@cruxy/cli 1.3.0 → 1.4.0

package/dist/agent/status.js

@@ -0,0 +1,56 @@
+import { readContext } from "./context.js";
+import { modeDescription } from "./mode.js";
+/** Count real user turns: `role: "user"` with STRING content — tool results
+ * are also role "user" but carry blocks, so this counts what the human said. */
+function userTurns(session) {
+    return session.messages.filter((m) => m.role === "user" && typeof m.content === "string").length;
+}
+/** Everything `/status` and the Overview view show, from live session state. */
+export function buildSessionStatus(session, git, 
+/**
+ * The tier the gateway last said actually SERVED a request, when the caller
+ * is somewhere that knows it. Only the TUI renderer tracks this — it arrives
+ * on the stream's routing frame — so `/status`, which has no renderer, omits
+ * it and shows the configured value alone.
+ */
+servedTier) {
+    const toolCtx = session.toolContext;
+    const config = toolCtx.config;
+    const mode = session.getMode();
+    const roots = toolCtx.workspace.roots().map((r) => {
+        const info = git(r.absPath);
+        return {
+            name: r.name,
+            path: r.absPath,
+            primary: r.primary,
+            // Spread rather than assigned, so "not probed" stays ABSENT rather than
+            // becoming an explicit `undefined` the renderer would have to re-check.
+            ...(info === undefined ? {} : { git: info }),
+        };
+    });
+    const jobs = session.jobs?.list();
+    return {
+        sessionId: session.sessionId,
+        turns: userTurns(session),
+        mode,
+        modeDescription: modeDescription(mode),
+        ...(session.model ? { model: session.model.current() } : {}),
+        ...(servedTier === undefined ? {} : { servedTier }),
+        provider: config.model.provider,
+        roots,
+        context: readContext(session.messages, config.context),
+        sandboxEnabled: Boolean(toolCtx.sandbox),
+        ...(toolCtx.sandbox ? { sandboxRuntime: toolCtx.sandbox.runtimeName } : {}),
+        checkpoints: Boolean(toolCtx.checkpointsActive),
+        ...(jobs
+            ? {
+                jobs: {
+                    total: jobs.length,
+                    running: jobs.filter((j) => j.status === "running").length,
+                    needingApproval: jobs.filter((j) => j.pendingApproval).length,
+                },
+            }
+            : {}),
+        tools: session.toolRegistry.list().length,
+    };
+}

