@basou/cli 0.8.0 → 0.10.0

package/dist/index.js

@@ -115,7 +115,8 @@ import { join } from "path";
 import {
   ApprovalSchema,
   ApprovalStatusSchema,
-  appendEvent,
+  acquireLock,
+  appendChainedEventLocked,
   assertBasouRootSafe,
   basouPaths,
   enumerateApprovals,
@@ -124,6 +125,7 @@ import {
   linkYamlFile,
   loadApproval,
   prefixedUlid,
+  readSessionYaml,
   readYamlFile,
   replayEvents,
   resolveRepositoryRoot
@@ -319,46 +321,63 @@ async function doRunApprovalResolve(idInput, options, ctx, decision) {
   if (approval.status !== "pending") {
     throw new Error(`Approval status mismatch: pending YAML has status=${approval.status}`);
   }
-  const sessionDir = join(paths.sessions, approval.session_id);
-  for await (const ev of replayEvents(sessionDir, {
-    onWarning: (w) => printReplayWarning(w, approval.session_id)
-  })) {
-    if (isApprovalEvent(ev) && ev.approval_id === approval.id && (ev.type === "approval_approved" || ev.type === "approval_rejected" || ev.type === "approval_expired")) {
-      throw new Error(`Approval already resolved (per events.jsonl): ${idInput}`);
-    }
-  }
   const now = /* @__PURE__ */ new Date();
-  if (isLazyExpired(approval, now)) {
-    throw new Error(`Approval already expired: ${idInput}`);
-  }
   const occurredAt = now.toISOString();
   const eventId = prefixedUlid("evt");
-  if (decision === "approve") {
-    const note = options.note ?? null;
-    await appendEvent(sessionDir, {
-      schema_version: "0.1.0",
-      id: eventId,
-      session_id: approval.session_id,
-      occurred_at: occurredAt,
-      source: "local-cli",
-      type: "approval_approved",
-      approval_id: approval.id,
-      resolver: "local-cli",
-      note
-    });
-  } else {
-    const reason = options.reason;
-    await appendEvent(sessionDir, {
-      schema_version: "0.1.0",
-      id: eventId,
-      session_id: approval.session_id,
-      occurred_at: occurredAt,
-      source: "local-cli",
-      type: "approval_rejected",
-      approval_id: approval.id,
-      resolver: "local-cli",
-      reason
-    });
+  const sessionLock = await acquireLock(paths, "session", approval.session_id);
+  try {
+    const sessionDir = join(paths.sessions, approval.session_id);
+    for await (const ev of replayEvents(sessionDir, {
+      onWarning: (w) => printReplayWarning(w, approval.session_id)
+    })) {
+      if (isApprovalEvent(ev) && ev.approval_id === approval.id && (ev.type === "approval_approved" || ev.type === "approval_rejected" || ev.type === "approval_expired")) {
+        throw new Error(`Approval already resolved (per events.jsonl): ${idInput}`);
+      }
+    }
+    if (isLazyExpired(approval, now)) {
+      throw new Error(`Approval already expired: ${idInput}`);
+    }
+    let sessionStatus = null;
+    try {
+      sessionStatus = (await readSessionYaml(paths, approval.session_id)).session.status;
+    } catch {
+      sessionStatus = null;
+    }
+    const attachable = sessionStatus === "initialized" || sessionStatus === "running" || sessionStatus === "waiting_approval";
+    if (sessionStatus !== null && !attachable) {
+      throw new Error(
+        `Cannot resolve an approval for a session that is not active (status=${sessionStatus}): ${idInput}`
+      );
+    }
+    if (decision === "approve") {
+      const note = options.note ?? null;
+      await appendChainedEventLocked(paths, approval.session_id, {
+        schema_version: "0.1.0",
+        id: eventId,
+        session_id: approval.session_id,
+        occurred_at: occurredAt,
+        source: "local-cli",
+        type: "approval_approved",
+        approval_id: approval.id,
+        resolver: "local-cli",
+        note
+      });
+    } else {
+      const reason = options.reason;
+      await appendChainedEventLocked(paths, approval.session_id, {
+        schema_version: "0.1.0",
+        id: eventId,
+        session_id: approval.session_id,
+        occurred_at: occurredAt,
+        source: "local-cli",
+        type: "approval_rejected",
+        approval_id: approval.id,
+        resolver: "local-cli",
+        reason
+      });
+    }
+  } finally {
+    await sessionLock.release();
   }
   const resolvedApproval = decision === "approve" ? {
     ...approval,
@@ -615,7 +634,7 @@ function printNoApprovals(options) {
 
