frizz 0.9.0 → 0.10.0

package/dist/frizz.js

@@ -12462,7 +12462,7 @@ var init_relay_protocol = __esm({
 function fallbackPort(base) {
   return base + 1e4;
 }
-var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_TEXT_EXTENSIONS, ATTACHMENT_OFFICE_EXTENSIONS, ATTACHMENT_DATA_EXTENSIONS, ATTACHMENT_ARCHIVE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, ThreadWatchView, PR_WATCH_DEFAULT_FOR_MS, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, OwnWatchKind, AddOwnWatchInput, OwnWatchView, AddOwnWatchResult, DropOwnWatchInput, DropOwnWatchResult, AskQuestionKind, ASK_MAX_PER_CALL, ASK_MAX_OPEN, AskedOptionSchema, AskedQuestionSchema, AskInput, RegisteredQuestionView, AskResult, UnaskInput, UnaskResult, QuestionAnswerSchema, AnswerQuestionsInput, AnswerQuestionsResult, DismissQuestionsInput, DismissQuestionsResult, MarkOwnDoneInput, MarkOwnDoneResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetOwnThreadTitleInput, SetOwnThreadTitleResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkillSource, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, HUMAN_GAP_FLOOR_MS, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, EditedFile, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketClientMsg, ProjectCard, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT;
+var import_yaml, ATTACHMENT_IMAGE_EXTENSIONS, ATTACHMENT_TEXT_EXTENSIONS, ATTACHMENT_OFFICE_EXTENSIONS, ATTACHMENT_DATA_EXTENSIONS, ATTACHMENT_ARCHIVE_EXTENSIONS, ATTACHMENT_DOC_EXTENSIONS, ATTACHMENT_EXTENSIONS, ATTACHMENT_MAX_BASE64_CHARS, ATTACHMENT_MAX_BYTES, ATTACHMENT_EXT_SET, ATTACHMENT_ACCEPT, FrizzStatus, BlockMechanism, RuntimeState, Backend, CodexModel, ThreadProfileOption, ThreadAgent, SubAgentView, BgShellView, CompletionHoldOp, CompletionHold, AskOption, AskQuestion, PendingAsk, AwaitingHint, RETIRED_AWAITING_KINDS, RETIRED_LINE_RE, AWAITING_FOR_MAX_MS, SnoozeUntil, SNOOZE_PROMPT_MAX, SnoozePrompt, RECURRING_PROMPT_MAX, RECURRING_MIN_INTERVAL_SECONDS, RECURRING_MAX_INTERVAL_SECONDS, RecurringPromptText, RecurringIntervalSeconds, ThreadRecurringPrompt, TIMER_PROMPT_MAX, TIMER_MAX_DELAY_SECONDS, TimerPromptText, SIGNOFF_NUDGE_MARKER, SIGNOFF_NUDGE_MESSAGE, ThreadWatchKind, GithubChecksState, GithubMergeState, GithubWatchStatus, ThreadWatchView, PR_WATCH_FOR_MAX_MS, PR_WATCH_DEFAULT_FOR_MS, PrWatchView, AddOwnPrWatchInput, AddOwnPrWatchResult, DropOwnPrWatchInput, DropOwnPrWatchResult, OwnWatchKind, AddOwnWatchInput, OwnWatchView, AddOwnWatchResult, DropOwnWatchInput, DropOwnWatchResult, AskQuestionKind, AskedOptionSchema, AskedQuestionSchema, AskInput, RegisteredQuestionView, AskResult, UnaskInput, UnaskResult, QuestionAnswerSchema, AnswerQuestionsInput, AnswerQuestionsResult, DismissQuestionsInput, DismissQuestionsResult, MarkOwnDoneInput, MarkOwnDoneResult, ListOwnPrWatchesInput, OwnPrWatchesResult, ThreadTimerView, ThreadFence, LimitWindow, LimitPause, ThreadView, BoardErrorItem, BoardSnapshot, QuotaWindow, ProviderQuota, QuotaSnapshot, ProviderAuth, AccountEmails, AuthSnapshot, AccountLogoutInput, AccountLogoutResult, AccountLoginStartInput, AccountLoginStartResult, AccountLoginStatusInput, AccountLoginStatusResult, PermissionMode, LocalFileOpener, Settings, DispatchProviderPreferences, DispatchPreferences, DispatchProfileSnapshot, SetDispatchPreferenceInput, DispatchInput, ADOPT_THREAD_MESSAGE_MAX_CHARS, AdoptThreadInput, AdoptThreadResult, AdoptSessionInput, FollowUpInput, UnqueueFollowUpInput, UnqueueFollowUpResult, DeliverQueuedNowInput, DeliverQueuedNowResult, SetThreadSnoozeInput, SetThreadPinnedInput, SetThreadRecurringPromptInput, SetOwnThreadRecurringPromptInput