worktrust 0.9.7 → 0.9.9

package/README.md

@@ -184,6 +184,8 @@ nothing it does not:
 | `reach` | the work's reach and its plan: commands on infrastructure (terraform, kubectl, helm, docker), data (psql, sqlite, bq, dbt) and cloud (aws, gcloud, az, supabase, vercel); plan or roadmap documents written and whether one came before the first code change; reviews approved, sent back or commented and issues opened or closed from the terminal; counts and one flag, never a command, a file name or a path (0.9.4) |
 | `hygiene.secrets` | counts a secret touched only when a file that holds one (a .env, a private key, credentials.json, .aws/credentials) is shown or copied (cat, head, tail, base64, cp); a search for a word (grep, sed, awk) is no read (0.9.5) |
 | `hygiene.secrets` | counts a secret shown only when a reader (cat, head, tail, base64, cp) takes the file as its own argument; a command that uses a .env and reads its output, and a template (.env.example), are no secret shown (0.9.6) |
+| `outcomes` | outcomes of the steps: per kind of check whether its first run passed, delivery attempts that failed, a model change and a new plan after a failure each followed by a passing check; and a check whose output goes through a pipe is read from its output's words (an error fails, a pass passes, a silent type check or lint passes, anything else is unconfirmed), never from the pipe's exit code (0.9.8) |
+| `retrieval` | retrieval and grounding: searches (grep, rg, find, Grep, Glob, a web search, an MCP search tool), the same search again, a search followed by a read or a change (found) or by another search (again), searches before the first change and right after a failure, and deliveries with docs, tests or a search since the last change (grounded); counts only, nothing searched is kept (0.9.9) |
 | `collector_version` | the CLI version that measured it |
 | `seq`, `prev`, `hash` | the line's place, the hash of the line before it, and its own hash |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "worktrust",
-  "version": "0.9.7",
+  "version": "0.9.9",
   "description": "Couple this computer to WorkTrust: approve a code in your browser, and every AI app here reports what you built. Metadata only, no dependencies.",
   "type": "module",
   "bin": {

package/preserve-lines.mjs

@@ -140,6 +140,18 @@ export function archiveLine(entry, behaviour = null, { ids = {}, collector, salt
     if (typeof entry.reach.plan_first === "boolean" && reach.plan_docs) reach.plan_first = entry.reach.plan_first;
     if (Object.keys(reach).length > 0) line.reach = reach;
   }
+  // 0.9.8: outcomes of the steps; whole counts, and first-pass per known kind of check.
+  if (entry.outcomes && typeof entry.outcomes === "object") {
+    const outcomes = Object.fromEntries(OUTCOME_KEYS.filter((key) => whole(entry.outcomes[key])).map((key) => [key, entry.outcomes[key]]));
+    const first = entry.outcomes.first_pass && typeof entry.outcomes.first_pass === "object" ? Object.fromEntries(CHECK_KINDS_KEPT.filter((kind) => typeof entry.outcomes.first_pass[kind] === "boolean").map((kind) => [kind, entry.outcomes.first_pass[kind]])) : {};
+    if (Object.keys(first).length > 0) outcomes.first_pass = first;
