pi-note 0.39.4 → 0.40.0

package/field-watchers.ts

@@ -0,0 +1,49 @@
+import { createHash } from 'node:crypto';
+import { accessSync, constants, lstatSync, readdirSync } from 'node:fs';
+import { basename, dirname, isAbsolute, join, normalize } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export type FieldWatcherConfig = { path: string; enabled: boolean };
+export type FieldWatcher = FieldWatcherConfig & { id: string; name: string; bundled: boolean };
+const moduleDirectory = dirname(fileURLToPath(import.meta.url));
+// tsc emits this module one level below the package root; discovery stays in
+// the same shipped package directory in source and compiled entry points.
+const bundledDirectory = join(basename(moduleDirectory) === 'dist-mcp' ? dirname(moduleDirectory) : moduleDirectory, 'watchers');
+function watcherPath(path: unknown): string {
+  if (typeof path !== 'string' || path.length > 4096 || !isAbsolute(path) || /[\u0000-\u001f\u007f-\u009f]/u.test(path)) {
+    throw new Error('Watcher path must be an absolute executable file path (max 4096 characters)');
+  }
+  return normalize(path);
+}
+export function parseFieldWatchers(root: Record<string, unknown>): FieldWatcherConfig[] {
+  let entries = root.fieldWatchers;
+  if (entries === undefined) entries = root.fieldHandler == null ? [] : [{ path: root.fieldHandler, enabled: false }];
+  if (!Array.isArray(entries) || entries.length > 32) throw new Error('fieldWatchers must be an array of at most 32 watchers');
+  const seen = new Set<string>();
+  return entries.map((entry: unknown) => {
+    if (!entry || typeof entry !== 'object' || Array.isArray(entry) || Object.keys(entry).some((key) => key !== 'path' && key !== 'enabled')) throw new Error('Invalid field watcher');
+    const config = entry as Record<string, unknown>;
+    const path = watcherPath(config.path);
+    if (typeof config.enabled !== 'boolean' || seen.has(path)) throw new Error('Invalid or duplicate field watcher');
+    seen.add(path);
+    return { path, enabled: config.enabled };
+  });
+}
+/** Validation only: never starts the executable or invokes a shell. */
+export function validateWatcherExecutable(path: string): void {
+  const canonical = watcherPath(path);
+  if (!lstatSync(canonical).isFile()) throw new Error('Watcher must be a regular executable file');
+  accessSync(canonical, constants.X_OK);
+}
+export function discoverFieldWatchers(root: Record<string, unknown>): FieldWatcher[] {
+  const stored = parseFieldWatchers(root);
+  const bundled = new Set<string>();
+  for (const name of readdirSync(bundledDirectory).sort()) {
+    if (!name.endsWith('.mjs')) continue;
+    const path = join(bundledDirectory, name);
+    try { validateWatcherExecutable(path); bundled.add(path); } catch { /* Not a regular executable. */ }
+  }
+  const merged = [...stored, ...[...bundled].filter((path) => !stored.some((entry) => entry.path === path)).map((path) => ({ path, enabled: false }))];
+  if (merged.length > 32) throw new Error('At most 32 discovered field watchers are supported');
+  return merged.map((config) => ({ ...config, id: createHash('sha256').update(config.path).digest('hex'), name: basename(config.path) === 'github-pr.mjs' && bundled.has(config.path) ? 'GitHub PR' : basename(config.path, '.mjs'), bundled: bundled.has(config.path) }));
+}

package/footer-config.ts

@@ -2,6 +2,7 @@ import { getAgentDir } from "./config-path.ts";
 import { closeSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
+import { parseFieldWatchers, type FieldWatcherConfig } from "./field-watchers.ts";
 
 export const defaultHandoffPrompt = "Read the current Pinote task. Summarize your understanding, but don’t start work yet.";
 export const defaultNewSessionPrompt = defaultHandoffPrompt;
@@ -117,7 +118,7 @@ export function loadFooterConfig(warn: (message: string) => void): FooterConfig
 