 // src/commands/decision.ts
 import {
-  acquireLock,
+  acquireLock as acquireLock2,
   appendEventToExistingSession,
   assertBasouRootSafe as assertBasouRootSafe2,
   basouPaths as basouPaths2,
@@ -680,7 +699,7 @@ async function doRunDecisionRecord(options, ctx) {
   if (options.session !== void 0) {
     const sessionId = await resolveSessionId(paths, options.session);
     const sesId = sessionId;
-    const sessionLock = await acquireLock(paths, "session", sesId);
+    const sessionLock = await acquireLock2(paths, "session", sesId);
     let result;
     try {
       result = await appendEventToExistingSession({
@@ -944,10 +963,12 @@ import { mkdir } from "fs/promises";
 import { homedir } from "os";
 import { join as join2 } from "path";
 import {
+  acquireLock as acquireLock3,
   assertBasouRootSafe as assertBasouRootSafe4,
   basouPaths as basouPaths4,
   ChildProcessRunner,
-  appendEvent as coreAppendEvent,
+  appendChainedEvent as coreAppendChainedEvent,
+  finalizeSessionYaml,
   getSnapshot,
   overwriteYamlFile,
   parseDuration,
@@ -973,7 +994,6 @@ function registerExecCommand(program2) {
 async function runExec(command, args, options, ctx = {}) {
   const runner = ctx.runner ?? new ChildProcessRunner();
   const now = ctx.now ?? (() => /* @__PURE__ */ new Date());
-  const appendEvent2 = ctx.appendEvent ?? coreAppendEvent;
   const cwd = options.cwd ?? process.cwd();
   const timeout_ms = options.timeout !== void 0 ? parseDuration(options.timeout) : void 0;
   const repoRoot = await resolveRepositoryRootForExec(cwd);
@@ -983,6 +1003,9 @@ async function runExec(command, args, options, ctx = {}) {
   const sessionId = prefixedUlid3("ses");
   const sessionDir = join2(paths.sessions, sessionId);
   await mkdir(sessionDir, { recursive: true });
+  const appendEvent = ctx.appendEvent ?? (async (_sessionDir, event) => {
+    await coreAppendChainedEvent(paths, sessionId, event);
+  });
   const startedAt = now().toISOString();
   const sessionYamlPath = join2(sessionDir, "session.yaml");
   const session = buildInitialSession({
@@ -994,7 +1017,7 @@ async function runExec(command, args, options, ctx = {}) {
     startedAt
   });
   await writeYamlFile(sessionYamlPath, session);
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_started",
     id: prefixedUlid3("evt"),
@@ -1003,10 +1026,10 @@ async function runExec(command, args, options, ctx = {}) {
     source: "terminal-recording"
   });
   if (options.snapshot !== false) {
-    await tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, appendEvent2);
+    await tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, appendEvent);
   }
   const runningAt = now().toISOString();
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_status_changed",
     id: prefixedUlid3("evt"),
@@ -1016,9 +1039,14 @@ async function runExec(command, args, options, ctx = {}) {
     from: "initialized",
     to: "running"
   });
-  await mutateSessionYaml(sessionYamlPath, (s) => {
-    s.session.status = "running";
-  });
+  const runningLock = await acquireLock3(paths, "session", sessionId);
+  try {
+    await mutateSessionYaml(sessionYamlPath, (s) => {
+      s.session.status = "running";
+    });
+  } finally {
+    await runningLock.release();
+  }
   const controller = new AbortController();
   let signalReceived = null;
   let activeChild = null;
@@ -1054,7 +1082,7 @@ async function runExec(command, args, options, ctx = {}) {
         }
       });
     } catch (spawnError) {
-      await finalizeSessionAsFailed(sessionDir, sessionYamlPath, sessionId, appendEvent2, {
+      await finalizeSessionAsFailed(paths, sessionDir, sessionId, appendEvent, {
         command,
         args,
         cwd,
@@ -1070,7 +1098,7 @@ async function runExec(command, args, options, ctx = {}) {
     activeChild = null;
   }
   const endedAt = now().toISOString();
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "command_executed",
     id: prefixedUlid3("evt"),
@@ -1086,10 +1114,10 @@ async function runExec(command, args, options, ctx = {}) {
     duration_ms: result.duration_ms
   });
   if (options.snapshot !== false) {
-    await tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, appendEvent2);
+    await tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, appendEvent);
