@reticlehq/server 3.7.0 → 3.8.1

package/dist/command/cli/cli-usage.js

@@ -9,6 +9,7 @@
  * not: `npx reticle` resolves the PACKAGE named `reticle`, which belongs to somebody else, and npx
  * will happily fetch and run it. So the npx spelling leads every page.
  */
+import { FEEDBACK_KIND_CHOICES } from '@reticlehq/core';
 export const HelpGroup = {
     START: 'Get started',
     CHECK: 'Check your app',
@@ -21,14 +22,16 @@ export const HelpGroup = {
 export const HELP_ALL_TOPIC = 'all';
 const INIT_DETAIL = `init wires the project, boots the app and proves a page connected. It ends with the
 instrumentation score, what is missing, and a prompt for your coding agent, which proves
-the first flow. It never drives: the Harness is opt-in and unlocks at 80% instrumentation.
+the first flow. It never drives: the Harness is opt-in and runs at any instrumentation score.
 
   --app <dir>        which app in a monorepo: writes its files only (add --start to boot it)
   --env KEY=VALUE    what the app needs to reach a usable state (repeatable)
   --files-only       write the files and stop; do not boot the app
   --no-install       do not install packages
+  --new-id           give this checkout its own project id (a copied repo keeps the original's)
   --no-mcp           skip the MCP registration, the agent rule files and the /reticle command
   --hooks            also install the agent hooks
+  --no-prompt-capture  install no hook that saves each prompt to .reticle/
   --relaunch         print the command that restarts this agent conversation with the tools loaded
   --license <key>    write an enterprise key to .env and keep .env out of git
   --json             print the result as one JSON object on stdout
@@ -47,11 +50,15 @@ const VERIFY_DETAIL = `Drives the URL and verifies the saved flows. Exit 0 means
   --session-id <id>, --timeout N, --headed, --port N
   --expect '<json predicate>' | --expect-file <path>
                                 one verdict, no saved flows needed. Asks a running daemon,
-                                never starts one. Exit 0 only on verified:"yes". For an
+                                never starts one, and waits up to --timeout ms (default 4000)
+                                for it to come true. Exit 0 only on verified:"yes". For an
                                 action --expect cannot do, use the HTTP MCP transport:
                                 https://docs.reticle.sh/http-transport.md`;
 const BROWSER_NOTE = `The browser Reticle opens for your agent is shown so you can watch the run. --headless hides
 it; CI, RETICLE_HEADLESS=1, or a Linux machine with no display hides it too.`;
+/** What `--http` starts. MCP is already on the bridge port; this flag is the verify endpoint. */
+const HTTP_HELP = '--http starts the verify endpoint. MCP is already served on the bridge port.';
+const DAEMON_DETAIL = `${BROWSER_NOTE}\n\n${HTTP_HELP}`;
 const COMMANDS = [
     {
         name: 'init',
@@ -72,9 +79,8 @@ const COMMANDS = [
             '  --project <name|id>    the dashboard project to link\n' +
             '  --workspace <name|id>  the workspace to link in, when you belong to more than one\n' +
             '  --url <origin>         the Reticle platform, when it is not the default\n\n' +
-            'Without a browser (CI, an agent), in two steps:\n' +
-            '  reticle login --email <e> [--org <name>]     emails a 6-digit code\n' +
-            '  reticle login --email <e> --code <123456>    signs in, then links this repo',
+            'Sign-in is with Google or GitHub, in the browser. Without a browser (CI, an agent), set\n' +
+            'RETICLE_API_KEY to a key from Settings > API keys. Email sign-in is gone.',
     },
     {
         name: 'try',
@@ -110,16 +116,18 @@ const COMMANDS = [
     },
     {
         name: 'open',
-        synopsis: 'open [url] [--port N]',
+        synopsis: 'open [url] [--port N] [--navigate]',
         summary: 'Open the app in your browser, or reuse a tab that is already connected',
         group: HelpGroup.MACHINE,
+        detail: '--navigate moves a tab already on that origin to the url instead of leaving it.',
     },
     {
         name: 'stop',
         synopsis: 'stop [--force] [--quiet] [--port N]',
         summary: 'Stop Reticle; --force frees its port even without a recorded pid',
         group: HelpGroup.MACHINE,
-        detail: 'Without --force, stops the daemon Reticle started, by its recorded pid.\n' +
+        detail: 'Without --force, asks the daemon to stop (an authenticated request on loopback), and sends\n' +
