@basou/cli 0.9.0 → 0.10.0

package/dist/index.js

@@ -115,7 +115,8 @@ import { join } from "path";
 import {
   ApprovalSchema,
   ApprovalStatusSchema,
-  appendEvent,
+  acquireLock,
+  appendChainedEventLocked,
   assertBasouRootSafe,
   basouPaths,
   enumerateApprovals,
@@ -320,55 +321,63 @@ async function doRunApprovalResolve(idInput, options, ctx, decision) {
   if (approval.status !== "pending") {
     throw new Error(`Approval status mismatch: pending YAML has status=${approval.status}`);
   }
-  const sessionDir = join(paths.sessions, approval.session_id);
-  for await (const ev of replayEvents(sessionDir, {
-    onWarning: (w) => printReplayWarning(w, approval.session_id)
-  })) {
-    if (isApprovalEvent(ev) && ev.approval_id === approval.id && (ev.type === "approval_approved" || ev.type === "approval_rejected" || ev.type === "approval_expired")) {
-      throw new Error(`Approval already resolved (per events.jsonl): ${idInput}`);
-    }
-  }
   const now = /* @__PURE__ */ new Date();
-  if (isLazyExpired(approval, now)) {
-    throw new Error(`Approval already expired: ${idInput}`);
-  }
-  let sessionStatus = null;
-  try {
-    sessionStatus = (await readSessionYaml(paths, approval.session_id)).session.status;
-  } catch {
-    sessionStatus = null;
-  }
-  if (sessionStatus === "imported") {
-    throw new Error(`Cannot resolve an approval for an imported session: ${idInput}`);
-  }
   const occurredAt = now.toISOString();
   const eventId = prefixedUlid("evt");
-  if (decision === "approve") {
-    const note = options.note ?? null;
-    await appendEvent(sessionDir, {
-      schema_version: "0.1.0",
-      id: eventId,
-      session_id: approval.session_id,
-      occurred_at: occurredAt,
-      source: "local-cli",
-      type: "approval_approved",
-      approval_id: approval.id,
-      resolver: "local-cli",
-      note
-    });
-  } else {
-    const reason = options.reason;
-    await appendEvent(sessionDir, {
-      schema_version: "0.1.0",
-      id: eventId,
-      session_id: approval.session_id,
-      occurred_at: occurredAt,
-      source: "local-cli",
-      type: "approval_rejected",
-      approval_id: approval.id,
-      resolver: "local-cli",
-      reason
-    });
+  const sessionLock = await acquireLock(paths, "session", approval.session_id);
+  try {
+    const sessionDir = join(paths.sessions, approval.session_id);
+    for await (const ev of replayEvents(sessionDir, {
+      onWarning: (w) => printReplayWarning(w, approval.session_id)
+    })) {
+      if (isApprovalEvent(ev) && ev.approval_id === approval.id && (ev.type === "approval_approved" || ev.type === "approval_rejected" || ev.type === "approval_expired")) {
+        throw new Error(`Approval already resolved (per events.jsonl): ${idInput}`);
+      }
+    }
+    if (isLazyExpired(approval, now)) {
+      throw new Error(`Approval already expired: ${idInput}`);
+    }
+    let sessionStatus = null;
+    try {
+      sessionStatus = (await readSessionYaml(paths, approval.session_id)).session.status;
+    } catch {
+      sessionStatus = null;
+    }
+    const attachable = sessionStatus === "initialized" || sessionStatus === "running" || sessionStatus === "waiting_approval";
+    if (sessionStatus !== null && !attachable) {
+      throw new Error(
+        `Cannot resolve an approval for a session that is not active (status=${sessionStatus}): ${idInput}`
+      );
+    }
+    if (decision === "approve") {
+      const note = options.note ?? null;
+      await appendChainedEventLocked(paths, approval.session_id, {
+        schema_version: "0.1.0",
+        id: eventId,
+        session_id: approval.session_id,
+        occurred_at: occurredAt,
+        source: "local-cli",
+        type: "approval_approved",
+        approval_id: approval.id,
