@cruxy/cli 1.11.1 → 1.11.3

package/dist/indexing/model-cache.js

@@ -0,0 +1,399 @@
+import { randomBytes } from "node:crypto";
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { EnvHttpProxyAgent, fetch as undiciFetch } from "undici";
+import { extract as tarExtract } from "tar";
+/**
+ * Cruxy-owned download + extraction of the local embedding model.
+ *
+ * Why this exists (#306): fastembed's own `retrieveModel` extracts the model
+ * tarball with `tar@6.2.1`, which carries a family of path-traversal /
+ * symlink-poisoning advisories, has no fixed 6.x, and cannot be overridden to
+ * tar 7 (fastembed does `import tar from "tar"`; tar 7 has no default export —
+ * the override was tested and breaks `cruxy index` at module link). fastembed
+ * 2.1.0 is its latest release and pins `tar ^6.2.0`.
+ *
+ * So cruxy provisions the model directory itself and hands fastembed an
+ * absolute path via `model: CUSTOM` + `modelAbsoluteDirPath`. In fastembed's
+ * `init`, `retrieveModel` sits on the other arm of a ternary on `CUSTOM`, so it
+ * is unreachable once we go through this module — tar 6 stays in the
+ * dependency tree (scanners will keep flagging it) but never runs.
+ *
+ * This code writes to every user's disk, so the archive is treated as hostile:
+ *  - every entry is checked by an explicit allow-list (regular files and
+ *    directories only; a single top-level directory named for the model; no
+ *    `..`, absolute, drive-letter, backslash or NUL paths; bounded count and
+ *    size) — never the library's defaults alone. A refused entry fails the
+ *    whole extraction; it is never silently skipped.
+ *  - download and extraction happen in a staging directory next to the final
+ *    one; the final directory appears only via a rename after the required
+ *    file set has been verified, so an interrupted run can never leave a
+ *    directory that looks complete.
+ *  - a completion marker records the verified file sizes; a cache hit requires
+ *    the marker AND matching sizes, so a partial or tampered directory is
+ *    redone rather than used.
+ */
+/** Model directory name inside the cache; also the archive's top-level dir. */
+export const MODEL_NAME = "fast-bge-small-en-v1.5";
+/** Where fastembed (and Qdrant's Python fastembed) fetch this archive from. */
+export const MODEL_ARCHIVE_URL = `https://storage.googleapis.com/qdrant-fastembed/${MODEL_NAME}.tar.gz`;
+/** The ONNX graph fastembed loads from the model directory. */
+export const MODEL_ONNX_FILE = "model_optimized.onnx";
+/**
+ * Files fastembed's `init` reads. The archive also ships `ort_config.json` and
+ * `vocab.txt`; they are extracted if present but not required.
+ */
+export const REQUIRED_FILES = [
+    "config.json",
+    MODEL_ONNX_FILE,
+    "special_tokens_map.json",
+    "tokenizer.json",
+    "tokenizer_config.json",
+];
+/** Written into the model dir after verification; absent ⇒ incomplete. */
+export const MARKER_FILE = ".cruxy-model.json";
+/** Compressed archive ceiling (the real one is ~77 MB). */
+export const MAX_ARCHIVE_BYTES = 512 * 1024 * 1024;
+/** Sum of declared entry sizes ceiling (the real one is ~134 MB). */
+export const MAX_EXTRACTED_BYTES = 1024 * 1024 * 1024;
+/** Entry-count ceiling (the real archive has 8). */
+export const MAX_ENTRIES = 64;
+/** Abort the download if no bytes arrive for this long. */
+const IDLE_TIMEOUT_MS = 60_000;
+/** Staging dirs older than this are leftovers of a dead run and are swept. */
+const STALE_STAGING_MS = 6 * 60 * 60 * 1000;
+/**
+ * Failure of the download / extraction / verification pipeline. `kind` lets
+ * the caller pick next steps: a `download` failure is the classic offline
+ * first run; `refused` means the archive contained an entry the allow-list
+ * rejected (retrying blindly is wrong); `incomplete` means the archive did not
+ * contain the required file set, or the extracted set failed verification.
