rivet-design 0.24.0 → 0.25.0

package/dist/config/flags.js

@@ -14,7 +14,6 @@ exports.FLAG_DEFINITIONS = {
     variantSend: { default: false },
     generativeControls: { default: false },
     refineMode: { default: false },
-    designContextViewer: { default: false },
     inspectorUndoRedo: { default: false },
 };
 exports.DEFAULT_FEATURE_FLAGS = Object.fromEntries(Object.entries(exports.FLAG_DEFINITIONS).map(([key, def]) => [

package/dist/index.js

@@ -781,7 +781,7 @@ const promptPostInstall = async () => {
         ? 'npx -y rivet-design@latest login'
         : 'rivet login';
     if (!process.stdin.isTTY || process.env.CI === 'true') {
-        console.log(`\nOne more step: run \`${loginCommand}\` to sign in (or create an account) and start using Rivet.\n`);
+        console.log(`\nNext: open your agent and say "Open Rivet". The first time, Rivet opens sign-in in your browser so you can sign in or create an account (\`${loginCommand}\` also works).\n`);
         return;
     }
     if (await new AuthService_1.AuthService().ensureAuthenticated()) {
@@ -799,7 +799,7 @@ const promptPostInstall = async () => {
         });
     }
     else {
-        console.log(`\nNo problem — run \`${loginCommand}\` whenever you're ready.\n`);
+        console.log(`\nNo problem — Rivet opens sign-in in your browser the first time you say "Open Rivet" (or run \`${loginCommand}\` whenever you're ready).\n`);
     }
 };
 const handleInstall = async (installArgs) => {

package/dist/prototype-host.js

@@ -29,6 +29,7 @@ const envSchema = zod_1.z.object({
 });
 const MALFORMED_REQUEST_STATUS = 400;
 const OVERSIZED_REQUEST_STATUS = 413;
+const UNSUPPORTED_ENCODING_STATUS = 415;
 const REQUEST_FAILURE_STATUS = 500;
 const handleRequestError = (error, _req, res, _next) => {
     log.warn('Prototype request failed', error);
@@ -51,6 +52,12 @@ const handleRequestError = (error, _req, res, _next) => {
             .json({ error: 'Request body too large' });
         return;
     }
+    if (errorType === 'encoding.unsupported') {
+        res
+            .status(UNSUPPORTED_ENCODING_STATUS)
+            .json({ error: 'Unsupported request body encoding' });
+        return;
+    }
     res.status(REQUEST_FAILURE_STATUS).json({ error: 'Request failed' });
 };
 const main = async () => {

package/dist/proxy-middleware/preview-bridge.d.ts

@@ -1,6 +1,5 @@
 import type { IncomingMessage } from 'http';
 export declare const PREVIEW_BRIDGE_SCRIPT_ID = "rivet-preview-bridge";
-export declare const PREVIEW_BRIDGE_CHANNEL = "rivet-preview-bridge";
 type PreviewBridgeInjectionInput = {
     method?: string;
     accept?: string | string[];

package/dist/proxy-middleware/preview-bridge.js

@@ -1,23 +1,51 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isHtmlDocumentRequest = exports.injectPreviewBridge = exports.shouldInjectPreviewBridge = exports.allowPreviewBridgeNonceInCsp = exports.createPreviewBridgeScript = exports.PREVIEW_BRIDGE_CHANNEL = exports.PREVIEW_BRIDGE_SCRIPT_ID = void 0;
+exports.isHtmlDocumentRequest = exports.injectPreviewBridge = exports.shouldInjectPreviewBridge = exports.allowPreviewBridgeNonceInCsp = exports.createPreviewBridgeScript = exports.PREVIEW_BRIDGE_SCRIPT_ID = void 0;
 const htmlDocument_1 = require("../utils/htmlDocument");
+const preview_bridge_1 = require("../types/preview-bridge");
 exports.PREVIEW_BRIDGE_SCRIPT_ID = 'rivet-preview-bridge';
-exports.PREVIEW_BRIDGE_CHANNEL = 'rivet-preview-bridge';
 const MAX_SIBLING_CONTEXT_COUNT = 6;
 const TEXT_SNIPPET_MAX_LENGTH = 80;
 const buildBridgeScript = ({ expectedParentOrigin, } = {}) => `
 (() => {
-  const CHANNEL = '${exports.PREVIEW_BRIDGE_CHANNEL}';
+  const CHANNEL = '${preview_bridge_1.PREVIEW_BRIDGE_CHANNEL}';
   const EXPECTED_PARENT_ORIGIN = ${JSON.stringify(expectedParentOrigin ?? null)} || window.location.origin;
   const RIVET_ID_ATTR = 'data-rivet-id';
   const MAX_SIBLING_CONTEXT_COUNT = ${MAX_SIBLING_CONTEXT_COUNT};
   const TEXT_SNIPPET_MAX_LENGTH = ${TEXT_SNIPPET_MAX_LENGTH};
+  const FORWARDED_KEYS = new Set(${JSON.stringify(preview_bridge_1.PREVIEW_BRIDGE_FORWARDED_KEYS)});
+  const TEXT_ENTRY_TAG_NAMES = new Set(['INPUT', 'TEXTAREA', 'SELECT']);
   if (window.__RIVET_PREVIEW_BRIDGE_ACTIVE__) {
     return;
   }
   window.__RIVET_PREVIEW_BRIDGE_ACTIVE__ = true;
 