package/dist/cli/commands/run.js

@@ -14,7 +14,7 @@ import { SandboxService } from "../../sandbox/index.js";
 import { buildHooksService, buildHooksRouter } from "../../hooks/index.js";
 import { DEFAULT_MODE, } from "../../agent/index.js";
 import { runInteractive } from "../repl.js";
-import { ContextGauge, createKeyLease, runTui, TuiRenderer, } from "../../tui/index.js";
+import { ContextGauge, createKeyLease, createGitView, createOverviewView, createSettingsView, createTasksView, runTui, TuiRenderer, WorkspaceGitCache, } from "../../tui/index.js";
 import { buildAgentSession } from "../session-factory.js";
 import { apiKeyEnvVar, maybeRunOnboarding } from "../onboard.js";
 import { resetLspServices } from "../../lsp/index.js";
@@ -71,7 +71,10 @@ export async function executeRun(promptParts, opts) {
             ]
             : [`provide a task, e.g. ${invokedAs} "fix the failing test"`]);
     }
-    const { config, sources } = loadConfig();
+    // Kept whole (not destructured away) because the Settings view needs the raw
+    // layers this result was merged from to say where each value came from.
+    const loaded = loadConfig();
+    const { config, sources } = loaded;
     let apiKey = resolveApiKey(config.model.provider);
     // Declared workspace roots (C.26). This is the ONE place `run` reads the
     // process working directory — the invocation directory is the base for
@@ -337,6 +340,30 @@ export async function executeRun(promptParts, opts) {
     // provider, where the constructor's static value stands and `/model` declines.
     if (session.model)
         tui?.attachModel(session.model);
+    // The main-pane views (P7). Registered here — the one place that has both the
+    // renderer and the session — and after the session exists, because a view
+    // reads its live state. Each root gets its own cached git probe: writes fan
+    // across every declared root when checkpoints are on, so a primary-only
+    // answer would under-report what a turn actually touched.
+    if (tui) {
+        // ONE cache, both views. They ask the same question of the same trees, and
+        // a second instance would double the subprocesses to hold two copies of an
+        // answer that must agree anyway.
+        const workspaceGit = new WorkspaceGitCache(session.toolContext.workspace.roots().map((r) => r.absPath));
+        tui.attachViews([
+            createOverviewView(session, workspaceGit, () => tui.servedTier()),
+            createGitView(() => session.toolContext.workspace.roots(), workspaceGit),
+            // Registered even when background jobs are disabled — the view says so,
+            // and a nav whose rows appear and vanish with config is worse than one
+            // row that explains itself. `session.jobs` is undefined in that case.
+            createTasksView(session.jobs),
+            // The SAME loaded config the session was built from, not a fresh read —
+            // the view's whole claim is "what this session is running on", and a
+            // second load could already disagree with it. `apiKey` is a getter
+            // because onboarding may have supplied one after this line was written.
+            createSettingsView(loaded, () => apiKey !== undefined),
+        ]);
+    }
     if (multiTurn) {
         try {
             // Same session, same renderer seam, two shells: the TUI when the

package/dist/cli/session-commands.js

@@ -1,7 +1,8 @@
 import { MODE_LABELS, SESSION_MODES, modeDescription, modeFromFlags, parseMode, } from "../agent/index.js";
 import { existsSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { contextReport, readContext } from "../agent/context.js";
+import { contextReport } from "../agent/context.js";
+import { buildSessionStatus } from "../agent/status.js";
 import { scaffoldProjectInstructions } from "../config/index.js";
 import { resolveSlash } from "../hooks/index.js";
 import { contextReportLines } from "../render/context-view.js";
@@ -365,57 +366,18 @@ function handleInit(ctx) {
  */
 function handleStatus(ctx) {
     const { out, session } = ctx;
-    const toolCtx = session.toolContext;
-    const config = toolCtx.config;
-    const mode = session.getMode();
-    // A real user turn is `role: "user"` with STRING content — tool results are
-    // also role "user" but carry blocks, so this counts what the human said.
-    const turns = session.messages.filter((m) => m.role === "user" && typeof m.content === "string").length;
-    const roots = toolCtx.workspace.roots().map((r) => {
-        // A synchronous probe, on an explicitly-requested command. The rail's rule
-        // (never probe on the paint path) is about frames, not about a user who
-        // just asked; there is no frame budget to blow here.
-        const git = getGitInfo(r.absPath);
-        return {
-            name: r.name,
-            path: r.absPath,
-            primary: r.primary,
-            ...(git === null ? {} : { branch: git.branch, changed: git.changed }),
-        };
-    });
-    const jobs = session.jobs?.list();
-    for (const line of sessionStatusLines({
-        sessionId: session.sessionId,
-        turns,
-        mode,
-        modeDescription: modeDescription(mode),
-        ...(session.model ? { model: session.model.current() } : {}),
-        provider: config.model.provider,
-        roots,
-        context: readContext(session.messages, config.context),
-        sandboxEnabled: Boolean(toolCtx.sandbox),
-        ...(toolCtx.sandbox
-            ? { sandboxRuntime: toolCtx.sandbox.runtimeName }
-            : {}),
-        checkpoints: Boolean(toolCtx.checkpointsActive),
-        ...(jobs
-            ? {
-                jobs: {
-                    total: jobs.length,
-                    running: jobs.filter((j) => j.status === "running").length,
-                    needingApproval: jobs.filter((j) => j.pendingApproval).length,
-                },
-            }
-            : {}),
-        tools: toolCount(ctx),
-    }, out.theme)) {
+    // A SYNCHRONOUS probe, and the one caller allowed one. The paint path's rule
+    // (never spawn during compose) is about frames; a user who just typed
+    // `/status` has no frame budget to blow, and an answer that says "checking…"
+    // for a fact this could have fetched would be worse than the 45ms.
+    //
+    // Everything else comes from the shared builder, so this and the Overview
+    // view cannot drift: they differ in exactly this argument and nowhere else.
+    const status = buildSessionStatus(session, (absPath) => getGitInfo(absPath));
+    for (const line of sessionStatusLines(status, out.theme)) {
         out.print(out.fit(line));
     }
 }
-/** Tools advertised to the model this session — the registry the loop dispatches against. */
-function toolCount(ctx) {
-    return ctx.session.toolRegistry.list().length;
-}
 /**
  * `/diff` (P6 track 4) — what has changed on disk, without leaving the session.
  *

