rivet-design 0.9.9 → 0.10.0

package/dist/services/accessTokenRefresh.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resetHostedDemoTokenRefreshSingleFlightForTests = exports.runHostedDemoTokenRefreshSingleFlight = exports.refreshAccessTokenViaProxy = exports.shouldProactivelyRefreshAccessToken = exports.getJwtSecondsUntilExpiry = exports.ACCESS_TOKEN_PROACTIVE_REFRESH_THRESHOLD_SECONDS = void 0;
+exports.resetHostedDemoTokenRefreshSingleFlightForTests = exports.runHostedDemoTokenRefreshSingleFlight = exports.refreshAccessTokenViaProxy = exports.shouldProactivelyRefreshAccessToken = exports.getJwtSub = exports.getJwtSecondsUntilExpiry = exports.ACCESS_TOKEN_PROACTIVE_REFRESH_THRESHOLD_SECONDS = void 0;
 const logger_1 = require("../utils/logger");
 const log = (0, logger_1.createLogger)('AccessTokenRefresh');
 /**
@@ -34,6 +34,32 @@ const getJwtSecondsUntilExpiry = (accessToken) => {
     }
 };
 exports.getJwtSecondsUntilExpiry = getJwtSecondsUntilExpiry;
+/**
+ * Returns the JWT `sub` claim (Supabase user id), or null when the token cannot
+ * be decoded. No signature verification — callers use this only to recover the
+ * canonical user id from a token we already trust locally.
+ */
+const getJwtSub = (accessToken) => {
+    if (!accessToken) {
+        return null;
+    }
+    try {
+        const segment = accessToken.split('.')[1];
+        if (!segment) {
+            return null;
+        }
+        const normalized = segment.replace(/-/g, '+').replace(/_/g, '/');
+        const padded = normalized.padEnd(Math.ceil(normalized.length / 4) * 4, '=');
+        const decoded = JSON.parse(Buffer.from(padded, 'base64').toString('utf8'));
+        return typeof decoded.sub === 'string' && decoded.sub.length > 0
+            ? decoded.sub
+            : null;
+    }
+    catch {
+        return null;
+    }
+};
+exports.getJwtSub = getJwtSub;
 /**
  * Returns true when the access token should be refreshed before use (expired, unreadable, or within threshold).
  */

