@mafdet/cli 0.4.3 → 0.4.5

package/dist/commands/sessions.js

@@ -11,14 +11,15 @@ import { sessionsDir } from "../config/paths.js";
 import { formatUsd } from "../output/money.js";
 import { ExitCode } from "../output/exit-codes.js";
 import { parseFormatFlags, renderJson, renderRecord, renderTable, } from "../output/format.js";
+import { safeForTerminal } from "../output/terminal-safe.js";
 import { keyDigest } from "../security/redact.js";
 import { loadIndex, removeIndexEntry } from "../sessions/index-file.js";
 import { acquireSessionLock, SessionLockedError } from "../sessions/lock.js";
 import { daysToCover, matchSettlements, planReconciliation, } from "../sessions/reconcile.js";
+import { InvalidSessionIdError, resolveSessionDirectory, } from "../sessions/session-id.js";
 import { deleteSession, readSession, SessionWriter, } from "../sessions/store.js";
 import { settledCaveat, summariseUsage } from "../sessions/usage.js";
 import { buildRuntime, reportError, requireApiKey, } from "./runtime.js";
-import { join } from "node:path";
 const USAGE = `Usage:
   mafdet sessions list [--json|--plain]
   mafdet sessions show <session-id> [--json]
@@ -32,6 +33,18 @@ calls a model and is never charged.
 cost. It sends request IDs and nothing else - no messages, no titles.
 `;
 export async function sessionsCommand(argv, io) {
+    // F-013 · Nothing here may reach the top level as a raw Error. `--json
+    // --plain` used to print an ESM stack trace and exit 1 instead of a usage
+    // message, and every other command surface already funnels through
+    // reportError.
+    try {
+        return await run(argv, io);
+    }
+    catch (error) {
+        return reportError(error, io);
+    }
+}
+async function run(argv, io) {
     const [sub, ...rest] = argv;
     const root = sessionsDir(io.env ?? process.env);
     if (sub === undefined || sub === "help" || sub === "--help") {
@@ -50,7 +63,13 @@ export async function sessionsCommand(argv, io) {
     return ExitCode.Usage;
 }
 function list(argv, io, root) {
-    const { format } = parseFormatFlags(argv);
+    const { format, rest } = parseFormatFlags(argv);
+    // R-7 · `list` was the one subcommand that threw its leftovers away, so
+    // `sessions list --dry-run` exited 0 and listed everything.
+    if (rest.length > 0) {
+        io.stderr(`mafdet sessions list: unexpected argument '${rest[0]}'\n${USAGE}`);
+        return ExitCode.Usage;
+    }
     const { sessions } = loadIndex(root);
     if (format === "json") {
         io.stdout(renderJson({
@@ -67,26 +86,38 @@ function list(argv, io, root) {
         return ExitCode.Ok;
     }
     io.stdout(renderTable(sessions, [
-        { header: "SESSION", value: (s) => s.session_id },
-        { header: "TITLE", value: (s) => s.title },
-        { header: "MODEL", value: (s) => s.model_id },
+        // F-010 · Every one of these came off disk. A transcript is a file, and
+        // a title carrying an OSC sequence would retitle the window of anyone
+        // who ran `sessions list`.
+        { header: "SESSION", value: (s) => safe(s.session_id, io) },
+        { header: "TITLE", value: (s) => safe(s.title, io) },
+        { header: "MODEL", value: (s) => safe(s.model_id, io) },
         { header: "REQUESTS", value: (s) => `${s.model_requests}` },
         {
             header: "EST. COST",
-            value: (s) => formatUsd(s.estimated_charge_micro_usd),
+            // R-6 · An unpriced session is not a free one. `$0.00` in the main