, SetOwnThreadRecurringPromptResult, GetOwnThreadRecurringPromptInput, OwnThreadRecurringPromptResult, SetOwnThreadTimerInput, CancelOwnThreadTimerInput, ListOwnThreadTimersInput, OwnThreadTimersResult, ThreadActivityItem, ListOwnThreadActivityInput, OwnThreadActivityResult, SetOwnThreadTimerResult, CancelOwnThreadTimerResult, SetOwnThreadStopHookInput, SetOwnThreadHeartbeatInput, ThreadPluginReloadResult, RenameThreadInput, AiRenameThreadInput, AiRenameThreadResult, SetOwnThreadTitleInput, SetOwnThreadTitleResult, SetThreadPermissionInput, SetThreadPermissionResult, ThreadProfileOptionsInput, ThreadProfileOptionsResult, ThreadSkillSource, ThreadSkill, ThreadSkillsInput, ThreadSkillsResult, SetThreadProfileInput, SetThreadProfileResult, DISPATCH_TASK_BANNER, DISPATCH_TASK_BANNER_MARKER, HUMAN_GAP_FLOOR_MS, GithubWakeItem, GithubWakeSteer, WAKE_SCOPE, WAKE_REF, WAKE_SINGLE, WAKE_MULTI_HEAD, PR_WATCH_FINISHED, PR_WATCH_CI_PASSED, PR_WATCH_CI_FAILED, GithubStatus, GithubRefCard, GithubRefPreviewInput, GithubRefPreviewResult, GithubItem, GithubListInput, GithubListResult, GithubBatchInput, GithubBatchResult, BoardMeta, ServerEvent, TranscriptEdit, TranscriptTodo, TranscriptToolCall, TranscriptPart, TranscriptMessage, TranscriptPageCursor, EditedFile, TranscriptPage, TranscriptEarlierInput, SocketTranscriptSlug, SocketFilePath, SocketTranscriptClientMsg, SocketFileClientMsg, SocketClientMsg, ProjectCard, PROJECT_ICON_MAX_BASE64_CHARS, DirectoryPickResult, ThreadLocation, FRIZZ_ROUTE_PREFIX, DEFAULT_PORT;
 var init_src = __esm({
   "packages/shared/src/index.ts"() {
     "use strict";
@@ -12742,8 +12742,13 @@ var init_src = __esm({
       subAgentCount: external_exports.number().default(0),
       // total live sub-agents (≥ subAgents.length)
       bgShells: external_exports.array(CompletionHoldOp).default([]),
-      bgShellCount: external_exports.number().default(0)
+      bgShellCount: external_exports.number().default(0),
       // total live background shells (≥ bgShells.length)
+      // The worker is DEAD and its recorded turn never ended — cut off by a reboot, a signal or a crash
+      // mid-tool-call (router.cutOffHold). Nothing is running, so nothing will be killed; the hold exists
+      // because the thread is not finished and Done would say it was. Optional rather than defaulted so it
+      // is absent (⇒ false) on every hold that is not this one, and a pre-change client reads them unchanged.
+      cutOff: external_exports.boolean().optional()
     });
     AskOption = external_exports.object({
       label: external_exports.string(),
@@ -12908,7 +12913,8 @@ var init_src = __esm({
        *  known, so a timer row always carries this. */
       timer: external_exports.object({ fireAt: external_exports.string(), prompt: external_exports.string() }).strict().optional()
     }).strict();
-    PR_WATCH_DEFAULT_FOR_MS = 6 * 60 * 60 * 1e3;
+    PR_WATCH_FOR_MAX_MS = 365 * 24 * 60 * 60 * 1e3;
+    PR_WATCH_DEFAULT_FOR_MS = 30 * 24 * 60 * 60 * 1e3;
     PrWatchView = external_exports.object({
       id: external_exports.string(),
       /** `owner/repo#N`, normalized — the same string the board's row and the status book are keyed by. */
@@ -12923,13 +12929,18 @@ var init_src = __esm({
       /** `owner/repo#123` or a PR URL. Parsed server-side; an unparseable ref is refused rather than stored,
        *  because a watcher that can never fire is worse than none — the worker rests believing it is covered. */
       target: external_exports.string().trim().min(1).max(200),
-      /** How long to watch, as a DURATION (`30m`, `2h`, `3d` — parseAwaitingDuration).