+        resolver: "local-cli",
+        note
+      });
+    } else {
+      const reason = options.reason;
+      await appendChainedEventLocked(paths, approval.session_id, {
+        schema_version: "0.1.0",
+        id: eventId,
+        session_id: approval.session_id,
+        occurred_at: occurredAt,
+        source: "local-cli",
+        type: "approval_rejected",
+        approval_id: approval.id,
+        resolver: "local-cli",
+        reason
+      });
+    }
+  } finally {
+    await sessionLock.release();
   }
   const resolvedApproval = decision === "approve" ? {
     ...approval,
@@ -625,7 +634,7 @@ function printNoApprovals(options) {
 
 // src/commands/decision.ts
 import {
-  acquireLock,
+  acquireLock as acquireLock2,
   appendEventToExistingSession,
   assertBasouRootSafe as assertBasouRootSafe2,
   basouPaths as basouPaths2,
@@ -690,7 +699,7 @@ async function doRunDecisionRecord(options, ctx) {
   if (options.session !== void 0) {
     const sessionId = await resolveSessionId(paths, options.session);
     const sesId = sessionId;
-    const sessionLock = await acquireLock(paths, "session", sesId);
+    const sessionLock = await acquireLock2(paths, "session", sesId);
     let result;
     try {
       result = await appendEventToExistingSession({
@@ -954,10 +963,12 @@ import { mkdir } from "fs/promises";
 import { homedir } from "os";
 import { join as join2 } from "path";
 import {
+  acquireLock as acquireLock3,
   assertBasouRootSafe as assertBasouRootSafe4,
   basouPaths as basouPaths4,
   ChildProcessRunner,
-  appendEvent as coreAppendEvent,
+  appendChainedEvent as coreAppendChainedEvent,
+  finalizeSessionYaml,
   getSnapshot,
   overwriteYamlFile,
   parseDuration,
@@ -983,7 +994,6 @@ function registerExecCommand(program2) {
 async function runExec(command, args, options, ctx = {}) {
   const runner = ctx.runner ?? new ChildProcessRunner();
   const now = ctx.now ?? (() => /* @__PURE__ */ new Date());
-  const appendEvent2 = ctx.appendEvent ?? coreAppendEvent;
   const cwd = options.cwd ?? process.cwd();
   const timeout_ms = options.timeout !== void 0 ? parseDuration(options.timeout) : void 0;
   const repoRoot = await resolveRepositoryRootForExec(cwd);
@@ -993,6 +1003,9 @@ async function runExec(command, args, options, ctx = {}) {
   const sessionId = prefixedUlid3("ses");
   const sessionDir = join2(paths.sessions, sessionId);
   await mkdir(sessionDir, { recursive: true });
+  const appendEvent = ctx.appendEvent ?? (async (_sessionDir, event) => {
+    await coreAppendChainedEvent(paths, sessionId, event);
+  });
   const startedAt = now().toISOString();
   const sessionYamlPath = join2(sessionDir, "session.yaml");
   const session = buildInitialSession({
@@ -1004,7 +1017,7 @@ async function runExec(command, args, options, ctx = {}) {
     startedAt
   });
   await writeYamlFile(sessionYamlPath, session);
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_started",
     id: prefixedUlid3("evt"),
@@ -1013,10 +1026,10 @@ async function runExec(command, args, options, ctx = {}) {
     source: "terminal-recording"
   });
   if (options.snapshot !== false) {
-    await tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, appendEvent2);
+    await tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, appendEvent);
   }
   const runningAt = now().toISOString();
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_status_changed",
     id: prefixedUlid3("evt"),
@@ -1026,9 +1039,14 @@ async function runExec(command, args, options, ctx = {}) {
     from: "initialized",
     to: "running"
   });
-  await mutateSessionYaml(sessionYamlPath, (s) => {
-    s.session.status = "running";
-  });
+  const runningLock = await acquireLock3(paths, "session", sessionId);
+  try {
+    await mutateSessionYaml(sessionYamlPath, (s) => {