   }
   const finalStatus = decideFinalStatus(result, signalReceived);
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_status_changed",
     id: prefixedUlid3("evt"),
@@ -1099,7 +1127,7 @@ async function runExec(command, args, options, ctx = {}) {
     from: "running",
     to: finalStatus
   });
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_ended",
     id: prefixedUlid3("evt"),
@@ -1108,7 +1136,7 @@ async function runExec(command, args, options, ctx = {}) {
     source: "terminal-recording",
     ...result.exit_code !== null ? { exit_code: result.exit_code } : {}
   });
-  await mutateSessionYaml(sessionYamlPath, (s) => {
+  await finalizeSessionYaml(paths, sessionId, (s) => {
     s.session.status = finalStatus;
     s.session.ended_at = endedAt;
     s.session.invocation.exit_code = result.exit_code;
@@ -1138,7 +1166,7 @@ function signalToExitCode(sig) {
   const num = SIGNUM_MAP[sig] ?? 1;
   return 128 + num;
 }
-async function tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, appendEvent2) {
+async function tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, appendEvent) {
   let snapshot;
   try {
     snapshot = await getSnapshot(repoRoot);
@@ -1146,7 +1174,7 @@ async function tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, append
     console.warn(normalizeGitSnapshotSkipMessage(error));
     return;
   }
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "git_snapshot",
     id: prefixedUlid3("evt"),
@@ -1202,8 +1230,8 @@ async function mutateSessionYaml(filePath, mutator) {
   const validated = SessionSchema.parse(parsed);
   await overwriteYamlFile(filePath, validated);
 }
-async function finalizeSessionAsFailed(sessionDir, sessionYamlPath, sessionId, appendEvent2, ctx) {
-  await appendEvent2(sessionDir, {
+async function finalizeSessionAsFailed(paths, sessionDir, sessionId, appendEvent, ctx) {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "command_executed",
     id: prefixedUlid3("evt"),
@@ -1218,7 +1246,7 @@ async function finalizeSessionAsFailed(sessionDir, sessionYamlPath, sessionId, a
     ...ctx.signalReceived !== null ? { received_signal: ctx.signalReceived } : {},
     duration_ms: 0
   });
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_status_changed",
     id: prefixedUlid3("evt"),
@@ -1228,7 +1256,7 @@ async function finalizeSessionAsFailed(sessionDir, sessionYamlPath, sessionId, a
     from: "running",
     to: "failed"
   });
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_ended",
     id: prefixedUlid3("evt"),
@@ -1236,7 +1264,7 @@ async function finalizeSessionAsFailed(sessionDir, sessionYamlPath, sessionId, a
     occurred_at: ctx.occurredAt,
     source: "terminal-recording"
   });
-  await mutateSessionYaml(sessionYamlPath, (s) => {
+  await finalizeSessionYaml(paths, sessionId, (s) => {
     s.session.status = "failed";
     s.session.ended_at = ctx.occurredAt;
     s.session.invocation.exit_code = null;
@@ -1342,7 +1370,7 @@ import {
   findErrorCode as findErrorCode5,
   importSessionFromJson,
   readManifest as readManifest3,
-  readSessionYaml,
+  readSessionYaml as readSessionYaml2,
   reimportPreservingId,
   resolveRepositoryRoot as resolveRepositoryRoot6,
   SessionImportPayloadSchema
@@ -1524,7 +1552,7 @@ async function importDerivedSessions(paths, manifest, options, sourceKind, candi
         dryRun: options.dryRun === true
       });
       if (outcome.status === "skipped") {
-        const detail = outcome.reason === "prior_events_unreadable" ? "prior events.jsonl has unreadable lines" : "source changed in a non-append way (derived events would be dropped)";
+        const detail = outcome.reason === "prior_events_unreadable" ? "prior events.jsonl has unreadable lines" : outcome.reason === "prior_chain_broken" ? "prior events.jsonl failed hash-chain verification (run 'basou verify')" : "source changed in a non-append way (derived events would be dropped)";
         console.error(`Import: ${externalId} ${detail}; re-import skipped`);
         counts.skippedNoAction++;
         continue;
@@ -1612,7 +1640,7 @@ async function loadExistingByExternalId(paths, sourceKind) {
   for (const sessionId of sessionIds) {
     let session;
     try {
-      session = await readSessionYaml(paths, sessionId);
