@reticlehq/server 3.6.0 → 3.7.0

package/dist/start-wiring.js

@@ -0,0 +1,169 @@
+/**
+ * The wiring `start` and `startDaemon` share, built in one place so the two entry points cannot drift.
+ *
+ * Split from `index.ts`: that file is the package's front door and the two entry points; these are
+ * the pieces both of them assemble — the browser pool, the drive/real-input provider, the CDP network
+ * router, and the per-project lookups the daemon closes over. `daemon-parity.test.ts` checks both
+ * entry points still call them.
+ */
+import { join } from 'node:path';
+import { cpus, homedir } from 'node:os';
+import { bridgeWsUrl, EventType, ReticleDir, ReticleEnv } from '@reticlehq/core';
+import { fetchPlatformConfig } from './features/harness/platform-config.js';
+import { platformEnvPort } from './memory/cloud/cloud-config.js';
+import { knownProjectCandidates, projectDirectoryFor, } from './memory/project/artifact-root-resolver.js';
+import { createNodeFileSystem } from './memory/project/fs/fs-port.js';
+import { originOf } from './portal/session/session-manager.js';
+import { setBrowserMode, BrowserMode } from './telemetry/browser-mode.js';
+import { sdkFixForDirectory } from './command/version/sdk-fix.js';
+import { SERVER_VERSION } from './command/version/identity/server-version.js';
+import { CdpRealInputProvider, LaunchedRealInputProvider } from './portal/input/real-input.js';
+import { BrowserPool } from './portal/pool/browser-pool.js';
+import { playwrightLauncher, resolveMaxContexts } from './portal/pool/playwright-launcher.js';
+import { readReaderBundle, zeroInstallScript as zeroInstallScriptFor, } from './portal/pool/zero-install.js';
+/**
+ * Build the shared browser pool (one headless Chromium, N capped isolated leased contexts). Lazy —
+ * no Chromium launches until the first lease — so creating it is free even when never used.
+ */
+/** Where the zero-install reader connects: this daemon's own bridge, with its pairing token. */
+export function readerConnect(port, token) {
+    return { url: bridgeWsUrl(port), ...(token === undefined ? {} : { token }) };
+}
+export function createBrowserPool(headless, reader) {
+    const maxContexts = resolveMaxContexts(process.env[ReticleEnv.MAX_CONTEXTS], cpus().length);
+    const genSessionId = () => `lease-${'function' === typeof globalThis.crypto?.randomUUID
+        ? globalThis.crypto.randomUUID()
+        : String(Date.now())}`;
+    // Built on first use and kept: the page that needs it is one whose app never connected.
+    let script;
+    const zeroInstallScript = () => {
+        if (script === undefined) {
+            const bundle = readReaderBundle();
+            script = bundle === undefined ? null : zeroInstallScriptFor(bundle, reader);
+        }
+        return script ?? undefined;
+    };
+    return new BrowserPool(playwrightLauncher({ headless }), {
+        maxContexts,
+        genSessionId,
+        zeroInstallScript,
+        launchHeaded: playwrightLauncher({ headless: false }),
+    });
+}
+/**
+ * Route CDP-authoritative network detail onto the driven session's journal.
+ *
+ * The page and the SDK session share an origin, so a NET_DETAIL is pushed to the matching connected
+ * session. Shared by both entry points: `startDaemon` previously omitted it entirely, so on the path
+ * users actually take, CDP network detail was collected and then dropped on the floor.
+ */
+export function makeNetworkDetailRouter(bridge, driveUrl) {
+    const driveOrigin = originOf(driveUrl ?? '');
+    return (detail) => {
+        // Route by the DOCUMENT that issued the request, not by the request's own origin.
+        //
+        // Matching the request's origin only works for same-origin calls. An app on one origin calling an
+        // API on another — most API calls — produced a detail matching no session, and it was dropped
+        // without a trace. The drive-URL fallback papered over it on the launched path and did nothing on
+        // the CDP-attach path, where driveUrl is undefined and the fallback compares against ''.
+        const pageOrigin = originOf(detail.pageUrl ?? '');
+        const requestOrigin = originOf(detail.url);
+        for (const session of bridge.sessions.all()) {
+            const origin = originOf(session.url);
+            // originOf returns `string | undefined`, NEVER '' — so the old `!== ''` guards were dead, and a
+            // bare `origin === requestOrigin` matched `undefined === undefined` when BOTH the session URL and
+            // the detail URL were unparseable. That routed a NET_DETAIL (with its response headers, incl.
+            // set-cookie) onto an unrelated session. Require a DEFINED origin; undefined operands then simply
+            // fail to match any of the three candidates.
+            const matches = origin !== undefined &&
