args['baseline']) ?? '';
-            const store = new VisualStore(deps.fs, deps.reticleRoot);
+            const store = new VisualStore(deps.fs, captureRoot(deps, asString(args['sessionId'])));
             // Capture FIRST, then fetch the baseline for the runtime that produced these pixels. Reading it
             // by the session's runtime looked equivalent and is not: the route decides the renderer, so a
             // desktop session captured through a driven browser must be compared against the WEB baseline,

package/dist/index.js

@@ -1,12 +1,15 @@
+import { writeHarnessSwitch } from './memory/cloud/harness-switch.js';
+import { harnessConfigSource } from './memory/cloud/harness-config.js';
+import { fetchPlatformConfig } from './features/harness/platform-config.js';
 import { join } from 'node:path';
 import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { resolveProjectCloud } from './memory/cloud/cloud-config.js';
-import { startSyncDaemon } from './memory/cloud/sync-daemon.js';
+import { linkedCloudPort } from './memory/cloud/cloud-config.js';
+import { attachCloudSync } from './memory/cloud/sync-daemon.js';
 import { wireHooks } from './hooks/hook-commands.js';
-import { PROJECT_REGISTRY_FILE, emptyProjectRegistry, parseProjectRegistry, projectCandidates, } from '@reticlehq/core/artifacts';
-import { discoverProjectConfigs, } from './command/cli/config/config-discovery.js';
-import { projectCandidatesFrom, resolveArtifactRoot, } from './memory/project/artifact-root.js';
+import { PROJECT_REGISTRY_FILE, parseProjectRegistry, projectCandidates, } from '@reticlehq/core/artifacts';
+import { discoverProjectConfigs } from './command/cli/config/config-discovery.js';
+import { artifactRootResolver } from './memory/project/artifact-root-resolver.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { AGENT_STOPPED_NOTICE, RETICLE_DEFAULT_PORT, ReticleCommand, ReticleDir, ReticleEnv, LOOPBACK_HOST, ReplayStatus, EventType, } from '@reticlehq/core';
 import { originOf } from './portal/session/session-manager.js';
@@ -25,6 +28,7 @@ import { initImpact } from './memory/impact/impact-recorder.js';
 import { FlowStore } from './language/flows/flows.js';
 import { buildFlowChips } from './language/flows/flow-scope.js';
 import { ProjectStore } from './memory/project/project-store.js';
+import { projectStoreResolver } from './memory/project/project-for-root.js';
 import { attachRouteLearning } from './memory/project/learned-routes.js';
 import { AnnotationStore } from './language/flows/stores/annotation-store.js';
 import { createNodeFileSystem } from './memory/project/fs/fs-port.js';
@@ -169,7 +173,15 @@ function attachJournal(bridge, deps) {
         // Stamp the project's own `.reticle` before ANY counter fires for this session. Without it every
         // verdict is recorded against wherever the daemon was started, which is how one app's evidence
         // reached a different account's production dashboard.
-        session.artifactRoot = resolveArtifactRoot(session.projectId).root;
+        // The origin is passed for the case where the page never stamped a project id: it is the only
+        // distinguishing fact left, and without it every such app shares one bucket.
+        session.artifactRoot = resolveArtifactRoot(session.projectId, originOf(session.url)).root;
+        // Here rather than on the start path, which was neither the moment we were about to write into a
+        // repository nor the root we were about to write into: it created `.reticle/` — holding nothing
+        // but the ignore file — wherever the daemon was launched, coming back every boot after the user
+        // deleted it, while the journals this ignore protects landed in another tree, uncovered.
+        if (deps.enabled)
+            void ensureWorkspaceGitignore(deps.fs, session.artifactRoot);
         journalAttach(session);
         // Seed the learned ambient map so a fresh session starts knowing which regions churn, instead of
         // re-learning from zero. Best-effort + async: a late seed still helps, a failure is silent.
@@ -181,7 +193,12 @@ function attachJournal(bridge, deps) {
         }
     });
     // Teardown: flush the journal tail to disk + persist what this session learned.
-    bridge.attachSessionEnd(makeSessionEnd(deps));
+    bridge.attachSessionEnd(makeSessionEnd({
+        ...deps,
+        // Retention runs from teardown, and it must not delete the journal of a session that is still
+        // being written. The registry is the only thing that knows which those are.
+        liveSessionIds: () => new Set(bridge.sessions.all().map((s) => s.id)),
+    }));
     /*
      * And the same write, DURING the session rather than only at the end of it.
