@aiwayds/dsh-tui-pi 0.29.0 → 1.0.0

package/lib/log-repair.js

@@ -0,0 +1,273 @@
+/**
+ * Corrupted-resume-log repair orchestration — the /resume safety net.
+ *
+ * When a persisted session's log was forked by a historical double-writer
+ * (two dsh processes appending to one jsonl), the loader refuses it with
+ * "corrupt session log: seq gap …" and /resume dead-ends. The offline
+ * surgery itself lives in scripts/repair-session-log.mjs (deterministic
+ * dedupe + dense renumbering; the original is NEVER modified there). This
+ * module is the TUI-free bridge around it: it runs the script, verifies the
+ * result, and — only after an explicit user confirmation upstream — swaps
+ * the repaired copy in beside a kept backup, under the single-writer lock.
+ *
+ * Contract of the script (its own header is authoritative):
+ *   exit 0 → the log is CLEAN (nothing written), or — with --apply — a
+ *            `<stem>.repaired.jsonl[.zstd]` artifact was written BESIDE the
+ *            original (the CLEAN verdict line distinguishes the two);
+ *   exit 3 → corrupt diagnosed, nothing written (dry-run only by contract);
+ *   exit 2 → usage/environment error (missing zstd, torn lines without
+ *            --skip-bad-lines, …).
+ *
+ * Safety invariants (all enforced here, testable without a terminal):
+ * - The original log is never edited in place — swapping moves it aside to
+ *   `<name>.corrupt-bak` first and only then renames the verified repaired
+ *   copy over the canonical name.
+ * - A repaired copy that does not itself verify CLEAN is never swapped in.
+ * - The writer lock beside the log (<sessionDir>/writer.lock, same file the
+ *   cold arms and the feishu guard compete on) is claimed for the whole
+ *   apply→verify→swap window and always released, success or not.
+ */
+import { spawnSync } from 'node:child_process';
+import { chmodSync, existsSync, renameSync, statSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { SESSION_LOG_FILE_NAMES } from "./retention.js";
+import { acquireWriterLock, projectKeyFor, releaseOwnedWriterLock, } from "./writer-lock.js";
+/** The repair script rides the published package (`files` includes scripts/). */
+export function repairScriptPath() {
+    return new URL('../scripts/repair-session-log.mjs', import.meta.url).pathname;
+}
+/** Hard wall-clock budget for one script invocation (big logs still finish; a hung zstd must not freeze /resume). */
+export const REPAIR_TIMEOUT_MS = 120_000;
+/**
+ * The path the repair script writes its artifact to (mirrors the script's
+ * own `<stem>.repaired.jsonl[.zstd]` naming, stem = name minus the jsonl[.zstd]
+ * suffix). Exported so tests and callers can predict the artifact location.
+ */
+export function repairedArtifactPath(logPath) {
+    const isZstd = /\.jsonl\.zstd$/.test(logPath);
+    const stem = basename(logPath).replace(/\.jsonl(\.zstd)?$/, '');
+    return join(dirname(logPath), `${stem}.repaired.jsonl${isZstd ? '.zstd' : ''}`);
+}
+function firstLine(text) {
+    const line = text.split('\n').map(l => l.trim()).find(l => l !== '');
+    return line ?? '';
+}
+/**
+ * Run scripts/repair-session-log.mjs against one log. Never touches the log
+ * itself (the script cannot); classifies the outcome per the exit contract
+ * above. A missing zstd binary surfaces as the script's exit 2 — or, should
+ * the spawn itself fail with ENOENT, as a failed result with an install hint.
+ */
+export function runRepair(logPath, options = {}) {
+    const apply = options.apply ?? false;
+    const spawn = options.spawnSyncFn ?? spawnSync;
+    let proc;
+    try {
+        proc = spawn(process.execPath, [repairScriptPath(), logPath, ...(apply ? ['--apply'] : [])], { encoding: 'utf8', timeout: REPAIR_TIMEOUT_MS, maxBuffer: 1 << 26 });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { status: 'failed', detail: `cannot run the repair script: ${message}` };
+    }
+    if (proc.error !== undefined) {
+        const code = proc.error.code;
+        const hint = code === 'ENOENT' ? ' — is zstd installed and on PATH?' : '';
+        return {
+            status: 'failed',
+            detail: `cannot run the repair script: ${proc.error.message}${hint}`,
+        };
+    }
+    const out = proc.stdout ?? '';
+    const err = proc.stderr ?? '';
+    if (proc.status === 0) {
+        // Exit 0 is ambiguous by contract (CLEAN vs. repaired+written); the
+        // CLEAN verdict line disambiguates without guessing at files.