+      session = await readSessionYaml2(paths, sessionId);
     } catch {
       continue;
     }
@@ -2388,11 +2416,13 @@ import { mkdir as mkdir2 } from "fs/promises";
 import { homedir as homedir4 } from "os";
 import { join as join5 } from "path";
 import {
+  acquireLock as acquireLock4,
   assertBasouRootSafe as assertBasouRootSafe8,
   basouPaths as basouPaths8,
   ChildProcessRunner as ChildProcessRunner2,
   claudeCodeAdapterMetadata,
-  appendEvent as coreAppendEvent2,
+  appendChainedEvent as coreAppendChainedEvent2,
+  finalizeSessionYaml as finalizeSessionYaml2,
   getDiff,
   getSnapshot as getSnapshot2,
   overwriteYamlFile as overwriteYamlFile2,
@@ -2428,7 +2458,6 @@ function registerRunCommand(program2, ctx = {}) {
 async function runClaudeCode(args, options, ctx = {}) {
   const runner = ctx.runner ?? new ChildProcessRunner2();
   const now = ctx.now ?? (() => /* @__PURE__ */ new Date());
-  const appendEvent2 = ctx.appendEvent ?? coreAppendEvent2;
   const resolveCommand = ctx.resolveCommand ?? resolveClaudeCodeCommand;
   const getDiffFn = ctx.getDiff ?? getDiff;
   const { command } = await resolveCommand();
@@ -2440,6 +2469,9 @@ async function runClaudeCode(args, options, ctx = {}) {
   const sessionId = prefixedUlid4("ses");
   const sessionDir = join5(paths.sessions, sessionId);
   await mkdir2(sessionDir, { recursive: true });
+  const appendEvent = ctx.appendEvent ?? (async (_sessionDir, event) => {
+    await coreAppendChainedEvent2(paths, sessionId, event);
+  });
   const startedAt = now().toISOString();
   const sessionYamlPath = join5(sessionDir, "session.yaml");
   const session = buildInitialSession2({
@@ -2451,7 +2483,7 @@ async function runClaudeCode(args, options, ctx = {}) {
     startedAt
   });
   await writeYamlFile2(sessionYamlPath, session);
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_started",
     id: prefixedUlid4("evt"),
@@ -2461,10 +2493,10 @@ async function runClaudeCode(args, options, ctx = {}) {
   });
   let preSnapshot = null;
   if (options.snapshot !== false) {
-    preSnapshot = await tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appendEvent2);
+    preSnapshot = await tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appendEvent);
   }
   const runningAt = now().toISOString();
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_status_changed",
     id: prefixedUlid4("evt"),
@@ -2474,9 +2506,14 @@ async function runClaudeCode(args, options, ctx = {}) {
     from: "initialized",
     to: "running"
   });
-  await mutateSessionYaml2(sessionYamlPath, (s) => {
-    s.session.status = "running";
-  });
+  const runningLock = await acquireLock4(paths, "session", sessionId);
+  try {
+    await mutateSessionYaml2(sessionYamlPath, (s) => {
+      s.session.status = "running";
+    });
+  } finally {
+    await runningLock.release();
+  }
   const controller = new AbortController();
   let signalReceived = null;
   let activeChild = null;
@@ -2511,7 +2548,7 @@ async function runClaudeCode(args, options, ctx = {}) {
         }
       });
     } catch (spawnError) {
-      await finalizeSessionAsFailed2(sessionDir, sessionYamlPath, sessionId, appendEvent2, {
+      await finalizeSessionAsFailed2(paths, sessionDir, sessionId, appendEvent, {
         command,
         args,
         cwd: repoRoot,
@@ -2527,7 +2564,7 @@ async function runClaudeCode(args, options, ctx = {}) {
     activeChild = null;
   }
   const endedAt = now().toISOString();
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "command_executed",
     id: prefixedUlid4("evt"),
@@ -2544,7 +2581,7 @@ async function runClaudeCode(args, options, ctx = {}) {
   });
   let postSnapshot = null;
   if (options.snapshot !== false) {
-    postSnapshot = await tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appendEvent2);
+    postSnapshot = await tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appendEvent);
   }
   let diff = null;
   if (preSnapshot !== null && postSnapshot !== null) {
@@ -2555,7 +2592,7 @@ async function runClaudeCode(args, options, ctx = {}) {
       preSnapshot.head,
       postSnapshot.head,
       now().toISOString(),
-      appendEvent2,
+      appendEvent,
       getDiffFn
     );
   }
@@ -2565,7 +2602,7 @@ async function runClaudeCode(args, options, ctx = {}) {