+            'a signal to its recorded pid only if it does not accept.\n' +
             "With --force, frees the port by the Reticle daemon LISTENING on it, never the agent's MCP\n" +
             'proxy, and refuses a listener that is not Reticle.',
     },
@@ -143,11 +151,12 @@ const COMMANDS = [
     },
     {
         name: 'feedback',
-        synopsis: 'feedback [--rating 1-5] [--bug] "message"',
+        synopsis: 'feedback [--rating 1-5] [--bug] [--contact <email>] "message"',
         summary: "Tell us what worked and what didn't; prints exactly what it sends",
         group: HelpGroup.ACCOUNT,
-        detail: 'Agents: reticle feedback --agent --kind <bug|gap|ambiguity|feature_request|improvement|experience> "message"\n' +
-            'works from anywhere, including a setup that never finished.',
+        detail: `Agents: reticle feedback --agent --kind ${FEEDBACK_KIND_CHOICES} "message"\n` +
+            'works from anywhere, including a setup that never finished.\n' +
+            '--contact <email> adds an address for a reply. It is sent only when you give it.',
     },
     {
         name: 'telemetry',
@@ -177,7 +186,7 @@ const COMMANDS = [
     },
     {
         name: 'config',
-        synopsis: 'config [--runs on|off] [--memory on|off] [--flows on|off] [--verify local|server]',
+        synopsis: 'config [--runs on|off] [--memory on|off] [--flows on|off] [--verify local|server] [--harness on|off]',
         summary: 'What this project sends to the dashboard',
         group: HelpGroup.MORE,
     },
@@ -199,19 +208,34 @@ const COMMANDS = [
         summary: 'Resume after a compaction: what was proved, failed and is still owed',
         group: HelpGroup.MORE,
     },
+    {
+        name: 'hook',
+        synopsis: 'hook [install|uninstall|status|prompt --agent <id>|tool --agent <id>|export --structure]',
+        summary: 'Save prompts, tool calls, the model and closing messages to .reticle/, through your agent hooks',
+        group: HelpGroup.MORE,
+        detail: '  hook install      add the prompt-capture hook for the agents used here\n' +
+            '  hook uninstall    remove exactly the entries hook install added\n' +
+            '  hook status       which agents capture prompts, and which rely on the MCP instructions\n' +
+            '  hook prompt --agent <id>   what the agent hook runs; reads the prompt on stdin\n' +
+            '  hook tool --agent <id>     what the post-tool hook runs; keeps the call in .reticle/episodes/\n' +
+            '  hook export --structure    each snapshot step in .reticle/episodes/ as text-free page structure (JSONL)\n\n' +
+            'One switch stops prompts, tool calls, the model and the closing message. Off for one project:\n' +
+            '"promptCapture": false in .reticle.json. Off on this machine: RETICLE_PROMPT_CAPTURE=0.\n' +
+            'Tool calls also stop with the journal: "journal": false or RETICLE_JOURNAL=0.',
+    },
     {
         name: 'mcp',
         synopsis: 'mcp [--port N] [--drive <url>] [--headless] [--headed] [--http] [--http-port N] [--http-token T]',
         summary: 'The MCP stdio server your agent runs; starts the daemon if needed',
         group: HelpGroup.MORE,
-        detail: BROWSER_NOTE,
+        detail: DAEMON_DETAIL,
     },
     {
         name: 'serve',
         synopsis: 'serve [--port N] [--drive <url>] [--headless] [--headed] [--http] [--http-port N] [--http-token T]',
         summary: 'Start the daemon in the background; returns once it answers',
         group: HelpGroup.MORE,
-        detail: BROWSER_NOTE,
+        detail: DAEMON_DETAIL,
     },
     {
         name: 'drive',
@@ -268,15 +292,18 @@ export const DOCUMENTED_COMMANDS = COMMANDS.map((c) => c.name);
  * answers with the page of the command that replaced it, and says so.
  */
 export function renderHelp(topic, renamed = new Map()) {
-    if (topic === undefined)
+    if (topic === undefined) {
         return CLI_USAGE;
-    if (HELP_ALL_TOPIC === topic)
+    }
+    if (HELP_ALL_TOPIC === topic) {
         return CLI_USAGE_ALL;
+    }
     const now = renamed.get(topic);
     const target = now?.split(' ')[0] ?? topic;
     const doc = COMMANDS.find((c) => c.name === target);
-    if (doc === undefined)
+    if (doc === undefined) {
         return CLI_USAGE;
+    }
     return [
         `usage:  reticle ${doc.synopsis}`,
         ...(now === undefined ? [] : [`        (\`reticle ${topic}\` is now \`reticle ${now}\`)`]),

