@reticlehq/server 3.7.0 → 3.8.1

package/dist/index.js

@@ -1,26 +1,27 @@
+import { agentSessionInEnv } from './command/version/peer-announce.js';
 import { applyHarnessSwitch, harnessConfigsByRoot } from './memory/cloud/harness-config.js';
 import { coveragePercents } from './features/exhaust/ledger.js';
 import { agentWiring } from './portal/session/zero-install-first-call.js';
 import { pushIfMoved, watchAccountFiles } from './memory/impact/account-watch.js';
 import { SESSION_FILE } from './command/cli/cloud-kit.js';
+import { signedInTo } from './command/cli/auth/cloud-session.js';
 import { join } from 'node:path';
 import { homedir } from 'node:os';
 import { linkedCloudPort, sessionCloudPort } from './memory/cloud/cloud-config.js';
 import { sessionRoot } from './memory/project/session-root.js';
-import { attachCloudSync } from './memory/cloud/sync-daemon.js';
+import { attachCloudSync, flushWithin } from './memory/cloud/sync-daemon.js';
 import { wireHooks } from './hooks/hook-commands.js';
 import { currentDrivenBy } from './hooks/driven-by.js';
 import { artifactRootResolver } from './memory/project/artifact-root-resolver.js';
-import { servingDirectoryOf } from './portal/session/serving-directory.js';
+import { liveCheckoutSource, servingDirectoryOf } from './portal/session/serving-directory.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
-import { AGENT_STOPPED_NOTICE, RETICLE_DEFAULT_PORT, ReticleCommand, ReticleDir, ReticleEnv, LOOPBACK_HOST, } from '@reticlehq/core';
+import { AGENT_STOPPED_NOTICE, AGENT_DETACH_GRACE_MS, RETICLE_DEFAULT_PORT, ReticleCommand, ReticleDir, ReticleEnv, LOOPBACK_HOST, } from '@reticlehq/core';
 import { replayFromHud } from './language/flows/replay-from-hud.js';
 import { createSharedServer } from './surface/http-server.js';
 import { openLoopbackAlias } from './command/daemon/binding/loopback-alias.js';
 import { reportAppInstrumented } from './telemetry/app-instrumented.js';
 import { resolveBridgeSecurityWithAutoToken } from './portal/bridge/bridge-security.js';
 import { Bridge } from './portal/bridge/bridge.js';
-import { connectionSkew } from './command/version/version-nudge.js';
 import { SERVER_VERSION } from './command/version/identity/server-version.js';
 import { BaselineStore } from './memory/project/baselines.js';
 import { RecordingStore } from './language/flows/recording/tape/recordings.js';
@@ -38,14 +39,15 @@ import { ReticleRunner } from './judgement/runs/reticle-runner.js';
 import { createRunnerPort } from './judgement/runs/runner-port.js';
 import { RunStore } from './judgement/runs/artifact/run-store.js';
 import { startVerifyServer } from './judgement/runs/verify-server.js';
-import { createMcpServer } from './surface/mcp/mcp.js';
+import { createMcpServer, mcpServerFactoryFor } from './surface/mcp/mcp.js';
 import { instructionStateAt } from './surface/mcp/mcp-proxy.js';
 import { LEASE_ACQUIRE_TOOL } from './surface/tools/lease-tools.js';
 import { attachHudHarness, projectLinkOnly, startChatDrives } from './surface/tools/chat-drives.js';
 import { runTool } from './surface/tools/invoke-tool.js';
 import { SessionReaper, endAllSessions, MCP_DISCONNECT_SUMMARY, } from './portal/session/session-reaper.js';
 import { wireSessionScope } from './portal/session/no-session-watch.js';
-import { buildIdlePredicate, noteSetupHold } from './command/daemon/lifetime/daemon-usefulness.js';
+import { withDetachGrace } from './surface/agent-presence-grace.js';
+import { buildIdlePredicate, noteAgentPresence, noteSetupHold, } from './command/daemon/lifetime/daemon-usefulness.js';
 import { resolveToolSurface } from './surface/tools/tool-surface.js';
 import { statusPayload } from './status-payload.js';
 import { AGENT_ALREADY_DRIVING_ELSEWHERE, shouldGreetWithLeaseNotice, } from './portal/session/lease-visibility.js';
@@ -68,7 +70,8 @@ export { SessionManager } from './portal/session/session-manager.js';
 export { buildSessionRecommendation } from './portal/session/presence/session-recommendation.js';
 export { TOOLS } from './surface/tools/tools.js';
 export { createToolInvoker, UNKNOWN_TOOL_ERROR } from './surface/tools/tool-invoker.js';
-export { runTool, SESSION_BOUND_TOOLS, SESSION_EXEMPT_TOOLS } from './surface/tools/invoke-tool.js';
+export { runTool } from './surface/tools/invoke-tool.js';
