@cruxy/cli 1.4.0 → 1.5.0

package/dist/onboarding/detect.js

@@ -1,36 +1,122 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from "node:fs";
 import { dirname, join } from "node:path";
 import { ONBOARDING_FILE_NAME } from "../constants.js";
 import { globalDir, resolveApiKey } from "../config/index.js";
+import { ONBOARDING_VERSION, OnboardingStateSchema, } from "./types.js";
 /**
  * First-run detection + onboarding-state persistence (U.6). "First run" is
  * deliberately derived from observable facts (no key + no completion marker)
  * rather than a flag, and is **TTY-gated** so a non-interactive run never
  * branches into an interactive flow.
  */
-const ONBOARDING_VERSION = 1;
 /** `~/.cruxy/onboarding.json` */
 export function onboardingStatePath() {
     return join(globalDir(), ONBOARDING_FILE_NAME);
 }
-/** Read persisted onboarding state, or `null` if absent/unreadable. */
+/**
+ * Read persisted onboarding state, or `null` if absent, unreadable, or not the
+ * shape this file is supposed to hold.
+ *
+ * VALIDATED, not cast. `as OnboardingState` accepted any object at all, so a
+ * truncated write or a hand-edit could hand the flow a `completedAt` that was a
+ * number — and the completion marker is the one fact that decides whether a
+ * user is walked through setup again or silently isn't.
+ *
+ * An invalid file reads as ABSENT rather than throwing, which is the same
+ * treatment corrupt JSON already got: the worst outcome of re-onboarding is one
+ * extra prompt, and the worst outcome of a hard error is a CLI that won't start
+ * because of a file that only exists to say "you've done this before".
+ */
 export function readOnboardingState(file = onboardingStatePath()) {
     if (!existsSync(file))
         return null;
+    let parsed;
     try {
-        const parsed = JSON.parse(readFileSync(file, "utf8"));
-        if (parsed && typeof parsed === "object")
-            return parsed;
+        parsed = JSON.parse(readFileSync(file, "utf8"));
     }
     catch {
         // A corrupt marker is treated as absent — onboarding can rewrite it.
+        return null;
     }
-    return null;
+    const result = OnboardingStateSchema.safeParse(parsed);
+    return result.success ? migrateState(result.data) : null;
+}
+/**
+ * The version branch the file has been writing a number for since U.6 and
+ * nothing has ever read.
+ *
+ * OLDER than this build: bring it forward. There is exactly one version today,
+ * so this is a re-stamp and nothing else — the point is that the next bump has
+ * one obvious place to add its step, instead of discovering at that moment that
+ * every reader assumed v1.
+ *
+ * NEWER than this build: return it untouched and keep trusting `completedAt`.
+ * Both alternatives are worse. Discarding it re-runs onboarding for someone who
+ * has plainly finished it, every time they use the older binary — running two
+ * cruxy versions against one home directory is ordinary, and being re-prompted
+ * for a key you already saved is not a reasonable punishment for it. Rewriting
+ * it down to our shape would destroy state we don't understand. `completedAt`
+ * is the marker in every version that has one; reading it across a version we
+ * don't know is a smaller assumption than either.
+ */
+function migrateState(state) {
+    if (state.version >= ONBOARDING_VERSION)
+        return state;
+    return { ...state, version: ONBOARDING_VERSION };
 }
-/** Persist onboarding state (creates `~/.cruxy` if needed). */
+/**
+ * Persist onboarding state (creates `~/.cruxy` if needed), owner-only.
+ *
+ * MERGED over what is on disk, not written over it. The schema passes unknown
+ * keys through, so a field a newer cruxy wrote survives a run of an older one
+ * — tolerating it on read and then flattening it on the next write would lose
+ * the data anyway, just one write later.
+ *
+ * The version is the MAX of the two for the same reason `migrateState` doesn't
+ * discard a future file: this build preserved the newer keys, so stamping our
+ * own lower number over them would tell the newer cruxy that its migration
+ * hasn't run when its data is in fact all still there.
+ */
 export function writeOnboardingState(state, file = onboardingStatePath()) {
+    const existing = readOnboardingState(file);
+    const merged = {
+        ...existing,
+        ...state,
+        version: Math.max(existing?.version ?? 0, state.version),
+    };
     mkdirSync(dirname(file), { recursive: true });
-    writeFileSync(file, JSON.stringify(state, null, 2) + "\n", "utf8");
+    writeFileSync(file, JSON.stringify(merged, null, 2) + "\n", {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    restrictToOwner(file);
+}
+/**
+ * Make the marker owner-only. It was the one store under `~/.cruxy` still at
+ * `0644` — usage, memory trust, MCP trust and hook trust are all `0600` — and
+ * while it holds no secret, it does record that this machine's user has a cruxy
+ * key configured and when they set it up. That is nobody else's business on a
+ * shared box, and "every file cruxy writes to your home directory is yours
+ * alone" is a rule worth being able to state without an exception.
+ *
+ * The `mode` on the write above only applies when the file is CREATED, so it
+ * does nothing for the `0644` files already out there; this fixes those on the
+ * next write. Best-effort and non-fatal, deliberately: unlike the credential
+ * store — which refuses to persist a secret it cannot secure — refusing to
+ * write this one would mean re-running onboarding forever on a filesystem
+ * without modes. Windows is skipped because POSIX modes are meaningless there
+ * (see `config/owner-only.ts`), and an `icacls` edit is more than a marker
+ * warrants.
+ */
+function restrictToOwner(file) {
+    if (process.platform === "win32")
+        return;
+    try {
+        chmodSync(file, 0o600);
+    }
+    catch {
+        // A filesystem that can't do modes still gets a working marker.
+    }
 }
 /** A fresh state object. */
 export function newOnboardingState() {