+  const isTextEntryTarget = (target) =>
+    Boolean(target) &&
+    (target.isContentEditable === true ||
+      (typeof target.tagName === 'string' &&
+        TEXT_ENTRY_TAG_NAMES.has(target.tagName.toUpperCase())));
+
+  window.addEventListener('keydown', (event) => {
+    if (
+      window.parent === window ||
+      !event.isTrusted ||
+      event.defaultPrevented ||
+      event.altKey ||
+      event.ctrlKey ||
+      event.metaKey ||
+      event.shiftKey ||
+      !FORWARDED_KEYS.has(event.key) ||
+      isTextEntryTarget(event.target)
+    ) {
+      return;
+    }
+    window.parent.postMessage(
+      { channel: CHANNEL, direction: 'event', type: 'keydown', key: event.key },
+      EXPECTED_PARENT_ORIGIN,
+    );
+  });
+
   const getClassName = (element) => {
     try {
       const value = element.className;

package/dist/routes/agentVariants.js

@@ -1639,73 +1639,6 @@ const createAgentVariantsRouter = (orchestrator, bridge, telemetry, variantHisto
             sendError(res, err);
         }
     });
-    router.get('/variants/:sessionId/design-md/:artifactId', async (req, res) => {
-        if (rejectNonLocalRequest(req, res))
-            return;
-        const flags = await (0, evaluateFlags_1.getFeatureFlags)({
-            userKey: (0, featureFlagUserKey_1.getConfigFeatureFlagUserKey)({ headers: req.headers }),
-        });
-        if (!flags.designContextViewer.isEnabled) {
-            res.status(403).json({
-                errorCode: 'FEATURE_DISABLED',
-                message: 'Design context viewer is not enabled.',
-            });
-            return;
-        }
-        const { sessionId, artifactId } = req.params;
-        try {
-            const markdown = orchestrator.getDesignContextMarkdown(sessionId, artifactId);
-            if (!markdown) {
-                res.status(404).json({
-                    errorCode: 'WORK_ITEM_NOT_FOUND',
-                    message: 'DesignMD artifact not found',
-                });
-                return;
-            }
-            res
-                .status(200)
-                .type('text/markdown')
-                .set('Cache-Control', 'no-store')
-                .send(markdown);
-        }
-        catch (err) {
-            sendError(res, err);
-        }
-    });
-    router.get('/variants/:sessionId/design-md/:artifactId/view', async (req, res) => {
-        if (rejectNonLocalRequest(req, res))
-            return;
-        const flags = await (0, evaluateFlags_1.getFeatureFlags)({
-            userKey: (0, featureFlagUserKey_1.getConfigFeatureFlagUserKey)({ headers: req.headers }),
-        });
-        if (!flags.designContextViewer.isEnabled) {
-            res.status(403).json({
-                errorCode: 'FEATURE_DISABLED',
-                message: 'Design context viewer is not enabled.',
-            });
-            return;
-        }
-        const { sessionId, artifactId } = req.params;
-        try {
-            const html = orchestrator.getDesignContextViewerHtml(sessionId, artifactId);
-            if (!html) {
-                res.status(404).json({
-                    errorCode: 'WORK_ITEM_NOT_FOUND',
-                    message: 'DesignMD artifact not found',
-                });
-                return;
-            }
-            res
-                .status(200)
-                .type('html')
-                .set('Cache-Control', 'no-store')
-                .set('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; img-src 'self'")
-                .send(html);
-        }
-        catch (err) {
-            sendError(res, err);
-        }
-    });
     router.get('/variants/:sessionId/static/:variantId/{*assetPath}', async (req, res) => {
         if (rejectNonLocalRequest(req, res))
             return;