+      /** How long to watch, as a DURATION (`2h`, `3d`, `180d` — parseAwaitingDurationRaw, capped at
+       *  PR_WATCH_FOR_MAX_MS).
        *
        *  A PR nobody ever reviews would otherwise be polled forever, and a thread parked on it would wait
        *  forever with it — the same unbounded wait the awaiting fence's `for:` closes, one level down. A
        *  duration rather than an instant for the same reason it is one there: it cannot be written in the
        *  past (maintainer 2026-08-15, asking for it explicitly).
        *
+       *  BOUNDED IS NOT THE SAME AS SHORT, and conflating them is what made this field a noise source. The
+       *  bound exists so a forgotten watcher stops polling eventually, which a year satisfies exactly as
+       *  well as a day — and a day spent it against every external PR, which does not move on that clock.
+       *
        *  REQUIRED BY THE TOOL, OPTIONAL ON THE WIRE, and the asymmetry is deliberate. A worker's MCP server
        *  outlives every frizz restart, so a session dispatched before this existed still holds a binary that
        *  cannot send it — and making the RPC reject that would break `watch_pr` outright for every thread
@@ -12944,6 +12955,12 @@ var init_src = __esm({
       /** True when this exact PR was ALREADY watched by this thread, so the call registered nothing new.
        *  Re-registering after a compaction is the common case, and a duplicate would double every wake. */
       alreadyArmed: external_exports.boolean(),
+      /** When this watcher runs out. Read back so the worker sees the duration it ACTUALLY got rather than
+       *  the one it asked for — on a re-registration that is the original expiry, which the call left alone. */
+      expiresAt: external_exports.string(),
+      /** The `for:` the worker wrote, present ONLY when it exceeded the ceiling and was capped. A clamp
+       *  nobody is told about is a worker resting on a year of coverage it does not have. */
+      clampedFrom: external_exports.string().optional(),
       watches: external_exports.array(PrWatchView)
     }).strict();
     DropOwnPrWatchInput = external_exports.object({
@@ -12970,7 +12987,11 @@ var init_src = __esm({
        *  that is both the stronger check and the one that catches the real mistake: naming a sub-agent under
        *  `kind: "shell"`, which is what put two sub-agents under a "Background shells" heading on 2026-08-26. */
       target: external_exports.string().trim().min(1).max(200),
-      /** REQUIRED, and a DURATION (`30m`, `2h`, `3d` — parseAwaitingDuration, capped at 24h).
+      /** REQUIRED, and a DURATION (`30m`, `2h`, `3d` — parseAwaitingDurationRaw, capped at 24h).
+       *
+       *  STILL A DAY, where a PR watcher now gets a year: this names a shell or a sub-agent, which lives
+       *  inside the session that launched it, so a wait standing longer than a day is one whose target is
+       *  almost certainly already gone.
        *
        *  No default and no wire-level optionality, unlike `AddOwnPrWatchInput.for`: that field is optional
        *  only to keep working for sessions dispatched before it existed, and this RPC has no such sessions.
@@ -12995,6 +13016,10 @@ var init_src = __esm({
       /** True when this exact (kind, target) was already watched, so the call registered nothing new and the
        *  existing expiry stands. Re-registering after a wake or a compaction is the common, correct case. */
       alreadyArmed: external_exports.boolean(),
+      /** The `for:` the worker wrote, present ONLY when it exceeded the ceiling and was capped — the twin of
+       *  `AddOwnPrWatchResult.clampedFrom`, for the same reason: a silent clamp is a worker resting on
+       *  coverage it does not have. */
+      clampedFrom: external_exports.string().optional(),
       watches: external_exports.array(OwnWatchView)
     }).strict();
     DropOwnWatchInput = external_exports.object({
@@ -13006,25 +13031,38 @@ var init_src = __esm({
       watches: external_exports.array(OwnWatchView)
     }).strict();
     AskQuestionKind = external_exports.enum(["question", "multi"]);
-    ASK_MAX_PER_CALL = 4;
-    ASK_MAX_OPEN = 12;
     AskedOptionSchema = external_exports.lazy(() => external_exports.object({
-      label: external_exports.string().trim().min(1).max(120),
-      description: external_exports.string().trim().max(400).optional(),
+      // 400, not the 120 it launched with (2026-09-03): a label is a chip line, but "Post the drafted
+      // comment as written" plus its qualifier runs long, and the fence has no cap at all. The answer's
+      // `chosen` carries labels, so its per-item cap matches this one.
+      label: external_exports.string().trim().min(1).max(400),
+      // 20000, not the 4000 the retired `preview` had (2026-09-03): a description is allowed to BE the rich
+      // body — a diff, a drafted comment, a table — and a real diff exceeds 4000.