+                (origin === pageOrigin || origin === requestOrigin || origin === driveOrigin);
+            if (matches) {
+                session.pushEvent({
+                    t: 0,
+                    type: EventType.NET_DETAIL,
+                    sessionId: session.id,
+                    data: { ...detail },
+                });
+            }
+        }
+    };
+}
+/**
+ * Resolve the drive/real-input provider from options — shared by start and startDaemon so the
+ * precedence (driveUrl launch+own → CDP attach → none) and the storageState/injectConnect plumbing
+ * live in ONE place. `onNavigateError` is the entrypoint's own cleanup (close the bridge/shared server)
+ * so a failed launch never leaks a WS port. A past divergence between the two paths let daemon mode
+ * run with a different setup — this removes that risk.
+ */
+export async function resolveRealInput(options, onNavigateError, onNetworkDetail) {
+    const driveUrl = options.driveUrl;
+    if (driveUrl !== undefined && driveUrl.length > 0) {
+        const headless = options.headless ?? true;
+        // The one place that knows. Everything downstream reads it rather than re-deriving it, and a
+        // daemon that launches nothing keeps the default (ATTACHED) rather than guessing.
+        setBrowserMode(headless ? BrowserMode.HEADLESS : BrowserMode.HEADED);
+        const injectConnect = options.injectConnect;
+        const storageState = options.storageState;
+        const factory = options.realInputFactory ??
+            ((opts) => new LaunchedRealInputProvider({
+                driveUrl: opts.driveUrl,
+                headless: opts.headless,
+                ...(injectConnect !== undefined ? { injectConnect } : {}),
+                ...(storageState !== undefined ? { storageState } : {}),
+                ...(onNetworkDetail !== undefined ? { onNetworkDetail } : {}),
+            }));
+        const launched = factory({ driveUrl, headless });
+        try {
+            await launched.navigate();
+        }
+        catch (error) {
+            await onNavigateError(); // no leaked WS port on a failed start
+            throw error;
+        }
+        return { realInput: launched, owned: launched };
+    }
+    const cdpUrl = options.cdpUrl ?? process.env[ReticleEnv.CDP_URL];
+    if (cdpUrl !== undefined && cdpUrl.length > 0) {
+        // Same network sink as the launched path. Whether Reticle opened the browser or attached to one
+        // someone else opened has no bearing on whether it can read that browser's network.
+        const cdp = new CdpRealInputProvider({
+            cdpUrl,
+            ...(onNetworkDetail !== undefined ? { onNetworkDetail } : {}),
+        });
+        return { realInput: cdp, owned: cdp };
+    }
+    return {};
+}
+/**
+ * The SDK-upgrade sentence for the package.json of the project the page announced, evaluated at
+ * each HELLO so a just-edited manifest is what we name. The daemon's cwd only when that project's
+ * directory is unknown, and the framework-neutral sensor when that is not an app either (#1135).
+ */
+export function sdkFixForProject(projectId) {
+    return sdkFixForDirectory(SERVER_VERSION, projectDirectoryFor(projectId) ?? process.cwd());
+}
+/**
+ * Resolve a session's artifact root, from everything this machine knows about where projects live.
+ *
+ * Built once per daemon and closed over by every tool call. The two sources are read lazily and
+ * cheaply on each call rather than snapshotted at startup: `init` can run in another terminal while
+ * this daemon is up, and a resolution that used a startup snapshot would keep answering with a map
+ * from before the project the agent is now driving existed.
+ */
+/**
+ * Every `.reticle` root on this machine that sync should consider, from the same two sources the
+ * artifact resolver uses.
+ *
+ * Read on every call rather than snapshotted, for the same reason: `reticle link` can run in
+ * another terminal while this daemon is up, and a startup snapshot would keep that repo silent
+ * until somebody restarted a process they have no reason to suspect.
+ *
+ * Returns directories that MIGHT be linked; the caller resolves each and skips the ones that are
+ * not. Deciding that here would mean reading every cloud.json on every tick.
+ */
+export function knownProjectRoots() {
+    return [...new Set(knownProjectCandidates().map((c) => join(c.directory, ReticleDir.ROOT)))];
+}
+/** This project's platform credential (stored, else the env key), as the env the platform readers take. */
+export const platformEnvFor = (root) => platformEnvPort(createNodeFileSystem(), root ?? join(process.cwd(), ReticleDir.ROOT), homedir(), process.env);
+export const loadHarnessConfig = async (root) => fetchPlatformConfig(await platformEnvFor(root)());