+ */
+export class ModelCacheError extends Error {
+    kind;
+    constructor(kind, message, cause) {
+        super(message, cause === undefined ? undefined : { cause });
+        this.name = "ModelCacheError";
+        this.kind = kind;
+    }
+}
+/**
+ * Ensure `<cacheDir>/<MODEL_NAME>` holds a verified, complete model and return
+ * that absolute path. Downloads and extracts only when the cache is missing or
+ * fails verification; never trusts a directory without its marker.
+ */
+export async function ensureModelDir(opts) {
+    const cacheDir = path.resolve(opts.cacheDir);
+    const modelDir = path.join(cacheDir, MODEL_NAME);
+    if (await isCompleteModelDir(modelDir))
+        return modelDir;
+    await fs.mkdir(cacheDir, { recursive: true });
+    await sweepStaleStaging(cacheDir);
+    // Stage next to the destination so the final publish is a same-filesystem
+    // rename (atomic on POSIX; on Windows it either succeeds or throws).
+    const stagingDir = path.join(cacheDir, `.${MODEL_NAME}.tmp-${process.pid}-${randomBytes(4).toString("hex")}`);
+    const archivePath = `${stagingDir}.tar.gz`;
+    try {
+        await fs.mkdir(stagingDir, { recursive: true });
+        await downloadArchive(opts.url ?? MODEL_ARCHIVE_URL, archivePath, opts.fetchImpl, opts.onProgress);
+        opts.onProgress?.({ phase: "extract" });
+        await extractArchive(archivePath, stagingDir);
+        opts.onProgress?.({ phase: "verify" });
+        const extracted = path.join(stagingDir, MODEL_NAME);
+        const files = await verifyModelDir(extracted);
+        await writeMarker(extracted, files);
+        await publish(extracted, modelDir);
+        return modelDir;
+    }
+    finally {
+        await fs.rm(archivePath, { force: true }).catch(() => { });
+        await fs.rm(stagingDir, { recursive: true, force: true }).catch(() => { });
+    }
+}
+/**
+ * True only when the marker exists, parses, names this model, and every
+ * required file is a regular file whose size matches the marker. Anything
+ * else — a missing marker (a partial or legacy extraction), a size mismatch,
+ * a symlink where a file should be — is "incomplete" and gets redone.
+ */
+export async function isCompleteModelDir(modelDir) {
+    let marker;
+    try {
+        const raw = await fs.readFile(path.join(modelDir, MARKER_FILE), "utf8");
+        marker = JSON.parse(raw);
+    }
+    catch {
+        return false;
+    }
+    if (!marker ||
+        marker.version !== 1 ||
+        marker.model !== MODEL_NAME ||
+        typeof marker.files !== "object" ||
+        marker.files === null) {
+        return false;
+    }
+    for (const name of REQUIRED_FILES) {
+        const expected = marker.files[name];
+        if (typeof expected !== "number" || expected <= 0)
+            return false;
+        const st = await fs.lstat(path.join(modelDir, name)).catch(() => null);
+        if (!st || !st.isFile() || st.size !== expected)
+            return false;
+    }
+    return true;
+}
+// ── download ──────────────────────────────────────────────────────────────────
+async function downloadArchive(url, dest, fetchImpl, onProgress) {
+    const doFetch = fetchImpl ?? undiciFetch;
+    const controller = new AbortController();
+    let idle;
+    const armIdle = () => {
+        if (idle)
+            clearTimeout(idle);
+        idle = setTimeout(() => controller.abort(new Error(`no data for ${IDLE_TIMEOUT_MS}ms`)), IDLE_TIMEOUT_MS);
+        idle.unref?.();
+    };
+    let res;
+    try {
+        armIdle();
+        res = await doFetch(url, {
+            signal: controller.signal,
+            redirect: "follow",
+            // Honor HTTPS_PROXY / NO_PROXY for this fixed, public URL (the web tool
+            // deliberately does not; it has an SSRF guard to protect instead). The
+            // agent is built only when a proxy is configured: undici prints an
+            // "experimental" warning on construction, and non-proxy users should
+            // never see it.