+    if (Object.keys(outcomes).length > 0) line.outcomes = outcomes;
+  }
+  // 0.9.9: retrieval and grounding; whole counts only.
+  if (entry.retrieval && typeof entry.retrieval === "object") {
+    const retrieval = Object.fromEntries(RETRIEVAL_KEYS.filter((key) => whole(entry.retrieval[key])).map((key) => [key, entry.retrieval[key]]));
+    if (Object.keys(retrieval).length > 0) line.retrieval = retrieval;
+  }
   const risk = pick(entry.risk, ["proposed", "refused", "run"]);
   if (risk && risk.proposed > 0 && risk.refused + risk.run <= risk.proposed) line.risk = risk;
   const keyed = (record, keys) => { const kept = Object.entries(record && typeof record === "object" ? record : {}).filter(([key, n]) => keys.includes(key) && whole(n) && n > 0).sort(); return kept.length ? Object.fromEntries(kept) : null; };
@@ -199,6 +211,11 @@ export function archiveEntries(dir, ownKey) {
 /** The furthest step a stretch reached on the computer (0.8.9). */
 const STAGES = ["attempted", "verified", "committed", "pushed", "pr", "deployed"];
 /** How fast a stretch moved (0.9.0). */
+/** Retrieval and grounding (0.9.9). */
+const RETRIEVAL_KEYS = ["searches", "repeated", "found", "again", "before_change", "after_failure", "deliveries", "grounded"];
+/** Outcomes of the steps (0.9.8). */
+const OUTCOME_KEYS = ["deliveries_failed", "escalations_helped", "replans_helped"];
+const CHECK_KINDS_KEPT = ["test", "typecheck", "lint", "build", "gate", "ci", "security"];
 /** The work's reach and its plan (0.9.4). */
 const REACH_KEYS = ["infra", "data", "cloud", "plan_docs", "reviews_approved", "reviews_changes", "reviews_commented", "issues_opened", "issues_closed"];
 /** Evidence read and adaptation (0.9.3). */
@@ -209,7 +226,7 @@ const ROUTE_KEYS = ["branches", "pushes_to_main", "commits_large", "fix_followup
 /** Risk and hygiene (0.9.1). */
 const HYGIENE_KEYS = ["rollbacks", "privileged", "bypasses", "secrets", "destructive", "destructive_checked", "guard_retried", "guard_changed", "guard_stopped"];
 const TIMING_KEYS = ["first_action_s", "first_check_s", "detect_actions", "detect_s", "recovery_calls", "resume_actions"];
-export const DERIVED_KEYS = ["signals", "analyzer_version", "verification", "unconfirmed", "delivery", "recovery", "delegation", "context", "routing", "steering", "tools", "complexity", "oversight", "planning", "changes", "autonomy", "authorship", "framing", "quality", "risk", "tool_mix", "reads", "context_files", "stage", "timing", "hygiene", "route", "adaptation", "reach", "interrupts", "steers", "utc_offset"];
+export const DERIVED_KEYS = ["signals", "analyzer_version", "verification", "unconfirmed", "delivery", "recovery", "delegation", "context", "routing", "steering", "tools", "complexity", "oversight", "planning", "changes", "autonomy", "authorship", "framing", "quality", "risk", "tool_mix", "reads", "context_files", "stage", "timing", "hygiene", "route", "adaptation", "reach", "outcomes", "retrieval", "interrupts", "steers", "utc_offset"];
 export function supplementFor(line, earlier) {
   const missing = DERIVED_KEYS.filter((key) => line[key] !== undefined && !earlier.some((old) => old[key] !== undefined));
   if (missing.length === 0) return null;