package/dist/routes/editorAccess.d.ts

@@ -1,3 +1,4 @@
 import type { RequestHandler } from 'express';
 export declare const authenticateEditor: (token: string) => RequestHandler;
+export declare const authenticateEditorApi: (token: string) => RequestHandler;
 //# sourceMappingURL=editorAccess.d.ts.map

package/dist/routes/editorAccess.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.authenticateEditor = void 0;
+exports.authenticateEditorApi = exports.authenticateEditor = void 0;
 const crypto_1 = require("crypto");
 const loopback_1 = require("../utils/loopback");
 const editorAccess_1 = require("../utils/editorAccess");
@@ -20,9 +20,7 @@ const authenticateEditor = (token) => (req, res, next) => {
         !supplied ||
         Buffer.byteLength(supplied) !== Buffer.byteLength(token) ||
         !(0, crypto_1.timingSafeEqual)(Buffer.from(supplied), Buffer.from(token))) {
-        res
-            .status(401)
-            .json({
+        res.status(401).json({
             error: 'Open Rivet from its local launch link to access this editor.',
         });
         return;
@@ -30,4 +28,15 @@ const authenticateEditor = (token) => (req, res, next) => {
     next();
 };
 exports.authenticateEditor = authenticateEditor;
+const authenticateEditorApi = (token) => {
+    const authenticate = (0, exports.authenticateEditor)(token);
+    return (req, res, next) => {
+        if ((0, editorAccess_1.isEditorApiPath)(req.path, req.method)) {
+            authenticate(req, res, next);
+            return;
+        }
+        next();
+    };
+};
+exports.authenticateEditorApi = authenticateEditorApi;
 //# sourceMappingURL=editorAccess.js.map

package/dist/server.js

@@ -321,6 +321,7 @@ const startServer = async (options) => {
         }
         next();
     });
+    app.use((0, editorAccess_1.authenticateEditorApi)(editorAccessToken));
     app.use('/api/telemetry', (0, telemetry_1.createTelemetryRouter)(telemetry));
     const jsonBodyParser = express_1.default.json({ limit: '50mb' });
     app.use(jsonBodyParser);

package/dist/services/AuthService.js

@@ -501,12 +501,14 @@ class AuthService {
             authUrl: startResult.authUrl,
             ...(installRef ? { installRef } : {}),
         });
-        try {
-            const open = (await Promise.resolve().then(() => __importStar(require('open')))).default;
-            await open(startResult.authUrl);
-        }
-        catch (error) {
-            log.warn('Could not open browser for login:', error);
+        if (!options.noBrowser) {
+            try {
+                const open = (await Promise.resolve().then(() => __importStar(require('open')))).default;
+                await open(startResult.authUrl);
+            }
+            catch (error) {
+                log.warn('Could not open browser for login:', error);
+            }
         }
         return {
             started: true,

package/dist/services/VariantHistoryService.js

@@ -671,7 +671,9 @@ class VariantHistoryService {
                 if (!vStat?.isDirectory())
                     continue;
                 const manifest = await readManifest(path_1.default.join(variantDir, MANIFEST_FILENAME));
-                if (!manifest)
+                if (!manifest ||
+                    manifest.sessionId !== sessionId ||
+                    manifest.variantId !== variantId)
                     continue;
                 if (args.status && manifest.status !== args.status)
                     continue;

package/dist/services/createAgentVariantsOrchestrator.js

@@ -54,6 +54,7 @@ const createAgentVariantsOrchestrator = (options) => {
         ? (0, exports.withVariantsSessionReplayLinking)(options.telemetry, options.bridge)
         : undefined;
     return new agent_variants_1.AgentVariantsOrchestrator({
+        getProjectPath,
         store: new agent_variants_1.SessionStore(),
         variantHistory: options.history,
         worktreeManager: options.worktreeManager ?? new WorktreeManager_1.WorktreeManager(getProjectPath),