package/dist/command/cli/cli-verify.d.ts

@@ -81,7 +81,7 @@ interface VerifyArgs {
     resultsJson?: string;
 }
 /** Orchestration: boot → wait for a session → replay flows → verdict → exit code. Browser-free. */
-export declare function runVerify(args: VerifyArgs, ports: VerifyPorts): Promise<void>;
+export declare function runVerify(args: VerifyArgs, outer: VerifyPorts): Promise<void>;
 /**
  * Why the run did not reach the dashboard. A revoked key left CI green with "cloud run sync failed
  * (401)" in the log as the only trace; a refused key is said as one, loudly.

package/dist/command/cli/cli-verify.js

@@ -9,7 +9,7 @@
  * so the decision logic — including the two honesty guards (no session, no flows ⇒ never a green pass)
  * — is unit-tested without launching a real browser.
  */
-import { CLI_CLIENT_NAME } from '../../judgement/runs/verification-sync.js';
+import { cliRunAuthor } from '../../judgement/runs/verification-sync.js';
 import { join, basename } from 'node:path';
 import { readFileSync } from 'node:fs';
 import { runAdhocVerdict } from './adhoc-verdict.js';
@@ -24,7 +24,7 @@ import { resolveSuiteSelection } from '../../language/flows/suite-selection.js';
 import { projectOnly } from '../../memory/project/session-root.js';
 import { configuredPairingToken, nodePairingTokenDeps, readOrCreatePairingTokenSync, defaultPairingTokenDir, } from '../../portal/bridge/pairing-token.js';
 import { randomUUID } from 'node:crypto';
-import { MCP_SSE_PATH, MCP_MESSAGE_PATH, RETICLE_DEFAULT_PORT, ReticleEnv, bridgeWsUrl, isLoopbackHostname, ReticleDir, RunAgentKind, RunFramework, RunProfile, RunTrigger, VerdictStatus, VerifyPhase, } from '@reticlehq/core';
+import { MCP_SSE_PATH, MCP_MESSAGE_PATH, RETICLE_DEFAULT_PORT, ReticleEnv, bridgeWsUrl, isLoopbackHostname, ReticleDir, RunFramework, RunProfile, VerdictStatus, VerifyPhase, } from '@reticlehq/core';
 import { start } from '../../index.js';
 import { probePresence, describePresence, PortPresence, } from '../daemon/binding/port-presence.js';
 import { EXPECT_FLAG } from './cli-parse-grammar.js';
@@ -59,7 +59,6 @@ const DEFAULT_PROJECT_NAME = 'app';
 export function verifyProjectName(linked, configured, folder) {
     return linked ?? configured ?? (folder || DEFAULT_PROJECT_NAME);
 }
-const VERIFY_AGENT_ID = CLI_CLIENT_NAME;
 const MSG_NO_SESSION = 'No app connected: Reticle drove the URL but no @reticlehq/browser session dialed back.\n' +
     '  Make sure the SDK is in the build and reticle.connect() runs on the preview page' +
     ' (for a non-localhost preview: allowNonLocalhost + a pairing token).';
@@ -85,10 +84,22 @@ async function openConnection(ports) {
     }
 }
 /** Orchestration: boot → wait for a session → replay flows → verdict → exit code. Browser-free. */
-export async function runVerify(args, ports) {
-    const conn = await openConnection(ports);
+export async function runVerify(args, outer) {
+    const conn = await openConnection(outer);
     if (conn === undefined)
         return;
+    /*
+     * The exit is held until the connection has closed. The live exit is process.exit, and close()
+     * runs the last cloud sync cycle that sends this run's flows and screenshots: exiting first skipped
+     * the `finally` below, so with no daemon running the run reached the dashboard without them.
+     */
+    let exitCode;
+    const ports = {
+        ...outer,
+        exit: (code) => {
+            exitCode = code;
+        },
+    };
     try {
         const ready = await conn.sessionReady(args.timeoutMs);
         if (!ready) {
@@ -160,7 +171,7 @@ export async function runVerify(args, ports) {
             progress.stop();
             await progress.flush().catch(() => undefined);
         }
-        await pushRunToCloud(run, cloud, ports); // best-effort; opt-in; never changes the verdict or exit code
+        const pushed = await pushRunToCloud(run, cloud, ports); // best-effort; opt-in; never changes the verdict or exit code
         /*