package/stretch-evidence.mjs

@@ -99,6 +99,34 @@ export const readKindOf = (block) => {
   return READ_KINDS.find(([, pattern]) => pattern.test(path))?.[0] ?? "source";
 };
 
+/**
+ * A CHECK WHOSE OUTPUT GOES THROUGH A PIPE (0.9.8): `tsc | tail -3` exits with tail's code, so the exit code says nothing
+ * about the check (68% of the owner's checks were so). Outside quotes, the piece holding the check pipes into another
+ * command and no pipefail is set. Its outcome is then read from its output's words, here and never kept.
+ */
+/** A shell command that is a search (0.9.9): its first word, outside quotes; the pattern is never kept. */
+export const shellSearch = (block) => {
+  if (!SHELL_TOOLS.has(String(block?.name ?? ""))) return false;
+  const raw = block.input?.command ?? block.input?.CommandLine ?? block.input?.cmd;
+  return typeof raw === "string" && raw.split(/;|&&|\n/).some((piece) => /^\s*(rg|grep|egrep|fgrep|ag|ack|fd|find|git\s+grep|locate)\b/.test(piece.split("|")[0]));
+};
+/** A shell command that reads a file (cat, sed -n, head, tail, less, bat): after a search, it found something (0.9.9). */
+export const shellReads = (block) => {
+  if (!SHELL_TOOLS.has(String(block?.name ?? ""))) return false;
+  const raw = block.input?.command ?? block.input?.CommandLine ?? block.input?.cmd;
+  return typeof raw === "string" && /^\s*(cat|sed\s+-n|head|tail|less|bat|nl|awk)\b/.test(raw.split("|")[0]);
+};
+export const pipedCheck = (block) => {
+  if (!SHELL_TOOLS.has(String(block?.name ?? ""))) return false;
+  const raw = block.input?.command ?? block.input?.CommandLine ?? block.input?.cmd;
+  if (typeof raw !== "string" || /pipefail/.test(raw)) return false;
+  const bare = raw.replace(/'[^']*'/g, "''").replace(/"(?:[^"\\]|\\.)*"/g, '""');
+  return bare.split(/;|&&|\n/).some((piece) => /\|(?!\|)/.test(piece.replace(/\|\|/g, "")) && callKindsOf({ name: "Bash", input: { command: piece.split("|")[0] } }).some((kind) => CHECK_KINDS.includes(kind)));
+};
+const FAIL_WORDS = /\berror TS\d+|\b\d+ (errors?|failed|failing)\b(?<!\b0 errors?)(?<!\b0 failed)|\bFAIL(ED)?\b|✗|✖|\bAssertionError\b|\bELIFECYCLE\b|\bnpm ERR!|\bTraceback\b|\b(gate|verify|exit)=[1-9]/;
+const PASS_WORDS = /\bPASS(ED)?\b|\bpassed\b|✓|✔|\b0 (errors?|failed|problems?)\b|\b(gate|verify|exit|tsc)=0\b|\ball tests passed\b|\bassertions hold\b/i;
+export const outputVerdict = (text) => (FAIL_WORDS.test(text) ? "fail" : PASS_WORDS.test(text) ? "pass" : null);
+
 /**
  * A TOOL RESULT AS THE STRETCH READS IT (0.8.1): its call's id, whether it failed, and, read here and never kept, WHO
  * refused it when it was refused: the PERSON (Claude Code's fixed sentence when they decline a tool use or a plan) or a
@@ -114,13 +142,14 @@ export const resultOf = (block) => {
   if (!failed && block.outcome === "unknown") return { id: block.tool_use_id, failed: null, refusal: null };
   // 0.9.3: an OUTAGE (the model or a tool overloaded, rate-limited, timed out, unreachable), read here and never kept.
   const outage = failed && OUTAGE.test(text);
-  return { id: block.tool_use_id, failed, refusal: failed && PERSON_REFUSED.test(text) ? "person" : failed && GUARD_REFUSED.test(text) ? "guard" : null, ...(outage ? { outage: true } : {}) };
+  const words = outputVerdict(text), silent = /^\s*(\((Bash|Command|Tool) (completed|ran|returned) with no output\)|no output)?\s*$/i.test(text);
+  return { id: block.tool_use_id, failed, refusal: failed && PERSON_REFUSED.test(text) ? "person" : failed && GUARD_REFUSED.test(text) ? "guard" : null, ...(outage ? { outage: true } : {}), ...(words ? { words } : {}), ...(silent ? { silent: true } : {}) };
 };
 /** A to-do list the agent wrote (TodoWrite): how many items and how many done, never what they say. */
 const planOf = (block) => (block.name === "TodoWrite" && Array.isArray(block.input?.todos) ? { items: block.input.todos.length, done: block.input.todos.filter((todo) => todo && todo.status === "completed").length } : null);
 
 /** One tool call as the stretch reads it: its id, its kinds, its FAMILY (the tool and its check kinds) and a digest of its input (compared, never kept). */
-export const callOf = (block) => { const kinds = callKindsOf(block), plan = planOf(block), marks = marksOf(block), read = readKindOf(block); return { id: block.id, kinds, ...(marks.length ? { marks } : {}), ...(read ? { read } : {}), family: `${String(block.name)}|${kinds.join("+")}`, digest: createHash("sha256").update(JSON.stringify(block.input ?? null)).digest("base64url").slice(0, 16), ...(plan ? { plan } : {}) }; };
+export const callOf = (block) => { const kinds = callKindsOf(block), plan = planOf(block), marks = marksOf(block), read = readKindOf(block), piped = pipedCheck(block), search = shellSearch(block), shellRead = shellReads(block); return { id: block.id, kinds, ...(marks.length ? { marks } : {}), ...(read ? { read } : {}), ...(piped ? { piped } : {}), ...(search ? { search } : {}), ...(shellRead ? { shellRead } : {}), family: `${String(block.name)}|${kinds.join("+")}`, digest: createHash("sha256").update(JSON.stringify(block.input ?? null)).digest("base64url").slice(0, 16), ...(plan ? { plan } : {}) }; };
 
 /**
  * VERIFICATION PER STRETCH (0.7.1; framework L7, L12): per kind of check, how many ran and how many failed; per step of
@@ -554,9 +583,90 @@ function reachOf(messages) {
   return Object.keys(kept).length > 0 ? kept : null;
 }
 