package/dist/types/preview-bridge.d.ts

@@ -0,0 +1,4 @@
+export declare const PREVIEW_BRIDGE_CHANNEL = "rivet-preview-bridge";
+export declare const PREVIEW_BRIDGE_FORWARDED_KEYS: readonly ["ArrowUp", "ArrowDown"];
+export type PreviewBridgeForwardedKey = (typeof PREVIEW_BRIDGE_FORWARDED_KEYS)[number];
+//# sourceMappingURL=preview-bridge.d.ts.map

package/dist/types/preview-bridge.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PREVIEW_BRIDGE_FORWARDED_KEYS = exports.PREVIEW_BRIDGE_CHANNEL = void 0;
+exports.PREVIEW_BRIDGE_CHANNEL = 'rivet-preview-bridge';
+exports.PREVIEW_BRIDGE_FORWARDED_KEYS = ['ArrowUp', 'ArrowDown'];
+//# sourceMappingURL=preview-bridge.js.map

package/dist/utils/editorAccess.d.ts

@@ -1,6 +1,7 @@
 export declare const EDITOR_ACCESS_TOKEN_HEADER = "x-rivet-editor-token";
 export declare const EDITOR_ACCESS_TOKEN_FRAGMENT = "editorToken";
 export declare const EDITOR_ACCOUNT_PATHS: string[];
+export declare const isEditorApiPath: (path: string, method?: string) => boolean;
 export declare const createEditorUrl: ({ port, token, }: {
     port: number;
     token: string;

package/dist/utils/editorAccess.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createEditorUrl = exports.EDITOR_ACCOUNT_PATHS = exports.EDITOR_ACCESS_TOKEN_FRAGMENT = exports.EDITOR_ACCESS_TOKEN_HEADER = void 0;
+exports.createEditorUrl = exports.isEditorApiPath = exports.EDITOR_ACCOUNT_PATHS = exports.EDITOR_ACCESS_TOKEN_FRAGMENT = exports.EDITOR_ACCESS_TOKEN_HEADER = void 0;
 exports.EDITOR_ACCESS_TOKEN_HEADER = 'x-rivet-editor-token';
 exports.EDITOR_ACCESS_TOKEN_FRAGMENT = 'editorToken';
 exports.EDITOR_ACCOUNT_PATHS = [
@@ -12,6 +12,16 @@ exports.EDITOR_ACCOUNT_PATHS = [
     '/api/integrations',
     '/api/reference-profiles',
 ];
+const VARIANT_MEDIA_PATH = /^\/api\/variants\/(?:[^/]+\/static\/|history\/[^/]+\/[^/]+\/(?:preview(?:\/|$)|site\/)|[^/]+\/[^/]+\/references\/[^/]+\/image\/?$)/;
+const isEditorApiPath = (path, method = 'GET') => {
+    const pathname = path.split(/[?#]/)[0].toLowerCase();
+    if (/^\/api\/variants(?:\/|$)/.test(pathname)) {
+        return (!['GET', 'HEAD'].includes(method.toUpperCase()) ||
+            !VARIANT_MEDIA_PATH.test(pathname));
+    }
+    return exports.EDITOR_ACCOUNT_PATHS.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+};
+exports.isEditorApiPath = isEditorApiPath;
 const createEditorUrl = ({ port, token, }) => {
     const url = new URL(`http://127.0.0.1:${port}/rivet`);
     url.hash = new URLSearchParams({

package/dist/utils/skills/cli-guidance.d.ts

@@ -1,4 +1,4 @@
-export declare const CLI_GUIDANCE_VERSION = 54;
+export declare const CLI_GUIDANCE_VERSION = 55;
 export declare const CLI_GUIDANCE_BODY: string;
 export declare const CLI_GUIDANCE_DESCRIPTION = "Rivet \u2014 open the visual editor or explore design directions for a web app.";
 //# sourceMappingURL=cli-guidance.d.ts.map

package/dist/utils/skills/cli-guidance.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLI_GUIDANCE_DESCRIPTION = exports.CLI_GUIDANCE_BODY = exports.CLI_GUIDANCE_VERSION = void 0;
 const displayLocale_1 = require("../displayLocale");
-exports.CLI_GUIDANCE_VERSION = 54;
+exports.CLI_GUIDANCE_VERSION = 55;
 const DISPLAY_LOCALE = (0, displayLocale_1.resolveDisplayLocale)();
 exports.CLI_GUIDANCE_BODY = `Rivet helps you **explore multiple design directions** for a web app. You drive it by running \`rivet\` CLI commands. Every command prints exactly one JSON envelope on stdout (\`{ schemaVersion, ok, command, data | error }\`), routes progress to stderr, and never prompts for input.
 
