openmerit 0.1.8 → 0.1.10

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.1.10 — 2026-10-26
+
+- Add default-on Claude Code background checks for compatible Scout skill/startup-rule updates, with daily checks, 15-minute failure backoff, non-blocking failure notices with the “update openmerit” fallback, manual `openmerit update`, persistent opt-out and a natural-language update instruction.
+- Verify npm package integrity and read a bounded instruction bundle without executing downloaded code. Preserve edited files, credentials, MCP configuration, privacy settings and project policy; serialize maintenance and recover interrupted instruction writes.
+- Disclose setup behavior, retain other Claude hooks/settings and require a new session to reliably load updated instructions. Existing installations need a one-time installer rerun after publication; incompatible releases require a reviewed manual upgrade. Hosted Scout and npm remain separate releases.
+- Enable Scout setup usage/installation diagnostics by default, honoring telemetry, DNT and account-unlink opt-outs. Terminal/evaluation analytics remain opt-in; MCP prompt-content capture remains off.
+
+## 0.1.9 — 2026-10-24
+
+- Add opt-in coding-agent installation milestones, component/connection diagnostics and consent-gated setup/installation correlation retained across resumed approval and upgrades. Carry browser usage and unlink choices into setup; keep standalone CLI analytics default-off and MCP prompt-content capture off.
+- Add bounded installation-event retries with stable delivery IDs. Report verification and remote revocation failures even when existing local command exit semantics remain successful.
+- Coordinate the independently released Scout browser/device/MCP lifecycle telemetry, correct HTTP-200 logical-error accounting, and distinguish key authorization from verified installation. These are observed events, not skipped-call detection, guaranteed delivery or downstream model-execution tracking.
+- Preserve existing package exports, model-decision guidance and legal metadata. Existing installations need an installer rerun; npm publication does not deploy Scout or the main website.
+
 ## 0.1.8 — 2026-10-24
 
 - Install an owned startup rule requiring Scout before explicit or implicit application-model choices, including pretrained/local/browser models, weight downloads and SDK defaults. Keep detailed access-policy and search instructions in the skill. These instructions are guidance, not hard enforcement.

package/dist/core/src/index.d.ts

@@ -7,13 +7,13 @@ export interface HarnessAdapter {
     scheduleWakeup?(request: HarnessWakeupRequest): Promise<HarnessDispatchReceipt>;
 }
 export interface IntentFactoryOptions {
-    readonly taskProfileId?: string;
+    readonly taskProfileId?: string | undefined;
     readonly authorizationPolicyId?: string;
-    readonly policy?: SupervisedGraduationPolicy;
+    readonly policy?: SupervisedGraduationPolicy | undefined;
     readonly id?: string;
     readonly requestedAt?: string;
-    readonly evaluationSpend?: number;
-    readonly targetId?: string;
+    readonly evaluationSpend?: number | undefined;
+    readonly targetId?: string | undefined;
     readonly additionalConstraints?: Readonly<Record<string, JsonValue>>;
 }
 export declare function createOpenMeritIntent(kind: IntentKind, options?: IntentFactoryOptions): OpenMeritIntent;
@@ -28,8 +28,8 @@ export interface VerificationResult {
 }
 export interface ResultInterpretation extends VerificationResult {
     readonly nextStage?: ImprovementCycleState["stage"];
-    readonly config?: OpenMeritProjectConfig;
-    readonly cyclePatch?: Partial<ImprovementCycleState>;
+    readonly config?: OpenMeritProjectConfig | undefined;
+    readonly cyclePatch?: Partial<ImprovementCycleState> | undefined;
 }
 export declare function validateObservabilityCoverage(profile: TaskProfile, coverage: ObservabilityCoverage, requireReady: boolean): readonly string[];
 export declare function interpretIntentResult(intent: OpenMeritIntent, result: AnyIntentResult, cycle: ImprovementCycleState, config: OpenMeritProjectConfig): ResultInterpretation;
@@ -52,7 +52,7 @@ export interface IssuedIntent {
     readonly receipt: HarnessDispatchReceipt;
 }
 export interface CoordinatorIssueOptions {
-    readonly additionalConstraints?: Readonly<Record<string, JsonValue>>;
+    readonly additionalConstraints?: Readonly<Record<string, JsonValue>> | undefined;
 }
 export interface AcceptedIntentResult {
     readonly intentKind: IntentKind;

