@basou/cli 0.7.0 → 0.9.0

package/dist/index.js

@@ -124,6 +124,7 @@ import {
   linkYamlFile,
   loadApproval,
   prefixedUlid,
+  readSessionYaml,
   readYamlFile,
   replayEvents,
   resolveRepositoryRoot
@@ -331,6 +332,15 @@ async function doRunApprovalResolve(idInput, options, ctx, decision) {
   if (isLazyExpired(approval, now)) {
     throw new Error(`Approval already expired: ${idInput}`);
   }
+  let sessionStatus = null;
+  try {
+    sessionStatus = (await readSessionYaml(paths, approval.session_id)).session.status;
+  } catch {
+    sessionStatus = null;
+  }
+  if (sessionStatus === "imported") {
+    throw new Error(`Cannot resolve an approval for an imported session: ${idInput}`);
+  }
   const occurredAt = now.toISOString();
   const eventId = prefixedUlid("evt");
   if (decision === "approve") {
@@ -1342,7 +1352,8 @@ import {
   findErrorCode as findErrorCode5,
   importSessionFromJson,
   readManifest as readManifest3,
-  readSessionYaml,
+  readSessionYaml as readSessionYaml2,
+  reimportPreservingId,
   resolveRepositoryRoot as resolveRepositoryRoot6,
   SessionImportPayloadSchema
 } from "@basou/core";
@@ -1418,10 +1429,15 @@ async function doRunImportClaudeCode(options, ctx) {
     const externalId = basename(file, ".jsonl");
     return {
       externalId,
-      toPayload: async () => claudeTranscriptToImportPayload(await readJsonlRecords(file), {
-        workspaceId: manifest.workspace.id,
-        externalId
-      })
+      sourcePath: file,
+      toPayload: async () => {
+        const { records, sizeBytes } = await readJsonlRecords(file);
+        return claudeTranscriptToImportPayload(records, {
+          workspaceId: manifest.workspace.id,
+          externalId,
+          sourceSizeBytes: sizeBytes
+        });
+      }
     };
   });
   await importDerivedSessions(paths, manifest, options, CLAUDE_IMPORT_SOURCE, candidates);
@@ -1439,10 +1455,15 @@ async function doRunImportCodex(options, ctx) {
   const rollouts = await discoverCodexRollouts(sessionsRoot, projectPaths, options);
   const candidates = rollouts.map(({ file, externalId }) => ({
     externalId,
-    toPayload: async () => codexRolloutToImportPayload(await readJsonlRecords(file), {
-      workspaceId: manifest.workspace.id,
-      externalId
-    })
+    sourcePath: file,
+    toPayload: async () => {
+      const { records, sizeBytes } = await readJsonlRecords(file);
+      return codexRolloutToImportPayload(records, {
+        workspaceId: manifest.workspace.id,
+        externalId,
+        sourceSizeBytes: sizeBytes
+      });
+    }
   }));
   await importDerivedSessions(paths, manifest, options, CODEX_IMPORT_SOURCE, candidates);
 }
@@ -1466,41 +1487,76 @@ async function importDerivedSessions(paths, manifest, options, sourceKind, candi
   const existingByExternalId = await loadExistingByExternalId(paths, sourceKind);
   const seenThisRun = /* @__PURE__ */ new Set();
   const results = [];
-  let skippedNoAction = 0;
-  let skippedExisting = 0;
-  let replaced = 0;
+  const counts = {
+    skippedNoAction: 0,
+    skippedExisting: 0,
+    replaced: 0,
+    reimported: 0,
+    skippedLegacy: 0,
+    skippedDecreased: 0,
+    skippedDuplicate: 0
+  };
   let sanitizedPaths = 0;
-  for (const { externalId, toPayload } of candidates) {
+  const validate = (payload) => {
+    if (payload === null) return null;
+    const parsed = SessionImportPayloadSchema.safeParse(payload);
+    if (!parsed.success) {
+      throw new Error("Invalid import payload", { cause: parsed.error });
+    }
+    if (parsed.data.schema_version !== "0.1.0") {
+      throw new Error(`Unsupported import schema_version: ${parsed.data.schema_version}`);
+    }
+    return parsed.data;
+  };