@@ -106,7 +106,7 @@ The export returns \`{checks:[{id,category,status:"pass"|"fail"|"blocked",rule,t
 - \`rivet variants cancel <sessionId> --project <path>\` — cancel a running variants session.
 - \`rivet evidence capture --url <url>\` — rendered design evidence (root variables, element styles, fonts) for a reference URL.
 - \`rivet reference fetch <url>\` — Pinterest / Are.na reference data via the user's connected account. Accepts full pin/board URLs and \`pin.it\` share links. Pinterest images are downloaded into \`.rivet/references/\` and returned as absolute paths (\`data.images\`, plus \`local_path\` per pin) — view them directly and pass them to variants via \`--context-images\` instead of relaying URLs. If Pinterest returns \`status: not_connected\`, present the returned \`authUrl\` to the user and retry after they authorize. On failure the error message says exactly what to tell the user (e.g. save the pin to a board first).
-- \`rivet auth status\` — signed-in state. If \`authenticated: false\`: call the \`rivet_login\` MCP tool when this host has it — it opens a browser sign-in for the user and returns immediately; after they finish, retry the blocked action (the session is picked up automatically). Without MCP tools, tell the user to run \`rivet login\` themselves — never run login in your own terminal (it blocks waiting on the browser).
+- \`rivet auth status\` — signed-in state. A signed-out \`rivet open\` starts Rivet sign-in in the browser itself and exits 3 with \`AUTH_REQUIRED\` and \`error.nextAction.authUrl\` if the user has not finished within a short wait. Share that \`authUrl\` as a clickable link (with \`--no-browser\` it is the only way in), ask the user to finish signing in, then rerun \`rivet open\`; it picks up the finished sign-in. For \`AUTH_REQUIRED\` from other commands, run \`rivet open\` the same way, or call the \`rivet_login\` MCP tool when this host has it. \`rivet login\` stays available for the user to run themselves — never run login in your own terminal (it blocks waiting on the browser).
 - \`rivet version status\` — check the installed and latest published CLI versions without changing the installation. Returns \`installedVersion\`, \`publishedVersion\`, and \`isUpdateAvailable\`.
 - \`rivet update\` — bypass the automatic-update cache, install the latest published CLI when available, and refresh existing host registrations and agent guidance. Run it when version status reports an available update, or for explicit verification or recovery.
 - \`rivet stop [--project <path>]\` — stop the CLI-owned server.

