agenttwin 0.3.10 → 0.3.12

package/README.md

@@ -12,7 +12,7 @@ Node.js 22.12+ is required. Run discovery from your project; npx installs the CL
 npx agenttwin init
 ```
 
-`init` discovers your repository and opens a persistent control menu. Bare `npx agenttwin` opens the same entry point. Select a reviewed world, inspect every service's support, run correctness checks, explore seeded faults, replay a failure, verify a source-only patch, save a regression, import an incident, or connect your account—all from this menu, without remembering flags or separate command names. `npx agenttwin refresh` updates discovery without executing application code. Existing advanced commands remain available to CI and coding agents.
+`init` discovers and connects your repository, then shows one recommended next step: set up your first test, or run the test you already selected. You can search and page through detected workflows, load a reviewed test file, and view the last result. Fault exploration, replay, patch verification, regressions, CI setup and runtime selection live under Advanced options. Bare `npx agenttwin` opens the same menu. `npx agenttwin refresh` updates discovery without executing application code. Existing commands remain available to CI and coding agents. Selecting a discovered workflow saves your choice and provides a coding-agent preparation request; it does not automatically create or execute a test.
 
 Discovery writes the inventory, workflow candidates, `agenttwin.config.json`, `ENVIRONMENT.md`, `REPLICATION.md`, and an offline browser report. A discovered candidate is not an executable specification: the menu accepts a reviewed `agenttwin.world.json` with explicit bundled Node files, synthetic services, invocation and required outcomes. The optional demo is clearly labeled as synthetic. Redirected input and `--yes` only perform discovery; they never start the interactive execution loop. `init --json --dry-run` writes nothing. Interactive init connects and syncs discovery after the first browser approval; saved connections sync without another approval. Noninteractive init never uploads automatically.
 
@@ -154,3 +154,9 @@ A run receipt's **Fix & retest** tab exports an evidence-based task for your cod
 The website’s Settings page saves workspace name, default execution limit (1–300 seconds for new templates), automatic refresh, compact lists and reduced motion in this browser. Existing reviewed bundles retain their limits. The account section supports token visibility, connection status, manual workspace refresh and disconnect; tokens are never persisted with preferences.
 
 Top-right initials open account actions. The sidebar closes into a full-width layout. See `docs-site/src/dashboard.mdx` for the complete guide. The website/API UI has received additional fixes after npm 0.2.2; the published package remains 0.2.2.
+
+### Workflow discovery boundaries
+
+Discovery identifies individual request branches in Fetch/Bun-style URL dispatch, Express-style callbacks, queue workers and exported provider operations. It follows direct local function calls and relative named imports, including aliases, and recognizes provider hosts in literal HTTP calls. Each candidate retains its source entrypoint and evidence. Router containers and pure exported helpers are not treated as complete workflows.
+
+These are possible static code paths, not executed or verified business workflows. Dynamic dispatch, computed destinations, external packages, re-exports and runtime-only integrations can remain unresolved. Prepare inputs, operation coverage and correctness checks before running a candidate. Refresh discovery and sync it to update an already-connected dashboard.

package/dist/api.js

@@ -1596,7 +1596,7 @@ var challengeStore = (map, key, value, ttlMs) => {
 init_dashboard_transfer();
 import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse } from "@simplewebauthn/server";
 import { createServer as createServer2 } from "http";
-import { createHash as createHash8, randomBytes as randomBytes6, randomUUID as randomUUID2, timingSafeEqual as timingSafeEqual4 } from "crypto";
+import { createHash as createHash9, randomBytes as randomBytes6, randomUUID as randomUUID2, timingSafeEqual as timingSafeEqual4 } from "crypto";
 import { mkdir as mkdir7, readFile as readFile12, writeFile as writeFile9, rename, mkdtemp as mkdtemp3, rm as rm4 } from "fs/promises";
 import { resolve as resolve4, join as join13, dirname as dirname2, extname } from "path";
 import { tmpdir as tmpdir3 } from "os";
@@ -4106,8 +4106,43 @@ See run.json for assertions, service state, application output and isolation met
   }
 }
 
+// src/runtime/analytics.ts
+import { createHash as createHash8 } from "crypto";
+function analyticsConfiguration() {
+  const key = process.env.POSTHOG_API_KEY;
+  const host = process.env.POSTHOG_API_HOST || "https://us.i.posthog.com";