package/dist/onboarding/types.js

@@ -1,6 +1,34 @@
+import { z } from "zod";
 /**
  * Types for the first-run onboarding flow (U.6). The flow is built from injected
  * dependencies (validation, persistence, the first-win runner) so every step is
  * unit-testable with scripted IO and no real network or filesystem.
  */
-export {};
+/**
+ * Bump when the on-disk onboarding state shape changes. The number is only
+ * worth writing if something READS it — see `migrateState` in `detect.ts`,
+ * which is where the branch it enables lives.
+ */
+export const ONBOARDING_VERSION = 1;
+/**
+ * The persisted state (`~/.cruxy/onboarding.json`), as a schema rather than a
+ * cast. It was read with `as OnboardingState` — a cast validates nothing, so
+ * `{"completedAt": 42}` or a JSON array parsed clean and the completion marker
+ * became whatever the file happened to contain.
+ *
+ * `.passthrough()`, for the reason `usage/types.ts` sets out at length: a read
+ * that can't validate is a read that discards, and a store hostile to its own
+ * future silently drops what a newer cruxy wrote the moment an older one runs
+ * against the same home directory. Passthrough both TOLERATES an unknown key
+ * and PRESERVES it, so `writeOnboardingState`'s merge hands it back intact.
+ */
+export const OnboardingStateSchema = z
+    .object({
+    /** Shape version — see {@link ONBOARDING_VERSION}. */
+    version: z.number().int().nonnegative(),
+    /** ISO timestamp; **its presence is the completion marker**. */
+    completedAt: z.string().min(1).optional(),
+    /** Whether a key has been successfully configured at least once. */
+    keyConfigured: z.boolean().optional(),
+})
+    .passthrough();