          * The last event anybody watching is waiting for, sent after the artifact has actually landed —
          * so "pushed" on a dashboard means the run is really there, not that we were about to try.
@@ -169,7 +180,7 @@ export async function runVerify(args, ports) {
         // The run's OWN injected timestamp — no wall clock is read in this path (rule 7).
         [{ phase: VerifyPhase.PUSHED, at: run.createdAt }], cloud, cloudFetch).catch(() => undefined);
         if (args.resultsJson !== undefined && ports.writeResults !== undefined) {
-            await ports.writeResults(args.resultsJson, `${JSON.stringify(verifyResults(run), null, 2)}\n`);
+            await ports.writeResults(args.resultsJson, `${JSON.stringify(verifyResults(run, pushed), null, 2)}\n`);
         }
         ports.out(renderRunReport(run));
         ports.exit(run.verdict.status === VerdictStatus.PASS ? EXIT_PASS : EXIT_FAIL);
@@ -180,6 +191,9 @@ export async function runVerify(args, ports) {
     }
     finally {
         await conn.close().catch(() => undefined);
+        // In the finally, so the early refusals that `return` from the try exit too.
+        if (exitCode !== undefined)
+            outer.exit(exitCode);
     }
 }
 /**
@@ -222,7 +236,7 @@ async function pushRunToCloud(run, config, ports) {
     if (null === config) {
         ports.out(`run ${run.runId} was kept on this computer: this repo is not linked, so nothing was sent ` +
             `to the dashboard. To save runs for your team: ${CONNECT}`);
-        return;
+        return false;
     }
     const result = await syncRunToCloud(run, config, cloudFetch);
     if (result.outcome === SyncOutcome.SYNCED) {
@@ -230,10 +244,10 @@ async function pushRunToCloud(run, config, ports) {
         ports.out(dashboard === undefined
             ? `↑ run ${run.runId} recorded on the Reticle dashboard`
             : seeRunLine(dashboard, run.runId));
+        return true;
     }
-    else {
-        ports.fail(runSyncFailure(result.status, result.error));
-    }
+    ports.fail(runSyncFailure(result.status, result.error));
+    return false;
 }
 /** The platform answered: the credential was not accepted. */
 const REFUSED_STATUSES = new Set([401, 403]);
@@ -360,12 +374,11 @@ async function openLiveConnection(opts) {
         verify: async (onProgress) => {
             const run = await runner.verify({
                 project: { name: opts.projectName, framework: RunFramework.OTHER, previewUrl: opts.url },
-                agent: { id: VERIFY_AGENT_ID, kind: RunAgentKind.OEM_PIPELINE },
-                trigger: { kind: RunTrigger.OEM },
+                ...cliRunAuthor(process.env),
                 profile: RunProfile.PROD_PREVIEW,
                 ...(onProgress === undefined ? {} : { onProgress }),
             });
-            // Persist the artifact. `reticle gate` decides from RunStore.latest, so without this the
+            // Persist the artifact. `reticle gate` decides from the runs in the store, so without this the
             // documented CI loop is broken end to end: `reticle verify` could pass and the gate would still
             // block, because it never sees a passing run. (Only the optional `serve --http` endpoint used to
             // persist.) Best-effort — a disk failure must not turn a passing verification into a failure.
@@ -591,6 +604,8 @@ export function handleVerify(parsed) {
                     port,
                     ...(parsed.url !== undefined && '' !== parsed.url ? { url: parsed.url } : {}),
                     predicate: expectation,
+                    // How long the expectation may take to come true (#1533).
+                    ...(parsed.timeoutMs === undefined ? {} : { timeoutMs: parsed.timeoutMs }),
                     // Read fresh, not from `presence`: that probe asks whether a daemon is on the port, and
                     // this asks whether a TAB is — the difference between asserting and opening the url first.
                     sessions: async () => summarizeStatus(await fetchStatus(port)).sessions,