+  return { enabled: Boolean(key), host: host.endsWith("/") ? host.slice(0, -1) : host, key: key ?? "" };
+}
+var FLUSH_SINK = "/capture/";
+function captureAnalytics(event) {
+  const config = analyticsConfiguration();
+  if (!config.enabled) return;
+  const body2 = {
+    api_key: config.key,
+    event: event.event,
+    distinct_id: event.distinctId,
+    properties: {
+      $lib: "agenttwin-gateway",
+      $lib_version: "0.1",
+      ...event.properties
+    },
+    timestamp: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const headers = { "content-type": "application/json" };
+  const timeout = AbortSignal.timeout(4e3);
+  void fetch(config.host + FLUSH_SINK, {
+    method: "POST",
+    headers,
+    body: JSON.stringify(body2),
+    signal: timeout
+  }).then((response) => {
+    if (!response.ok) throw new Error("analytics_http_" + response.status);
+  }).catch(() => {
+  });
+}
+
 // src/runtime/gateway.ts
-var hash2 = (value) => createHash8("sha256").update(value).digest("hex");
+var hash2 = (value) => createHash9("sha256").update(value).digest("hex");
 function uploadPath(path2) {
   if (!path2 || path2.startsWith("/") || path2.includes("\\") || path2.includes("\0") || path2.split("/").some((p) => !p || p === "." || p === ".." || /^(\.env.*|\.git|\.ssh|\.aws|\.azure|\.config|\.npmrc|\.netrc|credentials.*)$/i.test(p)) || /\.(pem|key|p12|pfx)$/i.test(path2)) throw new Error("Unsafe uploaded file path");
   return path2;
@@ -4227,10 +4262,12 @@ async function startGateway(opts) {
           const { reportPath: _report, evidencePath: _evidence, ...portable } = receipt;
           item.job.receipt = { ...portable, git: item.git, project: item.project, apiJobId: item.job.id, provenance: "client-supplied workflow declaration" };
           item.job.status = "completed";
+          captureAnalytics({ event: "run_completed", distinctId: item.job.accountId, properties: { jobId: item.job.id, ok: true } });
         } catch (error) {
           item.job.status = controllers.get(item.job.id)?.signal.aborted ? "cancelled" : "error";
           const message = error instanceof Error ? error.message : String(error);
           item.job.error = message.split(process.env.E2B_API_KEY ?? "\0").join("[redacted]").replace(/(?:postgresql|redis):\/\/[^\s]+/g, "[test-connection]").slice(0, 2e3);
+          if (item.job.status !== "cancelled") captureAnalytics({ event: "run_failed", distinctId: item.job.accountId, properties: { jobId: item.job.id } });
         } finally {
           try {
             if (workspace) await rm4(workspace, { recursive: true, force: true });
@@ -4451,6 +4488,7 @@ async function startGateway(opts) {
             if (store.accounts.length >= 1e4) throw new Error("account_capacity");
             owner = { id: randomUUID2(), tokenHash: hash2(randomBytes6(32).toString("hex")), label: identity.name + "'s workspace", active: true, usageDay: "", runs: 0, identity: { email: identity.email, name: identity.name }, externalIdentities: [{ provider: identity.provider, issuer: identity.issuer, subject: identity.subject }], ...identity.organization ? { organization: identity.organization } : {} };
             store.accounts.push(owner);
+            captureAnalytics({ event: "account_created", distinctId: owner.id, properties: { method: identity.provider, realm: identity.organization || identity.issuer } });
           }
           if (!owner.active) throw new Error("account_inactive");
           const secret = randomBytes6(32).toString("hex");
@@ -4671,6 +4709,7 @@ async function startGateway(opts) {
             }
             a = { id: randomUUID2(), tokenHash: hash2(randomBytes6(32).toString("hex")), label: workspace, active: true, usageDay: "", runs: 0, identity: { email: parsed.email, name, passwordHash: encoded } };
             store.accounts.push(a);
+            captureAnalytics({ event: "account_created", distinctId: a.id, properties: { method: "email", realm: "password" } });
           } else {
             const matches2 = await passwordMatches(parsed.password, a?.identity?.passwordHash ?? dummyPassword);
             if (!a?.active || !a.identity?.passwordHash || !matches2) {
@@ -5111,6 +5150,7 @@ async function startGateway(opts) {
         account.runs++;
         store.jobs.push(job);
         await save();
+        captureAnalytics({ event: "run_submitted", distinctId: account.id, properties: { jobId: job.id, project } });
         controllers.set(job.id, new AbortController());
         queue.push({ job, spec, files: input.files, git, project });
         schedule();

package/dist/cli.js

@@ -1929,7 +1929,7 @@ import { join as join34 } from "path";
 // package.json
 var package_default = {
   name: "agenttwin",
-  version: "0.3.10",
+  version: "0.3.12",
   description: "Give your agent a test world before it touches the real one.",
   keywords: [
     "agent",