+            // column is the claim that matters; a note on stderr cannot correct
+            // a number the user has already read.
+            value: (s) => s.unpriced_requests
+                ? "unknown"
+                : formatUsd(s.estimated_charge_micro_usd),
         },
         { header: "UPDATED", value: (s) => s.updated_at },
     ]));
     return ExitCode.Ok;
 }
 function show(argv, io, root) {
-    const { format } = parseFormatFlags(argv);
-    const id = argv.find((arg) => !arg.startsWith("-"));
+    const { format, rest } = parseFormatFlags(argv);
+    const id = rest[0];
     if (id === undefined) {
         io.stderr(`mafdet sessions show: no session id\n${USAGE}`);
         return ExitCode.Usage;
     }
-    const directory = join(root, id);
+    if (!checkExtra("show", rest, io))
+        return ExitCode.Usage;
+    const directory = locate(root, id, io);
+    if (directory === undefined)
+        return ExitCode.Usage;
     if (!existsSync(directory)) {
         io.stderr(`mafdet sessions: no session '${id}' on this computer\n`);
         return ExitCode.General;
@@ -104,37 +135,59 @@ function show(argv, io, root) {
             metadata: session.metadata,
             events: session.events,
             truncated_tail: session.truncatedTail,
+            corrupt_lines: session.corruptLines,
         }));
         return ExitCode.Ok;
     }
     const m = session.metadata;
     io.stdout(renderRecord([
-        ["session", m.session_id],
-        ["title", m.title],
-        ["model", m.model_id],
-        ["workspace", m.workspace],
-        ["mode", m.mode],
-        ["created", m.created_at],
-        ["updated", m.updated_at],
+        ["session", safe(m.session_id, io)],
+        ["title", safe(m.title, io)],
+        ["model", safe(m.model_id, io)],
+        ["workspace", safe(m.workspace, io)],
+        ["mode", safe(m.mode, io)],
+        // R-4 · Timestamps come off disk like everything else here; a file that
+        // has been edited can carry a sequence in any field, not only the
+        // free-text ones.
+        ["created", safe(m.created_at, io)],
+        ["updated", safe(m.updated_at, io)],
         ["messages", `${m.message_count}`],
         ["model requests", `${m.model_requests}`],
         ["tokens", `${m.prompt_tokens} in / ${m.completion_tokens} out`],
-        ["estimated cost", formatUsd(m.estimated_charge_micro_usd)],
+        [
+            "estimated cost",
+            m.unpriced_requests
+                ? `${formatUsd(m.estimated_charge_micro_usd)} + ${m.unpriced_requests} unpriced`
+                : formatUsd(m.estimated_charge_micro_usd),
+        ],
     ]));
     if (session.truncatedTail) {
         // Worth saying plainly: the user should know a crash cost them the tail.
         io.stderr("\nnote: the last event was incomplete, most likely an interrupted run.\n");
     }
+    if (session.corruptLines.length > 0) {
+        // F-016 · A hole in the middle is not an interrupted run - it is
+        // corruption or interleaved writes, and part of the conversation is
+        // simply gone. Presenting the rest as complete would be a lie.
+        io.stderr(`\nwarning: ${session.corruptLines.length} unreadable line(s) in this ` +
+            `transcript (line ${session.corruptLines.join(", ")}); ` +
+            `some of the conversation is missing.\n`);
+    }
     return ExitCode.Ok;
 }
 function remove(argv, io, root) {
-    const id = argv.find((arg) => !arg.startsWith("-"));
+    const { rest } = parseFormatFlags(argv);
