imprint-mcp 0.6.4 → 0.6.6

package/src/imprint/backend-ladder.ts

@@ -340,6 +340,8 @@ export async function runWithLadder(
     initialState?: Record<string, unknown>;
     /** Optional credential override used by auth verification. */
     credentials?: CredentialStore;
+    /** Caller cancellation for bounded verification work. */
+    signal?: AbortSignal;
   },
 ): Promise<LadderResult> {
   if (ladder.length === 0) {
@@ -437,6 +439,7 @@ export async function runWithLadder(
             options?.cdpPool,
             options?.initialState,
             options?.credentials,
+            options?.signal,
           );
           break;
         case 'stealth-fetch': {
@@ -1036,6 +1039,7 @@ async function runCdpReplay(
   cdpPool?: Map<string, CdpBrowserFetch>,
   callerState?: Record<string, unknown>,
   credentialOverride?: CredentialStore,
+  signal?: AbortSignal,
 ): Promise<ToolResult> {
   let baseUrl: string;
   try {
@@ -1105,6 +1109,9 @@ async function runCdpReplay(
       // declares it — never a blanket default. See AuthConfig.crossOriginCookieReinjection.
       reinjectCrossOriginCookies: tool.workflow.authConfig?.crossOriginCookieReinjection ?? false,
     });
+    // Register immediately so caller cancellation can close a browser that is
+    // still launching or minting its first jar.
+    if (cdpPool) cdpPool.set(poolKey, cf);
   }
 
   try {
@@ -1148,6 +1155,7 @@ async function runCdpReplay(
               snapshotCookies: cf.snapshotCookies.bind(cf),
             }
           : undefined,
+      signal,
     });
 
     if (result.ok) {
@@ -1597,6 +1605,8 @@ export async function runWorkflowWithLadder(opts: {
   /** Pin execution to a single rung, bypassing the parallel probe AND the winner
    *  memo. AuthVerifier pins `cdp-replay` so all actions share one browser. */
   forceBackend?: ConcreteBackend;
+  /** Caller cancellation for bounded verification work. */
+  signal?: AbortSignal;
 }): Promise<LadderResult> {
   if (!existsSync(opts.workflowPath)) {
     throw new Error(`runWorkflowWithLadder: workflow.json not found at ${opts.workflowPath}`);
@@ -1674,6 +1684,7 @@ export async function runWorkflowWithLadder(opts: {
         cdpPool,
         initialState: opts.initialState,
         credentials: opts.credentials,
+        signal: opts.signal,
       });
     }
 
@@ -1731,6 +1742,7 @@ export async function runWorkflowWithLadder(opts: {
             cdpPool,
             initialState: opts.initialState,
             credentials: opts.credentials,
+            signal: opts.signal,
           });
           const r = await settleProbeWithDeadline(inner, PROBE_TIMEOUT_MS, {
             result: { ok: false, error: 'NETWORK', message: 'probe deadline exceeded' },
@@ -1781,6 +1793,7 @@ export async function runWorkflowWithLadder(opts: {
         cdpPool,
         initialState: opts.initialState,
         credentials: opts.credentials,
+        signal: opts.signal,
       });
       if (probeReachable(seqResult.result)) {
         compileWinningBackend.set(memoKey, seqResult.usedBackend);
@@ -1804,6 +1817,7 @@ export async function runWorkflowWithLadder(opts: {
       cdpPool,
       initialState: opts.initialState,
       credentials: opts.credentials,
+      signal: opts.signal,
     });
     if (isProbeReachable(result.result)) {
       compileWinningBackend.set(memoKey, result.usedBackend);
@@ -1849,6 +1863,7 @@ export function resolveWorkflowTool(
             browser?: BrowserNavigationTransport;
             initialState?: Record<string, unknown>;
             credentials?: CredentialStore;
+            signal?: AbortSignal;
           }
         | undefined;
       return executeWorkflow({
@@ -1859,6 +1874,7 @@ export function resolveWorkflowTool(
         fetchImpl: o?.fetchImpl,
         browser: o?.browser,
         initialState: o?.initialState,
+        signal: o?.signal,
       });
     },
   };
@@ -1896,6 +1912,8 @@ export async function renderWorkflowRequests(opts: {
   params: Record<string, string | number | boolean>;
   workflowPath?: string;
   credentials?: CredentialStore;
+  /** Synthetic captured state for offline request tests. */
+  initialState?: Record<string, unknown>;
   recordedResponseFor?: (
     method: string,
     url: string,
@@ -1930,7 +1948,9 @@ export async function renderWorkflowRequests(opts: {
     params: opts.params,
     credentials: opts.credentials,
     workflowPath: opts.workflowPath,
+    initialState: opts.initialState,
     fetchImpl,
+    persistAuthState: false,
   });
   return { requests: captured, result };
 }

