@cruxy/cli 1.8.0 → 1.9.0

package/dist/session/replay.js

@@ -1,7 +1,7 @@
 import { readFileSync } from "node:fs";
 import { modeFromFlags } from "../agent/mode.js";
 import { redactMessages } from "./redact.js";
-import { SessionEventSchema, SessionMetaSchema, } from "./types.js";
+import { KNOWN_EVENT_KINDS, SessionEventSchema, SessionMetaSchema, } from "./types.js";
 /**
  * Replay: fold an append-only event log back into the state a session needs to
  * resume (P2).
@@ -11,8 +11,7 @@ import { SessionEventSchema, SessionMetaSchema, } from "./types.js";
  * the array the model last saw, including the synthetic compaction summaries.
  * Nothing is re-derived or re-summarised on the way back in.
  *
- * TOLERANCE IS THE POINT. A line that will not parse is SKIPPED and counted,
- * never fatal:
+ * TOLERANCE IS THE POINT. A line that will not parse is SKIPPED, never fatal:
  *  - a torn final line from a crash mid-append would otherwise cost the whole
  *    conversation (this is the failure temp-then-rename buys off at write time;
  *    an append-only log buys it off here instead);
@@ -20,8 +19,25 @@ import { SessionEventSchema, SessionMetaSchema, } from "./types.js";
  *    heard of is skipped rather than rejected, which together with the
  *    `.passthrough()` schemas is what keeps two CLI versions able to share one
  *    home directory.
- * `SessionState.skipped` carries the count so a caller can say so out loud
- * rather than presenting a partial history as complete.
+ *
+ * THE TWO ARE COUNTED APART (#172 item 2), because they are not the same fact
+ * and the caller says something different about each. A damaged line means
+ * content was LOST — "the restored history may be incomplete" is warranted. An
+ * unknown kind means content is not visible HERE while the file is perfectly
+ * intact.
+ *
+ * Conflating them was survivable only while unknown kinds were rare. The
+ * `resumed` event is written on EVERY reopen, so an older build sharing a home
+ * directory would have announced possible history loss on every single resume —
+ * a forward-compatibility mechanism producing a corruption warning as routine
+ * output. `SessionState.skipped` now counts only damage;
+ * `SessionState.unknownEvents` counts the rest.
+ *
+ * This fixes readers from this build forward. An ALREADY-SHIPPED cruxy has the
+ * old reader and will still say "unreadable lines" when it meets a `resumed`
+ * event; nothing here can reach it. That is the cost of the split landing with
+ * the event rather than before it, and it is bounded — it misreports, it does
+ * not lose anything.
  */
 /**
  * The one cast in this module, isolated and explained.
@@ -36,20 +52,37 @@ import { SessionEventSchema, SessionMetaSchema, } from "./types.js";
 function asMessages(validated) {
     return validated;
 }
-/** Parse one line, or `null` when it is unusable (torn, or an unknown kind). */
+/**
+ * Classify one line.
+ *
+ * The distinction that matters is inside the failure case. A line that is valid
+ * JSON, is an object, and names a `kind` this build has never heard of is a
+ * NEWER cruxy's event — the file is intact and the forward-compatibility rule is
+ * working as designed. Anything else that fails is damage.
+ *
+ * A known kind with a payload that does not validate counts as DAMAGE, not as
+ * unknown: this build understands that kind, so failing to parse it means the
+ * line is wrong rather than merely new.
+ */
 function parseLine(line) {
     const trimmed = line.trim();
     if (trimmed === "")
-        return null;
+        return { outcome: "blank" };
     let raw;
     try {
         raw = JSON.parse(trimmed);
