agenttwin 0.3.9 → 0.3.11

package/README.md

@@ -14,7 +14,7 @@ npx agenttwin init
 
 `init` discovers your repository and opens a persistent control menu. Bare `npx agenttwin` opens the same entry point. Select a reviewed world, inspect every service's support, run correctness checks, explore seeded faults, replay a failure, verify a source-only patch, save a regression, import an incident, or connect your account—all from this menu, without remembering flags or separate command names. `npx agenttwin refresh` updates discovery without executing application code. Existing advanced commands remain available to CI and coding agents.
 
-Discovery writes the inventory, workflow candidates, `agenttwin.config.json`, `ENVIRONMENT.md`, `REPLICATION.md`, and an offline browser report. A discovered candidate is not an executable specification: the menu accepts a reviewed `agenttwin.world.json` with explicit bundled Node files, synthetic services, invocation and required outcomes. The optional demo is clearly labeled as synthetic. Redirected input and `--yes` only perform discovery; they never start the interactive execution loop. `init --json --dry-run` writes nothing. Account sharing is explicit; having an existing token does not automatically upload evidence during init.
+Discovery writes the inventory, workflow candidates, `agenttwin.config.json`, `ENVIRONMENT.md`, `REPLICATION.md`, and an offline browser report. A discovered candidate is not an executable specification: the menu accepts a reviewed `agenttwin.world.json` with explicit bundled Node files, synthetic services, invocation and required outcomes. The optional demo is clearly labeled as synthetic. Redirected input and `--yes` only perform discovery; they never start the interactive execution loop. `init --json --dry-run` writes nothing. Interactive init connects and syncs discovery after the first browser approval; saved connections sync without another approval. Noninteractive init never uploads automatically.
 
 Seeded exploration includes an unfaulted control and up to 31 timeout-after-write trials. A seed controls the selected service/path and delay, not OS scheduling or arbitrary application randomness. Each trial uses fresh service state. Captured application files, checks, fault cases and receipts stay under `.agenttwin/explorations/`. Replay uses the captured application; patch verification uses current application files with the captured checks and fault cases. Hash mismatches reject accidental snapshot edits. This is local evidence, not a tamper-proof security boundary; protected CI anchors saved regression checks in a trusted Git baseline. Unexercised fault targets and unsupported provider operations remain incomplete.
 
@@ -138,11 +138,11 @@ Older releases without this updater cannot update themselves. After the new rele
 
 ### Coding session and dashboard discovery
 
-Run `npx agenttwin init` inside your repository (Node.js 22.12+). Interactive init opens the guided repository menu and offers account connection and reviewed project sharing. It does not launch another coding agent automatically. `npx agenttwin init --agent opencode` launches OpenCode explicitly with your configured provider and its normal permission controls. Provider authentication and usage belong to your coding-agent account. Other coding agents can use `.agenttwin/AGENT-TASK.md`.
+Run `npx agenttwin init` inside your repository (Node.js 22.12+). Interactive init connects your account, syncs project discovery and opens the guided repository menu. It does not launch another coding agent automatically. `npx agenttwin init --agent opencode` launches OpenCode explicitly with your configured provider and its normal permission controls. Provider authentication and usage belong to your coding-agent account. Other coding agents can use `.agenttwin/AGENT-TASK.md`.
 
 The session traces workflows across files, records intents and production failure hypotheses in `.agenttwin/WORKFLOWS.md`, and writes metadata to `.agenttwin/agent-discovery.json`. Static candidates retain their original evidence. Agent candidates remain unverified until the workflow is explicitly prepared and executed. Static discovery preserves distinct exported side-effect entrypoints, including repositories with 100 candidates; it does not prove that every business workflow has been found.
 
-Create a workspace at https://agenttwin.si/signup/ or run `npx agenttwin login` from your repository. Run `npx agenttwin init`, review discovery, then choose account connection and approve sharing in the guided menu. Sign in in your browser and enter the code shown in the terminal when prompted. Terminal credentials are stored with owner-only permissions in `~/.agenttwin/credentials.json`, outside your repository. You can still supply `AGENTTWIN_TOKEN` for automation. Optional `AGENTTWIN_API_URL` selects your API. The website loads account discovery after you connect in Settings, then refreshes while visible. Sync sends names, operations and relative entrypoint metadata; application source uploads happen separately through reviewed bundles. Avoid sensitive names or identifiers in discovery metadata.
+Create a workspace at https://agenttwin.si/signup/ or run `npx agenttwin login` from your repository. Run `npx agenttwin init`. On first use, sign in in the browser, compare its prefilled connection code with your terminal, and click Connect terminal. Keep init running: project discovery syncs automatically, and onboarding refreshes to show it. Subsequent interactive init runs use the saved connection without another sharing prompt. Terminal credentials are stored with owner-only permissions in `~/.agenttwin/credentials.json`, outside your repository. You can still supply `AGENTTWIN_TOKEN` for automation. Optional `AGENTTWIN_API_URL` selects your API. The website loads account discovery after you connect in Settings, then refreshes while visible. Sync sends names, operations and relative entrypoint metadata; application source uploads happen separately through reviewed bundles. Avoid sensitive names or identifiers in discovery metadata.
 