+            ...(fetchImpl || !proxyConfigured()
+                ? {}
+                : { dispatcher: new EnvHttpProxyAgent() }),
+        });
+    }
+    catch (err) {
+        if (idle)
+            clearTimeout(idle);
+        throw new ModelCacheError("download", `downloading ${url} failed: ${messageOf(err)}`, err);
+    }
+    try {
+        if (!res.ok) {
+            throw new ModelCacheError("download", `downloading ${url} failed: HTTP ${res.status}`);
+        }
+        const declared = Number(res.headers.get("content-length") ?? "");
+        if (Number.isFinite(declared) && declared > MAX_ARCHIVE_BYTES) {
+            throw new ModelCacheError("refused", `refused model archive: Content-Length ${declared} exceeds the ${MAX_ARCHIVE_BYTES}-byte ceiling`);
+        }
+        if (!res.body) {
+            throw new ModelCacheError("download", `downloading ${url}: empty body`);
+        }
+        const total = Number.isFinite(declared) && declared > 0 ? declared : undefined;
+        const fh = await fs.open(dest, "w");
+        let received = 0;
+        try {
+            for await (const chunk of res.body) {
+                armIdle();
+                received += chunk.byteLength;
+                if (received > MAX_ARCHIVE_BYTES) {
+                    controller.abort();
+                    throw new ModelCacheError("refused", `refused model archive: body exceeds the ${MAX_ARCHIVE_BYTES}-byte ceiling`);
+                }
+                await fh.write(chunk);
+                onProgress?.({ phase: "download", received, total });
+            }
+            if (total !== undefined && received !== total) {
+                throw new ModelCacheError("download", `downloading ${url}: connection closed after ${received} of ${total} bytes`);
+            }
+        }
+        catch (err) {
+            if (err instanceof ModelCacheError)
+                throw err;
+            throw new ModelCacheError("download", `downloading ${url} failed: ${messageOf(err)}`, err);
+        }
+        finally {
+            await fh.close();
+        }
+    }
+    finally {
+        if (idle)
+            clearTimeout(idle);
+    }
+}
+// ── extraction ────────────────────────────────────────────────────────────────
+/**
+ * Decide whether one archive entry may be written. Returns a reason string to
+ * refuse, or null to allow. Deliberately an allow-list: anything not proven
+ * safe is refused. Runs BEFORE tar's own checks, and independently of them.
+ */
+export function refuseEntry(entryPath, type, linkpath) {
+    if (type !== "File" && type !== "Directory") {
+        return `entry type ${type} is not allowed (${entryPath})`;
+    }
+    if (linkpath)
+        return `entry carries a link target (${entryPath})`;
+    if (entryPath.length === 0)
+        return "empty entry path";
+    if (entryPath.includes("\0"))
+        return "entry path contains NUL";
+    if (entryPath.includes("\\"))
+        return `entry path contains a backslash (${entryPath})`;
+    if (entryPath.startsWith("/"))
+        return `absolute entry path (${entryPath})`;
+    if (/^[A-Za-z]:/.test(entryPath))
+        return `drive-letter entry path (${entryPath})`;
+    const parts = entryPath.split("/");
+    // A directory entry may end with "/"; nothing else may have an empty segment.