      *
@@ -201,16 +218,15 @@ function attachJournal(bridge, deps) {
         });
     }
     if (deps.enabled) {
-        void pruneSessions(deps.fs, deps.reticleRoot);
+        // Empty in the ordinary case (nothing has connected yet), but this path also runs on a daemon
+        // that is already serving sessions.
+        void pruneSessions(deps.fs, deps.reticleRoot, {
+            live: new Set(bridge.sessions.all().map((s) => s.id)),
+        });
         // The largest thing in the workspace, and until now the only one with no delete path at all.
         void pruneVisualDiffs(deps.fs, deps.reticleRoot);
         // Write-only local copies of reports the outbox already carries.
         void pruneFeedback(deps.fs, deps.reticleRoot);
-        // Here rather than in `init`, because this is the moment we are actually about to write into
-        // somebody's repository — and the paths that reach it without ever running `init` (a plugin
-        // install, a hand-added client config) are exactly the ones that would otherwise leave an
-        // unexplained pile of untracked files behind. Best-effort and write-once; see the helper.
-        void ensureWorkspaceGitignore(deps.fs, deps.reticleRoot);
     }
 }
 /**
@@ -309,39 +325,18 @@ function knownProjectRoots() {
     }
     return [...roots];
 }
-function artifactRootResolver(daemonRoot) {
-    return (projectId) => {
-        let registry = emptyProjectRegistry();
-        try {
-            const path = join(homedir(), ReticleDir.ROOT, PROJECT_REGISTRY_FILE);
-            registry = existsSync(path)
-                ? parseProjectRegistry(JSON.parse(readFileSync(path, 'utf8')))
-                : registry;
-        }
-        catch {
-            // A cache that cannot be read is an empty cache, never an error: the daemon still resolves
-            // through discovery, and falls back to its own root exactly as it did before this existed.
-        }
-        let discovery = { found: [], searched: [] };
-        try {
-            discovery = discoverProjectConfigs(process.cwd());
-        }
-        catch {
-            // Same reasoning: a diagnostic search that throws must not take a tool call with it.
-        }
-        return resolveArtifactRoot({
-            projectId,
-            candidates: projectCandidatesFrom(discovery, registry),
-            daemonRoot,
-        });
-    };
-}
 export async function start(options = {}) {
     const port = options.port ?? RETICLE_DEFAULT_PORT;
     // Open the user's impact record before anything can connect. Not inside the MCP branch: a daemon
     // serving a browser with no agent attached still has a HUD to answer, and a report that reads
     // "nothing recorded yet" over a month of history on disk is the worst version of this feature.
-    initImpact({ reticleRoot: options.reticleRoot ?? join(process.cwd(), ReticleDir.ROOT) });
+    initImpact({
+        reticleRoot: options.reticleRoot ?? join(process.cwd(), ReticleDir.ROOT),
+        // The daemon owns both sides of this seam, so it is the layer that may join them: the cache
+        // lives in cloud memory, the platform read lives in the harness feature, and neither is allowed
+        // to reach for the other.
+        config: harnessConfigSource(() => fetchPlatformConfig(process.env)),
+    });
     const uninstallHooks = wireHooks(options.reticleRoot ?? join(process.cwd(), ReticleDir.ROOT), readProjectId(process.cwd()));
     const security = await resolveBridgeSecurityWithAutoToken(options);
     const bridge = new Bridge({ port, sdkFix: sdkFixForCwd, ...security });
@@ -381,7 +376,7 @@ export async function start(options = {}) {
             flows,
         });
         const project = new ProjectStore(fs, reticleRoot, { now });
-        attachRouteLearning(bridge, project);
+        attachRouteLearning(bridge, projectStoreResolver(fs, project, reticleRoot, now));
         const annotations = new AnnotationStore();
         pool = createBrowserPool(options.headless ?? true);
         leaseReaper = new LeaseReaper(pool);
@@ -462,7 +457,13 @@ export async function startDaemon(options = {}) {
     // was never opened in the process the HUD talks to: tool calls still recorded (the dispatch
     // chokepoint opens it lazily), but a tab that connected before the first tool call was pushed
     // nothing, so the report read "nothing recorded yet" over a file with history in it.
-    initImpact({ reticleRoot: options.reticleRoot ?? join(process.cwd(), ReticleDir.ROOT) });
+    initImpact({
+        reticleRoot: options.reticleRoot ?? join(process.cwd(), ReticleDir.ROOT),
+        // The daemon owns both sides of this seam, so it is the layer that may join them: the cache
+        // lives in cloud memory, the platform read lives in the harness feature, and neither is allowed
+        // to reach for the other.