+export { SESSION_BOUND_TOOLS, SESSION_EXEMPT_TOOLS } from './surface/tools/tool-kit.js';
 /**
  * The port-presence check the CLI commands (`drive`, `verify`, `status`, `doctor`, `kill`) all share,
  * re-exported so a consumer embedding `start()` in its own process can refuse a taken port the same
@@ -99,6 +102,8 @@ export { findContradictions } from '@reticlehq/engine/disagreement/contradiction
 /** Default localhost port for the verify HTTP endpoint (see docs/platform-integration.md). */
 export const RETICLE_VERIFY_DEFAULT_PORT = 7331;
 export { resolveBridgeSecurity } from './portal/bridge/bridge-security.js';
+/** How long `start().close()` waits for its last sync cycle. Exit must not hang on the network. */
+const EXIT_SYNC_BUDGET_MS = 5_000;
 /** Start the Reticle bridge (browser WS endpoint) and, by default, the MCP stdio server. */
 export async function start(options = {}) {
     const port = options.port ?? RETICLE_DEFAULT_PORT;
@@ -116,6 +121,19 @@ export async function start(options = {}) {
         coverageForRoot: (root) => () => coveragePercents(root),
     });
     const uninstallHooks = wireHooks(options.reticleRoot ?? join(process.cwd(), ReticleDir.ROOT), readProjectId(process.cwd()));
+    /*
+     * The same sync the daemon runs. `reticle drive` without a daemon and a self-booting `verify` run
+     * here, and their work waited on disk for a later daemon. It does nothing for an unlinked root,
+     * and `close` sends one last bounded cycle.
+     */
+    const cloudSync = attachCloudSync({
+        fs: createNodeFileSystem(),
+        reticleRoot: options.reticleRoot ?? join(process.cwd(), ReticleDir.ROOT),
+        homeDir: homedir(),
+        env: process.env,
+        otherRoots: knownProjectRoots,
+        clientVersion: SERVER_VERSION,
+    });
     const security = await resolveBridgeSecurityWithAutoToken(options);
     const bridge = new Bridge({ port, sdkFix: sdkFixForProject, ...security });
     // Server-authoritative liveness: a Node-side reaper (immune to browser throttling) ends sessions
@@ -128,6 +146,8 @@ export async function start(options = {}) {
     if (activeProjectId !== undefined) {
         bridge.sessions.setDefaultScope({ projectId: activeProjectId });
     }
+    // Then to the agent's own git worktree: every worktree declares the same projectId.
+    bridge.sessions.setCheckoutScope(liveCheckoutSource());
     const baselines = new BaselineStore();
     const recordings = new RecordingStore(() => currentDrivenBy() !== undefined);
     // drive precedence: driveUrl (launch+own a browser) → CDP (attach) → none.
@@ -158,6 +178,8 @@ export async function start(options = {}) {
             reportStep: reportOnboardingStep,
             flows,
             author: flowAuthor,
+            // A run or flow written mid-drive goes out within seconds, as it does under the daemon.
+            onRunPersisted: () => cloudSync.nudge(),
         });
         const project = new ProjectStore(fs, reticleRoot, { now });
         attachRouteLearning(bridge, projectStoreResolver(fs, project, reticleRoot, now));
@@ -181,8 +203,9 @@ export async function start(options = {}) {
         bridge.attachSessionCreate((session) => {
             const leasedIds = leasePool.leasedSessionIds();
             const leasedProjects = leasedIds.map((id) => bridge.sessions.get(id)?.projectId);
-            if (shouldGreetWithLeaseNotice(session, leasedIds, leasedProjects))
+            if (shouldGreetWithLeaseNotice(session, leasedIds, leasedProjects)) {
                 session.pushNarration(AGENT_ALREADY_DRIVING_ELSEWHERE);
+            }
         });
         const deps = {
             sessions: bridge.sessions,
@@ -198,6 +221,7 @@ export async function start(options = {}) {
             artifactRootFor: artifactRootResolver(reticleRoot, { servingDirectory: servingDirectoryOf }),
             now,
             bridgePort: port,
+            nonces: bridge.nonces,
             browserProbe: probeLaunchableChromium,
             // The daemon's OWN project, so a tool can tell "this session is mine" from "this session
             // belongs to a sibling app under the same daemon". contract_save refuses on the second.
@@ -210,12 +234,16 @@ export async function start(options = {}) {
