@cruxy/cli 1.11.1 → 1.11.3

package/dist/cli/commands/pr.js

@@ -6,6 +6,7 @@ import { authMissingKey, shouldUseColor } from "../../errors/index.js";
 import { themeForColor } from "../../theme/index.js";
 import { ApprovalService, defaultPromptIO, InteractivePolicy, SessionAllowlist, } from "../../approval/index.js";
 import { resolveTaskModel, routerForConfig } from "../../routing/index.js";
+import { latestRecordedRuns, shortId } from "../../session/index.js";
 import { createForgeProvider, createPrService, generateWithLlm, loadCommitGuidance, resolveForgeToken, } from "../../vcs/index.js";
 /**
  * `cruxy pr` — turn the current changes into a pull request (C.15). Generates the
@@ -48,6 +49,18 @@ export function prCommand() {
         // resolveForgeToken throws CRUXY_E_FORGE_AUTH (exit 4) if none is found.
         const forge = createForgeProvider(resolveForgeToken());
         const guidance = await loadCommitGuidance(cwd);
+        // The verification record (P2): this command runs outside any
+        // session, so the evidence is the project's latest session log — its
+        // runs, each dated, under a header naming that session rather than
+        // "this session". The model never writes the section (generate.ts);
+        // no session here, or one that ran nothing → no section at all.
+        const recorded = latestRecordedRuns(cwd);
+        const verification = recorded
+            ? {
+                runs: recorded.runs,
+                from: `in the latest session for this project (${shortId(recorded.sessionId)})`,
+            }
+            : undefined;
         // The allowlist here is provably inert, and stated rather than implied
         // (cli#251). `cruxy pr` submits exactly one kind of action — `vcs` — and
         // `vcsRequest` gives every one of them `scope: {kind: "none"}` and an
@@ -70,6 +83,7 @@ export function prCommand() {
                 ...i,
                 scopes: guidance.scopes,
                 skillBody: guidance.skillBody,
+                ...(verification ? { verification } : {}),
             }, { model: genModel }),
         });
         logger.info(t.muted("generating pull request content…"));

package/dist/cli/commands/run.js

@@ -16,6 +16,8 @@ import { apiKeyEnvVar, classifyCredentialLifetime, configSourceFile, globalDir,
 import { agentIncomplete, authMissingKey, shouldUseColor, usageError, } from "../../errors/index.js";
 import { createRenderer } from "../../render/index.js";
 import { themeForColor } from "../../theme/index.js";
+import { verificationTurnLines } from "../../verification/index.js";
+import { compactionTallyLines } from "../../render/context-view.js";
 import { summarizeRuns, renderSummary, } from "../../usage/index.js";
 import { CheckpointGate } from "../../checkpoint/index.js";
 import { SandboxService } from "../../sandbox/index.js";
@@ -383,6 +385,19 @@ export async function executeRun(promptParts, opts) {
                     usage: restore.usage,
                     sessionId: restore.meta.sessionId,
                     mode: restore.mode,
+                    // The last run the log recorded, so `/status` after a resume
+                    // says what last ran instead of "none". Not re-derived.
+                    ...(restore.lastVerification
+                        ? { lastVerification: restore.lastVerification }
+                        : {}),
+                    // And what compaction cost it so far (P3), so `/context`
+                    // continues the tally instead of restarting at zero.
+                    compactions: restore.compactions,
+                    // `restore.plan` is deliberately NOT passed (plan-durability).
+                    // The resume notice has already described it. Handing it to
+                    // the session would invite exactly the thing the record must
+                    // not do: treat a past `approve-grant` as consent in this
+                    // process. The allowlist starts empty; every action asks.
                 },
             }
             : {}),
@@ -543,6 +558,12 @@ export async function executeRun(promptParts, opts) {
     if (config.usage.enabled && session.lastRun) {
         printRunUsage(session.lastRun);
     }
+    // The verification record (P2 verification), next to the exit code CI
+    // already trusts: what ran this turn and how it exited — or that nothing
+    // did. Printed for BOTH a completed run and one that gave up below, and
+    // whether or not usage is on, so "completed" is never read on its own.
+    // The record is evidence; the exit code below is still decided by `stop`.
+    printTurnVerification(session);
     // Fail loud on a non-completed stop (#3/#5): a one-shot run that hit the
     // iteration cap or a token budget (or was cancelled) MUST exit non-zero —
     // otherwise CI reads a gave-up run as success. The partial history already
@@ -561,6 +582,20 @@ export async function executeRun(promptParts, opts) {
     }
 }
 /** Render the just-finished run's usage as a single themed line (C.22). */
+/** The one-shot summary's verification block — see `verification/view.ts`. */
+function printTurnVerification(session) {
+    const t = themeForColor(shouldUseColor(process.stdout));
+    for (const line of verificationTurnLines(session.turnVerification(), t)) {
+        logger.print(line);
+    }
+    // What compaction cost this run (P3 context quality), next to the
+    // verification block and for the same reason: a one-shot run that
+    // compacted three times and may have dropped an instruction is a fact CI
+    // reads nowhere else. Silent when nothing compacted.
+    for (const line of compactionTallyLines(session.compactions(), t)) {
+        logger.print(line);
+    }
+}
 function printRunUsage(record) {
     if (record.entries.length === 0)
         return;