+/**
+ * OUTCOMES OF THE STEPS (0.9.8): per kind of check, whether its FIRST run passed (first-pass, the quality of the first
+ * try); delivery attempts that did not go through (a push or deploy refused or failed); and what HELPED: a model change,
+ * and a new plan, after a failure, each followed by a passing check before the next failure. Counts and flags.
+ */
+function outcomesOf(messages) {
+  const results = new Map();
+  for (const message of messages) for (const result of message.results ?? []) results.set(result.id, result);
+  const firstPass = {}, out = { deliveries_failed: 0, escalations_helped: 0, replans_helped: 0 };
+  let model = null, failedAt = null, index = 0, pending = null; // pending: what came after the last failure ("model" | "plan")
+  for (const message of messages) {
+    if (message.bridge) continue;
+    if (message.type === "assistant" && message.model) { if (model && message.model !== model && failedAt !== null && index - failedAt <= 3 && !pending) pending = "model"; model = message.model; }
+    for (const call of message.calls ?? []) {
+      index += 1;
+      const result = results.get(call.id);
+      if (call.plan && failedAt !== null && !pending) pending = "plan";
+      const checks = call.kinds.filter((kind) => CHECK_KINDS.includes(kind));
+      for (const kind of checks) if (firstPass[kind] === undefined && (result?.failed === true || result?.failed === false)) firstPass[kind] = result.failed === false;
+      if (call.kinds.some((kind) => DELIVERY_KINDS.includes(kind)) && result?.failed === true && !result.refusal) out.deliveries_failed += 1;
+      if (checks.length > 0 && result?.failed === false && pending) { if (pending === "model") out.escalations_helped += 1; else out.replans_helped += 1; pending = null; failedAt = null; }
+      if (result?.failed === true) { failedAt = index; pending = null; }
+    }
+  }
+  const kept = Object.fromEntries(Object.entries(out).filter(([, value]) => value > 0));
+  if (Object.keys(firstPass).length > 0) kept.first_pass = firstPass;
+  return Object.keys(kept).length > 0 ? kept : null;
+}
+
+/**
+ * RETRIEVAL AND GROUNDING (0.9.9): searches (grep, rg, find, git grep, Grep, Glob, a web search, an MCP search or
+ * retrieval tool), the same search again, a search followed by a read or a change (it found something) against another
+ * search straight after (again), searches before the first change and right after a failure, and deliveries
+ * with docs or tests read, or a search, since the last change (grounded). What was searched is never kept.
+ */
+const SEARCH_TOOLS = new Set(["Grep", "Glob", "WebSearch", "web_search", "grep_search", "file_search", "codebase_search", "search_files", "find_files"]);
+const SEARCH_COMMAND = /^\s*(rg|grep|egrep|fgrep|ag|ack|fd|find|git\s+grep|locate)\b/;
+const isSearch = (call) => {
+  const tool = call.family.split("|")[0];
+  return SEARCH_TOOLS.has(tool) || (/^mcp__/.test(tool) && /search|query|retriev|vector|semantic|lookup/i.test(tool)) || call.search === true;
+};
+function retrievalOf(messages) {
+  const results = new Map();
+  for (const message of messages) for (const result of message.results ?? []) results.set(result.id, result);
+  const out = { searches: 0, repeated: 0, found: 0, again: 0, before_change: 0, after_failure: 0, deliveries: 0, grounded: 0 };
+  const seen = new Set();
+  let previousSearch = false, changed = false, sinceFailure = null, groundedSinceChange = false;
+  for (const message of messages) {
+    if (message.bridge) continue;
+    for (const call of message.calls ?? []) {
+      const tool = call.family.split("|")[0], result = results.get(call.id), search = isSearch(call);
+      if (previousSearch) { if (search) out.again += 1; else if (tool === "Read" || EDIT_TOOLS.has(tool) || call.shellRead) out.found += 1; }
+      if (search) {
+        out.searches += 1;
+        if (seen.has(call.digest)) out.repeated += 1; else seen.add(call.digest);
+        if (!changed) out.before_change += 1;
+        if (sinceFailure !== null && sinceFailure <= 3) out.after_failure += 1;
+        groundedSinceChange = true;
+      }
+      if (call.read === "docs" || call.read === "tests") groundedSinceChange = true;
+      if (EDIT_TOOLS.has(tool)) { changed = true; groundedSinceChange = false; }