             sessionCloud: sessionCloudPort(fs, homedir(), process.env, (id) => sessionRoot(toolDeps, id)),
             version: SERVER_VERSION,
         }, log);
-        const server = createMcpServer(toolDeps, profile, instructionStateAt(port, bridge.sessions.count()));
+        // Over stdio this process IS the agent's MCP server: the agent's session is in its environment.
+        const agentSession = agentSessionInEnv(process.env);
+        const server = createMcpServer(agentSession === undefined ? toolDeps : { ...toolDeps, agentSession }, profile, instructionStateAt(port, bridge.sessions.count()));
         // When the agent (the MCP client) disconnects cleanly, end every active session at once so the
         // HUD doesn't linger. (If the agent instead KILLS this process, the WS dies and the browser
         // self-ends via SESSION_LIFECYCLE.BRIDGE_LOST_MS — see transport.ts.)
         server.server.onclose = () => {
             endAllSessions(bridge.sessions, MCP_DISCONNECT_SUMMARY);
+            // The client often kills this process without calling `close`: send what the teardown wrote.
+            cloudSync.nudge();
         };
         await server.connect(new StdioServerTransport());
         log('mcp_connected', { port });
@@ -230,6 +258,7 @@ export async function start(options = {}) {
             await cleanupCaptureDirectories();
             leaseReaper?.stop();
             chatDrives?.stop();
+            await flushWithin(cloudSync, EXIT_SYNC_BUDGET_MS);
             await pool?.shutdown();
             await owned?.dispose();
             await bridge.close();
@@ -268,11 +297,14 @@ export async function startDaemon(options = {}) {
         sdkFix: sdkFixForProject,
         ...security,
     });
+    // The daemon serves every agent on the machine: scope id-less calls to the calling agent's worktree.
+    bridge.sessions.setCheckoutScope(liveCheckoutSource());
     const repaint = (only, ifChanged = false) => {
         for (const session of bridge.sessions.all()) {
             const root = session.artifactRoot ?? options.reticleRoot ?? join(process.cwd(), ReticleDir.ROOT);
-            if ((only ?? root) === root)
+            if ((only ?? root) === root) {
                 pushIfMoved(session, () => impactSnapshot(root), ifChanged);
+            }
         }
     };
     pushHarnessConfig = repaint;
@@ -289,22 +321,29 @@ export async function startDaemon(options = {}) {
     // the requested `--http-port` instead of silently ignoring the flag (#687).
     shared.attachStatus((held) => {
         // `init` holds the daemon it is waiting on, so the idle rule cannot shut it down mid-wait.
-        if (held)
+        if (held) {
             noteSetupHold(Date.now());
-        return statusPayload(bridge.sessions.count(), bridge.sessions.list(), bridge.sessions.noSessionHint(), verifyHttp?.port, bridge.sessions.noSessionLead(), bridge.sessions.all());
+        }
+        const tabs = bridge.sessions.all();
+        return statusPayload(bridge.sessions.count(), bridge.sessions.list(), bridge.sessions.noSessionHint(), verifyHttp?.port, bridge.sessions.noSessionLead(), tabs, tabs.map((session) => session.sdkVersion ?? null));
     });
+    // Called when an agent connects. The pages already up are the ones a restart would skew (#1709).
+    shared.attachPageSdkVersions(() => bridge.sessions.all().map((session) => session.sdkVersion));
     // Agent-independent presence: the daemon outlives any single agent, so when the LAST agent's MCP
     // connection drops (it stopped, or is waiting on the human), end every session and push a clear
     // "go to your terminal" notice to the panel — the human is on the browser and must not lose a typed
     // prompt into a dead session. A returning agent's next tool call revives the auto-ended session.
     // Track agent presence for the idle-shutdown predicate (below): the daemon is "idle" only when no
     // agent is attached AND no browser tab is connected AND no pool lease is active.
+    // The detach waits a short grace: a proxy that reconnects inside it keeps the sessions.
     let agentConnected = false;
-    shared.attachAgentPresence((connected) => {
+    shared.attachAgentPresence(withDetachGrace((connected) => {
         agentConnected = connected;
-        if (!connected)