package/dist/status-payload.d.ts

@@ -7,6 +7,7 @@
  * answering requests. See takeVersionSkewOnto in command/version/version-nudge.ts.
  */
 import type { SessionInfo } from './portal/session/session-info.js';
+import { instrumentationOf, type InstrumentedTab } from './portal/session/recorded-gaps.js';
 interface StatusPayload {
     running: true;
     version: string;
@@ -30,12 +31,23 @@ interface StatusPayload {
     whyLead?: string;
     /** Port of the verify HTTP endpoint this daemon serves — present only when started with `--http`. */
     verifyPort?: number;
+    /**
+     * Each connected tab's instrumentation coverage and, once a verdict recorded a gap, the prompt for
+     * a coding agent — what `reticle doctor` prints as its coverage line.
+     */
+    coverage?: TabCoverage[];
 }
+type TabCoverage = {
+    sessionId: string;
+    url?: string;
+} & ReturnType<typeof instrumentationOf>;
 export declare function statusPayload(sessionCount: number, sessions: SessionInfo[], 
 /** The no-session diagnosis, injected so this stays pure and the port probe stays off this path. */
 why?: string, verifyPort?: number, 
 /** The short rendering of the same diagnosis. Absent on a daemon that has no provider wired. */
-whyLead?: string): StatusPayload;
+whyLead?: string, 
+/** The live tabs, for their coverage. */
+tabs?: readonly InstrumentedTab[]): StatusPayload;
 /**
  * Why `serve --http` cannot claim success against an already-running daemon — or undefined when
  * that daemon already serves the verify HTTP endpoint on the wanted port.

package/dist/status-payload.js

@@ -1,10 +1,13 @@
 import { CONTRACT_FINGERPRINT } from '@reticlehq/core';
 import { SERVER_VERSION } from './command/version/identity/server-version.js';
+import { instrumentationOf } from './portal/session/recorded-gaps.js';
 export function statusPayload(sessionCount, sessions, 
 /** The no-session diagnosis, injected so this stays pure and the port probe stays off this path. */
 why, verifyPort, 
 /** The short rendering of the same diagnosis. Absent on a daemon that has no provider wired. */
-whyLead) {
+whyLead, 
+/** The live tabs, for their coverage. */
+tabs = []) {
     return {
         running: true,
         version: SERVER_VERSION,
@@ -16,6 +19,15 @@ whyLead) {
         ...(0 === sessionCount && why !== undefined ? { why } : {}),
         ...(0 === sessionCount && whyLead !== undefined ? { whyLead } : {}),
         ...(verifyPort === undefined ? {} : { verifyPort }),
+        ...(0 === tabs.length
+            ? {}
+            : {
+                coverage: tabs.map((tab) => ({
+                    sessionId: tab.id,
+                    ...(tab.url === undefined ? {} : { url: tab.url }),
+                    ...instrumentationOf(tab),
+                })),
+            }),
     };
 }
 /**

package/dist/surface/http-server.js

@@ -5,6 +5,7 @@ import { getSessionMetrics } from '../telemetry/session-metrics.js';
 import { agentPeerSkew, PEER_VERSION_PARAM, PEER_CONTRACT_PARAM, } from '../command/version/peer-announce.js';
 import { log } from '../log.js';
 import { isLoopbackHost, isLocalWebOrigin, isLoopbackPeer, requestToken, tokensMatch, } from '../portal/bridge/token-auth.js';
+import { clientDirectoryFromPeer, runWithClientDirectory } from '../hooks/client-directory.js';
 import { LOOPBACK_IDLE_MS } from './loopback-agent.js';
 /**
  * Creates a shared HTTP server that handles both the WebSocket bridge (browser SDK) and the
@@ -212,7 +213,12 @@ export function createSharedServer(options = {}) {
                 res.end('session not found');
                 return;
             }
-            transport.handlePostMessage(req, res).catch((err) => {
+            const clientDirectory = clientDirectoryFromPeer(isLoopbackPeer(req.socket.remoteAddress), req.headers);
+            const deliver = () => transport.handlePostMessage(req, res);
+            const posted = clientDirectory === undefined
+                ? deliver()
+                : runWithClientDirectory(clientDirectory, deliver);
+            posted.catch((err) => {
                 const message = err instanceof Error ? err.message : String(err);
                 log('mcp_message_error', { error: message });
             });