+      s.session.status = "running";
+    });
+  } finally {
+    await runningLock.release();
+  }
   const controller = new AbortController();
   let signalReceived = null;
   let activeChild = null;
@@ -1064,7 +1082,7 @@ async function runExec(command, args, options, ctx = {}) {
         }
       });
     } catch (spawnError) {
-      await finalizeSessionAsFailed(sessionDir, sessionYamlPath, sessionId, appendEvent2, {
+      await finalizeSessionAsFailed(paths, sessionDir, sessionId, appendEvent, {
         command,
         args,
         cwd,
@@ -1080,7 +1098,7 @@ async function runExec(command, args, options, ctx = {}) {
     activeChild = null;
   }
   const endedAt = now().toISOString();
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "command_executed",
     id: prefixedUlid3("evt"),
@@ -1096,10 +1114,10 @@ async function runExec(command, args, options, ctx = {}) {
     duration_ms: result.duration_ms
   });
   if (options.snapshot !== false) {
-    await tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, appendEvent2);
+    await tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, appendEvent);
   }
   const finalStatus = decideFinalStatus(result, signalReceived);
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_status_changed",
     id: prefixedUlid3("evt"),
@@ -1109,7 +1127,7 @@ async function runExec(command, args, options, ctx = {}) {
     from: "running",
     to: finalStatus
   });
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_ended",
     id: prefixedUlid3("evt"),
@@ -1118,7 +1136,7 @@ async function runExec(command, args, options, ctx = {}) {
     source: "terminal-recording",
     ...result.exit_code !== null ? { exit_code: result.exit_code } : {}
   });
-  await mutateSessionYaml(sessionYamlPath, (s) => {
+  await finalizeSessionYaml(paths, sessionId, (s) => {
     s.session.status = finalStatus;
     s.session.ended_at = endedAt;
     s.session.invocation.exit_code = result.exit_code;
@@ -1148,7 +1166,7 @@ function signalToExitCode(sig) {
   const num = SIGNUM_MAP[sig] ?? 1;
   return 128 + num;
 }
-async function tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, appendEvent2) {
+async function tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, appendEvent) {
   let snapshot;
   try {
     snapshot = await getSnapshot(repoRoot);
@@ -1156,7 +1174,7 @@ async function tryAppendGitSnapshot(sessionDir, sessionId, repoRoot, now, append
     console.warn(normalizeGitSnapshotSkipMessage(error));
     return;
   }
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "git_snapshot",
     id: prefixedUlid3("evt"),
@@ -1212,8 +1230,8 @@ async function mutateSessionYaml(filePath, mutator) {
   const validated = SessionSchema.parse(parsed);
   await overwriteYamlFile(filePath, validated);
 }
-async function finalizeSessionAsFailed(sessionDir, sessionYamlPath, sessionId, appendEvent2, ctx) {
-  await appendEvent2(sessionDir, {
+async function finalizeSessionAsFailed(paths, sessionDir, sessionId, appendEvent, ctx) {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "command_executed",
     id: prefixedUlid3("evt"),
@@ -1228,7 +1246,7 @@ async function finalizeSessionAsFailed(sessionDir, sessionYamlPath, sessionId, a
     ...ctx.signalReceived !== null ? { received_signal: ctx.signalReceived } : {},
     duration_ms: 0
   });
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_status_changed",
     id: prefixedUlid3("evt"),
@@ -1238,7 +1256,7 @@ async function finalizeSessionAsFailed(sessionDir, sessionYamlPath, sessionId, a
     from: "running",
     to: "failed"
   });
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_ended",
     id: prefixedUlid3("evt"),
@@ -1246,7 +1264,7 @@ async function finalizeSessionAsFailed(sessionDir, sessionYamlPath, sessionId, a
     occurred_at: ctx.occurredAt,