package/dist/components/keys.js

@@ -3,6 +3,7 @@
  * transformation — no terminal, no state — so every mapping row is directly
  * unit-testable. The stateful raw-mode plumbing lives in `input.ts`.
  */
+const CTRL_B = 0x02;
 const CTRL_C = 0x03;
 const CTRL_D = 0x04;
 const CTRL_K = 0x0b;
@@ -18,6 +19,18 @@ const DELETE = 0x7f;
  * unlike the arrows it is safe to accept with OR without parameters.
  */
 const CBT = 0x5a;
+/**
+ * CSI final byte `~` — the "tilde sequence" family, where the NUMERIC PARAMETER
+ * carries the identity (`5` = Page Up, `6` = Page Down) rather than the final
+ * byte. That inverts the arrow rule below: for `~` the parameter must be read,
+ * not rejected, so these are matched on the leading number instead.
+ */
+const TILDE = 0x7e;
+/** Leading `~`-sequence parameter → key. `ESC [ 5 ~` / `ESC [ 6 ~`. */
+const TILDES = {
+    5: "page-up",
+    6: "page-down",
+};
 /** CSI final byte → arrow key, for `ESC [ <final>` sequences. */
 const ARROWS = {
     0x41: "up", // A
@@ -61,6 +74,26 @@ export function decodeKeys(chunk) {
                         i = j + 1;
                         continue;
                     }
+                    if (buf[j] === TILDE) {
+                        // `ESC [ <n> ~`. The number is the key, so it is read rather than
+                        // rejected — the opposite of the arrow rule below, and for the same
+                        // underlying reason: match on whatever byte actually carries the
+                        // identity. A modifier (`ESC [ 5 ; 2 ~`) still means Page Up, so
+                        // only the parameter BEFORE the first `;` is parsed; an unmapped
+                        // number (`3` = Delete) falls through and is swallowed like any
+                        // other unbound sequence.
+                        let n = 0;
+                        let digits = 0;
+                        for (let k = i + 2; k < j && buf[k] >= 0x30 && buf[k] <= 0x39; k++) {
+                            n = n * 10 + (buf[k] - 0x30);
+                            digits++;
+                        }
+                        const tilde = digits > 0 ? TILDES[n] : undefined;
+                        if (tilde)
+                            keys.push({ kind: tilde });
+                        i = j + 1;
+                        continue;
+                    }
                     // Only a bare `ESC [ <final>` maps to an arrow; parameterized
                     // sequences (modifier arrows, Home/End variants) are swallowed —
                     // an unmapped combo must do nothing, not act as a plain arrow.
@@ -79,6 +112,11 @@ export function decodeKeys(chunk) {
             i++;
             continue;
         }
+        if (byte === CTRL_B) {
+            keys.push({ kind: "ctrl-b" });
+            i++;
+            continue;
+        }
         if (byte === CTRL_C) {
             keys.push({ kind: "ctrl-c" });
             i++;