+        if (out.includes('verdict: CLEAN'))
+            return { status: 'clean' };
+        const repairedPath = repairedArtifactPath(logPath);
+        if (existsSync(repairedPath)) {
+            return { status: 'repaired', repairedPath, detail: firstLine(out) };
+        }
+        return {
+            status: 'failed',
+            detail: 'repair script exited 0 but wrote no repaired artifact beside the log',
+        };
+    }
+    if (proc.status === 3) {
+        // By the script's contract exit 3 means "corrupt, dry-run, nothing
+        // written" — with --apply this is a contract violation, but either way
+        // there is nothing to swap in, so it is a failure for our caller.
+        return {
+            status: 'failed',
+            detail: firstLine(out) || 'log is corrupt — the script diagnosed it without writing a repair',
+        };
+    }
+    return {
+        status: 'failed',
+        detail: firstLine(err) || `repair script exited ${proc.status ?? 'by signal'}`,
+    };
+}
+/**
+ * Verify one log loads clean (dry-run diagnosis, never writes). Used on the
+ * repaired artifact BEFORE it replaces the canonical log.
+ */
+export function verifyClean(logPath, options = {}) {
+    const run = runRepair(logPath, { ...options, apply: false });
+    return run.status === 'clean' ? { ok: true } : { ok: false, detail: run.detail };
+}
+/**
+ * Swap the verified repaired copy in over the canonical log name: the
+ * original moves aside to `<name>.corrupt-bak` (suffixed with the epoch
+ * millisecond when that name is taken — never overwritten), the repaired
+ * copy takes its place with owner-only permissions, matching the store's
+ * private-file hygiene. Synchronous on purpose: the swap window sits under
+ * the writer lock and must be a tight rename-rename pair. A failed swap-in
+ * restores the original best-effort (mirroring the feishu surface) before
+ * rethrowing, so the session is never stranded without its canonical log.
+ */
+export function swapRepaired(logPath, repairedPath, options = {}) {
+    let backupPath = `${logPath}.corrupt-bak`;
+    try {
+        statSync(backupPath);
+        backupPath = `${backupPath}.${Date.now()}`;
+    }
+    catch {
+        // Free — the plain .corrupt-bak name is ours.
+    }
+    renameSync(logPath, backupPath);
+    try {
+        renameSync(repairedPath, logPath);
+    }
+    catch (error) {
+        // Best-effort restore first — the canonical name must not stay missing
+        // with the original parked in the backup; the rethrow is the signal.
+        try {
+            renameSync(backupPath, logPath);
+        }
+        catch {
+            // Nothing further is recoverable here; the caller reports the swap
+            // failure and the .corrupt-bak copy still holds the original.
+        }
+        throw error;
+    }
+    try {
+        ;
+        (options.chmodFn ?? chmodSync)(logPath, 0o600);
+    }
+    catch {
+        // Permissions are store hygiene, not log integrity: the swap already
+        // succeeded, so a chmod failure never flips the outcome. A later
+        // successful repair (or any manual chmod) fixes the mode.
+    }
+    return { backupPath };
+}
+/**
+ * End-to-end repair of one session log, under the single-writer lock beside
+ * it: claim → apply → verify the repaired copy → swap → release. ANY failure
+ * leaves the canonical log untouched, releases the lock, and reports
+ * {kind:'failed'}; only a verified artifact is ever swapped in. The lock dir
+ * is the log's own directory — the same `<sessionDir>/writer.lock` the cold
+ * arms and the feishu guard compete on.
+ */
+export async function repairSessionLog(logPath, options = {}) {
+    const dir = dirname(logPath);
+    let claim;
+    try {
+        claim = await acquireWriterLock(dir);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return { kind: 'failed', detail: `cannot claim the writer lock: ${message}` };
+    }
+    if (!claim.ok)
+        return { kind: 'locked', holder: claim.holder };
+    try {
+        const run = runRepair(logPath, { apply: true, spawnSyncFn: options.spawnSyncFn });
+        if (run.status === 'failed')
+            return { kind: 'failed', detail: run.detail };
+        if (run.status === 'clean')
+            return { kind: 'clean' };
+        const verdict = verifyClean(run.repairedPath, options);
+        if (!verdict.ok) {
+            return {
+                kind: 'failed',
+                detail: `the repaired copy still fails verification: ${verdict.detail}`,
+            };
+        }
+        return {
+            kind: 'repaired',
+            backupPath: swapRepaired(logPath, run.repairedPath, options).backupPath,
+        };
+    }
+    catch (error) {
+        // swapRepaired restored the original best-effort before rethrowing; map
+        // the residue to a plain failure so no exception ever escapes toward the
+        // command dispatch — this module's contract is results, not throws.
