@reticlehq/server 3.3.0 → 3.5.0

package/dist/command/setup/terminal/wait-progress.js

@@ -41,3 +41,20 @@ export function waitProgressLine(elapsedMs, watching, lastSpokeAtMs) {
     return (`Waiting ${seconds} for the dev server — watching ${watching}. If the app is already up ` +
         `somewhere else, that url is the thing to check first.`);
 }
+/**
+ * The same, for the wait on a session after the app is up.
+ *
+ * That wait was silent as well: a desktop init printed "Waiting for the app to launch and dial in."
+ * and then nothing for the whole of its budget. Naming what is awaited and how long remains is what
+ * lets somebody tell a slow start from a wedged one — and when to stop waiting themselves.
+ */
+export function connectProgressLine(elapsedMs, lastSpokeAtMs, budgetMs, awaiting) {
+    if (elapsedMs < WAIT_PROGRESS_EVERY_MS)
+        return undefined;
+    if (lastSpokeAtMs !== undefined && elapsedMs - lastSpokeAtMs < WAIT_PROGRESS_EVERY_MS) {
+        return undefined;
+    }
+    const seconds = (ms) => `${String(Math.max(0, Math.floor(ms / 1000)))}s`;
+    return (`Still waiting for ${awaiting} to connect: ${seconds(elapsedMs)} so far, giving up in ` +
+        `${seconds(budgetMs - elapsedMs)}.`);
+}

package/dist/command/version/peer-announce.d.ts

@@ -1,4 +1,8 @@
 export declare const PEER_VERSION_PARAM = "peerVersion";
 export declare const PEER_CONTRACT_PARAM = "peerContract";
-/** Compare an attaching agent process against this daemon, and queue the nudge when they disagree. */
-export declare function noteAgentPeer(version: string | null, contract: string | null): void;
+/**
+ * Compare an attaching agent process against this daemon: the skew to tell THAT connection, or
+ * undefined when they agree. Returned rather than queued daemon-wide, because it is true only for the
+ * agent that announced it (#1136).
+ */
+export declare function agentPeerSkew(version: string | null, contract: string | null): string | undefined;

package/dist/command/version/peer-announce.js

@@ -13,12 +13,15 @@
  */
 import { CONTRACT_FINGERPRINT } from '@reticlehq/core';
 import { SERVER_VERSION } from './identity/server-version.js';
-import { daemonFix, describeSkew, SkewPair } from './version-skew.js';
-import { noteVersionSkew } from './version-nudge.js';
+import { daemonFix, describeSkew } from './version-skew.js';
 export const PEER_VERSION_PARAM = 'peerVersion';
 export const PEER_CONTRACT_PARAM = 'peerContract';
-/** Compare an attaching agent process against this daemon, and queue the nudge when they disagree. */
-export function noteAgentPeer(version, contract) {
+/**
+ * Compare an attaching agent process against this daemon: the skew to tell THAT connection, or
+ * undefined when they agree. Returned rather than queued daemon-wide, because it is true only for the
+ * agent that announced it (#1136).
+ */
+export function agentPeerSkew(version, contract) {
     const skew = describeSkew({
         what: "the agent's MCP server",
         version: version ?? undefined,
@@ -27,6 +30,5 @@ export function noteAgentPeer(version, contract) {
         // MCP server, so the daemon is the newer half whenever the announcing agent is behind.
         fix: daemonFix(SERVER_VERSION, version ?? undefined),
     }, { version: SERVER_VERSION, contract: CONTRACT_FINGERPRINT });
-    if (skew !== undefined)
-        noteVersionSkew(SkewPair.DAEMON, skew);
+    return skew;
 }

