@rosthq/cli 0.7.110 → 0.7.111

package/dist/index.js

@@ -50253,7 +50253,7 @@ Agents can suggest commitments and report progress. They should not create a new
     order: 61,
     title: "Signal guide",
     summary: "How to define and read measurables so the company runs on evidence instead of status theater.",
-    version: "2026-07-20.1",
+    version: "2026-07-20.2",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["operating_rhythm"],
@@ -50312,7 +50312,7 @@ Avoid vanity numbers, manual-only status fields, and metrics nobody can act on.
 - Add a measurable: \`measurable.create\` (scope: seat) defines a measurable a seat owns \u2014 name, unit, direction, target, cadence. The seat owns it; readings attach to it afterward.
 - Record a reading: \`{{cli}} status record --measurable-id <id> --value <n>\` (\`status.record\`, scope: seat) writes a status event with the reading. This is not gated. An agent's \`status.record\` never downgrades a human-confirmed reading: a routine agent read that lands on a period a human already confirmed leaves the confirmed value and its confirmation intact (invariants #7/#8 \u2014 agents recommend; humans decide).
 - Confirm a reading: \`{{cli}} signal confirm\` / \`signal.confirm_reading\` / \`rost_confirm_signal_reading\` marks a reading human-verified. \`signal.correct_reading\` / \`rost_correct_signal_reading\` overwrites a reading with a human-confirmed value.
-- Draft first readings from a connected source: \`signal.draft_first_readings\` pulls a measurable's bound source once (read-only, SSRF-guarded \u2014 the same pull path as \`signal.preview\`) and lands the value as a DRAFT reading for the current period, for a human to confirm. It is for a measurable that has a connected source but no confirmed reading yet: the Signal page shows a "Draft first readings" button on those rows so the row stops being a permanent blank. Nothing is published \u2014 a human clears the draft with \`signal.confirm_reading\` (invariant #7) \u2014 and it never fabricates a value: a non-numeric or blocked pull drafts nothing and says so.
+- Draft first readings from a connected source: \`signal.draft_first_readings\` pulls a measurable's bound source once (read-only, SSRF-guarded \u2014 the same pull path as \`signal.preview\`) and lands the value as a DRAFT reading for the current period, for a human to confirm. It is strictly for a measurable that has a connected source but has never had a confirmed reading \u2014 in ANY period, not just the current one. A measurable that already carries a confirmed reading (even an older one) is rejected with an "already has readings" outcome and no pull happens, so the first-reading flow can never be repurposed as an ongoing draft source; use \`signal.report\` to add a current-period datapoint or \`signal.correct_reading\` to change a confirmed value instead. The Signal page shows a "Draft first readings" button on the eligible (never-measured) rows so the row stops being a permanent blank. Nothing is published \u2014 a human clears the draft with \`signal.confirm_reading\` (invariant #7) \u2014 and it never fabricates a value: a non-numeric or blocked pull drafts nothing and says so.
 