     }
     catch {
-        return null;
+        return { outcome: "damaged" }; // torn mid-write
     }
     const parsed = SessionEventSchema.safeParse(raw);
-    return parsed.success ? parsed.data : null;
+    if (parsed.success)
+        return { outcome: "event", event: parsed.data };
+    const kind = raw?.kind;
+    if (typeof kind === "string" && !KNOWN_EVENT_KINDS.has(kind)) {
+        return { outcome: "unknown" };
+    }
+    return { outcome: "damaged" };
 }
 /**
  * Fold events into {@link SessionState}. Exported separately from file reading
@@ -60,7 +93,7 @@ function parseLine(line) {
  * which directory the history refers to, and resuming a conversation whose
  * origin is unknown is precisely what ruling 4 forbids.
  */
-export function foldEvents(events, skipped = 0) {
+export function foldEvents(events, counts = {}) {
     const metaEvent = events.find((e) => e.kind === "meta");
     if (!metaEvent) {
         throw new Error("session log has no readable meta line");
@@ -76,6 +109,7 @@ export function foldEvents(events, skipped = 0) {
     let planMode = false;
     let mode = null;
     let redactions = 0;
+    const resumes = [];
     const usage = { input_tokens: 0, output_tokens: 0 };
     for (const event of events) {
         switch (event.kind) {
@@ -116,6 +150,12 @@ export function foldEvents(events, skipped = 0) {
                 messages = redactMessages(messages).messages;
                 redactions++;
                 break;
+            case "resumed":
+                // Recorded, never folded into anything the model sees. A reopen is a
+                // fact ABOUT the conversation, not a turn in it — the whole reason it
+                // could be added without touching `meta` or the message array.
+                resumes.push({ at: event.at, cwd: event.cwd });
+                break;
             case "meta":
                 break;
         }
@@ -128,7 +168,9 @@ export function foldEvents(events, skipped = 0) {
         // Auto-approve reads false there, which is right: it was not a thing that
         // could be on, so nothing is being inferred.
         mode: mode ?? modeFromFlags(planMode, false),
-        skipped,
+        skipped: counts.skipped ?? 0,
+        unknownEvents: counts.unknownEvents ?? 0,
+        resumes,
         redactions,
     };
 }
@@ -137,21 +179,29 @@ export function readEvents(file) {
     const raw = readFileSync(file, "utf8");
     const events = [];
     let skipped = 0;
+    let unknownEvents = 0;
     for (const line of raw.split("\n")) {
-        if (line.trim() === "")
-            continue;
-        const event = parseLine(line);
-        if (event)
-            events.push(event);
-        else
-            skipped++;
+        const parsed = parseLine(line);
+        switch (parsed.outcome) {
+            case "event":
+                events.push(parsed.event);
+                break;
+            case "unknown":
+                unknownEvents++;
+                break;
+            case "damaged":
+                skipped++;
+                break;
+            case "blank":
+                break;
+        }
     }
-    return { events, skipped };
+    return { events, skipped, unknownEvents };
 }
 /** Read a session file and fold it into resumable state. */
 export function replaySession(file) {
-    const { events, skipped } = readEvents(file);
-    return foldEvents(events, skipped);
+    const { events, skipped, unknownEvents } = readEvents(file);
+    return foldEvents(events, { skipped, unknownEvents });
 }
 /**
  * Read ONLY the meta line — enough to list a session without folding its whole

