@cruxy/cli 1.7.1 → 1.8.0

package/dist/agent/loop.js

@@ -131,6 +131,7 @@ routed) {
         // routing, which is why the fallback below still exists.
         let servedTier;
         let routingMode;
+        let reasoningEffort;
         // Live progress while waiting on the model; dismissed by the first delta.
         // Token context is whatever the loop has actually accumulated (U.4): zero
         // on the first turn → no figure shown, never a fabricated number.
@@ -151,6 +152,7 @@ routed) {
                 case "routing":
                     servedTier = ev.routing.tier;
                     routingMode = ev.routing.mode;
+                    reasoningEffort = ev.routing.reasoning_effort;
                     // Publish to the renderer HERE, not at the `setPhase` above. That one
                     // fires before `provider.stream` is called, so the served tier is not
                     // knowable yet and it can only carry `routed?.tier` — what this run
@@ -160,6 +162,12 @@ routed) {
                     renderer?.servedRouting({
                         tier: ev.routing.tier,
                         ...(ev.routing.mode !== undefined ? { mode: ev.routing.mode } : {}),
+                        // Conditionally spread like `mode`, and for the same reason: a
+                        // gateway that reported no effort must reach the surfaces as
+                        // ABSENT, not as an empty string they would then draw.
+                        ...(ev.routing.reasoning_effort !== undefined
+                            ? { reasoningEffort: ev.routing.reasoning_effort }
+                            : {}),
                     });
                     break;
                 case "text_delta":
@@ -219,6 +227,7 @@ routed) {
         args.onRequestUsage?.({
             tier: servedTier ?? routed?.tier,
             ...(routingMode !== undefined ? { routingMode } : {}),
+            ...(reasoningEffort !== undefined ? { reasoningEffort } : {}),
             usage: sawUsage ? { ...reqUsage } : undefined,
         });
         // ── Record the assistant turn ───────────────────────────────────────────

package/dist/agent/permissions.js

@@ -0,0 +1,72 @@
+import { deadGrantReason, scopeLabel } from "../approval/index.js";
+import { modeDescription, modeAutoApproves } from "./mode.js";
+/**
+ * Assembling the permissions screen (cli#196) — one builder, two callers.
+ *
+ * The same shape `agent/status.ts` uses, for the same reason: `/permissions`
+ * and the Permissions view show one screen, and the surest way to keep them
+ * from drifting is for there to be nothing to drift. Both call this;
+ * `render/permissions-view.ts` renders whatever it returns.
+ *
+ * WHAT IS NOT HERE: any probe, and any second opinion. The mode comes from the
+ * session, the grants come from the allowlist the session's policies actually
+ * spend, each label comes from the prompt's own `scopeLabel`, and each inert
+ * mark comes from the classifier's own rules. Nothing on this screen is
+ * re-derived from a copy — a permissions view that disagreed with the gate
+ * would be worse than no view at all.
+ */
+/**
+ * Where a grant applies, as one path.
+ *
+ * Every scope kind spells this `root`, and the two meanings behind that one
+ * field are worth knowing when reading a row: the three command/tool kinds are
+ * BOUND to the root they were taken in (C.26), while a `file-subtree` IS its
+ * path. The column answers the same question for both — "where does this let it
+ * happen" — which is why one column is right.
+ */
+function grantWhere(grant) {
+    return grant.scope.root;
+}
+/** One grant as a row, numbered by its position in `list()`. */
+function grantRow(grant, index) {
+    const dead = deadGrantReason(grant.scope);
+    return {
+        // 1-based: the number is typed by a human at `/permissions revoke <n>`, and
+        // `revoke` takes the array index — the conversion happens once, at the
+        // command, and never in the middle of a report.
+        n: index + 1,
+        tier: grant.tier,
+        // `scopeLabel` returns null only for `scope: "none"`, which an allowlist
+        // never holds (`grant()` refuses it) — so the fallback is unreachable
+        // rather than a case with a sensible answer.