     homedir: homedir4()
   }).sanitized;
   const finalStatus = decideFinalStatus2(result, signalReceived);
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_status_changed",
     id: prefixedUlid4("evt"),
@@ -2575,7 +2612,7 @@ async function runClaudeCode(args, options, ctx = {}) {
     from: "running",
     to: finalStatus
   });
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_ended",
     id: prefixedUlid4("evt"),
@@ -2584,7 +2621,7 @@ async function runClaudeCode(args, options, ctx = {}) {
     source: claudeCodeAdapterMetadata.kind,
     ...result.exit_code !== null ? { exit_code: result.exit_code } : {}
   });
-  await mutateSessionYaml2(sessionYamlPath, (s) => {
+  await finalizeSessionYaml2(paths, sessionId, (s) => {
     s.session.status = finalStatus;
     s.session.ended_at = endedAt;
     s.session.invocation.exit_code = result.exit_code;
@@ -2613,7 +2650,7 @@ function signalToExitCode2(sig) {
   const num = SIGNUM_MAP2[sig] ?? 1;
   return 128 + num;
 }
-async function tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appendEvent2) {
+async function tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appendEvent) {
   let snapshot;
   try {
     snapshot = await getSnapshot2(repoRoot);
@@ -2621,7 +2658,7 @@ async function tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appen
     console.warn(normalizeGitSnapshotSkipMessage2(error));
     return null;
   }
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "git_snapshot",
     id: prefixedUlid4("evt"),
@@ -2632,7 +2669,7 @@ async function tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appen
   });
   return snapshot;
 }
-async function tryAppendFileChangedEvents(sessionDir, sessionId, repoRoot, baseRef, headRef, occurredAt, appendEvent2, getDiffFn) {
+async function tryAppendFileChangedEvents(sessionDir, sessionId, repoRoot, baseRef, headRef, occurredAt, appendEvent, getDiffFn) {
   let diff;
   try {
     diff = await getDiffFn(repoRoot, baseRef, headRef);
@@ -2641,7 +2678,7 @@ async function tryAppendFileChangedEvents(sessionDir, sessionId, repoRoot, baseR
     return null;
   }
   for (const change of diff.changed_files) {
-    await appendEvent2(sessionDir, {
+    await appendEvent(sessionDir, {
       schema_version: "0.1.0",
       type: "file_changed",
       id: prefixedUlid4("evt"),
@@ -2724,8 +2761,8 @@ async function mutateSessionYaml2(filePath, mutator) {
   const validated = SessionSchema2.parse(parsed);
   await overwriteYamlFile2(filePath, validated);
 }
-async function finalizeSessionAsFailed2(sessionDir, sessionYamlPath, sessionId, appendEvent2, ctx) {
-  await appendEvent2(sessionDir, {
+async function finalizeSessionAsFailed2(paths, sessionDir, sessionId, appendEvent, ctx) {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "command_executed",
     id: prefixedUlid4("evt"),
@@ -2740,7 +2777,7 @@ async function finalizeSessionAsFailed2(sessionDir, sessionYamlPath, sessionId,
     ...ctx.signalReceived !== null ? { received_signal: ctx.signalReceived } : {},
     duration_ms: 0
   });
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_status_changed",
     id: prefixedUlid4("evt"),
@@ -2750,7 +2787,7 @@ async function finalizeSessionAsFailed2(sessionDir, sessionYamlPath, sessionId,
     from: "running",
     to: "failed"
   });
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_ended",
     id: prefixedUlid4("evt"),
@@ -2758,7 +2795,7 @@ async function finalizeSessionAsFailed2(sessionDir, sessionYamlPath, sessionId,
     occurred_at: ctx.occurredAt,
     source: claudeCodeAdapterMetadata.kind
   });
-  await mutateSessionYaml2(sessionYamlPath, (s) => {
+  await finalizeSessionYaml2(paths, sessionId, (s) => {
     s.session.status = "failed";
     s.session.ended_at = ctx.occurredAt;
     s.session.invocation.exit_code = null;
@@ -2781,16 +2818,18 @@ async function resolveRepositoryRootForRun(cwd) {
 import { readFile as readFile2 } from "fs/promises";
 import { basename as basename3, isAbsolute, join as join6, relative as relative2 } from "path";
 import {
-  acquireLock as acquireLock2,
+  acquireLock as acquireLock5,
   appendEventToExistingSession as appendEventToExistingSession2,
   assertBasouRootSafe as assertBasouRootSafe9,
   basouPaths as basouPaths9,
+  enumerateSessionDirs as enumerateSessionDirs2,