package/dist/session/resume.js

@@ -1,6 +1,6 @@
 import { selectList } from "../components/index.js";
 import { usageError } from "../errors/index.js";
-import { findSession, isAmbiguous, listSessions } from "./list.js";
+import { listSessionRefs, listSessions, matchSessionRefs, summarizeSession, } from "./list.js";
 import { replaySession } from "./replay.js";
 /** How many sessions the bare-`--resume` picker offers. */
 export const PICKER_LIMIT = 10;
@@ -47,6 +47,28 @@ export function cwdMismatchWarning(state, cwd) {
     return (`this session was recorded in ${state.meta.cwd}, but you are in ${cwd} — ` +
         `its history refers to files and paths from the original directory`);
 }
+/**
+ * Directories this session has run in BEFORE, other than the one we are
+ * resuming into now (#172 item 2). Returns a warning to print, or null.
+ *
+ * Distinct from {@link cwdMismatchWarning}, which compares where the
+ * conversation BEGAN against where it is being resumed. This compares where it
+ * has since RUN. The two disagree in exactly the case that motivated the
+ * `resumed` event: begin in `/a`, resume in `/b`, then resume in `/a` again —
+ * `meta.cwd` matches, so the mismatch check is silent, and yet the history now
+ * contains a whole stretch of work done against a different tree.
+ *
+ * Nothing could say this before, because nothing recorded it. Sessions written
+ * before the event simply have no `resumes` and are silent here — absence is
+ * "not recorded", never "did not happen".
+ */
+export function priorDirectoriesWarning(state, cwd) {
+    const others = [...new Set(state.resumes.map((r) => r.cwd))].filter((dir) => dir !== cwd && dir !== state.meta.cwd);
+    if (others.length === 0)
+        return null;
+    return (`this session has also run in ${others.join(", ")} — ` +
+        `part of its history refers to files and paths from ${others.length === 1 ? "that directory" : "those directories"}`);
+}
 /**
  * Load one session and collect its warnings. Throws a usage error when the
  * file cannot be replayed at all (no meta line) — an unreadable session is
@@ -67,10 +89,23 @@ export function loadResume(session, cwd) {
     const mismatch = cwdMismatchWarning(state, cwd);
     if (mismatch)
         warnings.push(mismatch);
+    const elsewhere = priorDirectoriesWarning(state, cwd);
+    if (elsewhere)
+        warnings.push(elsewhere);
     if (state.skipped > 0) {
         warnings.push(`${state.skipped} unreadable line${state.skipped === 1 ? "" : "s"} in the session log were skipped — ` +
             `the restored history may be incomplete`);
     }
+    if (state.unknownEvents > 0) {
+        // Deliberately NOT the sentence above. The file is intact; this build is
+        // simply older than whatever wrote those lines, and saying "unreadable"
+        // about a healthy log would send the user looking for damage that is not
+        // there. What IS true is that some of what the session recorded cannot be
+        // shown here.
+        warnings.push(`${state.unknownEvents} event${state.unknownEvents === 1 ? "" : "s"} in this session ` +
+            `${state.unknownEvents === 1 ? "was" : "were"} written by a newer cruxy and ${state.unknownEvents === 1 ? "is" : "are"} not shown — ` +
+            `the conversation itself is complete; upgrade to see the rest`);
+    }
     if (state.redactions > 0) {
         // Said on resume because the alternative is a user finding `[redacted …]`
         // in a transcript and not knowing whether cruxy did it or the model wrote
@@ -82,27 +117,54 @@ export function loadResume(session, cwd) {
     return { session, state, warnings };
 }
 /**
- * Resolve `--resume <id>`. Fails loud on an unknown or ambiguous id rather than
- * silently starting a new session — the user named something specific.
+ * VALIDATE `--resume <id>` — which session does this name? — without loading it.
+ *
+ * Split from the loading half for two reasons, one of them ordering:
+ *
+ *  1. `executeRun` has to answer "is this a real id?" BEFORE the non-TTY guard,
+ *     so `cruxy --resume no-such-id < /dev/null` complains about the id rather
+ *     than about the terminal. It must not have to pay a full `replaySession`
+ *     to find that out — a VALID id in that same position is still going to be
+ *     told it needs a terminal, and reading a whole conversation only to throw
+ *     it away is exactly the cost this split avoids.
+ *  2. Both questions — ambiguous? which one? — are now asked of ONE index. This
+ *     used to build the full listing up to three times (`isAmbiguous`, then
+ *     `findSession`, then a third time to name the collisions), each one a
+ *     complete read and parse of every session file in the project.
+ *
+ * Fails loud on an unknown or ambiguous id rather than silently starting a new
+ * session — the user named something specific.
+ *
+ * The one file that matched IS summarized, so the caller still gets the title
+ * and turn count the resume line prints. That is one read, not N.
  */
-export function resumeById(cwd, id) {
-    if (isAmbiguous(cwd, id)) {
-        const matches = listSessions(cwd)
-            .filter((s) => s.sessionId.startsWith(id))
-            .map((s) => shortId(s.sessionId));
+export function resolveSessionId(cwd, id) {
+    const matches = matchSessionRefs(listSessionRefs(cwd), id);
+    if (matches.length > 1) {
+        const names = matches.map((m) => shortId(m.sessionId)).join(", ");
         throw usageError(`\`${id}\` matches more than one session`, [
-            `did you mean one of: ${matches.join(", ")}?`,
+            `did you mean one of: ${names}?`,
             "run `cruxy --resume` to pick from a list",
         ]);
     }
-    const found = findSession(cwd, id);
-    if (!found) {
+    const summary = matches.length === 1 ? summarizeSession(matches[0].file) : null;
+    if (!summary) {
         throw usageError(`no session \`${id}\` in this project`, [
             "run `cruxy --resume` to pick from recent sessions",
             "sessions are per-directory; check you are in the right one",
         ]);
     }
-    return loadResume(found, cwd);
+    return summary;
+}
+/**
+ * Resolve `--resume <id>` all the way to restorable state: validate, then load.
+ *
+ * `executeRun` calls the two halves separately, so validation can precede the
+ * non-TTY guard; this composition is what everything else (and the tests) use
+ * where there is no ordering constraint to respect.
+ */
+export function resumeById(cwd, id) {
+    return loadResume(resolveSessionId(cwd, id), cwd);
 }
 /**
  * Bare `--resume`: pick from the most recent sessions, or start a new one.