package/dist/services/accessTokenRefresh.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessTokenRefresh.js","sourceRoot":"","sources":["../../src/services/accessTokenRefresh.ts"],"names":[],"mappings":";;;AAAA,4CAA+C;AAE/C,MAAM,GAAG,GAAG,IAAA,qBAAY,EAAC,oBAAoB,CAAC,CAAC;AAE/C;;;GAGG;AACU,QAAA,gDAAgD,GAAG,GAAG,CAAC;AAEpE;;GAEG;AACI,MAAM,wBAAwB,GAAG,CAAC,WAAmB,EAAiB,EAAE;IAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAExE,CAAC;QACF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAtBW,QAAA,wBAAwB,4BAsBnC;AAEF;;GAEG;AACI,MAAM,mCAAmC,GAAG,CACjD,WAAmB,EACnB,mBAA2B,wDAAgD,EAClE,EAAE;IACX,MAAM,eAAe,GAAG,IAAA,gCAAwB,EAAC,WAAW,CAAC,CAAC;IAC9D,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,eAAe,GAAG,gBAAgB,CAAC;AAC5C,CAAC,CAAC;AATW,QAAA,mCAAmC,uCAS9C;AAQF;;GAEG;AACI,MAAM,0BAA0B,GAAG,KAAK,EAAE,MAIhD,EAA4D,EAAE;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,mBAAmB,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;QAC9D,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACnC,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AA9BW,QAAA,0BAA0B,8BA8BrC;AAOF,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAGtC,CAAC;AAEJ;;;GAGG;AACI,MAAM,qCAAqC,GAAG,CACnD,SAAiB,EACjB,OAAoD,EACb,EAAE;IACzC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QACrC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,yBAAyB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAbW,QAAA,qCAAqC,yCAahD;AAEF,+DAA+D;AACxD,MAAM,+CAA+C,GAAG,GAAS,EAAE;IACxE,yBAAyB,CAAC,KAAK,EAAE,CAAC;AACpC,CAAC,CAAC;AAFW,QAAA,+CAA+C,mDAE1D"}
+{"version":3,"file":"accessTokenRefresh.js","sourceRoot":"","sources":["../../src/services/accessTokenRefresh.ts"],"names":[],"mappings":";;;AAAA,4CAA+C;AAE/C,MAAM,GAAG,GAAG,IAAA,qBAAY,EAAC,oBAAoB,CAAC,CAAC;AAE/C;;;GAGG;AACU,QAAA,gDAAgD,GAAG,GAAG,CAAC;AAEpE;;GAEG;AACI,MAAM,wBAAwB,GAAG,CAAC,WAAmB,EAAiB,EAAE;IAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAExE,CAAC;QACF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAtBW,QAAA,wBAAwB,4BAsBnC;AAEF;;;;GAIG;AACI,MAAM,SAAS,GAAG,CAAC,WAAmB,EAAiB,EAAE;IAC9D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAExE,CAAC;QACF,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;YAC9D,CAAC,CAAC,OAAO,CAAC,GAAG;YACb,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AApBW,QAAA,SAAS,aAoBpB;AAEF;;GAEG;AACI,MAAM,mCAAmC,GAAG,CACjD,WAAmB,EACnB,mBAA2B,wDAAgD,EAClE,EAAE;IACX,MAAM,eAAe,GAAG,IAAA,gCAAwB,EAAC,WAAW,CAAC,CAAC;IAC9D,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,eAAe,GAAG,gBAAgB,CAAC;AAC5C,CAAC,CAAC;AATW,QAAA,mCAAmC,uCAS9C;AAQF;;GAEG;AACI,MAAM,0BAA0B,GAAG,KAAK,EAAE,MAIhD,EAA4D,EAAE;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,IAAI,mBAAmB,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;YAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,GAAG,CAAC,IAAI,CAAC,4CAA4C,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;QAC9D,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACnC,OAAO;gBACL,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,YAAY,EAAE,MAAM,CAAC,YAAY;aAClC,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,CAAC,oCAAoC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AA9BW,QAAA,0BAA0B,8BA8BrC;AAOF,MAAM,yBAAyB,GAAG,IAAI,GAAG,EAGtC,CAAC;AAEJ;;;GAGG;AACI,MAAM,qCAAqC,GAAG,CACnD,SAAiB,EACjB,OAAoD,EACb,EAAE;IACzC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QACrC,yBAAyB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IACH,yBAAyB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAbW,QAAA,qCAAqC,yCAahD;AAEF,+DAA+D;AACxD,MAAM,+CAA+C,GAAG,GAAS,EAAE;IACxE,yBAAyB,CAAC,KAAK,EAAE,CAAC;AACpC,CAAC,CAAC;AAFW,QAAA,+CAA+C,mDAE1D"}

package/dist/utils/skills/claude-skill.js

@@ -8,7 +8,7 @@ exports.CLAUDE_SKILL_DIR = 'rivet';
 exports.CLAUDE_SKILL_FILENAME = 'SKILL.md';
 const AGENT_VARIANTS_SECTION = (0, shared_variants_protocol_1.buildAgentVariantsSection)({
     inChatEmphasis: 'IN THIS CHAT',
-    step9: `**Run all leased code-gen items IN PARALLEL.** Spawn one \`Task\` tool call per leased item in a single message — they execute concurrently. Use \`subagent_type: 'general-purpose'\` for every call. Do NOT pass a skill name (e.g. \`frontend-design:frontend-design\`) as \`subagent_type\` — skills are not agent types and Task will error with "Agent type … not found". If a relevant skill is installed (e.g. \`frontend-design\`), reference it in the sub-agent's prompt body instead. Each sub-agent:
+    step9: `**Run all code-gen items IN PARALLEL.** Spawn one \`Task\` tool call per work item in a single message — they execute concurrently. Use \`subagent_type: 'general-purpose'\` for every call. Do NOT pass a skill name (e.g. \`frontend-design:frontend-design\`) as \`subagent_type\` — skills are not agent types and Task will error with "Agent type … not found". If a relevant skill is installed (e.g. \`frontend-design\`), reference it in the sub-agent's prompt body instead. Each sub-agent:
    - Reads \`input.briefBody\` and \`input.target\`
    - Edits files in \`input.worktreePath\` (each variant has its own isolated worktree)
    - Calls \`report_variant_complete({ sessionId, workItemId, leaseId, attempt, status: 'succeeded' })\` itself. On failure, status \`'failed'\` with error description.`,