+    const id = rest[0];
     const confirmed = argv.includes("--yes");
     if (id === undefined) {
         io.stderr(`mafdet sessions delete: no session id\n${USAGE}`);
         return ExitCode.Usage;
     }
-    const directory = join(root, id);
+    if (!checkExtra("delete", rest, io, ["--yes"]))
+        return ExitCode.Usage;
+    const directory = locate(root, id, io);
+    if (directory === undefined)
+        return ExitCode.Usage;
     if (!existsSync(directory)) {
         io.stderr(`mafdet sessions: no session '${id}' on this computer\n`);
         return ExitCode.General;
@@ -146,11 +199,84 @@ function remove(argv, io, root) {
         io.stderr(DELETION_NOTICE(id));
         return ExitCode.Usage;
     }
-    deleteSession(directory);
+    // F-002 · Under the lock: a session open in another window is still writing
+    // to this directory, and deleting underneath it leaves the live process to
+    // recreate half a session.
+    let lock;
+    try {
+        lock = acquireSessionLock(directory);
+    }
+    catch (error) {
+        // Not only SessionLockedError: an unwritable directory throws EACCES here,
+        // and letting that escape would print a Node stack trace at the user.
+        io.stderr(`mafdet sessions: cannot delete ${id}: ${error instanceof Error ? error.message : String(error)}\n`);
+        return ExitCode.General;
+    }
+    let result;
+    try {
+        result = deleteSession(directory);
+    }
+    finally {
+        // The lock file lives inside the directory, so a successful delete already
+        // took it with it; releasing is for the failure path.
+        try {
+            lock.release();
+        }
+        catch {
+            // Gone with the directory.
+        }
+    }
+    if (!result.removed) {
+        // F-002 · Never print "deleted" for something still on disk.
+        io.stderr(`mafdet sessions: ${id} was not fully deleted\n`);
+        for (const failure of result.failures) {
+            io.stderr(`  ${failure.path}: ${failure.reason}\n`);
+        }
+        // The index is rebuilt from the directories, so leaving the entry keeps
+        // the listing honest about what is still there.
+        return ExitCode.General;
+    }
     removeIndexEntry(root, id);
     io.stdout(`deleted ${id}\n`);
     return ExitCode.Ok;
 }
+/**
+ * F-001 · Turn an id into a directory, or say why not.
+ *
+ * The single boundary: `show`, `usage` and `delete` all come through here, so
+ * there is no subcommand left that can build the path its own way. Returns
+ * undefined after reporting, because every caller's response is the same.
+ */
+/**
+ * F-014 · Refuse what we were not asked to do.
+ *
+ * A mistyped flag or a stray second argument used to be dropped silently, so
+ * `sessions delete a b --yes` deleted `a` and said nothing about `b`, and
+ * `--dry-run` looked like it worked. Anything not recognised is an error.
+ */
+/** F-010 · Terminal-safe when a terminal is reading, exact bytes otherwise. */
+function safe(text, io) {
+    return safeForTerminal(text, io.isTty ?? process.stdout.isTTY === true);
+}
+function checkExtra(name, rest, io, known = []) {
+    const leftover = rest.slice(1).filter((arg) => !known.includes(arg));
+    if (leftover.length === 0)
+        return true;
+    io.stderr(`mafdet sessions ${name}: unexpected argument '${leftover[0]}'\n${USAGE}`);
+    return false;
+}
+function locate(root, id, io) {
+    try {
+        return resolveSessionDirectory(root, id);