+      description: external_exports.string().trim().max(2e4).optional(),
       recommended: external_exports.boolean().optional(),
       preview: external_exports.string().max(4e3).optional(),
-      followUps: external_exports.array(AskedQuestionSchema).max(ASK_MAX_PER_CALL).optional()
+      // No count cap, like `options` (2026-09-03); the tree is bounded by ASK_MAX_DEPTH instead.
+      followUps: external_exports.array(AskedQuestionSchema).optional()
     }).strict());
     AskedQuestionSchema = external_exports.lazy(() => external_exports.object({
-      question: external_exports.string().trim().min(1).max(600),
+      // 4000, not the 600 it launched with (2026-09-03): this field is the whole card context — everything
+      // the human needs to answer cold — and a question that carries its own evidence needs the room. The
+      // answer restates it, so QuestionAnswerSchema's cap matches.
+      question: external_exports.string().trim().min(1).max(4e3),
       header: external_exports.string().trim().max(24).optional(),
       kind: AskQuestionKind,
       danger: external_exports.boolean().optional(),
-      options: external_exports.array(AskedOptionSchema).max(8).optional()
+      // UNBOUNDED, deliberately. This carried `.max(8)` from launch until 2026-09-03, when the maintainer
+      // asked for the cap to go ("allow arbitrary numbers of options"): a `multi` over a long list — which
+      // gates to run, which of twenty findings to act on — is a real shape, and the card letters past 26
+      // (`AA.`) already. The count is the worker's to choose; the answer's `chosen` is unbounded to match.
+      options: external_exports.array(AskedOptionSchema).optional()
     }).strict());
     AskInput = external_exports.object({
       slug: ThreadSlug,
-      questions: external_exports.array(AskedQuestionSchema).min(1).max(ASK_MAX_PER_CALL)
+      // No cap on the count (four until 2026-09-03): the tool's own text says "several at once is one
+      // call — register them together", and a cap here told a worker with six to batch and then refused it.
+      questions: external_exports.array(AskedQuestionSchema).min(1)
     }).strict();
     RegisteredQuestionView = external_exports.object({
       /** Minted by frizz. The worker never chose it, which is why an answer RESTATES the question text —
@@ -13048,17 +13086,19 @@ var init_src = __esm({
     }).strict();
     QuestionAnswerSchema = external_exports.lazy(() => external_exports.object({
       questionId: external_exports.string().min(1).max(64),
-      question: external_exports.string().min(1).max(600),
-      chosen: external_exports.array(external_exports.string().max(200)).max(8),
+      question: external_exports.string().min(1).max(4e3),
+      // No count cap: a `multi` may carry any number of options (see AskedQuestionSchema), and the human
+      // may pick every one of them. The per-item cap is the option label's.
+      chosen: external_exports.array(external_exports.string().max(400)),
       text: external_exports.string().max(8e3).optional(),
-      followUps: external_exports.array(QuestionAnswerSchema).max(ASK_MAX_PER_CALL).optional()
+      followUps: external_exports.array(QuestionAnswerSchema).optional()
     }).strict());
     AnswerQuestionsInput = external_exports.object({
       slug: ThreadSlug,
       /** SUBMITTED AS A UNIT. The card sends whatever was answered in one call, because a per-question send
        *  would half-wake a turn: the worker would come back to a payload it cannot act on and would have to
        *  ask again for the rest. */
-      answers: external_exports.array(QuestionAnswerSchema).min(1).max(ASK_MAX_OPEN)
+      answers: external_exports.array(QuestionAnswerSchema).min(1)
     }).strict();
     AnswerQuestionsResult = external_exports.object({
       /** The ids that were open and are now answered. An id that was already settled is silently absent
@@ -13068,7 +13108,7 @@ var init_src = __esm({
     }).strict();
     DismissQuestionsInput = external_exports.object({
       slug: ThreadSlug,
-      ids: external_exports.array(external_exports.string().min(1).max(64)).min(1).max(ASK_MAX_OPEN)
+      ids: external_exports.array(external_exports.string().min(1).max(64)).min(1)
     }).strict();
     DismissQuestionsResult = external_exports.object({
       dismissed: external_exports.array(external_exports.string()),
@@ -13248,6 +13288,11 @@ var init_src = __esm({
       // AUTO-bump (the scheduler resumes the agent with exactly this text) rather than a reminder, which is
       // the distinction the held row's tooltip renders. Absent ⇒ the card merely re-surfaces.
       snoozePrompt: external_exports.string().optional(),
+      // The instant the human PINNED this thread (absent = not pinned). A pinned thread leaves the rail's
+      // band system entirely — Rested/Active/Snoozed/Done — and holds the pinned band at the very top, in
+      // this instant's order. Lifecycle metadata like the snooze: written only by the pin/unpin verb, and
+      // it outranks every derived state (a pinned thread that finishes stays pinned).
