@reticlehq/server 3.7.0 → 3.8.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reticlehq/server",
-  "version": "3.7.0",
+  "version": "3.8.1",
   "mcpName": "io.github.reticlehq/reticle",
   "description": "Reticle CLI, bridge and MCP server: a coding agent drives your running web app from the inside and gets a verdict with evidence, for change verification, access control, accessibility, performance and SEO checks.",
   "type": "module",
@@ -22,13 +22,12 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.31.0",
     "ws": "^8.21.3",
-    "zod": "^3.24.1",
-    "zod-to-json-schema": "^3.24.0",
-    "@reticlehq/browser": "3.7.0",
-    "@reticlehq/engine": "3.7.0",
+    "zod": "^4.6.6",
+    "@reticlehq/engine": "3.8.1",
+    "@reticlehq/core": "3.8.1",
+    "@reticlehq/init": "3.8.1",
     "open-verification": "1.0.0",
-    "@reticlehq/core": "3.7.0",
-    "@reticlehq/init": "3.7.0"
+    "@reticlehq/browser": "3.8.1"
   },
   "devDependencies": {
     "@types/pngjs": "^6.0.5",
@@ -36,7 +35,7 @@
     "yaml": "^2.9.1"
   },
   "optionalDependencies": {
-    "pixelmatch": "^7.2.0",
+    "pixelmatch": "^8.0.0",
     "playwright": "^1.63.0",
     "pngjs": "^7.0.0"
   },
@@ -65,10 +64,8 @@
     "cli"
   ],
   "reticle": {
-    "changelog": "Drive your localhost app from the Reticle platform's chat: the daemon of a linked project drives it on your machine, the chat shows it live and keeps it as a check with a replay. The Harness now runs only on the platform, on every plan, and plans, replays and learns each app. A page on SDK 3.1-3.4 is no longer version-skewed, a pressed key sends its keyCode, and a screenshot never carries another tab's pixels. Upgrading from 3.5: see MIGRATION.md.",
-    "breakingChanges": [
-      "reticle_verify { action: \"explore\" } and reticle verify --explore no longer drive on a model key of your own. The Harness decides on the Reticle platform and needs a linked project (npx @reticlehq/server connect); every plan includes Harness credits. ANTHROPIC_API_KEY, OPENAI_API_KEY and JEV_API_KEY are no longer read for driving, RETICLE_HARNESS_DRIVER and RETICLE_HARNESS_MODEL are ignored, and the explore tool's `driver` argument is removed. A secret field's value comes from RETICLE_SECRET_<FIELD> on your machine."
-    ]
+    "changelog": "On Windows, the daemon now keeps running when the agent process that started it ends. A collapsed Next.js \"1 Issue\" badge no longer turns every check into unknown. Reticle moves to zod 4 for a high-severity memory advisory. reticle_lease can omit url and lease the project's own dev server. reticle doctor checks that the daemon answers, and streamed SSE response bodies can be captured. Replay waits for a start page that is still loading, a re-acquired lease moves to the page asked for, and a guarded app driven by fast clicks is no longer accused of applying a stale response. Update the SDK in your app as well as the CLI.",
+    "breakingChanges": []
   },
   "publishConfig": {
     "access": "public"

package/dist/command/dev/stale-issue-guard.d.ts

@@ -1,34 +0,0 @@
-/**
- * An issue we have already fixed must not still read as available work.
- *
- * A commit saying it closes an issue is a claim that the issue is done. If that issue is still open
- * and unlabelled afterwards, the tracker is lying to whoever reads it next — and the person it lies
- * to is by definition someone looking for something to work on. Remembering is not a mechanism; this
- * is the smallest one that works.
- *
- * ## Why `fixed-pending-release` is an accepted answer
- *
- * Work that is already ON the release branch is legitimately still open; the issue closes when the
- * version ships. The label is that fact. It is not a fact about an open pull request. Applying it
- * there is what told contributors a fix had shipped when the pull request was still unmerged.
- *
- * Pure. The git log and the GitHub lookup belong to the caller, which is what makes every branch
- * below testable without a network or a repo.
- */
-export interface IssueState {
-    number: number;
-    state: 'open' | 'closed';
-    labels: readonly string[];
-}
-export declare function closedRefsIn(commitMessage: string): number[];
-/**
- * Of the issues these commits claimed to close, the ones still reading as available work.
- *
- * An issue that could not be looked up is deliberately silent rather than failing. A rate limit, a
- * transferred issue or a deleted one would otherwise turn this red for a reason unrelated to what it
- * guards, and a guard that goes red for unrelated reasons gets disabled — which costs more than the
- * defect it was catching.
- */
-export declare function staleIssues(claimed: readonly number[], issues: readonly IssueState[]): number[];
-/** The message the guard prints. Held here so the check and its tests cannot describe it differently. */
-export declare function staleIssueReport(stale: readonly number[]): string;