package/src/imprint/build-plan.ts

@@ -183,6 +183,8 @@ type DynamicValueFinding = z.infer<typeof DynamicValueFindingSchema>;
 
 const PerToolPlanSchema = z.object({
   toolName: z.string().regex(/^[a-z][a-z0-9_]*$/),
+  /** Callable prerequisite tools chosen by candidate detection. */
+  dependsOnTools: z.array(z.string().regex(/^[a-z][a-z0-9_]*$/)).default([]),
   usesSharedModules: z.array(z.string()).default([]),
   loadBearingSeqs: z.array(z.number().int().nonnegative()).default([]),
   parserGuidance: z.string().default(''),
@@ -692,6 +694,8 @@ export function topoLevelsForTools<T extends { toolName: string }>(
     (t) => {
       if (!plan) return [];
       const deps = new Set<string>();
+      const toolPlan = plan.perTool.find((candidate) => candidate.toolName === t.toolName);
+      for (const dependency of toolPlan?.dependsOnTools ?? []) deps.add(dependency);
       for (const tp of resolveTokenParams(plan, t.toolName)) deps.add(tp.sourceTool);
       // General contract edges: a producer_tool input depends on its producer; any
       // auth input depends on the authenticate tool (filtered out by kahnLevels
@@ -862,6 +866,20 @@ export function validateBuildPlan(
   const plan = BuildPlanSchema.parse(normalizeRawPlan(input));
   if (selected && selected.length > 0) {
     const names = new Set(selected.map((t) => (typeof t === 'string' ? t : t.toolName)));
+    const dependenciesByName = new Map(
+      selected.flatMap((candidate) =>
+        typeof candidate === 'string'
+          ? []
+          : [
+              [
+                candidate.toolName,
+                candidate.dependsOnTools.filter(
+                  (dependency) => names.has(dependency) && dependency !== candidate.toolName,
+                ),
+              ] as const,
+            ],
+      ),
+    );
     plan.perTool = plan.perTool.filter((t) => names.has(t.toolName));
     for (const name of names) {
       if (!plan.perTool.some((t) => t.toolName === name)) {
@@ -873,6 +891,9 @@ export function validateBuildPlan(
     if (plan.perTool.length === 0) {
       throw new Error('Build plan has no perTool entries for the selected tools.');
     }
+    for (const tool of plan.perTool) {
+      tool.dependsOnTools = dependenciesByName.get(tool.toolName) ?? [];
+    }
   }
   // Deterministic requiredInputs ordering for stable sidecar JSON.
   for (const t of plan.perTool) {

package/src/imprint/claude-cli-compile.ts

@@ -51,6 +51,7 @@ import {
   traceLlmIoEnabled,
   traced,
 } from './tracing.ts';
+import type { SharedTriageSelection } from './triage-selection.ts';
 import type { Session } from './types.ts';
 
 const log = createLog('compile-claude-cli');
@@ -127,7 +128,7 @@ interface CompileViaClaudeCliOptions {
   onProgress?: (p: CompileAgentProgress) => void;
   /** Called when wall-clock deadline is reached; return ms to extend or null to time out. */
   onDeadlineReached?: OnDeadlineReached;
-  /** Retain parser.test.ts after successful verification. Mirrors the
+  /** Retain agent-generated tests after successful verification. Mirrors the
    *  in-process loop's `keepTest`. */
   keepTest?: boolean;
   candidate?: ToolCandidate;
@@ -140,6 +141,8 @@ interface CompileViaClaudeCliOptions {
   toolPlan?: string;
   /** Revise existing generated artifacts from durable verification feedback. */
   revisionMode?: boolean;
+  /** Shared triage result for irreversible-effect propagation in the MCP server. */
+  sharedTriageSelection?: SharedTriageSelection;
   /** Present → drive an auth compile rather than a data compile. */
   authMode?: AuthCliCompileMode;
   /** Auth segments only: resume a prior segment's claude session with a new user
@@ -377,6 +380,9 @@ async function runClaudeCliAttempt(opts: CompileViaClaudeCliOptions): Promise<Co
       ...(opts.buildPlanPath ? ['--build-plan-path', opts.buildPlanPath] : []),
       ...(opts.sharedModules ? ['--shared-modules-json', JSON.stringify(opts.sharedModules)] : []),
       ...(opts.revisionMode ? ['--revision-mode'] : []),
+      ...(opts.sharedTriageSelection
+        ? ['--shared-triage-json', JSON.stringify(opts.sharedTriageSelection)]
+        : []),
     ];
     allowedToolNames = [
       'read_session_summary',