+  for (const { externalId, sourcePath, toPayload } of candidates) {
     if (seenThisRun.has(externalId)) {
-      skippedExisting++;
+      counts.skippedExisting++;
       continue;
     }
-    const priorSessionIds = existingByExternalId.get(externalId) ?? [];
-    if (priorSessionIds.length > 0 && options.force !== true) {
-      skippedExisting++;
+    const priors = existingByExternalId.get(externalId) ?? [];
+    if (priors.length > 0 && options.force !== true) {
+      const prior = await classifyReimport(priors, sourcePath, externalId, counts);
+      if (prior === null) continue;
+      const payload2 = validate(await toPayload());
+      if (payload2 === null) {
+        counts.skippedNoAction++;
+        continue;
+      }
+      const readSize = payload2.session.source.source_size_bytes;
+      if (prior.sourceSizeBytes !== void 0 && readSize !== void 0 && readSize <= prior.sourceSizeBytes) {
+        console.error(
+          `Import: ${externalId} source changed during read (now ${readSize} <= ${prior.sourceSizeBytes} bytes); re-import skipped`
+        );
+        counts.skippedDecreased++;
+        continue;
+      }
+      const outcome = await reimportPreservingId(paths, manifest, prior.sessionId, payload2, {
+        dryRun: options.dryRun === true
+      });
+      if (outcome.status === "skipped") {
+        const detail = outcome.reason === "prior_events_unreadable" ? "prior events.jsonl has unreadable lines" : outcome.reason === "prior_chain_broken" ? "prior events.jsonl failed hash-chain verification (run 'basou verify')" : "source changed in a non-append way (derived events would be dropped)";
+        console.error(`Import: ${externalId} ${detail}; re-import skipped`);
+        counts.skippedNoAction++;
+        continue;
+      }
+      counts.reimported++;
+      seenThisRun.add(externalId);
       continue;
     }
-    const payload = await toPayload();
+    const payload = validate(await toPayload());
     if (payload === null) {
-      skippedNoAction++;
+      counts.skippedNoAction++;
       continue;
     }
-    const parsed = SessionImportPayloadSchema.safeParse(payload);
-    if (!parsed.success) {
-      throw new Error("Invalid import payload", { cause: parsed.error });
-    }
-    if (parsed.data.schema_version !== "0.1.0") {
-      throw new Error(`Unsupported import schema_version: ${parsed.data.schema_version}`);
-    }
-    if (priorSessionIds.length > 0 && options.force === true) {
+    if (priors.length > 0 && options.force === true) {
       if (options.dryRun !== true) {
-        for (const sid of priorSessionIds) {
-          await rm(join3(paths.sessions, sid), { recursive: true, force: true });
+        for (const { sessionId } of priors) {
+          await rm(join3(paths.sessions, sessionId), { recursive: true, force: true });
         }
       }
-      replaced++;
+      counts.replaced++;
     }
-    const result = await importSessionFromJson(paths, manifest, parsed.data, {
+    const result = await importSessionFromJson(paths, manifest, payload, {
       dryRun: options.dryRun === true
     });
     results.push(result);
@@ -1510,17 +1566,52 @@ async function importDerivedSessions(paths, manifest, options, sourceKind, candi
   if (sanitizedPaths > 0) {
     console.error(`Imported sessions: ${sanitizedPaths} path(s) sanitized`);
   }
-  printImportResult(options, results, { skippedNoAction, skippedExisting, replaced });
+  printImportResult(options, results, counts);
+}
+async function classifyReimport(priors, sourcePath, externalId, counts) {
+  if (priors.length > 1) {
+    console.error(
+      `Import: ${externalId} has ${priors.length} prior sessions; re-import skipped (use --force)`
+    );
+    counts.skippedDuplicate++;