 To execute a workflow, supply an executable Node entrypoint, reviewed supported dependency mappings, synthetic fixtures and expected observable outcomes. Run `npx agenttwin prepare --file preparation.json`, review the bundle, and run it through your AgentTwin API or E2B account. Browser/desktop automation and arbitrary vendor SDKs require additional runtimes/adapters. The CLI is the default runner; select a hosted runner only when the workflow requires it. No local Docker is used.
 
@@ -154,3 +154,9 @@ A run receipt's **Fix & retest** tab exports an evidence-based task for your cod
 The website’s Settings page saves workspace name, default execution limit (1–300 seconds for new templates), automatic refresh, compact lists and reduced motion in this browser. Existing reviewed bundles retain their limits. The account section supports token visibility, connection status, manual workspace refresh and disconnect; tokens are never persisted with preferences.
 
 Top-right initials open account actions. The sidebar closes into a full-width layout. See `docs-site/src/dashboard.mdx` for the complete guide. The website/API UI has received additional fixes after npm 0.2.2; the published package remains 0.2.2.
+
+### Workflow discovery boundaries
+
+Discovery identifies individual request branches in Fetch/Bun-style URL dispatch, Express-style callbacks, queue workers and exported provider operations. It follows direct local function calls and relative named imports, including aliases, and recognizes provider hosts in literal HTTP calls. Each candidate retains its source entrypoint and evidence. Router containers and pure exported helpers are not treated as complete workflows.
+
+These are possible static code paths, not executed or verified business workflows. Dynamic dispatch, computed destinations, external packages, re-exports and runtime-only integrations can remain unresolved. Prepare inputs, operation coverage and correctness checks before running a candidate. Refresh discovery and sync it to update an already-connected dashboard.