package/dist/surface/mcp/attach-memory.d.ts

@@ -71,6 +71,7 @@ export declare function describeAttachState(state: AttachState): string | undefi
 /** What `reticle status` reports about the client side of the install. */
 interface AttachStatusFields {
     mcpClient: AttachState;
+    mcpClientSaid: string;
     mcpClientAction?: string;
 }
 /**

package/dist/surface/mcp/attach-memory.js

@@ -169,6 +169,13 @@ export function describeAttachState(state) {
         return NEVER_CALLED_ACTION;
     return undefined;
 }
+/** Each state in words, for a person: the state names are the record's, never the reader's. */
+const ATTACH_STATE_SAID = {
+    [AttachState.ENUMERATED]: "✓ your agent has read and used Reticle's tools",
+    [AttachState.NEVER_CALLED]: "your agent read Reticle's tools and has not called one yet",
+    [AttachState.NEVER_ENUMERATED]: '✗ your agent started Reticle and never read its tools',
+    [AttachState.NEVER_ATTACHED]: 'no agent has started Reticle on this port yet',
+};
 /**
  * The client-side fields for one `status` run.
  *
@@ -181,5 +188,9 @@ export function attachStatusFields(stateDir, port) {
     const action = describeAttachState(state);
     // OMITTED rather than undefined: `exactOptionalPropertyTypes` is on, and an absent key is also
     // what keeps the healthy line to one fact.
-    return { mcpClient: state, ...(action === undefined ? {} : { mcpClientAction: action }) };
+    return {
+        mcpClient: state,
+        mcpClientSaid: ATTACH_STATE_SAID[state],
+        ...(action === undefined ? {} : { mcpClientAction: action }),
+    };
 }

package/dist/surface/mcp/mcp-proxy.d.ts

@@ -25,6 +25,8 @@ export declare const RECONNECT_INITIALIZE_ID = "__reticle_proxy_reinit";
 export declare class PendingRequests {
     #private;
     observeOutbound(line: string): void;
+    /** Whether this unanswered request asked for a Harness drive. */
+    isDrive(id: unknown): boolean;
     observeInbound(line: string): void;
     get unanswered(): string[];
     /**
@@ -34,6 +36,8 @@ export declare class PendingRequests {
     take(id: unknown): boolean;
     /** Take every unanswered id and forget them, so the same request is failed at most once. */
     drain(): string[];
+    /** Forget which requests were drives, once their replies are written. */
+    clearDrives(): void;
 }
 /**
  * JSON-RPC errors for every request that was in flight when the stream died.