+      pinnedAt: external_exports.string().optional(),
       /** The EVENT snooze on the resting card is armed for this exact rest — the human has said "hide this
        *  until something reports". Distinct from `snoozedUntil`, which is a wall-clock park on the whole
        *  thread: this one has no deadline and clears itself when the thread comes to a NEW rest.
@@ -13493,6 +13538,12 @@ var init_src = __esm({
       // Code caps to the model's real window. Optional so an old blob parses; defaultSettings pins 500_000
       // (maintainer 2026-08-26: "a default compaction window of 500k by default").
       autoCompactWindow: external_exports.number().int().positive().optional(),
+      // The prompt-cache tier a NEW Claude worker writes to. "auto" leaves the CLI's own choice (1h on a
+      // subscription); "5m" and "1h" reach the worker as CLAUDE_CODE_PROMPT_CACHE_TTL (and the sub-agent
+      // twin). The 1h tier bills a cache write at 2x input against 1.25x for 5m; on 2026-09-03 cache
+      // writes were 51% of a day's spend while the entries were invalidated every 15–30 minutes anyway
+      // (see claudePromptCacheEnv). Optional so an old blob parses; defaultSettings pins "auto".
+      promptCacheTtl: external_exports.enum(["auto", "5m", "1h"]).optional(),
       // The GitHub batch-dispatch prompt template (the picker's per-item worker prompt). Optional: when
       // unset OR blank the server falls back to its exported DEFAULT_GITHUB_PROMPT. Substitution tokens
       // the server fills: {repo} {n} {title} {url} {labels} {body}. The leading `THREAD: <slug>` tag is
@@ -13631,6 +13682,11 @@ var init_src = __esm({
       // can never leave an armed prompt behind.
       prompt: SnoozePrompt.nullable().optional()
     }).strict();
+    SetThreadPinnedInput = external_exports.object({
+      slug: ThreadSlug,
+      sessionId: external_exports.string().min(1),
+      pinned: external_exports.boolean()
+    }).strict();
     SetThreadRecurringPromptInput = external_exports.object({
       slug: ThreadSlug,
       sessionId: external_exports.string().min(1),
@@ -14311,10 +14367,16 @@ ${DISPATCH_TASK_BANNER}
       cursor: TranscriptPageCursor
     }).strict();
     SocketTranscriptSlug = ThreadSlug;
-    SocketClientMsg = external_exports.discriminatedUnion("t", [
+    SocketFilePath = external_exports.string().min(1).max(4096);
+    SocketTranscriptClientMsg = external_exports.discriminatedUnion("t", [
       external_exports.object({ t: external_exports.literal("sub"), topic: external_exports.literal("transcript"), slug: SocketTranscriptSlug }).strict(),
       external_exports.object({ t: external_exports.literal("unsub"), topic: external_exports.literal("transcript"), slug: SocketTranscriptSlug }).strict()
     ]);
+    SocketFileClientMsg = external_exports.discriminatedUnion("t", [
+      external_exports.object({ t: external_exports.literal("sub"), topic: external_exports.literal("file"), path: SocketFilePath }).strict(),
+      external_exports.object({ t: external_exports.literal("unsub"), topic: external_exports.literal("file"), path: SocketFilePath }).strict()
+    ]);
+    SocketClientMsg = external_exports.union([SocketTranscriptClientMsg, SocketFileClientMsg]);
     ProjectCard = external_exports.object({
       id: external_exports.string(),
       slug: external_exports.string(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "frizz",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "private": false,
   "description": "A local web UI for running many coding agents at once",
   "keywords": [

package/runtime/cc-worker/DECISIONS.md

@@ -1147,3 +1147,14 @@ Two corrections from one maintainer thread, both about Frizz telling the worker
 
 - **`recurring_prompt` is renamed `goal`.** The board panel, the footer mark and the delivered trailer have all said "Goal" since 2026-08-11; only the MCP tool still carried the mechanism's name. Maintainer: *"I don't think the tool is even called Recurring Prompt anymore, is it?"* — then *"Rename it."* Only the TOOL name and the worker-facing wording changed: the RPC procedures (`setOwnThreadRecurringPrompt`, `getOwnThreadRecurringPrompt`) and the `session.recurring_*` columns keep their names, because renaming the procedure is exactly what stranded every in-flight worker the last time (see the legacy aliases in `@frizz/shared`). No alias tool is listed for the old name — Claude Code rejects a tool name it has not listed, so an alias would have to be a visible second tool forever — and the new tool's description names its former name once, for a resumed worker whose summary still says `recurring_prompt`.