package/dist/cli.js

@@ -1876,6 +1876,12 @@ function validVerificationUrl(base, value) {
     return false;
   }
 }
+function pairingUrl(base, verificationUrl, userCode) {
+  if (!validVerificationUrl(base, verificationUrl) || !/^[A-F0-9]{10}$/.test(userCode)) throw new Error("Invalid pairing response.");
+  const url = new URL(verificationUrl);
+  url.hash = new URLSearchParams({ user_code: userCode }).toString();
+  return url.toString();
+}
 async function runLogin(log) {
   const base = apiBase(process.env.AGENTTWIN_API_URL || "https://api.agenttwin.si");
   const request = async (path2, input = {}) => fetch(base + path2, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify(input), redirect: "error", signal: AbortSignal.timeout(15e3) });
@@ -1883,12 +1889,13 @@ async function runLogin(log) {
   if (!response.ok) throw new Error("Cannot start sign in. Please try again.");
   const device = await response.json();
   if (!/^[a-f0-9]{64}$/.test(device.deviceCode) || !/^[A-F0-9]{10}$/.test(device.userCode) || !validVerificationUrl(base, device.verificationUrl)) throw new Error("Invalid pairing response.");
-  log(`Sign in or create an account at ${device.verificationUrl}`);
+  const browserUrl = pairingUrl(base, device.verificationUrl, device.userCode);
+  log(`Sign in or create an account at ${browserUrl}`);
   log(`Enter this code to connect this terminal: ${device.userCode}`);
-  log("Only approve the code shown in this terminal. No passwords or API keys to paste.");
-  if (process.platform === "darwin") execFile("open", [device.verificationUrl], () => {
+  log("Compare the browser code with this terminal, then choose Connect terminal. No passwords or API keys to paste.");
+  if (process.platform === "darwin") execFile("open", [browserUrl], () => {
   });
-  else if (process.platform === "linux") execFile("xdg-open", [device.verificationUrl], () => {
+  else if (process.platform === "linux") execFile("xdg-open", [browserUrl], () => {
   });
   const deadline = Date.now() + 6e5;
   while (Date.now() < deadline) {
@@ -1899,7 +1906,7 @@ async function runLogin(log) {
     if (!poll.ok || !/^at_user_[a-f0-9]{64}$/.test(data.token ?? "")) throw new Error(data.error || "Unable to finish sign in.");
     await saveConnection(base, data.token);
     log(`Connected to ${data.workspace}. Login saved privately outside your repository.`);
-    log("Return to the guided menu to review and share this repository.");
+    log("Terminal approved. Continuing project connection\u2026");
     return;
   }
   throw new Error("Sign in expired. Run npx agenttwin login again.");
@@ -1922,7 +1929,7 @@ import { join as join34 } from "path";
 // package.json
 var package_default = {
   name: "agenttwin",
-  version: "0.3.9",
+  version: "0.3.11",
   description: "Give your agent a test world before it touches the real one.",
   keywords: [
     "agent",
@@ -6713,15 +6720,15 @@ function factoryProviderBindings(source) {
       constructors.set(specifier.local.name, provider.id);
     }
   }
-  const walk = (node, visit, skipFunctions = false) => {
+  const walk2 = (node, visit, skipFunctions = false) => {
     if (!node || typeof node !== "object") return;
     const value = node;
     if (skipFunctions && ["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"].includes(value.type)) return;
     visit(value);
     for (const [key, child] of Object.entries(value)) {
       if (["loc", "start", "end", "comments"].includes(key)) continue;
-      if (Array.isArray(child)) child.forEach((item) => walk(item, visit, skipFunctions));
-      else if (child && typeof child === "object") walk(child, visit, skipFunctions);
+      if (Array.isArray(child)) child.forEach((item) => walk2(item, visit, skipFunctions));
+      else if (child && typeof child === "object") walk2(child, visit, skipFunctions);
     }
   };
   const factories = /* @__PURE__ */ new Map();
@@ -6730,7 +6737,7 @@ function factoryProviderBindings(source) {
     if (node?.type !== "FunctionDeclaration" || !node.id || node.async || node.generator || node.params.length) continue;
     const providers = /* @__PURE__ */ new Set();
     let unknown = false;
-    walk(node.body, (child) => {
+    walk2(node.body, (child) => {
       if (child.type !== "ReturnStatement") return;
       const argument = child.argument;
       if (argument?.type === "NullLiteral") return;
@@ -6742,18 +6749,18 @@ function factoryProviderBindings(source) {
   }
   const declarations = /* @__PURE__ */ new Map();
   const count = (name) => declarations.set(name, (declarations.get(name) ?? 0) + 1);
-  walk(ast.program, (node) => {
+  walk2(ast.program, (node) => {
     if (["FunctionDeclaration", "ClassDeclaration"].includes(node.type) && node.id?.name) count(node.id.name);
     if (node.type === "VariableDeclarator" && node.id.type === "Identifier") count(node.id.name);
     if (["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"].includes(node.type)) {
-      for (const parameter of node.params ?? []) walk(parameter, (part) => {
+      for (const parameter of node.params ?? []) walk2(parameter, (part) => {
         if (part.type === "Identifier") count(part.name);
       });
     }
   });
   for (const name of factories.keys()) if ((declarations.get(name) ?? 0) > 1) factories.delete(name);
   const ambiguous = /* @__PURE__ */ new Set();
-  walk(ast.program, (node) => {
+  walk2(ast.program, (node) => {
     if (node.type !== "VariableDeclarator" || node.id.type !== "Identifier" || node.init?.type !== "CallExpression" || node.init.callee.type !== "Identifier") return;
     const provider = factories.get(node.init.callee.name);
     if (!provider) return;
@@ -6769,6 +6776,195 @@ function factoryProviderBindings(source) {
 init_entrypoints();
 import { createHash as createHash12 } from "crypto";
 