+    return null;
+  }
+  const prior = priors[0];
+  if (prior === void 0) {
+    counts.skippedExisting++;
+    return null;
+  }
+  const currentSize = await statSize(sourcePath);
+  if (currentSize === void 0) {
+    counts.skippedExisting++;
+    return null;
+  }
+  if (prior.sourceSizeBytes === void 0) {
+    counts.skippedLegacy++;
+    return null;
+  }
+  if (currentSize === prior.sourceSizeBytes) {
+    counts.skippedExisting++;
+    return null;
+  }
+  if (currentSize < prior.sourceSizeBytes) {
+    console.error(
+      `Import: ${externalId} source shrank (${currentSize} < ${prior.sourceSizeBytes} bytes); re-import skipped (use --force to replace)`
+    );
+    counts.skippedDecreased++;
+    return null;
+  }
+  return prior;
 }
 function encodeProjectDir(projectPath) {
   return projectPath.replaceAll("/", "-");
 }
 async function loadExistingByExternalId(paths, sourceKind) {
   const byExternalId = /* @__PURE__ */ new Map();
-  const add = (externalId, sessionId) => {
+  const add = (externalId, prior) => {
     const list = byExternalId.get(externalId);
-    if (list === void 0) byExternalId.set(externalId, [sessionId]);
-    else list.push(sessionId);
+    if (list === void 0) byExternalId.set(externalId, [prior]);
+    else list.push(prior);
   };
   let sessionIds;
   try {
@@ -1531,19 +1622,21 @@ async function loadExistingByExternalId(paths, sourceKind) {
   for (const sessionId of sessionIds) {
     let session;
     try {
-      session = await readSessionYaml(paths, sessionId);
+      session = await readSessionYaml2(paths, sessionId);
     } catch {
       continue;
     }
     if (session.session.source.kind !== sourceKind) continue;
+    const sourceSizeBytes = session.session.source.source_size_bytes;
+    const prior = sourceSizeBytes !== void 0 ? { sessionId, sourceSizeBytes } : { sessionId };
     const ext = session.session.source.external_id;
     if (typeof ext === "string" && ext.length > 0) {
-      add(ext, sessionId);
+      add(ext, prior);
       continue;
     }
     const label = session.session.label;
     const match = typeof label === "string" ? label.match(/^claude-code import (\S+)$/) : null;
-    if (match?.[1] !== void 0) add(match[1], sessionId);
+    if (match?.[1] !== void 0) add(match[1], prior);
   }
   return byExternalId;
 }
@@ -1589,6 +1682,14 @@ async function pathExists(file) {
     throw error;
   }
 }
+async function statSize(file) {
+  try {
+    return (await stat(file)).size;
+  } catch (error) {
+    if (findErrorCode5(error, "ENOENT")) return void 0;
+    throw error;
+  }
+}
 async function discoverCodexRollouts(sessionsRoot, projectPaths, options) {
   const projectSet = new Set(projectPaths);
   const files = await findRolloutFiles(sessionsRoot);
@@ -1667,9 +1768,9 @@ async function readFirstLine(file) {
   }
 }
 async function readJsonlRecords(file) {
-  let body;
+  let buffer;
   try {
-    body = await readFile(file, "utf8");
+    buffer = await readFile(file);
   } catch (error) {
     if (findErrorCode5(error, "ENOENT")) {
       throw new Error("Source log not found", { cause: error });
@@ -1680,7 +1781,7 @@ async function readJsonlRecords(file) {
     throw new Error("Failed to read source log", { cause: error });
   }
   const records = [];
-  for (const line of body.split("\n")) {
+  for (const line of buffer.toString("utf8").split("\n")) {
     const trimmed = line.trim();
     if (trimmed.length === 0) continue;
     try {
@@ -1691,7 +1792,7 @@ async function readJsonlRecords(file) {
     } catch {
     }
   }
-  return records;
+  return { records, sizeBytes: buffer.length };
 }
 function isObject(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -1699,7 +1800,15 @@ function isObject(value) {