+    if (type === "Directory" &&
+        parts.length > 1 &&
+        parts[parts.length - 1] === "") {
+        parts.pop();
+    }
+    for (const seg of parts) {
+        if (seg === "" || seg === "." || seg === "..") {
+            return `entry path has an empty, "." or ".." segment (${entryPath})`;
+        }
+    }
+    if (parts[0] !== MODEL_NAME) {
+        return `entry is outside the ${MODEL_NAME}/ directory (${entryPath})`;
+    }
+    if (type === "Directory" && parts.length !== 1) {
+        return `nested directory not allowed (${entryPath})`;
+    }
+    if (type === "File" && parts.length !== 2) {
+        return `file must sit directly under ${MODEL_NAME}/ (${entryPath})`;
+    }
+    return null;
+}
+async function extractArchive(archivePath, cwd) {
+    const refused = [];
+    let entries = 0;
+    let declaredBytes = 0;
+    // On the extract path tar always hands a ReadEntry (Stats is the create-side
+    // shape of the same option), but keep the narrowing explicit.
+    const filter = (entryPath, entry) => {
+        entries += 1;
+        if (entries > MAX_ENTRIES) {
+            refused.push(`more than ${MAX_ENTRIES} entries`);
+            return false;
+        }
+        if (!("header" in entry)) {
+            refused.push(`unexpected non-archive entry (${entryPath})`);
+            return false;
+        }
+        const reason = refuseEntry(entryPath, String(entry.type), entry.linkpath ? String(entry.linkpath) : undefined);
+        if (reason) {
+            refused.push(reason);
+            return false;
+        }
+        declaredBytes += Number(entry.size ?? 0);
+        if (declaredBytes > MAX_EXTRACTED_BYTES) {
+            refused.push(`declared size exceeds the ${MAX_EXTRACTED_BYTES}-byte ceiling`);
+            return false;
+        }
+        return true;
+    };
+    try {
+        await tarExtract({
+            file: archivePath,
+            cwd,
+            // tar's own guards stay on as a second layer: strict turns its warnings
+            // (e.g. its independent ".." detection) into errors; preservePaths=false
+            // keeps its absolute-path stripping; no ownership or mode replay.
+            strict: true,
+            preservePaths: false,
+            preserveOwner: false,
+            noChmod: true,
+            noMtime: true,
+            filter,
+        });
+    }
+    catch (err) {
+        if (refused.length > 0) {
+            throw new ModelCacheError("refused", `refused model archive: ${refused.join("; ")}`, err);
+        }
+        throw new ModelCacheError("incomplete", `extracting the model archive failed: ${messageOf(err)}`, err);
+    }
+    if (refused.length > 0) {
+        throw new ModelCacheError("refused", `refused model archive: ${refused.join("; ")}`);
+    }
+}
+// ── verification + publish ────────────────────────────────────────────────────
+/**
+ * Every required file must be a regular, non-empty file; nothing in the dir
+ * may be a symlink (belt and braces over the entry filter). Returns the size
+ * manifest for the marker.
+ */
+async function verifyModelDir(dir) {
+    const st = await fs.lstat(dir).catch(() => null);
+    if (!st || !st.isDirectory()) {
+        throw new ModelCacheError("incomplete", `model archive did not contain a ${MODEL_NAME}/ directory`);
+    }
+    const files = {};
+    for (const name of await fs.readdir(dir)) {
+        const s = await fs.lstat(path.join(dir, name));
+        if (s.isSymbolicLink()) {
+            throw new ModelCacheError("refused", `symlink found after extraction: ${name}`);
+        }
+        if (s.isFile())
+            files[name] = s.size;
+    }
+    const missing = REQUIRED_FILES.filter((n) => !(files[n] > 0));
+    if (missing.length > 0) {
+        throw new ModelCacheError("incomplete", `model archive is missing or has empty required file(s): ${missing.join(", ")}`);
+    }
+    return files;
+}
+async function writeMarker(dir, files) {
+    const marker = {
+        version: 1,
+        model: MODEL_NAME,
+        files,
+        extractedAt: new Date().toISOString(),
+    };
+    await fs.writeFile(path.join(dir, MARKER_FILE), JSON.stringify(marker, null, 2));
+}
+/** Rename the verified staging dir into place; tolerate a concurrent winner. */
+async function publish(from, to) {
+    try {
+        await fs.rename(from, to);
+        return;
+    }
+    catch (err) {
+        // Another process may have published a complete model meanwhile — accept
+        // it. Otherwise whatever is there failed verification: replace it.