+// src/inventory/workflow-graph.ts
+init_catalog();
+import { parse as parse3 } from "@babel/parser";
+import { posix } from "path";
+function walk(node, visit, skipFunctions = false) {
+  if (!node || typeof node !== "object") return;
+  if (skipFunctions && /^(FunctionDeclaration|FunctionExpression|ArrowFunctionExpression)$/.test(node.type)) return;
+  visit(node);
+  for (const [key, child] of Object.entries(node)) {
+    if (["loc", "start", "end", "comments", "tokens"].includes(key)) continue;
+    if (Array.isArray(child)) child.forEach((item) => walk(item, visit, skipFunctions));
+    else if (child && typeof child === "object") walk(child, visit, skipFunctions);
+  }
+}
+function workflowGraph(sources, operations, tools) {
+  const modules = /* @__PURE__ */ new Map();
+  const gaps = [];
+  const resolve19 = (path2, specifier) => {
+    const base = posix.normalize(posix.join(posix.dirname(path2), specifier));
+    return [base, ...[".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"].map((ext) => base + ext), base.replace(/\.js$/, ".ts"), ...[".ts", ".js"].map((ext) => base + "/index" + ext)].find((candidate) => sources.has(candidate));
+  };
+  for (const [path2, source] of sources) {
+    if (!/\.[cm]?[jt]sx?$/.test(path2)) continue;
+    let ast;
+    try {
+      ast = parse3(source, { sourceType: "unambiguous", plugins: ["typescript", "jsx"] });
+    } catch {
+      gaps.push(`Workflow syntax could not be parsed: ${path2}`);
+      continue;
+    }
+    const mod = { functions: /* @__PURE__ */ new Map(), imports: /* @__PURE__ */ new Map(), routes: [], ast };
+    modules.set(path2, mod);
+    const unit = (name, node, exported, trigger = false) => ({ path: path2, name, node, exported, trigger, startLine: node.loc.start.line, endLine: node.loc.end.line });
+    for (const item of ast.program.body) {
+      if (item.type === "ImportDeclaration" && item.importKind !== "type" && item.source.value.startsWith(".")) {
+        const target = resolve19(path2, item.source.value);
+        if (target) for (const spec of item.specifiers) {
+          if (spec.type === "ImportSpecifier" && spec.importKind !== "type") mod.imports.set(spec.local.name, { path: target, name: spec.imported.name ?? spec.imported.value });
+          if (spec.type === "ImportDefaultSpecifier") mod.imports.set(spec.local.name, { path: target, name: "default" });
+        }
+      }
+      const exported = item.type === "ExportNamedDeclaration" || item.type === "ExportDefaultDeclaration";
+      const declaration = exported ? item.declaration : item;
+      if (declaration?.type === "FunctionDeclaration") {
+        const name = declaration.id?.name ?? "default";
+        mod.functions.set(name, { ...unit(name, declaration.body, exported), parameters: declaration.params });
+        if (item.type === "ExportDefaultDeclaration") mod.functions.set("default", mod.functions.get(name));
+      }
+      if (declaration?.type === "VariableDeclaration") for (const variable of declaration.declarations) {
+        if (variable.id.type !== "Identifier") continue;
+        const fn = variable.init;
+        if (fn && ["ArrowFunctionExpression", "FunctionExpression"].includes(fn.type)) mod.functions.set(variable.id.name, { ...unit(variable.id.name, fn.body, exported), parameters: fn.params });
+      }
+    }
+    walk(ast.program, (fn) => {
+      if (!["FunctionDeclaration", "FunctionExpression", "ArrowFunctionExpression"].includes(fn.type) || fn.body?.type !== "BlockStatement") return;
+      const paths = /* @__PURE__ */ new Set();
+      const patterns = /* @__PURE__ */ new Map();
+      walk(fn.body, (node) => {
+        if (node.type !== "VariableDeclarator" || node.id.type !== "Identifier") return;
+        if (node.init?.type === "MemberExpression" && node.init.property.name === "pathname") paths.add(node.id.name);
+        const call = node.init;
+        if (call?.type === "CallExpression" && call.callee.type === "MemberExpression" && paths.has(call.callee.object.name) && call.callee.property.name === "match" && call.arguments[0]?.type === "RegExpLiteral") patterns.set(node.id.name, "/" + call.arguments[0].pattern + "/");
+      }, true);
+      if (paths.size === 0) return;
+      walk(fn.body, (node) => {
+        if (node.type !== "IfStatement") return;
+        const routes = /* @__PURE__ */ new Set();
+        const methods = /* @__PURE__ */ new Set();
+        walk(node.test, (test) => {
+          if (test.type === "Identifier" && patterns.has(test.name)) routes.add(patterns.get(test.name));
+          if (test.type !== "BinaryExpression" || !["===", "=="].includes(test.operator)) return;
+          for (const [left, right] of [[test.left, test.right], [test.right, test.left]]) {
+            if (right.type !== "StringLiteral") continue;
+            if (left.type === "Identifier" && paths.has(left.name) && right.value.startsWith("/")) routes.add(right.value);
+            if (left.type === "MemberExpression" && left.property.name === "method" && /^(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)$/.test(right.value)) methods.add(right.value);
+          }
+        });
+        let handlesRequest = false;
+        walk(node.consequent, (part) => {
+          if (part.type === "CallExpression" || part.type === "NewExpression" || part.type === "ReturnStatement" && part.argument && part.argument.type !== "NullLiteral") handlesRequest = true;
+        }, true);
+        if (!handlesRequest) return;
+        for (const route of routes) {
+          const method = methods.size === 1 ? [...methods][0] : "HTTP";
+          mod.routes.push({ ...unit(`route:${method}:${route}@${node.loc.start.line}`, node.consequent, false, true), parameters: fn.params });
+        }
+      }, true);
+    });
+    walk(ast.program, (node) => {
+      if (node.type !== "CallExpression" || node.callee.type !== "Identifier" || node.callee.name !== "fetch") return;
+      const url = node.arguments[0];