package/src/imprint/codex-cli-compile.ts

@@ -34,6 +34,7 @@ import {
   traceToolIoEnabled,
   traced,
 } from './tracing.ts';
+import type { SharedTriageSelection } from './triage-selection.ts';
 import type { Session } from './types.ts';
 
 const log = createLog('compile-codex-cli');
@@ -143,6 +144,8 @@ interface CompileViaCodexCliOptions {
   toolPlan?: string;
   /** Revise existing generated artifacts from durable verification feedback. */
   revisionMode?: boolean;
+  /** Shared triage result for irreversible-effect propagation in the MCP server. */
+  sharedTriageSelection?: SharedTriageSelection;
   /** Present → drive an auth compile rather than a data compile. */
   authMode?: AuthCliCompileMode;
   /** Auth segments only: resume the same non-interactive Codex session. */
@@ -302,6 +305,9 @@ async function compileViaCodexCliImpl(
       ...(opts.buildPlanPath ? ['--build-plan-path', opts.buildPlanPath] : []),
       ...(opts.sharedModules ? ['--shared-modules-json', JSON.stringify(opts.sharedModules)] : []),
       ...(opts.revisionMode ? ['--revision-mode'] : []),
+      ...(opts.sharedTriageSelection
+        ? ['--shared-triage-json', JSON.stringify(opts.sharedTriageSelection)]
+        : []),
     ];
     const { assignedSharedModules } = resolvePlanSliceFromFile(
       opts.buildPlanPath,

package/src/imprint/compile-agent.ts

@@ -28,12 +28,14 @@ import {
 } from './compile-agent-types.ts';
 import { formatCandidateContext, formatToolPlan } from './compile-agent-types.ts';
 import {
+  applyIrreversibleVerificationWaiver,
   applyLiveVerification,
   applyParamVerification,
   buildCompileTools,
   externalVerification,
 } from './compile-tools.ts';
 import { type Replacement, extractCredentials } from './credential-extract.ts';
+import { workflowHasIrreversibleEffect } from './effects.ts';
 import {
   isInfrastructureOnlyInconclusiveReport,
   mergeSemanticParamVerification,
@@ -61,7 +63,12 @@ import { rebindExistingBackendsCacheToWorkflow } from './probe-backends.ts';
 import { detectPageMintedHeaders, redactSession } from './redact.ts';
 import type { ClassifiedValue } from './session-diff.ts';
 import type { SharedCompileContext, ToolCandidate } from './tool-candidates.ts';
-import { type Session, SessionSchema } from './types.ts';
+import {
+  type SharedTriageSelection,
+  applySharedTriageSelection,
+  minimalSharedTriageSelection,
+} from './triage-selection.ts';
+import { type Session, SessionSchema, WorkflowSchema } from './types.ts';
 
 export type { CompileAgentProgress } from './compile-agent-types.ts';
 
@@ -126,8 +133,8 @@ interface CompileAgentOptions {
   llmProvider?: ToolUseProvider;
   /** Progress callback with verification cycle information. */
   onProgress?: (p: CompileAgentProgress) => void;
-  /** Retain parser.test.ts after successful verification. By default it's
-   *  deleted (the test reads the gitignored redacted session at
+  /** Retain generated tests after successful verification. By default they are
+   *  deleted (parser tests read the gitignored redacted session at
    *  $IMPRINT_SESSION_PATH, so it's not reproducible elsewhere — keeping it
    *  on disk just confuses `bun test`). Pass true with `--keep-test` to
    *  inspect the agent's test output locally. */
@@ -161,6 +168,8 @@ interface CompileAgentOptions {
   /** Revise an existing generated artifact, using durable verification feedback
    *  as the starting point instead of rebuilding it from raw capture. */
   revisionMode?: boolean;
+  /** Shared triage decision propagated into all compile transports. */
+  preTriagedSession?: SharedTriageSelection;
 }
 
 function formatRevisionMode(enabled: boolean | undefined): string {
@@ -220,6 +229,12 @@ export async function compileAgent(opts: CompileAgentOptions): Promise<CompileAg
       );
     }
   }
+  if (opts.preTriagedSession) {
+    session = applySharedTriageSelection(session, opts.preTriagedSession, {
+      candidate: opts.candidate,
+      sharedContext: opts.sharedContext,
+    });
+  }
 