 ## Run Signal without an agent
 
@@ -57737,6 +57737,7 @@ ${usage()}
   let failed = false;
   let activeSessions = 0;
   const activeTurnExecutionIds = /* @__PURE__ */ new Set();
+  let serverHeartbeatContractVersion = null;
   do {
     const detectedCapabilities = await detectCapabilities(cliVersion, env, homeDir, config2.maxSessionsOverride);
     const capabilities = capabilitiesForConfiguredRuntime(detectedCapabilities, config2.runtime);
@@ -57745,7 +57746,8 @@ ${usage()}
       const heartbeat = await post2(fetchImpl, options.appUrl, "/api/runner/heartbeat", buildHeartbeatBody({
         capabilities,
         telemetry: detectTelemetry(capabilities, env, activeSessions, cliVersion),
-        activeTurnExecutionIds: [...activeTurnExecutionIds]
+        activeTurnExecutionIds: [...activeTurnExecutionIds],
+        serverContractVersion: serverHeartbeatContractVersion
       }), state.runner_secret);
       if (heartbeat.status !== 200) {
         options.io.stderr.write(`heartbeat ${heartbeat.status}: ${redactForLog(JSON.stringify(heartbeat.json))}
@@ -57753,6 +57755,10 @@ ${usage()}
         failed = true;
       } else {
         heartbeatSucceeded = true;
+        const learnedVersion = readHeartbeatContractVersion(heartbeat.json);
+        if (learnedVersion !== null) {
+          serverHeartbeatContractVersion = learnedVersion;
+        }
         options.io.stdout.write(`heartbeat ok #${beat} runner_id=${state.runner_id} claude=${capabilities.claude.installed} codex=${capabilities.codex.installed}
 `);
       }
@@ -57766,7 +57772,11 @@ ${usage()}
           capabilities,
           io: options.io,
           telemetry: () => detectTelemetry(capabilities, env, activeSessions, cliVersion),
-          activeTurnIds: () => [...activeTurnExecutionIds]
+          activeTurnIds: () => [...activeTurnExecutionIds],
+          serverContractVersion: () => serverHeartbeatContractVersion,
+          recordServerContractVersion: (v) => {
+            serverHeartbeatContractVersion = v;
+          }
         });
         try {
           await claimAndExecute(fetchImpl, options.appUrl, state, config2, options.io, localRuntime, activeTurnExecutionIds);
@@ -57791,13 +57801,17 @@ ${usage()}
         localRuntime,
         capabilities,
         () => detectTelemetry(capabilities, env, activeSessions, cliVersion),
-        activeTurnExecutionIds
+        activeTurnExecutionIds,
+        () => serverHeartbeatContractVersion,
+        (v) => {
+          serverHeartbeatContractVersion = v;
+        }
       );
     }
   } while (!config2.once);
   return heartbeatSucceeded && !failed ? 0 : 1;
 }
-async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runtime, capabilities, telemetry, activeTurnExecutionIds) {
+async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runtime, capabilities, telemetry, activeTurnExecutionIds, serverContractVersion, recordServerContractVersion) {
   const deadline = Date.now() + config2.heartbeatMs;
   const stopWait = runtime ? startTurnHeartbeat({
     fetchImpl,
@@ -57807,7 +57821,9 @@ async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runt
     capabilities,
     io,
     telemetry,
-    activeTurnIds: () => [...activeTurnExecutionIds]
+    activeTurnIds: () => [...activeTurnExecutionIds],
+    serverContractVersion,
+    recordServerContractVersion
   }) : null;
   try {
     while (Date.now() < deadline) {
@@ -57827,12 +57843,17 @@ async function waitForNextHeartbeat(fetchImpl, appUrl2, state, config2, io, runt
     stopWait?.();
   }
 }
+var HEARTBEAT_ACTIVE_TURN_MIN_CONTRACT_VERSION = 2;
+function readHeartbeatContractVersion(json2) {
+  const value = json2.heartbeat_contract_version;
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
 function buildHeartbeatBody(input) {
   const body = {
     capabilities: input.capabilities,
     telemetry: input.telemetry
   };
-  if (input.activeTurnExecutionIds.length > 0) {
+  if (input.activeTurnExecutionIds.length > 0 && (input.serverContractVersion ?? 0) >= HEARTBEAT_ACTIVE_TURN_MIN_CONTRACT_VERSION) {
     body.active_turn_execution_ids = input.activeTurnExecutionIds;
   }
   return body;
@@ -57853,11 +57874,17 @@ function startTurnHeartbeat(deps) {
         const response = await post2(deps.fetchImpl, deps.appUrl, "/api/runner/heartbeat", buildHeartbeatBody({
           capabilities: deps.capabilities,
           telemetry: deps.telemetry(),
-          activeTurnExecutionIds: deps.activeTurnIds()
+          activeTurnExecutionIds: deps.activeTurnIds(),
+          serverContractVersion: deps.serverContractVersion()
         }), deps.secret, controller.signal);
         if (!stopped && response.status !== 200) {
           deps.io.stderr.write(`turn heartbeat ${response.status}: ${redactForLog(JSON.stringify(response.json))}
 `);
+        } else if (!stopped && response.status === 200) {
+          const learnedVersion = readHeartbeatContractVersion(response.json);
+          if (learnedVersion !== null) {
+            deps.recordServerContractVersion(learnedVersion);
+          }
         }
       } catch (error51) {
         if (!stopped) {