 // Synchronous compare-and-replace: reject edits made while the settings dialog was open,
 // preserve unrelated keys, and never leave partial JSON behind.
-export function saveFooterConfig(config: FooterConfig, expectedRaw: string | null, handoffPrompt?: string, newSessionPrompt?: string, taskOfferPolicy?: string, agentGuidance?: string | null) {
+export function saveFooterConfig(config: FooterConfig, expectedRaw: string | null, handoffPrompt?: string, newSessionPrompt?: string, taskOfferPolicy?: string, agentGuidance?: string | null, fieldWatchers?: FieldWatcherConfig[]) {
   if (taskOfferPolicy !== undefined && !["always", "github-remote", "never"].includes(taskOfferPolicy)) throw new Error("Invalid taskOfferPolicy");
   const checked = parseFooterConfig({ footer: config });
   const prompts = {
@@ -140,6 +141,10 @@ export function saveFooterConfig(config: FooterConfig, expectedRaw: string | nul
     const root = expectedRaw === null ? {} : JSON.parse(expectedRaw);
     if (!object(root)) throw new Error("Invalid pi-note configuration; expected an object.");
     if (agentGuidance === null) delete root.agentGuidance;
+    if (fieldWatchers !== undefined) {
+      root.fieldWatchers = parseFieldWatchers({ fieldWatchers });
+      delete root.fieldHandler;
+    }
     raw = `${JSON.stringify({ ...root, ...prompts, ...(taskOfferPolicy === undefined ? {} : { taskOfferPolicy }), footer: checked }, null, 2)}\n`;
     writeFileSync(temp, raw, { flag: "wx", mode: 0o600 });
     renameSync(temp, path);

package/mcp/FIELD_EVENTS.md

@@ -1,26 +1,40 @@
-# Field-event handler
+# Field watchers
 
-pi-note **0.39.0+** with **note 0.24.0+** can run one executable for all task-field
-changes. This is opt-in, on the **HTTP service machine**. No extra daemon or Pi-local
-watcher is installed. The local-only extension and stdio service do not run handlers.
+pi-note **0.40.0+** with **note 0.24.0+** runs independently enabled executables for
+task-field changes on the **HTTP service machine**. No extra daemon or Pi-local
+watcher is installed. The local-only extension and stdio service do not run watchers.
 
 ## Enable
 
-Create a trusted executable with a shebang, then add its absolute path to the
-service's `pi-note.json`, preserving existing settings:
+Open **Settings → Footer fields → Watchers**. The fixed package `watchers/` folder
+is scanned for executable `.mjs` files; discovery never executes or enables them.
+Enable **GitHub PR**, or add a custom absolute executable path on the service
+machine and enable it separately. Every change requires review and confirmation.
+Watchers are trusted code, not sandboxed; enabling authorizes their alerts to
+trigger the owning worker to investigate and fix the task within existing permissions.
+
+The corresponding service `pi-note.json` setting is:
 
 ```json
 {
-  "fieldHandler": "/absolute/path/field-events.mjs"
+  "fieldWatchers": [
+    { "path": "/absolute/path/watcher.mjs", "enabled": true }
+  ]
 }
 ```
 
-Restart the existing Pinote HTTP service; update clients and `/reload` Pi for alerts
-and footer styling. Removing the setting or setting it to `null`, then restarting,
-disables execution and hides automation results without modifying task fields.
-Scripts and settings are never installed or enabled automatically.
+Update/restart the existing HTTP service and `/reload` Pi once after upgrading.
+Subsequent watcher changes apply live. Disable a watcher to stop checks and hide
+its results without changing task fields. Custom entries can also be removed;
+the file is retained. At most 32 watchers may be configured. For overlapping
+results, the first nonempty watcher result in configuration order supplies the
+footer style; alerts remain independent.
+
+`fieldHandler` is replaced, not run alongside the list. An old handler appears
+disabled until explicitly enabled because the previous setting authorized only
+notifications, not automatic worker actions. Saving watchers removes the old key.
 
-The bundled [`examples/field-events.mjs`](../examples/field-events.mjs) handles `PR`
+The bundled [`watchers/github-pr.mjs`](../watchers/github-pr.mjs) handles `PR`
 and ignores other fields. Copy it to a user-owned location before customization,
 make it executable (`chmod u+x`), and ensure authenticated `gh` and Node are on the
 **service's** PATH. It accepts a GitHub PR URL or Markdown link, checks once, and
@@ -29,8 +43,8 @@ strikes through merged PRs while keeping their links. Closed/merged PRs stop
 polling; merging never completes the Pinote task. Passing means reported checks
 passed, not that every review/branch-protection requirement is satisfied.
 
-To support another field, add another branch to this same file. No registry or
-plugin package is needed.
+To support another field, add another executable using the contract below. Each
+watcher receives all field events and returns `{}` for fields it does not handle.
 