+        if (await isCompleteModelDir(to))
+            return;
+        await fs.rm(to, { recursive: true, force: true });
+        try {
+            await fs.rename(from, to);
+        }
+        catch (err2) {
+            throw new ModelCacheError("incomplete", `could not move the verified model into ${to}: ${messageOf(err2)}`, err2 ?? err);
+        }
+    }
+}
+async function sweepStaleStaging(cacheDir) {
+    const prefix = `.${MODEL_NAME}.tmp-`;
+    const now = Date.now();
+    let names;
+    try {
+        names = await fs.readdir(cacheDir);
+    }
+    catch {
+        return;
+    }
+    for (const name of names) {
+        if (!name.startsWith(prefix))
+            continue;
+        const p = path.join(cacheDir, name);
+        const st = await fs.lstat(p).catch(() => null);
+        if (st && now - st.mtimeMs > STALE_STAGING_MS) {
+            await fs.rm(p, { recursive: true, force: true }).catch(() => { });
+        }
+    }
+}
+function proxyConfigured() {
+    const env = process.env;
+    return Boolean(env.HTTPS_PROXY || env.https_proxy || env.HTTP_PROXY || env.http_proxy);
+}
+function messageOf(err) {
+    return err instanceof Error ? err.message : String(err);
+}

package/dist/mcp/bounds.js

@@ -1,4 +1,4 @@
-import { MAX_SCHEMA_DEPTH, schemaDepth } from "../tools/schema-depth.js";
+import { MAX_SCHEMA_DEPTH, MAX_SCHEMA_NODES, schemaDepth, schemaNodes, } from "../tools/schema-depth.js";
 const PERMISSIVE_SCHEMA = {
     type: "object",
     additionalProperties: true,
@@ -48,6 +48,13 @@ export function boundToolList(tools, bounds) {
             inputSchema = { ...PERMISSIVE_SCHEMA };
             notes.push(`input schema nests ${depth} levels deep, at or over the ${MAX_SCHEMA_DEPTH}-level provider limit, and was replaced with a permissive one`);
         }
+        // Same order, same reasoning: nodes are counted on the post-cap value, and
+        // the gateway's bound is inclusive (P4) — 400 passes, 401 fails the request.
+        const nodes = schemaNodes(inputSchema);
+        if (nodes > MAX_SCHEMA_NODES) {
+            inputSchema = { ...PERMISSIVE_SCHEMA };
+            notes.push(`input schema has ${nodes} nodes, over the ${MAX_SCHEMA_NODES}-node provider limit, and was replaced with a permissive one`);
+        }
         return { name: t.name, description, inputSchema, notes };
     });
     return { tools: bounded, droppedCount };

package/dist/plan/execute.js

@@ -1,7 +1,7 @@
 import { CruxyError } from "../errors/index.js";
 import { promptContinueAfterFailure } from "./approve.js";
 export async function executePlan(plan, deps) {
-    const { runStep, io, renderer } = deps;
+    const { runStep, io, renderer, record } = deps;
     try {
         for (const [index, step] of plan.steps.entries()) {
             step.status = "running";
@@ -13,14 +13,17 @@ export async function executePlan(plan, deps) {
             });
             renderer?.setPhase({ kind: "executing-step" });
             renderer?.setPlan(plan.steps);
+            record?.(step);
             try {
                 await runStep(step);
                 step.status = "done";
                 renderer?.setPlan(plan.steps);
+                record?.(step);
             }
             catch (err) {
                 step.status = "failed";
                 renderer?.setPlan(plan.steps);
+                record?.(step);
                 // Surface the failure via the U.5 shape when we have it.
