@reticlehq/server 3.8.2 → 3.9.0

package/docs/install-manual.mdx

@@ -32,6 +32,21 @@ npx @reticlehq/server setup mcp
 
 `reticle setup mcp` is exactly the registration half of the installer, and it prints any client it could not write for you.
 
+### Sandbox and container images
+
+Install the CLI once, in the image:
+
+```bash
+npm install -g @reticlehq/server
+npx @reticlehq/server setup mcp
+```
+
+npx runs the installed copy. When the CLI is installed, `reticle init` and `reticle setup mcp` register its absolute path (`node <path>/bin/reticle.js mcp`). Each boot then starts the MCP server from the local copy, and your agent does not wait for a download.
+
+Without an install, the registration is `npx @reticlehq/server@<version> mcp`, with one exact version. npx uses its cache again only when that cache is in the image. A fresh sandbox with an empty npm cache downloads the package at each boot, and your agent waits for it before its first turn.
+
+If you remove the installed copy later, the agent shows the server as failed. `reticle doctor` then prints a `launcher` row with the missing path and the command to run.
+
 ## Part 1. Register the MCP server
 
 There is no config file that all agents share. Each harness has its own path and its own schema, so write only the one you actually use.
@@ -187,7 +202,7 @@ Screenshots and headless mode need the Rust crate, which is versioned independen
 
 ```toml
 [dependencies]
-reticle-tauri = "3.8"
+reticle-tauri = "3.9"
 ```
 
 ```rust

package/docs/packages/engine.mdx

@@ -12,7 +12,7 @@ icon: gavel
 
 It was nine thousand lines in the middle of the server, which meant the rules that decide a verdict could only be read, tested or trusted by running the whole daemon. Carving it out has three consequences that matter more than tidiness:
 
-- **It can be audited.** The verdict is the product, so the code that produces one is the code a sceptical reader most wants to see. It is Apache 2.0 for that reason, carved out of an otherwise source-available server.
+- **It can be audited.** The verdict is the product, so the code that produces one is the code a sceptical reader most wants to see. It is Apache 2.0, the same as every other Reticle package.
 - **It can be reused.** Anything that has evidence in the protocol's shape can reach a verdict without Reticle in the loop.
 - **It cannot quietly depend on the daemon.** A rule that needs a browser to decide something is not a rule, it is a measurement, and the package boundary is what makes that confusion a compile error.
 

package/docs/packages/server.mdx

@@ -6,7 +6,7 @@ icon: server
 
 `@reticlehq/server` is the Reticle bridge, MCP server and CLI in one Node package. It hosts the WebSocket your app dials into, exposes the MCP tools your agent calls, and ships the `reticle` binary. **You do not add it to your project**: your agent runs it with `npx @reticlehq/server mcp`.
 
-**Licensed under `FSL-1.1-ALv2` (the Functional Source License, converting to Apache 2.0), not Apache 2.0 like the SDK packages.** This is the package the enterprise terms apply to.
+**Licensed under `Apache-2.0`, the same as every other Reticle package.**
 
 ## Why it exists
 

package/docs/packages/tauri.mdx

@@ -16,7 +16,7 @@ Tauri IPC observation needs nothing on the Rust side. An `invoke('load_todos')`
 
 ```toml
 [dependencies]
-reticle-tauri = "3.8"
+reticle-tauri = "3.9"
 ```
 
 Its own dependencies are `tauri = "2.12"` (the Windows backend must use the same `webview2-com` and `windows` versions Tauri does, so it follows Tauri's minor version) plus the per-platform capture backends: `objc2` and friends on macOS, `webview2-com` and `windows` on Windows, `webkit2gtk` and `cairo-rs` on Linux and the BSDs.

package/docs/packages/test.mdx

@@ -6,7 +6,7 @@ icon: vial
 
 `@reticlehq/test` is Reticle's spec runner for CI. It turns an interactive session into a suite that runs on every pull request, without an agent and without paying model tokens to re-derive the same checks. Install it when you want unattended verification; skip it if you only ever drive Reticle interactively through MCP.
 
-**Licensed under `FSL-1.1-ALv2`. Depends on `@reticlehq/core` and `@reticlehq/server`. Optional peer dependency: `vitest ^3.2.6 || ^4.0.0`.**
+**Licensed under `Apache-2.0`. Depends on `@reticlehq/core` and `@reticlehq/server`. Optional peer dependency: `vitest ^3.2.6 || ^4.0.0`.**
 
 ```bash
 npm i -D @reticlehq/test

package/docs/packages.mdx

@@ -253,7 +253,7 @@ A lint rule makes the signal layer self-enforcing, which is the only way a conve
 
 ```toml
 [dependencies]
-reticle-tauri = "3.8"
+reticle-tauri = "3.9"
 ```
 
 <Card title="Desktop setup in full" icon="display" href="/desktop">

package/docs/platform-integration.md

@@ -154,4 +154,4 @@ A service that drives apps it did not build uses these seams.
 