+        label: scopeLabel(grant.scope) ?? "an unnameable scope",
+        where: grantWhere(grant),
+        ...(dead === null ? {} : { dead }),
+    };
+}
+/** Everything `/permissions` and the Permissions view show, from live state. */
+export function permissionsReport(session) {
+    const mode = session.getMode();
+    const allowlist = session.allowlist;
+    return {
+        mode,
+        modeDescription: modeDescription(mode),
+        autoApproves: modeAutoApproves(mode),
+        // Absent, not empty, when nothing is wired — see `PermissionsReport.grants`.
+        ...(allowlist ? { grants: allowlist.list().map(grantRow) } : {}),
+    };
+}
+/**
+ * The one-line confirmation for a revoked grant, so the command and any future
+ * caller say the same thing about what just happened.
+ *
+ * It names the grant in the words it was listed under and states the limit in
+ * the same breath: revoking means no FUTURE lookup matches it. An action
+ * already past the gate keeps the decision it was given, and a user who is
+ * revoking because something is running deserves to be told that here rather
+ * than to infer it from a command that says only "revoked".
+ */
+export function revokedLine(grant) {
+    const label = scopeLabel(grant.scope) ?? "that grant";
+    return `revoked: ${label} (${grantWhere(grant)}) — it will ask again next time; anything already approved keeps running`;
+}

package/dist/agent/session.js

@@ -154,6 +154,14 @@ export class Session {
     get toolRegistry() {
         return this.args.registry;
     }
+    /**
+     * The standing session grants (cli#196), or undefined when no allowlist was
+     * wired. `/permissions` reads and revokes through this; nothing else on the
+     * shell side touches it.
+     */
+    get allowlist() {
+        return this.args.allowlist;
+    }
     /** The background-job manager (C.28), or undefined when jobs are disabled.
      * The REPL uses it to service paused-job approvals and drive `/jobs`; `cruxy
      * run` uses it to cancel every live job on exit. */
@@ -213,6 +221,14 @@ export class Session {
         // model iterations WITHIN this turn — it just never leaks into the next one.
         for (const tool of this.args.registry.list())
             tool.onTurnStart?.();
+        // Re-read the account's headroom (P9 / cli#212), on EVERY turn and on every
+        // surface — the REPL and headless included, neither of which has a rail to
+        // have justified the probe before. It is fired here rather than after the
+        // turn for two reasons: it overlaps the turn instead of the process's exit,
+        // so a one-shot never waits on a status read to finish; and it lands while
+        // this turn is still running, which is when the fan-out seam asks. Never
+        // awaited — see `SessionBudget.refreshLimits`.
+        this.args.budget?.refreshLimits();
         this.messages.push({ role: "user", content: userPrompt });
         // Record the user's turn before anything can fail (P2): a turn that dies in
         // the provider still leaves what the user asked for on disk.
@@ -311,7 +327,11 @@ export class Session {
         this.lastRun = record;
         this.args.onRunUsage?.(record);
         // The budget draws down from the SAME record the usage store persists, so
-        // `/budget` and `/usage` can never report different spends for one turn.
+        // `/budget` and `/usage` can never report different spends for THIS turn's
+        // own requests. They can differ by a subagent's worth: the orchestrator
+        // folds each child's spend into the budget (cli#212 — an admission check
+        // whose own dispatches never move the numerator is not a check) and does not
+        // write child runs to the store. See the note at that call site.
         this.args.budget?.record(record);
         // after-run (C.19): advisory by default (a blocking after-run hook throws
         // and surfaces at the boundary). The turn already completed and its history
@@ -508,6 +528,7 @@ export class Session {
         let sawUsage = false;
         let servedTier;
         let routingMode;
+        let reasoningEffort;
         for await (const ev of this.args.provider.stream({
             system: SUMMARY_SYSTEM,
             messages: [{ role: "user", content: transcript }],
@@ -517,6 +538,7 @@ export class Session {
                 case "routing":
                     servedTier = ev.routing.tier;
                     routingMode = ev.routing.mode;
+                    reasoningEffort = ev.routing.reasoning_effort;
                     break;
                 case "text_delta":
                     text += ev.text;
@@ -536,9 +558,16 @@ export class Session {
         // Attribute this compaction request to the tier that served it — the
         // gateway's answer over the `summarize` tier this run asked for, same
         // precedence and same reasoning as the main loop.