package/dist/config/effective.js

@@ -0,0 +1,225 @@
+import { ENV_OVERRIDES, } from "./manager.js";
+/** What a redacted scalar renders as. A marker, never a length-preserving mask
+ * — a mask that matched the length would leak the length. */
+export const REDACTED = "<redacted>";
+/** Layers in precedence order (last wins), paired with the origin they name. */
+function layerOrder(layers) {
+    return [
+        ["global", layers.global],
+        ["project", layers.project],
+        ["explicit", layers.explicit],
+        ["env", layers.env],
+    ];
+}
+function isPlainObject(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/**
+ * Whether `layer` explicitly sets `path`.
+ *
+ * Presence, not definedness: `in` rather than `!== undefined`, because a key
+ * written as `null` was still written, and reporting it as "default" would
+ * point someone at the schema for a value their file is responsible for.
+ */
+function hasPath(layer, path) {
+    if (layer === null)
+        return false;
+    let cursor = layer;
+    for (const key of path.split(".")) {
+        if (!isPlainObject(cursor) || !(key in cursor))
+            return false;
+        cursor = cursor[key];
+    }
+    return true;
+}
+/** The highest-precedence layer that set `path`, or `default` if none did. */
+function originOf(layers, path) {
+    let found = "default";
+    for (const [origin, layer] of layerOrder(layers)) {
+        if (hasPath(layer, path))
+            found = origin;
+    }
+    return found;
+}
+/**
+ * Paths whose value NAMES a secret rather than being one — checked before the
+ * name heuristic below, which would otherwise redact both of them.
+ *
+ * This distinction is the whole point of these two fields: `credentialRef` and
+ * `apiKeyEnv` exist so that a config file can say WHERE the secret comes from
+ * without containing it, and redacting them would hide the answer to "which
+ * credential is this server using" while protecting nothing.
+ */
+const SECRET_REFERENCE_PATHS = [
+    /^mcp\.servers\.[^.]+\.credentialRef$/,
+    /^web\.apiKeyEnv$/,
+];
+/**
+ * Paths that carry a live secret, structurally.
+ *
+ * `mcp.servers.<id>.headers.<name>` is the obvious one — the schema calls a live
+ * header value a secret in so many words, and only accepts it from user-scope
+ * config for that reason. `env` is the same class by a different route: it is
+ * how a stdio server is handed its token (`GITHUB_TOKEN`, `…_API_KEY`), and the
+ * fact that it is spelled as an environment variable rather than a header
+ * changes nothing about what is in it.
+ */
+const SECRET_VALUE_PATHS = [
+    /^mcp\.servers\.[^.]+\.headers\.[^.]+$/,
+    /^mcp\.servers\.[^.]+\.env\.[^.]+$/,
+];
+/**
+ * Backstop for keys that do not exist yet.
+ *
+ * The structural rules above enumerate today's secret-carrying paths, and an
+ * enumeration is exactly the kind of thing a later schema addition forgets to
+ * update — at which point a new key holding a credential renders in full on a
+ * pane someone is screen-sharing. So the leaf NAME is also checked, and the
+ * failure mode is inverted: a new secret is redacted by default, and a false
+ * positive costs one line of a read-only pane (the value is still readable
+ * with `cruxy config get`).
+ *
+ * `token` is NOT in this list, and that omission is the whole reason the rule
+ * needs stating carefully. In this schema "token" almost always means an LLM
+ * token: `context.maxTokens`, `memory.maxRecallTokens`,
+ * `agent.maxTokensPerTurn`, `index.search.tokenBudget`. A heuristic that
+ * matched it would blank out a dozen of the most-consulted numbers in the
+ * product to protect nothing — a redaction that hides only ordinary values
+ * teaches the reader that `<redacted>` means "noise", which is exactly how a
+ * real one gets skimmed past. {@link isSecretPath} catches the credential-ish
+ * senses of the word through the value type instead: a token COUNT is a
+ * number, a bearer token is a string.
+ */
+const SECRET_NAME = /(secret|password|passwd|apikey|api_key|credential)/i;
+/** Names that are secret-shaped only when they carry a string. */
+const SECRET_NAME_IF_STRING = /(token|bearer)/i;
+/** Whether this leaf's value must never be printed. */
+function isSecretPath(path, value) {
+    if (SECRET_REFERENCE_PATHS.some((re) => re.test(path)))
+        return false;
+    if (SECRET_VALUE_PATHS.some((re) => re.test(path)))
+        return true;
+    const leaf = path.split(".").pop() ?? "";
+    if (SECRET_NAME.test(leaf))
+        return true;
+    return typeof value === "string" && SECRET_NAME_IF_STRING.test(leaf);
+}
+/**
+ * A URL with its credential-carrying parts removed: userinfo (`user:pass@`) and