+        const message = error instanceof Error ? error.message : String(error);
+        return { kind: 'failed', detail: `swap failed: ${message}` };
+    }
+    finally {
+        await releaseOwnedWriterLock(dir);
+    }
+}
+/**
+ * The /resume corrupt-log fingerprint: the loader's "corrupt session log:
+ * seq gap …" refusal, plus the raw-decompression twin ("corrupt zstandard
+ * log"). Case-insensitive; anything else (locked session, missing
+ * persistence, network) must NOT route into the repair flow.
+ */
+const CORRUPT_LOG_PATTERN = /corrupt .*(session|zstandard) log/i;
+export function isCorruptLogError(message) {
+    return CORRUPT_LOG_PATTERN.test(message);
+}
+/**
+ * User-facing notice for a repair attempt that did NOT swap anything;
+ * undefined when the flow should proceed to resume ('repaired' | 'clean').
+ * Pure so the wording is testable without a terminal (English-only).
+ */
+export function repairFailureNotice(result) {
+    if (result.kind === 'locked') {
+        return `session is driven by pid ${result.holder.pid} — close it on the other side first`;
+    }
+    if (result.kind === 'failed') {
+        return `repair failed: ${result.detail} — log untouched`;
+    }
+    return undefined;
+}
+/**
+ * Locate one session's canonical log file on disk the same way the
+ * single-writer guard derives it: `<root>/<projectKeyFor(cwd)>/<sessionId>/<name>`,
+ * with the cwd taken from the persisted header list (the log lives under
+ * THAT project key). Best-effort: no header, no cwd, or no log file under
+ * the derived dir yields undefined — the caller reports a failure instead
+ * of repairing a decoy. When both suffixes coexist (a kept raw copy beside
+ * the compressed log) the compressed name wins: it is what the writer
+ * appends to and what the loader reads.
+ */
+export async function locateSessionLog(persistence, sessionId, root) {
+    let cwd;
+    try {
+        const stored = (await persistence?.list?.().catch(() => [])) ?? [];
+        const header = stored.find(candidate => String(candidate.id) === sessionId);
+        if (typeof header?.cwd === 'string' && header.cwd !== '')
+            cwd = header.cwd;
+    }
+    catch {
+        return undefined;
+    }
+    if (cwd === undefined)
+        return undefined;
+    const dir = join(root, projectKeyFor(cwd), sessionId);
+    for (const name of SESSION_LOG_FILE_NAMES.slice().reverse()) {
+        const file = join(dir, name);
+        try {
+            statSync(file);
+            return file;
+        }
+        catch {
+            // Not this suffix — try the next one.
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=log-repair.js.map

package/lib/log-repair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-repair.js","sourceRoot":"","sources":["../src/log-repair.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,SAAS,EAAyB,MAAM,oBAAoB,CAAA;AACrE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AACrE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,sBAAsB,GAEvB,MAAM,kBAAkB,CAAA;AAEzB,iFAAiF;AACjF,MAAM,UAAU,gBAAgB;IAC9B,OAAO,IAAI,GAAG,CAAC,mCAAmC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAA;AAC/E,CAAC;AAED,qHAAqH;AACrH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAA;AAoBxC;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,mBAAmB,EAAE,EAAE,CAAC,CAAA;IAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,kBAAkB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACjF,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;IACpE,OAAO,IAAI,IAAI,EAAE,CAAA;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,UAA4B,EAAE;IACvE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,IAAI,SAAS,CAAA;IAC9C,IAAI,IAA8B,CAAA;IAClC,IAAI,CAAC;QACH,IAAI,GAAG,KAAK,CACV,OAAO,CAAC,QAAQ,EAChB,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAC5D,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CACrE,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iCAAiC,OAAO,EAAE,EAAE,CAAA;IACjF,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAI,IAAI,CAAC,KAA+B,CAAC,IAAI,CAAA;QACvD,MAAM,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,CAAA;QACzE,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,iCAAiC,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,EAAE;SACrE,CAAA;IACH,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;IAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAA;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,oEAAoE;QACpE,8DAA8D;QAC9D,IAAI,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,CAAA;QAC9D,MAAM,YAAY,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAA;QAClD,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAA;QACrE,CAAC;QACD,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,sEAAsE;SAC/E,CAAA;IACH,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,mEAAmE;QACnE,uEAAuE;QACvE,kEAAkE;QAClE,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,mEAAmE;SAC9F,CAAA;IACH,CAAC;IACD,OAAO;QACL,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,IAAI,wBAAwB