+        //
+        // Compaction has no live surface of its own — it runs between turns, with
+        // no renderer to publish routing to — so the usage record is the ONLY place
+        // its effort can land. That matters more here than on the main loop: a
+        // summarize call reasoning at `high` is exactly the kind of silent spend a
+        // per-request record exists to expose.
         onRequestUsage?.({
             tier: servedTier ?? routed?.tier,
             ...(routingMode !== undefined ? { routingMode } : {}),
+            ...(reasoningEffort !== undefined ? { reasoningEffort } : {}),
             usage: sawUsage ? { ...usage } : undefined,
         });
         if (!text.trim())

package/dist/approval/classify.js

@@ -1,4 +1,5 @@
 import path from "node:path";
+import { captureExclusion } from "../checkpoint/coverage.js";
 /**
  * Classify a pending tool action into a {@link RiskTier} + a tight session
  * {@link Scope}. The cardinal rule: **anything unrecognized is `destructive`**
@@ -47,29 +48,51 @@ export function classify(action, cwd) {
  *
  *   • `capture.ts` enumerates with `git ls-files --cached --others
  *     --exclude-standard` — tracked + untracked-non-ignored files **under one
- *     root**. So: nothing outside a declared root, and nothing gitignored
- *     (`node_modules/`, build output, `.env`).
- *   • `git-store.ts` states it outright: "no ref is ever created or moved, and
- *     HEAD / the index / the stash are never written." `.git/` is never
- *     enumerated at all. So: **no git history, refs, branches, or stash.**
+ *     root** — and then filters that list through
+ *     {@link captureExclusion}. So: nothing outside a declared root, nothing
+ *     gitignored, and nothing under `.git/`, `node_modules/`, `.cruxy/`, or the
+ *     secrets denylist.
+ *   • Only file *content* and the executable bit ({@link CaptureFile.mode} is
+ *     `100644` or `100755`). Not the rest of the permission word, not ownership,
+ *     not flags. And regular files only — a symlink is skipped on capture and
+ *     restore writes plain files.
  *   • Nothing off-disk. A checkpoint cannot un-send a push, un-publish a
  *     package, or un-call an HTTP endpoint.
  *
- * Everything a checkpoint DOES cover, it covers completely: `withCheckpointGate`
- * snapshots the whole root before the first mutation of a run, so arbitrary
- * in-root file damage — including `rm -rf` of the workspace — is restorable.
- * That is why the rules key on *escape* (out of the root, into `.git`, onto the
- * network) rather than on how destructive an in-root command looks.
+ * ── The correction (cli#241) ──
+ * The rules used to key on *root containment*: inside the workspace meant
+ * restorable, because `withCheckpointGate` snapshots the whole root before a
+ * run's first mutation. But "the whole root" was never true — the capturer had
+ * always excluded the four classes above, all of which live *inside* the root.
+ * Inside-the-root and captured-by-the-checkpoint are different sets, and every
+ * path in the gap auto-ran with nothing to restore from: `rm -rf .git`,
+ * `rm .env`, `rm -rf node_modules`, `rm -rf .cruxy`. No unlisted binary
+ * required — ordinary `rm` cleared all four gates.
  *
- * ── Residual risk, stated plainly ──
- * No static analysis can prove a shell command's effects. {@link ESCAPES_ROOT}
- * is a denylist, and denylists lose: `node deploy.js` or an unlisted CLI can
- * still reach the network. It is a belt. The braces are the two rules that fail
- * *closed* — an unprovable command (any shell metacharacter) and any argument
- * resolving outside the root are both irreversible without consulting any list
- * — plus the pre-command checkpoint, which bounds the on-disk half absolutely.
- * Auto-approve is a deliberate, per-session, visibly-announced choice; this is
- * the ceiling on that choice, not a sandbox.
+ * So containment is now necessary but not sufficient. A path must be inside the
+ * root AND inside the capture set, and the capture set is read from the function
+ * the capturer itself filters on, so the ceiling cannot drift from the snapshot
+ * again.
