@mafdet/cli 0.4.3 → 0.4.4

package/dist/tui/app.js

@@ -6,6 +6,7 @@
 // picker (CLI-020) and the agent surface (CLI-021) attach after onboarding.
 import { existsSync } from "node:fs";
 import { ExitCode } from "../output/exit-codes.js";
+import { loadConfig } from "../config/load.js";
 import { loadCatalogue, saveDefaultModel } from "./adapters/models.js";
 import { renderBanner } from "./banner.js";
 import { keyboard } from "./input.js";
@@ -16,11 +17,24 @@ import { palette, detectCapabilities, } from "./theme.js";
 import { followResize } from "./resize.js";
 import { installTerminalGuard } from "./terminal.js";
 import { inspectWorkspace, renderWorkspaceSummary, } from "./workspace-summary.js";
-import { parsePermissions, parseSessionOptions, startAgent, } from "./start-agent.js";
+import { checkTuiArguments, parsePermissions, parseSessionOptions, startAgent, TuiArgumentError, TUI_FLAGS, } from "./start-agent.js";
 import { sessionsDir } from "../config/paths.js";
 import { chooseSession } from "./session-centre.js";
 import { select } from "./widgets.js";
 export async function runTui(options) {
+    // F-014 · Before anything is drawn: a mistyped flag or a `--title` with no
+    // value used to start a session that quietly did something else.
+    try {
+        checkTuiArguments(options.argv);
+    }
+    catch (error) {
+        if (error instanceof TuiArgumentError) {
+            options.stdout.write(`mafdet: ${error.message}\n`);
+            options.stdout.write(`Supported here: ${TUI_FLAGS.join(", ")}\n`);
+            return ExitCode.Usage;
+        }
+        throw error;
+    }
     // Live, not a snapshot: a window resized mid-session must not keep laying
     // out for the width it used to be.
     const live = followResize(detectCapabilities({
@@ -123,7 +137,9 @@ export async function runTui(options) {
             stdout: options.stdout,
             commandIo: options.commandIo,
             apiKey: auth.apiKey,
-            model: chosen,
+            model: chosen.model,
+            catalogue: chosen.catalogue,
+            agentCapableModels: chosen.agentCapable,
             workspace: options.workspace,
             permissions: parsePermissions(options.argv),
             session: {
@@ -143,12 +159,21 @@ export async function runTui(options) {
         guard.release();
     }
 }
-/**
- * Pick a model, then offer to remember it.
- *
- * Only the model id is ever persisted. The key stays in memory for the life of
- * the process, which is the promise onboarding made.
- */
+/** The model the whole precedence chain settles on: flag > env > project > user. */
+function resolvedDefaultModel(options) {
+    try {
+        return loadConfig({
+            env: options.commandIo.env,
+            cwd: options.commandIo.cwd,
+            userConfigFile: options.commandIo.userConfigFile,
+        }).model;
+    }
+    catch {
+        // A broken config must not stop the picker from opening; it will be
+        // reported the moment anything actually needs the configuration.
+        return options.commandIo.env?.MAFDET_MODEL;
+    }
+}
 async function chooseModel(options) {
     const { dim, bold } = palette(options.capabilities);
     options.stdout.write(dim("  loading the model catalogue...\n"));
@@ -184,7 +209,11 @@ async function chooseModel(options) {
         // Fail closed: offer only agent-capable models when any exist, so a
         // model the agent cannot drive never becomes the session's default.
         agentOnly: catalogue.agentReady.length > 0,
-        current: options.commandIo.env?.MAFDET_MODEL,
+        // F-005 · The resolved model, not just the environment variable. After
+        // "Remember X as your default?" wrote X to the user config, the next
+        // launch still highlighted whatever MAFDET_MODEL said - usually nothing -
+        // so the setting the user had just agreed to appeared not to have worked.
+        current: resolvedDefaultModel(options),
     });
     if (picked.kind === "cancelled" || picked.model === undefined)
         return undefined;
@@ -213,5 +242,9 @@ async function chooseModel(options) {
             ? dim(`  saved to ${saved.path}\n`)
             : dim(`  could not save to ${saved.path}: ${saved.problem}\n`));
     }
-    return picked.model;
+    return {
+        model: picked.model,
+        catalogue: catalogue.chat,
+        agentCapable: catalogue.agentReady.map((m) => m.modelId),
+    };
 }