   // 3. Determine the generated tool directory.
   const absoluteToolDir = opts.outDir ?? localSiteDir(session.site);
@@ -321,6 +336,9 @@ Begin by calling read_session_summary to orient yourself, then proceed per the s
         toolPlan: opts.toolPlan,
         revisionMode: opts.revisionMode,
         model: opts.llmConfig?.model,
+        sharedTriageSelection: opts.preTriagedSession
+          ? minimalSharedTriageSelection(opts.preTriagedSession)
+          : undefined,
       });
     }
     if (resolvedProvider.name === 'codex-cli') {
@@ -340,6 +358,9 @@ Begin by calling read_session_summary to orient yourself, then proceed per the s
         toolPlan: opts.toolPlan,
         revisionMode: opts.revisionMode,
         model: opts.llmConfig?.model,
+        sharedTriageSelection: opts.preTriagedSession
+          ? minimalSharedTriageSelection(opts.preTriagedSession)
+          : undefined,
       });
     }
     if (!isToolUseProvider(resolvedProvider)) {
@@ -426,10 +447,11 @@ Begin by calling read_session_summary to orient yourself, then proceed per the s
         expectedToolName: opts.candidate?.toolName,
         likelyParams: opts.candidate?.likelyParams,
         candidateRequestSeqs: opts.candidate?.requestSeqs,
-        // Widen Fix B's variation pool to the dependency requests (e.g. a
-        // bootstrap GET) so a session token that varies only across dependency
-        // seqs and is then frozen as a literal in the tool's request is caught.
-        dependencyRequestSeqs: opts.candidate?.dependencySeqs,
+        // Widen checks to requests this tool depends on (bootstrap/login/etc.).
+        dependencyRequestSeqs: [
+          ...(opts.candidate?.dependencySeqs ?? []),
+          ...(opts.sharedContext?.loginRequestSeqs ?? []),
+        ],
         assignedSharedModules,
         tokenParams,
         tokenParamShapes,
@@ -445,6 +467,25 @@ Begin by calling read_session_summary to orient yourself, then proceed per the s
       log(`verification warnings (non-blocking):\n${warnings.join('\n')}`);
     }
 
+    let workflow: ReturnType<typeof WorkflowSchema.parse> | undefined;
+    if (failures.length === 0) {
+      workflow = WorkflowSchema.parse(
+        JSON.parse(readFileSync(pathJoin(absoluteToolDir, 'workflow.json'), 'utf8')),
+      );
+    }
+    if (workflow && workflowHasIrreversibleEffect(workflow)) {
+      warnings.push(...applyIrreversibleVerificationWaiver(absoluteToolDir, workflow));
+      message = result.doneSummary ?? 'Task completed';
+      message += `\n\nWarnings:\n${warnings.join('\n')}`;
+      if (!opts.keepTest) {
+        for (const file of ['parser.test.ts', 'request.test.ts', 'integration.test.ts']) {
+          const testPath = pathJoin(absoluteToolDir, file);
+          if (existsSync(testPath)) unlinkSync(testPath);
+        }
+      }
+      break;
+    }
+
     let semanticReviewCompleted = false;
     let semanticReviewAttempted = false;
     if (failures.length === 0) {
@@ -488,7 +529,7 @@ Begin by calling read_session_summary to orient yourself, then proceed per the s
         message = result.doneSummary ?? 'Task completed';
         message += `\n\nWarnings:\n${warnings.join('\n')}`;
         if (!opts.keepTest) {
-          for (const f of ['parser.test.ts', 'integration.test.ts']) {
+          for (const f of ['parser.test.ts', 'request.test.ts', 'integration.test.ts']) {
             const testPath = pathJoin(absoluteToolDir, f);
             if (existsSync(testPath)) unlinkSync(testPath);
           }
@@ -561,7 +602,7 @@ Begin by calling read_session_summary to orient yourself, then proceed per the s
             message += `\n\nWarnings:\n${allWarnings.join('\n')}`;
           }
           if (!opts.keepTest) {
-            for (const f of ['parser.test.ts', 'integration.test.ts']) {
+            for (const f of ['parser.test.ts', 'request.test.ts', 'integration.test.ts']) {
               const testPath = pathJoin(absoluteToolDir, f);
               if (existsSync(testPath)) unlinkSync(testPath);
             }