@@ -6720,15 +6720,15 @@ function factoryProviderBindings(source) {
       constructors.set(specifier.local.name, provider.id);
     }
   }
-  const walk = (node, visit, skipFunctions = false) => {
+  const walk2 = (node, visit, skipFunctions = false) => {
     if (!node || typeof node !== "object") return;
     const value = node;
     if (skipFunctions && ["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"].includes(value.type)) return;
     visit(value);
     for (const [key, child] of Object.entries(value)) {
       if (["loc", "start", "end", "comments"].includes(key)) continue;
-      if (Array.isArray(child)) child.forEach((item) => walk(item, visit, skipFunctions));
-      else if (child && typeof child === "object") walk(child, visit, skipFunctions);
+      if (Array.isArray(child)) child.forEach((item) => walk2(item, visit, skipFunctions));
+      else if (child && typeof child === "object") walk2(child, visit, skipFunctions);
     }
   };
   const factories = /* @__PURE__ */ new Map();
@@ -6737,7 +6737,7 @@ function factoryProviderBindings(source) {
     if (node?.type !== "FunctionDeclaration" || !node.id || node.async || node.generator || node.params.length) continue;
     const providers = /* @__PURE__ */ new Set();
     let unknown = false;
-    walk(node.body, (child) => {
+    walk2(node.body, (child) => {
       if (child.type !== "ReturnStatement") return;
       const argument = child.argument;
       if (argument?.type === "NullLiteral") return;
@@ -6749,18 +6749,18 @@ function factoryProviderBindings(source) {
   }
   const declarations = /* @__PURE__ */ new Map();
   const count = (name) => declarations.set(name, (declarations.get(name) ?? 0) + 1);
-  walk(ast.program, (node) => {
+  walk2(ast.program, (node) => {
     if (["FunctionDeclaration", "ClassDeclaration"].includes(node.type) && node.id?.name) count(node.id.name);
     if (node.type === "VariableDeclarator" && node.id.type === "Identifier") count(node.id.name);
     if (["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"].includes(node.type)) {
-      for (const parameter of node.params ?? []) walk(parameter, (part) => {
+      for (const parameter of node.params ?? []) walk2(parameter, (part) => {
         if (part.type === "Identifier") count(part.name);
       });
     }
   });
   for (const name of factories.keys()) if ((declarations.get(name) ?? 0) > 1) factories.delete(name);
   const ambiguous = /* @__PURE__ */ new Set();
-  walk(ast.program, (node) => {
+  walk2(ast.program, (node) => {
     if (node.type !== "VariableDeclarator" || node.id.type !== "Identifier" || node.init?.type !== "CallExpression" || node.init.callee.type !== "Identifier") return;
     const provider = factories.get(node.init.callee.name);
     if (!provider) return;
@@ -6776,6 +6776,195 @@ function factoryProviderBindings(source) {
 init_entrypoints();
 import { createHash as createHash12 } from "crypto";
 
+// src/inventory/workflow-graph.ts
+init_catalog();
+import { parse as parse3 } from "@babel/parser";
+import { posix } from "path";
+function walk(node, visit, skipFunctions = false) {
+  if (!node || typeof node !== "object") return;
+  if (skipFunctions && /^(FunctionDeclaration|FunctionExpression|ArrowFunctionExpression)$/.test(node.type)) return;
+  visit(node);
+  for (const [key, child] of Object.entries(node)) {
+    if (["loc", "start", "end", "comments", "tokens"].includes(key)) continue;
+    if (Array.isArray(child)) child.forEach((item) => walk(item, visit, skipFunctions));
+    else if (child && typeof child === "object") walk(child, visit, skipFunctions);
+  }
+}
+function workflowGraph(sources, operations, tools) {
+  const modules = /* @__PURE__ */ new Map();
+  const gaps = [];
+  const resolve19 = (path2, specifier) => {
+    const base = posix.normalize(posix.join(posix.dirname(path2), specifier));
+    return [base, ...[".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"].map((ext) => base + ext), base.replace(/\.js$/, ".ts"), ...[".ts", ".js"].map((ext) => base + "/index" + ext)].find((candidate) => sources.has(candidate));
+  };
+  for (const [path2, source] of sources) {
+    if (!/\.[cm]?[jt]sx?$/.test(path2)) continue;
+    let ast;
+    try {
+      ast = parse3(source, { sourceType: "unambiguous", plugins: ["typescript", "jsx"] });
+    } catch {
+      gaps.push(`Workflow syntax could not be parsed: ${path2}`);
+      continue;
+    }
+    const mod = { functions: /* @__PURE__ */ new Map(), imports: /* @__PURE__ */ new Map(), routes: [], ast };
+    modules.set(path2, mod);
+    const unit = (name, node, exported, trigger = false) => ({ path: path2, name, node, exported, trigger, startLine: node.loc.start.line, endLine: node.loc.end.line });
+    for (const item of ast.program.body) {
+      if (item.type === "ImportDeclaration" && item.importKind !== "type" && item.source.value.startsWith(".")) {