package/dist/cli/commands/sessions.js

@@ -7,6 +7,7 @@ import { SESSION_FILE_EXT, matchSessionRefs, listSessionRefs, pruneSessions, ses
 import { themeForColor } from "../../theme/index.js";
 import { formatBytes } from "../../utils/disk.js";
 import { logger } from "../../utils/logger.js";
+import { describeHolder, removeOwnerFile, sessionHeldBy, } from "../../session/owner.js";
 /**
  * `cruxy sessions` (#257) — see and bound what `~/.cruxy/projects/<project>/`
  * is holding.
@@ -149,8 +150,15 @@ export function sessionsCommand() {
                 "sessions are per-directory; check you are in the right one",
             ]);
         }
+        // Not while another cruxy is writing it (P1): its next append would
+        // recreate the file headless and leave a session nothing can load.
+        const holder = sessionHeldBy(matches[0].file);
+        if (holder) {
+            throw usageError(`session ${shortId(matches[0].sessionId)} is open in another cruxy (${describeHolder(holder)})`, ["quit that cruxy first, then delete it"]);
+        }
         try {
             unlinkSync(matches[0].file);
+            removeOwnerFile(matches[0].file);
         }
         catch (err) {
             throw usageError(`could not delete session ${shortId(matches[0].sessionId)}`, [`${matches[0].file}: ${err.message}`]);

package/dist/cli/session-commands.js

@@ -680,7 +680,9 @@ function handleExport(input, ctx) {
 function handleContext(ctx) {
     const { out, session } = ctx;
     const report = contextReport(session.messages, session.toolContext.config.context);
-    for (const line of contextReportLines(report, out.theme)) {
+    // Plus what compaction has already cost (P3) — the one figure the
+    // preview above cannot give, because it is a record, not an estimate.
+    for (const line of contextReportLines(report, out.theme, Infinity, session.compactions())) {
         out.print(out.fit(line));
     }
 }