+      const value = url?.type === "StringLiteral" ? url.value : url?.type === "TemplateLiteral" ? url.quasis[0]?.value.cooked : void 0;
+      if (!value || !/^https?:\/\//.test(value)) return;
+      let host;
+      try {
+        host = new URL(value).hostname;
+      } catch {
+        return;
+      }
+      const provider = PROVIDERS.find((p) => p.signatures.hosts?.some((h2) => host === h2 || host.endsWith("." + h2)));
+      const toolId = provider && tools.get(provider.id);
+      if (!toolId) return;
+      const methodNode = node.arguments[1]?.properties?.find((p) => p.key?.name === "method" || p.key?.value === "method")?.value;
+      const method = methodNode ? methodNode.type === "StringLiteral" ? methodNode.value.toUpperCase() : "UNKNOWN" : "GET";
+      const line = node.loc.start.line;
+      operations.push({ path: path2, line, toolId, kind: method === "GET" || method === "HEAD" ? "reads" : "writes", label: `HTTP ${method} ${host}`, resource: provider.id, ref: `${path2}:${line}` });
+    });
+  }
+  const adjacency = /* @__PURE__ */ new Map();
+  const resolveCalls = (entry) => {
+    const cached = adjacency.get(entry);
+    if (cached) return cached;
+    const found = /* @__PURE__ */ new Set();
+    const boundNames = (nodes) => {
+      const names = /* @__PURE__ */ new Set();
+      for (const node of nodes) walk(node, (part) => {
+        if (part.type === "Identifier") names.add(part.name);
+      });
+      return names;
+    };
+    const scan = (node, shadowed) => {
+      if (!node || typeof node !== "object") return;
+      if (node.type === "FunctionDeclaration") return;
+      if (["ArrowFunctionExpression", "FunctionExpression"].includes(node.type)) {
+        scan(node.body, /* @__PURE__ */ new Set([...shadowed, ...boundNames(node.params)]));
+        return;
+      }
+      if (node.type === "BlockStatement") {
+        shadowed = new Set(shadowed);
+        for (const statement of node.body) {
+          if (statement.type === "VariableDeclaration") for (const declaration of statement.declarations) for (const name of boundNames([declaration.id])) shadowed.add(name);
+          if (statement.type === "FunctionDeclaration" && statement.id) shadowed.add(statement.id.name);
+        }
+      }
+      if (node.type === "CallExpression" && node.callee.type === "Identifier" && !shadowed.has(node.callee.name)) {
+        const mod = modules.get(entry.path);
+        const local = mod.functions.get(node.callee.name);
+        const imported = mod.imports.get(node.callee.name);
+        const target = local ?? (imported ? modules.get(imported.path)?.functions.get(imported.name) : void 0);
+        if (target && (local || target.exported)) found.add(target);
+      }
+      for (const [key, child] of Object.entries(node)) {
+        if (["loc", "start", "end", "comments", "tokens"].includes(key)) continue;
+        if (Array.isArray(child)) child.forEach((item) => scan(item, shadowed));
+        else if (child && typeof child === "object") scan(child, shadowed);
+      }
+    };
+    scan(entry.node, boundNames(entry.parameters ?? []));
+    const result = [...found];
+    adjacency.set(entry, result);
+    return result;
+  };
+  const byPath = /* @__PURE__ */ new Map();
+  for (const operation of operations) {
+    const list2 = byPath.get(operation.path) ?? [];
+    list2.push(operation);
+    byPath.set(operation.path, list2);
+  }
+  const directEffects = /* @__PURE__ */ new Map();
+  const effects = (unit) => {
+    let result = directEffects.get(unit);
+    if (!result) {
+      result = (byPath.get(unit.path) ?? []).filter((op) => op.line >= unit.startLine && op.line <= unit.endLine);
+      directEffects.set(unit, result);
+    }
+    return result;
+  };
+  const entries = [];
+  for (const mod of modules.values()) {
+    for (const entry of [...new Set(mod.functions.values()), ...mod.routes]) {
+      if (!entry.exported && !entry.trigger) continue;
+      if (!entry.trigger && mod.routes.some((route) => route.startLine >= entry.startLine && route.endLine <= entry.endLine)) continue;
+      const visited = /* @__PURE__ */ new Set();
+      const pending = [entry];
+      while (pending.length) {
+        const current = pending.pop();
+        if (visited.has(current)) continue;
+        visited.add(current);
+        pending.push(...resolveCalls(current));
+      }
+      const calls = [...new Set([...visited].flatMap(effects))];
+      if (!entry.trigger && !calls.some((call) => call.kind === "writes" || call.kind === "emits")) continue;
+      entries.push({ ...entry, calls, evidence: [...visited].map((u) => ({ source: "static", ref: `${u.path}:${u.startLine}` })) });
+    }
+  }
+  return { entries, gaps };
+}
+
 // src/inventory/operations.ts
 var WRITE_VERBS = /* @__PURE__ */ new Set([
   "create",
@@ -7187,32 +7383,47 @@ async function buildRelationships(apps, tools, files, decisions) {
       verified: false
     });
   }
-  for (const [path2, text] of sourceText) {
+  const allowedCalls = entrypointCalls.filter((call) => decidedRecords.some((record2) => record2.toolId === call.toolId && record2.kind === call.kind && record2.evidence.some((e) => e.ref === call.ref)));
+  const graph = workflowGraph(sourceText, allowedCalls, new Map(providerTools.map((t) => [t.providerId, t.id])));
+  gaps.push(...graph.gaps);
+  const entries = graph.entries.map((entry) => ({ ...entry, evidence: entry.evidence }));
+  for (const [path2, text] of sourceText) for (const entry of exportedEntrypoints(text)) {
+    if (!/^(route|job):/.test(entry.name)) continue;
+    entries.push({
+      ...entry,
+      path: path2,
+      node: {},
+      exported: false,
+      trigger: true,
+      calls: allowedCalls.filter((call) => call.path === path2 && call.line >= entry.startLine && call.line <= entry.endLine),
+      evidence: [{ source: "static", ref: `${path2}:${entry.startLine}` }]
+    });
+  }
