Slice 7: repair recipes that miss

[rvegajr]

Stacked on #10. Spec sentences are in docs/IMPLEMENTATION.md §4 Slice 7.

What

• Core
  • repairPrompt: current recipe, missed inputs with their reasons fenced as untrusted, previously passing inputs.
  • checkRepaired: same name, same param names, no new origins; always back to draft.
  • appendRegression: deduplicated, keeps the recorded example and the most recent inputs, capped at 10.
  • repairRecipe.
• CLI
  • tyto repair <name> --param value:
    • reruns the input;
    • on a miss, repairs it in one model session;
    • replaces the recipe only if the missed input and every regression input then pass. Otherwise the old recipe is unchanged.
  • Repaired auth recipes are saved as drafts that need approval again. They aren't run with your logins before you approve them.
  • tyto run appends passing inputs to the regression list, and prints a ready-to-run tyto repair … command on a miss.

Verified live

A deliberately naive GitHub recipe (trusts the first release on the page):

Step	Result
Before	vercel-labs/agent-browser ✅; nodejs/node → safe MISS (an older LTS release sits first), plus a repair hint
tyto repair github-release --repo nodejs/node	108 s, one Claude session; validated on both known inputs
After	node v26.10.0 ✅ (Latest), agent-browser v0.38.1 ✅, plus unseen deno v2.9.7 ✅ and playwright v1.63.0 ✅ (all match GitHub's API)

Tests

• npm run check: 19 files, 158 tests, typecheck clean, gitleaks clean.

🤖 Generated with Claude Code