     source: "terminal-recording"
   });
-  await mutateSessionYaml(sessionYamlPath, (s) => {
+  await finalizeSessionYaml(paths, sessionId, (s) => {
     s.session.status = "failed";
     s.session.ended_at = ctx.occurredAt;
     s.session.invocation.exit_code = null;
@@ -2398,11 +2416,13 @@ import { mkdir as mkdir2 } from "fs/promises";
 import { homedir as homedir4 } from "os";
 import { join as join5 } from "path";
 import {
+  acquireLock as acquireLock4,
   assertBasouRootSafe as assertBasouRootSafe8,
   basouPaths as basouPaths8,
   ChildProcessRunner as ChildProcessRunner2,
   claudeCodeAdapterMetadata,
-  appendEvent as coreAppendEvent2,
+  appendChainedEvent as coreAppendChainedEvent2,
+  finalizeSessionYaml as finalizeSessionYaml2,
   getDiff,
   getSnapshot as getSnapshot2,
   overwriteYamlFile as overwriteYamlFile2,
@@ -2438,7 +2458,6 @@ function registerRunCommand(program2, ctx = {}) {
 async function runClaudeCode(args, options, ctx = {}) {
   const runner = ctx.runner ?? new ChildProcessRunner2();
   const now = ctx.now ?? (() => /* @__PURE__ */ new Date());
-  const appendEvent2 = ctx.appendEvent ?? coreAppendEvent2;
   const resolveCommand = ctx.resolveCommand ?? resolveClaudeCodeCommand;
   const getDiffFn = ctx.getDiff ?? getDiff;
   const { command } = await resolveCommand();
@@ -2450,6 +2469,9 @@ async function runClaudeCode(args, options, ctx = {}) {
   const sessionId = prefixedUlid4("ses");
   const sessionDir = join5(paths.sessions, sessionId);
   await mkdir2(sessionDir, { recursive: true });
+  const appendEvent = ctx.appendEvent ?? (async (_sessionDir, event) => {
+    await coreAppendChainedEvent2(paths, sessionId, event);
+  });
   const startedAt = now().toISOString();
   const sessionYamlPath = join5(sessionDir, "session.yaml");
   const session = buildInitialSession2({
@@ -2461,7 +2483,7 @@ async function runClaudeCode(args, options, ctx = {}) {
     startedAt
   });
   await writeYamlFile2(sessionYamlPath, session);
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_started",
     id: prefixedUlid4("evt"),
@@ -2471,10 +2493,10 @@ async function runClaudeCode(args, options, ctx = {}) {
   });
   let preSnapshot = null;
   if (options.snapshot !== false) {
-    preSnapshot = await tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appendEvent2);
+    preSnapshot = await tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appendEvent);
   }
   const runningAt = now().toISOString();
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_status_changed",
     id: prefixedUlid4("evt"),
@@ -2484,9 +2506,14 @@ async function runClaudeCode(args, options, ctx = {}) {
     from: "initialized",
     to: "running"
   });
-  await mutateSessionYaml2(sessionYamlPath, (s) => {
-    s.session.status = "running";
-  });
+  const runningLock = await acquireLock4(paths, "session", sessionId);
+  try {
+    await mutateSessionYaml2(sessionYamlPath, (s) => {
+      s.session.status = "running";
+    });
+  } finally {
+    await runningLock.release();
+  }
   const controller = new AbortController();
   let signalReceived = null;
   let activeChild = null;
@@ -2521,7 +2548,7 @@ async function runClaudeCode(args, options, ctx = {}) {
         }
       });
     } catch (spawnError) {
-      await finalizeSessionAsFailed2(sessionDir, sessionYamlPath, sessionId, appendEvent2, {
+      await finalizeSessionAsFailed2(paths, sessionDir, sessionId, appendEvent, {
         command,
         args,
         cwd: repoRoot,
@@ -2537,7 +2564,7 @@ async function runClaudeCode(args, options, ctx = {}) {
     activeChild = null;
   }
   const endedAt = now().toISOString();
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "command_executed",
     id: prefixedUlid4("evt"),
@@ -2554,7 +2581,7 @@ async function runClaudeCode(args, options, ctx = {}) {