package/dist/command/cli/cloud-cli.js

@@ -7,7 +7,8 @@
  */
 import { CreatedProjectSchema } from './project-name.js';
 import { keyRefusalAtLastSync } from '../../memory/project/sync-status.js';
-import { apiKeyFrom } from '@reticlehq/core';
+import { ReticleEnv, apiKeyFrom } from '@reticlehq/core';
+import { writeHarnessSwitch } from '../../memory/cloud/harness-switch.js';
 import { PlatformLinkVia } from '@reticlehq/core/telemetry';
 import { existsSync } from 'node:fs';
 import { writeFile } from 'node:fs/promises';
@@ -17,7 +18,7 @@ import { join } from 'node:path';
 import { z } from 'zod';
 import { createNodeFileSystem } from '../../memory/project/fs/fs-port.js';
 import { CLOUD_LINK_FILE, resolveProjectCloud } from '../../memory/cloud/cloud-config.js';
-import { memoryReadUrl, MemoryResponseScope, scopeMemoryResponse, scopeOfMemoryResponse, } from '../../memory/cloud/memory-scope.js';
+import { readMemoryPages, MemoryResponseScope, scopeMemoryResponse, scopeOfMemoryResponse, } from '../../memory/cloud/memory-scope.js';
 import { linkDirectoryFrom } from '../../memory/project/link-directory.js';
 import { RETICLE_CONFIG_BASENAME } from './ports/resolve/cli-port.js';
 import { cmdLink, validateKey } from './cloud-link.js';
@@ -33,9 +34,11 @@ import { GateExit, gateExitWith } from './answers/gate-exit.js';
 import { brokenOf } from './known-regression.js';
 import { describeUnsyncedBriefly } from '../../memory/cloud/unsynced-roots.js';
 import { machineUnsyncedRoots } from '../../memory/project/sync-status.js';
-import { describeSync, runSyncCycle } from '../../memory/cloud/sync-cycle.js';
-import { diskSink, diskSource, readCloudIssues, readCloudState } from '../../memory/cloud/sync-disk.js';
+import { runSyncCycle } from '../../memory/cloud/sync-cycle.js';
+import { describeSync } from '../../memory/cloud/sync-describe.js';
+import { diskSink, diskSource, policyScreenshots, readCloudIssues, readCloudState, } from '../../memory/cloud/sync-disk.js';
 import { fetchPlatformRun } from '../../features/harness/platform/platform-drives.js';
+import { SERVER_VERSION } from '../version/identity/server-version.js';
 /**
  * Where `reticle login` dials when nothing says otherwise: the hosted service.
  *
@@ -260,6 +263,23 @@ const cmdConnect = async (given) => {
 /** `reticle config [--runs on|off] [--memory on|off] [--flows on|off] [--verify local|server]`. */
 const cmdConfig = async (argv) => {
     const f = flags(argv);
+    // The Harness switch lives on the platform, not in cloud.json: every drive spends the workspace's
+    // credits, so it is the user's to turn on, with the project's own key.
+    if (f['harness'] !== undefined) {
+        const enabled = 'on' === f['harness'] ? true : 'off' === f['harness'] ? false : undefined;
+        if (enabled === undefined) {
+            err('--harness must be on|off');
+            return 2;
+        }
+        const { url, apiKey } = await repoCloud();
+        const env = { [ReticleEnv.API_KEY]: apiKey, [ReticleEnv.CLOUD_URL]: url };
+        if (!(await writeHarnessSwitch(env, enabled))) {
+            err(`the platform did not switch the Harness ${f['harness']} (locked, no access, or offline)`);
+            return 1;
+        }
+        emit({ harness: f['harness'] });
+        return 0;
+    }
     const linkPath = join(linkedRoot(), CLOUD_LINK_FILE);
     const raw = await readJson(linkPath);
     if (null === raw || typeof raw !== 'object') {
@@ -322,9 +342,7 @@ const cmdSync = async (argv) => {
         capsules: () => (cloud.policy.capsules ? full.capsules() : []),
         // `memory` is the project's cross-run history and the derived records that summarise it.
         derived: (kind) => cloud.policy.memory ? full.derived(kind) : undefined,
-        ...(cloud.policy.screenshots && full.screenshot !== undefined
-            ? { screenshot: full.screenshot }
-            : {}),
+        ...policyScreenshots(full.screenshot, cloud.policy),
     };
     const once = async () => {
         const report = await runSyncCycle({
@@ -336,6 +354,7 @@ const cmdSync = async (argv) => {
             sink: diskSink(reticleRoot),
             state: readCloudState(reticleRoot),
             now: () => Date.now(),
+            clientVersion: SERVER_VERSION,
             request: (url, init) => syncRequest(url, init),
         });
         emit({
@@ -508,8 +527,7 @@ const cmdMemory = async (argv) => {
     // `undefined` for anything it cannot show to be this project's, so there is no ordering a future
     // edit can get wrong — the body it must not print is one it was never handed. The verdict is read
     // only to say WHICH refusal this is.
-    const scope = { projectId, subject };
-    const body = await api('GET', memoryReadUrl(url, scope), apiKey);
+    const body = await readMemoryPages(url, { projectId, subject }, (page) => api('GET', page, apiKey));
     const printable = scopeMemoryResponse(body, projectId);
     if (printable === undefined) {
         err(MemoryResponseScope.OTHER === scopeOfMemoryResponse(body, projectId)