+ *
+ * ── Braces and belt ──
+ * The rules that fail *closed*, needing no list to be correct: an unprovable
+ * command (any shell metacharacter); an argument resolving outside the root; an
+ * argument naming a path the capturer skips; an argument naming the root itself
+ * (a container whose contents are only partly captured). Those are the braces,
+ * and they are what the guarantee rests on.
+ *
+ * {@link ESCAPES_ROOT} and {@link MUTATES_UNCAPTURED_STATE} are the belt: two
+ * denylists of program names, and denylists lose — `node deploy.js` still
+ * reaches the network (cli#194), and `install -m 000` still evades the
+ * permission rule. A name is a prediction about what a program will do, so it
+ * cannot fail closed by construction. The end of that argument is confinement
+ * keyed on the *mode* rather than the program, which cli#194 tracks; these lists
+ * are what holds until then, not a sandbox.
+ *
+ * One residual is deliberate and named: generic **gitignored** paths (`rm -rf
+ * dist`) cannot be decided from a path alone — it needs the repo's ignore files,
+ * and this classifier is pure and synchronous by design. See
+ * {@link captureExclusion} for why that tail is the low-value one.
  */
 /**
  * `git` subcommands that only read. Everything else `git` does is irreversible
@@ -139,11 +162,43 @@ const ESCAPES_ROOT = new Map([
     ["mkfs", "it formats a filesystem, which no checkpoint can restore"],
     ["diskutil", "it changes disk state, which no checkpoint can restore"],
 ]);
+/**
+ * Programs that change file state the snapshot does not record. Not "scary
+ * verbs" — each names an attribute {@link CaptureFile} has no field for, so
+ * restore provably cannot put it back:
+ *
+ *   • permissions beyond the executable bit (`mode` is `100644` or `100755`),
+ *   • ownership and file flags (no field at all),
+ *   • symlink-ness (capture skips non-regular files; restore writes plain ones).
+ *
+ * `chmod -R 000 .` is the case that motivates this: every file stays captured
+ * and byte-identical, so `restore.ts` sees nothing changed and reverts nothing,
+ * while the tree is now unreadable. Being a name list this is a belt, not a
+ * brace — `install -m`, `setfacl`, and a script calling `os.chmod` all evade it.
+ */
+const MUTATES_UNCAPTURED_STATE = new Map([
+    [
+        "chmod",
+        "a snapshot records only the executable bit, so any other permission change is not restored",
+    ],
+    ["chown", "a snapshot records no ownership, so it cannot be restored"],
+    ["chgrp", "a snapshot records no group ownership, so it cannot be restored"],
+    ["chflags", "a snapshot records no file flags, so they cannot be restored"],
+    [
+        "setfacl",
+        "a snapshot records no access-control lists, so they cannot be restored",
+    ],
+    [
+        "ln",
+        "a snapshot captures regular files only, so a link it creates — and a captured file it replaces — fall outside the checkpoint",
+    ],
+]);
 /**
  * Why the checkpoint cannot restore `command`, or `null` when it can.
  *
- * Three gates, in order of how hard they fail closed. The first two need no
- * list to be correct; the third is the belt described above.
+ * Gates in order of how hard they fail closed. The metacharacter gate and the
+ * argument gate need no list to be correct; the `git`/package-manager gates are
+ * allowlists over a known surface; the two name maps are the belt.
  */
 function shellIrreversibility(command, root) {
     const tokens = commandTokens(command);
@@ -168,47 +223,137 @@ function shellIrreversibility(command, root) {
     const escapes = ESCAPES_ROOT.get(program);
     if (escapes)
         return `\`${program}\` is not checkpointable — ${escapes}`;
-    const outside = args.find((a) => escapesRoot(a, root));
-    if (outside) {
-        return `\`${outside}\` resolves outside the workspace root, which the checkpoint does not capture`;
+    const attribute = MUTATES_UNCAPTURED_STATE.get(program);
+    if (attribute)
+        return `\`${program}\` is not checkpointable — ${attribute}`;
+    // Every remaining argument is treated as a candidate path. Note this asks
+    // "would the checkpoint cover this path", NOT "does the command write it" —
+    // `cat .env` is classified irreversible too. That over-inclusion is the
+    // deliberate direction of error: a false positive costs one prompt, a false
+    // negative costs the file. `tokens[0]` is excluded because it is what *runs*,
+    // not what is written, and running a file does not destroy it — otherwise
+    // `./node_modules/.bin/vitest` would prompt on every invocation.
