worktrust 0.9.2 → 0.9.4

package/README.md

@@ -177,6 +177,8 @@ nothing it does not:
 | `timing` | how fast the stretch moved: seconds from your first turn to the first action and from the first change to the first check, the actions and seconds from a failure to the change that answered it, the calls from a failed check to it passing, and the calls back to work after a compaction; medians from the order and the clocks, never what was said (0.9.0) |
 | `hygiene` | risk and hygiene: rollbacks, privileged commands (sudo, a forced push), hooks skipped (--no-verify), secrets touched (a .env printed, a private key read), destructive commands and how many a look or a check came before, the answer to a guard (retried, changed, stopped), and whether a check followed delivery; counts only, never the command or the path (0.9.1) |
 | `route` | the route the work took: branches made, pushes straight to the default branch, and of the stretch's own commits those over twenty files, a fix that followed another, those naming an issue, and the changed CI, script and docs files; counts only, never a subject, a branch name or a path (0.9.2) |
+| `adaptation` | evidence and adaptation: what the stretch read by kind (docs, tests, logs, config, source, the web), a plan written again after a failure, a model changed right after a failure, two or more agents whose work a check met, and outages (overloaded, rate-limited, timed out) and how many the work went on past; counts only, never a path or a message (0.9.3) |
+| `reach` | the work's reach and its plan: commands on infrastructure (terraform, kubectl, helm, docker), data (psql, sqlite, bq, dbt) and cloud (aws, gcloud, az, supabase, vercel); plan or roadmap documents written and whether one came before the first code change; reviews approved, sent back or commented and issues opened or closed from the terminal; counts and one flag, never a command, a file name or a path (0.9.4) |
 | `collector_version` | the CLI version that measured it |
 | `seq`, `prev`, `hash` | the line's place, the hash of the line before it, and its own hash |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "worktrust",
-  "version": "0.9.2",
+  "version": "0.9.4",
   "description": "Couple this computer to WorkTrust: approve a code in your browser, and every AI app here reports what you built. Metadata only, no dependencies.",
   "type": "module",
   "bin": {

package/preserve-lines.mjs

@@ -127,6 +127,19 @@ export function archiveLine(entry, behaviour = null, { ids = {}, collector, salt
     const route = Object.fromEntries(ROUTE_KEYS.filter((key) => whole(entry.route[key])).map((key) => [key, entry.route[key]]));
     if (Object.keys(route).length > 0) line.route = route;
   }
+  // 0.9.3: evidence read and adaptation; whole counts, and reads by kind.
+  if (entry.adaptation && typeof entry.adaptation === "object") {
+    const adaptation = Object.fromEntries(ADAPTATION_KEYS.filter((key) => whole(entry.adaptation[key])).map((key) => [key, entry.adaptation[key]]));
+    const sources = entry.adaptation.sources && typeof entry.adaptation.sources === "object" ? Object.fromEntries(READ_KINDS.filter((kind) => whole(entry.adaptation.sources[kind]) && entry.adaptation.sources[kind] > 0).map((kind) => [kind, entry.adaptation.sources[kind]])) : {};
+    if (Object.keys(sources).length > 0) adaptation.sources = sources;
+    if (Object.keys(adaptation).length > 0) line.adaptation = adaptation;
+  }
+  // 0.9.4: the work's reach and its plan; whole counts, and whether a plan came first.
+  if (entry.reach && typeof entry.reach === "object") {
+    const reach = Object.fromEntries(REACH_KEYS.filter((key) => whole(entry.reach[key])).map((key) => [key, entry.reach[key]]));
+    if (typeof entry.reach.plan_first === "boolean" && reach.plan_docs) reach.plan_first = entry.reach.plan_first;
+    if (Object.keys(reach).length > 0) line.reach = reach;
+  }
   const risk = pick(entry.risk, ["proposed", "refused", "run"]);
   if (risk && risk.proposed > 0 && risk.refused + risk.run <= risk.proposed) line.risk = risk;
   const keyed = (record, keys) => { const kept = Object.entries(record && typeof record === "object" ? record : {}).filter(([key, n]) => keys.includes(key) && whole(n) && n > 0).sort(); return kept.length ? Object.fromEntries(kept) : null; };
@@ -186,12 +199,17 @@ export function archiveEntries(dir, ownKey) {
 /** The furthest step a stretch reached on the computer (0.8.9). */
 const STAGES = ["attempted", "verified", "committed", "pushed", "pr", "deployed"];
 /** How fast a stretch moved (0.9.0). */
+/** The work's reach and its plan (0.9.4). */
+const REACH_KEYS = ["infra", "data", "cloud", "plan_docs", "reviews_approved", "reviews_changes", "reviews_commented", "issues_opened", "issues_closed"];
+/** Evidence read and adaptation (0.9.3). */
+const ADAPTATION_KEYS = ["replans", "escalations", "reconciled", "outages", "outages_continued"];
+const READ_KINDS = ["docs", "tests", "logs", "config", "source", "web"];
 /** The route the work took (0.9.2). */
 const ROUTE_KEYS = ["branches", "pushes_to_main", "commits_large", "fix_followups", "issue_refs", "ci_files", "script_files", "doc_files"];
 /** Risk and hygiene (0.9.1). */
 const HYGIENE_KEYS = ["rollbacks", "privileged", "bypasses", "secrets", "destructive", "destructive_checked", "guard_retried", "guard_changed", "guard_stopped"];
 const TIMING_KEYS = ["first_action_s", "first_check_s", "detect_actions", "detect_s", "recovery_calls", "resume_actions"];
-export const DERIVED_KEYS = ["signals", "analyzer_version", "verification", "unconfirmed", "delivery", "recovery", "delegation", "context", "routing", "steering", "tools", "complexity", "oversight", "planning", "changes", "autonomy", "authorship", "framing", "quality", "risk", "tool_mix", "reads", "context_files", "stage", "timing", "hygiene", "route", "interrupts", "steers", "utc_offset"];
+export const DERIVED_KEYS = ["signals", "analyzer_version", "verification", "unconfirmed", "delivery", "recovery", "delegation", "context", "routing", "steering", "tools", "complexity", "oversight", "planning", "changes", "autonomy", "authorship", "framing", "quality", "risk", "tool_mix", "reads", "context_files", "stage", "timing", "hygiene", "route", "adaptation", "reach", "interrupts", "steers", "utc_offset"];
 export function supplementFor(line, earlier) {
   const missing = DERIVED_KEYS.filter((key) => line[key] !== undefined && !earlier.some((old) => old[key] !== undefined));
   if (missing.length === 0) return null;