+    }
+    catch (error) {
+        if (error instanceof InvalidSessionIdError) {
+            io.stderr(`mafdet sessions: ${error.message}\n`);
+            return undefined;
+        }
+        throw error;
+    }
+}
 export const DELETION_NOTICE = (id) => `Deleting ${id} removes local messages and its per-session usage mapping\n` +
     `from this computer.\n\n` +
     `It does not remove API usage, billing records, or charges.\n\n` +
@@ -170,13 +296,17 @@ export const DELETION_NOTICE = (id) => `Deleting ${id} removes local messages an
  * would be a smaller number than the truth.
  */
 async function usage(argv, io, root) {
-    const { format } = parseFormatFlags(argv);
-    const id = argv.find((arg) => !arg.startsWith("-"));
+    const { format, rest } = parseFormatFlags(argv);
+    const id = rest[0];
     if (id === undefined) {
         io.stderr(`mafdet sessions usage: no session id\n${USAGE}`);
         return ExitCode.Usage;
     }
-    const directory = join(root, id);
+    if (!checkExtra("usage", rest, io, ["--refresh"]))
+        return ExitCode.Usage;
+    const directory = locate(root, id, io);
+    if (directory === undefined)
+        return ExitCode.Usage;
     if (!existsSync(directory)) {
         io.stderr(`mafdet sessions: no session '${id}' on this computer\n`);
         return ExitCode.General;
@@ -211,6 +341,8 @@ async function usage(argv, io, root) {
             completion_tokens: totals.completionTokens,
             // Strings, so no parser turns a charge into a float.
             estimated_charge_micro_usd: totals.estimatedMicroUsd.toString(),
+            // R-6 · Without this a consumer reads the total above as complete.
+            unpriced_requests: totals.unpricedRequests,
             settled_charge_micro_usd: totals.settledMicroUsd.toString(),
             by_settlement: totals.bySettlement,
             by_model: totals.byModel.map((m) => ({
@@ -237,7 +369,12 @@ async function usage(argv, io, root) {
             `${totals.toolRuns}${totals.toolRunsRefused > 0 ? ` (${totals.toolRunsRefused} refused)` : ""}`,
         ],
         ["tokens", `${totals.promptTokens} in / ${totals.completionTokens} out`],
-        ["local estimate", formatUsd(totals.estimatedMicroUsd.toString())],
+        [
+            "local estimate",
+            totals.unpricedRequests > 0
+                ? `${formatUsd(totals.estimatedMicroUsd.toString())} + ${totals.unpricedRequests} unpriced`
+                : formatUsd(totals.estimatedMicroUsd.toString()),
+        ],
     ];
     if (totals.bySettlement.settled > 0) {
         rows.push([
@@ -255,7 +392,7 @@ async function usage(argv, io, root) {
     if (totals.byModel.length > 1) {
         io.stdout("\nBy model\n");
         io.stdout(renderTable(totals.byModel, [
-            { header: "MODEL", value: (m) => m.modelId },
+            { header: "MODEL", value: (m) => safe(m.modelId, io) },
             { header: "REQUESTS", value: (m) => `${m.modelRequests}` },
             {
                 header: "ESTIMATE",
@@ -267,7 +404,7 @@ async function usage(argv, io, root) {
         // Split per key so two accounts' spending is never presented as one.
         io.stdout("\nBy API key\n");
         io.stdout(renderTable(totals.byKey, [
-            { header: "KEY", value: (k) => k.apiKeyRef },
+            { header: "KEY", value: (k) => safe(k.apiKeyRef, io) },
             { header: "REQUESTS", value: (k) => `${k.modelRequests}` },
             {
                 header: "ESTIMATE",