package/dist/utils/skills/cursor-rules.js

@@ -7,7 +7,7 @@ exports.CURSOR_RULES_FILENAME = 'rivet.mdc';
 const CURSOR_RULES_VERSION_MARKER = `rivet-rules-version: ${exports.CURSOR_RULES_VERSION}`;
 const AGENT_VARIANTS_SECTION = (0, shared_variants_protocol_1.buildAgentVariantsSection)({
     inChatEmphasis: 'in chat',
-    step9: `**Run all leased code-gen items IN PARALLEL** via parallel tool calls in a single response. For each:
+    step9: `**Run all code-gen items IN PARALLEL** via parallel tool calls in a single response. For each:
    - Read \`input.briefBody\` and \`input.target\`
    - Edit files in \`input.worktreePath\` (each variant has its own isolated worktree)
    - Call \`report_variant_complete({ sessionId, workItemId, leaseId, attempt, status: 'succeeded' })\`. On failure, status \`'failed'\` with error description.`,

package/dist/utils/skills/shared-variants-protocol.js

@@ -47,7 +47,7 @@ There are three sub-flows. Pick by project state:
    - \`target\` (optional): \`{ type: 'element'|'file'|'route', ref }\` — set this for refinement requests pinned to a specific element/file/route
    - \`projectPath\` (optional): defaults to the MCP server's cwd; pass explicitly if the variants target a different directory
 
-   Response: \`{ sessionId, stage: 'work_items_ready', mode: 'existing', leaseId, leaseTtlMs, variants: [{ variantId, briefId, label, workItem }], project: { projectPath, framework }, visualEditor? }\`. The server already detected the framework, opened the Rivet visual editor (share \`visualEditor.url\` with the user immediately), and leased every variant — you do NOT need to call \`detect_project\`, \`open_visual_editor\`, or \`continue_variants(request_work)\`. Each \`variants[i].workItem\` carries \`input.worktreePath\` (where to edit files) and \`attempt\`.
+   Response: \`{ sessionId, stage: 'work_items_ready', mode: 'existing', leaseId, leaseTtlMs, variants: [{ variantId, briefId, label, workItem }], project: { projectPath, framework }, visualEditor? }\`. The server already detected the framework, opened the Rivet visual editor (share \`visualEditor.url\` with the user immediately), and started every variant — you do NOT need to call \`detect_project\`, \`open_visual_editor\`, or \`continue_variants(request_work)\`. Each \`variants[i].workItem\` carries \`input.worktreePath\` (where to edit files) and \`attempt\`.
 
 2. ${opts.step9}
 
@@ -73,7 +73,7 @@ There are three sub-flows. Pick by project state:
 
 ### Sub-flow B: Fresh project (prompt-only) — use \`start_variants({ mode: 'zero_to_one' })\`
 
-For brand-new projects the user describes from scratch ("build me a Vite todo app", "make a Pomodoro timer", "scaffold a kanban board"), use the same single-call kickoff. The server derives the destination directory, opens the editor on it, leases all variants, and returns everything in one response. No in-chat approval gate.
+For brand-new projects the user describes from scratch ("build me a Vite todo app", "make a Pomodoro timer", "scaffold a kanban board"), use the same single-call kickoff. The server derives the destination directory, opens the editor on it, starts all variants, and returns everything in one response. No in-chat approval gate.
 
 1. **Call \`start_variants\`** with:
    - \`prompt\`: the user's request verbatim
@@ -92,7 +92,7 @@ For brand-new projects the user describes from scratch ("build me a Vite todo ap
 
 **Trigger:** the user provided inspiration URLs ("like stripe.com"), attached an image in chat (pasted screenshot/mockup), attached a video/gif/screen recording ("match this animation", "build the hover from this clip"), referenced an image or video file path (e.g. \`~/Desktop/mockup.png\`, \`~/Desktop/hover.mov\`), or supplied written design context. Image-only and video-only requests with no URLs are valid and belong in this sub-flow — do not fall back to Sub-flow B.
 