+        noteAgentPresence(Date.now());
+        if (!connected) {
             endAllSessions(bridge.sessions, AGENT_STOPPED_NOTICE);
-    });
+        }
+    }, AGENT_DETACH_GRACE_MS));
     const reaper = new SessionReaper(bridge.sessions);
     reaper.start();
     const { realInput, owned } = await resolveRealInput(options, () => shared.close(), makeNetworkDetailRouter(bridge, options.driveUrl));
@@ -366,12 +405,15 @@ export async function startDaemon(options = {}) {
         homeDir: homedir(),
         env: process.env,
         otherRoots: knownProjectRoots,
+        clientVersion: SERVER_VERSION,
+        signedIn: (url) => signedInTo(join(homedir(), ReticleDir.ROOT), url),
     });
     syncNudge.run = () => cloudSync.nudge();
     // `syncNow`, not `nudge` (a cycle soon): somebody is watching the button. Never awaited.
     bridge.attachSyncRequest(() => void cloudSync.syncNow());
-    if (options.hudSignIn !== undefined)
+    if (options.hudSignIn !== undefined) {
         bridge.attachSigninRequest(options.hudSignIn(repaint, projectLinkOnly(options.hudLink)));
+    }
     // Logout and link run in another process: repaint when their files change, the rest on a timer.
     const accountFiles = watchAccountFiles(repaint, undefined, () => repaint(undefined, true));
     accountFiles.watch(join(homedir(), ReticleDir.ROOT, SESSION_FILE));
@@ -409,19 +451,16 @@ export async function startDaemon(options = {}) {
         artifactRootFor: artifactRootResolver(reticleRoot, { servingDirectory: servingDirectoryOf }),
         now,
         bridgePort: port,
+        nonces: bridge.nonces,
         browserProbe: probeLaunchableChromium,
-        ...agentWiring(port, bridge.sessions, leaseUrl),
+        ...agentWiring(bridge.sessions, leaseUrl),
         // A finished verification should not sit behind a one-minute timer — see ToolDeps.onRunPersisted.
         onRunPersisted: () => cloudSync.nudge(),
         syncNow: () => cloudSync.syncNow(),
     };
     const profile = resolveToolSurface(options.toolProfile);
     const effectiveDeps = realInput !== undefined ? { ...deps, realInput } : deps;
-    // Read per attach, not once: a project that gets wired while this daemon is alive should stop
-    // being told to wire itself on the next agent that connects.
-    shared.attachMcp((peerSkew) => createMcpServer(peerSkew === undefined
-        ? effectiveDeps
-        : { ...effectiveDeps, peerSkew: connectionSkew(peerSkew) }, profile, instructionStateAt(port, bridge.sessions.count())));
+    shared.attachMcp(mcpServerFactoryFor(effectiveDeps, profile, () => instructionStateAt(port, bridge.sessions.count())));
     shared.attachDrive(leaseUrl); // `reticle drive <url>` — see cli/drive/drive-attach.ts.
     // The platform chat's apps and drives, run here. See chat-drives.ts.
     const chatDrives = startChatDrives(effectiveDeps, bridge.sessions, fs, {
@@ -446,8 +485,9 @@ export async function startDaemon(options = {}) {
     // verdict into the same activity log they watch the agent in. The page animates via the normal
     // replay path, so they see it re-drive and the ✓/⚠/✗ land.
     bridge.attachReplay((sessionId, flowName) => {
-        if (bridge.sessions.get(sessionId) === undefined)
+        if (bridge.sessions.get(sessionId) === undefined) {
             return;
+        }
         void replayFromHud(effectiveDeps, (id) => bridge.sessions.get(id), sessionId, flowName);
     });
     // On connect, hand the panel the replayable flows so it can render the ▶ list. Scoped to the
@@ -511,12 +551,14 @@ export async function startDaemon(options = {}) {
         // says WHETHER it is idle; this says how long that quiet should be tolerated — see idle-grace.
         agentAttached: () => agentConnected,
         announceShutdown: () => shared.announceShutdown(),
+        onShutdownRequest: (handler) => shared.attachShutdown(handler),
         close: async () => {
             reaper.stop();
             await cleanupCaptureDirectories();
             const vh = verifyHttp;
-            if (vh !== undefined)
+            if (vh !== undefined) {
                 await new Promise((resolve) => vh.server.close(() => resolve()));
+            }
             leaseReaper.stop();
             chatDrives.stop();
             accountFiles.close();