   findErrorCode as findErrorCode8,
   importSessionFromJson as importSessionFromJson2,
   loadSessionEntries,
   readAllEvents,
   readManifest as readManifest5,
   readYamlFile as readYamlFile4,
+  rechainSessionInPlace,
   resolveRepositoryRoot as resolveRepositoryRoot10,
   resolveSessionId as resolveSessionId2,
   resolveTaskId,
@@ -2839,6 +2878,11 @@ function registerSessionCommand(program2) {
   session.command("note <session_id>").description("Append a note_added event to an existing session").option("--body <text>", "Note body (inline)", parseNoteBodyOption).option("--from-file <path>", "Read note body from a file").option("--json", "Output the result as JSON").option("-v, --verbose", "Show error causes").action(async (sessionIdInput, options) => {
     await runSessionNote(sessionIdInput, options);
   });
+  session.command("rechain").description(
+    "Add the tamper-evidence hash chain, in place, to imported sessions created before chaining existed"
+  ).option("--session <id>", "Rechain a single session (unique id prefix accepted)").option("--all", "Rechain every session in the workspace").option("--dry-run", "Compute the outcomes only; do not write").option("--json", "Output the outcomes as JSON").option("-v, --verbose", "Show error causes").action(async (options) => {
+    await runSessionRechain(options);
+  });
 }
 async function runSessionList(options, ctx = {}) {
   try {
@@ -3324,7 +3368,7 @@ async function doRunSessionNote(sessionIdInput, options, ctx) {
   }
   const occurredAt = (/* @__PURE__ */ new Date()).toISOString();
   const sesId = sessionId;
-  const sessionLock = await acquireLock2(paths, "session", sesId);
+  const sessionLock = await acquireLock5(paths, "session", sesId);
   let result;
   try {
     result = await appendEventToExistingSession2({
@@ -3380,6 +3424,74 @@ function printSessionNoteResult(options, sessionId, eventId, sessionStatus, body
   const preview = body.length > NOTE_BODY_PREVIEW_LIMIT ? `${body.slice(0, NOTE_BODY_PREVIEW_HEAD)}...` : body;
   console.log(`Added note to session ${sid} (${sessionStatus}): ${preview}`);
 }
+async function runSessionRechain(options, ctx = {}) {
+  try {
+    await doRunSessionRechain(options, ctx);
+  } catch (error) {
+    renderCliError(error, { verbose: isVerbose(options) });
+    process.exitCode = 1;
+  }
+}
+async function doRunSessionRechain(options, ctx) {
+  if (options.session !== void 0 && options.all === true) {
+    throw new Error("Specify either --session <id> or --all, not both");
+  }
+  if (options.session === void 0 && options.all !== true) {
+    throw new Error("Specify --session <id> or --all");
+  }
+  const cwd = ctx.cwd ?? process.cwd();
+  const repositoryRoot = await resolveRepositoryRootForSession(cwd, "rechain");
+  const paths = basouPaths9(repositoryRoot);
+  await assertWorkspaceInitialized7(paths.root);
+  const sessionIds = options.session !== void 0 ? [await resolveSessionId2(paths, options.session)] : await enumerateSessionDirs2(paths);
+  const dryRun = options.dryRun === true;
+  const rows = [];
+  for (const sessionId of sessionIds) {
+    let outcome;
+    try {
+      outcome = await rechainSessionInPlace(paths, sessionId, { dryRun });
+    } catch (error) {
+      rows.push({
+        session_id: sessionId,
+        status: "error",
+        message: error instanceof Error ? error.message : "Unknown error"
+      });
+      continue;
+    }
+    if (outcome.status === "rechained") {
+      rows.push({ session_id: sessionId, status: "rechained", event_count: outcome.eventCount });
+    } else {
+      rows.push({ session_id: sessionId, status: "skipped", reason: outcome.reason });
+    }
+  }
+  const tamperedCount = rows.filter((r) => r.reason === "tampered").length;
+  const errorCount = rows.filter((r) => r.status === "error").length;
+  if (options.json === true) {
+    console.log(JSON.stringify(rows, null, 2));
+  } else {
+    for (const row of rows) {
+      console.log(`${row.session_id}  ${renderRechainRow(row, dryRun)}`);
+    }
+    const rechained = rows.filter((r) => r.status === "rechained").length;
+    const skipped = rows.filter((r) => r.status === "skipped").length;
+    console.log(
+      `Sessions: ${rows.length} total \u2014 ${rechained} ${dryRun ? "would be rechained" : "rechained"}, ${skipped} skipped, ${errorCount} errors`