 ## Script contract
 
@@ -91,6 +105,7 @@ are deduplicated; a resolved condition followed by another failure alerts again.
 - The service stores its history cursor, scheduled checks, results and alert owner
   under `$XDG_STATE_HOME/pinote/field-events/<database-path-hash>/state.db` (default
   state home: `~/.local/state`). Keep this private and local, like `notes.db`.
+  Watcher cursors, jobs and notices are independent; alert ownership is shared.
   It uses Node's built-in SQLite API; Node 22 may print its experimental warning.
 - Monitoring continues without an open Pi session while the HTTP service runs.
   Deadlines survive restarts. A lease prevents overlapping normal execution by
@@ -114,23 +129,31 @@ are deduplicated; a resolved condition followed by another failure alerts again.
   task. For an unowned task, the first selected-task view claims alerts. Other
   sessions still see shared field status. Explicitly selecting the task reclaims
   ownership. No alert is delivered while that conversation has another task selected.
-- Pi shows an alert once and persists receipts across reload/resume (latest 4,096
-  IDs per branch). Current results reach the next agent run through fresh,
-  task-scoped context. Duplicate field values are not repeated; results exceeding
-  the context budget are omitted with a count, preserving the complete task first.
-  **No prompt submission, model wake-up, task selection or
-  completion is authorized by a handler result.**
+- Pi triggers a worker turn once per current alert and persists receipts across
+  reload/resume (latest 4,096 IDs per branch). Receipts accompany view reads so
+  bounded 64-alert pages advance past delivered failures even if they persist.
+  Busy workers defer delivery until
+  idle, then refresh to verify ownership, selection and current status. An aborted
+  run does not immediately drain deferred alerts. There is no launch of a closed
+  Pi process; current alerts are delivered when its owning conversation reconnects.
+  Older clients/services retain notification-only behavior until both are updated.
+- Worker messages use fixed instructions plus explicitly untrusted observations;
+  the worker must verify fresh task context and obey existing scope and approvals.
+  Enabling never authorizes task selection/completion, PR merging or bypassing
+  approvals. Current results reach each agent run through fresh task-scoped
+  context; oversized results are omitted with a count, preserving the task first.
 - Only the latest current alert per field is retained, not an offline alert log.
   If a failure resolves while Pi is closed, it is not delivered later as a stale
   failure. Network recovery remains explicit through `/pinote` or a tool call.
-- Changing the configured handler path resets automation state and reconstructs
-  history; editing the same file affects its next invocation, not stopped checks.
+- Newly enabled watchers reconstruct current fields from history independently.
+  Disabling/removing clears their automation state; enabling again checks afresh.
+  Editing the same file affects its next invocation, not stopped checks.
   Restoring an older notes backup can invalidate the cursor: stop the service and
   deliberately back up/reset its corresponding automation state before restarting.
 
 Handlers run with the service user's permissions and inherited environment,
 including available credentials. They are trusted code, **not sandboxed**. The
-remote UI and agent tools cannot configure executable paths. Service logs report
+human-confirmed Watchers UI can configure executable paths; agent tools cannot. Service logs report
 failures generically; script output and stderr are not copied into logs. Run the
 script manually with synthetic input when debugging; don't put secrets in results,
 which may be displayed and sent to the configured model.

package/mcp/README.md

@@ -141,12 +141,14 @@ Tests use temporary data and real HTTP/stdio connections, including authenticati
 shared notes, independent selections, conflicts and reconnects. Visual checks use
 Xvfb and private D-Bus; never point them at personal data.
 
-## Field automations
-
-A user-configured single executable can react to task-field changes and request
-scheduled checks inside this service. State survives restarts; no additional daemon
-is needed. Requires note 0.24.0+ and is disabled by default. See the
-[field-handler contract and PR example](FIELD_EVENTS.md) before enabling trusted code.
+## Field watchers
+
+Manage `fieldWatchers` in **Settings → Footer fields → Watchers**. Bundled files
+are discovered disabled; trusted custom executables can be added and enabled.
+Independent checks survive restarts and settings apply live, without another daemon.
+The GitHub PR watcher triggers the owning worker on failed CI/conflicts and strikes
+through merged PRs. Requires note 0.24.0+. Review the
+[watcher contract and safeguards](FIELD_EVENTS.md) before enabling trusted code.
 