package/dist/surface/mcp/mcp-proxy.js

@@ -32,6 +32,7 @@ export { accountProxyLogWrite, proxyLog, proxyLogPath, PROXY_LOG_CHECK_BYTES, re
 import { proxyLog } from './proxy/proxy-log.js';
 import { OutageReason, OutageStage, reportMcpOutage } from './faults/mcp-outage.js';
 import { postToSession } from './proxy/mcp-post-transport.js';
+import { MSG_DRIVE_MAY_BE_RUNNING, isHarnessDriveCall } from './proxy/drive-calls.js';
 import { reconnectDelayMs } from './proxy/proxy-backoff.js';
 import { PROXY_IDLE_EXIT_EVENT, ProxyIdleExit, resolveProxyIdleExitMs } from './proxy-idle-exit.js';
 export { reconnectDelayMs } from './proxy/proxy-backoff.js';
@@ -84,11 +85,20 @@ const INITIALIZED_METHOD = 'notifications/initialized';
  */
 export class PendingRequests {
     #ids = new Set();
+    /** The pending requests that start or poll a Harness drive, which outlives a lost connection. */
+    #drives = new Set();
     observeOutbound(line) {
         const msg = parseJsonRpc(line);
         if (null === msg || msg.id === undefined || msg.method === undefined)
             return;
-        this.#ids.add(JSON.stringify(msg.id));
+        const id = JSON.stringify(msg.id);
+        this.#ids.add(id);
+        if (isHarnessDriveCall(msg))
+            this.#drives.add(id);
+    }
+    /** Whether this unanswered request asked for a Harness drive. */
+    isDrive(id) {
+        return this.#drives.has(JSON.stringify(id));
     }
     observeInbound(line) {
         const msg = parseJsonRpc(line);
@@ -104,6 +114,7 @@ export class PendingRequests {
      * a duplicate response to one id is a protocol violation, not a belt-and-braces retry.
      */
     take(id) {
+        this.#drives.delete(JSON.stringify(id));
         return this.#ids.delete(JSON.stringify(id));
     }
     /** Take every unanswered id and forget them, so the same request is failed at most once. */
@@ -112,6 +123,10 @@ export class PendingRequests {
         this.#ids.clear();
         return ids;
     }
+    /** Forget which requests were drives, once their replies are written. */
+    clearDrives() {
+        this.#drives.clear();
+    }
 }
 /**
  * JSON-RPC errors for every request that was in flight when the stream died.
@@ -126,9 +141,12 @@ export class PendingRequests {
  * with the MCP server still perfectly alive. An agent cannot tell that apart from "still working".
  */
 export function streamLossReplies(pending, reason, nextStep) {
-    return pending
-        .drain()
-        .map((id) => transportLossReply(JSON.parse(id), reason, nextStep));
+    const replies = pending.drain().map((id) => {
+        const parsed = JSON.parse(id);
+        return transportLossReply(parsed, reason, nextStep, pending.isDrive(parsed));
+    });
+    pending.clearDrives();
+    return replies;
 }
 /**
  * -32001: a server-defined error. Not -32603 (internal): nothing went wrong INSIDE the call, the
@@ -142,14 +160,16 @@ const TRANSPORT_LOSS_CODE = -32001;
  * `nextStep` is appended when the caller knows one. Without it this reply describes a condition and
  * stops there, which is all a first-run user got out of their first ever tool call.
  */
-function transportLossReply(id, reason, nextStep) {
+function transportLossReply(id, reason, nextStep, drive = false) {
     return JSON.stringify({
         jsonrpc: '2.0',
         id,
         error: {
             code: TRANSPORT_LOSS_CODE,
-            message: `the daemon connection dropped (${reason}) before this call was answered — it did NOT ` +
-                'complete. Reticle is recovering the connection; retry if the action is safe to repeat.' +
+            message: (drive
+                ? `the daemon connection dropped (${reason}) before this call was answered. ${MSG_DRIVE_MAY_BE_RUNNING}`
+                : `the daemon connection dropped (${reason}) before this call was answered — it did NOT ` +
+                    'complete. Reticle is recovering the connection; retry if the action is safe to repeat.') +
                 (nextStep === undefined ? '' : ` ${nextStep}`),
         },
     });
@@ -490,6 +510,7 @@ onUsableSession = () => undefined) {
                 if (null === failure)
                     return;
                 const msg = parseJsonRpc(line);
+                const drive = null !== msg && pending.isDrive(msg.id);
                 if (null === msg || msg.id === undefined || !pending.take(msg.id))
                     return;
                 // No outage is reported here, deliberately. A POST leg that died while the SSE stream is
@@ -503,7 +524,7 @@ onUsableSession = () => undefined) {
                     reason: failure.reason,
                     note: 'the stream is still up, so nothing else would ever have answered this call',
                 });
-                emit(transportLossReply(msg.id, failure.reason));
+                emit(transportLossReply(msg.id, failure.reason, undefined, drive));
             });
         };
         function onSseEvent(event, data, p) {