+    for (const arg of args) {
+        const reason = argIrreversibility(arg, root);
+        if (reason)
+            return reason;
     }
     return null;
 }
+// ── dead grants (cli#196) ─────────────────────────────────────────────────────
 /**
- * Whether a command argument names a path the checkpoint would not cover.
+ * Why an already-recorded grant can never match another action, or `null` when
+ * it is still spendable.
+ *
+ * Since cli#193 the ceiling is checked BEFORE any scope matching, so a grant
+ * whose every possible match is irreversible is inert the moment it is written:
+ * the user was prompted, said "allow this session", and bought nothing. The
+ * grant is still recorded (`grant()` does not judge), and `/permissions` lists
+ * it — listing it looking exactly like a live one is what would re-create the
+ * "the grant was forgotten" confusion {@link SessionAllowlist.overriddenGrant}
+ * exists to prevent, one surface further along.
+ *
+ * Decidable from the SCOPE ALONE, which is the whole reason this can be a
+ * function rather than a guess:
+ *
+ *   • `mcp-tool` — {@link mcpRequest} marks every MCP call irreversible
+ *     unconditionally, so no request can clear the ceiling. Blocked, not dead
+ *     code: the fix is #239's per-tool judgement, and on the day that lands
+ *     these grants start working with no change here.
+ *   • `shell-exact` (a test grant) — the scope carries the exact command and
+ *     root, and {@link testRequest} derives `irreversible` from those same two
+ *     values through this same function. Same inputs, same verdict, every time:
+ *     a `pnpm install` test grant is inert on the subcommand parse alone.
+ *   • `shell-prefix` — only where the program name decides it regardless of
+ *     arguments, i.e. the two name maps. NOT the `git`/package-manager gates:
+ *     those turn on the subcommand, and a `git` grant that cannot cover
+ *     `git commit` still covers `git log` — that grant is narrow, not dead.
  *
- * Handles `--flag=<path>` as well as a bare path, because the flag form is how
- * an out-of-root target most often sneaks past a naive check. Absolute paths and
- * anything containing `..` are resolved against the root and tested; a plain
- * relative token cannot escape, so it is left alone. (`~` and `*` never reach
- * here — {@link commandTokens} already rejects the whole command for those.)
+ * `file-subtree` is not judged. A subtree rooted somewhere the capturer skips
+ * (inside `node_modules/`, say) is genuinely inert, but deciding that needs the
+ * WORKSPACE root to relativize against and the scope carries only its own
+ * absolute path — and the ordinary case, a subtree of source files, is live. A
+ * missing mark on a rare inert grant is a lesser wrong than a wrong mark on a
+ * common live one.
  */
-function escapesRoot(arg, root) {
+export function deadGrantReason(scope) {
+    if (scope.kind === "mcp-tool") {
+        return "every MCP call is classified irreversible, so the ceiling refuses this grant before it is ever matched (cli#239)";
+    }
+    if (scope.kind === "shell-exact") {
+        return shellIrreversibility(scope.command, scope.root);
+    }
+    if (scope.kind === "shell-prefix") {
+        const program = path.basename(scope.token);
+        const escapes = ESCAPES_ROOT.get(program);
+        if (escapes)
+            return `\`${program}\` is not checkpointable — ${escapes}`;
+        const attribute = MUTATES_UNCAPTURED_STATE.get(program);
+        if (attribute)
+            return `\`${program}\` is not checkpointable — ${attribute}`;
+    }
+    return null;
+}
+/**
+ * Why the checkpoint could not restore the path a command argument names, or
+ * `null` when it could (or when the token names no path at all).
+ *
+ * Handles `--flag=<path>` as well as a bare token, because the flag form is how
+ * an out-of-root target most often sneaks past a naive check. Bare options are
+ * skipped: `-rf` resolves to a path that exists in no capture set and would only
+ * produce noise. (`~` and `*` never reach here — {@link commandTokens} already
+ * rejects the whole command for those.)