package/dist/utils/skills/codex-skill.d.ts

@@ -1,3 +1,3 @@
 export declare const CODEX_SKILL_MARKER = "[//]: # (managed-by: rivet install codex)";
-export declare const CODEX_SKILL_CONTENT = "---\nname: rivet\ndescription: Open Rivet for the current project when asked or invoked as $rivet.\n---\n\n[//]: # (managed-by: rivet install codex)\n\n# Open Rivet\n\nOpen the current project when the user invokes `$rivet` alone. Use the current directory unless they specify another project.\n\nFor a CLI-installed integration, before the first Rivet command in this conversation, run `rivet version status` with the caller flags below. Report installed and published versions; if an update is available, run `rivet update` and report whether it caught up. Report check or update failures, then continue if the installed CLI works.\n\nRun the installed CLI as a standalone shell command:\n\n```sh\nrivet open --project \"<absolute project path>\" --caller-agent codex --caller-model \"<your actual model>\"\n```\n\nReplace the placeholders with the actual path and model. Include `--caller-session` when the current session ID is available. If another host invokes this skill, use its actual caller agent instead of codex.\n\nIn the local ChatGPT desktop app, run `rivet open --no-browser` with the project and caller flags when its in-app browser reaches localhost, then open the returned `data.editorUrl` (including its fragment) with the browser tool. Otherwise run `rivet open` without `--no-browser` to launch the system browser. To switch browsers later, open the existing URL in the requested browser without rerunning `rivet open`; clarify ambiguous terms such as \"native\". Attach to an already-running app with `--user-port <port>`.\n\nRead the returned JSON envelope. On success, share `data.editorUrl`; if browser navigation or launch failed, tell the user to open that link manually. On failure, explain the reported error and address its cause before retrying. If sign-in is required, use Rivet's available login tool or ask the user to run `rivet login` in their own terminal.\n\nFor a bundled plugin, follow its pinned lifecycle instructions and do not run a global install or updater.\n\nRead `data.guidance` as the user's saved defaults for this conversation. Report `data.guidanceError` if context could not load. Before authoring direction briefs for later generations, read `rivet_get_design_context` when the explicit MCP tools are registered. Use the selected saved instructions in full and keep checking recipes out of generation briefs. A current explicit user request overrides those defaults. For a one-run exclusion, omit the selected instruction locally and pass its ID in `excludedGuidanceIds` to `rivet_explore_designs`. Use `guidance: \"off\"` to exclude all saved instructions. Author a batch label and one brief per direction, including for fresh apps, and pass `runLabel` and `briefs` to `rivet_explore_designs`. Poll `rivet_get_exploration` for progress. Follow the full installed guidance for worker handoff and the separate apply, cancellation, and verification tools. Do not substitute CLI commands for operations absent from the MCP catalog.\n\nWithout MCP, run `rivet context resolve` before briefs. Pass `--exclude-guidance '[\"<documentId>\"]'` to both resolve and variants start, or `--guidance off` to exclude all saved instructions. Pass the authored batch label and briefs with `--run-label` and `--briefs`. Rivet delivers selected saved instructions to workers without a direction-planning model call.\n\nOpening Rivet alone does not request variant generation. If the user also asks for design work, open Rivet first and then follow their request using the installed Rivet CLI guidance.\n";
+export declare const CODEX_SKILL_CONTENT = "---\nname: rivet\ndescription: Open Rivet for the current project when asked or invoked as $rivet.\n---\n\n[//]: # (managed-by: rivet install codex)\n\n# Open Rivet\n\nOpen the current project when the user invokes `$rivet` alone. Use the current directory unless they specify another project.\n\nFor a CLI-installed integration, before the first Rivet command in this conversation, run `rivet version status` with the caller flags below. Report installed and published versions; if an update is available, run `rivet update` and report whether it caught up. Report check or update failures, then continue if the installed CLI works.\n\nRun the installed CLI as a standalone shell command:\n\n```sh\nrivet open --project \"<absolute project path>\" --caller-agent codex --caller-model \"<your actual model>\"\n```\n\nReplace the placeholders with the actual path and model. Include `--caller-session` when the current session ID is available. If another host invokes this skill, use its actual caller agent instead of codex.\n\nIn the local ChatGPT desktop app, run `rivet open --no-browser` with the project and caller flags when its in-app browser reaches localhost, then open the returned `data.editorUrl` (including its fragment) with the browser tool. Otherwise run `rivet open` without `--no-browser` to launch the system browser. To switch browsers later, open the existing URL in the requested browser without rerunning `rivet open`; clarify ambiguous terms such as \"native\". Attach to an already-running app with `--user-port <port>`.\n\nRead the returned JSON envelope. On success, share `data.editorUrl`; if browser navigation or launch failed, tell the user to open that link manually. On failure, explain the reported error and address its cause before retrying. If sign-in is required, `rivet open` has already started Rivet sign-in in the browser: share `error.nextAction.authUrl` as a clickable link, ask the user to finish signing in, then rerun `rivet open`. Rivet's login tool works too when available, and the user can still run `rivet login` themselves.\n\nFor a bundled plugin, follow its pinned lifecycle instructions and do not run a global install or updater.\n\nRead `data.guidance` as the user's saved defaults for this conversation. Report `data.guidanceError` if context could not load. Before authoring direction briefs for later generations, read `rivet_get_design_context` when the explicit MCP tools are registered. Use the selected saved instructions in full and keep checking recipes out of generation briefs. A current explicit user request overrides those defaults. For a one-run exclusion, omit the selected instruction locally and pass its ID in `excludedGuidanceIds` to `rivet_explore_designs`. Use `guidance: \"off\"` to exclude all saved instructions. Author a batch label and one brief per direction, including for fresh apps, and pass `runLabel` and `briefs` to `rivet_explore_designs`. Poll `rivet_get_exploration` for progress. Follow the full installed guidance for worker handoff and the separate apply, cancellation, and verification tools. Do not substitute CLI commands for operations absent from the MCP catalog.\n\nWithout MCP, run `rivet context resolve` before briefs. Pass `--exclude-guidance '[\"<documentId>\"]'` to both resolve and variants start, or `--guidance off` to exclude all saved instructions. Pass the authored batch label and briefs with `--run-label` and `--briefs`. Rivet delivers selected saved instructions to workers without a direction-planning model call.\n\nOpening Rivet alone does not request variant generation. If the user also asks for design work, open Rivet first and then follow their request using the installed Rivet CLI guidance.\n";
 //# sourceMappingURL=codex-skill.d.ts.map