package/dist/pi/src/index.js

@@ -536,7 +536,7 @@ export default function openMeritExtension(pi) {
         await dispatchIntent(pi, ctx, state, store, "establish_evals", registerCompletionTool, {
             applicationTargetRequired: true,
             detectedApplicationTargets: detectedTargetsConstraint(detectedApplicationTargets),
-            ...(detectedApplicationTargets.length === 1 && detectedApplicationTargets[0].configuredModelId ? { expectedIncumbentModelId: detectedApplicationTargets[0].configuredModelId } : {}),
+            ...(detectedApplicationTargets.length === 1 && detectedApplicationTargets[0]?.configuredModelId ? { expectedIncumbentModelId: detectedApplicationTargets[0]?.configuredModelId } : {}),
         });
     });
     pi.on("session_start", async (_event, ctx) => {
@@ -573,7 +573,7 @@ export default function openMeritExtension(pi) {
                         await dispatchIntent(pi, ctx, state, store, "establish_evals", registerCompletionTool, {
                             applicationTargetRequired: true,
                             detectedApplicationTargets: detectedTargetsConstraint(detectedApplicationTargets),
-                            ...(detectedApplicationTargets.length === 1 && detectedApplicationTargets[0].configuredModelId ? { expectedIncumbentModelId: detectedApplicationTargets[0].configuredModelId } : {}),
+                            ...(detectedApplicationTargets.length === 1 && detectedApplicationTargets[0]?.configuredModelId ? { expectedIncumbentModelId: detectedApplicationTargets[0]?.configuredModelId } : {}),
                         });
                     }
                 }
@@ -626,7 +626,7 @@ export default function openMeritExtension(pi) {
                 await dispatchIntent(pi, ctx, state, store, "establish_evals", registerCompletionTool, {
                     applicationTargetRequired: true,
                     detectedApplicationTargets: detectedTargetsConstraint(detectedApplicationTargets),
-                    ...(detectedApplicationTargets.length === 1 && detectedApplicationTargets[0].configuredModelId ? { expectedIncumbentModelId: detectedApplicationTargets[0].configuredModelId } : {}),
+                    ...(detectedApplicationTargets.length === 1 && detectedApplicationTargets[0]?.configuredModelId ? { expectedIncumbentModelId: detectedApplicationTargets[0]?.configuredModelId } : {}),
                 });
             }
             else {
@@ -652,7 +652,7 @@ export default function openMeritExtension(pi) {
                         await dispatchIntent(pi, ctx, state, store, "establish_evals", registerCompletionTool, {
                             applicationTargetRequired: true,
                             detectedApplicationTargets: detectedTargetsConstraint(detectedApplicationTargets),
-                            ...(detectedApplicationTargets.length === 1 && detectedApplicationTargets[0].configuredModelId ? { expectedIncumbentModelId: detectedApplicationTargets[0].configuredModelId } : {}),
+                            ...(detectedApplicationTargets.length === 1 && detectedApplicationTargets[0]?.configuredModelId ? { expectedIncumbentModelId: detectedApplicationTargets[0]?.configuredModelId } : {}),
                         });
                     }
                     return;