+ * the query string, which is where a remote MCP endpoint's token most often
+ * rides (`?token=…`). The origin and path survive, because WHICH server this is
+ * remains the useful part and it is not the sensitive one.
+ *
+ * Returns null when nothing had to be removed, so an ordinary URL is not
+ * flagged as redacted.
+ */
+function redactUrl(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        // Not parseable as a URL — the schema rejects those, but this module is
+        // also handed layers that never reached the schema. Leave it alone rather
+        // than guess at its structure.
+        return null;
+    }
+    const hadUserinfo = url.username !== "" || url.password !== "";
+    const hadQuery = url.search !== "";
+    if (!hadUserinfo && !hadQuery)
+        return null;
+    url.username = "";
+    url.password = "";
+    if (hadQuery)
+        url.search = "";
+    let out = url.toString();
+    // Both removals are MARKED rather than silent: a URL that quietly lost its
+    // query reads as the whole address, and someone debugging why a server 401s
+    // would be looking at a string their config does not contain.
+    if (hadQuery)
+        out += `?${REDACTED}`;
+    if (hadUserinfo)
+        out = out.replace("://", `://${REDACTED}@`);
+    return out;
+}
+/** One leaf's display value, with any secret removed. */
+function redact(path, value) {
+    if (isSecretPath(path, value))
+        return { value: REDACTED, redacted: true };
+    if (typeof value === "string" && /^https?:\/\//i.test(value)) {
+        const stripped = redactUrl(value);
+        if (stripped !== null)
+            return { value: stripped, redacted: true };
+    }
+    return { value, redacted: false };
+}
+/**
+ * Depth-first walk to the leaves.
+ *
+ * A leaf is anything that is not a plain object — INCLUDING an array (the merge
+ * replaces arrays wholesale, so an array is one decision, not many) and an
+ * empty object, which is a real answer: `routing.map: {}` is what "routing is
+ * configured but inert" looks like, and a walk that recursed into it would emit
+ * nothing and leave the key looking unset.
+ *
+ * The walk is over the RESOLVED config, so what it yields is exactly the keys
+ * that have an effective value. A schema key that is optional with no default
+ * (`shell.executable`, `git.defaultBase`, `test.command`) therefore has no row
+ * while it is unset — there is no value to attribute and no layer to blame.
+ * The moment any layer sets one it appears, correctly attributed, because JSON
+ * cannot express `undefined`: a key present in a file is present in the merge.
+ * Enumerating the schema's unset knobs is a job for documentation and
+ * `cruxy config set`, not for a pane whose subject is what is in effect.
+ */
+function walk(value, prefix, out) {
+    if (isPlainObject(value) && Object.keys(value).length > 0) {
+        for (const [key, child] of Object.entries(value)) {
+            walk(child, prefix === "" ? key : `${prefix}.${key}`, out);
+        }
+        return;
+    }
+    out.push({ path: prefix, value });
+}
+/**
+ * Every effective setting, in schema order, with its origin and nothing secret.
+ *
+ * Schema order rather than alphabetical or overrides-first: this is read by
+ * scanning, and a list that reorders itself as values change moves the row
+ * being read out from under the reader — the same reason the Tasks view keeps
+ * dispatch order.
+ */
+export function effectiveSettings(loaded) {
+    const leaves = [];
+    walk(loaded.config, "", leaves);
+    return leaves.map(({ path, value }) => {
+        const { value: shown, redacted } = redact(path, value);
+        return {
+            path,
+            value: shown,
+            redacted,
+            origin: originOf(loaded.layers, path),
+        };
+    });
+}
+/**
+ * Which environment variables are contributing to this result, by name. Read
+ * off the layer this load actually built, through the one {@link ENV_OVERRIDES}
+ * table — never `process.env`, so what is named is what was USED (a variable
+ * exported after startup is not in effect, and must not be listed as if it is).
+ */
+export function envOverrideNames(loaded) {
+    return ENV_OVERRIDES.filter(({ path }) => hasPath(loaded.layers.env, path)).map(({ envVar }) => envVar);
+}
+/** The file a given origin was read from, when it has one. */
+export function originFile(loaded, origin) {
+    switch (origin) {
+        case "global":
+            return loaded.sources.global;
+        case "project":
+            return loaded.sources.project;
+        case "explicit":
+            return loaded.sources.explicit;
+        default:
+            return null;
+    }
+}