package/dist/config/config.d.ts

@@ -6,20 +6,9 @@ export declare class ConfigError extends Error {
 }
 declare const projectConfigSchema: z.ZodObject<{
     model: z.ZodOptional<z.ZodString>;
-    approvalMode: z.ZodOptional<z.ZodEnum<{
-        "read-only": "read-only";
-        suggest: "suggest";
-        "auto-edit": "auto-edit";
-    }>>;
-    testCommands: z.ZodOptional<z.ZodArray<z.ZodString>>;
 }, z.core.$strict>;
 declare const userConfigSchema: z.ZodObject<{
     model: z.ZodOptional<z.ZodString>;
-    approvalMode: z.ZodOptional<z.ZodEnum<{
-        "read-only": "read-only";
-        suggest: "suggest";
-        "auto-edit": "auto-edit";
-    }>>;
     baseUrl: z.ZodOptional<z.ZodString>;
     backendUrl: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
@@ -48,7 +37,6 @@ export interface ResolvedConfig {
     modelSource: "flag" | "env" | "project" | "user" | "none";
     baseUrl: string;
     backendUrl: string;
-    approvalMode: "read-only" | "suggest" | "auto-edit";
     apiKey?: string;
 }
 /** Plan §5.1: flag > env > project > user > default. */

package/dist/config/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAK5B;AAYD,QAAA,MAAM,mBAAmB;;;;;;;;kBAMd,CAAC;AAEZ,QAAA,MAAM,gBAAgB;;;;;;;;;kBAOX,CAAC;AAEZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,CAczE;AAOD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAWxE;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,GACb,aAAa,CAcf;AAED,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,WAAW,GAAG,SAAS,GAAG,WAAW,CAAC;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wDAAwD;AACxD,wBAAgB,aAAa,CAAC,KAAK,GAAE,YAAiB,GAAG,cAAc,CAiCtE"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,eAAO,MAAM,gBAAgB,6BAA6B,CAAC;AAC3D,eAAO,MAAM,mBAAmB,8BAA8B,CAAC;AAE/D,qBAAa,WAAY,SAAQ,KAAK;gBACxB,OAAO,EAAE,MAAM;CAK5B;AAoCD,QAAA,MAAM,mBAAmB;;kBAId,CAAC;AAEZ,QAAA,MAAM,gBAAgB;;;;kBAMX,CAAC;AAUZ,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAChE,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,GAAG,CAczE;AAOD,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAWxE;AAED,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,OAAO,EACZ,MAAM,EAAE,MAAM,GACb,aAAa,CAef;AAED,MAAM,WAAW,YAAY;IAC3B,4CAA4C;IAC5C,KAAK,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,IAAI,CAAC,EAAE,UAAU,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,WAAW,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wDAAwD;AACxD,wBAAgB,aAAa,CAAC,KAAK,GAAE,YAAiB,GAAG,cAAc,CA8BtE"}

package/dist/config/config.js

@@ -16,22 +16,48 @@ export class ConfigError extends Error {
  * silently dropping them would hide an attempt to redirect traffic.
  */
 const FORBIDDEN_IN_PROJECT = ["apiKey", "baseUrl", "backendUrl"];
-const approvalMode = z.enum(["read-only", "suggest", "auto-edit"]);
+/**
+ * F-006 · Accepted, displayed, and never read by anything.
+ *
+ * `approvalMode` and `testCommands` were in the schema, in `config list` and
+ * in the README, and no code consulted either - so a user could set
+ * `approvalMode: "auto-edit"` and believe approval had been turned off.
+ *
+ * They are removed rather than wired up, and the reason is not effort. Both
+ * are permission-granting settings, and in a project file that means a cloned
+ * repository raising its own permission level: `.mafdet.json` asking for
+ * `auto-edit`, or listing its own `testCommands` to run. §8.3 already refuses
+ * a global approval flag, and CLI-003 already treats a repository as
+ * untrusted input - honouring these would undo both.
+ *
+ * Rejected with an explanation rather than ignored, so anyone who set one
+ * finds out it never did what they thought.
+ */
+const REMOVED_KEYS = {
+    approvalMode: "it was never implemented, and a config file may not raise the approval " +
+        "level - use --allow-write for this run",
+    testCommands: "it was never implemented, and a config file may not grant command " +
+        "execution - use --allow-command for this run",
+};
 const projectConfigSchema = z
     .object({
     model: z.string().min(1).optional(),
-    approvalMode: approvalMode.optional(),
-    testCommands: z.array(z.string().min(1)).optional(),
 })
     .strict();
 const userConfigSchema = z
     .object({
     model: z.string().min(1).optional(),
-    approvalMode: approvalMode.optional(),
     baseUrl: z.string().url().optional(),
     backendUrl: z.string().url().optional(),
 })
     .strict();
+function rejectRemoved(raw, source) {
+    for (const [key, why] of Object.entries(REMOVED_KEYS)) {
+        if (hasKey(raw, key)) {
+            throw new ConfigError(`${source} sets '${key}': ${why}.`);
+        }
+    }
+}
 /**
  * Remote endpoints must be HTTPS. Plain HTTP is allowed only against the local
  * machine, where there is no network to intercept — that exception exists so a
@@ -72,6 +98,7 @@ export function parseProjectConfig(raw, source) {
                 `Credentials and endpoints come from the environment or your user config only.`);
         }
     }
+    rejectRemoved(raw, source);
     const parsed = projectConfigSchema.safeParse(raw);
     if (!parsed.success) {
         throw new ConfigError(`${source} is invalid: ${issueText(parsed.error)}`);
@@ -99,8 +126,6 @@ export function resolveConfig(input = {}) {
         modelSource,
         baseUrl,
         backendUrl,
-        // read-only is the safe default; a caller raises it explicitly.
-        approvalMode: input.project?.approvalMode ?? input.user?.approvalMode ?? "read-only",
         // The key is environment-only, by design (plan §5.4): a flag would put it
         // in shell history and the process list, a file would outlive its use.
         apiKey: trimmed(env.MAFDET_API_KEY),