package/dist/render/status-view.js

@@ -1,9 +1,55 @@
+import { capacityLevel, formatCapacity, } from "../utils/disk.js";
 import { fit } from "./layout.js";
 import { formatTokens } from "./state.js";
 /** `key  value`, aligned on a fixed gutter so the column is scannable. */
 function row(key, value, t) {
     return `  ${t.muted(key.padEnd(11))} ${value}`;
 }
+/**
+ * Collapse locations that report identical figures into one row, naming all of
+ * them.
+ *
+ * A project under `~` and `~/.cruxy` are usually the same filesystem, and two
+ * rows saying `54% free · 251 GiB of 465 GiB` twice is noise dressed as detail.
+ * Grouping is on the RENDERED numbers rather than on mount identity because
+ * `statfs` gives no filesystem id to compare — and grouping on the numbers is
+ * the honest test anyway: if two locations report the same total and the same
+ * free bytes, either they are one filesystem or they are two the reader has no
+ * way to tell apart, and in both cases one row is the whole of what's known.
+ */
+function groupLocations(locations) {
+    const groups = new Map();
+    for (const loc of locations) {
+        const key = `${loc.capacity.totalBytes}:${loc.capacity.freeBytes}`;
+        const existing = groups.get(key);
+        if (existing)
+            existing.labels.push(loc.label);
+        else
+            groups.set(key, { labels: [loc.label], capacity: loc.capacity });
+    }
+    return [...groups.values()];
+}
+/**
+ * The disk rows: `disk  cli, ~/.cruxy  54% free · 251 GiB of 465 GiB`.
+ *
+ * Coloured by {@link capacityLevel}, which judges absolute bytes — so a nearly
+ * full 4 TB disk with plenty left in it is not dressed up as an emergency, and
+ * a small VM disk with 800 MB left is, whatever percentage that happens to be.
+ * Only the first row carries the key; the rest align under it, because a `disk`
+ * label repeated down the column reads as several different facts.
+ */
+function diskLines(locations, t) {
+    return groupLocations(locations).map((group, i) => {
+        const text = formatCapacity(group.capacity);
+        const level = capacityLevel(group.capacity);
+        const value = level === "critical"
+            ? t.danger(text)
+            : level === "low"
+                ? t.warning(text)
+                : t.muted(text);
+        return row(i === 0 ? "disk" : "", `${group.labels.join(", ")}  ${value}`, t);
+    });
+}
 /** The full `/status` block as lines to print. */
 export function sessionStatusLines(status, t, width = Infinity) {
     const lines = [t.heading("status")];
@@ -33,6 +79,12 @@ export function sessionStatusLines(status, t, width = Infinity) {
     lines.push(row("checkpoints", status.checkpoints
         ? t.muted("on — `cruxy rollback` can undo a run's file changes")
         : t.warning("off — file changes are not restorable"), t));
+    // Next to checkpoints, the feature that turns a turn into a shadow copy of
+    // the tree: the two rows answer one question between them — will this
+    // session's writes land.
+    if (status.disk && status.disk.length > 0) {
+        lines.push(...diskLines(status.disk, t));
+    }
     if (status.jobs) {
         const { total, running, needingApproval } = status.jobs;
         const detail = total === 0

package/dist/theme/tokens.js

@@ -22,6 +22,8 @@ export const UNICODE_GLYPHS = {
     caretDown: "↓",
     cached: "↻",
     cursorBar: "▏",
+    barFilled: "█",
+    barEmpty: "░",
     bullet: "•",
     sep: "·",
     ellipsis: "…",
@@ -45,6 +47,8 @@ export const ASCII_GLYPHS = {
     caretDown: "v",
     cached: "",
     cursorBar: "|",
+    barFilled: "#",
+    barEmpty: ".",
     bullet: "*",
     sep: "-",
     ellipsis: "...",
@@ -72,6 +76,9 @@ export const SCREEN_READER_GLYPHS = {
     caretDown: "down",
     cached: "",
     cursorBar: "",
+    // A bar announces as nothing; the percentage beside it says everything.
+    barFilled: "",
+    barEmpty: "",
     bullet: "-",
     sep: "-",
     ellipsis: "...",