+        const target = resolve19(path2, item.source.value);
+        if (target) for (const spec of item.specifiers) {
+          if (spec.type === "ImportSpecifier" && spec.importKind !== "type") mod.imports.set(spec.local.name, { path: target, name: spec.imported.name ?? spec.imported.value });
+          if (spec.type === "ImportDefaultSpecifier") mod.imports.set(spec.local.name, { path: target, name: "default" });
+        }
+      }
+      const exported = item.type === "ExportNamedDeclaration" || item.type === "ExportDefaultDeclaration";
+      const declaration = exported ? item.declaration : item;
+      if (declaration?.type === "FunctionDeclaration") {
+        const name = declaration.id?.name ?? "default";
+        mod.functions.set(name, { ...unit(name, declaration.body, exported), parameters: declaration.params });
+        if (item.type === "ExportDefaultDeclaration") mod.functions.set("default", mod.functions.get(name));
+      }
+      if (declaration?.type === "VariableDeclaration") for (const variable of declaration.declarations) {
+        if (variable.id.type !== "Identifier") continue;
+        const fn = variable.init;
+        if (fn && ["ArrowFunctionExpression", "FunctionExpression"].includes(fn.type)) mod.functions.set(variable.id.name, { ...unit(variable.id.name, fn.body, exported), parameters: fn.params });
+      }
+    }
+    walk(ast.program, (fn) => {
+      if (!["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"].includes(fn.type) || fn.body?.type !== "BlockStatement") return;
+      const paths = /* @__PURE__ */ new Set();
+      const patterns = /* @__PURE__ */ new Map();
+      walk(fn.body, (node) => {
+        if (node.type !== "VariableDeclarator" || node.id.type !== "Identifier") return;
+        if (node.init?.type === "MemberExpression" && node.init.property.name === "pathname") paths.add(node.id.name);
+        const call = node.init;
+        if (call?.type === "CallExpression" && call.callee.type === "MemberExpression" && paths.has(call.callee.object.name) && call.callee.property.name === "match" && call.arguments[0]?.type === "RegExpLiteral") patterns.set(node.id.name, "/" + call.arguments[0].pattern + "/");
+      }, true);
+      if (paths.size === 0) return;
+      walk(fn.body, (node) => {
+        if (node.type !== "IfStatement") return;
+        const routes = /* @__PURE__ */ new Set();
+        const methods = /* @__PURE__ */ new Set();
+        walk(node.test, (test) => {
+          if (test.type === "Identifier" && patterns.has(test.name)) routes.add(patterns.get(test.name));
+          if (test.type !== "BinaryExpression" || !["===", "=="].includes(test.operator)) return;
+          for (const [left, right] of [[test.left, test.right], [test.right, test.left]]) {
+            if (right.type !== "StringLiteral") continue;
+            if (left.type === "Identifier" && paths.has(left.name) && right.value.startsWith("/")) routes.add(right.value);
+            if (left.type === "MemberExpression" && left.property.name === "method" && /^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)$/.test(right.value)) methods.add(right.value);
+          }
+        });
+        let handlesRequest = false;
+        walk(node.consequent, (part) => {
+          if (part.type === "CallExpression" || part.type === "NewExpression" || part.type === "ReturnStatement" && part.argument && part.argument.type !== "NullLiteral") handlesRequest = true;
+        }, true);
+        if (!handlesRequest) return;
+        for (const route of routes) {
+          const method = methods.size === 1 ? [...methods][0] : "HTTP";
+          mod.routes.push({ ...unit(`route:${method}:${route}@${node.loc.start.line}`, node.consequent, false, true), parameters: fn.params });
+        }
+      }, true);
+    });
+    walk(ast.program, (node) => {
+      if (node.type !== "CallExpression" || node.callee.type !== "Identifier" || node.callee.name !== "fetch") return;
+      const url = node.arguments[0];
+      const value = url?.type === "StringLiteral" ? url.value : url?.type === "TemplateLiteral" ? url.quasis[0]?.value.cooked : void 0;
+      if (!value || !/^https?:\/\//.test(value)) return;
+      let host;
+      try {
+        host = new URL(value).hostname;
+      } catch {
+        return;
+      }
+      const provider = PROVIDERS.find((p) => p.signatures.hosts?.some((h2) => host === h2 || host.endsWith("." + h2)));
+      const toolId = provider && tools.get(provider.id);
+      if (!toolId) return;
+      const methodNode = node.arguments[1]?.properties?.find((p) => p.key?.name === "method" || p.key?.value === "method")?.value;
+      const method = methodNode ? methodNode.type === "StringLiteral" ? methodNode.value.toUpperCase() : "UNKNOWN" : "GET";
+      const line = node.loc.start.line;