package/dist/tui/start-agent.d.ts

@@ -20,7 +20,27 @@ export interface AgentPermissions {
  * granting these and no second one to keep in step.
  */
 /** `--no-history` and `--title`, read off the bare invocation. */
+/** Every flag the bare `mafdet` invocation understands. */
+export declare const TUI_FLAGS: readonly ["--allow-write", "--read-only", "--allow-command", "--no-history", "--no-tui", "--resume", "--title"];
+export declare class TuiArgumentError extends Error {
+}
+/**
+ * F-014 · Refuse arguments we do not understand.
+ *
+ * `--title` with no value, or a mistyped `--reusme`, used to be dropped in
+ * silence: the session started, looked fine, and did something other than what
+ * was asked. That is worse than an error, because nothing tells the user.
+ */
+export declare function checkTuiArguments(argv: readonly string[]): void;
 export declare function parseSessionOptions(argv: readonly string[]): SessionOptions;
+/**
+ * F-004 · The same permission syntax as the command surface.
+ *
+ * `--read-only` existed only in `mafdet agent`, so `mafdet --allow-write
+ * --read-only` was read-only there and write-enabled here. A flag whose whole
+ * purpose is to take permission away must not be the one the TUI ignores, and
+ * last-flag-wins is the only ordering a user can reason about.
+ */
 export declare function parsePermissions(argv: readonly string[]): AgentPermissions;
 export interface StartAgentOptions {
     readonly io: WidgetIo;
@@ -32,6 +52,17 @@ export interface StartAgentOptions {
     readonly apiKey: string;
     readonly model: ResolvedModel;
     readonly workspace: string;
+    /**
+     * F-003 · Everything this key can reach.
+     *
+     * Passed in whole rather than as two id lists because a resumed session runs
+     * on its *own* recorded model, and that model needs its catalogue entry for
+     * pricing. Checking resume against only the model picked moments earlier was
+     * asking the wrong question: resume asks whether this key can still call the
+     * model the session was recorded with.
+     */
+    readonly catalogue?: readonly ResolvedModel[];
+    readonly agentCapableModels?: readonly string[];
     readonly permissions: AgentPermissions;
     readonly session?: SessionOptions;
     /**

package/dist/tui/start-agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start-agent.d.ts","sourceRoot":"","sources":["../../src/tui/start-agent.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEtE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAcnD,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;;;GAKG;AACH,kEAAkE;AAClE,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,CAqB3E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAe1E;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,WAAW,GAAG,SAAS,CAAC;CACpD;AAED,wBAAsB,UAAU,CAC9B,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,QAAQ,CAAC,CAkGnB"}
+{"version":3,"file":"start-agent.d.ts","sourceRoot":"","sources":["../../src/tui/start-agent.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAgB,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAEtE,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAenD,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;;;GAKG;AACH,kEAAkE;AAClE,2DAA2D;AAC3D,eAAO,MAAM,SAAS,iHAQZ,CAAC;AASX,qBAAa,gBAAiB,SAAQ,KAAK;CAAG;AAE9C;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAgB/D;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,cAAc,CAiB3E;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAgB1E;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C,QAAQ,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAClD,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,QAAQ,CAAC,WAAW,EAAE,gBAAgB,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,cAAc,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,WAAW,GAAG,SAAS,CAAC;CACpD;AAED,wBAAsB,UAAU,CAC9B,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,QAAQ,CAAC,CA8JnB"}