package/dist/tui/disk-status.js

@@ -0,0 +1,47 @@
+import { readDiskCapacity } from "../utils/disk.js";
+export class WorkspaceDiskCache {
+    paths;
+    probe;
+    values = new Map();
+    /** The refresh in flight, so concurrent triggers share one pass. */
+    inFlight = null;
+    constructor(paths, probe = readDiskCapacity) {
+        // Deduplicated: the same path twice would be the same syscall twice for the
+        // same answer. Two DIFFERENT paths on one filesystem are NOT collapsed here
+        // — that is a question about the numbers, and it is answered where they are
+        // rendered (see `status-view.ts`), not by guessing at mount identity.
+        this.paths = [...new Set(paths)];
+        this.probe = probe;
+    }
+    /**
+     * The last known capacity for one path — a map read, safe from the paint
+     * path. `undefined` means not probed yet, probed and unreadable, or a path
+     * this cache was never given; every one of those renders as nothing, so they
+     * do not need telling apart the way the git tri-state does.
+     */
+    current(path) {
+        return this.values.get(path);
+    }
+    /** Re-probe every path, concurrently, and resolve when all have settled. */
+    async refresh() {
+        if (this.inFlight)
+            return this.inFlight;
+        this.inFlight = this.run();
+        try {
+            await this.inFlight;
+        }
+        finally {
+            this.inFlight = null;
+        }
+    }
+    async run() {
+        await Promise.all(this.paths.map(async (path) => {
+            const value = await this.probe(path);
+            // A failed probe keeps the last good reading rather than blanking the
+            // row. A transient failure is not evidence that the disk changed, and a
+            // figure that flickers in and out is read as a bug in the tool.
+            if (value)
+                this.values.set(path, value);
+        }));
+    }
+}

package/dist/tui/index.js

@@ -3,6 +3,7 @@ export { COLUMN_LABELS, PANEL_LABELS, contextPanelLines, gitPanelLines, headerMo
 export { ContextGauge, readContext, } from "./context-gauge.js";
 export { ToolVersions, parseVersion, } from "./tool-versions.js";
 export { GitStatusCache, WorkspaceGitCache, } from "./git-status.js";
+export { WorkspaceDiskCache } from "./disk-status.js";
 export { createOverviewView } from "./overview.js";
 export { createGitView, gitViewLines, GIT_VIEW_MAX_FILES, } from "./git-view.js";
 export { createTasksView, tasksViewLines, TASKS_VIEW_MAX_JOBS, TASKS_VIEW_TAIL, } from "./tasks-view.js";

package/dist/tui/layout.js

@@ -1,6 +1,7 @@
 import { fit, visibleWidth } from "../render/layout.js";
 export const RAIL_PANELS = [
     "context",
+    "limits",
     "model",
     "git",
     "tools",