 - **Every surface that mentions the scratch directory stopped prescribing the notes-plus-arming arrangement.** The 2026-08-06 entry above set the rule "every surface that mentions the directory also mentions `post_compaction: true`", and it produced the effect the maintainer noticed: workers armed the post-compaction goal constantly, 49 of the 65 armed prompts in the live db copying the contract's template sentence verbatim. Maintainer: *"this is a very opinionated thing, and I don't think we should be pushing it as the thing to do. We should just be saying that the scratch directory is available to it if it wants it. We can also be saying that it can set these goal hooks."* The contract's scratch sections, the dispatch preamble, `scratchpadOrientation`, the five `scratchpad.mjs` hook texts and the tool's own `post_compaction` wording now say the directory and the goal hooks EXIST and leave the choice to the worker. The literal `post_compaction: true` stays on each surface so the capability is still discoverable; the nudge hook keeps its ~60k-token cadence with the informational wording.
+
+## 2026-09-03: a worker mounts ONLY what its project declares — `--strict-mcp-config`, with the project's `.mcp.json` carried inline
+
+Maintainer, the evening of two memory crashes (a jetsam spiral into a watchdog panic at 19:50, a forced power-off at 20:52): *"Very weird that Frizz eagerly spawns Chrome DevTools."* It was not Frizz. It was the CLI's own discovery doing exactly what the 2026-08-26 entry above asked of it — in every worker at once.
+
+Measured on the maintainer's machine 2026-09-02, nine live workers: the user-scope `chrome-real` (`claude mcp add --scope user`, an npx chrome-devtools-mcp) and each project's `chrome-devtools` (`.mcp.json`) both booted in EVERY worker — 18 browser servers, 36 processes, 4.2 GB, and 61 thirty-second MCP connection timeouts inside the crash window. The 2026-08-26 line *"Frizz's `--mcp-config` ADDS to whatever the CLI discovered rather than replacing it (frizz never passes `--strict-mcp-config`)"* was written so a project and an operator could each bring a browser. It also meant a fleet multiplied the operator's personal servers by N.
+
+- **Every worker now launches under `--strict-mcp-config`** (`strictMcpConfig: true` on the SDK path, the flag on the argv path) and is handed its whole MCP surface inline, lowest precedence first: the operator's REMOTE user-scope servers (`type: http`/`sse` in `~/.claude.json` — a URL costs no process), the project's `.mcp.json` filtered by the same approval the CLI applies (`enableAllProjectMcpServers` / `enabledMcpjsonServers` / `disabledMcpjsonServers`, every layer unioned), then the `frizz` server, which wins a name collision. `packages/server/src/backend/project-mcp-servers.ts` is the rule and the reasons; the daemon reads it at every fork, so a `.mcp.json` edit reaches the next dispatch as it reaches the next plain `claude`.
+- **User-scope STDIO servers are the one thing a worker no longer inherits.** `claude mcp add --scope user` still reaches the operator's own sessions. A project that wants one in its fleet declares it in its `.mcp.json` — the scope that means "this repo's sessions".
+- **Nothing about settings changed.** `settingSources` stays `user,project,local` (the 2026-08-16 entry): auth, permissions, hooks, plugins and `CLAUDE.md` all still reach a worker. Only MCP discovery is replaced, and only with what discovery would have produced minus the operator's local processes.
+- **What this does not fix.** Twelve threads restarted at once are still ~9 processes and ~1 GB each before any of them runs a build; the crash was the aggregate, and this removes its largest avoidable term. A dispatch-time back-pressure check is the follow-up.