package/dist/surface/mcp/mcp.d.ts

@@ -3,6 +3,7 @@ import { z } from 'zod';
 import { type ToolDeps } from '../tools/tools.js';
 import type { ToolDef } from '../tools/tools.js';
 import { type ToolSurface } from '../tools/tool-surface.js';
+import { type ToolCall } from '../tools/tool-kit.js';
 import { type InstructionState } from './server-instructions.js';
 /** The JSON-RPC method the SDK registers its tool dispatcher under. */
 export declare const CALL_TOOL_METHOD = "tools/call";
@@ -36,6 +37,28 @@ export { firstSentence } from '../tools/first-sentence.js';
  * form with `RETICLE_ENCODING=pretty`; `RETICLE_ENCODING=toon` is the even-denser tabular encoding.
  */
 export declare function encodeResult(result: unknown, encoding: string): string;
+/** The slice of the SDK's per-request `extra` a tool call reads: cancellation and progress. */
+interface McpRequestExtra {
+    signal?: AbortSignal;
+    _meta?: {
+        progressToken?: string | number;
+    };
+    sendNotification?: (notification: {
+        method: typeof PROGRESS_NOTIFICATION;
+        params: {
+            progressToken: string | number;
+            progress: number;
+            message: string;
+        };
+    }) => Promise<void>;
+}
+declare const PROGRESS_NOTIFICATION = "notifications/progress";
+/**
+ * The request's cancellation and, when the client sent a progress token, a progress reporter. A
+ * long call (a Harness drive's wait) reports each step, so a client that resets its timeout on
+ * progress keeps waiting instead of abandoning a call that is working.
+ */
+export declare function toolCallOf(extra: McpRequestExtra | undefined): ToolCall;
 /**
  * The tools a profile advertises directly.
  *

package/dist/surface/mcp/mcp.js

@@ -38,6 +38,7 @@ import { SERVER_VERSION } from '../../command/version/identity/server-version.js
 import { setMcpClientNameHook } from '../../telemetry/feedback-context.js';
 import { getSessionMetrics } from '../../telemetry/session-metrics.js';
 import { reportMcpConnected } from '../../telemetry/mcp-connection.js';
+import { noteAgentAttached, noteAgentDetached, runAsAgent } from '../../hooks/coding-agents.js';
 import { parsePredicate } from '@reticlehq/engine/question/predicate/predicate-parse.js';
 /**
  * Merge the runtime-spliced envelope into a tool's declared outputSchema so structuredContent
@@ -192,6 +193,27 @@ export function encodeResult(result, encoding) {
     }
     return encoding === PRETTY_VALUE ? JSON.stringify(result, null, 2) : JSON.stringify(result);
 }
+const PROGRESS_NOTIFICATION = 'notifications/progress';
+/**
+ * The request's cancellation and, when the client sent a progress token, a progress reporter. A
+ * long call (a Harness drive's wait) reports each step, so a client that resets its timeout on
+ * progress keeps waiting instead of abandoning a call that is working.
+ */
+export function toolCallOf(extra) {
+    const token = extra?._meta?.progressToken;
+    const send = extra?.sendNotification;
+    return {
+        ...(extra?.signal === undefined ? {} : { signal: extra.signal }),
+        ...(token === undefined || send === undefined
+            ? {}
+            : {
+                progress: (progress, message) => void send({
+                    method: PROGRESS_NOTIFICATION,
+                    params: { progressToken: token, progress, message },
+                }).catch(() => undefined),
+            }),
+    };
+}
 /**
  * The tools a profile advertises directly.
  *
@@ -430,8 +452,10 @@ function installUnadvertisedToolHelp(server, advertised, known) {
             return original(asCallOf(request, moved.tool, moved.action), extra);
         }
         const help = name === undefined ? undefined : unadvertisedToolHelp(name, advertised, known);
+        // A failed RESULT, not a JSON-RPC error: a client that reads only `result` rendered the error
+        // as an empty success, and the agent believed `reticle_flow_save` had saved its flow.
         if (help !== undefined)
-            throw new McpError(ErrorCode.InvalidParams, help);
+            return { content: [{ type: 'text', text: help }], isError: true };
         return original(request, extra);
     });
 }
@@ -537,12 +561,15 @@ tools = tableForSurface(profile)) {
         if (info?.name === undefined)
             return;
         getSessionMetrics().recordClient(info.name, info.version);
+        // So the HUD can say which agent is connected, and credit a note to the one that read it.
+        noteAgentAttached(deps.attachId, info.name);
         // The one signal that separates "Reticle is running" from "somebody is USING it", reported from
         // the first moment it can carry WHO. It used to fire from the SSE `connect()` resolution, which
         // happens before the handshake — so every connect row was anonymous, and the field meant to say
         // which agent client converts best was empty on every event ever sent.
-        reportMcpConnected(info.name);
+        void runAsAgent(deps.attachId, () => Promise.resolve(reportMcpConnected(info.name)));
     };
+    server.server.onclose = () => noteAgentDetached(deps.attachId);
     // Which agent is on the other end, for a feedback report. Registered as a lazy hook rather than
     // read here: the handshake has not happened yet at construction time, and a report filed twenty
     // tool calls later is exactly when we want the answer.
@@ -624,9 +651,12 @@ tools = tableForSurface(profile)) {
         // clients. This removes the single largest remaining slice of the per-request tax (~36% of the
         // hybrid payload) with no loss the agent can observe.
         const config = advertisedConfig(tool, advertised, profile);
-        registerTool(tool.name, config, async (args) => {
+        registerTool(tool.name, config, async (args, extra) => {
             try {
-                const result = await runTool(tool, deps, args);
+                // Inside the caller's connection, so the telemetry this call emits after its handler (the
+                // verdict, a defect, a refusal) is credited to the agent that made it, not to whichever
+                // agent is attached.
+                const result = await runAsAgent(deps.attachId, () => runTool(tool, deps, args, toolCallOf(extra)));
                 // A tool this codebase did not write may not hand the agent a verdict.
                 //
                 // Only reached for a tool absent from the first-party table, so the shipped surface pays a