package/dist/command/version/version-nudge.d.ts

@@ -11,7 +11,7 @@
  * result, then goes quiet until the skew CHANGES. Told, not nagged: a banner on every call is one an
  * agent learns to skip, and it would cost those tokens on every call for the rest of the session.
  */
-import type { SkewPair } from './version-skew.js';
+import { SkewPair } from './version-skew.js';
 interface VersionSkewNudge {
     pair: SkewPair;
     action: string;
@@ -21,8 +21,20 @@ interface VersionSkewNudge {
  * a second tab on a third version is news; the same tab reconnecting is not.
  */
 export declare function noteVersionSkew(pair: SkewPair, action: string): void;
-/** The next undelivered skew, once. */
-export declare function takeVersionSkew(): VersionSkewNudge | undefined;
+/**
+ * A daemon skew bound to the one MCP connection whose server announced it, told once (#1136).
+ *
+ * The page pair stays in the daemon-wide queue: it is a fact about a tab, true for whoever asks.
+ * This pair is a fact about the CALLER, and telling it to a different caller is advice to restart
+ * a server that is fine, or to run `reticle stop` and cut every agent on the daemon.
+ */
+export declare function connectionSkew(action: string): {
+    take(): string | undefined;
+};
+/** The next undelivered skew, once: this connection's own first, then the daemon-wide queue. */
+export declare function takeVersionSkew(connection?: {
+    take(): string | undefined;
+}): VersionSkewNudge | undefined;
 /**
  * Splice pending skew onto a tool-error payload.
  *
@@ -36,6 +48,8 @@ export declare function takeVersionSkewOnto(payload: {
     error: string;
     recovery?: string;
     feedback?: string;
+}, connection?: {
+    take(): string | undefined;
 }): Record<string, unknown>;
 /** Tests only — drop the module state so each case starts clean. */
 export declare function resetVersionSkew(): void;

package/dist/command/version/version-nudge.js

@@ -12,6 +12,7 @@
  * agent learns to skip, and it would cost those tokens on every call for the rest of the session.
  */
 import { EnvelopeKey } from '../../surface/tools/tool-kit.js';
+import { SkewPair } from './version-skew.js';
 /** Pending per pair — the SDK and the daemon are different upgrades and each is worth saying once. */
 const pending = new Map();
 /** The last message delivered for each pair, so the same skew is never repeated. */
@@ -25,8 +26,28 @@ export function noteVersionSkew(pair, action) {
         return;
     pending.set(pair, action);
 }
-/** The next undelivered skew, once. */
-export function takeVersionSkew() {
+/**
+ * A daemon skew bound to the one MCP connection whose server announced it, told once (#1136).
+ *
+ * The page pair stays in the daemon-wide queue: it is a fact about a tab, true for whoever asks.
+ * This pair is a fact about the CALLER, and telling it to a different caller is advice to restart
+ * a server that is fine, or to run `reticle stop` and cut every agent on the daemon.
+ */
+export function connectionSkew(action) {
+    let pendingAction = action;
+    return {
+        take: () => {
+            const taken = pendingAction;
+            pendingAction = undefined;
+            return taken;
+        },
+    };
+}
+/** The next undelivered skew, once: this connection's own first, then the daemon-wide queue. */
+export function takeVersionSkew(connection) {
+    const own = connection?.take();
+    if (own !== undefined)
+        return { pair: SkewPair.DAEMON, action: own };
     for (const [pair, action] of pending) {
         pending.delete(pair);
         delivered.set(pair, action);
@@ -43,8 +64,8 @@ export function takeVersionSkew() {
  * feedback ask is replaced: the skew IS the next move, and inviting a bug report about it is
  * backwards. A recognized recovery is kept; the envelope still rides along.
  */
-export function takeVersionSkewOnto(payload) {
-    const skew = takeVersionSkew();
+export function takeVersionSkewOnto(payload, connection) {
+    const skew = takeVersionSkew(connection);
     if (skew === undefined)
         return payload;
     const { feedback, ...rest } = payload;

package/dist/features/crawl/crawl-empty.js

@@ -19,6 +19,6 @@ export function crawlEmptyNote(outcome) {
         return `no interactive controls were found on this page, so nothing was clicked — the crawl ran and found none, which is a result rather than a failure.${capped}`;
     }
     return (`${String(outcome.interactiveFound)} interactive controls were found and none of them were clicked. ` +
-        `That is not an empty page, so something stopped the loop — report it with reticle_feedback, ` +
+        `That is not an empty page, so something stopped the loop — report it with reticle_session { action: "feedback" }, ` +
         `including this page's URL and one control's ref.`);
 }

package/dist/features/crawl/crawl-tools.d.ts

@@ -1,4 +1,10 @@
 import type { ToolDef } from '../../surface/tools/tool-kit.js';
+/**
+ * The configured secret for a field, only on the origin the crawl started on. The field name comes
+ * from whatever page is on screen, so without the check a page on another origin could name an
+ * empty textbox after a secret and have the crawl type it in.
+ */
+export declare function crawlSecret(startUrl: string, env: Readonly<Record<string, string | undefined>>): (name: string, pageUrl: string) => string | undefined;
 /**
  * The autonomous "smart monkey" tool. Builds on reticle_explore (which only LISTS) by
  * actually clicking each reachable control and classifying the reaction. DESTRUCTIVE by nature —