package/dist/config/index.js

@@ -1,5 +1,6 @@
 export * from "./schema.js";
 export * from "./paths.js";
 export * from "./manager.js";
+export * from "./effective.js";
 export * from "./project.js";
 export * from "./credentials.js";

package/dist/config/manager.js

@@ -59,18 +59,35 @@ function rejectProjectScopeHeaders(obj, file) {
         }
     }
 }
+/**
+ * Which environment variable overrides which config path — a TABLE rather than
+ * a run of `if`s, because two surfaces need it read in opposite directions:
+ * this file turns variables into a layer, and the settings view turns a layer
+ * back into "which variable is doing this". A second hand-written copy of the
+ * mapping would drift on the first variable added, and the copy that drifts is
+ * the one telling the user where the value came from.
+ */
+export const ENV_OVERRIDES = [
+    { envVar: "CRUXY_MODEL", path: "model.model" },
+    { envVar: "CRUXY_PROVIDER", path: "model.provider" },
+    { envVar: "CRUXY_LOG_LEVEL", path: "logLevel" },
+];
 /** Overrides sourced from environment variables. */
 function envOverrides() {
     const out = {};
-    const model = {};
-    if (process.env.CRUXY_MODEL)
-        model.model = process.env.CRUXY_MODEL;
-    if (process.env.CRUXY_PROVIDER)
-        model.provider = process.env.CRUXY_PROVIDER;
-    if (Object.keys(model).length)
-        out.model = model;
-    if (process.env.CRUXY_LOG_LEVEL)
-        out.logLevel = process.env.CRUXY_LOG_LEVEL;
+    for (const { envVar, path } of ENV_OVERRIDES) {
+        const value = process.env[envVar];
+        if (!value)
+            continue;
+        const keys = path.split(".");
+        let cursor = out;
+        for (const key of keys.slice(0, -1)) {
+            if (!isPlainObject(cursor[key]))
+                cursor[key] = {};
+            cursor = cursor[key];
+        }
+        cursor[keys[keys.length - 1]] = value;
+    }
     return out;
 }
 /**
@@ -83,15 +100,23 @@ export function loadConfig(opts = {}) {
         project: null,
         explicit: null,
     };
+    const layers = {
+        global: null,
+        project: null,
+        explicit: null,
+        env: {},
+    };
     let merged = {};
     const gPath = globalConfigPath();
     if (existsSync(gPath)) {
-        merged = deepMerge(merged, readJsonFile(gPath));
+        layers.global = readJsonFile(gPath);
+        merged = deepMerge(merged, layers.global);
         sources.global = gPath;
     }
     if (opts.configPath) {
         const obj = readJsonFile(opts.configPath);
         rejectProjectScopeHeaders(obj, opts.configPath);
+        layers.explicit = obj;
         merged = deepMerge(merged, obj);
         sources.explicit = opts.configPath;
     }
@@ -100,11 +125,13 @@ export function loadConfig(opts = {}) {
         if (pPath) {
             const obj = readJsonFile(pPath);
             rejectProjectScopeHeaders(obj, pPath);
+            layers.project = obj;
             merged = deepMerge(merged, obj);
             sources.project = pPath;
         }
     }
-    merged = deepMerge(merged, envOverrides());
+    layers.env = envOverrides();
+    merged = deepMerge(merged, layers.env);
     const result = CruxyConfigSchema.safeParse(merged);
     if (!result.success) {
         const issues = result.error.issues
@@ -112,7 +139,7 @@ export function loadConfig(opts = {}) {
             .join("\n");
         throw configInvalid(issues, sources.project ?? sources.global ?? undefined);
     }
-    return { config: result.data, sources };
+    return { config: result.data, sources, layers };
 }
 /** Resolve a dot-path (e.g. "model.temperature") against a config object. */
 export function getPath(obj, path) {
@@ -176,12 +203,15 @@ export function resolveApiKey(provider) {
 }
 /** The API key from the environment for `provider`, or `undefined`. */
 function envApiKey(provider) {
-    switch (provider) {
-        case "cruxy":
-            return process.env.CRUXY_API_KEY;
-        case "openai":
-            return process.env.OPENAI_API_KEY;
-        default:
-            return process.env.CRUXY_API_KEY;
-    }
+    return process.env[apiKeyEnvVar(provider)];
+}
+/**
+ * The environment variable a provider's API key is read from — the NAME only,
+ * never the value, so a surface can say where a key would come from without
+ * ever holding one. Exported so nothing has to restate this mapping: a second
+ * copy would drift the moment a provider is added, and the copy that drifts is
+ * always the one telling the user where to put their key.
+ */
+export function apiKeyEnvVar(provider) {
+    return provider === "openai" ? "OPENAI_API_KEY" : "CRUXY_API_KEY";
 }