package/dist/tui/limits-panel.js

@@ -0,0 +1,255 @@
+import { bindingWindow, usedFraction } from "../limits/index.js";
+/**
+ * The limits panel (P9): what this credential may spend, and how much is left.
+ *
+ * THE PANEL IS DRIVEN BY THE BUCKET, NEVER BY THE LOGIN. Which numbers exist —
+ * and whether a fraction exists at all — is decided by the billing bucket the
+ * gateway reports, because that is the only thing that actually decides it. The
+ * inference this replaces (a CLI login is an apikey, so it is metered and
+ * ungated) was true when it was written and silently stopped being true when the
+ * gateway changed what a login mints (cruxy-ai/api#174), with nothing locally
+ * observable changing. So there are four bodies here, one per shape, and the
+ * type system hands each of them only the numbers that shape may state.
+ *
+ * AND THIS ONE GETS A BAR. The context panel refuses one under a locking test,
+ * for reasons that are exactly right there: its numerator is a chars/4 estimate
+ * and its denominator a local config default, so a filled bar would render a
+ * guess as a measurement. Every number here is the opposite — server-authored,
+ * in the meter's own unit, peeked from the same buckets the gate enforces on, so
+ * the fraction the bar fills IS the fraction the next request is judged against.
+ * A bar is the right claim for a real measurement, and only for one.
+ *
+ * The corollary is the rule the rest of this file exists to keep: NO CAP, NO
+ * FRACTION. An enterprise pool reports `{enforced: false}` and a developer key
+ * reports `metered: true`; neither has an allowance, so neither gets a bar, a
+ * percentage, or an X-of-Y — not even a reassuring full one. Spend caps are not
+ * a substitute, because they appear only when someone set one.
+ */
+/** Cells in the bar. Sized so `bar + " " + "100%"` clears {@link RAIL_COLS}. */
+const BAR_CELLS = 12;
+/**
+ * A proportion bar. Empty under the screen-reader glyph table (both cells are
+ * ""), which is deliberate — a run of blocks announces as nothing, and the
+ * percentage that follows it carries the entire meaning.
+ */
+export function bar(theme, fraction, cells = BAR_CELLS) {
+    const filled = Math.round(Math.min(1, Math.max(0, fraction)) * cells);
+    return (theme.glyph.barFilled.repeat(filled) +
+        theme.glyph.barEmpty.repeat(cells - filled));
+}
+/**
+ * The styler for a window's state. `low` and `blocked` are the two the user can
+ * act on, and they are different acts — one is "wrap up", the other is "you are
+ * already being refused" — so they are not merged into one warning.
+ */
+function stateStyle(theme, state) {
+    if (state === "blocked")
+        return theme.danger;
+    if (state === "low")
+        return theme.warning;
+    return theme.strong;
+}
+/** 14_000_000 → "14M", 8_700_000 → "8.7M", 125_000 → "125k", 900 → "900". */
+export function compactTokens(n) {
+    const abs = Math.abs(n);
+    if (abs >= 1_000_000)
+        return `${trimZero(n / 1_000_000)}M`;
+    if (abs >= 1_000)
+        return `${trimZero(n / 1_000)}k`;
+    return `${Math.round(n)}`;
+}
+/** One decimal, but only when it says something: 8.7 stays, 14.0 becomes 14. */
+function trimZero(n) {
+    const one = n.toFixed(1);
+    return one.endsWith(".0") ? one.slice(0, -2) : one;
+}
+/** 27.77 → "$27.77", 29 → "$29", 0.5 → "$0.50". */
+export function usd(n) {
+    return Number.isInteger(n) ? `$${n}` : `$${n.toFixed(2)}`;
+}
+/**
+ * How long until an ISO instant, compactly: "18d", "4h", "12m", "now".
+ * `undefined` for an absent or unparseable one — a reset we cannot state is
+ * simply not stated, never guessed at.
+ */
+export function untilLabel(iso, now) {
+    if (!iso)
+        return undefined;
+    const at = Date.parse(iso);
+    if (Number.isNaN(at))
+        return undefined;
+    const ms = at - now;
+    if (ms <= 0)
+        return "now";
+    const minutes = Math.floor(ms / 60_000);
+    if (minutes < 60)
+        return `${Math.max(1, minutes)}m`;
+    const hours = Math.floor(minutes / 60);
+    if (hours < 24)
+        return `${hours}h`;
+    return `${Math.floor(hours / 24)}d`;
+}
+/** A percentage for display: 0.618 → "62%". */
+function pct(fraction) {
+    return `${Math.round(fraction * 100)}%`;
+}
+/**
+ * Beyond this, the reading is called out as old rather than presented as
+ * current. The pool is shared with every other surface on the account, so an
+ * idle CLI's figures can go stale without this process doing anything at all —
+ * which is precisely the case a timestamp has to cover.
+ */
+const STALE_AFTER_MS = 5 * 60_000;
+/**
+ * The subscription pool: a bar on the BINDING window, the same one the gate
+ * decides against.
+ *
+ * Drawing the month instead — the bigger, friendlier number — would routinely
+ * show a comfortable 6% while the trailing-12h burst, a quarter of the month's
+ * cap on every self-serve tier, is the window actually about to refuse the next
+ * request. The bar is the thing that stops you, and the line under it names
+ * which window that is so the figure is never ambiguous.
+ */
+function poolLines(theme, pool, now) {
+    const binding = bindingWindow(pool.monthly, pool.burst);
+    // Unreachable via `reduceLimits` (a pool with no readable window reduces to
+    // `unknown`), but the type permits it and inventing a bar is the one thing
+    // this panel must never do on the way to being defensive.
+    if (!binding)
+        return [theme.muted("figures not reported")];
+    const { window: w, name } = binding;
+    const fraction = usedFraction(w) ?? 0;
+    const style = stateStyle(theme, w.state ?? pool.state);
+    const lines = [
+        `${style(bar(theme, fraction))} ${style(pct(fraction))}`,
+        `${compactTokens(w.used)} / ${compactTokens(w.cap)} ${name}`,
+    ];
+    // The window that is NOT binding, so both dimensions are visible — a user
+    // whose burst is tight still needs to know the month is nearly gone too.