 ## Licensing for embedding
 
-The embeddable SDK is **Apache-2.0** (ship it in your customers' apps). The server/CLI is **FSL** (free, no competing resale). Enterprise features + the premium-access flow: [`enterprise.md`](./enterprise.md). OEM terms: **[hey@reticle.sh](mailto:hey@reticle.sh)**.
+Every Reticle package is **Apache-2.0**, so you can ship the SDK in your customers' apps. Hosted and team features: [`enterprise.md`](./enterprise.md). OEM terms: **[hey@reticle.sh](mailto:hey@reticle.sh)**.

package/docs/skill.md

@@ -3,7 +3,7 @@ name: reticle-docs
 description: Install, instrument and verify this running web app from the inside (DOM, network, routing, console and framework state) instead of screenshots or guessing. Drives one real flow end to end and returns a verdict with the file:line to fix. Use when the user asks to set up or install Reticle, when a user-facing change needs proving before you call it done, when a test passes but the UI is broken, or when the user types /reticle.
 license: Apache-2.0
 metadata:
-  version: 3.8.2
+  version: 3.9.0
   homepage: https://docs.reticle.sh
   repository: https://github.com/reticlehq/reticle
   internal: true

package/docs/telemetry.md

@@ -40,7 +40,7 @@ Twenty-five kinds of events, each a single small JSON object. This is the whole
 | `mcp_proxy_exited` | The process that gives your agent its Reticle tools ends | Why it ended (`stdin_end`, `idle`, `client_gone_storm`, `wake_failed`), how long it ran, and two counts: how many times it lost the daemon and how many tool calls it carried, with its random id. Never what the calls were |
 | `daemon_died_unclean` | Reticle finds that an earlier daemon stopped without a clean exit | How long that daemon had run. Nothing else |
 | `wake_refused` | Reticle will not use the daemon port it found, because something else holds it | Whether the holder was another program (`foreign`) or a Reticle daemon for another project (`other_project`). Never the port or the project |
-| `onboarding_step` | One step of getting set up begins, finishes, fails, is skipped, or is walked away from | Which phase (`install`, `onboard`, `first_run`), which step, what became of it, how long it took, and the framework. The step name comes from a closed list we define -- it can only ever be one of the names in `core/src/onboarding.ts`, so nothing you typed or any path on your disk can arrive in it. `unattended` says whether anybody was asked anything |
+| `onboarding_step` | One step of getting set up begins, finishes, fails, is skipped, or is walked away from | Which phase (`install`, `onboard`, `first_run`), which step, what became of it, how long it took, and the framework. The step name comes from a closed list we define -- it can only ever be one of the names in `core/src/onboarding.ts`, so nothing you typed or any path on your disk can arrive in it. `unattended` says whether anybody was asked anything. A step that failed can carry why setup stopped, also from a closed list (`no_node`, `node_too_old`, `no_web_app`, `dev_server_failed`, `chromium_unavailable`, and so on) |
 | `init_completed` | `reticle init` finishes | Whether it worked, a classified reason when it did not, and which published install route you came through, DECLARED by that route via `RETICLE_INSTALL_SOURCE` and never inferred, and `unknown` when nothing declared one |
 | `bug_found` | Reticle finds a defect in the app under test | The **kind** of defect (`signal-contradicted`, `console-error`, …) and how it was found, never what it was found in |
 | `tool_refused` | A tool cannot do what an agent asked | Which tool, why (one of six buckets: no session, no match, unsupported, bad arguments, not ready, other), and whether the same call was retried. **Never the message**, because a refusal interpolates whatever you asked for, so only the tool name and the bucket are sent. Capped at 50 per daemon run |
@@ -49,11 +49,12 @@ Twenty-five kinds of events, each a single small JSON object. This is the whole
 | `hud_signin_prompted` | The HUD shows you a sign-in or "link this project" prompt | Which prompt (`rail`, `harness` or `header`), once per prompt for each daemon run |
 | `platform_linked` | A project on this machine is linked to a Reticle workspace | How (`connect`, `hud` or `link`) and the workspace's id; see [The platform side](#the-platform-side) |
 | `harness_run` | A Reticle Harness run starts, and again when it ends | Who started it (`agent`, `hud`, `dashboard`, `cli_try`, `plan`), whether the platform drove it, and at the end how it went (`proved`, `not_proved`, `failed`, `blocked`, `stopped`), how many journeys it answered and replayed, as buckets, and for a `blocked` or `failed` run why it did not drive, from a closed list (`not_linked`, `harness_off`, `no_credits`, and so on) |
+| `gate_completed` | `reticle gate` ends | How it ended (`pass`, `fail`, `nothing_to_check`, `regression` or `error`) and how many saved flows it judged. Never a flow name or a file path |
 | `identified` | **Never** from this version. Only an earlier version's `reticle identify`, which has been removed | What you chose to tell us then; see [Telling us who you are](#telling-us-who-you-are) |
 