+      operations.push({ path: path2, line, toolId, kind: method === "GET" || method === "HEAD" ? "reads" : "writes", label: `HTTP ${method} ${host}`, resource: provider.id, ref: `${path2}:${line}` });
+    });
+  }
+  const adjacency = /* @__PURE__ */ new Map();
+  const resolveCalls = (entry) => {
+    const cached = adjacency.get(entry);
+    if (cached) return cached;
+    const found = /* @__PURE__ */ new Set();
+    const boundNames = (nodes) => {
+      const names = /* @__PURE__ */ new Set();
+      for (const node of nodes) walk(node, (part) => {
+        if (part.type === "Identifier") names.add(part.name);
+      });
+      return names;
+    };
+    const scan = (node, shadowed) => {
+      if (!node || typeof node !== "object") return;
+      if (node.type === "FunctionDeclaration") return;
+      if (["ArrowFunctionExpression", "FunctionExpression"].includes(node.type)) {
+        scan(node.body, /* @__PURE__ */ new Set([...shadowed, ...boundNames(node.params)]));
+        return;
+      }
+      if (node.type === "BlockStatement") {
+        shadowed = new Set(shadowed);
+        for (const statement of node.body) {
+          if (statement.type === "VariableDeclaration") for (const declaration of statement.declarations) for (const name of boundNames([declaration.id])) shadowed.add(name);
+          if (statement.type === "FunctionDeclaration" && statement.id) shadowed.add(statement.id.name);
+        }
+      }
+      if (node.type === "CallExpression" && node.callee.type === "Identifier" && !shadowed.has(node.callee.name)) {
+        const mod = modules.get(entry.path);
+        const local = mod.functions.get(node.callee.name);
+        const imported = mod.imports.get(node.callee.name);
+        const target = local ?? (imported ? modules.get(imported.path)?.functions.get(imported.name) : void 0);
+        if (target && (local || target.exported)) found.add(target);
+      }
+      for (const [key, child] of Object.entries(node)) {
+        if (["loc", "start", "end", "comments", "tokens"].includes(key)) continue;
+        if (Array.isArray(child)) child.forEach((item) => scan(item, shadowed));
+        else if (child && typeof child === "object") scan(child, shadowed);
+      }
+    };
+    scan(entry.node, boundNames(entry.parameters ?? []));
+    const result = [...found];
+    adjacency.set(entry, result);
+    return result;
+  };
+  const byPath = /* @__PURE__ */ new Map();
+  for (const operation of operations) {
+    const list2 = byPath.get(operation.path) ?? [];
+    list2.push(operation);
+    byPath.set(operation.path, list2);
+  }
+  const directEffects = /* @__PURE__ */ new Map();
+  const effects = (unit) => {
+    let result = directEffects.get(unit);
+    if (!result) {
+      result = (byPath.get(unit.path) ?? []).filter((op) => op.line >= unit.startLine && op.line <= unit.endLine);
+      directEffects.set(unit, result);
+    }
+    return result;
+  };
+  const entries = [];
+  for (const mod of modules.values()) {
+    for (const entry of [...new Set(mod.functions.values()), ...mod.routes]) {
+      if (!entry.exported && !entry.trigger) continue;
+      if (!entry.trigger && mod.routes.some((route) => route.startLine >= entry.startLine && route.endLine <= entry.endLine)) continue;
+      const visited = /* @__PURE__ */ new Set();
+      const pending = [entry];
+      while (pending.length) {
+        const current = pending.pop();
+        if (visited.has(current)) continue;
+        visited.add(current);
+        pending.push(...resolveCalls(current));
+      }
+      const calls = [...new Set([...visited].flatMap(effects))];
+      if (!entry.trigger && !calls.some((call) => call.kind === "writes" || call.kind === "emits")) continue;
+      entries.push({ ...entry, calls, evidence: [...visited].map((u) => ({ source: "static", ref: `${u.path}:${u.startLine}` })) });
+    }
+  }
+  return { entries, gaps };
+}
+
 // src/inventory/operations.ts
 var WRITE_VERBS = /* @__PURE__ */ new Set([
   "create",
@@ -7194,32 +7383,47 @@ async function buildRelationships(apps, tools, files, decisions) {
       verified: false
     });
   }
-  for (const [path2, text] of sourceText) {
+  const allowedCalls = entrypointCalls.filter((call) => decidedRecords.some((record2) => record2.toolId === call.toolId && record2.kind === call.kind && record2.evidence.some((e) => e.ref === call.ref)));
+  const graph = workflowGraph(sourceText, allowedCalls, new Map(providerTools.map((t) => [t.providerId, t.id])));
+  gaps.push(...graph.gaps);
+  const entries = graph.entries.map((entry) => ({ ...entry, evidence: entry.evidence }));
+  for (const [path2, text] of sourceText) for (const entry of exportedEntrypoints(text)) {
+    if (!/^(route|job):/.test(entry.name)) continue;
+    entries.push({
+      ...entry,
+      path: path2,
+      node: {},
+      exported: false,
+      trigger: true,
+      calls: allowedCalls.filter((call) => call.path === path2 && call.line >= entry.startLine && call.line <= entry.endLine),