   });
   let postSnapshot = null;
   if (options.snapshot !== false) {
-    postSnapshot = await tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appendEvent2);
+    postSnapshot = await tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appendEvent);
   }
   let diff = null;
   if (preSnapshot !== null && postSnapshot !== null) {
@@ -2565,7 +2592,7 @@ async function runClaudeCode(args, options, ctx = {}) {
       preSnapshot.head,
       postSnapshot.head,
       now().toISOString(),
-      appendEvent2,
+      appendEvent,
       getDiffFn
     );
   }
@@ -2575,7 +2602,7 @@ async function runClaudeCode(args, options, ctx = {}) {
     homedir: homedir4()
   }).sanitized;
   const finalStatus = decideFinalStatus2(result, signalReceived);
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_status_changed",
     id: prefixedUlid4("evt"),
@@ -2585,7 +2612,7 @@ async function runClaudeCode(args, options, ctx = {}) {
     from: "running",
     to: finalStatus
   });
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_ended",
     id: prefixedUlid4("evt"),
@@ -2594,7 +2621,7 @@ async function runClaudeCode(args, options, ctx = {}) {
     source: claudeCodeAdapterMetadata.kind,
     ...result.exit_code !== null ? { exit_code: result.exit_code } : {}
   });
-  await mutateSessionYaml2(sessionYamlPath, (s) => {
+  await finalizeSessionYaml2(paths, sessionId, (s) => {
     s.session.status = finalStatus;
     s.session.ended_at = endedAt;
     s.session.invocation.exit_code = result.exit_code;
@@ -2623,7 +2650,7 @@ function signalToExitCode2(sig) {
   const num = SIGNUM_MAP2[sig] ?? 1;
   return 128 + num;
 }
-async function tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appendEvent2) {
+async function tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appendEvent) {
   let snapshot;
   try {
     snapshot = await getSnapshot2(repoRoot);
@@ -2631,7 +2658,7 @@ async function tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appen
     console.warn(normalizeGitSnapshotSkipMessage2(error));
     return null;
   }
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "git_snapshot",
     id: prefixedUlid4("evt"),
@@ -2642,7 +2669,7 @@ async function tryAppendGitSnapshot2(sessionDir, sessionId, repoRoot, now, appen
   });
   return snapshot;
 }
-async function tryAppendFileChangedEvents(sessionDir, sessionId, repoRoot, baseRef, headRef, occurredAt, appendEvent2, getDiffFn) {
+async function tryAppendFileChangedEvents(sessionDir, sessionId, repoRoot, baseRef, headRef, occurredAt, appendEvent, getDiffFn) {
   let diff;
   try {
     diff = await getDiffFn(repoRoot, baseRef, headRef);
@@ -2651,7 +2678,7 @@ async function tryAppendFileChangedEvents(sessionDir, sessionId, repoRoot, baseR
     return null;
   }
   for (const change of diff.changed_files) {
-    await appendEvent2(sessionDir, {
+    await appendEvent(sessionDir, {
       schema_version: "0.1.0",
       type: "file_changed",
       id: prefixedUlid4("evt"),
@@ -2734,8 +2761,8 @@ async function mutateSessionYaml2(filePath, mutator) {
   const validated = SessionSchema2.parse(parsed);
   await overwriteYamlFile2(filePath, validated);
 }
-async function finalizeSessionAsFailed2(sessionDir, sessionYamlPath, sessionId, appendEvent2, ctx) {
-  await appendEvent2(sessionDir, {
+async function finalizeSessionAsFailed2(paths, sessionDir, sessionId, appendEvent, ctx) {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "command_executed",
     id: prefixedUlid4("evt"),
@@ -2750,7 +2777,7 @@ async function finalizeSessionAsFailed2(sessionDir, sessionYamlPath, sessionId,
     ...ctx.signalReceived !== null ? { received_signal: ctx.signalReceived } : {},
     duration_ms: 0
   });
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_status_changed",