package/dist/tui/start-agent.js

@@ -16,6 +16,7 @@ import { SessionRecorder } from "../sessions/recorder.js";
 import { SessionWriter } from "../sessions/store.js";
 import { NOTICE_FILE, decideRecording, firstSaveNotice, } from "../sessions/policy.js";
 import { describeResume, openForResume } from "../sessions/open.js";
+import { describeBlocker } from "../sessions/resume.js";
 import { runAgentSurface } from "./agent-surface.js";
 import { palette } from "./theme.js";
 /**
@@ -25,24 +26,64 @@ import { palette } from "./theme.js";
  * granting these and no second one to keep in step.
  */
 /** `--no-history` and `--title`, read off the bare invocation. */
-export function parseSessionOptions(argv) {
-    let title;
+/** Every flag the bare `mafdet` invocation understands. */
+export const TUI_FLAGS = [
+    "--allow-write",
+    "--read-only",
+    "--allow-command",
+    "--no-history",
+    "--no-tui",
+    "--resume",
+    "--title",
+];
+/** The ones that consume the argument after them. */
+const TUI_FLAGS_WITH_VALUE = new Set([
+    "--allow-command",
+    "--resume",
+    "--title",
+]);
+export class TuiArgumentError extends Error {
+}
+/**
+ * F-014 · Refuse arguments we do not understand.
+ *
+ * `--title` with no value, or a mistyped `--reusme`, used to be dropped in
+ * silence: the session started, looked fine, and did something other than what
+ * was asked. That is worse than an error, because nothing tells the user.
+ */
+export function checkTuiArguments(argv) {
     for (let i = 0; i < argv.length; i += 1) {
-        if (argv[i] !== "--title")
+        const arg = argv[i];
+        if (!arg.startsWith("-")) {
+            throw new TuiArgumentError(`unexpected argument '${arg}'`);
+        }
+        if (!TUI_FLAGS.includes(arg)) {
+            throw new TuiArgumentError(`unknown option '${arg}'`);
+        }
+        if (!TUI_FLAGS_WITH_VALUE.has(arg))
             continue;
         const value = argv[i + 1];
-        if (value !== undefined && !value.startsWith("-")) {
-            title = value;
-            i += 1;
+        if (value === undefined || value.startsWith("-")) {
+            throw new TuiArgumentError(`${arg} needs a value`);
         }
+        i += 1;
     }
+}
+export function parseSessionOptions(argv) {
+    let title;
     let resumeId;
     for (let i = 0; i < argv.length; i += 1) {
-        if (argv[i] !== "--resume")
+        const arg = argv[i];
+        if (!TUI_FLAGS_WITH_VALUE.has(arg))
             continue;
         const value = argv[i + 1];
-        if (value !== undefined && !value.startsWith("-"))
+        if (value === undefined || value.startsWith("-"))
+            continue;
+        if (arg === "--title")
+            title = value;
+        if (arg === "--resume")
             resumeId = value;
+        i += 1;
     }
     return {
         noHistory: argv.includes("--no-history"),
@@ -50,6 +91,14 @@ export function parseSessionOptions(argv) {
         ...(resumeId === undefined ? {} : { resumeId }),
     };
 }
+/**
+ * F-004 · The same permission syntax as the command surface.
+ *
+ * `--read-only` existed only in `mafdet agent`, so `mafdet --allow-write
+ * --read-only` was read-only there and write-enabled here. A flag whose whole
+ * purpose is to take permission away must not be the one the TUI ignores, and
+ * last-flag-wins is the only ordering a user can reason about.
+ */
 export function parsePermissions(argv) {
     let allowWrite = false;
     const allowedCommands = [];
@@ -57,6 +106,8 @@ export function parsePermissions(argv) {
         const arg = argv[i];
         if (arg === "--allow-write")
             allowWrite = true;
+        else if (arg === "--read-only")
+            allowWrite = false;
         else if (arg === "--allow-command") {
             const value = argv[i + 1];
             if (value !== undefined && !value.startsWith("-")) {
@@ -69,15 +120,6 @@ export function parsePermissions(argv) {
 }
 export async function startAgent(options) {
     const { dim, bold } = palette(options.capabilities);
-    let workspace;
-    try {
-        workspace = Workspace.open(options.workspace);
-    }
-    catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        options.stdout.write(`\n  ${bold("cannot use this directory")}: ${message}\n`);
-        return ExitCode.General;
-    }
     // The TUI is interactive by construction, so `--allow-write` can be honoured
     // here without the non-interactive downgrade the command surface applies.
     const mode = options.permissions.allowWrite ? "suggest" : "read-only";
@@ -96,10 +138,13 @@ export async function startAgent(options) {
             root: sessionsDir(options.commandIo.env ?? process.env),
             sessionId: options.session.resumeId,
             systemPrompt: mode === "read-only" ? READ_ONLY_PROMPT : WRITE_PROMPT,
-            callable: [options.model.modelId],
-            agentCapable: options.model.agentEligible
-                ? [options.model.modelId]
-                : [],
+            // F-003 · The whole set this key can call, not just the model that
+            // happened to be picked before the session was chosen. Checking
+            // against a one-element set made every resume of a different model
+            // look unavailable, and told the user the wrong thing about why.
+            callable: (options.catalogue ?? [options.model]).map((m) => m.modelId),
+            agentCapable: options.agentCapableModels ??
+                (options.model.agentEligible ? [options.model.modelId] : []),
             allowedCommandsThisRun: options.permissions.allowedCommands,
         })
         : undefined;
@@ -111,6 +156,44 @@ export async function startAgent(options) {