+      evidence: [{ source: "static", ref: `${path2}:${entry.startLine}` }]
+    });
+  }
+  for (const entry of entries) {
+    const { path: path2 } = entry;
     const app = appForPath(apps, path2);
-    for (const entry of exportedEntrypoints(text)) {
-      const calls = entrypointCalls.filter((call) => call.path === path2 && call.line >= entry.startLine && call.line <= entry.endLine && decidedRecords.some((record2) => record2.toolId === call.toolId && record2.kind === call.kind && record2.evidence.some((e) => e.ref === call.ref)));
-      if (!calls.some((call) => call.kind === "writes" || call.kind === "emits")) continue;
-      const dependencies = [...new Set(calls.map((call) => call.toolId))];
-      const evidence = [...new Set(calls.map((call) => call.ref))].map((ref) => ({ source: "static", ref }));
-      workflows.push({
-        id: "entry:" + createHash12("sha256").update(path2 + ":" + entry.name).digest("hex").slice(0, 20),
-        title: entry.name,
-        entrypoint: path2 + "#" + entry.name,
-        apps: [app.id],
-        tools: dependencies,
-        steps: dependencies.map((tool2) => ({ app: app.id, tool: tool2, operations: [...new Set(calls.filter((c) => c.toolId === tool2).map((c) => c.label))], evidence })),
-        sharedEntities: [...new Set(calls.map((call) => singularize(call.resource)))],
-        evidence,
-        confidence: "medium",
-        risk: "high",
-        rank: 0,
-        supported: false,
-        hypothesis: true,
-        linkingSignals: ["callable export or route/job handler containing binding-resolved side effects; invocation and correctness require review"],
-        scopeUncertain: true,
-        verified: false
-      });
-    }
+    const calls = entry.calls.filter((call) => !rejected.has(opRelId(appForPath(apps, call.path).id, call.toolId, call.kind)));
+    if (!entry.trigger && !calls.some((call) => call.kind === "writes" || call.kind === "emits")) continue;
+    const dependencies = [...new Set(calls.map((call) => call.toolId))];
+    const evidence = [...new Map([...entry.evidence, ...calls.map((call) => ({ source: "static", ref: call.ref }))].map((ref) => [ref.ref, ref])).values()];
+    workflows.push({
+      id: "entry:" + createHash12("sha256").update(path2 + ":" + entry.name).digest("hex").slice(0, 20),
+      title: entry.name,
+      entrypoint: path2 + "#" + entry.name.replace(/\\/g, "%5C"),
+      apps: [app.id],
+      tools: dependencies,
+      steps: dependencies.map((tool2) => ({ app: app.id, tool: tool2, operations: [...new Set(calls.filter((c) => c.toolId === tool2).map((c) => c.label))], evidence })),
+      sharedEntities: [...new Set(calls.map((call) => singularize(call.resource)))],
+      evidence,
+      confidence: "medium",
+      risk: "high",
+      rank: 0,
+      supported: false,
+      hypothesis: true,
+      linkingSignals: [entry.trigger ? "explicit request or background-job trigger" : "exported operation with statically linked provider effects", "local helper call chains are possible paths, not proof of runtime execution; invocation and correctness require review"],
+      scopeUncertain: true,
+      verified: false
+    });
   }
   if (sourceFiles.length === MAX_FILES3) gaps.push("Source scan is limited to 2500 files; split large repositories into explicit roots. Not every workflow can be proven by static discovery.");
   const finalWorkflows = workflows.filter((w) => !rejected.has(w.id)).map(
@@ -7878,6 +8082,10 @@ function scenariosFor(kind) {
   return [...new Set(list2)];
 }
 function assertionsFor(candidate) {
+  if (candidate.entrypoint) return [
+    `define the expected response/output for ${candidate.entrypoint}`,
+    "review required final state and forbidden effects; discovery does not infer business correctness"
+  ];
   const entity = candidate.sharedEntities[0] ?? "record";
   return [
     `exactly one ${entity} write is applied (no duplicates)`,
@@ -7900,7 +8108,7 @@ function buildWorkflowPlans(candidates, _tools) {
       ),
       sharedEntities: candidate.sharedEntities,
       permissions: permissionsFor(kind, candidate.sharedEntities),
-      asyncEvents: eventsFor(kind, candidate.sharedEntities),
+      asyncEvents: candidate.entrypoint ? [] : eventsFor(kind, candidate.sharedEntities),
       failureScenarios: scenariosFor(kind),
       outcomeAssertions: assertionsFor(candidate),
       unknowns: [
@@ -9072,7 +9280,7 @@ async function runInit(opts) {
 // src/commands/control.ts
 import { createInterface as createInterface3 } from "readline/promises";
 import { readFile as readFile23, writeFile as writeFile22 } from "fs/promises";
-import { join as join27, resolve as resolve14 } from "path";
+import { basename as basename4, join as join27, resolve as resolve14 } from "path";
 init_store();
 init_contracts();
 
@@ -9173,7 +9381,7 @@ var CONTROL_ACTIONS = [
