@stevecastaneda/paseo-progress 1.14.3 → 1.14.5

package/README.md

@@ -178,6 +178,14 @@ The progress file, `progress.jsonl`, holds one JSON event per line, each with a
 
 ## Changelog
 
+### 1.14.5
+
+- [Fixed] **Agents record your answer on the first try.** In Claude Code, an agent that hadn't loaded the answer tool guessed its field names, and the call failed once before the agent retried. The skill now has agents load every Progress tool at once, and again after Claude Code compacts a long chat. Asking a question also tells the agent which fields the answer takes.
+
+### 1.14.4
+
+- [Improved] **Agents learn what Paseo's preview blocks.** Paseo opens an HTML deliverable in a sandboxed preview, where some common page code fails without a visible error. Saving to localStorage, sessionStorage, cookies or IndexedDB throws, so a page that loads its saved state first stops before it draws anything. `alert`, `confirm`, `prompt`, `window.open` and form submits do nothing, `navigator.clipboard` throws, and one syntax error stops a whole script. The skill and the command help now list these, with what to do instead.
+
 ### 1.14.3
 
 - [Fixed] **Open hands only pictures, video, audio, PDFs and text to their default app.** This fixes a security issue in opening deliverables. Progress used to open any file an agent recorded with its default app, and for a script or an app that means running it. Now Open works only for images, video, audio, PDFs and text files. Pressing any other file, an SVG file or a folder copies its path, and an HTML page always opens in Paseo.

package/dist/server/cli.js

@@ -661,6 +661,7 @@ __export(util_exports, {
   required: () => required,
   safeExtend: () => safeExtend,
   shallowClone: () => shallowClone,
+  sizeCaps: () => sizeCaps,
   slugify: () => slugify,
   stringifyPrimitive: () => stringifyPrimitive,
   toZod: () => toZod,
@@ -1180,6 +1181,18 @@ function prefixIssues(path, issues) {
 function unwrapMessage(message) {
   return typeof message === "string" ? message : message?.message;
 }
+function sizeCaps(defChecks) {
+  const caps = [];
+  for (const ch of defChecks ?? []) {
+    const d = ch._zod.def;
+    if (!/_(length|size)$|_equals$/.test(d.check))
+      break;
+    const max = d.maximum ?? d.length ?? d.size;
+    if (max >= 0)
+      caps.push([max, ch]);
+  }
+  return caps;
+}
 function attachSchema(issues, start, inst) {
   var _a3;
   for (let i = start; i < issues.length; i++) {
@@ -2600,7 +2613,7 @@ ${content.join("\n")}
 var version = {
   major: 4,
   minor: 6,
-  patch: 5
+  patch: 7
 };
 
