@cruxy/cli 1.4.0 → 1.5.0

package/dist/tui/renderer.js

@@ -11,6 +11,7 @@ import { ELAPSED_AFTER_MS, fitStatusLine, formatElapsed, phaseIdentity, } from "
 import { budgetColumns, bodyRows, composeScreen, droppedForWidth, fitOverlay, overlayRows, scrollNotice, scrollWindow, stackPanels, CLOSABLE_PANELS, } from "./layout.js";
 import { CONVERSATION_VIEW, cycleView, navLines, } from "./views.js";
 import { contextPanelLines, gitPanelLines, headerModel, mainWelcome, modelPanelLines, railBlocks, sidebarLines, toolsPanelLines, } from "./panels.js";
+import { limitsPanelLines } from "./limits-panel.js";
 /**
  * The full-viewport renderer (P1) — the fourth {@link StreamRenderer}, and the
  * only one that owns the whole screen rather than a single managed line.
@@ -93,6 +94,10 @@ export class TuiRenderer {
     git;
     /** Context-budget reading for the context panel (P4 track 3); absent → unwired. */
     context;
+    /** The account's headroom for the limits panel (P9); absent → panel unwired. */
+    limits;
+    /** Whether the first limits read has been kicked off (see {@link startLimits}). */
+    limitsStarted = false;
     /**
      * The configured model/tier as known at construction — the renderer is built
      * before the session exists, so this covers the window before {@link attachModel}
@@ -196,6 +201,20 @@ export class TuiRenderer {
         gauge.sample();
         this.schedulePaint();
     }
+    /**
+     * Attach the limits cache (P9). Set after construction like the context gauge,
+     * because the credential it reads with is resolved alongside the session.
+     *
+     * NO PROBE HAPPENS HERE. The first read is deferred to the first paint that
+     * actually shows the panel — the rule the tool probes already follow — so a
+     * user who keeps `limits` closed, or who runs a one-shot that never paints a
+     * rail, never makes the request at all. The panel is a status surface; it does
+     * not get to spend a round trip on someone who is not looking at it.
+     */
+    attachLimits(limits) {
+        this.limits = limits;
+        this.schedulePaint();
+    }
     /**
      * Adopt the session's live model choice (P6 track 1). Set after construction
      * for the same reason the context gauge is: the choice belongs to the session,
@@ -233,6 +252,24 @@ export class TuiRenderer {
      * nothing after the first; the repaint callback is what lets each row appear
      * as its own probe lands rather than all at once at the end.
      */
+    /**
+     * Kick off the first limits read, at the first paint that actually SHOWS the
+     * panel. Returns the cache so the paint path can read it in one expression.
+     *
+     * Guarded by its own flag rather than by the cache's interval floor: the floor
+     * exists to coalesce refreshes AFTER a reading exists, and would not stop the
+     * paint path from firing a request on every frame before the first one lands.
+     */
+    startLimits(limits) {
+        if (!this.limitsStarted) {
+            this.limitsStarted = true;
+            void limits.refresh().then(() => {
+                if (!this.closed)
+                    this.schedulePaint();
+            });
+        }
+        return limits;
+    }
     startTools(tools) {
         tools.start(() => {
             if (!this.closed)
@@ -639,8 +676,29 @@ export class TuiRenderer {
         this.context?.sample();
         this.paintNow();
         this.refreshGit();
+        this.refreshLimits();
         this.refreshViews();
     }
+    /**
+     * Re-read the account's headroom after a turn (P9) — the one moment it is
+     * KNOWN to have moved, because this process just spent some of it.
+     *
+     * Same rules as the git probe: never awaited, a failure leaves the last good
+     * reading standing, and the cache coalesces. Unlike git it is also floored by
+     * a minimum interval, because this one crosses the network — and unlike git it
+     * is skipped entirely while the panel is closed, since a user who has hidden
+     * the figures has no use for the request that fetches them.
+     */
+    refreshLimits() {
+        const limits = this.limits;
+        if (limits === undefined || this.closed || !this.open.has("limits"))
+            return;
+        void limits.refresh().then(() => {
+            if (this.closed)
+                return;
+            this.schedulePaint();
+        });
+    }
     /**
      * Re-probe the working tree, off the paint path, and repaint when it lands.
      *
@@ -1043,6 +1101,14 @@ export class TuiRenderer {
             ...(this.context === undefined
                 ? {}
                 : { context: contextPanelLines(this.theme, this.context.current()) }),
+            // Like the tool probes: the first network read starts at the first paint
+            // that SHOWS this panel, never at startup and never at all while it is
+            // closed. `startLimits` is idempotent, so painting it costs one request.
+            ...(this.limits === undefined || !this.open.has("limits")
+                ? {}
+                : {
+                    limits: limitsPanelLines(this.theme, this.startLimits(this.limits).current()),
+                }),
             ...(this.git === undefined
                 ? {}
                 : { git: gitPanelLines(this.theme, this.git.current()) }),