+      if (call.kinds.some((kind) => DELIVERY_KINDS.includes(kind)) && result?.failed === false) { out.deliveries += 1; if (groundedSinceChange) out.grounded += 1; }
+      previousSearch = search;
+      sinceFailure = result?.failed === true ? 0 : sinceFailure === null ? null : sinceFailure + 1;
+    }
+  }
+  return out.searches > 0 || out.deliveries > 0 ? Object.fromEntries(Object.entries(out).filter(([, value]) => value > 0)) : null;
+}
+
 /** The stretch's whole derived record; `helpers` are the hook's own readers of a human turn, so both read it the same way. */
-export function deriveStretch(messages, helpers) {
+/** A piped check's outcome from its output's words: failed or passed when they say so, unknown (null) when they do not. */
+function settlePiped(messages) {
+  const piped = new Map();
+  for (const message of messages) for (const call of message.calls ?? []) if (call.piped) piped.set(call.id, call.kinds);
+  if (piped.size === 0) return messages;
+  // A type check and a linter print nothing when they pass: silence behind the pipe is their pass, no other check's.
+  const quietPass = (kinds) => kinds.some((kind) => kind === "typecheck" || kind === "lint") && !kinds.some((kind) => !["typecheck", "lint"].includes(kind) && CHECK_KINDS.includes(kind));
+  const settle = (result) => ({ ...result, failed: result.words === "fail" ? true : result.words === "pass" ? false : result.silent && quietPass(piped.get(result.id)) ? false : null });
+  return messages.map((message) => (message.results?.some((result) => piped.has(result.id)) ? { ...message, results: message.results.map((result) => (piped.has(result.id) && !result.refusal ? settle(result) : result)) } : message));
+}
+
+export function deriveStretch(raw, helpers) {
+  const messages = settlePiped(raw);
   const context = contextOf(messages, helpers), routing = routingOf(messages), steering = steeringOf(messages, helpers);
-  const timing = timingOf(messages, helpers), hygiene = hygieneOf(messages), route = routeOf(messages), adaptation = adaptationOf(messages), reach = reachOf(messages), tools = toolsOf(messages), oversight = oversightOf(messages), planning = planningOf(messages), autonomy = autonomyOf(messages), practice = practiceOf(messages, helpers);
-  return { ...(practice ?? {}), ...(oversight ? { oversight } : {}), ...(planning ? { planning } : {}), ...(autonomy ? { autonomy } : {}), ...verificationOf(messages, helpers), ...(context ? { context } : {}), ...(routing ? { routing } : {}), ...(steering ? { steering } : {}), ...(tools ? { tools } : {}), ...(timing ? { timing } : {}), ...(hygiene ? { hygiene } : {}), ...(route ? { route } : {}), ...(adaptation ? { adaptation } : {}), ...(reach ? { reach } : {}) };
+  const timing = timingOf(messages, helpers), hygiene = hygieneOf(messages), route = routeOf(messages), adaptation = adaptationOf(messages), reach = reachOf(messages), outcomes = outcomesOf(messages), retrieval = retrievalOf(messages), tools = toolsOf(messages), oversight = oversightOf(messages), planning = planningOf(messages), autonomy = autonomyOf(messages), practice = practiceOf(messages, helpers);
+  return { ...(practice ?? {}), ...(oversight ? { oversight } : {}), ...(planning ? { planning } : {}), ...(autonomy ? { autonomy } : {}), ...verificationOf(messages, helpers), ...(context ? { context } : {}), ...(routing ? { routing } : {}), ...(steering ? { steering } : {}), ...(tools ? { tools } : {}), ...(timing ? { timing } : {}), ...(hygiene ? { hygiene } : {}), ...(route ? { route } : {}), ...(adaptation ? { adaptation } : {}), ...(reach ? { reach } : {}), ...(outcomes ? { outcomes } : {}), ...(retrieval ? { retrieval } : {}) };
 }

package/worktrust.mjs

@@ -73,7 +73,7 @@ const command = args.find((arg, at) => !arg.startsWith("--") && !(at > 0 && VALU
 const flag = (name) => { const at = args.indexOf(`--${name}`); return at >= 0 ? args[at + 1] : undefined; };
 const has = (name) => args.includes(`--${name}`);
 /** This CLI's version, said to the door so the app can tell which computer runs an old one (check-cli-package holds it equal to package.json). */
-const CLI_VERSION = "0.9.7";
+const CLI_VERSION = "0.9.9";
 const ORIGIN = (flag("origin") ?? process.env.WORKTRUST_ORIGIN ?? "https://app.worktrust.io").replace(/\/$/, "");
 const MCP = flag("url") ?? process.env.WORKTRUST_MCP_URL ?? `${ORIGIN}/api/mcp`;
 const HOME_DIR = join(homedir(), ".worktrust");