 ## Task-completion events
 

package/mcp/core.ts

@@ -14,6 +14,7 @@ import { stripVTControlCharacters } from 'node:util';
 import { defaultAgentGuidance, defaultFooterField, defaultHandoffPrompt, defaultNewSessionPrompt, effectiveFooterFields, parseAgentGuidance, parseFooterConfig, parseHandoffPrompt, parseNewSessionPrompt, readConfigDocument, readFooterDocument, saveFooterConfig } from '../footer-config.ts';
 import { proposalTitleOptions, proposalDescriptionOptions, proposalText } from '../proposal.ts';
 import type { FieldAutomation, FieldResult } from './field-events.ts';
+import { discoverFieldWatchers, parseFieldWatchers, validateWatcherExecutable, type FieldWatcherConfig } from '../field-watchers.ts';
 import { taskTitle } from '../task-title.ts';
 
 const URI = 'pinote://ui';
@@ -35,7 +36,7 @@ const ProposalInput = z.union([
   ExistingProposal,
 ]);
 const Proposal = z.union([NewProposal.extend({ id: z.string().uuid() }), ExistingProposal.extend({ id: z.string().uuid() })]);
-const Context = z.object({ conversationId: z.string().min(1).max(256), contextId: z.string().min(1).max(256).optional(), state: z.object({
+const Context = z.object({ conversationId: z.string().min(1).max(256), contextId: z.string().min(1).max(256).optional(), fieldReceipts: z.array(z.string().uuid()).max(4096).optional(), state: z.object({
   proposal: Proposal.nullable().optional(),
   launch: z.object({ task_id: TaskId, updated_at: z.string().min(1).max(128) }).strict().optional(),
   selectedId: z.number().int().positive().safe().nullable().optional(), screen: z.enum(['tasks', 'settings', 'field']).optional(),
@@ -104,7 +105,7 @@ function settings() {
   if (!['always', 'github-remote', 'never'].includes(policy)) throw new Error('Invalid taskOfferPolicy in pi-note.json');
   const guidanceOverridden = Object.hasOwn(root, 'agentGuidance');
   const guidance = guidanceOverridden ? parseAgentGuidance(root.agentGuidance) : defaultAgentGuidance;
-  return { ...document, handoffPrompt, newSessionPrompt, policy, guidance, guidanceOverridden };
+  return { ...document, handoffPrompt, newSessionPrompt, policy, guidance, guidanceOverridden, watchers: discoverFieldWatchers(root) };
 }
 function agentGuidance(): string {
   const { value: root } = readConfigDocument();
@@ -117,7 +118,7 @@ async function selection(state: State, signal: AbortSignal) {
   if (proposal && 'task_id' in proposal && (!proposedTask || !['active', 'in_progress'].includes(proposedTask.state))) proposal = null;
   return { task, proposal, proposedTask };
 }
-async function snapshot(state: State, signal: AbortSignal, automation?: FieldAutomation, contextId?: string) {
+async function snapshot(state: State, signal: AbortSignal, automation?: FieldAutomation, contextId?: string, receipts: readonly string[] = []) {
   const launchTask: Task | null = state.launch ? JSON.parse(await note(['agent', 'get', String(state.launch.task_id)], signal)) : null;
   const tasks: Task[] = state.launch
     ? launchTask && ['active', 'in_progress'].includes(launchTask.state) ? [launchTask] : []
@@ -129,7 +130,7 @@ async function snapshot(state: State, signal: AbortSignal, automation?: FieldAut
   if (state.screen === 'field' && !fields(config.config, task?.agent_notes).some((f) => f.name === state.field)) state.screen = 'settings';
   state = Context.parse({ conversationId: 'canonical', state }).state;
   const fieldStatuses = task ? automation?.statuses(task) ?? [] : [];
-  const fieldNotifications = task && contextId ? automation?.notices(task, contextId) ?? [] : [];
+  const fieldNotifications = task && contextId ? automation?.notices(task, contextId, receipts) ?? [] : [];
   const revision = createHash('sha256').update(JSON.stringify({ state, tasks, task, proposedTask, raw: config.raw, fieldStatuses, fieldNotifications })).digest('hex');
   return { state, tasks, task, proposedTask, suggestion, config, revision, fieldStatuses, fieldNotifications };
 }
@@ -159,6 +160,7 @@ function footerFeatures(meta: Record<string, unknown> | undefined) {
     footerNativeActions: z.object({ footerNativeActions: z.literal(true) }).safeParse(meta?.['native-ui/features']).success,
     footerStyles: z.object({ footerStyles: z.literal(true) }).safeParse(meta?.['native-ui/features']).success,
     fieldEvents: z.object({ fieldEvents: z.literal(true) }).safeParse(meta?.['native-ui/features']).success,