 // node_modules/zod/v4/core/schemas.js
@@ -3356,6 +3369,31 @@ var $ZodDate = /* @__PURE__ */ $constructor("$ZodDate", (inst, def) => {
     return payload;
   };
 });
+function capSize(inst, size) {
+  const caps = sizeCaps(inst._zod.def.checks);
+  if (!caps.length)
+    return;
+  const cap = Math.min(...caps.map((c) => c[0]));
+  const parse3 = inst._zod.parse;
+  inst._zod.parse = (payload, ctx) => {
+    const n = size(payload.value);
+    if (n > cap && !ctx?.skipChecks && ctx?.direction !== "backward") {
+      for (const [max, ch] of sizeCaps(inst._zod.def.checks)) {
+        if (n > max && ch._zod.def.when(payload)) {
+          const start = payload.issues.length;
+          ch._zod.check(payload);
+          payload.issues[start].continue = false;
+          attachSchema(payload.issues, start, inst);
+          return payload;
+        }
+      }
+    }
+    return parse3(payload, ctx);
+  };
+}
+var arraySize = (input2) => Array.isArray(input2) ? input2.length : -1;
+var mapSize = (input2) => input2 instanceof Map ? input2.size : -1;
+var setSize = (input2) => input2 instanceof Set ? input2.size : -1;
 function handleArrayResult(result, final, index) {
   if (result.issues.length) {
     final.issues.push(...prefixIssues(index, result.issues));
@@ -3399,6 +3437,7 @@ var $ZodArray = /* @__PURE__ */ $constructor("$ZodArray", (inst, def) => {
     }
     return payload;
   };
+  capSize(inst, arraySize);
 });
 function handlePropertyResult(result, final, key, input2, optin, optout) {
   const isPresent = key in input2;
@@ -4355,6 +4394,7 @@ var $ZodMap = /* @__PURE__ */ $constructor("$ZodMap", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, mapSize);
 });
 function handleMapResult(keyResult, valueResult, final, key, input2, inst, ctx) {
   if (keyResult.issues.length) {
@@ -4421,6 +4461,7 @@ var $ZodSet = /* @__PURE__ */ $constructor("$ZodSet", (inst, def) => {
       return Promise.all(proms).then(() => payload);
     return payload;
   };
+  capSize(inst, setSize);
 });
 function handleSetResult(result, final) {
   if (result.issues.length) {
@@ -13951,9 +13992,15 @@ function generateNullableCheck(doc, ctx, schema, accessor, buildsValue = true) {
   doc.write(`}`);
   return outputVar;
 }
+function generateSizeGate(doc, schema, size) {
+  for (const [max, check2] of sizeCaps(schema._zod.def.checks)) {
+    doc.write(`if (${size} > ${numericOperand(max, check2._zod.def.check)}) return INVALID;`);
+  }
+}
 function generateArrayCheck(doc, ctx, schema, accessor, buildsValue = true) {
   const def = schema._zod.def;
   doc.write(`if (!Array.isArray(${accessor})) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.length`);
   const outputVar = buildsValue ? newVar(ctx) : null;
   const iVar = newVar(ctx);
   const elemVar = newVar(ctx);
@@ -14353,6 +14400,7 @@ function literalPropertyKey(ctx, key) {
 function generateMapCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Map)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const kVar = newVar(ctx);
   const valVar = newVar(ctx);
@@ -14369,6 +14417,7 @@ function generateMapCheck(doc, ctx, schema, accessor) {
 function generateSetCheck(doc, ctx, schema, accessor) {
   const def = schema._zod.def;
   doc.write(`if (!(${accessor} instanceof Set)) return INVALID;`);
+  generateSizeGate(doc, schema, `${accessor}.size`);
   const outputVar = newVar(ctx);
   const valVar = newVar(ctx);
   doc.write(`const ${outputVar} = new Set();`);
@@ -21004,7 +21053,7 @@ ${modeLine(mode)}`
   },
   "deliverable add": {
     usage: `deliverable add "<title>" <path or http(s) URL> [--ticket <id>] [--kind ${DELIVERABLE_KINDS.join("|")}]`,
-    summary: `Add something the user can review. Paths are relative to where you run the command. Prints its id (D1, D2, ...). An HTML deliverable must be self-contained, with its CSS in the page and images embedded as data URIs, and no scripts or styles from the web, because Paseo's preview blocks the network.`,
+    summary: `Add something the user can review. Paths are relative to where you run the command. Prints its id (D1, D2, ...). An HTML deliverable opens in Paseo's sandboxed preview, which blocks everything from the web, so put its CSS in the page and embed images as data URIs. In the preview, storage APIs and navigator.clipboard throw an error. The alert, confirm, prompt and window.open calls and form submits do nothing. One syntax error stops a whole script.`,
     options: { ticket: { type: "string" }, kind: { type: "string" } },
     run({ positionals, values, state, cwd, root }) {
       const title = required2(positionals[0], "deliverable title");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stevecastaneda/paseo-progress",
-  "version": "1.14.3",
+  "version": "1.14.5",
   "description": "A live progress dashboard per worktree for Paseo, drawn from a file agents write with the Progress tools or the paseo-progress command.",
   "keywords": [
     "coding-agents",
@@ -57,7 +57,7 @@
     "react": "19.1.0",
     "react-native": "0.81.5",
     "typescript": "^5.9.3",
-    "zod": "^4.4.3"
+    "zod": "^4.6.7"
   },
   "engines": {
     "node": "^22.18.0 || >=23.6.0"