 function printImportResult(options, results, counts) {
   const isDry = options.dryRun === true;
   const eventTotal = results.reduce((sum, r) => sum + r.eventCount, 0);
-  const { skippedNoAction, skippedExisting, replaced } = counts;
+  const {
+    skippedNoAction,
+    skippedExisting,
+    replaced,
+    reimported,
+    skippedLegacy,
+    skippedDecreased,
+    skippedDuplicate
+  } = counts;
   if (options.json === true) {
     console.log(
       JSON.stringify({
@@ -1711,8 +1820,12 @@ function printImportResult(options, results, counts) {
         })),
         imported_count: results.length,
         replaced_count: replaced,
+        reimported_count: reimported,
         skipped_no_action: skippedNoAction,
         skipped_already_imported: skippedExisting,
+        skipped_legacy_untracked: skippedLegacy,
+        skipped_decreased: skippedDecreased,
+        skipped_duplicate: skippedDuplicate,
         event_total: eventTotal,
         dry_run: isDry
       })
@@ -1722,20 +1835,36 @@ function printImportResult(options, results, counts) {
   const skipParts = [];
   if (skippedNoAction > 0) skipParts.push(`${skippedNoAction} with no actions`);
   if (skippedExisting > 0) skipParts.push(`${skippedExisting} already imported`);
+  if (skippedLegacy > 0) skipParts.push(`${skippedLegacy} legacy (untracked size)`);
+  if (skippedDecreased > 0) skipParts.push(`${skippedDecreased} shrank`);
+  if (skippedDuplicate > 0) skipParts.push(`${skippedDuplicate} duplicated`);
   const skipSuffix = skipParts.length > 0 ? `; skipped ${skipParts.join(", ")}` : "";
   const eventsPart = replaced > 0 ? `${eventTotal} events, ${replaced} replaced` : `${eventTotal} events`;
-  if (results.length === 0) {
+  if (isDry) {
+    const parts = [];
+    if (results.length > 0) parts.push(`import ${results.length} session(s) (${eventsPart})`);
+    if (reimported > 0) parts.push(`re-import ${reimported} changed session(s)`);
+    const head = parts.length > 0 ? `Dry run: would ${parts.join(", ")}` : "Dry run: no changes";
+    console.log(`${head}${skipSuffix}`);
+    return;
+  }
+  if (results.length === 0 && reimported === 0) {
     console.log(
       skipParts.length > 0 ? `No new sessions imported (skipped ${skipParts.join(", ")})` : "No transcripts found to import"
     );
     return;
   }
-  if (isDry) {
-    console.log(`Dry run: would import ${results.length} session(s) (${eventsPart})${skipSuffix}`);
-    return;
+  const segments = [];
+  if (results.length > 0) {
+    const single = results.length === 1 && results[0] !== void 0 ? ` (${shortId2(results[0].sessionId)})` : "";
+    segments.push(`Imported ${results.length} session(s)${single} (${eventsPart})`);
   }
-  const single = results.length === 1 && results[0] !== void 0 ? ` (${shortId2(results[0].sessionId)})` : "";
-  console.log(`Imported ${results.length} session(s)${single} (${eventsPart})${skipSuffix}`);
+  if (reimported > 0) {
+    segments.push(
+      `${results.length > 0 ? "re-imported" : "Re-imported"} ${reimported} changed session(s)`
+    );
+  }
+  console.log(`${segments.join(", ")}${skipSuffix}`);
 }
 function shortId2(id) {
   if (id.startsWith(SES_PREFIX2)) {
@@ -1908,8 +2037,10 @@ async function runImport(adapter, fn) {
       status: "ran",
       importedCount: readCount(json.imported_count),
       replacedCount: readCount(json.replaced_count),
+      reimportedCount: readCount(json.reimported_count),
       skippedNoAction: readCount(json.skipped_no_action),
       skippedAlreadyImported: readCount(json.skipped_already_imported),
+      skippedLegacyUntracked: readCount(json.skipped_legacy_untracked),
       eventTotal: readCount(json.event_total),