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAeA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAmDlD,wBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyGpE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAeA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAmElD,wBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAyGpE"}

package/dist/index.js

@@ -27,8 +27,10 @@ const HELP = `mafdet - Mafdet AI command line
 Usage:
   mafdet <command> [options]
 
+Run with no arguments in a terminal to open an interactive session.
+
 Commands:
-  agent             Inspect the workspace with a model (read-only)
+  agent             Work in this directory with a model
   chat              Send a prompt to a model
   embed             Turn text into a vector
   speech            Turn text into an audio file
@@ -39,6 +41,7 @@ Commands:
   account subscription  Current plan and Playground allowance
   sessions list     Conversations saved on this computer
   sessions show     One saved conversation in detail
+  sessions usage    What one conversation used, and what it was charged
   sessions delete   Remove a saved conversation from this computer
   config list       Show the resolved settings and where each came from
   doctor            Check key, endpoints, model, balance and workspace
@@ -49,6 +52,19 @@ Options:
   -h, --help        Show this help
   -v, --version     Print the version
 
+Interactive session (bare 'mafdet'):
+  --allow-write     Offer file changes, each shown as a diff and approved
+  --allow-command <prefix>  Allow one command prefix, approved per run
+  --read-only       Cancel an earlier --allow-write
+  --resume <id>     Continue a saved conversation
+  --title <text>    Name this conversation in the listing
+  --no-history      Do not record this run at all
+  --no-tui          Do not open the interactive session
+
+The agent is read-only unless told otherwise, every file change is shown as a
+diff and approved one at a time, and there is no flag that approves
+everything in advance.
+
 Docs: https://docs.mafdet.ai
 `;
 async function readStdin() {

package/dist/output/format.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/output/format.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAiBrE;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEjD;AAED,MAAM,WAAW,MAAM,CAAC,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,wBAAgB,WAAW,CAAC,CAAC,EAC3B,IAAI,EAAE,SAAS,CAAC,EAAE,EAClB,OAAO,EAAE,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE,GAC5B,MAAM,CAoBR;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAC3B,IAAI,EAAE,SAAS,CAAC,EAAE,EAClB,OAAO,EAAE,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE,GAC5B,MAAM,CAOR;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,GAC9C,MAAM,CAOR"}
+{"version":3,"file":"format.d.ts","sourceRoot":"","sources":["../../src/output/format.ts"],"names":[],"mappings":"AAGA;;;GAGG;AAEH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,YAAY,CAAC;IACrB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAwBrE;AAED,sDAAsD;AACtD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEjD;AAED,MAAM,WAAW,MAAM,CAAC,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CAC1B;AAED,wBAAgB,WAAW,CAAC,CAAC,EAC3B,IAAI,EAAE,SAAS,CAAC,EAAE,EAClB,OAAO,EAAE,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE,GAC5B,MAAM,CAoBR;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAC3B,IAAI,EAAE,SAAS,CAAC,EAAE,EAClB,OAAO,EAAE,SAAS,MAAM,CAAC,CAAC,CAAC,EAAE,GAC5B,MAAM,CAOR;AAED,wBAAgB,YAAY,CAC1B,OAAO,EAAE,SAAS,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,GAC9C,MAAM,CAOR"}