package/dist/command/cli/cloud-kit.js

@@ -15,9 +15,9 @@ import { homedir } from 'node:os';
 import { join } from 'node:path';
 import { z } from 'zod';
 import { cloudFetch } from '../../memory/cloud/cloud-sync.js';
-import { normalizeUrl, readSessionFrom, resolveSessionFor, sessionPath, } from './auth/cloud-session.js';
+import { ACTIVE_SESSION_FILE, normalizeUrl, readSessionFrom, resolveSessionFor, sessionPath, } from './auth/cloud-session.js';
 export const RETICLE_DIR = '.reticle';
-export const SESSION_FILE = 'session.json';
+export const SESSION_FILE = ACTIVE_SESSION_FILE;
 export const CREDENTIALS_FILE = 'credentials.json';
 /** The user-level reticle directory, `~/.reticle`. Sessions and credentials live here, not in a repo. */
 export const home = () => join(homedir(), RETICLE_DIR);
@@ -105,7 +105,7 @@ export class CredentialRefusedError extends Error {
                 : reason.replace(/\.$/, '')}. Mint a new key in Settings → API keys and set RETICLE_API_KEY to it.`
             : `the platform refused your sign-in (${String(status)}): ${reason === undefined || KEY_REFUSED === reason
                 ? 'it expired, was revoked, or you no longer have access to the workspace'
-                : reason.replace(/\.$/, '')}. Run \`reticle login\`.`);
+                : reason.replace(/\.$/, '')}. Run \`npx @reticlehq/server connect\`.`);
         this.status = status;
         this.apiKey = apiKey;
     }

package/dist/command/cli/cloud-link.d.ts

@@ -10,28 +10,9 @@ export declare const validateKey: (url: string, key: string) => Promise<z.infer<
 declare const WhoamiSchema: z.ZodObject<{
     projectId: z.ZodString;
     projectName: z.ZodString;
-    /**
-     * Which tenant the key belongs to. Optional for the same reason `dashboardUrl` is — an older
-     * cloud does not send it — and when it is missing a stored key cannot be proved to be ours, which
-     * is why the reuse path below mints instead of guessing.
-     */
     orgId: z.ZodOptional<z.ZodString>;
-    /**
-     * Where this project's dashboard lives. Optional because an older cloud does not send it, and a
-     * CLI that refused to link against one would break the thing it is supposed to connect.
-     */
     dashboardUrl: z.ZodOptional<z.ZodString>;
-}, "strip", z.ZodTypeAny, {
-    projectId: string;
-    projectName: string;
-    orgId?: string | undefined;
-    dashboardUrl?: string | undefined;
-}, {
-    projectId: string;
-    projectName: string;
-    orgId?: string | undefined;
-    dashboardUrl?: string | undefined;
-}>;
+}, z.core.$strip>;
 export interface PlatformLinked {
     via: PlatformLinkVia;
     /** The project this folder was bound to before, if any: a re-run against it is not a new link. */

package/dist/command/cli/cloud-link.js

@@ -280,6 +280,8 @@ via = PlatformLinkVia.LINK) => {
      * this can be read aloud, pasted into an issue, or left in a terminal without leaking anything.
      */
     hint(`bound this repo to project "${projectName}"${inWorkspace(workspace)}`);
+    if (dashboardUrl !== undefined)
+        hint(`dashboard: ${dashboardUrl}`);
     if (projectDir !== resolve(cwd))
         hint(`linked ${relative(cwd, projectDir)}: that is where this app's runs are written`);
     hint(reusedKey