+    const other = name === "burst" ? pool.monthly : pool.burst;
+    const otherName = name === "burst" ? "month" : "burst";
+    const until = untilLabel(w.resetsAt, now);
+    if (other) {
+        const otherPct = pct(usedFraction(other) ?? 0);
+        lines.push(theme.muted(until
+            ? `${otherName} ${otherPct} ${theme.sep}${until}`
+            : `${otherName} ${otherPct}`));
+    }
+    else if (until) {
+        lines.push(theme.muted(`resets ${until}`));
+    }
+    // Only when it is actionable. A blocked model list is the answer to "why did
+    // that request fail"; mira's remaining requests are the answer to "what can I
+    // still run" — and neither question is being asked while the pool is healthy.
+    if (pool.blockedModels.length > 0) {
+        lines.push(theme.danger(`no ${pool.blockedModels.join(" ")}`));
+    }
+    else if (pool.state === "low" && pool.mira) {
+        lines.push(theme.muted(`mira ${compactTokens(pool.mira.remaining)} left`));
+    }
+    return lines;
+}
+/** A spend cap line. Text, never a bar: the bar belongs to the allowance. */
+function spendCapLine(theme, label, cap) {
+    return theme.muted(`${label} ${usd(cap.remaining)} of ${usd(cap.cap)}`);
+}
+/** How long ago, compactly: the mirror of {@link untilLabel}. */
+function agoLabel(ms) {
+    const minutes = Math.floor(ms / 60_000);
+    if (minutes < 60)
+        return `${Math.max(1, minutes)}m`;
+    const hours = Math.floor(minutes / 60);
+    return hours < 24 ? `${hours}h` : `${Math.floor(hours / 24)}d`;
+}
+/** The body for a ready reading, chosen by the budget shape. */
+function readingLines(theme, reading, now) {
+    const lines = [];
+    const budget = reading.budget;
+    switch (budget.kind) {
+        case "pool":
+            lines.push(...poolLines(theme, budget, now));
+            break;
+        // Enterprise. NO fraction, and no consolation bar drawn at 0% either: a full
+        // green bar and "no limit" are read the same way at a glance, and only one
+        // of them is true.
+        case "unenforced":
+            lines.push(theme.strong(reading.tier));
+            lines.push(theme.muted("pool not enforced"));
+            break;
+        // A developer key: billed per token, gated by nothing it draws down. Saying
+        // "no pool" explicitly matters here — an empty budget section would read as
+        // a figure that failed to load rather than as a figure that does not exist.
+        case "metered":
+            lines.push(`${theme.strong(reading.tier)}${theme.muted(" metered")}`);
+            lines.push(theme.muted("no pool cap"));
+            break;
+        case "credits": {
+            const fraction = budget.granted > 0
+                ? Math.min(1, Math.max(0, budget.used / budget.granted))
+                : undefined;
+            if (fraction !== undefined) {
+                const style = fraction >= 0.9 ? theme.warning : theme.strong;
+                lines.push(`${style(bar(theme, fraction))} ${style(pct(fraction))}`);
+            }
+            lines.push(`${usd(budget.remaining)} of ${usd(budget.granted)}`);
+            const until = untilLabel(budget.resetsAt, now);
+            if (until)
+                lines.push(theme.muted(`resets ${until}`));
+            break;
+        }
+        // The bucket, or the pool inside it, is one this build cannot read. Both
+        // facts it DOES have are real and server-resolved, so both are shown; what
+        // it does not have, it declines to imply.
+        case "unknown":
+            lines.push(`${theme.strong(reading.tier)}${theme.muted(` ${theme.glyph.sep} ${reading.bucket}`)}`);
+            lines.push(theme.muted("budget not reported"));
+            break;
+    }
+    // Rate and spend caps hang off every bucket, so they are appended once here
+    // rather than repeated per branch. They are the ONLY ceilings a metered key
+    // has — and they appear only when they exist, which is why they can never
+    // stand in for the pool a metered key does not have.
+    if (budget.kind === "metered" && reading.chat) {
+        const { remaining, limit } = reading.chat.perKey;
+        lines.push(theme.muted(`${remaining} / ${limit} rpm`));
+    }
+    if (reading.keySpendCap) {
+        lines.push(spendCapLine(theme, "key", reading.keySpendCap));
+    }
+    if (reading.workspaceSpendCap) {
+        lines.push(spendCapLine(theme, "ws", reading.workspaceSpendCap));
+    }
+    // The cache keeps the last good reading through a failed refresh, so the panel
+    // owes the user the age of what it is showing rather than the impression that
+    // it is live.
+    const age = now - reading.readAt;
+    if (age > STALE_AFTER_MS) {
+        lines.push(theme.muted(`as of ${agoLabel(age)} ago`));
+    }
+    return lines;
+}
+/**
+ * The limits panel's body.
+ *
+ * `pending` and each error reason are said differently, on the tri-state
+ * discipline the git panel established: "still asking" must not read as "no
+ * limits", and neither may read as "your key is bad".
+ */
+export function limitsPanelLines(theme, state, now = Date.now()) {
+    if (state === undefined || state.status === "pending") {
+        return [theme.muted(`checking${theme.glyph.ellipsis}`)];
+    }
+    if (state.status === "error") {
+        switch (state.reason) {
+            case "unauthenticated":
+                return [theme.muted("not signed in"), theme.muted("run cruxy login")];
+            case "unsupported":
+                // The gateway answered — it simply has no limits to report. Sending this
+                // user to debug their network would be the wrong errand entirely.
+                return [theme.muted("gateway reports"), theme.muted("no limits")];
+            case "unreachable":
+                return [theme.muted("gateway unreachable")];
+        }
+    }
+    return readingLines(theme, state.reading, now);
+}