,IAAI,CAAC,MAAM,IAAI,WAAW,EAAE;KAC/E,CAAA;AACH,CAAC;AAKD;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,UAA4B,EAAE;IACzE,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;IAC5D,OAAO,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;AAClF,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe,EAAE,YAAoB,EAAE,UAAuB,EAAE;IAC3F,IAAI,UAAU,GAAG,GAAG,OAAO,cAAc,CAAA;IACzC,IAAI,CAAC;QACH,QAAQ,CAAC,UAAU,CAAC,CAAA;QACpB,UAAU,GAAG,GAAG,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IACD,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAC/B,IAAI,CAAC;QACH,UAAU,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,uEAAuE;QACvE,qEAAqE;QACrE,IAAI,CAAC;YACH,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,8DAA8D;QAChE,CAAC;QACD,MAAM,KAAK,CAAA;IACb,CAAC;IACD,IAAI,CAAC;QACH,CAAC;QAAA,CAAC,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,qEAAqE;QACrE,iEAAiE;QACjE,0DAA0D;IAC5D,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,CAAA;AACvB,CAAC;AAmBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAe,EACf,UAAgC,EAAE;IAElC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,IAAI,KAA6D,CAAA;IACjE,IAAI,CAAC;QACH,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,iCAAiC,OAAO,EAAE,EAAE,CAAA;IAC/E,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAA;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;QACjF,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAA;QAC1E,IAAI,GAAG,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAA;QACpD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QACtD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,MAAM,EAAE,+CAA+C,OAAO,CAAC,MAAM,EAAE;aACxE,CAAA;QACH,CAAC;QACD,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,UAAU;SACxE,CAAA;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,wEAAwE;QACxE,yEAAyE;QACzE,oEAAoE;QACpE,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACtE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,OAAO,EAAE,EAAE,CAAA;IAC9D,CAAC;YAAS,CAAC;QACT,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAA;IACnC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,mBAAmB,GAAG,oCAAoC,CAAA;AAEhE,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAA2B;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,4BAA4B,MAAM,CAAC,MAAM,CAAC,GAAG,qCAAqC,CAAA;IAC3F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,kBAAkB,MAAM,CAAC,MAAM,kBAAkB,CAAA;IAC1D,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAA+C,EAC/C,SAAiB,EACjB,IAAY;IAEZ,IAAI,GAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,MAAM,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAClE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,SAAS,CAAC,CAAA;QAC3E,IAAI,OAAO,MAAM,EAAE,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,KAAK,EAAE;YAAE,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,CAAA;IACrD,KAAK,MAAM,IAAI,IAAI,sBAAsB,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QAC5B,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,CAAA;YACd,OAAO,IAAI,CAAA;QACb,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/lib/repair-dialog.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The /resume repair confirmation dialog — shown when a picked session's
+ * log fails to load with a corrupt-log error (src/log-repair.ts
+ * `isCorruptLogError`). Repairing rewrites user data on disk, so it is
+ * NEVER done implicitly: this dialog is the explicit confirmation gate.
+ *
+ * Two options, in the spec's button order:
+ *   1. Repair & resume — run the guarded in-place repair, then re-enter the
+ *      selected row's resume path.
+ *   2. Cancel — leave the log untouched; /resume reports the original error.
+ * ↑↓ moves the selection, `1`/`2` select directly, Enter confirms, Esc
+ * cancels — the exact keymap of the submit routing dialog (route-dialog.ts),
+ * whose pure-reducer split this file mirrors so the decision matrix stays
+ * unit-testable without a terminal. Framing/focus follow the shared overlay
+ * contract: PanelHost framing, close re-focuses the CURRENT editor instance
+ * through `restoreFocus`.
+ */
+import { type Component, type TUI } from '@earendil-works/pi-tui';
+import { type TuiTheme } from './theme/index.ts';
+/** The two choices in display order; index 0 is preselected. */
+export declare const REPAIR_CONFIRM_OPTIONS: ReadonlyArray<{
+    id: 'repair' | 'cancel';
+    title: string;
+    hint: string;
+}>;
+/** The fixed body copy (spec wording): what happened, what repair does, what is kept. */
+export declare const REPAIR_CONFIRM_MESSAGE: string;
+/** Footer hint — hardcoded like every other panel footer (English-only). */
+export declare const REPAIR_CONFIRM_FOOTER = "\u2191\u2193 select \u00B7 1/2 pick \u00B7 Enter confirm \u00B7 Esc cancel";
+/** Pure dialog state: which row is highlighted, and the terminal outcome. */
+export interface RepairConfirmState {
+    selected: number;
+    /**
+     * Set once by a terminal key: `'confirm'` (Enter on a selection) or
+     * `'cancel'` (Esc). Further input is ignored afterwards.