package/dist/features/crawl/crawl-tools.js

@@ -5,8 +5,29 @@ import { ReticleTool } from '@reticlehq/core';
 import { asNumber, asString } from '@reticlehq/core';
 import { stepCountSchema, timeoutMsSchema } from '../../surface/tools/args/numeric-bounds.js';
 import { crawl } from './crawl.js';
+import { EXHAUST_DEFAULT_ACTIONS, runExhaustive } from '../exhaust/exhaust-run.js';
+import { heuristicFillValue } from '../harness/fill-values.js';
+import { secretEnvKey } from '../../language/flows/flows.js';
+import { CRAWL_DEFAULTS } from '@reticlehq/core';
 import { routeFromUrl, routesFromEvents } from '../../memory/project/learned-routes.js';
 const nodeSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * The configured secret for a field, only on the origin the crawl started on. The field name comes
+ * from whatever page is on screen, so without the check a page on another origin could name an
+ * empty textbox after a secret and have the crawl type it in.
+ */
+export function crawlSecret(startUrl, env) {
+    const originOf = (url) => {
+        try {
+            return new URL(url).origin;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const home = originOf(startUrl);
+    return (name, pageUrl) => home !== undefined && home === originOf(pageUrl) ? env[secretEnvKey(name)] : undefined;
+}
 /**
  * The autonomous "smart monkey" tool. Builds on reticle_explore (which only LISTS) by
  * actually clicking each reachable control and classifying the reaction. DESTRUCTIVE by nature —
@@ -27,6 +48,10 @@ export const CRAWL_TOOLS = [
                 .string()
                 .optional()
                 .describe('CSS selector or element ref to restrict crawling to a subtree.'),
+            exhaustive: z
+                .boolean()
+                .optional()
+                .describe("Walk every state it can tell apart, drive each write's failure path, fold into the coverage ledger."),
             confirmDangerous: z
                 .boolean()
                 .optional()
@@ -62,6 +87,8 @@ export const CRAWL_TOOLS = [
                 .optional()
                 .describe('Present only when the page exceeded one snapshot, so controls past the cap were never listed. When present, a zero-anomaly result does NOT mean the app is clean.'),
             truncated: z.boolean(),
+            // Only on `exhaustive` — see features/exhaust/exhaust-run.ts. Loose: it carries the levels.
+            exhaustive: z.record(z.unknown()).optional(),
         },
         handler: async (deps, args) => {
             const session = deps.sessions.resolve(asString(args['sessionId']));
@@ -76,6 +103,36 @@ export const CRAWL_TOOLS = [
                 ...(scope !== undefined ? { scope } : {}),
                 ...(true === args['confirmDangerous'] ? { confirmDangerous: true } : {}),
             };
+            if (true === args['exhaustive']) {
+                // Starts code-coverage collection, so the drive below is measured. See takeCodeCoverage.
+                await deps.realInput?.takeCodeCoverage?.(session.url);
+                const secret = crawlSecret(session.url, process.env);
+                return runExhaustive({
+                    sessions: deps.sessions,
+                    session,
+                    startUrl: session.url,
+                    maxActions: maxSteps ?? EXHAUST_DEFAULT_ACTIONS,
+                    settleMs: settleMs ?? CRAWL_DEFAULTS.SETTLE_MS,
+                    fillValue: (label, pageUrl) => {
+                        const name = /"([^"]*)"/.exec(label)?.[1] ?? label;
+                        return secret(name, pageUrl) ?? heuristicFillValue(name);
+                    },
+                    now: deps.now,
+                    sleep: nodeSleep,
+                    ...(deps.realInput?.setMocks === undefined
+                        ? {}
+                        : {
+                            setMocks: (url, rules) => deps.realInput?.setMocks?.(url, rules) ?? Promise.resolve(false),
+                        }),
+                    ...(deps.realInput?.takeCodeCoverage === undefined
+                        ? {}
+                        : {
+                            takeCode: (url) => deps.realInput?.takeCodeCoverage?.(url) ?? Promise.resolve(undefined),
+                        }),
+                    fs: deps.fs,
+                    reticleRoot: sessionRoot(deps, session.id),
+                });
+            }
             const report = await crawl(session, opts, nodeSleep);
             const routes = [
                 ...(initialRoute === undefined ? [] : [initialRoute]),