package/stretch-evidence.mjs

@@ -49,7 +49,19 @@ const MARKS = [
   // 0.9.2: the route the work took: a branch of its own, or a push straight to the default branch.
   ["branch", /\bgit\s+(checkout\s+-b|switch\s+-c)\s|\bgit\s+branch\s+(?!-)[\w./-]+/],
   ["push_main", /\bgit\s+push\b[^\n;&|]*\s(main|master)\b/],
+  // 0.9.4: the kind of system a command worked on, and reviews and issues handled from the terminal.
+  ["infra", /(^|[\s;&|(])(terraform|tofu|pulumi|kubectl|helm|kustomize|ansible(-playbook)?|docker(\s+compose)?|docker-compose|podman)\s/],
+  ["data", /(^|[\s;&|(])(psql|pg_dump|pg_restore|mysql|sqlite3|duckdb|mongosh|redis-cli|bq|snowsql|dbt|clickhouse(-client)?)\b/],
+  ["cloud", /(^|[\s;&|(])(aws|gcloud|gsutil|az|vercel|netlify|fly|flyctl|wrangler|supabase|firebase|heroku|doctl)\s/],
+  ["review_approve", /\bgh\s+pr\s+review\b[^\n;&|]*\s(-a|--approve)\b/],
+  ["review_changes", /\bgh\s+pr\s+review\b[^\n;&|]*\s(-r|--request-changes)\b/],
+  ["review_comment", /\bgh\s+pr\s+review\b[^\n;&|]*\s(-c|--comment)\b/],
+  ["issue_open", /\bgh\s+issue\s+create\b/],
+  ["issue_close", /\bgh\s+issue\s+close\b/],
 ];
+/** A plan or roadmap the work wrote down (0.9.4), by the file's name; the name never leaves. */
+const PLAN_DOC = /(^|[\\/])(PLAN|ROADMAP|DESIGN|SPEC|RFC|ADR)[\w.-]*\.(md|mdx|txt)$|(^|[\\/])(plans?|roadmaps?|rfcs?|adrs?|specs?)[\\/][^\\/]+\.(md|mdx)$|\.plan\.md$/i;
+const WRITE_TOOLS = new Set(["Write", "Edit", "MultiEdit", "write_file", "edit_file", "create_file"]);
 const SECRET_FILE = /(^|[\/\s'"])(\.env(\.[\w-]+)?|id_(rsa|ed25519|ecdsa)|[\w.-]+\.(pem|p12|pfx|key)|credentials(\.json)?|\.npmrc|\.netrc|\.pgpass)(['"\s]|$)/;
 const PRINTS = /\b(cat|less|more|head|tail|bat|type|Get-Content|grep|sed|awk|cp|scp|base64)\b/;
 const READ_TOOLS = new Set(["Read", "read_file", "view", "open_file"]);
@@ -58,10 +70,29 @@ export const marksOf = (block) => {
   const command = SHELL_TOOLS.has(name) ? block.input?.command ?? block.input?.CommandLine ?? block.input?.cmd : null;
   const path = READ_TOOLS.has(name) ? block.input?.file_path ?? block.input?.path ?? null : null;
   const marks = typeof command === "string" ? MARKS.filter(([, pattern]) => pattern.test(command)).map(([mark]) => mark) : [];
+  const written = WRITE_TOOLS.has(name) ? block.input?.file_path ?? block.input?.path ?? null : null;
+  if (typeof written === "string" && PLAN_DOC.test(written)) marks.push("plan_doc");
   if ((typeof path === "string" && SECRET_FILE.test(path)) || (typeof command === "string" && PRINTS.test(command) && SECRET_FILE.test(command))) marks.push("secret");
   return marks;
 };
 