+     */
+    settled?: 'confirm' | 'cancel';
+}
+export declare function initialRepairConfirmState(): RepairConfirmState;
+/**
+ * Apply one raw key sequence to the dialog state. Unknown keys are no-ops;
+ * anything after a settle is ignored (single terminal outcome guard).
+ */
+export declare function updateRepairConfirm(state: RepairConfirmState, data: string): RepairConfirmState;
+/** Resolved dialog outcome: the chosen action, or undefined on cancel. */
+export declare function repairConfirmOutcome(state: RepairConfirmState): 'repair' | 'cancel' | undefined;
+/**
+ * The framed overlay component. Renders the fixed body copy plus the two
+ * option rows; every key goes through {@link updateRepairConfirm}, and the
+ * first terminal key fires `onFinish` exactly once.
+ */
+export declare class RepairConfirmPanel implements Component {
+    private readonly theme;
+    private readonly onFinish;
+    private readonly requestRenderFn;
+    private state;
+    constructor(theme: TuiTheme, onFinish: (outcome: 'repair' | 'cancel' | undefined) => void, requestRender: () => void);
+    invalidate(): void;
+    render(width: number): string[];
+    handleInput(data: string): void;
+}
+/**
+ * Open the repair confirmation dialog for one corrupt resume target.
+ * Resolves `'repair'` when the user explicitly confirmed, `'cancelled'`
+ * otherwise (Esc, or an overlay that failed to mount — treated as cancel so
+ * a half-mounted dialog can never imply consent). Closing always hands
+ * focus back through `restoreFocus` before the promise settles.
+ */
+export declare function openRepairConfirmDialog(tui: TUI, theme: TuiTheme, restoreFocus: () => void): Promise<'repair' | 'cancelled'>;

package/lib/repair-dialog.js

@@ -0,0 +1,153 @@
+/**
+ * The /resume repair confirmation dialog — shown when a picked session's
+ * log fails to load with a corrupt-log error (src/log-repair.ts
+ * `isCorruptLogError`). Repairing rewrites user data on disk, so it is
+ * NEVER done implicitly: this dialog is the explicit confirmation gate.
+ *
+ * Two options, in the spec's button order:
+ *   1. Repair & resume — run the guarded in-place repair, then re-enter the
+ *      selected row's resume path.
+ *   2. Cancel — leave the log untouched; /resume reports the original error.
+ * ↑↓ moves the selection, `1`/`2` select directly, Enter confirms, Esc
+ * cancels — the exact keymap of the submit routing dialog (route-dialog.ts),
+ * whose pure-reducer split this file mirrors so the decision matrix stays
+ * unit-testable without a terminal. Framing/focus follow the shared overlay
+ * contract: PanelHost framing, close re-focuses the CURRENT editor instance
+ * through `restoreFocus`.
+ */
+import { getKeybindings } from '@earendil-works/pi-tui';
+import { PanelHost, panelThemeFns } from "./panels.js";
+import { BOLD, RESET, ansiFg } from "./theme/index.js";
+import { clipToWidth, wrapText } from "./text.js";
+/** The two choices in display order; index 0 is preselected. */
+export const REPAIR_CONFIRM_OPTIONS = [
+    { id: 'repair', title: 'Repair & resume', hint: 'rebuild the log in place, then enter the session' },
+    { id: 'cancel', title: 'Cancel', hint: 'leave the log untouched' },
+];
+/** The fixed body copy (spec wording): what happened, what repair does, what is kept. */
+export const REPAIR_CONFIRM_MESSAGE = 'Resume log is corrupted (likely from a historical double-writer). '
+    + 'Repair it in place? The original is kept as .corrupt-bak.';
+/** Footer hint — hardcoded like every other panel footer (English-only). */
+export const REPAIR_CONFIRM_FOOTER = '↑↓ select · 1/2 pick · Enter confirm · Esc cancel';
+export function initialRepairConfirmState() {
+    return { selected: 0 };
+}
+/**
+ * Apply one raw key sequence to the dialog state. Unknown keys are no-ops;
+ * anything after a settle is ignored (single terminal outcome guard).