package/dist/output/format.js

@@ -1,7 +1,5 @@
-/**
- * Rendering for query commands. Three shapes, one rule: stdout carries the
- * result and nothing else, so `mafdet ... --json | jq` is always valid.
- */
+import { ApiError } from "../api/errors.js";
+import { ExitCode } from "./exit-codes.js";
 /** `--json` and `--plain` are mutually exclusive; table is the default. */
 export function parseFormatFlags(argv) {
     const rest = [];
@@ -10,7 +8,14 @@ export function parseFormatFlags(argv) {
     for (const arg of argv) {
         if (arg === "--json" || arg === "--plain") {
             if (chosen && chosen !== arg) {
-                throw new Error(`${chosen} and ${arg} cannot be combined`);
+                // F-013 · A typed error, so the command surface turns this into a
+                // usage message and exit 2. A bare Error escaped to the top level and
+                // printed a Node stack trace at the user.
+                throw new ApiError({
+                    kind: "request",
+                    exitCode: ExitCode.Usage,
+                    message: `${chosen} and ${arg} cannot be combined`,
+                });
             }
             chosen = arg;
             format = arg === "--json" ? "json" : "plain";

package/dist/output/terminal-safe.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Make untrusted text safe to print, when and only when a terminal will read
+ * it.
+ *
+ * `isTty` is passed in rather than read from `process.stdout` so that the
+ * decision is testable and so a caller writing somewhere else cannot get the
+ * wrong answer by accident.
+ */
+export declare function safeForTerminal(text: string, isTty: boolean): string;
+/** Wrap a writer so everything through it is sanitised for a terminal. */
+export declare function terminalSafeWriter(write: (text: string) => void, isTty: boolean): (text: string) => void;
+//# sourceMappingURL=terminal-safe.d.ts.map

package/dist/output/terminal-safe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terminal-safe.d.ts","sourceRoot":"","sources":["../../src/output/terminal-safe.ts"],"names":[],"mappings":"AAuBA;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAEpE;AAED,0EAA0E;AAC1E,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC7B,KAAK,EAAE,OAAO,GACb,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAGxB"}

package/dist/output/terminal-safe.js

@@ -0,0 +1,38 @@
+// F-010 · Text we did not write, on its way to a terminal.
+//
+// Control sequences were already stripped from file contents, command output,
+// tool cards and diff previews. Three sources were not covered, and they are
+// the ones a remote party controls most directly:
+//
+//   - the model's own reply, streamed straight to stdout;
+//   - a session's title, workspace and model id, rendered into tables and
+//     pickers - a transcript is a file, and files can be edited;
+//   - anything else read back out of the local store.
+//
+// An OSC sequence retitles the window, a CSI can clear the screen or move the
+// cursor to overwrite what came before, and either makes the terminal show
+// something other than what happened.
+//
+// The rule is deliberately about the *destination*, not the source: escapes
+// only do damage when something interprets them. Stripping on the way to a
+// pipe or a file would corrupt `mafdet chat > answer.txt` and any JSON a
+// script parses, for no safety gain - a byte in a file is inert until it is
+// cat'd, and at that point it is that terminal's problem, not a hole we made.
+import { stripAnsi } from "../agent/command-policy.js";
+/**
+ * Make untrusted text safe to print, when and only when a terminal will read
+ * it.
+ *
+ * `isTty` is passed in rather than read from `process.stdout` so that the
+ * decision is testable and so a caller writing somewhere else cannot get the
+ * wrong answer by accident.
+ */
+export function safeForTerminal(text, isTty) {
+    return isTty ? stripAnsi(text) : text;
+}
+/** Wrap a writer so everything through it is sanitised for a terminal. */
+export function terminalSafeWriter(write, isTty) {
+    if (!isTty)
+        return write;
+    return (text) => write(stripAnsi(text));
+}