+    );
+  }
+  if (tamperedCount > 0 || errorCount > 0) {
+    process.exitCode = 1;
+  }
+}
+function renderRechainRow(row, dryRun) {
+  switch (row.status) {
+    case "rechained":
+      return `${dryRun ? "would rechain" : "rechained"} (${row.event_count} events)`;
+    case "skipped":
+      return row.reason === "tampered" ? "skipped (TAMPERED \u2014 inspect with 'basou verify')" : `skipped (${row.reason})`;
+    case "error":
+      return `error (${row.message})`;
+  }
+}
 
 // src/commands/stats.ts
 import {
@@ -4716,9 +4828,107 @@ function maxLen3(values, floor) {
   return max;
 }
 
+// src/commands/verify.ts
+import {
+  assertBasouRootSafe as assertBasouRootSafe13,
+  basouPaths as basouPaths13,
+  enumerateSessionDirs as enumerateSessionDirs3,
+  findErrorCode as findErrorCode12,
+  resolveRepositoryRoot as resolveRepositoryRoot14,
+  resolveSessionId as resolveSessionId4,
+  verifyEventsChain
+} from "@basou/core";
+function registerVerifyCommand(program2) {
+  program2.command("verify").description("Verify the tamper-evidence hash chain of sessions' event logs (read-only)").option("--session <id>", "Verify a single session (unique id prefix accepted)").option("--all", "Verify every session (the default when --session is omitted)").option("--json", "Output the verdicts as JSON").option("-v, --verbose", "Show error causes").action(async (opts) => {
+    await runVerify(opts);
+  });
+}
+async function runVerify(options, ctx = {}) {
+  try {
+    await doRunVerify(options, ctx);
+  } catch (error) {
+    renderCliError(error, { verbose: isVerbose(options) });
+    process.exitCode = 1;
+  }
+}
+async function doRunVerify(options, ctx) {
+  if (options.session !== void 0 && options.all === true) {
+    throw new Error("Specify either --session <id> or --all, not both");
+  }
+  const cwd = ctx.cwd ?? process.cwd();
+  const repositoryRoot = await resolveRepositoryRootForVerify(cwd);
+  const paths = basouPaths13(repositoryRoot);
+  await assertWorkspaceInitialized10(paths.root);
+  const sessionIds = options.session !== void 0 ? [await resolveSessionId4(paths, options.session)] : await enumerateSessionDirs3(paths);
+  const rows = [];
+  for (const sessionId of sessionIds) {
+    const verdict = await verifyEventsChain(paths, sessionId);
+    rows.push({
+      session_id: sessionId,
+      status: verdict.status,
+      event_count: verdict.eventCount,
+      ...verdict.reason !== void 0 ? { reason: verdict.reason } : {},
+      ...verdict.line !== void 0 ? { line: verdict.line } : {}
+    });
+  }
+  const tamperedCount = rows.filter((r) => r.status === "tampered").length;
+  if (options.json === true) {
+    console.log(JSON.stringify(rows, null, 2));
+  } else {
+    for (const row of rows) {
+      console.log(`${row.session_id}  ${renderVerdict(row)}`);
+    }
+    const tally = (status) => rows.filter((r) => r.status === status).length;
+    console.log(
+      `Sessions: ${rows.length} total \u2014 ${tally("verified")} verified, ${tally("unchained")} unchained, ${tally("empty")} empty, ${tally("incomplete")} incomplete, ${tally("in_progress")} in_progress, ${tamperedCount} tampered`
+    );
+  }
+  if (tamperedCount > 0) {
+    process.exitCode = 1;
+  }
+}
+function renderVerdict(row) {
+  switch (row.status) {
+    case "verified":
+      return `verified (${row.event_count} events)`;
+    case "tampered":
+      return row.line !== void 0 ? `TAMPERED (${row.reason} at line ${row.line})` : `TAMPERED (${row.reason})`;
+    case "incomplete":
+      return "incomplete (session.yaml missing; re-import to repair)";
+    case "in_progress":
+      return `in_progress (${row.event_count} events; live session, anchor written at finalize)`;
+    case "unchained":
+      return "unchained (session created before event-log chaining)";
+    case "empty":
+      return "empty";
+  }
+}
+async function resolveRepositoryRootForVerify(cwd) {
+  try {
+    return await resolveRepositoryRoot14(cwd);
+  } catch (error) {
+    if (error instanceof Error && error.message === "Not a git repository") {
+      throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou verify'.", {
+        cause: error
+      });
+    }
+    throw error;
+  }
+}
+async function assertWorkspaceInitialized10(basouRoot) {