package/dist/cli/session-factory.js

@@ -25,6 +25,7 @@ import { MemoryService, buildMultiRootRecallBlock, rememberTool, } from "../memo
 import { findDefinitionTool, findReferencesTool, getDiagnosticsTool, hoverTool, } from "../lsp/index.js";
 import { createWebSearchTool, createWebFetchTool } from "../web/index.js";
 import { appendRun } from "../usage/index.js";
+import { VerificationLedger } from "../verification/index.js";
 import { Semaphore, SubagentOrchestrator, makeSpawnSubagentTool, makeSpawnSubagentsTool, } from "../subagent/index.js";
 import { ApprovalQueue, JobManager, makeRunInBackgroundTool, } from "../jobs/index.js";
 /**
@@ -253,13 +254,26 @@ opts = {}) {
                 logger.warn(`${error.code}: ${error.title} — ${error.cause}`);
         }
         : undefined;
+    // The verification record (P2 verification): ONE ledger for the session,
+    // fed by the exec tools' side channels below and by the file tools through
+    // `ctx.verification`, and written through to the session log as its own
+    // event kinds. The in-memory side is what `/status` and the one-shot
+    // summary read; the log is what a resume and the transcript keep.
+    const verification = new VerificationLedger({
+        sink: opts.recorder ? (obs) => opts.recorder.observe(obs) : undefined,
+    });
     // The `run_tests` side channel (P3): the structured outcome the tool already
     // built, handed to the renderer to draw. Every field it needs is copied
     // across as-is — nothing is derived here, so an absent `total` stays absent
-    // rather than becoming a number the parsers refused to claim.
+    // rather than becoming a number the parsers refused to claim. The record
+    // takes the same object, from the same call — never re-parsed from the
+    // string the model gets.
     const execRegistry = buildDefaultRegistry({
-        onTestResult: renderer
-            ? (result, command) => renderer.testResult({
+        // `tools.fileEdit` / `tools.shell` (P4): wired here, the one place the
+        // default registry is built for a session.
+        tools: config.tools,
+        onTestResult: (result, command, run) => {
+            renderer?.testResult({
                 passed: result.passed,
                 command: command.command,
                 durationMs: result.durationMs,
@@ -270,8 +284,38 @@ opts = {}) {
                     ...(f.line !== undefined ? { line: f.line } : {}),
                 })),
                 outputTruncated: result.outputTruncated,
-            })
-            : undefined,
+            });
+            verification.record({
+                kind: "verification",
+                tool: "run_tests",
+                command: command.command,
+                source: command.source,
+                passed: result.passed,
+                exitCode: result.exitCode,
+                durationMs: result.durationMs,
+                ...(result.total !== undefined ? { total: result.total } : {}),
+                failureCount: result.failures.length,
+                failureNames: result.failures.map((f) => f.name),
+                outputTruncated: result.outputTruncated,
+                substrate: run.substrate,
+            });
+        },
+        // `run_command` records what ran and how it exited — and NOTHING about
+        // what it was for. Whether "pnpm typecheck" was a typecheck is the
+        // reader's call; classifying it here from its text is the inference the
+        // record refuses to make.
+        onCommandResult: (result) => verification.record({
+            kind: "verification",
+            tool: "run_command",
+            command: result.command,
+            passed: result.exitCode === 0,
+            exitCode: result.exitCode,
+            durationMs: result.durationMs,
+            failureCount: 0,
+            failureNames: [],
+            outputTruncated: result.outputTruncated,
+            substrate: result.substrate,
+        }),
     });
     const git = getGitInfo(cwd);
     const projectInstructions = loadProjectInstructions(cwd);
@@ -508,8 +552,9 @@ opts = {}) {
         requestApproval: gate(approval),
         checkpointsActive,
         sandbox,
+        verification,
     };
-    const planRunner = ({ messages, projectInstructions, recalledMemory: turnMemory, renderer: turnRenderer, onRequestUsage, }) => runPlanSession({
+    const planRunner = ({ messages, projectInstructions, recalledMemory: turnMemory, renderer: turnRenderer, onRequestUsage, compact, record, }) => runPlanSession({
         provider,
         config,
         ctx,
@@ -524,6 +569,8 @@ opts = {}) {
         renderer: turnRenderer,
         router,
         onRequestUsage,
+        compact,
+        record,
     });
     holder.session = new Session({
         provider,
@@ -548,6 +595,7 @@ opts = {}) {
         // not a second list that agrees with them only by luck.
         allowlist,
         recorder: opts.recorder,
+        verification,
         restore: opts.restore,
     });
     return holder.session;