package/runtime/cc-worker/bin/frizz-mcp.mjs

@@ -271,7 +271,13 @@ const WATCH_PR = {
     "wait at all. This tool is the wait.\n\n" +
     "THE ```awaiting FENCE IS STILL WORTH WRITING, and it is a different job: it is how you come to REST " +
     "without frizz asking you for a handoff, and how the human sees what you are waiting for. Register " +
-    "the watcher with this tool, then name the same PR in your fence's `prs:` list.\n\n" +
+    "the watcher with this tool, then name the same PR in your fence's `prs:` list — and give the fence " +
+    "the same long `for:` you gave the watcher, or the fence expires first and bumps you anyway.\n\n" +
+    "GIVE AN EXTERNAL PR A LONG `for` — MONTHS, up to a year. A pull request into a repo nobody here " +
+    "controls moves on its maintainers' clock, not yours, and a short watcher on one expires against a " +
+    "PR that has not changed: a wake with nothing in it, and a re-arm. Long costs nothing — real " +
+    "activity still wakes you the instant it lands, and the human snoozes or archives the thread if " +
+    "they want it off the board.\n\n" +
     "REGISTERING IS IDEMPOTENT per pull request: asking twice returns the SAME id and tells you it was " +
     "already armed, so re-registering after a compaction is safe and is the right instinct. Use `list` " +
     "when you want to know what you are holding without changing anything — it answers with each PR's " +
@@ -299,10 +305,18 @@ const WATCH_PR = {
       for: {
         type: "string",
         description:
-          "REQUIRED for `add`. How long to watch, as a DURATION — `30m`, `2h`, `3d` (max 24h). Never an " +
-          "instant, and there is no default. A PR nobody ever reviews would otherwise be polled forever " +
-          "and hold your thread with it; the watcher settles itself when this runs out and tells you, " +
-          "and you re-register if you still care.",
+          "REQUIRED for `add`. How long to watch, as a DURATION — `2h`, `3d`, `180d` (max 365d). Never " +
+          "an instant, and there is no default. The watcher settles itself when this runs out and tells " +
+          "you, and you re-register if you still care.\n\n" +
+          "MATCH IT TO WHOSE PR IT IS, and the two cases are far apart. Your own PR, waiting on CI or on " +
+          "a review you expect today: hours. A PULL REQUEST IN A REPO NOBODY HERE CONTROLS — an upstream " +
+          "project, someone else's maintainers — takes as long as it takes, so give it MONTHS (`90d`, " +
+          "`180d`, `365d`). A short `for` on one of those does not make it get reviewed sooner; it just " +
+          "expires against a PR nothing has touched, wakes you for nothing, and costs a re-arm. That is " +
+          "not hypothetical — a watcher on an external PR re-armed at the old 24h ceiling four days " +
+          "running, with zero maintainer activity in between. Long is FREE here: real activity wakes you " +
+          "the moment it happens either way, and the human can snooze or archive the thread whenever " +
+          "they want it gone.",
       },
       id: {
         type: "string",
@@ -368,7 +382,9 @@ const WATCH = {
           "REQUIRED. How long to hold the wait, as a DURATION — `30m`, `2h`, `3d` (max 24h). Never an " +
           "instant, and there is no default: choose it for THIS wait. When it elapses the row is " +
           "cancelled and you are woken to re-decide, so an over-long guess costs a wait that outlives " +
-          "its reason and a too-short one costs one extra turn.",
+          "its reason and a too-short one costs one extra turn. The ceiling is a DAY here, unlike " +
+          "`watch_pr`'s year: a shell or a sub-agent dies with this session, so a wait on one that has " +
+          "stood for a day is a wait on something already gone.",
       },
     },
     required: ["kind", "target", "for"],
@@ -414,8 +430,12 @@ function questionSchema(depth) {
       description: {
         type: "string",
         description:
-          "ONE LINE of trade-off. What this option costs, or why it is the one to take. An option list " +
-          "with no trade-offs asks the human to reconstruct your reasoning before they can choose.",
+          "The trade-off, or the evidence — and it renders INSIDE the option, always visible, so this " +
+          "is where the human learns what they are choosing BEFORE they pick anything. One line for a " +
+          "simple fork. FULL MARKDOWN, over several lines, for one that deserves it: a list of " +
+          "consequences, a code block, the diff the option would produce, the exact message that would " +
+          "be posted. An option list with no trade-offs asks the human to reconstruct your reasoning " +
+          "before they can choose.",
       },
       recommended: {
         type: "boolean",
@@ -425,18 +445,16 @@ function questionSchema(depth) {
           "YOU ARE ASKING: you already know the answer, so implement it and say which way you went. " +
           "This is for the fork you genuinely cannot take yourself.",
       },
-      preview: {
-        type: "string",
-        description:
-          "Markdown revealed under this option when the human picks it — the diff it produces, the " +
-          "message that would be posted, the mockup. Use it when SEEING the outcome is what decides the " +
-          "question; skip it when the one-line trade-off already says everything.",
-      },
+      // `preview` (markdown revealed under the option once picked) is RETIRED from this schema
+      // (2026-09-01): detail that decides a choice must be visible before the choice, so it belongs in
+      // a rich `description` now. The server still ACCEPTS the field — an in-flight worker dispatched
+      // against the old schema keeps working, and the card folds it into the same always-visible body.