package/dist/command/cli/cloud-login.d.ts

@@ -1,9 +1,13 @@
 /** Run `reticle link` with these arguments. Injected; see the note at the top of this file. */
 type Linker = (argv: readonly string[]) => Promise<number>;
 /**
- * `reticle login` — browser device flow by default; `--email <e>` (or a positional email) keeps the
- * headless two-step code path for CI/servers where opening a browser makes no sense.
+ * Email sign-in is gone: the platform answers its routes with 410 `email_sign_in_removed`. The sentence
+ * starts with the platform's own, so the terminal and the sign-in page agree. `--email`, `--code`
+ * and a positional address now stop with it, because the person who typed them wants no browser, and
+ * a device flow that waits for an approval nobody can give is worse than a clear refusal.
  */
+export declare const EMAIL_SIGN_IN_REMOVED: string;
+/** `reticle login` — the browser device flow. Email sign-in is gone (see EMAIL_SIGN_IN_REMOVED). */
 export declare const cmdLogin: (argv: readonly string[], link: Linker, autoLink?: boolean) => Promise<number>;
 /** `reticle logout` — forget the cached session token (per-project keys under credentials.json stay). */
 /**

package/dist/command/cli/cloud-login.js

@@ -19,24 +19,16 @@ import { RETICLE_CONFIG_BASENAME } from './ports/resolve/cli-port.js';
 import { DevicePollSchema, DeviceStartSchema, LoginOrigin, openBrowser, withLoginOrigin, } from './auth/device-flow.js';
 import { normalizeUrl, sessionPath, SESSIONS_DIR } from './auth/cloud-session.js';
 import { api, baseUrl, emit, err, flags, hint, home, readSession, RETICLE_DIR, SESSION_FILE, } from './cloud-kit.js';
-const LoginSchema = z.object({
-    token: z.string(),
-    org: z.object({ id: z.string().optional(), name: z.string() }),
-});
 /**
- * `reticle login --email <e> [--org <name>] [--code <123456>]` — sign in, cache the token under
- * ~/.reticle.
- *
- * TWO STEPS, because the cloud proves you own the inbox before it hands out a session: ask for a code,
- * then exchange it. (It used to take an email alone — which meant anyone who knew your address owned your
- * org.) `--org` is only consulted when the account is brand new; a returning user never needs it.
- *
- * Without `--code` we request one and stop, telling the user to re-run with it. The one exception is a
- * LOCAL cloud, whose dev mailer cannot actually deliver mail and so echoes the code back in its response
- * (`devCode`) — there we complete the login in a single command rather than asking a developer to read a
- * code out of a server log they may not even be tailing.
+ * Email sign-in is gone: the platform answers its routes with 410 `email_sign_in_removed`. The sentence
+ * starts with the platform's own, so the terminal and the sign-in page agree. `--email`, `--code`
+ * and a positional address now stop with it, because the person who typed them wants no browser, and
+ * a device flow that waits for an approval nobody can give is worse than a clear refusal.
  */
-const RequestCodeSchema = z.object({ devCode: z.string().optional() });
+export const EMAIL_SIGN_IN_REMOVED = 'Email sign-in is gone. Sign in with Google or GitHub: run `reticle connect`, which opens the browser. ' +
+    'Without a browser (CI, an agent), set RETICLE_API_KEY to a key from Settings > API keys.';
+/** The flags the removed email sign-in took. Any one of them gets the sentence above. */
+const EMAIL_FLAGS = ['email', 'code', 'org'];
 const MeSchema = z.object({ email: z.string().min(1).nullable().optional() });
 /** The signed-in address, asked of the cloud. Best-effort: a login never fails for want of it. */
 const signedInEmail = async (url, token) => {
@@ -151,35 +143,15 @@ const cmdLoginDevice = async (explicitUrl, project, link, autoLink, open = openB
         return 1;
     }
 };
-/**
- * `reticle login` — browser device flow by default; `--email <e>` (or a positional email) keeps the
- * headless two-step code path for CI/servers where opening a browser makes no sense.
- */
+/** `reticle login` — the browser device flow. Email sign-in is gone (see EMAIL_SIGN_IN_REMOVED). */
 export const cmdLogin = async (argv, link, autoLink = true) => {
     const f = flags(argv);
     const positional = argv[0] !== undefined && !argv[0].startsWith('--') ? argv[0] : undefined;
-    const email = f['email'] ?? positional;
-    if (email === undefined)
-        return cmdLoginDevice(f['url'], f['project'], link, autoLink);
-    const org = f['org'];
-    const url = baseUrl(null, f['url']);
-    let code = f['code'];
-    if (code === undefined) {
-        const requested = RequestCodeSchema.parse(await api('POST', `${url}/v1/auth/request-code`, null, {
-            email,
-            ...(org !== undefined ? { orgName: org } : {}),
-        }));
-        // A real cloud mails the code and never echoes it; a local one cannot mail, so it hands it back.
-        if (requested.devCode === undefined) {
-            emit({ codeSent: true, to: email });
-            hint(`check your inbox, then: \`reticle login --email ${email} --code <the 6-digit code>\``);
-            return 0;
-        }
-        code = requested.devCode;
+    if (positional !== undefined || EMAIL_FLAGS.some((name) => f[name] !== undefined)) {
+        err(EMAIL_SIGN_IN_REMOVED);
+        return 2;
     }
-    const parsed = LoginSchema.parse(await api('POST', `${url}/v1/auth/login`, null, { email, code }));
-    await writeSession(url, parsed.token, parsed.org.name, parsed.org.id, f['project'], link, email, autoLink);
-    return 0;
+    return cmdLoginDevice(f['url'], f['project'], link, autoLink);
 };
 /** `reticle logout` — forget the cached session token (per-project keys under credentials.json stay). */
 /**