package/dist/judgement/app-graph/journal-steps.d.ts

@@ -0,0 +1,8 @@
+/**
+ * A session's journal as the App Graph's driven steps (`@reticlehq/core`'s `mapOfRun`): what each act
+ * pressed, anchored the way a flow anchors it, the events of its own window, and whether what it
+ * declared held. The cloud reads the same steps off its harness's calls; a coding agent's acts are
+ * read off the journal the daemon already keeps, so building the graph costs the act path nothing.
+ */
+import { type DrivenStep, type JournalAction, type ReticleEvent } from '@reticlehq/core';
+export declare function journalSteps(actions: readonly JournalAction[], events: readonly ReticleEvent[]): DrivenStep[];

package/dist/judgement/app-graph/journal-steps.js

@@ -0,0 +1,92 @@
+/**
+ * A session's journal as the App Graph's driven steps (`@reticlehq/core`'s `mapOfRun`): what each act
+ * pressed, anchored the way a flow anchors it, the events of its own window, and whether what it
+ * declared held. The cloud reads the same steps off its harness's calls; a coding agent's acts are
+ * read off the journal the daemon already keeps, so building the graph costs the act path nothing.
+ */
+import { ReticleTool, asString, } from '@reticlehq/core';
+/** The acts that press something. Reads, waits and navigation press nothing. */
+const PRESSING = new Set([
+    ReticleTool.ACT,
+    ReticleTool.ACT_AND_WAIT,
+    ReticleTool.ACT_SEQUENCE,
+]);
+const record = (value) => 'object' === typeof value && null !== value ? value : {};
+/** A step's target as a flow's anchor; undefined for a ref, which no later run can find again. */
+const anchorOf = (step) => {
+    const target = record(step['target']);
+    const testid = asString(target['testid']) ?? ('testid' === step['by'] ? asString(step['value']) : undefined);
+    if (testid !== undefined) {
+        return { by: 'testid', value: testid };
+    }
+    const role = asString(target['role']) ?? ('role' === step['by'] ? asString(step['value']) : undefined);
+    const name = asString(target['name']) ?? asString(step['name']);
+    return role !== undefined && name !== undefined ? { by: 'role', value: role, name } : undefined;
+};
+const heldOf = (effect) => {
+    const verified = record(effect)['verified'];
+    if ('yes' === verified) {
+        return true;
+    }
+    if ('no' === verified) {
+        return false;
+    }
+    return undefined;
+};
+export function journalSteps(actions, events) {
+    const steps = [];
+    const within = (from, to) => events.filter((e) => e.t >= from && e.t <= to);
+    // The steps of the last sequence, by index, so its later verdict lines find them.
+    let sequence = [];
+    for (const a of actions) {
+        if (!PRESSING.has(a.tool)) {
+            continue;
+        }
+        const args = record(a.args);
+        const index = args['step'];
+        // A sequence's verdict for one of its steps arrives as its own line.
+        if ('number' === typeof index) {
+            const step = sequence[index];
+            const held = heldOf(a.effect);
+            if (step !== undefined && held !== undefined) {
+                step.held = held;
+            }
+            continue;
+        }
+        const inner = Array.isArray(args['steps']) ? args['steps'].map(record) : undefined;
+        if (inner === undefined) {
+            const anchor = anchorOf(args);
+            if (anchor === undefined) {
+                continue;
+            }
+            const held = heldOf(a.effect);
+            steps.push({
+                anchor,
+                since: a.tRange.from,
+                window: within(a.tRange.from, a.tRange.to),
+                ...(held === undefined ? {} : { held }),
+            });
+            continue;
+        }
+        // ponytail: one window for the whole sequence, credited to its last step; per-step windows
+        // would need the journal to record each step's range.
+        sequence = [];
+        inner.forEach((step, i) => {
+            const anchor = anchorOf(step);
+            const last = i === inner.length - 1;
+            const driven = anchor === undefined
+                ? undefined
+                : {
+                    anchor,
+                    since: a.tRange.from,
+                    window: last ? within(a.tRange.from, a.tRange.to) : [],
+                };
+            if (driven !== undefined) {
+                steps.push(driven);
+            }
+            // Kept by position, so a step without an anchor still takes its index.
+            sequence[i] = driven ?? { anchor: {}, since: a.tRange.from, window: [] };
+        });
+    }
+    return steps;
+}