       ...(depth < ASK_MAX_DEPTH
         ? {
+            // No `maxItems` here either (four until 2026-09-03): the tree is bounded by its DEPTH, not
+            // by how many branches hang off one option.
             followUps: {
               type: "array",
-              maxItems: 4,
               description:
                 "Questions that become live ONLY if the human picks this option — the conditional " +
                 "branch. A branch nobody takes is never asked and never answered, so this is how you " +
@@ -479,10 +497,13 @@ function questionSchema(depth) {
           "x cannot dismiss it, because a generic close icon is not consent for something irreversible. " +
           "Declining must therefore be one of your own options.",
       },
+      // No `maxItems`: the count is the worker's to choose (maintainer 2026-09-03 — "allow arbitrary
+      // numbers of options"). A `multi` over a long list is a real shape, and the card letters past 26.
       options: {
         type: "array",
-        maxItems: 8,
-        description: "Two to four is almost always right. Omit entirely for a free-text question.",
+        description:
+          "As many as the choice actually has — a fork of two, or a `multi` over twenty findings. " +
+          "Omit entirely for a free-text question.",
         items: option,
       },
     },
@@ -530,10 +551,11 @@ const ASK = {
   inputSchema: {
     type: "object",
     properties: {
+      // No `maxItems` (four until 2026-09-03): "several at once is one call" above, and a cap here told
+      // a worker with six to batch them and then refused the batch.
       questions: {
         type: "array",
         minItems: 1,
-        maxItems: 4,
         description: "The questions to register, together. Each becomes its own card and its own row.",
         items: questionSchema(1),
       },
@@ -1299,8 +1321,13 @@ async function watch(args) {
     ? `Already watching \`${target}\` as ${id} — nothing new was registered, and its original expiry stands.`
     : `Watching \`${target}\` as ${id}. Your thread is held out of the queue until it finishes, and the ` +
       "registration survives your turn ending, a compaction and a frizz restart."
+  // A clamp is news here for the same reason it is on `watch_pr` — see that handler.
+  const clamped = result?.clampedFrom
+    ? `\n\nYOUR \`for: ${result.clampedFrom}\` WAS CAPPED at the 24h ceiling for a shell or a sub-agent — ` +
+      "the expiry listed below is what you actually hold."
+    : ""
   return (
-    `${head}\n\nWHEN \`for\` RUNS OUT the row is CANCELLED and you are woken to re-decide — register ` +
+    `${head}${clamped}\n\nWHEN \`for\` RUNS OUT the row is CANCELLED and you are woken to re-decide — register ` +
     `again if you still mean it.\n\nDROP IT the moment it stops mattering (\`unwatch\`, id \`${id}\`); ` +
     `you do NOT need to when the work simply finishes.\n\n${armedWatchList(result)}`
   )
@@ -1436,12 +1463,19 @@ async function watchPr(args) {
   const result = (await callRpc("addOwnPrWatch", { slug, target, for: typeof args.for === "string" ? args.for.trim() : "" }))?.result
   const id = result?.id ?? "(unknown)"
   const ref = result?.target ?? target
+  const until = result?.expiresAt ? ` until ${result.expiresAt}` : ""
   const head = result?.alreadyArmed
-    ? `Already watching ${ref} as ${id} — nothing new was registered, and you will be woken once per event.`
-    : `Watching ${ref} as ${id}. Frizz wakes you when CI passes or fails and on every later review or ` +
-      "comment, and the registration survives your turn ending, a compaction and a frizz restart."
+    ? `Already watching ${ref} as ${id}${until} — nothing new was registered, its original expiry stands, and you will be woken once per event.`
+    : `Watching ${ref} as ${id}${until}. Frizz wakes you when CI passes or fails and on every later ` +
+      "review or comment, and the registration survives your turn ending, a compaction and a frizz restart."
+  // A CLAMP IS NEWS. Silently handing back less coverage than was asked for is how a worker comes to
+  // rest believing it is watched for a year when it is watched for one day.
+  const clamped = result?.clampedFrom
+    ? `\n\nYOUR \`for: ${result.clampedFrom}\` WAS CAPPED at the ceiling — the expiry above is what you ` +
+      "actually hold. Nothing else about the watcher changed."
+    : ""
   return (
-    `${head}\n\nNAME IT IN YOUR \`\`\`awaiting FENCE TOO (\`prs: [${ref}]\`) — the watcher does the ` +
+    `${head}${clamped}\n\nNAME IT IN YOUR \`\`\`awaiting FENCE TOO (\`prs: [${ref}]\`) — the watcher does the ` +
     `waking, the fence is what lets you come to rest and shows the human what you are waiting for.\n\n` +
     `DROP IT when it stops mattering (\`action: "drop", id: "${id}"\`).\n\n${armedPrWatchList(result)}`
   )