 **There is no per-tool-call event.** Tool usage is counted in memory and leaves once, inside `daemon_stopped`, as a histogram like `{"reticle_act": 40, "reticle_assert": 12}`. That is counts of tool NAMES from a fixed list we define, never arguments, results, selectors, or URLs.
 
-**Parameter and flag NAMES are collected; their VALUES are not.** We record that `reticle_act` was called with `ref` and `action`, and that you ran `reticle serve --headed --port`. We do not record what you set them to. This distinction is the whole safety property, and it is absolute for CLI flags: `--http-token` holds a secret, `--drive` holds a URL, `--storage-state` holds a file path, so no flag value is ever sent. For tool parameters there is one narrow exception: a short, explicit allowlist of parameters whose values are enums _we_ defined (`action: "click"`), listed in [`argument-shape.ts`](https://github.com/reticlehq/reticle/blob/main/server/src/telemetry/argument-shape.ts). A value outside that allowlist reports as `other`, so a future schema change cannot quietly start forwarding free text. `reticle_act`'s `args` (the text being typed into your app, which on a login form is a password) is **never** in that allowlist.
+**Parameter and flag NAMES are collected; their VALUES are not.** We record that `reticle_act` was called with `ref` and `action`, and that you ran `reticle serve --headed --port`. We do not record what you set them to. This distinction is the whole safety property, and it is absolute for CLI flags: `--http-token` holds a secret, `--drive` holds a URL, `--storage-state` holds a file path, so no flag value is ever sent. For tool parameters there is one narrow exception: a short, explicit allowlist of parameters whose values are enums _we_ defined (`action: "click"`, and the name of the Reticle tool that `reticle_run` calls), listed in [`argument-shape.ts`](https://github.com/reticlehq/reticle/blob/main/server/src/telemetry/argument-shape.ts). A value outside that allowlist reports as `other`, so a future schema change cannot quietly start forwarding free text. `reticle_act`'s `args` (the text being typed into your app, which on a login form is a password) is **never** in that allowlist.
 
 `daemon_stopped` carries: how long the session ran, how many tool calls and of which tools, how many of those calls came before an app connected, the version of the Reticle SDK in the last page that connected, how long each tool took (total and worst case), how many failed, how many verifications ran, browser/lease connection attempts with their failure causes, and which MCP clients connected (`claude-code`, `cursor`). It also carries how the in-page HUD was used: presses per control (`hudControls`, by the control's name from a closed list Reticle defines, a toggle as `name:on` / `name:off`), how long the HUD sat as a bubble, collapsed or open and on which page (`hudViewMs`, `hudPanelMs`), which rail slides were shown (`hudSlides`), and the order of those presses and views, cut at 60 (`hudJourney`). Control names, never anything typed or shown on the page.
 
@@ -113,6 +114,7 @@ Every event carries the same few fields:
 | `version` | The Reticle version running | n/a |
 | `os` | The platform (`darwin` / `linux` / `win32`) | Not the OS version, hostname, or hardware |
 | `ci` | Whether the run is inside CI | n/a |
+| `internal` | `true`, only on the Reticle team's own machines and test runs, which set it on purpose | Not set for anybody else, and never guessed from a name, an email or a path |
 