       dryRun: json.dry_run === true
     };
@@ -2030,11 +2161,13 @@ function scansEqual(a, b) {
   }
   return true;
 }
-function importedCount(outcome) {
-  return outcome.status === "ran" ? outcome.importedCount : 0;
+function changedCount(outcome) {
+  return outcome.status === "ran" ? outcome.importedCount + outcome.reimportedCount + outcome.replacedCount : 0;
 }
 function describeOutcome(outcome) {
-  return outcome.status === "ran" ? `${outcome.adapter} +${outcome.importedCount}` : `${outcome.adapter} skipped`;
+  if (outcome.status !== "ran") return `${outcome.adapter} skipped`;
+  const reimported = outcome.reimportedCount > 0 ? ` ~${outcome.reimportedCount}` : "";
+  return `${outcome.adapter} +${outcome.importedCount}${reimported}`;
 }
 function hms(date) {
   return date.toISOString().slice(11, 19);
@@ -2042,7 +2175,7 @@ function hms(date) {
 async function runImports(deps) {
   const claude = await importClaudeCode(deps.importOptions, deps.ctx);
   const codex = await importCodex(deps.importOptions, deps.ctx);
-  return { claude, codex, imported: importedCount(claude) + importedCount(codex) };
+  return { claude, codex, changed: changedCount(claude) + changedCount(codex) };
 }
 async function regenerate(deps) {
   const nowIso = deps.now().toISOString();
@@ -2074,8 +2207,8 @@ async function runRefreshWatch(deps) {
     try {
       const current = await scanSourceLogs(roots);
       if (scansEqual(current, lastScan) && !scansEqual(current, importedScan)) {
-        const { claude, codex, imported } = await runImports(deps);
-        if (imported > 0) pendingRegen = true;
+        const { claude, codex, changed } = await runImports(deps);
+        if (changed > 0) pendingRegen = true;
         if (pendingRegen) {
           const sessions = await regenerate(deps);
           pendingRegen = false;
@@ -2214,9 +2347,11 @@ function describeImport(outcome) {
   }
   const verb = outcome.dryRun ? "would import" : "imported";
   const parts = [`${outcome.importedCount} session(s)`, `${outcome.eventTotal} events`];
+  if (outcome.reimportedCount > 0) parts.push(`${outcome.reimportedCount} re-imported`);
   if (outcome.replacedCount > 0) parts.push(`${outcome.replacedCount} replaced`);
   if (outcome.skippedAlreadyImported > 0)
     parts.push(`${outcome.skippedAlreadyImported} already imported`);
+  if (outcome.skippedLegacyUntracked > 0) parts.push(`${outcome.skippedLegacyUntracked} legacy`);
   return `${outcome.adapter}: ${verb} ${parts.join(", ")}`;
 }
 function printRefreshSummary(result) {
@@ -2660,12 +2795,14 @@ import {
   appendEventToExistingSession as appendEventToExistingSession2,
   assertBasouRootSafe as assertBasouRootSafe9,
   basouPaths as basouPaths9,
+  enumerateSessionDirs as enumerateSessionDirs2,
   findErrorCode as findErrorCode8,
   importSessionFromJson as importSessionFromJson2,
   loadSessionEntries,
   readAllEvents,
   readManifest as readManifest5,
   readYamlFile as readYamlFile4,
+  rechainSessionInPlace,
   resolveRepositoryRoot as resolveRepositoryRoot10,
   resolveSessionId as resolveSessionId2,
   resolveTaskId,
@@ -2714,6 +2851,11 @@ function registerSessionCommand(program2) {
   session.command("note <session_id>").description("Append a note_added event to an existing session").option("--body <text>", "Note body (inline)", parseNoteBodyOption).option("--from-file <path>", "Read note body from a file").option("--json", "Output the result as JSON").option("-v, --verbose", "Show error causes").action(async (sessionIdInput, options) => {
     await runSessionNote(sessionIdInput, options);
   });
+  session.command("rechain").description(
+    "Add the tamper-evidence hash chain, in place, to imported sessions created before chaining existed"