     }
     if (opened !== undefined)
         options.stdout.write(dim(describeResume(opened)));
+    // F-003 · A blocker used to be printed and then ignored, so a resume with an
+    // uncallable model or a deleted workspace started anyway. Resuming into a
+    // different directory is the worst of them: with writing enabled the agent
+    // would carry one project's context into another project's files.
+    if (opened !== undefined && opened.blockers.length > 0) {
+        options.stdout.write(`\n  ${bold("cannot continue this conversation yet")}:\n` +
+            opened.blockers
+                .map((blocker) => `    - ${describeBlocker(blocker)}\n`)
+                .join("") +
+            `\n  You can still read it with 'mafdet sessions show ${options.session?.resumeId ?? ""}'.\n\n`);
+        opened.writer.close();
+        opened.lock.release();
+        return ExitCode.General;
+    }
+    // F-003 · A resumed session runs where it was recorded and on the model it
+    // was recorded with. Continuing project A's conversation against project B's
+    // files is how an agent with write access edits the wrong repository - and
+    // it used to be the default, because the workspace came from the cwd.
+    const effectiveWorkspace = opened === undefined ? options.workspace : opened.metadata.workspace;
+    const effectiveModel = opened === undefined
+        ? options.model
+        : ((options.catalogue ?? []).find((m) => m.modelId === opened.metadata.model_id) ?? options.model);
+    let workspace;
+    try {
+        workspace = Workspace.open(effectiveWorkspace);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        options.stdout.write(`\n  ${bold("cannot use this directory")}: ${message}\n`);
+        if (opened !== undefined) {
+            opened.writer.close();
+            opened.lock.release();
+        }
+        return ExitCode.General;
+    }
+    if (opened !== undefined && effectiveWorkspace !== options.workspace) {
+        options.stdout.write(dim(`  continuing in ${effectiveWorkspace}, where it was recorded\n`));
+    }
     const recorder = opened !== undefined
         ? new SessionRecorder({
             writer: opened.writer,
@@ -119,32 +202,51 @@ export async function startAgent(options) {
             onProblem: (message) => void options.stdout.write(dim(`  ${message}\n`)),
         })
         : startRecording(options, mode);
-    await runAgentSurface({
-        io: options.io,
-        ...(recorder === undefined ? {} : { recorder }),
-        capabilities: options.capabilities,
-        stdout: options.stdout,
-        ...(options.getSignal === undefined
-            ? {}
-            : { getSignal: options.getSignal }),
-        session: {
-            client: runtime.dataPlane,
-            model: options.model.modelId,
-            pricing: options.model,
-            catalog: [options.model],
-            systemPrompt: mode === "read-only" ? READ_ONLY_PROMPT : WRITE_PROMPT,
-            tools: buildToolset(mode, hasCommands),
-            toolContext: {
-                workspace,
+    // F-015 · The resume lock lives for exactly the run that holds it. It used
+    // to be taken and never released, so the lock file survived until the next
+    // process judged the pid dead - and on a shared filesystem, where the
+    // recorded hostname differs, `isStale` never reclaims it at all and the
+    // session is locked forever. The finally covers a normal exit, a Ctrl+C that
+    // unwinds through here, and a throw.
+    try {
+        await runAgentSurface({
+            io: options.io,
+            ...(recorder === undefined ? {} : { recorder }),
+            capabilities: options.capabilities,
+            stdout: options.stdout,
+            ...(options.getSignal === undefined
+                ? {}
+                : { getSignal: options.getSignal }),
+            session: {
+                client: runtime.dataPlane,
+                model: effectiveModel.modelId,
+                pricing: effectiveModel,
+                catalog: options.catalogue ?? [effectiveModel],
+                systemPrompt: mode === "read-only" ? READ_ONLY_PROMPT : WRITE_PROMPT,
+                tools: buildToolset(mode, hasCommands),
+                toolContext: {
+                    workspace,
+                    allowedCommands: options.permissions.allowedCommands,
+                },
+                mode,
+                // The rebuilt conversation, or nothing for a new session. runSession
+                // appends to this array in place, which is what continues the thread.
+                ...(opened === undefined ? {} : { history: opened.messages }),
                 allowedCommands: options.permissions.allowedCommands,
             },
-            mode,
-            // The rebuilt conversation, or nothing for a new session. runSession
-            // appends to this array in place, which is what continues the thread.
-            ...(opened === undefined ? {} : { history: opened.messages }),
-            allowedCommands: options.permissions.allowedCommands,
-        },
-    });
+        });
+    }
+    finally {
+        if (opened !== undefined) {
+            try {
+                opened.writer.close();
+            }
+            catch {
+                // Closing is bookkeeping; nothing depends on it succeeding.
+            }
+            opened.lock.release();
+        }
+    }
     return ExitCode.Ok;
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mafdet/cli",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Mafdet AI command line — model calls, account queries, and a permissioned local agent.",
   "type": "module",
   "license": "MIT",