package/server/cli.ts

@@ -397,7 +397,7 @@ const commands: Record<string, Command> = {
   },
   "deliverable add": {
     usage: `deliverable add "<title>" <path or http(s) URL> [--ticket <id>] [--kind ${DELIVERABLE_KINDS.join("|")}]`,
-    summary: `Add something the user can review. Paths are relative to where you run the command. Prints its id (D1, D2, ...). An HTML deliverable must be self-contained, with its CSS in the page and images embedded as data URIs, and no scripts or styles from the web, because Paseo's preview blocks the network.`,
+    summary: `Add something the user can review. Paths are relative to where you run the command. Prints its id (D1, D2, ...). An HTML deliverable opens in Paseo's sandboxed preview, which blocks everything from the web, so put its CSS in the page and embed images as data URIs. In the preview, storage APIs and navigator.clipboard throw an error. The alert, confirm, prompt and window.open calls and form submits do nothing. One syntax error stops a whole script.`,
     options: { ticket: { type: "string" }, kind: { type: "string" } },
     run({ positionals, values, state, cwd, root }) {
       const title = required(positionals[0], "deliverable title");

package/server/tool.ts

@@ -56,6 +56,21 @@ function commandTool<Input extends z.ZodType>(title: string, command: string, in
   });
 }
 
+// Claude Code hides a tool's inputs until the agent loads it, so an agent
+// that skipped loading the answer tool guesses its field names.
+export const ANSWER_NOTE =
+  "When the user replies, record it with progress_question_answer: id is this question's reference, choice is the option letter or their own short answer, and words is what they said.";
+
+function withNote(tool: Tool, note: string): Tool {
+  return {
+    ...tool,
+    async execute(input, context) {
+      const result = await tool.execute(input, context);
+      return result.isError ? result : { ...result, text: `${result.text}\n${note}` };
+    },
+  };
+}
+
 const ticketId = (what: string) => z.string().describe(`${what}, like T03`);
 const estimate = z.number().int().describe("Whole minutes, like 90");
 const ticketSource = z.string().describe("Spec file path or http(s) link where the ticket is written up");
@@ -102,41 +117,44 @@ const tools: Record<ProgressToolName, Tool> = {
     ({ id, status, stage, title, estimateMinutes, note, waitsFor, source }) =>
       commandArgs("ticket update", [id], { status, stage, title, estimate: estimateMinutes, note, "waits-for": waitsFor, source }),
   ),
-  progress_question_ask: commandTool(
-    "Ask question",
-    "question ask",
-    z.object({
-      title: z.string().describe("A short title"),
-      question: z.string(),
-      options: z.array(
-        z.object({
-          letter: z.string().describe("A, B, C, ..."),
-          label: z.string(),
-          consequence: z.string().describe("What picking it means for the user"),
-        }),
-      ),
-      recommend: z.string().describe("The option letter you would pick"),
-      big: z.string().optional().describe("Only for a big question: which test it meets, in a few plain words"),
-      background: z.string().optional(),
-      files: z
-        .array(
+  progress_question_ask: withNote(
+    commandTool(
+      "Ask question",
+      "question ask",
+      z.object({
+        title: z.string().describe("A short title"),
+        question: z.string(),
+        options: z.array(
           z.object({
-            target: z.string().describe("A file path or http(s) link, like a screenshot"),
-            label: z.string().optional(),
+            letter: z.string().describe("A, B, C, ..."),
+            label: z.string(),
+            consequence: z.string().describe("What picking it means for the user"),
           }),
-        )
-        .optional(),
-      ticket: ticketId("The ticket it's about").optional(),
-    }),
-    ({ title, question, options, recommend, big, background, files, ticket }) =>
-      commandArgs("question ask", [title, question], {
-        option: options.map(({ letter, label, consequence }) => `${letter}=${label} | ${consequence}`),
-        recommend,
-        big,
-        background,
-        file: files?.map(({ target, label }) => (label ? `${target}=${label}` : target)),
-        ticket,
+        ),
+        recommend: z.string().describe("The option letter you would pick"),
+        big: z.string().optional().describe("Only for a big question: which test it meets, in a few plain words"),
+        background: z.string().optional(),
+        files: z
+          .array(
+            z.object({
+              target: z.string().describe("A file path or http(s) link, like a screenshot"),
+              label: z.string().optional(),
+            }),
+          )
+          .optional(),
+        ticket: ticketId("The ticket it's about").optional(),
       }),
+      ({ title, question, options, recommend, big, background, files, ticket }) =>
+        commandArgs("question ask", [title, question], {
+          option: options.map(({ letter, label, consequence }) => `${letter}=${label} | ${consequence}`),
+          recommend,
+          big,
+          background,
+          file: files?.map(({ target, label }) => (label ? `${target}=${label}` : target)),
+          ticket,
+        }),
+    ),
+    ANSWER_NOTE,
   ),
   progress_question_answer: commandTool(
     "Record answer",

package/skills/paseo-progress/SKILL.md

@@ -7,9 +7,15 @@ description: Keep the Paseo Progress dashboard live with the Progress tools or t
 