+  ).option("--session <id>", "Rechain a single session (unique id prefix accepted)").option("--all", "Rechain every session in the workspace").option("--dry-run", "Compute the outcomes only; do not write").option("--json", "Output the outcomes as JSON").option("-v, --verbose", "Show error causes").action(async (options) => {
+    await runSessionRechain(options);
+  });
 }
 async function runSessionList(options, ctx = {}) {
   try {
@@ -3255,6 +3397,74 @@ function printSessionNoteResult(options, sessionId, eventId, sessionStatus, body
   const preview = body.length > NOTE_BODY_PREVIEW_LIMIT ? `${body.slice(0, NOTE_BODY_PREVIEW_HEAD)}...` : body;
   console.log(`Added note to session ${sid} (${sessionStatus}): ${preview}`);
 }
+async function runSessionRechain(options, ctx = {}) {
+  try {
+    await doRunSessionRechain(options, ctx);
+  } catch (error) {
+    renderCliError(error, { verbose: isVerbose(options) });
+    process.exitCode = 1;
+  }
+}
+async function doRunSessionRechain(options, ctx) {
+  if (options.session !== void 0 && options.all === true) {
+    throw new Error("Specify either --session <id> or --all, not both");
+  }
+  if (options.session === void 0 && options.all !== true) {
+    throw new Error("Specify --session <id> or --all");
+  }
+  const cwd = ctx.cwd ?? process.cwd();
+  const repositoryRoot = await resolveRepositoryRootForSession(cwd, "rechain");
+  const paths = basouPaths9(repositoryRoot);
+  await assertWorkspaceInitialized7(paths.root);
+  const sessionIds = options.session !== void 0 ? [await resolveSessionId2(paths, options.session)] : await enumerateSessionDirs2(paths);
+  const dryRun = options.dryRun === true;
+  const rows = [];
+  for (const sessionId of sessionIds) {
+    let outcome;
+    try {
+      outcome = await rechainSessionInPlace(paths, sessionId, { dryRun });
+    } catch (error) {
+      rows.push({
+        session_id: sessionId,
+        status: "error",
+        message: error instanceof Error ? error.message : "Unknown error"
+      });
+      continue;
+    }
+    if (outcome.status === "rechained") {
+      rows.push({ session_id: sessionId, status: "rechained", event_count: outcome.eventCount });
+    } else {
+      rows.push({ session_id: sessionId, status: "skipped", reason: outcome.reason });
+    }
+  }
+  const tamperedCount = rows.filter((r) => r.reason === "tampered").length;
+  const errorCount = rows.filter((r) => r.status === "error").length;
+  if (options.json === true) {
+    console.log(JSON.stringify(rows, null, 2));
+  } else {
+    for (const row of rows) {
+      console.log(`${row.session_id}  ${renderRechainRow(row, dryRun)}`);
+    }
+    const rechained = rows.filter((r) => r.status === "rechained").length;
+    const skipped = rows.filter((r) => r.status === "skipped").length;
+    console.log(
+      `Sessions: ${rows.length} total \u2014 ${rechained} ${dryRun ? "would be rechained" : "rechained"}, ${skipped} skipped, ${errorCount} errors`
+    );
+  }
+  if (tamperedCount > 0 || errorCount > 0) {
+    process.exitCode = 1;
+  }
+}
+function renderRechainRow(row, dryRun) {
+  switch (row.status) {
+    case "rechained":
+      return `${dryRun ? "would rechain" : "rechained"} (${row.event_count} events)`;
+    case "skipped":
+      return row.reason === "tampered" ? "skipped (TAMPERED \u2014 inspect with 'basou verify')" : `skipped (${row.reason})`;
+    case "error":
+      return `error (${row.message})`;
+  }
+}
 
 // src/commands/stats.ts
 import {
@@ -4591,9 +4801,107 @@ function maxLen3(values, floor) {
   return max;
 }
 
+// src/commands/verify.ts
+import {
+  assertBasouRootSafe as assertBasouRootSafe13,
+  basouPaths as basouPaths13,
+  enumerateSessionDirs as enumerateSessionDirs3,