package/dist/session/types.js

@@ -248,6 +248,41 @@ export const RedactEventSchema = z
     count: z.number().int().nonnegative().default(0),
 })
     .passthrough();
+/**
+ * A session was REOPENED (#172 item 2) — `--resume` found this log and
+ * continued it.
+ *
+ * `meta` is written once and never again, on purpose: it records where and when
+ * the conversation BEGAN, and a second copy written from wherever it was
+ * resumed would make "the session's directory" ambiguous. That ruling stands.
+ * Its consequence was that a resume left no trace at all — a session started in
+ * one directory and continued in another looked, from the file, as though it
+ * had only ever run in the first.
+ *
+ * This event closes that without touching `meta`'s authority. `meta.cwd` is
+ * still where the conversation began; `resumed.cwd` is somewhere it has since
+ * run. A reader can tell the two apart because they are different kinds.
+ *
+ * SCOPE, stated because the obvious next step is deliberately NOT taken here:
+ * this makes a cross-directory resume AUDITABLE, not DISCOVERABLE. The file
+ * still lives under `projectKey(meta.cwd)`, and `listSessions` for the other
+ * directory does one `readdir` of its own project dir and will never see it.
+ * Surfacing it there needs a pointer written into the second directory, or a
+ * scan across every project — a separate decision with a real cost, not a
+ * side effect of recording the fact.
+ */
+export const ResumedEventSchema = z
+    .object({
+    kind: z.literal("resumed"),
+    at: z.string(),
+    /** The primary root the session was resumed INTO. */
+    cwd: z.string(),
+    /** Roots declared on the resuming run — multi-root can differ per run. */
+    roots: z.array(RootRefSchema).default([]),
+    /** The build that reopened it; a session can outlive several. */
+    cliVersion: z.string().optional(),
+})
+    .passthrough();
 /** Every event, discriminated on `kind`. */
 export const SessionEventSchema = z.discriminatedUnion("kind", [
     SessionMetaSchema,
@@ -258,4 +293,14 @@ export const SessionEventSchema = z.discriminatedUnion("kind", [
     SessionModeEventSchema,
     UsageEventSchema,
     RedactEventSchema,
+    ResumedEventSchema,
 ]);
+/**
+ * Every `kind` this build understands, derived from the union itself so the two
+ * cannot drift.
+ *
+ * This exists so the reader can tell "a line I do not understand" from "a line
+ * that is damaged" — see `replay.ts`. Those are different facts about a file and
+ * they used to be counted as one.
+ */
+export const KNOWN_EVENT_KINDS = new Set(SessionEventSchema.options.map((option) => option.shape.kind.value));

package/dist/tui/limits-panel.js

@@ -241,6 +241,15 @@ export function limitsPanelLines(theme, state, now = Date.now()) {
         switch (state.reason) {
             case "unauthenticated":
                 return [theme.muted("not signed in"), theme.muted("run cruxy login")];
+            case "expired":
+                // The same remedy as "not signed in", but a different fact — and the
+                // fact is the point. "Sign-in expired" tells someone their setup was
+                // right and simply aged out; "not signed in" invites them to go looking
+                // for what they configured wrong.
+                return [
+                    theme.warning("sign-in expired"),
+                    theme.muted("run cruxy login"),
+                ];
             case "unsupported":
                 // The gateway answered — it simply has no limits to report. Sending this
                 // user to debug their network would be the wrong errand entirely.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cruxy/cli",
-  "version": "1.8.0",
+  "version": "1.9.0",
   "description": "an agentic coding CLI",
   "type": "module",
   "bin": {
@@ -36,7 +36,7 @@
     "undici": "^6.21.0",
     "zod": "^3.23.8",
     "zod-to-json-schema": "^3.23.5",
-    "@cruxy/sdk": "0.6.0"
+    "@cruxy/sdk": "0.7.0"
   },
   "optionalDependencies": {
     "better-sqlite3": "^12.11.1"