     id: prefixedUlid4("evt"),
@@ -2760,7 +2787,7 @@ async function finalizeSessionAsFailed2(sessionDir, sessionYamlPath, sessionId,
     from: "running",
     to: "failed"
   });
-  await appendEvent2(sessionDir, {
+  await appendEvent(sessionDir, {
     schema_version: "0.1.0",
     type: "session_ended",
     id: prefixedUlid4("evt"),
@@ -2768,7 +2795,7 @@ async function finalizeSessionAsFailed2(sessionDir, sessionYamlPath, sessionId,
     occurred_at: ctx.occurredAt,
     source: claudeCodeAdapterMetadata.kind
   });
-  await mutateSessionYaml2(sessionYamlPath, (s) => {
+  await finalizeSessionYaml2(paths, sessionId, (s) => {
     s.session.status = "failed";
     s.session.ended_at = ctx.occurredAt;
     s.session.invocation.exit_code = null;
@@ -2791,7 +2818,7 @@ async function resolveRepositoryRootForRun(cwd) {
 import { readFile as readFile2 } from "fs/promises";
 import { basename as basename3, isAbsolute, join as join6, relative as relative2 } from "path";
 import {
-  acquireLock as acquireLock2,
+  acquireLock as acquireLock5,
   appendEventToExistingSession as appendEventToExistingSession2,
   assertBasouRootSafe as assertBasouRootSafe9,
   basouPaths as basouPaths9,
@@ -3341,7 +3368,7 @@ async function doRunSessionNote(sessionIdInput, options, ctx) {
   }
   const occurredAt = (/* @__PURE__ */ new Date()).toISOString();
   const sesId = sessionId;
-  const sessionLock = await acquireLock2(paths, "session", sesId);
+  const sessionLock = await acquireLock5(paths, "session", sesId);
   let result;
   try {
     result = await appendEventToExistingSession2({
@@ -4812,9 +4839,7 @@ import {
   verifyEventsChain
 } from "@basou/core";
 function registerVerifyCommand(program2) {
-  program2.command("verify").description(
-    "Verify the tamper-evidence hash chain of imported sessions' event logs (read-only)"
-  ).option("--session <id>", "Verify a single session (unique id prefix accepted)").option("--all", "Verify every session (the default when --session is omitted)").option("--json", "Output the verdicts as JSON").option("-v, --verbose", "Show error causes").action(async (opts) => {
+  program2.command("verify").description("Verify the tamper-evidence hash chain of sessions' event logs (read-only)").option("--session <id>", "Verify a single session (unique id prefix accepted)").option("--all", "Verify every session (the default when --session is omitted)").option("--json", "Output the verdicts as JSON").option("-v, --verbose", "Show error causes").action(async (opts) => {
     await runVerify(opts);
   });
 }
@@ -4855,7 +4880,7 @@ async function doRunVerify(options, ctx) {
     }
     const tally = (status) => rows.filter((r) => r.status === status).length;
     console.log(
-      `Sessions: ${rows.length} total \u2014 ${tally("verified")} verified, ${tally("unchained")} unchained, ${tally("empty")} empty, ${tally("incomplete")} incomplete, ${tamperedCount} tampered`
+      `Sessions: ${rows.length} total \u2014 ${tally("verified")} verified, ${tally("unchained")} unchained, ${tally("empty")} empty, ${tally("incomplete")} incomplete, ${tally("in_progress")} in_progress, ${tamperedCount} tampered`
     );
   }
   if (tamperedCount > 0) {
@@ -4870,8 +4895,10 @@ function renderVerdict(row) {
       return row.line !== void 0 ? `TAMPERED (${row.reason} at line ${row.line})` : `TAMPERED (${row.reason})`;
     case "incomplete":
       return "incomplete (session.yaml missing; re-import to repair)";
+    case "in_progress":
+      return `in_progress (${row.event_count} events; live session, anchor written at finalize)`;
     case "unchained":
-      return "unchained (not an imported session, or imported before chaining)";
+      return "unchained (session created before event-log chaining)";
     case "empty":
       return "empty";
   }