 async function readState(cwd) {
   try {
     const state = JSON.parse(await readFile23(join27(cwd, ".agenttwin/control.json"), "utf8"));
-    if (state.schema === "agenttwin/control-v1" && ["world", "exploration", "receipt"].every((key) => state[key] === void 0 || typeof state[key] === "string") && (state.runtime === void 0 || ["local", "hosted", "e2b"].includes(state.runtime))) return state;
+    if (state.schema === "agenttwin/control-v1" && ["world", "exploration", "receipt", "workflowId", "workflowTitle"].every((key) => state[key] === void 0 || typeof state[key] === "string") && (state.runtime === void 0 || ["local", "hosted", "e2b"].includes(state.runtime))) return state;
   } catch {
   }
   return { schema: "agenttwin/control-v1" };
@@ -9188,7 +9396,7 @@ async function runControl(opts) {
   const ask = async (prompt) => (await rl.question(prompt + " ")).trim();
   const save = () => writeFile22(join27(opts.cwd, ".agenttwin/control.json"), JSON.stringify(state, null, 2) + "\n", { mode: 384 });
   const requireWorld = () => {
-    if (!state.world) throw new Error("Select a reviewed world file first (option 2). Discovery candidates are not executable specifications.");
+    if (!state.world) throw new Error("Set up a test first. A detected workflow needs application files, test data and expected outcomes before it can run.");
     return state.world;
   };
   const connectAndShare = async () => {
@@ -9199,20 +9407,110 @@ async function runControl(opts) {
     const result = await runSync(opts.cwd);
     log(`Project connected: ${result.tools} services and ${result.workflows} workflow candidates synced. ${result.dashboard}`);
   };
+  const chooseWorkflow = async () => {
+    const inventory = await readInventory(opts.cwd);
+    const workflows = inventory?.workflows ?? [];
+    if (!workflows.length) {
+      log("No workflow candidates found. Refresh discovery in Advanced options, or load an existing test file.");
+      return;
+    }
+    log(`${workflows.length} workflow candidates found. These are code paths, not tested workflows yet.`);
+    const query = (await ask("Find a workflow (for example mail, calendar or billing; Enter shows all):")).toLowerCase();
+    const matches2 = workflows.filter((w) => `${w.title} ${w.entrypoint ?? ""}`.toLowerCase().includes(query));
+    if (!matches2.length) {
+      log("No matching workflows. Try another search.");
+      return;
+    }
+    let offset = 0;
+    while (true) {
+      const page2 = matches2.slice(offset, offset + 10);
+      page2.forEach((w, i) => log(`  ${i + 1}. ${w.title}${w.entrypoint ? ` \xB7 ${w.entrypoint}` : ""}`));
+      log(`Showing ${offset + 1}\u2013${offset + page2.length} of ${matches2.length}. n: next page \xB7 p: previous page \xB7 0: back`);
+      const selected = await ask("Choose a workflow [0]:");
+      if (!selected || selected === "0") return;
+      if (selected === "n") {
+        offset = offset + 10 < matches2.length ? offset + 10 : 0;
+        continue;
+      }
+      if (selected === "p") {
+        offset = Math.max(0, offset - 10);
+        continue;
+      }
+      const workflow = /^\d+$/.test(selected) ? page2[Number(selected) - 1] : void 0;
+      if (!workflow) {
+        log("Choose a workflow number from this page.");
+        continue;
+      }
+      state.workflowId = workflow.id;
+      state.workflowTitle = workflow.title;
+      delete state.world;
+      delete state.exploration;
+      delete state.receipt;
+      await save();
+      log(`Selected: ${workflow.title}`);
+      log("Next: prepare its test. AgentTwin cannot yet turn every detected code path into a runnable test automatically.");
+      log("Give your coding agent this request:");
+      log(`Read .agenttwin/AGENT-TASK.md and .agenttwin/inventory.json. Prepare workflow ${JSON.stringify(workflow.id)} (${JSON.stringify(workflow.title)}) as agenttwin.world.json, with bundled application files, supported service operations, synthetic records and reviewed expected outcomes. Report unsupported dependencies; do not replace the application with a demo.`);
+      log("Then return here and choose Load a test file. Selecting a workflow has not run your application.");
+      return;
+    }
+  };
   try {
     try {
       await connectAndShare();
     } catch (error) {
-      log(`Connection stopped: ${error instanceof Error ? error.message : String(error)}. Local discovery is saved. Retry with option 9.`);
+      log(`Connection stopped: ${error instanceof Error ? error.message : String(error)}. Local discovery is saved. Retry Connect project in Advanced options.`);
     }
     while (true) {
-      log("\nAgentTwin \xB7 your repository control center");
-      log(`World: ${state.world ?? "not selected"} \xB7 Runtime: ${state.runtime ?? "local"} \xB7 Exploration: ${state.exploration ?? "not captured"}`);