package/dist/render/diff.js

@@ -99,7 +99,13 @@ export function previewStats(preview) {
     }
     return [];
 }
-/** `+12/-3`, `~+1/-1`, `+8` — omitting a side the preview cannot count. */
+/**
+ * `+12/-3`, `~+1/-1`, `+8` — omitting a side the preview cannot count.
+ *
+ * Takes only the three fields it reads rather than a whole {@link DiffFileStat},
+ * so P7's git-status changes render through this same formatter instead of a
+ * second one that would eventually disagree with it about what `null` means.
+ */
 export function formatStat(stat, c) {
     const parts = [];
     if (stat.added !== null && stat.added > 0)

package/dist/render/status-view.js

@@ -50,12 +50,12 @@ export function sessionStatusLines(status, t, width = Infinity) {
     lines.push(t.strong(status.roots.length === 1 ? "root" : "roots"));
     for (const r of status.roots) {
         const mark = r.primary ? t.accent(t.glyph.pointer) : " ";
-        const git = r.branch === undefined
-            ? t.muted("not a git repo")
-            : `${t.strong(r.branch)} ${r.changed === undefined
-                ? ""
-                : r.changed > 0
-                    ? t.warning(`${r.changed} changed`)
+        const git = r.git === undefined
+            ? t.muted(`checking${t.glyph.ellipsis}`)
+            : r.git === null
+                ? t.muted("not a git repo")
+                : `${t.strong(r.git.branch)} ${r.git.changed > 0
+                    ? t.warning(`${r.git.changed} changed`)
                     : t.success("clean")}`;
         lines.push(`${mark} ${r.name.padEnd(12)} ${git}`);
         lines.push(`  ${t.muted(r.path)}`);