+ */
+export function updateRepairConfirm(state, data) {
+    if (state.settled !== undefined)
+        return state;
+    const kb = getKeybindings();
+    if (kb.matches(data, 'tui.select.cancel'))
+        return { ...state, settled: 'cancel' };
+    if (kb.matches(data, 'tui.input.submit'))
+        return { ...state, settled: 'confirm' };
+    if (kb.matches(data, 'tui.select.up')) {
+        return { ...state, selected: Math.max(0, state.selected - 1) };
+    }
+    if (kb.matches(data, 'tui.select.down')) {
+        return { ...state, selected: Math.min(REPAIR_CONFIRM_OPTIONS.length - 1, state.selected + 1) };
+    }
+    // Digit direct-select (1-based): selects the row, Enter still confirms —
+    // same select-then-confirm split as the routing dialog.
+    const digit = /^([1-9])$/.exec(data);
+    if (digit !== null) {
+        const index = Number(digit[1]) - 1;
+        if (index < REPAIR_CONFIRM_OPTIONS.length)
+            return { ...state, selected: index };
+    }
+    return state;
+}
+/** Resolved dialog outcome: the chosen action, or undefined on cancel. */
+export function repairConfirmOutcome(state) {
+    if (state.settled !== 'confirm')
+        return undefined;
+    return REPAIR_CONFIRM_OPTIONS[state.selected]?.id;
+}
+/**
+ * The framed overlay component. Renders the fixed body copy plus the two
+ * option rows; every key goes through {@link updateRepairConfirm}, and the
+ * first terminal key fires `onFinish` exactly once.
+ */
+export class RepairConfirmPanel {
+    theme;
+    onFinish;
+    requestRenderFn;
+    state = initialRepairConfirmState();
+    constructor(theme, onFinish, requestRender) {
+        this.theme = theme;
+        this.onFinish = onFinish;
+        this.requestRenderFn = requestRender;
+    }
+    invalidate() { }
+    render(width) {
+        const fns = panelThemeFns(this.theme);
+        const wrap = Math.max(2, width - 2);
+        // Word-wrap the body FIRST, then paint (iron rule: width math runs on
+        // plain text, ANSI goes on after clipping).
+        const lines = [
+            fns.accent(BOLD + clipToWidth('● Corrupted resume log', wrap) + RESET),
+            ...wrapText(REPAIR_CONFIRM_MESSAGE, wrap).map(segment => fns.muted(clipToWidth(segment, wrap))),
+            '',
+        ];
+        for (let i = 0; i < REPAIR_CONFIRM_OPTIONS.length; i++) {
+            const option = REPAIR_CONFIRM_OPTIONS[i];
+            const marker = i === this.state.selected ? '▸' : ' ';
+            const row = clipToWidth(`${marker} ${i + 1}. ${option.title} — ${option.hint}`, wrap);
+            lines.push(i === this.state.selected
+                ? ansiFg(this.theme.palette.accent) + BOLD + row + RESET
+                : fns.muted(row));
+        }
+        lines.push('');
+        lines.push(fns.subtle(clipToWidth(REPAIR_CONFIRM_FOOTER, wrap)));
+        return lines;
+    }
+    handleInput(data) {
+        const previous = this.state;
+        this.state = updateRepairConfirm(this.state, data);
+        if (this.state === previous)
+            return;
+        if (this.state.settled === undefined) {
+            this.requestRenderFn();
+            return;
+        }
+        this.onFinish(repairConfirmOutcome(this.state));
+    }
+}
+/**
+ * Open the repair confirmation dialog for one corrupt resume target.
+ * Resolves `'repair'` when the user explicitly confirmed, `'cancelled'`
+ * otherwise (Esc, or an overlay that failed to mount — treated as cancel so
+ * a half-mounted dialog can never imply consent). Closing always hands
+ * focus back through `restoreFocus` before the promise settles.
+ */
+export function openRepairConfirmDialog(tui, theme, restoreFocus) {
+    return new Promise(resolve => {
+        let settled = false;
+        const settle = (outcome) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(outcome);
+        };
+        // A half-mounted overlay must not strand the keyboard: PanelHost's
+        // onError closes + calls restoreFocus, then we settle as cancelled.
+        const host = new PanelHost(tui, theme, () => {
+            restoreFocus();
+            settle('cancelled');
+        });
+        const finish = (outcome) => {
+            host.close();
+            restoreFocus();
+            settle(outcome === 'repair' ? 'repair' : 'cancelled');
+        };
+        const panel = new RepairConfirmPanel(theme, outcome => finish(outcome), () => tui.requestRender());
+        // maxHeight is a hard slice in pi-tui: ~9 content rows + 5 frame rows
+        // must fit or the bottom border (and footer) is cut. 75% of the 24-row
+        // e2e floor is 18 — the same headroom the /resume picker reserves.