package/dist/judgement/capsule/capsule-store.d.ts

@@ -18,52 +18,15 @@ export declare const CAPSULE_VERSION = 1;
 declare const CapsuleSchema: z.ZodObject<{
     version: z.ZodLiteral<1>;
     id: z.ZodString;
-    /** The flow the failure happened in, when it came from one (a bare assert has no flow). */
     flow: z.ZodOptional<z.ZodString>;
     createdAt: z.ZodNumber;
-    /** Why it was captured — a failed assertion, a crawl anomaly, a human review pin. */
     origin: z.ZodString;
-    /** The consequence that was supposed to hold. */
     expected: z.ZodString;
-    /** What was observed instead — the first-divergence sentence. */
     observed: z.ZodString;
-    /** Minimal steps to reproduce (prefix-trimmed). */
-    steps: z.ZodArray<z.ZodType<FlowStep, z.ZodTypeDef, FlowStep>, "many">;
-    /**
-     * How many times this exact failure has been captured, and when it last was.
-     *
-     * A repeat is not a new capsule -- it is the same one, again. "This failed 37 times, most
-     * recently at T" is strictly MORE than 37 files each holding one timestamp, so folding the
-     * duplicates in adds information rather than discarding it.
-     *
-     * Optional, because a capsule written before these existed has neither and must not be read as
-     * though it were seen once when nobody counted.
-     */
+    steps: z.ZodArray<z.ZodType<FlowStep, unknown, z.core.$ZodTypeInternals<FlowStep, unknown>>>;
     seen: z.ZodOptional<z.ZodNumber>;
     lastSeenAt: z.ZodOptional<z.ZodNumber>;
-}, "strip", z.ZodTypeAny, {
-    version: 1;
-    id: string;
-    origin: string;
-    createdAt: number;
-    expected: string;
-    steps: FlowStep[];
-    observed: string;
-    flow?: string | undefined;
-    seen?: number | undefined;
-    lastSeenAt?: number | undefined;
-}, {
-    version: 1;
-    id: string;
-    origin: string;
-    createdAt: number;
-    expected: string;
-    steps: FlowStep[];
-    observed: string;
-    flow?: string | undefined;
-    seen?: number | undefined;
-    lastSeenAt?: number | undefined;
-}>;
+}, z.core.$strip>;
 export type Capsule = z.infer<typeof CapsuleSchema>;
 /** Capsule ids are filenames — refuse anything that could escape the capsules directory. */
 export declare function isValidCapsuleId(id: string): boolean;

package/dist/judgement/domain/domain-model.js

@@ -13,18 +13,9 @@
  * Pure: no IO, no clock. The tool layer loads flows + contract and calls this.
  */
 import { AnchorKind, PredicateKind, compareSourceClauses, } from '@reticlehq/core';
-import { classifyFlowAssertions, FlowAssertionGrade } from '../../language/flows/flow-classify.js';
+import { classifyFlowAssertions, FlowAssertionGrade, flattenSteps as flatten, } from '../../language/flows/flow-classify.js';
 import { successLabel } from '../../language/flows/flow-success.js';
 import { flowRisk, latestRun, rankByRisk, RiskLevel } from './flow-risk.js';
-function flatten(steps) {
-    const out = [];
-    for (const s of steps) {
-        out.push(s);
-        if (s.steps !== undefined)
-            out.push(...flatten(s.steps));
-    }
-    return out;
-}
 /*
  * The vocabulary a flow uses, read out of a predicate TREE.
  *