+        config: harnessConfigSource(() => fetchPlatformConfig(process.env)),
+    });
     const security = await resolveBridgeSecurityWithAutoToken(options);
     const shared = createSharedServer(security.token === undefined ? {} : { token: security.token });
     const bridge = new Bridge({ port, server: shared.httpServer, sdkFix: sdkFixForCwd, ...security });
@@ -477,7 +478,7 @@ export async function startDaemon(options = {}) {
     // answers WHY rather than just "sessionCount: 0".
     // `verifyPort` rides along so a later `serve --http` can tell whether this daemon already honours
     // the requested `--http-port` instead of silently ignoring the flag (#687).
-    shared.attachStatus(() => statusPayload(bridge.sessions.count(), bridge.sessions.list(), bridge.sessions.noSessionHint(), verifyHttp?.port));
+    shared.attachStatus(() => statusPayload(bridge.sessions.count(), bridge.sessions.list(), bridge.sessions.noSessionHint(), verifyHttp?.port, bridge.sessions.noSessionLead()));
     // Agent-independent presence: the daemon outlives any single agent, so when the LAST agent's MCP
     // connection drops (it stopped, or is waiting on the human), end every session and push a clear
     // "go to your terminal" notice to the panel — the human is on the browser and must not lose a typed
@@ -504,7 +505,7 @@ export async function startDaemon(options = {}) {
     /*
      * Bound AFTER the sync daemon exists, read only when a run is actually written.
      *
-     * `attachJournal` runs before `startSyncDaemon` because the journal has to be capturing before
+     * `attachJournal` runs before `attachCloudSync` because the journal has to be capturing before
      * anything can connect, and reordering them so this could be a direct reference would put sync
      * setup ahead of session capture for the sake of one callback.
      */
@@ -519,7 +520,7 @@ export async function startDaemon(options = {}) {
         onRunPersisted: () => syncNudge.run?.(),
     });
     const project = new ProjectStore(fs, reticleRoot, { now });
-    attachRouteLearning(bridge, project);
+    attachRouteLearning(bridge, projectStoreResolver(fs, project, reticleRoot, now));
     const annotations = new AnnotationStore();
     const pool = createBrowserPool(options.headless ?? true);
     const leaseReaper = new LeaseReaper(pool);
@@ -540,19 +541,22 @@ export async function startDaemon(options = {}) {
      * events a user most wants: the ones at the start of a run.
      */
     wireHooks(reticleRoot, readProjectId(process.cwd()));
-    const cloudSync = startSyncDaemon({
+    const cloudSync = attachCloudSync({
+        fs,
         reticleRoot,
-        cloud: () => resolveProjectCloud(fs, reticleRoot, homedir(), process.env),
-        // Every OTHER linked repo on this machine, not just the directory the daemon was started in.
-        // One daemon serves many projects, and pushing only its own root left the rest silently
-        // reporting nothing — indistinguishable, on the dashboard, from nobody having verified anything.
-        otherRoots: () => Promise.resolve(knownProjectRoots()),
-        cloudFor: (root) => resolveProjectCloud(fs, root, homedir(), process.env),
+        homeDir: homedir(),
+        env: process.env,
+        otherRoots: knownProjectRoots,
     });
     syncNudge.run = () => cloudSync.nudge();
-    // The panel's sync button. `syncNow`, not `nudge`: a nudge schedules a cycle soon, which is right
-    // for "a run landed" and wrong for a button somebody is watching. Never awaited.
+    // `syncNow`, not `nudge`: a nudge schedules a cycle soon, which is right for "a run landed" and
+    // wrong for a button somebody is watching. Never awaited.
     bridge.attachSyncRequest(() => void cloudSync.syncNow());
+    // The panel's harness switch. Written through to the platform rather than kept locally, so the
+    // console and the panel cannot disagree about a setting they both offer. Nothing is awaited and a
+    // failure is not surfaced: the next snapshot re-reads the platform, so a lost write shows up as
+    // the switch springing back, which is the truthful outcome.
+    bridge.attachHarnessRequest((enabled) => void writeHarnessSwitch(process.env, enabled));
     // Scope auto-selection to the active project (from .reticle.json) so a stray tab from another app is
     // never picked when the agent omits a sessionId. Explicit per-call scope/sessionId still overrides.
     // Scope + the no-session diagnosis: "no browser session connected" is the error that ends most
@@ -574,6 +578,7 @@ export async function startDaemon(options = {}) {
         project,
         fs,
         reticleRoot,
+        linkedCloud: linkedCloudPort(fs, reticleRoot, homedir(), process.env),
         // The long-lived daemon needs this MORE than the standalone MCP process does, not less: it is
         // the one that outlives a single project and serves every app on the machine. Omitting it here
         // silently disabled per-session artifact resolution for every agent that attaches to a running