+        host.open(panel, '70%', '75%');
+    });
+}
+//# sourceMappingURL=repair-dialog.js.map

package/lib/repair-dialog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repair-dialog.js","sourceRoot":"","sources":["../src/repair-dialog.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,cAAc,EAA4B,MAAM,wBAAwB,CAAA;AACjF,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAiB,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAEjD,gEAAgE;AAChE,MAAM,CAAC,MAAM,sBAAsB,GAA4E;IAC7G,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,kDAAkD,EAAE;IACpG,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,EAAE;CACnE,CAAA;AAED,yFAAyF;AACzF,MAAM,CAAC,MAAM,sBAAsB,GACjC,oEAAoE;MAClE,2DAA2D,CAAA;AAE/D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,qBAAqB,GAAG,mDAAmD,CAAA;AAYxF,MAAM,UAAU,yBAAyB;IACvC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAyB,EAAE,IAAY;IACzE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAC7C,MAAM,EAAE,GAAG,cAAc,EAAE,CAAA;IAC3B,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IACjF,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,kBAAkB,CAAC;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;IACjF,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAA;IAChE,CAAC;IACD,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACxC,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,EAAE,CAAA;IAChG,CAAC;IACD,yEAAyE;IACzE,wDAAwD;IACxD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,GAAG,sBAAsB,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IACjF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,KAAyB;IAC5D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IACjD,OAAO,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,kBAAkB;IACZ,KAAK,CAAU;IACf,QAAQ,CAAoD;IAC5D,eAAe,CAAY;IACpC,KAAK,GAAuB,yBAAyB,EAAE,CAAA;IAE/D,YACE,KAAe,EACf,QAA4D,EAC5D,aAAyB;QAEzB,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAA;QACxB,IAAI,CAAC,eAAe,GAAG,aAAa,CAAA;IACtC,CAAC;IAED,UAAU,KAAU,CAAC;IAErB,MAAM,CAAC,KAAa;QAClB,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAA;QACnC,sEAAsE;QACtE,4CAA4C;QAC5C,MAAM,KAAK,GAAa;YACtB,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,WAAW,CAAC,wBAAwB,EAAE,IAAI,CAAC,GAAG,KAAK,CAAC;YACtE,GAAG,QAAQ,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAC/F,EAAE;SACH,CAAA;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,sBAAsB,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,sBAAsB,CAAC,CAAC,CAAE,CAAA;YACzC,MAAM,MAAM,GAAG,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;YACpD,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAA;YACrF,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,QAAQ;gBAClC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,GAAG,GAAG,GAAG,KAAK;gBACxD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;QACrB,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACd,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;QAChE,OAAO,KAAK,CAAA;IACd,CAAC;IAED,WAAW,CAAC,IAAY;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAA;QAC3B,IAAI,CAAC,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAClD,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ;YAAE,OAAM;QACnC,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,eAAe,EAAE,CAAA;YACtB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACjD,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAQ,EACR,KAAe,EACf,YAAwB;IAExB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,MAAM,GAAG,CAAC,OAA+B,EAAQ,EAAE;YACvD,IAAI,OAAO;gBAAE,OAAM;YACnB,OAAO,GAAG,IAAI,CAAA;YACd,OAAO,CAAC,OAAO,CAAC,CAAA;QAClB,CAAC,CAAA;QACD,mEAAmE;QACnE,oEAAoE;QACpE,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE;YAC1C,YAAY,EAAE,CAAA;YACd,MAAM,CAAC,WAAW,CAAC,CAAA;QACrB,CAAC,CAAC,CAAA;QACF,MAAM,MAAM,GAAG,CAAC,OAAwC,EAAQ,EAAE;YAChE,IAAI,CAAC,KAAK,EAAE,CAAA;YACZ,YAAY,EAAE,CAAA;YACd,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QACvD,CAAC,CAAA;QACD,MAAM,KAAK,GAAG,IAAI,kBAAkB,CAClC,KAAK,EACL,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAC1B,GAAG,EAAE,CAAC,GAAG,CAAC,aAAa,EAAE,CAC1B,CAAA;QACD,sEAAsE;QACtE,uEAAuE;QACvE,mEAAmE;QACnE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;AACJ,CAAC"}

package/lib/sessions.d.ts

@@ -195,6 +195,15 @@ export declare function filterSessionsByLastActivity(headers: readonly SessionHe
 export declare function previewOfEvents(events: readonly SessionEvent[]): string | undefined;
 /** Collapse control chars/whitespace and clip a raw message into a one-line preview. */
 export declare function normalizePreview(text: string, maxChars?: number): string;
+/**
+ * The picker row's SESSION-column label: the first-message preview when one
+ * was read, else the header label (cwd basename · short id). `corrupt`
+ * prepends the ⚠ marker — the same pre-read `inspect` that harvests previews
+ * already diagnosed this log as corrupt, and selecting the row will offer an
+ * in-place repair instead of a dead end. Pure so the marker contract is
+ * unit-testable without a store.