+  for (const entry of entries) {
+    const { path: path2 } = entry;
     const app = appForPath(apps, path2);
-    for (const entry of exportedEntrypoints(text)) {
-      const calls = entrypointCalls.filter((call) => call.path === path2 && call.line >= entry.startLine && call.line <= entry.endLine && decidedRecords.some((record2) => record2.toolId === call.toolId && record2.kind === call.kind && record2.evidence.some((e) => e.ref === call.ref)));
-      if (!calls.some((call) => call.kind === "writes" || call.kind === "emits")) continue;
-      const dependencies = [...new Set(calls.map((call) => call.toolId))];
-      const evidence = [...new Set(calls.map((call) => call.ref))].map((ref) => ({ source: "static", ref }));
-      workflows.push({
-        id: "entry:" + createHash12("sha256").update(path2 + ":" + entry.name).digest("hex").slice(0, 20),
-        title: entry.name,
-        entrypoint: path2 + "#" + entry.name,
-        apps: [app.id],
-        tools: dependencies,
-        steps: dependencies.map((tool2) => ({ app: app.id, tool: tool2, operations: [...new Set(calls.filter((c) => c.toolId === tool2).map((c) => c.label))], evidence })),
-        sharedEntities: [...new Set(calls.map((call) => singularize(call.resource)))],
-        evidence,
-        confidence: "medium",
-        risk: "high",
-        rank: 0,
-        supported: false,
-        hypothesis: true,
-        linkingSignals: ["callable export or route/job handler containing binding-resolved side effects; invocation and correctness require review"],
-        scopeUncertain: true,
-        verified: false
-      });
-    }
+    const calls = entry.calls.filter((call) => !rejected.has(opRelId(appForPath(apps, call.path).id, call.toolId, call.kind)));
+    if (!entry.trigger && !calls.some((call) => call.kind === "writes" || call.kind === "emits")) continue;
+    const dependencies = [...new Set(calls.map((call) => call.toolId))];
+    const evidence = [...new Map([...entry.evidence, ...calls.map((call) => ({ source: "static", ref: call.ref }))].map((ref) => [ref.ref, ref])).values()];
+    workflows.push({
+      id: "entry:" + createHash12("sha256").update(path2 + ":" + entry.name).digest("hex").slice(0, 20),
+      title: entry.name,
+      entrypoint: path2 + "#" + entry.name.replace(/\\/g, "%5C"),
+      apps: [app.id],
+      tools: dependencies,
+      steps: dependencies.map((tool2) => ({ app: app.id, tool: tool2, operations: [...new Set(calls.filter((c) => c.toolId === tool2).map((c) => c.label))], evidence })),
+      sharedEntities: [...new Set(calls.map((call) => singularize(call.resource)))],
+      evidence,
+      confidence: "medium",
+      risk: "high",
+      rank: 0,
+      supported: false,
+      hypothesis: true,
+      linkingSignals: [entry.trigger ? "explicit request or background-job trigger" : "exported operation with statically linked provider effects", "local helper call chains are possible paths, not proof of runtime execution; invocation and correctness require review"],
+      scopeUncertain: true,
+      verified: false
+    });
   }
   if (sourceFiles.length === MAX_FILES3) gaps.push("Source scan is limited to 2500 files; split large repositories into explicit roots. Not every workflow can be proven by static discovery.");
   const finalWorkflows = workflows.filter((w) => !rejected.has(w.id)).map(
@@ -7871,6 +8082,10 @@ function scenariosFor(kind) {
   return [...new Set(list2)];
 }
 function assertionsFor(candidate) {
+  if (candidate.entrypoint) return [
+    `define the expected response/output for ${candidate.entrypoint}`,
+    "review required final state and forbidden effects; discovery does not infer business correctness"
+  ];
   const entity = candidate.sharedEntities[0] ?? "record";
   return [
     `exactly one ${entity} write is applied (no duplicates)`,
@@ -7893,7 +8108,7 @@ function buildWorkflowPlans(candidates, _tools) {
       ),
       sharedEntities: candidate.sharedEntities,
       permissions: permissionsFor(kind, candidate.sharedEntities),
-      asyncEvents: eventsFor(kind, candidate.sharedEntities),
+      asyncEvents: candidate.entrypoint ? [] : eventsFor(kind, candidate.sharedEntities),
       failureScenarios: scenariosFor(kind),
       outcomeAssertions: assertionsFor(candidate),
       unknowns: [
@@ -9056,7 +9271,7 @@ async function runInit(opts) {
     if (opts.sync) {
       const synced = await runSync(opts.cwd);
       if (!opts.json) ok2(`Synced ${synced.workflows} candidates: ${synced.dashboard}`);
-    } else if (!opts.json) info(opts.controller ? "Account connection and reviewed sharing are available in the control menu. Nothing was uploaded." : "Connect this terminal: npx agenttwin login. Then send reviewed discovery: npx agenttwin sync.");
+    } else if (!opts.json) info(opts.controller ? "Discovery saved locally. Interactive init will now connect your account and sync this project." : "Connect this terminal: npx agenttwin login. Then send reviewed discovery: npx agenttwin sync.");
   }
   process.exitCode = result.exitCode;
   return wrote;
@@ -9066,21 +9281,6 @@ async function runInit(opts) {
 import { createInterface as createInterface3 } from "readline/promises";
 import { readFile as readFile23, writeFile as writeFile22 } from "fs/promises";
 import { join as join27, resolve as resolve14 } from "path";
-
-// src/runtime/local-workspace.ts
-async function detectLocalWorkspace(request = fetch) {
-  try {
-    const response = await request("http://localhost:8080/v1/dev/workspace", { redirect: "error", signal: AbortSignal.timeout(700) });
-    if (!response.ok) return null;
-    const data = await response.json();
-    if (data.schema !== "agenttwin/local-workspace-v1" || data.dashboard !== "http://localhost:3000/onboarding/") return null;
-    return { api: "http://localhost:8080", dashboard: data.dashboard };
-  } catch {
-    return null;
-  }
-}
-
-// src/commands/control.ts
 init_store();
 init_contracts();
 