-Use \`create_zero_to_one_project\` for this sub-flow. \`start_variants({ mode: 'zero_to_one' })\` rejects any request whose \`sourceContext\` carries \`sourceUrls\`, \`sourceArtifacts\`, or \`sourceIntent\` — that handler is prompt-only (Sub-flow B). The source-research and brief-approval hops are only wired into \`create_zero_to_one_project\`.
+Use \`create_zero_to_one_project\` for this sub-flow. \`start_variants({ mode: 'zero_to_one' })\` rejects any request whose \`sourceContext\` carries \`sourceUrls\`, \`sourceArtifacts\`, or \`sourceIntent\` — that handler is prompt-only (Sub-flow B). The source-research hop is only wired into \`create_zero_to_one_project\`.
 
 1. **Call \`create_zero_to_one_project\`** with:
    - \`prompt\`: the user's request verbatim
@@ -112,7 +112,7 @@ Use \`create_zero_to_one_project\` for this sub-flow. \`start_variants({ mode: '
 
 3. **Call \`report_source_plan\`** with \`{ sessionId, workItemId, leaseId, attempt, sourcePlan }\`. Response: \`{ stage: 'awaiting_briefs', briefWorkItem, executionPlan, nextAction: 'report_variant_briefs' }\`.
 
-4. **From here, follow the brief-approval gate from Sub-flow A** (\`report_variant_briefs\` with N briefs, show in chat, \`approve_variant_briefs\` with \`confirmedByUser: true\` after the user confirms, then \`continue_variants({ action: 'request_work' })\`). Work items are \`static_preview\` or \`code_gen\` depending on \`executionPlan.mode\`. On commit, the apply payload is \`payload.kind === 'project-created'\` — the server materialized the chosen variant to \`destinationPath\`.
+4. **Report briefs and start generating — no approval gate.** Call \`report_variant_briefs\` with N briefs; the server starts every direction immediately and returns \`stage: 'work_items_ready'\`. Do NOT pause to ask the user to approve the briefs first. Then call \`continue_variants({ action: 'request_work' })\` and follow Sub-flow A steps 2-5. Work items are \`static_preview\` or \`code_gen\` depending on \`executionPlan.mode\`. On commit, the apply payload is \`payload.kind === 'project-created'\` — the server materialized the chosen variant to \`destinationPath\`.
 
 ---
 
@@ -126,7 +126,7 @@ ${describe_motion_protocol_1.DESCRIBE_MOTION_PROTOCOL}
 - Always pass the user's prompt verbatim — don't paraphrase.
 - Prefer \`start_variants\` (with the matching \`mode\`) over the older \`propose_variants\` → \`report_variant_briefs\` → \`approve_variant_briefs\` chain. The unified call also handles \`detect_project\`, \`open_visual_editor\`, and \`continue_variants(request_work)\` server-side. The older tools and standalone \`detect_project\` / \`open_visual_editor\` stay registered for the Visual Editor flow (point-and-click changes without variants).
 - For source-grounded fresh projects, run \`extract_inspiration_context\` FIRST and forward its output into \`start_variants\` — don't try to pack inspiration URLs into \`start_variants\` directly without extraction.
-- Briefs (when shown via \`propose_variants\` legacy flow) are PLAIN TEXT in chat. Do not render UI, open a browser tab, or fabricate a URL.
+- Briefs are never an approval gate — reporting them starts the directions immediately. Do not pause to ask the user "do these look good?" before generating. If you mention briefs in chat at all they are PLAIN TEXT; do not render UI, open a browser tab, or fabricate a URL.
 - The user picks AFTER seeing the variants render LIVE in the iframe, not before. Hand off to the iframe chip for visual cycling + commit.
 - Don't dump diffs in chat by default. The iframe chip is the primary review surface. If the user explicitly asks "show me the diffs", then print them.
 - Parallel code-gen is the only step where you fan out — every other step is one tool call.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rivet-design",
-  "version": "0.9.9",
+  "version": "0.10.0",
   "description": "Local visual web development tool with AI-powered code modification",
   "main": "dist/index.js",
   "workspaces": [
@@ -44,7 +44,8 @@
     "check:pre-commit": "npx lint-staged && yarn build && cd src/ui && yarn typecheck && cd ../.. && cd src/proxy && yarn build && cd ../.. && cd desktop/renderer && yarn build && cd ../..",
     "check:pre-push": "yarn test",
     "desktop": "yarn build && cd desktop && yarn dev",
-    "start:hosted-demo": "node dist/hosted-demo.js"
+    "start:hosted-demo": "node dist/hosted-demo.js",
+    "start:prototype-host": "node dist/prototype-host.js"
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.1.42",