-      CONTROL_ACTIONS.forEach((action, index) => log(`  ${index + 1}. ${action}`));
+      log(`
+AgentTwin \xB7 ${basename4(opts.cwd)}`);
+      if (state.world) log(`Ready to test: ${state.world} \xB7 ${state.runtime ?? "local"}`);
+      else if (state.workflowTitle) log(`Setup needed: ${state.workflowTitle}`);
+      else log("Next: choose a workflow to test.");
+      log(`  1. ${state.world ? "Run my test" : state.workflowTitle ? "Continue test setup" : "Set up my first test"} \u2190 next step`);
+      log("  2. View last result");
+      log("  3. Change workflow or test");
+      log("  4. Advanced options");
       log("  0. Exit");
-      const choice = await ask("Choose an action [0]:");
-      if (!choice || choice === "0") break;
+      let choice = await ask("Choose [1]:");
+      if (choice === "0") break;
       try {
+        if (!choice || choice === "1") choice = state.world ? "3" : "setup";
+        else if (choice === "2") choice = "13";
+        else if (choice === "3") choice = "setup";
+        else if (choice === "4") {
+          log("\nAdvanced options");
+          CONTROL_ACTIONS.forEach((action, index) => log(`  ${index + 1}. ${action}`));
+          log("  0. Back");
+          choice = await ask("Advanced action [0]:");
+          if (!choice || choice === "0") continue;
+          if (!/^\d+$/.test(choice) || Number(choice) < 1 || Number(choice) > CONTROL_ACTIONS.length) {
+            log("Choose a listed action.");
+            continue;
+          }
+        } else {
+          log("Choose 1, 2, 3, 4 or 0.");
+          continue;
+        }
+        if (choice === "setup") {
+          log("\nSet up a test");
+          log("  1. Choose a workflow from my repository");
+          log("  2. Load a test file I already have");
+          log("  3. Try a sample test (not my application)");
+          log("  0. Back");
+          const setup = await ask("Choose [1]:");
+          if (!setup || setup === "1") {
+            await chooseWorkflow();
+            continue;
+          }
+          if (setup === "0") continue;
+          if (setup === "2") choice = "2";
+          else if (setup === "3") choice = "12";
+          else {
+            log("Choose a listed action.");
+            continue;
+          }
+        }
         switch (choice) {
           case "1": {
             const inventory = await readInventory(opts.cwd);
@@ -9220,7 +9518,7 @@ async function runControl(opts) {
             break;
           }
           case "2": {
-            let file = await ask("Path to reviewed world or preparation JSON [agenttwin.world.json]:") || "agenttwin.world.json";
+            let file = await ask("Test file [agenttwin.world.json]:") || "agenttwin.world.json";
             const { parseWorld: parseWorld2 } = await Promise.resolve().then(() => (init_spec(), spec_exports));
             let input = JSON.parse(await readFile23(resolve14(opts.cwd, file), "utf8"));
             if (input.schema === "agenttwin/preparation-v1") {
@@ -9232,8 +9530,11 @@ async function runControl(opts) {
             const spec = parseWorld2(input);
             log(`${spec.name}: ${spec.files.length} explicit application files, ${spec.assertions.length} required outcomes, ${(spec.forbiddenEffects?.length ?? 0) + (spec.preservedState?.length ?? 0)} safety checks.`);
             log("Review the listed files, command, synthetic state and checks. Local execution runs application code on this machine.");
-            state.world = file;
+            state.world = resolve14(opts.cwd, file);
+            delete state.receipt;
+            delete state.exploration;
             await save();
+            log("Test ready. Choose Run my test to execute it.");
             break;
           }
           case "3": {
@@ -9253,12 +9554,12 @@ async function runControl(opts) {
             const result = await runExploration(opts.cwd, captured.id, { log });
             state.receipt = (result.results.find((r) => r.status !== "passed") ?? result.results[0]).evidencePath;
             await save();
-            log(`${result.status.toUpperCase()} \xB7 saved ${result.results.length} trial receipts. Replay with option 5; verify a patch with option 6.`);
+            log(`${result.status.toUpperCase()} \xB7 saved ${result.results.length} trial receipts. Replay or verify a patch in Advanced options.`);
             break;
           }
           case "5":
           case "6": {
-            if (!state.exploration) throw new Error("Capture an exploration first (option 4).");
+            if (!state.exploration) throw new Error("Choose Explore seeded faults in Advanced options first.");
             const result = await runExploration(opts.cwd, state.exploration, { patched: choice === "6", log });
             state.receipt = (result.results.find((r) => r.status !== "passed") ?? result.results[0]).evidencePath;
             await save();