package/dist/utils/skills/codex-skill.js

@@ -25,7 +25,7 @@ Replace the placeholders with the actual path and model. Include \`--caller-sess
 
 In the local ChatGPT desktop app, run \`rivet open --no-browser\` with the project and caller flags when its in-app browser reaches localhost, then open the returned \`data.editorUrl\` (including its fragment) with the browser tool. Otherwise run \`rivet open\` without \`--no-browser\` to launch the system browser. To switch browsers later, open the existing URL in the requested browser without rerunning \`rivet open\`; clarify ambiguous terms such as "native". Attach to an already-running app with \`--user-port <port>\`.
 
-Read the returned JSON envelope. On success, share \`data.editorUrl\`; if browser navigation or launch failed, tell the user to open that link manually. On failure, explain the reported error and address its cause before retrying. If sign-in is required, use Rivet's available login tool or ask the user to run \`rivet login\` in their own terminal.
+Read the returned JSON envelope. On success, share \`data.editorUrl\`; if browser navigation or launch failed, tell the user to open that link manually. On failure, explain the reported error and address its cause before retrying. If sign-in is required, \`rivet open\` has already started Rivet sign-in in the browser: share \`error.nextAction.authUrl\` as a clickable link, ask the user to finish signing in, then rerun \`rivet open\`. Rivet's login tool works too when available, and the user can still run \`rivet login\` themselves.
 
 For a bundled plugin, follow its pinned lifecycle instructions and do not run a global install or updater.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rivet-design",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Local visual web development tool with AI-powered code modification",
   "main": "dist/index.js",
   "workspaces": [
@@ -56,8 +56,13 @@
     "bench:typecheck": "tsc -p benchmarks/tsconfig.json",
     "smoke:preview-dependencies": "node scripts/smoke-preview-dependencies.cjs",
     "smoke:plugin-telemetry": "node scripts/smoke-plugin-telemetry.mjs",
+    "test:release-candidate": "node --test scripts/release-candidate.test.mjs",
+    "release:review": "node scripts/release-review.mjs",
+    "release:candidate": "node scripts/release-candidate-cli.mjs",
     "smoke:cli": "node scripts/smoke-cli.mjs && yarn test:plugin-runtime",
     "test:plugin-runtime": "node --test scripts/plugin-runtime.test.mjs scripts/plugin-telemetry.test.mjs",
+    "test:source-maps": "node --test scripts/*source-maps*.test.mjs",
+    "export:source-maps": "node scripts/export-source-maps.mjs",
     "smoke:runtime-upgrade": "node scripts/smoke-runtime-upgrade.mjs",
     "smoke:embedded-prototypes": "node --import tsx scripts/smoke-embedded-prototypes.mjs",
     "smoke:library-preview-origins": "node scripts/smoke-library-preview-origins.mjs",
@@ -144,6 +149,7 @@
     "dist/",
     "src/ui/dist/",
     "bin/",
+    "!**/*.map",
     "scripts/verify-node-version.cjs",
     "README.npm.md"
   ],
@@ -205,5 +211,6 @@
   },
   "rivetPlugin": {
     "toolContract": "intent-v1"
-  }
+  },
+  "gitHead": "3047ffda74d0b7c5af730e54b9b310c529358250"
 }