package/dist/command/dev/stale-issue-guard.js

@@ -1,69 +0,0 @@
-/**
- * An issue we have already fixed must not still read as available work.
- *
- * A commit saying it closes an issue is a claim that the issue is done. If that issue is still open
- * and unlabelled afterwards, the tracker is lying to whoever reads it next — and the person it lies
- * to is by definition someone looking for something to work on. Remembering is not a mechanism; this
- * is the smallest one that works.
- *
- * ## Why `fixed-pending-release` is an accepted answer
- *
- * Work that is already ON the release branch is legitimately still open; the issue closes when the
- * version ships. The label is that fact. It is not a fact about an open pull request. Applying it
- * there is what told contributors a fix had shipped when the pull request was still unmerged.
- *
- * Pure. The git log and the GitHub lookup belong to the caller, which is what makes every branch
- * below testable without a network or a repo.
- */
-/** The label that means "fixed, waiting for a release" — an honest reason to still be open. */
-const PENDING_RELEASE_LABEL = 'fixed-pending-release';
-/**
- * Issue numbers a commit message CLAIMS to have closed.
- *
- * Only the closing verbs GitHub itself acts on. A bare `#447`, a `Refs #447` or a `see #447` is how
- * a change points at context it did not close — the exact habit we want to encourage — so counting
- * those would make the guard cry wolf on good behaviour, and a check that cries wolf is one people
- * learn to skip.
- */
-const CLOSING_REF = /\b(?:close[sd]?|fix(?:e[sd])?|resolve[sd]?)\s+#(\d+)/gi;
-export function closedRefsIn(commitMessage) {
-    const seen = new Set();
-    for (const match of commitMessage.matchAll(CLOSING_REF)) {
-        const raw = match[1];
-        if (raw === undefined)
-            continue;
-        const parsed = Number.parseInt(raw, 10);
-        if (Number.isFinite(parsed))
-            seen.add(parsed);
-    }
-    return [...seen];
-}
-/**
- * Of the issues these commits claimed to close, the ones still reading as available work.
- *
- * An issue that could not be looked up is deliberately silent rather than failing. A rate limit, a
- * transferred issue or a deleted one would otherwise turn this red for a reason unrelated to what it
- * guards, and a guard that goes red for unrelated reasons gets disabled — which costs more than the
- * defect it was catching.
- */
-export function staleIssues(claimed, issues) {
-    const byNumber = new Map(issues.map((issue) => [issue.number, issue]));
-    return claimed.filter((number) => {
-        const issue = byNumber.get(number);
-        if (issue === undefined)
-            return false;
-        if ('closed' === issue.state)
-            return false;
-        return !issue.labels.includes(PENDING_RELEASE_LABEL);
-    });
-}
-/** The message the guard prints. Held here so the check and its tests cannot describe it differently. */
-export function staleIssueReport(stale) {
-    const list = stale.map((n) => `#${String(n)}`).join(', ');
-    const pronoun = 1 === stale.length ? 'it' : 'them';
-    return (`${list} ${1 === stale.length ? 'is' : 'are'} still OPEN, and a commit on this branch says it ` +
-        `closes ${pronoun}. Anyone browsing the tracker reads that as work nobody has started. Close ` +
-        `${pronoun} when this merges. Do not apply \`${PENDING_RELEASE_LABEL}\` from an open pull ` +
-        `request: that label means the fix is already on the release branch and waiting for the version ` +
-        `to ship. Applying it earlier is what sent contributors away from work that was not merged.`);
-}