+/**
+ * WHAT A READ WAS (0.9.3), by kind: docs, tests, logs, config, source, or the web. The path is read here and never kept.
+ */
+const READ_KINDS = [
+  ["docs", /(^|[\\/])docs?[\\/]|(^|[\\/])README|\.(md|mdx|rst|txt)$/i],
+  ["tests", /(^|[\\/])(__tests__|tests?|spec|e2e)[\\/]|\.(test|spec)\.[cm]?[jt]sx?$|_test\.(go|py|rb)$/],
+  ["logs", /\.log$|(^|[\\/])logs?[\\/]/i],
+  ["config", /\.(json|ya?ml|toml|ini|env\.example)$|(^|[\\/])\.[\w-]+rc$|config/i],
+];
+export const readKindOf = (block) => {
+  const name = String(block?.name ?? "");
+  if (/^(WebFetch|WebSearch|web_fetch|web_search)$/.test(name)) return "web";
+  const path = READ_TOOLS.has(name) ? block.input?.file_path ?? block.input?.path ?? null : null;
+  if (typeof path !== "string") return null;
+  return READ_KINDS.find(([, pattern]) => pattern.test(path))?.[0] ?? "source";
+};
+
 /**
  * A TOOL RESULT AS THE STRETCH READS IT (0.8.1): its call's id, whether it failed, and, read here and never kept, WHO
  * refused it when it was refused: the PERSON (Claude Code's fixed sentence when they decline a tool use or a plan) or a
@@ -69,18 +100,21 @@ export const marksOf = (block) => {
  */
 const PERSON_REFUSED = /^\s*(The user doesn't want to (proceed|take this action)|User rejected|The user rejected|The user declined)/i;
 const GUARD_REFUSED = /^\s*Permission for this (command|action) was denied by/i;
+const OUTAGE = /\b(overloaded|rate[ -]?limit(ed)?|too many requests|429|503|service unavailable|timed? ?out|ETIMEDOUT|ECONNRESET|ECONNREFUSED|ENOTFOUND)\b/i;
 export const resultOf = (block) => {
   const text = typeof block.content === "string" ? block.content : Array.isArray(block.content) ? block.content.map((part) => (part && typeof part.text === "string" ? part.text : "")).join("") : "";
   const failed = block.is_error === true;
   // 0.8.5: a reader that could not see the outcome (Codex's code mode, a background terminal) says so; unknown is never a pass.
   if (!failed && block.outcome === "unknown") return { id: block.tool_use_id, failed: null, refusal: null };
-  return { id: block.tool_use_id, failed, refusal: failed && PERSON_REFUSED.test(text) ? "person" : failed && GUARD_REFUSED.test(text) ? "guard" : null };
+  // 0.9.3: an OUTAGE (the model or a tool overloaded, rate-limited, timed out, unreachable), read here and never kept.
+  const outage = failed && OUTAGE.test(text);
+  return { id: block.tool_use_id, failed, refusal: failed && PERSON_REFUSED.test(text) ? "person" : failed && GUARD_REFUSED.test(text) ? "guard" : null, ...(outage ? { outage: true } : {}) };
 };
 /** A to-do list the agent wrote (TodoWrite): how many items and how many done, never what they say. */
 const planOf = (block) => (block.name === "TodoWrite" && Array.isArray(block.input?.todos) ? { items: block.input.todos.length, done: block.input.todos.filter((todo) => todo && todo.status === "completed").length } : null);
 