+ */
+function argIrreversibility(arg, root) {
     const eq = arg.indexOf("=");
     const candidate = eq === -1 ? arg : arg.slice(eq + 1);
     if (candidate === "")
-        return false;
-    const looksLikePath = candidate.startsWith("/") || candidate.split("/").includes("..");
-    if (!looksLikePath)
-        return false;
-    return !isInside(root, path.resolve(root, candidate));
+        return null;
+    if (eq === -1 && candidate.startsWith("-"))
+        return null;
+    return pathIrreversibility(path.resolve(root, candidate), root, arg);
+}
+/**
+ * The shared containment+coverage test behind every path-bearing rule: why the
+ * checkpoint could not restore `abs`, or `null` when it could. `label` is what
+ * the message names — the token the user actually typed, for a shell argument.
+ *
+ * Three ways a path falls outside the snapshot, and the last two are cli#241:
+ * being outside the root was never the only one.
+ */
+function pathIrreversibility(abs, root, label = abs) {
+    if (!isInside(root, abs)) {
+        return `\`${label}\` resolves outside the workspace root, which the checkpoint does not capture`;
+    }
+    if (abs === root) {
+        // The root is a container, not a captured path: it holds `.git/`, `.cruxy/`,
+        // gitignored output and secrets, none of which come back. `rm -rf .` and
+        // `chmod -R 000 .` are inside the root and still unrecoverable.
+        return `\`${label}\` names the workspace root itself, which contains paths the checkpoint does not capture (\`.git/\`, ignored output, secrets)`;
+    }
+    const rel = path.relative(root, abs).split(path.sep).join("/");
+    const excluded = captureExclusion(rel);
+    return excluded
+        ? `\`${label}\` is not captured by the checkpoint — ${excluded}`
+        : null;
 }
 /**
  * Why the checkpoint cannot restore a file action, or `null` when it can.
  *
  * A delete is not special here — `patchHasDelete` raises the *tier* because a
- * delete deserves a louder prompt, but a deleted file inside the root is
- * restored from the snapshot exactly like an edited one. What matters is
- * containment, and that every target is known: an action carrying no resolved
+ * delete deserves a louder prompt, but a deleted file inside the capture set is
+ * restored from the snapshot exactly like an edited one. What matters is that
+ * every target is known, contained, AND captured: an action carrying no resolved
  * target cannot be shown to be covered, so it is not.
  */
 function fileIrreversibility(targets, root) {
     if (targets.length === 0) {
         return "the action names no resolvable target, so the checkpoint cannot be shown to cover it";
     }
-    const outside = targets.find((t) => !isInside(root, t));
-    if (outside) {
-        return `\`${outside}\` is outside the workspace root, which the checkpoint does not capture`;
+    for (const target of targets) {
+        const reason = pathIrreversibility(target, root);
+        if (reason)
+            return reason;
     }
     return null;
 }
@@ -378,6 +523,11 @@ function mcpRequest(action, root) {
         // Same reasoning as the tier: the server cannot vouch for itself. A
         // `readOnlyHint` is a claim by the thing being gated, and the checkpoint
         // cannot reach whatever it did anyway.
+        //
+        // But it is unconditional, which is this classifier declining to judge —
+        // and since cli#193 (the ceiling outranks grants) that verdict is what makes
+        // the `mcp-tool` scope above unreachable. Tracked in #239; the fix is a
+        // per-tool judgement here, never a ceiling carve-out for MCP.
         irreversible: "an MCP tool runs unsandboxed in an external server, so its effects are outside the checkpoint entirely",
     };
 }
@@ -416,10 +566,10 @@ function fileScope(targets, root) {
     const dir = commonDir(targets);
     if (dir === root || !isInside(root, dir)) {
         return targets.length === 1
-            ? { kind: "file-subtree", root: targets[0] } // exact-file grant
+            ? { kind: "file-subtree", root: targets[0], exact: true } // exact-file grant
             : { kind: "none" };
     }
-    return { kind: "file-subtree", root: dir };
+    return { kind: "file-subtree", root: dir, exact: false };
 }
 function fileSummary(action, targets, root) {
     const verb = action.kind === "write"