+  findErrorCode as findErrorCode12,
+  resolveRepositoryRoot as resolveRepositoryRoot14,
+  resolveSessionId as resolveSessionId4,
+  verifyEventsChain
+} from "@basou/core";
+function registerVerifyCommand(program2) {
+  program2.command("verify").description(
+    "Verify the tamper-evidence hash chain of imported sessions' event logs (read-only)"
+  ).option("--session <id>", "Verify a single session (unique id prefix accepted)").option("--all", "Verify every session (the default when --session is omitted)").option("--json", "Output the verdicts as JSON").option("-v, --verbose", "Show error causes").action(async (opts) => {
+    await runVerify(opts);
+  });
+}
+async function runVerify(options, ctx = {}) {
+  try {
+    await doRunVerify(options, ctx);
+  } catch (error) {
+    renderCliError(error, { verbose: isVerbose(options) });
+    process.exitCode = 1;
+  }
+}
+async function doRunVerify(options, ctx) {
+  if (options.session !== void 0 && options.all === true) {
+    throw new Error("Specify either --session <id> or --all, not both");
+  }
+  const cwd = ctx.cwd ?? process.cwd();
+  const repositoryRoot = await resolveRepositoryRootForVerify(cwd);
+  const paths = basouPaths13(repositoryRoot);
+  await assertWorkspaceInitialized10(paths.root);
+  const sessionIds = options.session !== void 0 ? [await resolveSessionId4(paths, options.session)] : await enumerateSessionDirs3(paths);
+  const rows = [];
+  for (const sessionId of sessionIds) {
+    const verdict = await verifyEventsChain(paths, sessionId);
+    rows.push({
+      session_id: sessionId,
+      status: verdict.status,
+      event_count: verdict.eventCount,
+      ...verdict.reason !== void 0 ? { reason: verdict.reason } : {},
+      ...verdict.line !== void 0 ? { line: verdict.line } : {}
+    });
+  }
+  const tamperedCount = rows.filter((r) => r.status === "tampered").length;
+  if (options.json === true) {
+    console.log(JSON.stringify(rows, null, 2));
+  } else {
+    for (const row of rows) {
+      console.log(`${row.session_id}  ${renderVerdict(row)}`);
+    }
+    const tally = (status) => rows.filter((r) => r.status === status).length;
+    console.log(
+      `Sessions: ${rows.length} total \u2014 ${tally("verified")} verified, ${tally("unchained")} unchained, ${tally("empty")} empty, ${tally("incomplete")} incomplete, ${tamperedCount} tampered`
+    );
+  }
+  if (tamperedCount > 0) {
+    process.exitCode = 1;
+  }
+}
+function renderVerdict(row) {
+  switch (row.status) {
+    case "verified":
+      return `verified (${row.event_count} events)`;
+    case "tampered":
+      return row.line !== void 0 ? `TAMPERED (${row.reason} at line ${row.line})` : `TAMPERED (${row.reason})`;
+    case "incomplete":
+      return "incomplete (session.yaml missing; re-import to repair)";
+    case "unchained":
+      return "unchained (not an imported session, or imported before chaining)";
+    case "empty":
+      return "empty";
+  }
+}
+async function resolveRepositoryRootForVerify(cwd) {
+  try {
+    return await resolveRepositoryRoot14(cwd);
+  } catch (error) {
+    if (error instanceof Error && error.message === "Not a git repository") {
+      throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou verify'.", {
+        cause: error
+      });
+    }
+    throw error;
+  }
+}
+async function assertWorkspaceInitialized10(basouRoot) {
+  try {
+    await assertBasouRootSafe13(basouRoot);
+  } catch (error) {
+    if (findErrorCode12(error, "ENOENT")) {
+      throw new Error("Workspace not initialized. Run 'basou init' first.");
+    }
+    throw error;
+  }
+}
+
 // src/commands/view.ts
 import { spawn } from "child_process";