                 const detail = err instanceof CruxyError
                     ? `${err.title}${err.cause ? ` — ${err.cause}` : ""}`

package/dist/plan/service.js

@@ -3,6 +3,7 @@ import { ToolRegistry } from "../tools/index.js";
 import { runAgent } from "../agent/loop.js";
 import { promptPlanDecision } from "./approve.js";
 import { executePlan } from "./execute.js";
+import { stepInstruction } from "./step-message.js";
 import { makeSubmitPlanTool } from "./submit-plan.js";
 /**
  * Orchestrates a plan-mode turn (C.31): propose → approve/revise (capped) →
@@ -13,6 +14,32 @@ import { makeSubmitPlanTool } from "./submit-plan.js";
  *
  * A propose phase that ends with NO plan is a completed conversational turn, not
  * an error — see the `!holder.plan` branch below.
+ *
+ * WHAT SURVIVES THE PROCESS, AND WHAT DOES NOT (plan-durability).
+ *
+ * The plan object lives in `holder` below for exactly one call of this
+ * function. Three things outlive it: the transcript (every step's messages
+ * reach the log as they happen, through `args.compact`), the typed record
+ * (`args.record` — the approval as a fact, and each step transition), and the
+ * checkpoint (see `execute.ts` for what that one actually covers). After a
+ * crash, a closed terminal, or Ctrl-C — which is a real SIGINT here, because
+ * the TUI releases stdin for the duration of a turn — `--resume` restores the
+ * mode and the history and DESCRIBES the plan; it does not continue it.
+ *
+ * NOT BUILT: a resumable executor. Re-entering `executePlan` at step N on
+ * resume needs three things this turn does not have: a re-entry point that
+ * rebuilds the plan from the record rather than from a `submit_plan` call; a
+ * fresh-consent decision, because the approval was given in another process
+ * against a tree that has since changed (and `[g]`'s grants are gone with
+ * that process, rightly); and a second checkpoint latch, which would split one
+ * undo unit into two. Once the transcript is durable the model can continue
+ * from step N+1 on a one-line nudge — it can see its own plan and every "Do
+ * ONLY step" message that ran — and there is no recorded interruption where
+ * that has failed.
+ *
+ * REVISIT TRIGGER: one observed case where transcript-driven continuation
+ * fails — a resumed session that, told to carry on, redoes a finished step or
+ * cannot tell where it stopped. Until then the record is the deliverable.
  */
 /** Default cap on plan revisions before failing loud. */
 export const MAX_PLAN_REVISIONS = 3;
@@ -82,6 +109,7 @@ export async function runPlanSession(args) {
             router: args.router,
             taskClass: "plan",
             onRequestUsage: args.onRequestUsage,
+            compact: args.compact,
         }));
         if (!holder.plan) {
             // NO PLAN IS NOT A FAILURE. The propose phase's registry is read-only plus
@@ -121,14 +149,18 @@ export async function runPlanSession(args) {
             if (decision.kind === "approve-grant") {
                 args.planPolicy.enableSafeStepGrants();
             }
+            // The approval, recorded as a fact (plan-durability): which choice, and
+            // the steps it covered. Written before the first step runs, so a plan
+            // that dies in step 1 still has its approval on disk.
+            args.record?.planApproved(decision.kind, plan.steps.map((s) => ({ id: s.id, title: s.title, kind: s.kind })));
             // Execute step-by-step, driving one agent turn per step against the full
             // registry. Each step's actions still pass through the U.3 gate.
             const runStep = async (step) => {
-                messages.push({
-                    role: "user",
-                    content: `The plan is approved. Do ONLY step ${step.id}: ${step.title}. ${step.rationale} ` +
-                        "Do not start any other step. When this step is complete, stop.",
-                });
+                // The scoping instruction plus the whole plan's current statuses
+                // (plan-durability): the executor has already marked this step
+                // `running` and every earlier one `done` or `failed`, so the message
+                // says which — see `step-message.ts` for why the failed case matters.