package/dist/protocol/src/index.d.ts

@@ -361,16 +361,16 @@ export declare const REQUIRED_CAPABILITIES: Readonly<Record<IntentKind, readonly
 export type ImprovementStage = "unconfigured" | "establishing_evidence" | "collecting_baseline" | "baseline_ready" | "discovering_candidates" | "candidates_ready" | "running_challenger_trials" | "challengers_ready" | "calculating_frontier" | "frontier_ready" | "awaiting_swap_approval" | "swap_approved" | "applying_swap" | "swap_applied" | "verifying_swap" | "swap_verified" | "verification_failed" | "rolling_back" | "monitoring";
 export interface ImprovementCycleState {
     readonly id: string;
-    readonly targetId?: string;
-    readonly taskProfileId?: string;
+    readonly targetId?: string | undefined;
+    readonly taskProfileId?: string | undefined;
     readonly stage: ImprovementStage;
-    readonly activeCandidateId?: string;
-    readonly previousCandidateId?: string;
-    readonly proposedCandidateId?: string;
+    readonly activeCandidateId?: string | undefined;
+    readonly previousCandidateId?: string | undefined;
+    readonly proposedCandidateId?: string | undefined;
     readonly verifiedSwapCount: number;
     readonly baselineEvidenceSufficient: boolean;
     readonly observabilityReady?: boolean;
-    readonly policy?: SupervisedGraduationPolicy;
+    readonly policy?: SupervisedGraduationPolicy | undefined;
 }
 export interface OpenMeritProjectConfig {
     readonly schemaVersion: 1;
@@ -382,13 +382,13 @@ export interface OpenMeritProjectConfig {
 export interface OpenMeritProjectState {
     readonly schemaVersion: 1;
     readonly cycle: ImprovementCycleState;
-    readonly activeIntent?: OpenMeritIntent;
-    readonly lastResult?: IntentResult;
+    readonly activeIntent?: OpenMeritIntent | undefined;
+    readonly lastResult?: IntentResult | undefined;
     /** Durable handoffs between discovery, trials, and frontier calculation. */
-    readonly candidates?: readonly CandidateDescriptor[];
-    readonly assessments?: readonly CandidateAssessment[];
-    readonly experimentManifest?: EvidenceReference;
-    readonly observability?: ObservabilityCoverage;
+    readonly candidates?: readonly CandidateDescriptor[] | undefined;
+    readonly assessments?: readonly CandidateAssessment[] | undefined;
+    readonly experimentManifest?: EvidenceReference | undefined;
+    readonly observability?: ObservabilityCoverage | undefined;
     readonly automation: {
         readonly paused?: boolean;
         readonly setupNudgeShown: boolean;
@@ -397,9 +397,9 @@ export interface OpenMeritProjectState {
         readonly modelCatalogFingerprint?: string;
         readonly modelCatalogChangedAt?: string;
         readonly processedSignalIds?: readonly string[];
-        readonly pendingIntentKind?: IntentKind;
-        readonly pendingIntentReason?: string;
-        readonly lastAssessmentAt?: string;
+        readonly pendingIntentKind?: IntentKind | undefined;
+        readonly pendingIntentReason?: string | undefined;
+        readonly lastAssessmentAt?: string | undefined;
         readonly baselineStartedAt?: string;
         readonly lastReassessmentTaskCount?: number;
         readonly lastReassessmentAt?: string;

