@cruxy/cli 1.2.0 → 1.3.0

package/dist/approval/policy.js

@@ -75,20 +75,58 @@ export function scopeCovers(scope, request) {
 export class InteractivePolicy {
     allowlist;
     io;
-    constructor(allowlist, io) {
+    autoApprove;
+    constructor(allowlist, io, 
+    /**
+     * Whether the session is in an auto-approving mode (P5 track 3).
+     *
+     * A THUNK, not a boolean: the mode is runtime state the user can change at
+     * any point, including between two actions of the same turn. Reading it
+     * once at construction would let a session that has been switched back to
+     * `manual` keep auto-approving for the rest of its life — a stale copy of
+     * exactly the fact this must never be wrong about.
+     *
+     * Omitted → never auto-approves, which is every non-interactive caller.
+     */
+    autoApprove = () => false) {
         this.allowlist = allowlist;
         this.io = io;
+        this.autoApprove = autoApprove;
     }
     async decide(request) {
+        // A grant the allowlist answers shows the user nothing (P3) — left
+        // unflagged so a caller can render the change instead.
         if (this.allowlist.allows(request))
             return { allow: true };
+        // Auto-approve: allowed without a prompt, and deliberately NOT flagged as
+        // `prompted` — so `previewSilentApprovals` renders the diff. An unattended
+        // mode that showed nothing would let a session's whole body of work land
+        // invisibly, which is a different failure from the one it is meant to save
+        // the user: skipping the QUESTION is the point, skipping the RECORD is not.
+        //
+        // THE CEILING (P5 track 3). Auto-approve suppresses the prompt for
+        // reversible actions ONLY. An action the run's checkpoint cannot restore —
+        // a delete outside the workspace, a force-push, a history rewrite, an MCP
+        // call, a rollback, anything unprovable — falls through to the prompt even
+        // here, and even unattended.
+        //
+        // This is the line the product position rests on. "Only change what was
+        // asked, no silent deletions" is not a claim a mode may switch off:
+        // suppressing prompts is a convenience, and suppressing the last gate before
+        // irreversible damage is a different thing wearing the same word. Note the
+        // gate is `request.irreversible`, NOT `request.tier` — the tier is an
+        // unprovability signal (every shell command is `destructive`, `ls`
+        // included), so gating on it would make the mode either useless or
+        // dishonest. See `ApprovalRequest.irreversible`.
+        if (this.autoApprove() && !request.irreversible)
+            return { allow: true };
         const choice = await promptForApproval(request, this.io);
         switch (choice.kind) {
             case "once":
-                return { allow: true };
+                return { allow: true, prompted: true };
             case "session":
                 this.allowlist.grant(request);
-                return { allow: true };
+                return { allow: true, prompted: true };
             case "reject":
                 return choice.reason
                     ? {

package/dist/approval/prompt.js

@@ -10,29 +10,39 @@ import { themeForColor } from "../theme/index.js";
  * is a reject.
  */
 export async function promptForApproval(request, io) {
-    io.write(render(request, io.color, io.columns ?? resolveColumns()));
-    const key = (await io.readKey()).toLowerCase();
-    io.write("\n");
-    switch (key) {
-        case "y":
-            return { kind: "once" };
-        case "a":
-            return { kind: "session" };
-        case "n": {
-            io.write("  reason (optional, sent to the agent): ");
-            const reason = (await io.readLine()).trim();
-            return reason ? { kind: "reject", reason } : { kind: "reject" };
-        }
-        case "t": {
-            io.write("  what should the agent do instead? ");
-            const instruction = (await io.readLine()).trim();
-            return instruction
-                ? { kind: "instruct", instruction }
-                : { kind: "reject" };
+    // The terminal is about to belong to this prompt: yield the live region
+    // BEFORE the question lands, or it would be painted into a region the next
+    // repaint erases (U.2/U.4). `finally` gives it back on every path, including
+    // the default-deny ones.
+    io.beginPrompt?.();
+    try {
+        io.write(render(request, io.color, io.columns ?? resolveColumns()));
+        const key = (await io.readKey()).toLowerCase();
+        io.write("\n");
+        switch (key) {
+            case "y":
+                return { kind: "once" };
+            case "a":
+                return { kind: "session" };
+            case "n": {
+                io.write("  reason (optional, sent to the agent): ");
+                const reason = (await io.readLine()).trim();
+                return reason ? { kind: "reject", reason } : { kind: "reject" };
+            }
+            case "t": {
+                io.write("  what should the agent do instead? ");
+                const instruction = (await io.readLine()).trim();
+                return instruction
+                    ? { kind: "instruct", instruction }
+                    : { kind: "reject" };
+            }
+            default:
+                // n/a key, empty, EOF, Ctrl-C → default-deny.
+                return { kind: "reject" };
         }
-        default:
-            // n/a key, empty, EOF, Ctrl-C → default-deny.
-            return { kind: "reject" };
+    }
+    finally {
+        io.endPrompt?.();
     }
 }
 /** Render the full prompt block: header, detail (diff or command+cwd), choices. */
@@ -48,10 +58,27 @@ export function render(request, color, columns = resolveColumns()) {
     const label = tierLabel(request.tier, t);
     const lines = [];
     lines.push(...header(request.summary, mark, label, t, columns));
+    lines.push(...whyAsking(request.irreversible, t, columns));
     lines.push(detail(request, t, columns));
     lines.push(choices(request.scope, t));
     return lines.filter((l) => l !== "").join("\n") + " ";
 }
+/**
+ * The one-clause reason the checkpoint cannot restore this action, when there is
+ * one. Rendered for every mode, not just the auto ones — the prompt has no way
+ * to know the session's mode, and a user in `manual` benefits from the same
+ * sentence.
+ *
+ * It earns its line in auto-approve, where an unexplained prompt is actively
+ * misleading: the user asked not to be asked, so the only useful thing to say is
+ * why this one is different. Reflowed, never truncated — a half-sentence about
+ * irreversibility is worse than none.
+ */
+function whyAsking(irreversible, t, width) {
+    if (!irreversible)
+        return [];
+    return reflow(`no undo: ${irreversible}`, Math.max(1, width - 2)).map((l) => t.muted(`  ${l}`));
+}
 /**
  * The header, width-aware (U.12). Wide: the one inline line `! cruxy wants to
  * <summary> (destructive)`. Narrow: the risk (mark + tier label) stands on its

package/dist/checkpoint/gate.js

@@ -81,6 +81,18 @@ export class CheckpointGate {
         });
         await writeSet(this.primaryRoot, this.set);
     }
+    /**
+     * The current run's id, or undefined before the first {@link beginRun}.
+     *
+     * This is the ONE per-turn id in the CLI, and the session log (P2) borrows it
+     * rather than minting a second: `cruxy rollback <id>` reverts a turn's
+     * mutations and the session log records that turn's messages, so if the two
+     * used different ids the undo unit would mean two different things depending
+     * on which surface you asked. Exposed read-only — only `beginRun` sets it.
+     */
+    currentRunId() {
+        return this.runId ?? undefined;
+    }
     /** Root names that got a per-root service this process (inspection/tests). */
     get touchedRoots() {
         return [...this.services.keys()];