+ */
+export declare function resumeRowTitle(header: SessionHeader, preview: string | undefined, corrupt: boolean): string;
 /**
  * Validate one persisted session's log without publishing it — the /resume
  * pre-check: a corrupt target must be rejected BEFORE the current live agent

package/lib/sessions.js

@@ -11,6 +11,7 @@ import { readdir, stat } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { basename, join } from 'node:path';
 import { SESSION_LOG_FILE_NAMES } from "./retention.js";
+import { isCorruptLogError } from "./log-repair.js";
 import { emitNotice } from "./notice-bridge.js";
 import { wrapFramedOverlay } from "./frame.js";
 import { autoColumns, columnWidths, MARKER_W, padCell, panelThemeFns, TablePanel, tableHeaderLine, tableRuleLine, TABLE_SEP, } from "./panels.js";
@@ -405,9 +406,27 @@ export function normalizePreview(text, maxChars = PREVIEW_MAX_CHARS) {
     const oneLine = text.replace(/[\x00-\x1f\x7f]+/g, ' ').replace(/\s+/g, ' ').trim();
     return oneLine.length <= maxChars ? oneLine : `${oneLine.slice(0, maxChars)}…`;
 }
-/** Best-effort first-message preview per session id; failures map to undefined. */
+/**
+ * The picker row's SESSION-column label: the first-message preview when one
+ * was read, else the header label (cwd basename · short id). `corrupt`
+ * prepends the ⚠ marker — the same pre-read `inspect` that harvests previews
+ * already diagnosed this log as corrupt, and selecting the row will offer an
+ * in-place repair instead of a dead end. Pure so the marker contract is
+ * unit-testable without a store.
+ */
+export function resumeRowTitle(header, preview, corrupt) {
+    const base = preview ?? `${basename(header.cwd ?? '?')} · ${clipToWidth(String(header.id), 8)}`;
+    return corrupt ? `⚠ ${base}` : base;
+}
+/**
+ * Best-effort first-message preview per session id; failures map to
+ * undefined, and failures matching the corrupt-log fingerprint additionally
+ * record the id in `corruptIds` — zero extra IO (the inspect calls already
+ * ran for the previews), so the ⚠ rows stay a free byproduct of enrichment.
+ */
 async function loadSessionPreviews(persistence, ids) {
     const previews = new Map();
+    const corruptIds = new Set();
     let cursor = 0;
     const workers = Array.from({ length: Math.min(PREVIEW_CONCURRENCY, ids.length) }, async () => {
         while (cursor < ids.length) {
@@ -420,14 +439,17 @@ async function loadSessionPreviews(persistence, ids) {
                 if (text)
                     preview = normalizePreview(text);
             }
-            catch {
+            catch (error) {
                 preview = undefined;
+                const message = error instanceof Error ? error.message : String(error);
+                if (isCorruptLogError(message))
+                    corruptIds.add(String(id));
             }
             previews.set(String(id), preview);
         }
     });
     await Promise.all(workers);
-    return previews;
+    return { previews, corruptIds };
 }
 /**
  * Validate one persisted session's log without publishing it — the /resume
@@ -518,16 +540,16 @@ export async function pickPersistedSession(ctx, tui, theme, excludeSessionId, re
     }
     // Enrich the most recent candidates with their first-message preview so the
     // rows are distinguishable at a glance; older ones fall back to the header
-    // label (cwd + short id).
-    const previews = await loadSessionPreviews(persistence, ordered.slice(0, PREVIEW_SESSION_CAP).map(header => header.id));
+    // label (cwd + short id). Logs the enrichment inspect diagnosed as corrupt
+    // get the ⚠ marker — a free byproduct of the same calls, never a new scan.
+    const { previews, corruptIds } = await loadSessionPreviews(persistence, ordered.slice(0, PREVIEW_SESSION_CAP).map(header => header.id));
     const rows = ordered.map(header => {
         const id = String(header.id);
-        const preview = previews.get(id);
         const updated = lastUpdates.get(id)?.mtimeMs ?? header.createdAt;
         return {
             value: id,
             header,
-            session: preview ?? `${basename(header.cwd ?? '?')} · ${clipToWidth(id, 8)}`,
+            session: resumeRowTitle(header, previews.get(id), corruptIds.has(id)),
             when: new Date(updated).toLocaleString(),
             dir: header.cwd ?? 'no cwd',
         };