 /** One tool call as the stretch reads it: its id, its kinds, its FAMILY (the tool and its check kinds) and a digest of its input (compared, never kept). */
-export const callOf = (block) => { const kinds = callKindsOf(block), plan = planOf(block), marks = marksOf(block); return { id: block.id, kinds, ...(marks.length ? { marks } : {}), family: `${String(block.name)}|${kinds.join("+")}`, digest: createHash("sha256").update(JSON.stringify(block.input ?? null)).digest("base64url").slice(0, 16), ...(plan ? { plan } : {}) }; };
+export const callOf = (block) => { const kinds = callKindsOf(block), plan = planOf(block), marks = marksOf(block), read = readKindOf(block); return { id: block.id, kinds, ...(marks.length ? { marks } : {}), ...(read ? { read } : {}), family: `${String(block.name)}|${kinds.join("+")}`, digest: createHash("sha256").update(JSON.stringify(block.input ?? null)).digest("base64url").slice(0, 16), ...(plan ? { plan } : {}) }; };
 
 /**
  * VERIFICATION PER STRETCH (0.7.1; framework L7, L12): per kind of check, how many ran and how many failed; per step of
@@ -453,9 +487,70 @@ function routeOf(messages) {
   return branches + pushesToMain > 0 ? { ...(branches ? { branches } : {}), ...(pushesToMain ? { pushes_to_main: pushesToMain } : {}) } : null;
 }
 