+  try {
+    await assertBasouRootSafe13(basouRoot);
+  } catch (error) {
+    if (findErrorCode12(error, "ENOENT")) {
+      throw new Error("Workspace not initialized. Run 'basou init' first.");
+    }
+    throw error;
+  }
+}
+
 // src/commands/view.ts
 import { spawn } from "child_process";
-import { assertBasouRootSafe as assertBasouRootSafe13, basouPaths as basouPaths13, findErrorCode as findErrorCode13, resolveRepositoryRoot as resolveRepositoryRoot14 } from "@basou/core";
+import { assertBasouRootSafe as assertBasouRootSafe14, basouPaths as basouPaths14, findErrorCode as findErrorCode14, resolveRepositoryRoot as resolveRepositoryRoot15 } from "@basou/core";
 import { InvalidArgumentError as InvalidArgumentError5 } from "commander";
 
 // src/lib/view-server.ts
@@ -4727,7 +4937,7 @@ import { join as join8 } from "path";
 import {
   computeWorkStats as computeWorkStats2,
   enumerateApprovals as enumerateApprovals2,
-  findErrorCode as findErrorCode12,
+  findErrorCode as findErrorCode13,
   isLazyExpired as isLazyExpired2,
   loadApproval as loadApproval2,
   loadSessionEntries as loadSessionEntries3,
@@ -4735,7 +4945,7 @@ import {
   readAllEvents as readAllEvents2,
   readManifest as readManifest8,
   readMarkdownFile as readMarkdownFile4,
-  readSessionYaml as readSessionYaml2,
+  readSessionYaml as readSessionYaml3,
   readTaskFile as readTaskFile2,
   renderDecisions as renderDecisions3,
   renderHandoff as renderHandoff3
@@ -5329,7 +5539,7 @@ async function overview(deps) {
   try {
     manifest = await readManifest8(deps.paths);
   } catch (error) {
-    if (findErrorCode12(error, "ENOENT")) {
+    if (findErrorCode13(error, "ENOENT")) {
       return { initialized: false, repoRoot: deps.repoRoot };
     }
     throw error;
@@ -5376,7 +5586,7 @@ async function sessionsList(deps) {
 async function sessionDetail(deps, sessionId) {
   let session;
   try {
-    session = await readSessionYaml2(deps.paths, sessionId);
+    session = await readSessionYaml3(deps.paths, sessionId);
   } catch (error) {
     if (error instanceof Error && error.message === "YAML file not found") {
       throw new HttpError(404, "Session not found");
@@ -5544,8 +5754,8 @@ async function runView(options, ctx = {}) {
 async function doRunView(options, ctx) {
   const cwd = ctx.cwd ?? process.cwd();
   const repositoryRoot = await resolveRepositoryRootForView(cwd);
-  const paths = basouPaths13(repositoryRoot);
-  await assertWorkspaceInitialized10(paths.root);
+  const paths = basouPaths14(repositoryRoot);
+  await assertWorkspaceInitialized11(paths.root);
   const deps = {
     paths,
     repoRoot: repositoryRoot,
@@ -5576,7 +5786,7 @@ async function startListening(port, deps) {
   try {
     return await startViewServer({ port, deps });
   } catch (error) {
-    if (findErrorCode13(error, "EADDRINUSE")) {
+    if (findErrorCode14(error, "EADDRINUSE")) {
       throw new Error(`Port ${port} is already in use. Pass --port <n> to choose another.`, {
         cause: error
       });
@@ -5627,7 +5837,7 @@ function waitForShutdown(signal) {
 }
 async function resolveRepositoryRootForView(cwd) {
   try {
-    return await resolveRepositoryRoot14(cwd);
+    return await resolveRepositoryRoot15(cwd);
   } catch (error) {
     if (error instanceof Error && error.message === "Not a git repository") {
       throw new Error("Not a git repository. Run 'git init' first, then re-run 'basou view'.", {
@@ -5637,11 +5847,11 @@ async function resolveRepositoryRootForView(cwd) {
     throw error;
   }
 }
-async function assertWorkspaceInitialized10(basouRoot) {
+async function assertWorkspaceInitialized11(basouRoot) {
   try {
-    await assertBasouRootSafe13(basouRoot);
+    await assertBasouRootSafe14(basouRoot);
   } catch (error) {
-    if (findErrorCode13(error, "ENOENT")) {
+    if (findErrorCode14(error, "ENOENT")) {
       throw new Error("Workspace not initialized. Run 'basou init' first.");
     }
     throw error;
@@ -5663,6 +5873,7 @@ function buildProgram() {
   registerSessionCommand(program2);
   registerImportCommand(program2);
   registerRefreshCommand(program2);
+  registerVerifyCommand(program2);
   registerViewCommand(program2);
   registerApprovalCommand(program2);
   registerDecisionCommand(program2);