package/dist/tui/overview.js

@@ -20,7 +20,8 @@ import { sessionStatusLines } from "../render/status-view.js";
  *    cost two subprocesses each, ~45ms warm and worse on Windows, and the pane
  *    repaints on every frame and every resize. {@link WorkspaceGitCache} does
  *    the probing after a turn; {@link lines} only ever reads the last settled
- *    value.
+ *    value. Free space joins them: microseconds on a local disk, and an
+ *    unbounded kernel block on a network mount that has stopped answering.
  *
  * The rule the split enforces: nothing in `lines` may spawn, block, or touch
  * the disk. Anything that needs to is a cache read here and a `refresh` there.
@@ -31,19 +32,30 @@ export function createOverviewView(session, git,
  * because it changes per turn and the view is registered once. Supplied by
  * the renderer, the only object that sees the stream's routing frame.
  */
-servedTier = () => undefined) {
+servedTier = () => undefined, 
+/**
+ * Free space where cruxy writes. Optional so a caller that has no disk cache
+ * gets a status screen without disk rows rather than a probe it didn't ask
+ * for — the same shape `servedTier` uses for a fact only some callers have.
+ */
+disk) {
     return {
         id: "overview",
         label: "overview",
-        lines: (theme, cols) => sessionStatusLines(buildSessionStatus(session, (absPath) => git.current(absPath), servedTier()), theme, cols),
+        lines: (theme, cols) => sessionStatusLines(buildSessionStatus(session, (absPath) => git.current(absPath), servedTier(), disk ? (path) => disk.current(path) : undefined), theme, cols),
         /**
          * Re-probe every root after a turn. Invalidate-then-refresh because a turn
          * is exactly when the tree may have moved; the cache coalesces, so the ten
          * writes a turn makes still cost one probe per root.
+         *
+         * Disk refreshes alongside, and unconditionally — it has no invalidate,
+         * because free space moves for reasons that have nothing to do with this
+         * session (see `disk-status.ts`). Concurrently, not in sequence: they are
+         * independent reads and neither should wait on the other's slowest mount.
          */
         refresh: async () => {
             git.invalidate();
-            await git.refresh();
+            await Promise.all([git.refresh(), disk?.refresh()]);
         },
     };
 }

package/dist/tui/panels.js

@@ -17,6 +17,7 @@ import { RAIL_PANELS, } from "./layout.js";
 export const PANEL_LABELS = {
     sidebar: "sidebar",
     context: "context",
+    limits: "limits",
     model: "model",
     git: "git",
     tools: "tools",
@@ -30,6 +31,7 @@ export const COLUMN_LABELS = {
 /** Titles drawn at the top of each rail panel. */
 const RAIL_TITLES = {
     context: "context",
+    limits: "limits",
     model: "model",
     git: "git",
     tools: "tools",