@@ -9201,25 +9401,17 @@ async function runControl(opts) {
   };
   const connectAndShare = async () => {
     const connection = await savedConnection();
+    const destination = process.env.AGENTTWIN_API_URL || connection?.base || "https://api.agenttwin.si";
+    log(`Connecting this project to ${destination}. Sync sends detected service names, workflow metadata, Git metadata and test evidence; application source and credentials stay local.`);
     if (!process.env.AGENTTWIN_TOKEN && (!connection || process.env.AGENTTWIN_API_URL && connection.base !== process.env.AGENTTWIN_API_URL)) await runLogin(log);
-    log("Discovery is local until you share it. Sharing sends detected service names, workflow metadata, Git metadata and test evidence; application source and credentials stay local.");
-    if ((await ask("Share this repository with your workspace? [y/N]")).toLowerCase() === "y") {
-      const result = await runSync(opts.cwd);
-      log(`Project shared: ${opts.cwd}. Open your workspace and check for your project. ${result.dashboard}`);
-    } else log("Kept on this computer. This repository will not appear in your online workspace yet.");
+    const result = await runSync(opts.cwd);
+    log(`Project connected: ${result.tools} services and ${result.workflows} workflow candidates synced. ${result.dashboard}`);
   };
   try {
-    if (!process.env.AGENTTWIN_API_URL && !process.env.AGENTTWIN_TOKEN) {
-      const local = await detectLocalWorkspace();
-      if (local && (await ask(`Local AgentTwin workspace detected at ${local.dashboard}. Connect to it instead of production for this session? [y/N]`)).toLowerCase() === "y") process.env.AGENTTWIN_API_URL = local.api;
-    }
-    log("Repository discovered locally. To see it in onboarding, connect this terminal and share its reviewed discovery.");
-    if ((await ask("Connect and share this project now? [y/N]")).toLowerCase() === "y") {
-      try {
-        await connectAndShare();
-      } catch (error) {
-        log(`Connection stopped: ${error instanceof Error ? error.message : String(error)}. Retry with option 9.`);
-      }
+    try {
+      await connectAndShare();
+    } catch (error) {
+      log(`Connection stopped: ${error instanceof Error ? error.message : String(error)}. Local discovery is saved. Retry with option 9.`);
     }
     while (true) {
       log("\nAgentTwin \xB7 your repository control center");