+/**
+ * EVIDENCE AND ADAPTATION (0.9.3): what the stretch read, by kind; a plan written again after a failure; a model change
+ * within three calls after a failure (escalation); two or more agents whose work a check met before the next delivery
+ * (reconciliation, a proxy); and outages (the model or a tool overloaded, rate-limited, timed out) and how many the work
+ * went on past (a later call succeeded). Counts only.
+ */
+function adaptationOf(messages) {
+  const results = new Map();
+  for (const message of messages) for (const result of message.results ?? []) results.set(result.id, result);
+  const sources = {}, out = { replans: 0, escalations: 0, reconciled: 0, outages: 0, outages_continued: 0 };
+  let failedSince = false, lastFailureCall = null, index = 0, model = null, agentsOpen = 0, outageOpen = false;
+  for (const message of messages) {
+    if (message.bridge) continue;
+    if (message.type === "assistant" && message.model) {
+      // Once per failure: the change that answered it, not every switch after it.
+      if (model && message.model !== model && lastFailureCall !== null && index - lastFailureCall <= 3) { out.escalations += 1; lastFailureCall = null; }
+      model = message.model;
+    }
+    for (const call of message.calls ?? []) {
+      index += 1;
+      const tool = call.family.split("|")[0], result = results.get(call.id);
+      if (call.read) sources[call.read] = (sources[call.read] ?? 0) + 1;
+      if (call.plan && failedSince) { out.replans += 1; failedSince = false; }
+      if (tool === "Agent" || tool === "Task") agentsOpen += 1;
+      if (call.kinds.some((kind) => CHECK_KINDS.includes(kind)) && agentsOpen >= 2) { out.reconciled += 1; agentsOpen = 0; }
+      if (call.kinds.some((kind) => DELIVERY_KINDS.includes(kind))) agentsOpen = 0;
+      if (result?.outage) { out.outages += 1; outageOpen = true; }
+      else if (outageOpen && result?.failed === false) { out.outages_continued += 1; outageOpen = false; }
+      if (result?.failed === true) { failedSince = true; lastFailureCall = index; }
+    }
+  }
+  const kept = Object.fromEntries(Object.entries(out).filter(([, value]) => value > 0));
+  if (Object.keys(sources).length > 0) kept.sources = sources;
+  return Object.keys(kept).length > 0 ? kept : null;
+}
+
+/**
+ * THE WORK'S REACH AND ITS PLAN (0.9.4): commands on infrastructure, data and cloud; plan or roadmap documents written,
+ * and whether one came before the first code change; reviews approved, sent back or commented and issues opened or closed
+ * from the terminal. Counts, and one flag.
+ */
+function reachOf(messages) {
+  const results = new Map();
+  for (const message of messages) for (const result of message.results ?? []) results.set(result.id, result);
+  const out = { infra: 0, data: 0, cloud: 0, plan_docs: 0, reviews_approved: 0, reviews_changes: 0, reviews_commented: 0, issues_opened: 0, issues_closed: 0 };
+  const KEY = { infra: "infra", data: "data", cloud: "cloud", plan_doc: "plan_docs", review_approve: "reviews_approved", review_changes: "reviews_changes", review_comment: "reviews_commented", issue_open: "issues_opened", issue_close: "issues_closed" };
+  let changed = false, planFirst = null;
+  for (const message of messages) {
+    if (message.bridge) continue;
+    for (const call of message.calls ?? []) {
+      const tool = call.family.split("|")[0], marks = call.marks ?? [], result = results.get(call.id);
+      if (marks.includes("plan_doc") && !changed && planFirst === null) planFirst = true;
+      if (EDIT_TOOLS.has(tool) && !marks.includes("plan_doc")) { if (!changed && planFirst === null) planFirst = false; changed = true; }
+      for (const mark of marks) if (KEY[mark] && result?.failed !== true) out[KEY[mark]] += 1;
+    }
+  }
+  const kept = Object.fromEntries(Object.entries(out).filter(([, value]) => value > 0));
+  if (out.plan_docs > 0) kept.plan_first = planFirst === true;
+  return Object.keys(kept).length > 0 ? kept : null;
+}
+
 /** The stretch's whole derived record; `helpers` are the hook's own readers of a human turn, so both read it the same way. */
 export function deriveStretch(messages, helpers) {
   const context = contextOf(messages, helpers), routing = routingOf(messages), steering = steeringOf(messages, helpers);
-  const timing = timingOf(messages, helpers), hygiene = hygieneOf(messages), route = routeOf(messages), tools = toolsOf(messages), oversight = oversightOf(messages), planning = planningOf(messages), autonomy = autonomyOf(messages), practice = practiceOf(messages, helpers);
-  return { ...(practice ?? {}), ...(oversight ? { oversight } : {}), ...(planning ? { planning } : {}), ...(autonomy ? { autonomy } : {}), ...verificationOf(messages, helpers), ...(context ? { context } : {}), ...(routing ? { routing } : {}), ...(steering ? { steering } : {}), ...(tools ? { tools } : {}), ...(timing ? { timing } : {}), ...(hygiene ? { hygiene } : {}), ...(route ? { route } : {}) };
+  const timing = timingOf(messages, helpers), hygiene = hygieneOf(messages), route = routeOf(messages), adaptation = adaptationOf(messages), reach = reachOf(messages), tools = toolsOf(messages), oversight = oversightOf(messages), planning = planningOf(messages), autonomy = autonomyOf(messages), practice = practiceOf(messages, helpers);
+  return { ...(practice ?? {}), ...(oversight ? { oversight } : {}), ...(planning ? { planning } : {}), ...(autonomy ? { autonomy } : {}), ...verificationOf(messages, helpers), ...(context ? { context } : {}), ...(routing ? { routing } : {}), ...(steering ? { steering } : {}), ...(tools ? { tools } : {}), ...(timing ? { timing } : {}), ...(hygiene ? { hygiene } : {}), ...(route ? { route } : {}), ...(adaptation ? { adaptation } : {}), ...(reach ? { reach } : {}) };
 }

package/worktrust.mjs

@@ -73,7 +73,7 @@ const command = args.find((arg, at) => !arg.startsWith("--") && !(at > 0 && VALU
 const flag = (name) => { const at = args.indexOf(`--${name}`); return at >= 0 ? args[at + 1] : undefined; };
 const has = (name) => args.includes(`--${name}`);
 /** This CLI's version, said to the door so the app can tell which computer runs an old one (check-cli-package holds it equal to package.json). */
-const CLI_VERSION = "0.9.2";
+const CLI_VERSION = "0.9.4";
 const ORIGIN = (flag("origin") ?? process.env.WORKTRUST_ORIGIN ?? "https://app.worktrust.io").replace(/\/$/, "");
 const MCP = flag("url") ?? process.env.WORKTRUST_MCP_URL ?? `${ORIGIN}/api/mcp`;
 const HOME_DIR = join(homedir(), ".worktrust");