+    fieldWatchers: z.object({ fieldWatchers: z.literal(true) }).safeParse(meta?.['native-ui/features']).success,
     footerDoubleActions: z.object({ footerDoubleActions: z.literal(true) }).safeParse(meta?.['native-ui/features']).success,
   };
 }
@@ -170,7 +172,7 @@ function fullPreview(task: { text: string; agent_notes?: Record<string, string>
   const document = task.text + notes;
   return document.length <= 20_000 ? document : 'Full preview exceeds the 20000-character display limit. Nothing has been truncated here: read the complete task and handoff notes through the Pinote CLI or service (get_task).';
 }
-function view(data: Snapshot, scoped = false, secondary = false, features: { footerNativeActions?: boolean; footerStyles?: boolean; footerDoubleActions?: boolean; fieldEvents?: boolean } = {}) {
+function view(data: Snapshot, scoped = false, secondary = false, features: { footerNativeActions?: boolean; footerStyles?: boolean; footerDoubleActions?: boolean; fieldEvents?: boolean; fieldWatchers?: boolean } = {}) {
   const { tasks, task, suggestion, config, revision } = data;
   const state = Context.parse({ conversationId: 'outgoing-state', state: { ...data.state, selectedId: task?.id ?? null } }).state;
   const controls: Control[] = [];
@@ -202,6 +204,16 @@ function view(data: Snapshot, scoped = false, secondary = false, features: { foo
     for (const [key, label, description] of [['titleWidth', 'Task title width', '3–1000 terminal cells.'], ['fieldWidth', 'Default field width', '3–1000 terminal cells; inherited by fields without a width override.'], ['maxFields', 'Maximum visible fields', '0–64 fields; 0 hides all task fields.']] as const) controls.push({ id: key, label, description, kind: 'number', value: config.config[key], confirm: 'Save this global footer setting?' });
     controls.push({ id: 'add-field', label: 'Add field', icon: icons.add, kind: 'text', value: '', description: 'Unique nonblank field name, at most 64 characters; Bar is reserved. Changes display definitions, not task values.', confirm: 'Add this global footer field?' });
     fields(config.config, task?.agent_notes).forEach((field) => action(`field:${field.name}`, field.name, { description: `${field.label || '(no label)'} · ${field.format}` }));
+    controls.push({ id: 'add-watcher', label: 'Add watcher file', icon: icons.add, kind: 'text', value: '',
+      description: 'Absolute executable path on the service machine. Added disabled; enable separately after reviewing trusted code.',
+      confirm: 'Add this trusted watcher file to shared fieldWatchers (disabled)?' });
+    for (const watcher of config.watchers) {
+      controls.push({ id: `watcher:${watcher.id}`, label: watcher.name, kind: 'toggle', value: watcher.enabled,
+        description: `${watcher.bundled ? 'Bundled' : 'Custom'} · ${watcher.path}`,
+        confirm: `Change this shared watcher?\n${watcher.path}\nEnabling executes trusted code with the service user’s permissions and credentials. Its alerts automatically trigger the owning Pi worker to investigate and fix the current task. Disabling stops checks and hides its results.` });
+      if (!watcher.bundled) action(`remove-watcher:${watcher.id}`, `Remove ${watcher.name}`, { icon: icons.cross,
+        description: watcher.path, confirm: `Remove this watcher from shared settings? The file and task values are retained.\n${watcher.path}` });
+    }
   } else if (state.screen === 'field') {
     const field = fields(config.config, task?.agent_notes).find((f) => f.name === state.field);
     if (!field) throw new Error('Field no longer exists; open Settings again');
@@ -274,7 +286,7 @@ function view(data: Snapshot, scoped = false, secondary = false, features: { foo
     return false;
   });
   if (scoped) for (const control of editable) control.revision = actionRevision(data, control);
-  const result = { version: 1, title, body: body.slice(0, 20_000), revision, state: boundedState(state), retainOnNew: true, controls: editable, footer, ...(features.fieldEvents ? { fieldNotifications: data.fieldNotifications } : {}) };
+  const result = { version: 1, title, body: body.slice(0, 20_000), revision, state: boundedState(state), retainOnNew: true, controls: editable, footer, ...(features.fieldEvents ? { fieldNotifications: data.fieldNotifications.map((notice) => ({ ...notice, ...(features.fieldWatchers ? { triggerWorker: true } : {}) })) } : {}) };