package/dist/judgement/domain/domain-tools.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
 import { projectForRoot } from '../../memory/project/project-for-root.js';
 import { sessionRoot } from '../../memory/project/session-root.js';
+import { flowsForSessionId } from '../../language/flows/flow-store-for-session.js';
 import { asNumber, asString } from '@reticlehq/core';
 import { ReticleTool } from '@reticlehq/core';
 import { countSchema } from '../../surface/tools/args/numeric-bounds.js';
@@ -69,10 +70,11 @@ export const DOMAIN_TOOLS = [
                 .describe('Ready-to-apply instrumentation proposals for gaps that have a source location — { file, line, insert, rationale }. Apply, re-verify, and the app’s observability compounds.'),
         },
         handler: async (deps, args) => {
-            const names = await deps.flows.list();
+            const { flows: store, projectId } = flowsForSessionId(deps, asString(args['sessionId']));
+            const names = await store.list(projectId);
             const flows = [];
             for (const name of names) {
-                const loaded = await deps.flows.load(name);
+                const loaded = await store.load(name, projectId);
                 if (loaded.ok)
                     flows.push(loaded.value);
             }

package/dist/judgement/runs/artifact/run-store.d.ts

@@ -5,8 +5,8 @@
  * individual run to a deploy. The run is already clock-stamped by buildVerificationRun, so the store
  * needs no clock.
  */
-import { RunReadError, type ReticleVerificationRun, type RunId, type RunScreenshot } from '@reticlehq/core';
-import type { FileSystemPort } from '../../../memory/project/fs/fs-port.js';
+import { RunReadError, type ReticleVerificationRun, type RunFlowResult, type RunId, type RunScreenshot } from '@reticlehq/core';
+import { type FileSystemPort } from '../../../memory/project/fs/fs-port.js';
 /** Never-throws read result (mirrors ReadProjectResult). */
 export type ReadRunResult = {
     ok: true;
@@ -30,21 +30,41 @@ interface RunStoreOptions {
      */
     onWrote?: () => void;
 }
+interface FlowAt {
+    result: RunFlowResult;
+    createdAt: number;
+    id: string;
+}
 export declare class RunStore {
     #private;
     constructor(fs: FileSystemPort, root: string, opts?: RunStoreOptions);
-    /**
-     * Write one run artifact. Creates .reticle/runs/ first; byte-stable (fixed indent + trailing newline).
-     * Guards runId as a safe path segment BEFORE building the path — a runId can originate from a caller
-     * (an OEM may set it), so an unsafe value must never escape .reticle/runs/ (mirrors the read guard).
-     */
-    write(given: ReticleVerificationRun): Promise<void>;
+    write(given: ReticleVerificationRun, 
+    /** The tab the run came from, so a run written outside any call still finds its episode. */
+    hint?: {
+        sessionId?: string;
+    }): Promise<void>;
     /** Never throws. Invalid id / missing → MISSING; bad JSON or failed schema → MALFORMED. */
     read(runId: RunId): Promise<ReadRunResult>;
     /** List run ids on disk (filenames minus.json). Empty when the runs dir is absent. */
     list(): Promise<RunId[]>;
+    /** Every readable run. Retention bounds how many there are. */
+    all(): Promise<ReticleVerificationRun[]>;
     /** The most-recent run by createdAt (undefined when none). Powers reticle_run_export's default. */
     latest(): Promise<ReticleVerificationRun | undefined>;
+    /**
+     * The newest recorded result for each flow name, taken across every readable run, with the time
+     * and id of the run it came from. A run that carries no flows (a drive or an export) says nothing
+     * about any flow, so it can neither supply nor erase a result: judging coverage from `latest()`
+     * alone let one such run hide every earlier replay. Equal times break on the run id, so the answer
+     * never depends on the order `list()` returns.
+     */
+    latestPerFlow(): Promise<Map<string, FlowAt>>;
+    /**
+     * The names `credit` (the gate's passing rule) gives each flow's newest result, each with the time
+     * of that result, so a caller can refuse a pass that predates an edit. The rule is passed in, so
+     * the run store does not reach into the flow language.
+     */
+    passingFlowTimes(credit: (flows: readonly RunFlowResult[]) => readonly string[]): Promise<Map<string, number>>;
     /**
      * The two most-recent runs by createdAt as `[previous, current]` (oldest-first), or undefined when
      * fewer than two readable runs exist. Powers reticle_run_export's `format:"diff"` (run-to-run deltas).