+                messages.push({ role: "user", content: stepInstruction(plan, step) });
                 accumulate(await runAgent({
                     messages,
                     provider: args.provider,
@@ -142,12 +174,17 @@ export async function runPlanSession(args) {
                     router: args.router,
                     taskClass: "main-turn",
                     onRequestUsage: args.onRequestUsage,
+                    // The step message pushed above reaches the log at this loop's
+                    // first iteration, BEFORE the step's first model call — so a step
+                    // that dies still leaves on disk which step it was.
+                    compact: args.compact,
                 }));
             };
             await executePlan(plan, {
                 runStep,
                 io: args.io,
                 renderer: args.renderer,
+                record: (step) => args.record?.planStep(step.id, step.status),
             });
             return finish();
         }

package/dist/plan/step-message.js

@@ -0,0 +1,49 @@
+/**
+ * The per-step instruction the executor sends the model (plan-durability).
+ *
+ * The first paragraph is the C.31 scoping instruction, unchanged: do this one
+ * step, nothing else, then stop. What follows it is new — the whole plan with
+ * each step's CURRENT status — and it exists because of what the model could
+ * not see without it.
+ *
+ * The model already has the plan: its own `submit_plan` call sits in the
+ * history with every step as the tool input. What it never had was status. A
+ * step that failed and that the user chose to continue past (`[c]` at the
+ * failure prompt) was followed by exactly the same message a successful step
+ * was — "Do ONLY step N+1" — so the model walked into step N+1 believing step N
+ * had landed, and built on work that was not there. The block below makes a
+ * failed step read as failed, in the message that asks for the next one.
+ *
+ * This is a prompt change, not a tool: no schema, no new tool, and no change to
+ * the tool set between phases (the prefix-cache argument in cli#150). It is
+ * appended to EVERY step message, a one-step plan included, so the shape the
+ * model learns is the same shape every time rather than one that appears from
+ * step 2 on. Plain words rather than the renderer's glyphs, because the reader
+ * here is the model and the status has to survive as text.
+ */
+export function stepInstruction(plan, step) {
+    const head = `The plan is approved. Do ONLY step ${step.id}: ${step.title}. ${step.rationale} ` +
+        "Do not start any other step. When this step is complete, stop.";
+    const n = plan.steps.length;
+    const lines = plan.steps.map((s) => `  ${s.id}. ${statusLabel(s, step)} — ${s.title}`);
+    return `${head}\n\nPlan status (${n} step${n === 1 ? "" : "s"}):\n${lines.join("\n")}`;
+}
+/**
+ * One step's status as the model should read it. `failed` is the label that
+ * matters: it names the user's decision, so the model knows the step was not
+ * skipped by accident and is not going to be retried by the executor.
+ */
+function statusLabel(s, current) {
+    if (s.id === current.id)
+        return "this step";
+    switch (s.status) {
+        case "done":
+            return "done";
+        case "failed":
+            return "FAILED — the user chose to continue past it; do not assume its work exists";
+        case "running":
+            return "running";
+        case "pending":
+            return "pending";
+    }
+}

package/dist/render/context-view.js

@@ -49,7 +49,9 @@ function share(tokens, of) {
  * a table into a misaligned mess; the default is unbounded for callers that
  * reflow themselves (the TUI's main column).