package/dist/config/schema.js

@@ -78,9 +78,18 @@ export const AgentConfigSchema = z
     planMode: z.boolean().default(false),
 })
     .strict();
+/**
+ * Which built-in tool families the model is handed (P4). Declared in the C.0
+ * scaffold and consumed by nothing until P4 — see `buildDefaultRegistry` for
+ * why they were wired rather than removed (`initConfig` writes them into every
+ * generated config, and the schema is `.strict()`).
+ */
 export const ToolsConfigSchema = z
     .object({
+    /** `false` withholds `write_file`, `edit_file` and `apply_patch`. Reads stay. */
     fileEdit: z.boolean().default(true),
+    /** `false` withholds `run_command` and `run_tests` — no command execution
+     * by the model at all. `create_pull_request` (git, own approval) stays. */
     shell: z.boolean().default(true),
 })
     .strict();

package/dist/errors/constructors.js

@@ -545,16 +545,25 @@ export function indexEmbedderUnavailable(underlying) {
  * exact "reads like success, isn't" trap C.17 forbids. The `search_codebase`
  * tool instead surfaces it as a tool error and points the model at `grep_files`.
  */
-export function indexEmbedderDownloadFailed(underlying) {
+export function indexEmbedderDownloadFailed(underlying, opts = {}) {
+    // A refused archive is not a connectivity problem: the download succeeded
+    // and cruxy's extractor rejected an entry (path traversal, a link, an
+    // unexpected layout). Retrying will refuse it again, so say so.
+    const nextSteps = opts.archiveRefused
+        ? [
+            "the model archive was refused by cruxy's extraction guard and nothing was written; this is not a connectivity problem",
+            "do not retry blindly — if it persists, report it with the message above (the upstream archive may have changed shape)",
+        ]
+        : [
+            "check your internet connection — the model (bge-small-en-v1.5, ~77 MB) downloads once on first use",
+            "if you are behind a proxy or firewall, allow access to storage.googleapis.com (the qdrant-fastembed bucket); HTTPS_PROXY / NO_PROXY are honored",
+            "once the download succeeds it is cached under ~/.cruxy/models and never re-fetched",
+        ];
     return new CruxyError({
         code: ErrorCode.IndexEmbedderDownloadFailed,
         title: "the local embedding model could not be downloaded or initialized",
         cause: messageOf(underlying),
-        nextSteps: [
-            "check your internet connection — the model (bge-small-en-v1.5) downloads once on first use",
-            "if you are behind a proxy or firewall, allow access to the model host (Hugging Face) and set HTTPS_PROXY",
-            "once the download succeeds it is cached under ~/.cruxy/models and never re-fetched",
-        ],
+        nextSteps,
         underlying,
     });
 }

package/dist/errors/types.js

@@ -99,6 +99,12 @@ export const ErrorCode = {
     PermissionDenied: "CRUXY_E_PERMISSION_DENIED",
     PathEscape: "CRUXY_E_PATH_ESCAPE",
     CheckpointFailed: "CRUXY_E_CHECKPOINT_FAILED",
+    /** A mutating file tool re-read its target immediately before the approved
+     * write and found it was not the file the approval was granted against (P1):
+     * changed, deleted, or created by something else during the approval wait.
+     * Refused with nothing written — the approval covered a diff against ONE
+     * specific state, and that state moved. See `tools/file/snapshot.ts`. */
+    FileChangedSinceRead: "CRUXY_E_FILE_CHANGED_SINCE_READ",
     // index (exit 8)
     /** The fastembed native module could not be LOADED (missing/broken install,
      * un-built onnxruntime-node addon). Fail-loud by design — the embedder never
@@ -341,6 +347,7 @@ const EXIT_CODES = {
     [ErrorCode.PermissionDenied]: 7,
     [ErrorCode.PathEscape]: 7,
     [ErrorCode.CheckpointFailed]: 7,
+    [ErrorCode.FileChangedSinceRead]: 7,
     [ErrorCode.IndexEmbedderUnavailable]: 8,
     [ErrorCode.IndexEmbedderDownloadFailed]: 8,
     [ErrorCode.IndexStoreUnavailable]: 8,