package/dist/command/cli/config/checkout.d.ts

@@ -0,0 +1,10 @@
+import { type Checkout } from '@reticlehq/core';
+/** The checkout `dir` is in, or undefined outside git. */
+export declare function checkoutAt(dir: string): Checkout | undefined;
+/**
+ * The same folder in every other checkout of the repository that holds `directory`: the main
+ * checkout and each linked worktree. Empty outside git and without worktrees.
+ */
+export declare function worktreeTwins(directory: string): string[];
+/** True when the repository whose git directory is `commonDir` has a linked worktree. One read. */
+export declare function hasLinkedWorktrees(commonDir: string): boolean;

package/dist/command/cli/config/checkout.js

@@ -0,0 +1,78 @@
+/**
+ * The git checkout a directory is in, read from disk. The rule is core's `checkoutOf`; this file
+ * only supplies the reads, so every server module asks the same question the same way.
+ */
+import { readFileSync, readdirSync, realpathSync } from 'node:fs';
+import { dirname, join, relative, resolve } from 'node:path';
+import { checkoutOf, samePath } from '@reticlehq/core';
+/** Where git keeps one folder for each linked worktree, under the repository's git directory. */
+const WORKTREES_DIR = 'worktrees';
+/** The file in that folder that names the worktree's `.git`. */
+const GITDIR_FILE = 'gitdir';
+/**
+ * The long form of a path. Windows can spell one folder two ways (`RUNNER~1` and `runneradmin`), and
+ * git writes the long one, so a short-form caller was named as its own twin.
+ */
+const longForm = (path) => {
+    try {
+        return realpathSync.native(path);
+    }
+    catch {
+        return path;
+    }
+};
+const readOrUndefined = (path) => {
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch {
+        // Missing, a directory, or unreadable: not the file we look for.
+        return undefined;
+    }
+};
+/** The checkout `dir` is in, or undefined outside git. */
+export function checkoutAt(dir) {
+    return checkoutOf(dir, readOrUndefined);
+}
+/** The top directory of each linked worktree of the repository whose git directory is `commonDir`. */
+function linkedWorktreeRoots(commonDir) {
+    const admin = join(commonDir, WORKTREES_DIR);
+    let names = [];
+    try {
+        names = readdirSync(admin);
+    }
+    catch {
+        return [];
+    }
+    return names.flatMap((name) => {
+        // `<worktree>/.git`, absolute, or relative to this file when git writes relative paths.
+        const pointer = readOrUndefined(join(admin, name, GITDIR_FILE))?.trim();
+        return pointer === undefined || 0 === pointer.length
+            ? []
+            : [dirname(resolve(admin, name, pointer))];
+    });
+}
+/**
+ * The same folder in every other checkout of the repository that holds `directory`: the main
+ * checkout and each linked worktree. Empty outside git and without worktrees.
+ */
+export function worktreeTwins(directory) {
+    const from = checkoutAt(directory);
+    if (from === undefined)
+        return [];
+    const rel = relative(from.root, directory);
+    const roots = new Set([from.mainRoot, ...linkedWorktreeRoots(from.commonDir)]);
+    const self = longForm(from.root);
+    return [...roots]
+        .filter((root) => !samePath(longForm(root), self))
+        .map((root) => join(root, rel));
+}
+/** True when the repository whose git directory is `commonDir` has a linked worktree. One read. */
+export function hasLinkedWorktrees(commonDir) {
+    try {
+        return readdirSync(join(commonDir, WORKTREES_DIR)).length > 0;
+    }
+    catch {
+        return false;
+    }
+}