package/dist/utils/disk.js

@@ -0,0 +1,95 @@
+import { statfsSync } from "node:fs";
+import { statfs } from "node:fs/promises";
+const GIB = 1024 ** 3;
+/** Below this, a run that shadow-copies a repo can plausibly fail. */
+const LOW_FREE_BYTES = 5 * GIB;
+/** Below this, assume the next sizeable write fails. */
+const CRITICAL_FREE_BYTES = 1 * GIB;
+export function capacityLevel(capacity) {
+    if (capacity.freeBytes < CRITICAL_FREE_BYTES)
+        return "critical";
+    if (capacity.freeBytes < LOW_FREE_BYTES)
+        return "low";
+    return "ok";
+}
+/**
+ * Turn a `statfs` result into a capacity, or `undefined` when it cannot say
+ * anything true.
+ *
+ * `blocks === 0` is the guard that matters: some pseudo-filesystems report a
+ * zero total, and a percentage derived from it is `NaN` or `Infinity` — a
+ * "0% free" that means "we have no idea" is the single worst thing this could
+ * render, because it is indistinguishable from a genuinely full disk.
+ *
+ * Exported for the test that pins that guard: it is the one branch here that
+ * cannot be reached through a real `statfs` on any machine CI runs on.
+ */
+export function capacityFromStats(stats) {
+    const blockSize = Number(stats.bsize);
+    const blocks = Number(stats.blocks);
+    const available = Number(stats.bavail);
+    if (!(blockSize > 0) || !(blocks > 0) || !(available >= 0))
+        return undefined;
+    const totalBytes = blocks * blockSize;
+    const freeBytes = available * blockSize;
+    return {
+        freeBytes,
+        totalBytes,
+        freePercent: Math.floor((freeBytes / totalBytes) * 100),
+    };
+}
+/**
+ * Capacity of the filesystem holding `path`, or `undefined` if it can't be
+ * read (a path that doesn't exist, a platform or mount that won't answer).
+ *
+ * ASYNC because a `statfs` is only microseconds on a local disk — the whole
+ * reason this is affordable — but can block for SECONDS on an unresponsive
+ * network mount, and someone will eventually run cruxy in a repo on NFS. The
+ * cost model that justifies the feature holds for the common case; the API is
+ * shaped for the uncommon one.
+ */
+export async function readDiskCapacity(path) {
+    try {
+        return capacityFromStats(await statfs(path));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The synchronous read, for the one caller that is allowed one: a command the
+ * user just typed, which has no frame to lose and every reason to print a real
+ * answer instead of "checking…". Never call this from a paint path.
+ */
+export function readDiskCapacitySync(path) {
+    try {
+        return capacityFromStats(statfsSync(path));
+    }
+    catch {
+        return undefined;
+    }
+}
+const UNITS = ["B", "KiB", "MiB", "GiB", "TiB", "PiB"];
+/**
+ * `8.1 GiB`, `465 GiB`, `912 MiB`.
+ *
+ * Binary units with binary labels. `GB` for 2^30 is the ambiguity that makes
+ * people distrust a number they were about to act on; if the unit is 1024-based
+ * the label says so.
+ */
+export function formatBytes(bytes) {
+    let value = Math.max(0, bytes);
+    let unit = 0;
+    while (value >= 1024 && unit < UNITS.length - 1) {
+        value /= 1024;
+        unit++;
+    }
+    // One decimal only while it carries information: "8.1 GiB" is a different
+    // amount from "8 GiB", "465.3 GiB" is not meaningfully different from "465".
+    const digits = unit > 0 && value < 10 ? 1 : 0;
+    return `${value.toFixed(digits)} ${UNITS[unit]}`;
+}
+/** `2% free · 8.1 GiB of 465 GiB` — the percentage first, since that's the read. */
+export function formatCapacity(capacity) {
+    return `${capacity.freePercent}% free · ${formatBytes(capacity.freeBytes)} of ${formatBytes(capacity.totalBytes)}`;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cruxy/cli",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "an agentic coding CLI",
   "type": "module",
   "bin": {
@@ -36,7 +36,7 @@
     "undici": "^6.21.0",
     "zod": "^3.23.8",
     "zod-to-json-schema": "^3.23.5",
-    "@cruxy/sdk": "0.4.1"
+    "@cruxy/sdk": "0.5.0"
   },
   "optionalDependencies": {
     "better-sqlite3": "^12.11.1"