package/dist/dashboard/assets/next/static/{xDiek0iCt0gykeKT7O5aO → 8DWbcYS099IMf1RzFG63k}/_buildManifest.js

@@ -1 +1 @@
-self.__BUILD_MANIFEST=function(e,r,t,_){return{__rewrites:{afterFiles:[],beforeFiles:[],fallback:[]},__routerFilterStatic:{numItems:16,errorRate:1e-4,numBits:307,numHashes:14,bitArray:[0,0,r,1,1,e,r,r,r,e,r,r,e,r,e,r,r,e,r,r,r,e,r,e,e,r,r,r,e,r,e,e,e,e,e,r,e,e,r,e,e,r,e,e,e,e,e,e,e,e,e,e,e,e,r,e,e,e,r,r,e,e,r,e,r,r,r,r,e,r,r,r,r,r,r,e,e,e,r,r,r,e,r,r,e,e,r,e,e,e,r,e,r,r,e,e,e,e,e,e,e,r,r,e,r,r,e,r,e,r,r,e,r,r,r,e,e,e,e,r,e,r,r,r,e,r,r,r,e,r,e,r,r,e,r,e,e,r,e,r,r,e,r,r,e,r,e,e,r,r,e,e,r,e,r,e,e,r,e,e,r,e,e,r,e,r,e,r,r,r,r,e,e,r,r,e,r,e,r,e,r,r,e,e,e,r,e,r,e,e,r,e,e,r,e,r,e,e,r,e,r,r,e,e,e,e,r,r,r,r,r,r,e,e,e,r,r,r,e,r,e,e,r,e,r,e,e,e,r,r,r,e,e,e,e,r,r,e,e,r,e,r,e,r,e,r,e,r,e,r,e,e,r,e,r,r,e,r,e,r,r,r,e,e,e,r,r,e,e,e,r,e,e,e,e,e,r,e,e,e,e,e,e,e,e,r,r,r,e,r,e,e,r,r,r,e,e,e,r,r,e,e,r,r,r,r,e]},__routerFilterDynamic:{numItems:e,errorRate:1e-4,numBits:20,numHashes:14,bitArray:[r,r,e,e,r,r,e,e,e,e,r,r,e,e,r,e,r,e,e,r]},"/_error":["static/chunks/pages/_error-cb2a52f75f2162e2.js"],sortedPages:["/_app","/_error"]}}(1,0,1e-4,14),self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();
+self.__BUILD_MANIFEST=function(e,r,t,_){return{__rewrites:{afterFiles:[],beforeFiles:[],fallback:[]},__routerFilterStatic:{numItems:16,errorRate:1e-4,numBits:307,numHashes:14,bitArray:[0,0,r,1,1,e,r,r,r,e,r,r,e,r,e,r,r,e,r,r,r,e,r,e,e,r,r,r,e,r,e,e,e,e,e,r,e,e,r,e,e,r,e,e,e,e,e,e,e,e,e,e,e,e,r,e,e,e,r,r,e,e,r,e,r,r,r,r,e,r,r,r,r,r,r,e,e,e,r,r,r,e,r,r,e,e,r,e,e,e,r,e,r,r,e,e,e,e,e,e,e,r,r,e,r,r,e,r,e,r,r,e,r,r,r,e,e,e,e,r,e,r,r,r,e,r,r,r,e,r,e,r,r,e,r,e,e,r,e,r,r,e,r,r,e,r,e,e,r,r,e,e,r,e,r,e,e,r,e,e,r,e,e,r,e,r,e,r,r,r,r,e,e,r,r,e,r,e,r,e,r,r,e,e,e,r,e,r,e,e,r,e,e,r,e,r,e,e,r,e,r,r,e,e,e,e,r,r,r,r,r,r,e,e,e,r,r,r,e,r,e,e,r,e,r,e,e,e,r,r,r,e,e,e,e,r,r,e,e,r,e,r,e,r,e,r,e,r,e,r,e,e,r,e,r,r,e,r,e,r,r,r,e,e,e,r,r,e,e,e,r,e,e,e,e,e,r,e,e,e,e,e,e,e,e,r,r,r,e,r,e,e,r,r,r,e,e,e,r,r,e,e,r,r,r,r,e]},__routerFilterDynamic:{numItems:e,errorRate:1e-4,numBits:20,numHashes:14,bitArray:[r,r,e,e,r,r,e,e,e,e,r,r,e,e,r,e,r,e,e,r]},"/_error":["static/chunks/pages/_error-94812ad32cad7365.js"],sortedPages:["/_app","/_error"]}}(1,0,1e-4,14),self.__BUILD_MANIFEST_CB&&self.__BUILD_MANIFEST_CB();