-import { assertBasouRootSafe as assertBasouRootSafe13, basouPaths as basouPaths13, findErrorCode as findErrorCode13, resolveRepositoryRoot as resolveRepositoryRoot14 } from "@basou/core";
+import { assertBasouRootSafe as assertBasouRootSafe14, basouPaths as basouPaths14, findErrorCode as findErrorCode14, resolveRepositoryRoot as resolveRepositoryRoot15 } from "@basou/core";
 import { InvalidArgumentError as InvalidArgumentError5 } from "commander";
 
 // src/lib/view-server.ts
@@ -4602,7 +4910,7 @@ import { join as join8 } from "path";
 import {
   computeWorkStats as computeWorkStats2,
   enumerateApprovals as enumerateApprovals2,
-  findErrorCode as findErrorCode12,
+  findErrorCode as findErrorCode13,
   isLazyExpired as isLazyExpired2,
   loadApproval as loadApproval2,
   loadSessionEntries as loadSessionEntries3,
@@ -4610,7 +4918,7 @@ import {
   readAllEvents as readAllEvents2,
   readManifest as readManifest8,
   readMarkdownFile as readMarkdownFile4,
-  readSessionYaml as readSessionYaml2,
+  readSessionYaml as readSessionYaml3,
   readTaskFile as readTaskFile2,
   renderDecisions as renderDecisions3,
   renderHandoff as renderHandoff3
@@ -5204,7 +5512,7 @@ async function overview(deps) {
   try {
     manifest = await readManifest8(deps.paths);
   } catch (error) {
-    if (findErrorCode12(error, "ENOENT")) {
+    if (findErrorCode13(error, "ENOENT")) {
       return { initialized: false, repoRoot: deps.repoRoot };
     }
     throw error;
@@ -5251,7 +5559,7 @@ async function sessionsList(deps) {
 async function sessionDetail(deps, sessionId) {
   let session;
   try {
-    session = await readSessionYaml2(deps.paths, sessionId);
+    session = await readSessionYaml3(deps.paths, sessionId);
   } catch (error) {
     if (error instanceof Error && error.message === "YAML file not found") {
       throw new HttpError(404, "Session not found");
@@ -5419,8 +5727,8 @@ async function runView(options, ctx = {}) {
 async function doRunView(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForView(cwd);
-  const paths = basouPaths13(repositoryRoot);
-  await assertWorkspaceInitialized10(paths.root);
+  const paths = basouPaths14(repositoryRoot);
+  await assertWorkspaceInitialized11(paths.root);
   const deps = {
     paths,
     repoRoot: repositoryRoot,
@@ -5451,7 +5759,7 @@ async function startListening(port, deps) {
   try {
     return await startViewServer({ port, deps });
   } catch (error) {
-    if (findErrorCode13(error, "EADDRINUSE")) {
+    if (findErrorCode14(error, "EADDRINUSE")) {
       throw new Error(`Port ${port} is already in use. Pass --port <n> to choose another.`, {
         cause: error
       });
@@ -5502,7 +5810,7 @@ function waitForShutdown(signal) {
 }
 async function resolveRepositoryRootForView(cwd) {
   try {
-    return await resolveRepositoryRoot14(cwd);
+    return await resolveRepositoryRoot15(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou view'.", {
@@ -5512,11 +5820,11 @@ async function resolveRepositoryRootForView(cwd) {
     throw error;
   }
 }
-async function assertWorkspaceInitialized10(basouRoot) {
+async function assertWorkspaceInitialized11(basouRoot) {
   try {
-    await assertBasouRootSafe13(basouRoot);
+    await assertBasouRootSafe14(basouRoot);
   } catch (error) {
-    if (findErrorCode13(error, "ENOENT")) {
+    if (findErrorCode14(error, "ENOENT")) {
       throw new Error("Workspace not initialized. Run 'basou init' first.");
     }
     throw error;
@@ -5538,6 +5846,7 @@ function buildProgram() {
   registerSessionCommand(program2);
   registerImportCommand(program2);
   registerRefreshCommand(program2);
+  registerVerifyCommand(program2);
   registerViewCommand(program2);
   registerApprovalCommand(program2);
   registerDecisionCommand(program2);