   // JSON escaping and expanded footer formats can exceed the host budget even
   // with bounded row counts. Preserve navigation/filter controls ahead of rows.
   let shortened = false;
@@ -337,14 +349,14 @@ server.setRequestHandler(ReadResourceRequestSchema, (request, extra) => serial(a
   }
   if (request.params.uri !== URI) throw new Error('Unknown resource');
   const caller = context(request.params._meta);
-  const data = await snapshot(caller.state, extra.signal, options.fieldAutomation, caller.contextId ?? caller.conversationId);
+  const data = await snapshot(caller.state, extra.signal, options.fieldAutomation, caller.contextId ?? caller.conversationId, caller.fieldReceipts);
   return { contents: [{ uri: URI, mimeType: MIME, text: JSON.stringify(view(data, scopedActions(request.params._meta), secondaryActions(request.params._meta), footerFeatures(request.params._meta))) }] };
 }));
 server.setRequestHandler(Action, (request, extra) => serial(async () => {
   const caller = context(request.params._meta);
   const state = caller.state;
   const owner = caller.contextId ?? caller.conversationId;
-  const before = await snapshot(state, extra.signal, options.fieldAutomation, owner);
+  const before = await snapshot(state, extra.signal, options.fieldAutomation, owner, caller.fieldReceipts);
   const scoped = scopedActions(request.params._meta);
   const { action, value } = request.params;
   const control = view(before, scoped, secondaryActions(request.params._meta), footerFeatures(request.params._meta)).controls.find((item) => item.id === action);
@@ -389,7 +401,25 @@ server.setRequestHandler(Action, (request, extra) => serial(async () => {
     const cfg = structuredClone(before.config.config);
     let handoff = before.config.handoffPrompt, newSession = before.config.newSessionPrompt, policy = before.config.policy;
     let guidance: string | null | undefined;
-    if (action === 'agentGuidance') guidance = parseAgentGuidance(value);
+    let watchers: FieldWatcherConfig[] | undefined;
+    if (action === 'add-watcher' || action.startsWith('watcher:') || action.startsWith('remove-watcher:')) {
+      watchers = before.config.watchers.map(({ path, enabled }) => ({ path, enabled }));
+      if (action === 'add-watcher') {
+        const entry = parseFieldWatchers({ fieldWatchers: [{ path: z.string().parse(value), enabled: false }] })[0];
+        validateWatcherExecutable(entry.path);
+        watchers.push(entry);
+      } else {
+        const watcher = before.config.watchers.find((item) => item.id === action.split(':')[1]);
+        if (!watcher) staleAction();
+        if (action.startsWith('remove-watcher:')) watchers = watchers.filter((item) => item.path !== watcher.path);
+        else {
+          const enabled = z.boolean().parse(value);
+          if (enabled) validateWatcherExecutable(watcher.path);
+          watchers.find((item) => item.path === watcher.path)!.enabled = enabled;
+        }
+      }
+      watchers = parseFieldWatchers({ fieldWatchers: watchers });
+    } else if (action === 'agentGuidance') guidance = parseAgentGuidance(value);
     else if (action === 'reset-agent-guidance') guidance = null;
     else if (action === 'handoffPrompt') handoff = z.string().parse(value);
     else if (action === 'newSessionPrompt') newSession = z.string().parse(value);
@@ -408,10 +438,10 @@ server.setRequestHandler(Action, (request, extra) => serial(async () => {
       }
     }
     extra.signal.throwIfAborted();
-    saveFooterConfig(cfg, before.config.raw, handoff, newSession, policy, guidance);
+    saveFooterConfig(cfg, before.config.raw, handoff, newSession, policy, guidance, watchers);
   }
   if (next.selectedId && (action.startsWith('select:') || action === 'proposal:accept' || action === 'add')) options.fieldAutomation?.claim(next.selectedId, owner, true);
-  const result = { view: view(await snapshot(next, extra.signal, options.fieldAutomation, owner), scoped, secondaryActions(request.params._meta), footerFeatures(request.params._meta)), ...(draft ? { draft } : {}), ...(preview ? { preview } : {}) };
+  const result = { view: view(await snapshot(next, extra.signal, options.fieldAutomation, owner, caller.fieldReceipts), scoped, secondaryActions(request.params._meta), footerFeatures(request.params._meta)), ...(draft ? { draft } : {}), ...(preview ? { preview } : {}) };
   await notifyChanged();
   return result;
 }));