 There are no IP-based profiles, no cookies, no fingerprinting, and no person profiles: events are processed in "personless" mode, so they are never joined into a person profile.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reticlehq/server",
-  "version": "3.8.2",
+  "version": "3.9.0",
   "mcpName": "io.github.reticlehq/reticle",
   "description": "Reticle CLI, bridge and MCP server: a coding agent drives your running web app from the inside and gets a verdict with evidence, for change verification, access control, accessibility, performance and SEO checks.",
   "type": "module",
@@ -23,11 +23,11 @@
     "@modelcontextprotocol/sdk": "^1.31.0",
     "ws": "^8.21.3",
     "zod": "^4.6.6",
-    "@reticlehq/browser": "3.8.2",
-    "@reticlehq/engine": "3.8.2",
+    "@reticlehq/browser": "3.9.0",
+    "@reticlehq/core": "3.9.0",
+    "@reticlehq/init": "3.9.0",
     "open-verification": "1.1.0",
-    "@reticlehq/core": "3.8.2",
-    "@reticlehq/init": "3.8.2"
+    "@reticlehq/engine": "3.9.0"
   },
   "devDependencies": {
     "@types/pngjs": "^6.0.5",
@@ -39,7 +39,7 @@
     "playwright": "^1.63.0",
     "pngjs": "^7.0.0"
   },
-  "license": "FSL-1.1-ALv2",
+  "license": "Apache-2.0",
   "author": "Reticle contributors",
   "repository": {
     "type": "git",
@@ -52,7 +52,8 @@
     "bin",
     "dist",
     "README.md",
-    "LICENSE-ENTERPRISE",
+    "LICENSE",
+    "NOTICE",
     "SKILL.md",
     "docs"
   ],
@@ -64,8 +65,11 @@
     "cli"
   ],
   "reticle": {
-    "changelog": "3.8.1 could not record a verdict: every run it built or read failed with an Invalid element at key subject error. 3.8.2 fixes it. Update the CLI and the SDK in your app.",
-    "breakingChanges": []
+    "changelog": "3.9.0 gets more installs to a first verdict. The one-line installer and reticle init now check your app and wait for your agent to connect. A lease reads a deployed preview with no SDK installed. Several false verdicts are fixed: a click that hit Reticle's own panel, a recorded flow that lost its assertion, and an iframe that took over a page's session. Every package is now Apache-2.0. Update the CLI and the SDK in your app.",
+    "breakingChanges": [
+      "A headless page now opens at 1440x900, not 1280x720. Record your headless screenshot baselines again, or they report dimension-mismatch.",
+      "The JSON line of `reticle license` no longer has the `gated` and `coversNothingHere` fields."
+    ]
   },
   "publishConfig": {
     "access": "public"

package/LICENSE-ENTERPRISE

@@ -1,37 +0,0 @@
-The Reticle Enterprise License (the "Enterprise License")
-Copyright (c) 2026 Reticle Labs
-
-With regard to the Reticle software (the "Software"):
-
-This Software and associated documentation files (the "Software") may only be
-used in production if you (and any entity that you represent) hold a valid Reticle
-Enterprise subscription for the correct number of seats and/or usage as agreed
-with Reticle Labs.
-
-Subject to the foregoing, you are free to use, copy, modify, and create
-derivative works of the Software for development, testing, and evaluation
-purposes without a subscription.
-
-You may not move, change, disable, or circumvent the license-key functionality
-in the Software, and you may not remove or obscure any functionality in the
-Software that is protected by the license key.
-
-You may not alter, remove, or obscure any licensing, copyright, or other
-notices.
-
-Any use of the Software in violation of this Enterprise License will
-automatically terminate your rights under this Enterprise License for the
-current and all other versions of the Software.
-
-This Enterprise License does not grant you any rights to any trademark, trade
-name, service mark, logo, or product name of Reticle Labs.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-For a Reticle Enterprise subscription: hey@reticle.sh

package/dist/features/ee/audit-log.d.ts

@@ -1,14 +0,0 @@
-/**
- * Example enterprise feature (Reticle Enterprise License — see./LICENSE). Demonstrates the pattern every
- * ee feature follows: call assertEnterprise...) first, then do the privileged work. The body here is a
- * stub — the real audit sink is the hosted control plane. It exists now to prove the gate.
- */
-import { type GateContext } from '../license/license.js';
-interface AuditEvent {
-    actor: string;
-    action: string;
-    at: number;
-}
-/** Record an audit event — gated. Throws EnterpriseLicenseError in production without a valid license. */
-export declare function recordAuditEvent(event: AuditEvent, ctx: GateContext): AuditEvent;
-export {};

package/dist/features/ee/audit-log.js

@@ -1,11 +0,0 @@
-/**
- * Example enterprise feature (Reticle Enterprise License — see./LICENSE). Demonstrates the pattern every
- * ee feature follows: call assertEnterprise...) first, then do the privileged work. The body here is a
- * stub — the real audit sink is the hosted control plane. It exists now to prove the gate.
- */
-import { assertEnterprise, EnterpriseFeature, } from '../license/license.js';
-/** Record an audit event — gated. Throws EnterpriseLicenseError in production without a valid license. */
-export function recordAuditEvent(event, ctx) {
-    assertEnterprise(EnterpriseFeature.AUDIT_LOG, ctx);
-    return event; // stub: a real implementation persists to the enterprise audit store
-}