package/dist/terminal/scout-update.json

@@ -0,0 +1 @@
+{"format":1,"contract":"scout-recommend-v1","version":"0.1.10","skill":"---\nname: openmerit-scout\ndescription: Consults OpenMerit Scout before choosing, adding, downloading, replacing or configuring any application inference model, including implicit choices while building features, pretrained browser/local models, SDK defaults, embeddings, OCR, speech, classification, detection, segmentation, LLMs and agents. Not for unrelated edits, ordinary inference calls or this coding agent's own model.\n---\n\n# OpenMerit · Scout\n\nBefore introducing, recommending, replacing or configuring an application\ninference model, call the `scout_models` tool on the `openmerit` MCP server.\nThis applies even when the user never mentions models or Scout. Downloading local\nweights, using a pretrained browser model or accepting an SDK default is a model\ndecision: consult Scout before model-specific code, installs or downloads.\nPreserve the user's explicit model choice; assess it rather than silently replacing\nit. Leave unchanged, approved application selections in place.\n\n## Project policy\n\nRead `.openmerit/scout.json` before searching. If it is absent, ask once whether this\nproject uses **existing-only** (only endpoints it can already reach) or\n**existing-first** (prefer them, ask before searching the whole catalogue), and\nwhich public catalogue endpoint IDs it can access. Save the answer:\n\n```sh\nnpx -y openmerit@latest project --policy existing-only --endpoint-id <id> ...\n```\n\nNever infer access from a model name, SDK or environment-variable name. Never\nrecord credentials, private URLs, prompts or customer data. An empty inventory\nis not permission to search all models.\n\n## Searching\n\nCall `scout_models` with a non-confidential task description and\n`endpointIds` set to the saved inventory, including `[]` when empty.\nExisting-only never broadens. For existing-first, if no existing candidate fits,\nexplain the gap and ask before a separate search without `endpointIds`. Send\nonly task requirements, never source files, secrets or real customer records.\n\nCompare model AND endpoint, evidence, reference cost/time, unknowns and\nwarnings. For multiple tasks read `tasks[].slots[0].recommendations`; the\ntop-level list is empty. Prefer the cheapest usable option the quality evidence\nsupports, without claiming benchmarks prove application accuracy. Use the\nreturned provider model ID and the project's actual SDK and protocol.\n\n## Boundaries\n\nAsk before adding providers or credentials, spending, deploying or external\nwrites. Report recommendation, endpoint connectivity and application checks as\nseparate results, each only after it succeeds. Do not switch this coding agent's\nown model.\n\nIf Scout fails or has no suitable candidate/evidence for the required deployment,\nsay so and pause the model decision; do not substitute a remembered recommendation\nor SDK default. Continue only model-independent work. Local/browser models are not\nexempt when the catalogue lacks coverage. If it reports that the device key is missing,\nexpired or revoked, run `npx -y openmerit@latest login` and then\n`npx -y openmerit@latest install` again. Never ask the user to paste a key.\n","rule":"# Application model decisions · OpenMerit Scout\n\nBefore choosing, recommending, adding, downloading, replacing or configuring\nANY application inference model, load the `openmerit-scout` skill and consult\n`scout_models` on the `openmerit` MCP server before committing to a model.\nThis applies even when the user only asks you to build a feature, never mentions\nmodels or Scout, or names a model themselves (assess it; do not silently replace it).\n\nA pretrained model, local weights, browser inference, an SDK's default model,\nembeddings, OCR, speech, image classification, detection and segmentation all\ncount as model choices, not implementation details. Identify this decision before\nwriting model-specific code, installing a model package or downloading weights.\n\nFollow the skill's project access policy. If it is missing, ask and save it first.\nIf Scout is unavailable, fails or has no suitable evidence/candidate, disclose the\ngap and pause the model decision; do not fall back to a remembered or SDK-default\nmodel. You may continue work that does not commit to a model.\n\nDo not consult Scout for unrelated edits, normal inference calls using an unchanged\napproved model, or this coding agent's own model. Do not reselect approved models\nunless the task introduces or changes a model decision.\n\nWhen the user says \"update openmerit\", run\n`npx -y openmerit@latest update --scope user` (use `--scope project` if this\nrule is in the project's .claude/rules directory). Report the result, including\nany conflict or manual-upgrade requirement. Do not delete edited files, bypass\npermissions or rerun login automatically. A new session loads updated instructions.\n"}

package/dist/terminal/src/cli.mjs

@@ -11,6 +11,7 @@ const help = `OpenMerit · Inference Terminal
 
   openmerit dash [path] [options]
   openmerit install --help           Connect OpenMerit to your coding agent
+  openmerit update --help            Update installed Scout instructions
   openmerit eval --help              Evaluate CLI changes across coding agents
 
   --port <number>      Require a specific local port (default: 4310 or a free port)
@@ -29,7 +30,7 @@ Coding-harness usage is outside this terminal's scope.
 
 async function main() {
   const args = process.argv.slice(2);
-  if (['install', 'status', 'remove', 'login', 'logout', 'project', 'doctor'].includes(args[0])) { const { main } = await import('./install.mjs'); process.exitCode = await main(args); return; }
+  if (['install', 'status', 'remove', 'login', 'logout', 'project', 'doctor', 'update'].includes(args[0])) { const { main } = await import('./install.mjs'); process.exitCode = await main(args); return; }
   if (args[0] === 'eval') { const { main } = await import('../../eval/src/cli.mjs'); await main(args.slice(1)); return; }
   if (!args.length || args.includes('--help') || args.includes('-h')) { console.log(help); return; }
   if (args.shift() !== 'dash') throw new Error('Unknown command. Run openmerit --help.');