package/dist/indexing/embedder.js

@@ -1,5 +1,7 @@
-import { promises as fs } from "node:fs";
+import path from "node:path";
+import { globalDir } from "../config/paths.js";
 import { indexEmbedderDownloadFailed, indexEmbedderUnavailable, } from "../errors/index.js";
+import { ensureModelDir, MODEL_ONNX_FILE, } from "./model-cache.js";
 import { l2normalize } from "./util.js";
 /**
  * Output dimensionality of bge-small-en-v1.5, and the default size of the
@@ -69,6 +71,12 @@ export class HashingEmbedder {
  * registering the `search_codebase` tool stays cheap and the heavy ONNX runtime
  * only loads when an index is actually built or queried.
  *
+ * The model files are provisioned by cruxy ({@link ensureModelDir}), NOT by
+ * fastembed: fastembed is initialised with `model: CUSTOM` and an absolute
+ * directory, which in its `init` makes its own `retrieveModel` (tar@6-based
+ * download + extract, #306) unreachable. `CUSTOM` changes nothing else for this
+ * model — fastembed's only model-specific branch is for multilingual-e5.
+ *
  * Embedding is CPU-bound and single-threaded inside ONNX, so throughput is
  * bounded by `batchSize` (fed sequentially through fastembed's batching
  * generator) rather than by JS-level concurrency.
@@ -84,23 +92,29 @@ export class FastEmbedEmbedder {
     getModel() {
         if (!this.model) {
             this.model = (async () => {
+                const cacheDir = this.opts.cacheDir ?? path.join(globalDir(), "models");
+                const provision = this.opts.provision ?? ((dir) => ensureModelDir({ cacheDir: dir }));
+                let modelDir;
+                try {
+                    modelDir = await provision(cacheDir);
+                }
+                catch (err) {
+                    throw indexEmbedderDownloadFailed(err, {
+                        archiveRefused: isRefusedArchive(err),
+                    });
+                }
                 try {
                     const mod = await import("fastembed");
-                    // fastembed's init does a non-recursive mkdir of the cache dir, so it
-                    // fails if an ancestor (e.g. ~/.cruxy) doesn't exist yet. Create it first.
-                    if (this.opts.cacheDir) {
-                        await fs.mkdir(this.opts.cacheDir, { recursive: true });
-                    }
                     return (await mod.FlagEmbedding.init({
-                        model: mod.EmbeddingModel.BGESmallENV15,
+                        model: mod.EmbeddingModel.CUSTOM,
+                        modelAbsoluteDirPath: modelDir,
+                        modelName: MODEL_ONNX_FILE,
                         maxLength: this.opts.maxLength ?? 512,
-                        cacheDir: this.opts.cacheDir,
-                        showDownloadProgress: this.opts.showDownloadProgress ?? false,
+                        showDownloadProgress: false,
                     }));
                 }
                 catch (err) {
-                    // The heavy path: first-run model download/decompress or ONNX-runtime
-                    // init failed (offline, unreachable model bucket, proxy). Surface a
+                    // ONNX-runtime init failed on a verified model directory. Surface a
                     // typed, actionable error instead of letting it collapse into the
                     // generic CRUXY_E_INDEX_FAILED ("re-run --verbose"). Still fail-loud —
                     // this never degrades to the lexical backend. (Module-*load* failure is
@@ -128,6 +142,15 @@ export class FastEmbedEmbedder {
         return l2normalize(Float32Array.from(await model.queryEmbed(text)));
     }
 }
+/**
+ * Duck-typed on purpose: tests re-import this module across
+ * `vi.resetModules()`, which would defeat an `instanceof ModelCacheError`.
+ */
+function isRefusedArchive(err) {
+    return (err instanceof Error &&
+        err.name === "ModelCacheError" &&
+        err.kind === "refused");
+}
 /**
  * Build the **production** embedder: fastembed / bge-small-en-v1.5.
  *