 The user watches a live dashboard in Paseo for this worktree. Keep it live: record each change the moment it happens, so the dashboard is a side effect of the work. Write every line for a product manager, in plain words.
 
-Use the Progress tools when you have them: `progress_show`, `progress_start`, `progress_ticket_add`, `progress_ticket_update`, `progress_question_ask`, `progress_question_answer`, `progress_deliverable_add`, `progress_activity_add`, `progress_ticker`, `progress_finish`, and `paseo_progress` for any other command. Paseo hands them to agents when the user turns on Paseo tools. Claude Code names them like `mcp__paseo__progress_show` and keeps them hidden until you search, so search your tools for `progress_` before your first update. Otherwise, run the `paseo-progress` command from inside the worktree. When a tool call says the tool isn't found, use the command for the rest of that reply.
+Use the Progress tools when you have them. Paseo hands them to agents when the user turns on Paseo tools. Claude Code hides their inputs until you load them, and a compacted conversation loses what you loaded. So before your first update, and again after each compaction, load them all in one `ToolSearch` call with `max_results` 11 and this query:
 
-The tools and the command take the same values and print the same answers. The steps below use the command's words: `--estimate` is `estimateMinutes` in the tools, `--waits-for` is `waitsFor`. `paseo-progress --help` is the reference for every command and flag.
+```text
+select:mcp__paseo__progress_show,mcp__paseo__progress_start,mcp__paseo__progress_ticket_add,mcp__paseo__progress_ticket_update,mcp__paseo__progress_question_ask,mcp__paseo__progress_question_answer,mcp__paseo__progress_deliverable_add,mcp__paseo__progress_activity_add,mcp__paseo__progress_ticker,mcp__paseo__progress_finish,mcp__paseo__paseo_progress
+```
+
+Without the tools, run the `paseo-progress` command from inside the worktree. When a tool call says the tool isn't found, use the command for the rest of that reply.
+
+The tools and the command take the same values and print the same answers. The steps below use the command's words: `--estimate` is `estimateMinutes` in the tools, `--waits-for` is `waitsFor`, and `question answer Q7 A` is `id` and `choice`. `paseo-progress --help` is the reference for every command and flag.
 
 ## 1. Set up
 
@@ -25,7 +31,13 @@ Done when `show` lists every ticket with an estimate.
 
 Move each ticket through `--status working --stage Build`, then the stages `Review`, `Fixes` and `Verify`, then `--status done`. Along the way, record what the user would want to see: `deliverable add` for anything reviewable, `activity add` for milestones, `ticker set` for what you are doing right now. Tag each with `--ticket` unless it covers the whole run.
 
-- An HTML deliverable must be self-contained, with its CSS in the page and images embedded as data URIs, and no scripts or styles from the web, because Paseo's preview blocks the network.
+- An HTML deliverable opens in Paseo's preview, a sandboxed frame. Write the page for it:
+  - Keep it self-contained, with its CSS in the page and images embedded as data URIs. The preview blocks every script, style and image from the web.
+  - Keep the page's state in variables. localStorage, sessionStorage, cookies and IndexedDB throw an error.
+  - Show messages in the page. `alert`, `confirm`, `prompt` and `window.open` do nothing. `confirm` returns false and `prompt` returns null.
+  - Handle form input in a script. A form never submits.
+  - To copy text, select a hidden textarea and call `document.execCommand("copy")`. `navigator.clipboard` throws an error.
+  - Check that each script parses before you add the page. One syntax error stops that whole script, and the page can open blank.
 - A ticket past its estimate with no update turns stuck. Keep its stage current, or raise its `--estimate`.
 - A ticket another session adds is part of the plan. Work it in order.
 - `--status blocked` and `stuck set` are for things outside the run, like a service that's down or missing access.