package/dist/surface/mcp/proxy/drive-calls.d.ts

@@ -0,0 +1,10 @@
+/** A `tools/call` of reticle_verify explore, directly or through the reticle_run hatch. */
+export declare function isHarnessDriveCall(msg: {
+    method?: unknown;
+    params?: unknown;
+}): boolean;
+/**
+ * A drive lives in the daemon, not in the call: a lost connection does not end it, and retrying the
+ * call as if it had not run pays for a second drive.
+ */
+export declare const MSG_DRIVE_MAY_BE_RUNNING: string;

package/dist/surface/mcp/proxy/drive-calls.js

@@ -0,0 +1,27 @@
+/** Which proxied calls are Harness drives, and what to tell an agent whose drive call was lost. */
+import { ReticleTool } from '@reticlehq/core';
+const TOOLS_CALL = 'tools/call';
+const EXPLORE_ACTION = 'explore';
+/** A `tools/call` of reticle_verify explore, directly or through the reticle_run hatch. */
+export function isHarnessDriveCall(msg) {
+    if (TOOLS_CALL !== msg.method)
+        return false;
+    const params = (msg.params ?? {});
+    const args = (params.arguments ?? {});
+    if (ReticleTool.VERIFY_EXPLORE === params.name)
+        return true;
+    if (ReticleTool.VERIFY === params.name)
+        return EXPLORE_ACTION === args['action'];
+    if (ReticleTool.RUN !== params.name)
+        return false;
+    const inner = (args['args'] ?? {});
+    return (ReticleTool.VERIFY_EXPLORE === args['tool'] ||
+        (ReticleTool.VERIFY === args['tool'] && EXPLORE_ACTION === inner['action']));
+}
+/**
+ * A drive lives in the daemon, not in the call: a lost connection does not end it, and retrying the
+ * call as if it had not run pays for a second drive.
+ */
+export const MSG_DRIVE_MAY_BE_RUNNING = `The Harness drive this call started or polled may still be running in the daemon. Once ` +
+    `Reticle reconnects, call ${ReticleTool.VERIFY} {action:"explore"} with no runId to get the ` +
+    `running drive back (it will not start a second), then poll it by runId.`;

package/dist/surface/mcp/proxy/mcp-post-transport.js

@@ -7,6 +7,7 @@
  * saying honestly that it never arrived — and the file it came from is about the SSE stream.
  */
 import * as http from 'node:http';
+import { MCP_CLIENT_DIRECTORY_HEADER } from '@reticlehq/core';
 import { log } from '../../../log.js';
 import { getSessionMetrics } from '../../../telemetry/session-metrics.js';
 import { reconnectDelayMs } from './proxy-backoff.js';
@@ -47,6 +48,10 @@ export function postToSession(url, body, request = (options, callback) => http.r
             headers: {
                 'Content-Type': 'application/json',
                 'Content-Length': bodyBuf.byteLength,
+                // The project this proxy was started in. The daemon serves every project; without this
+                // it can only see the directory it itself started in. Percent-encoded: a cwd such as
+                // `/work/项目` is not a legal header value, and Node throws before the request is sent.
+                [MCP_CLIENT_DIRECTORY_HEADER]: encodeURIComponent(process.cwd()),
             },
         };
         // A keep-alive socket carries historical bytes; retry safety depends on this request's delta.