  */
-export function contextReportLines(report, t, width = Infinity) {
+export function contextReportLines(report, t, width = Infinity, 
+/** What compaction has cost so far (P3); omitted → the section is left out. */
+tally) {
     const { reading, compaction } = report;
     const lines = [t.heading("context")];
     // The headline, worded exactly as the panel words it — same estimate, same
@@ -88,6 +90,13 @@ export function contextReportLines(report, t, width = Infinity) {
             lines.push(`${head}${c.excerpt === "" ? "" : t.muted(` — ${c.excerpt}`)}`);
         }
     }
+    // ── what compaction has cost so far (P3) ──────────────────────────────────
+    if (tally) {
+        lines.push("");
+        lines.push(t.strong("compaction so far"));
+        const so = compactionTallyLines(tally, t, "  ");
+        lines.push(...(so.length > 0 ? so : [t.muted("  none yet this session")]));
+    }
     // ── what compaction would do ──────────────────────────────────────────────
     lines.push("");
     lines.push(t.strong("if you compact now"));
@@ -113,3 +122,37 @@ export function contextReportLines(report, t, width = Infinity) {
         ? lines.map((l) => fit(l, width, t.glyph.ellipsis))
         : lines;
 }
+/**
+ * What compaction has cost a session (P3 context quality), as lines — the
+ * one renderer behind `/context`'s "compaction so far" and the one-shot
+ * summary, so both describe the tally the same way. Empty when nothing has
+ * compacted: the one-shot prints nothing, `/context` says "none yet".
+ *
+ * The sums cover only the compactions that recorded a cost; when that is
+ * fewer than the count (a log written before P3), the line says so rather
+ * than presenting a partial sum as the whole. A suspected instruction loss is
+ * a WARNING line: it is the one figure here a user should act on.
+ */
+export function compactionTallyLines(tally, t, indent = "") {
+    if (tally.count === 0)
+        return [];
+    const lines = [];
+    const key = t.strong("compaction");
+    const times = `${tally.count} time${tally.count === 1 ? "" : "s"}`;
+    if (tally.measured === 0) {
+        lines.push(`${indent}${key} ${times} ${t.muted("(cost not recorded — written before it was measured)")}`);
+    }
+    else {
+        const scope = tally.measured < tally.count
+            ? t.muted(` (${tally.count - tally.measured} recorded no cost)`)
+            : "";
+        lines.push(`${indent}${key} ${times}${t.sep}freed ${approx(tally.freedTokens)}${t.sep}` +
+            t.muted(`summaries cost ${approx(tally.summaryInputTokens)} in / ${approx(tally.summaryOutputTokens)} out`) +
+            scope);
+    }
+    if (tally.instructionLosses > 0) {
+        const n = tally.instructionLosses;
+        lines.push(`${indent}${t.warning(`${n} compaction${n === 1 ? "" : "s"} may have dropped an instruction you gave — restate any that still apply`)}`);
+    }
+    return lines;
+}

package/dist/render/status-view.js

@@ -1,6 +1,7 @@
 import { capacityLevel, formatCapacity, } from "../utils/disk.js";
 import { fit } from "./layout.js";
 import { formatTokens } from "./state.js";
+import { formatDuration } from "./test-view.js";
 /** `key  value`, aligned on a fixed gutter so the column is scannable. */
 function row(key, value, t) {
     return `  ${t.muted(key.padEnd(11))} ${value}`;
@@ -96,6 +97,18 @@ export function sessionStatusLines(status, t, width = Infinity) {
         lines.push(row("jobs", detail, t));
     }
     lines.push(row("tools", t.muted(`${status.tools} available to the model`), t));
+    // What last ran and how it exited, dated — the record's answer to "was
+    // this verified", which is the reader's question to settle, not this
+    // row's. "none recorded" is said out loud rather than omitted.
+    if (status.verification) {
+        const v = status.verification;
+        const exit = v.exitCode === null ? "no exit code" : `exit ${v.exitCode}`;
+        lines.push(row("verify", `${t.muted(v.tool)} ${v.command} ${t.glyph.arrow} ${v.passed ? t.muted(exit) : t.danger(exit)} ` +
+            t.muted(`(${formatDuration(v.durationMs)}) ${t.glyph.sep} ${v.age}`), t));
+    }
+    else {
+        lines.push(row("verify", t.warning("none recorded this session"), t));
+    }
     // Roots last: one line each, so a multi-root session shows which repo each
     // change lands in — the fact the startup banner states once and then loses.
     lines.push("");