package/dist/sessions/index-file.d.ts

@@ -7,6 +7,8 @@ export interface IndexEntry {
     readonly workspace: string;
     readonly model_requests: number;
     readonly estimated_charge_micro_usd: string;
+    /** R-6 · Requests the estimate above does not include; see F-012. */
+    readonly unpriced_requests?: number;
 }
 export interface SessionIndex {
     readonly schema_version: number;

package/dist/sessions/index-file.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index-file.d.ts","sourceRoot":"","sources":["../../src/sessions/index-file.ts"],"names":[],"mappings":"AAqBA,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,YAAY,CAAC;AAKpB,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;CAC7C;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;CAC1C;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAmBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAoBvD;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAiBlE;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAapD;AAwBD,yEAAyE;AACzE,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,eAAe,GACxB,YAAY,CAUd;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,YAAY,CAed;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBnD"}
+{"version":3,"file":"index-file.d.ts","sourceRoot":"","sources":["../../src/sessions/index-file.ts"],"names":[],"mappings":"AAqBA,OAAO,EAIL,KAAK,eAAe,EACrB,MAAM,YAAY,CAAC;AAKpB,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,0BAA0B,EAAE,MAAM,CAAC;IAC5C,qEAAqE;IACrE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,SAAS,UAAU,EAAE,CAAC;CAC1C;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAsBD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAoBvD;AAED,oEAAoE;AACpE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAiBlE;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,CAapD;AAwBD,yEAAyE;AACzE,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,eAAe,GACxB,YAAY,CAUd;AAED,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB,YAAY,CAed;AAED,8EAA8E;AAC9E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAkBnD"}

package/dist/sessions/index-file.js

@@ -25,6 +25,9 @@ function entryOf(metadata) {
         workspace: metadata.workspace,
         model_requests: metadata.model_requests,
         estimated_charge_micro_usd: metadata.estimated_charge_micro_usd,
+        ...(metadata.unpriced_requests
+            ? { unpriced_requests: metadata.unpriced_requests }
+            : {}),
     };
 }
 /** Newest first, which is the order a session list wants. */

package/dist/sessions/open.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open.d.ts","sourceRoot":"","sources":["../../src/sessions/open.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,oBAAoB,EAGpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,aAAa,EAAe,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;CAC/D,CAAC;AAEN,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,UAAU,CA4DnE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GAC9C,MAAM,CAwBR"}
+{"version":3,"file":"open.d.ts","sourceRoot":"","sources":["../../src/sessions/open.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAEL,oBAAoB,EAGpB,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAKrB,OAAO,EAAE,aAAa,EAAe,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;CACpD;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACxD;IACE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;CAC/D,CAAC;AAEN,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,UAAU,CAqFnE;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,OAAO,CAAC,UAAU,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,GAC9C,MAAM,CAyBR"}

package/dist/sessions/open.js

@@ -6,12 +6,25 @@
 // and the checks are all re-derived from the key in use *now*, never from
 // what the session was recorded with.
 import { existsSync } from "node:fs";
-import { join } from "node:path";
+import { stripAnsi } from "../agent/command-policy.js";
 import { acquireSessionLock, SessionLockedError, } from "./lock.js";
 import { describeBlocker, permissionsForResume, rebuildContext, resumeBlockers, } from "./resume.js";
+import { InvalidSessionIdError, resolveSessionDirectory, } from "./session-id.js";
 import { SessionWriter, readSession } from "./store.js";
 export function openForResume(input) {
-    const directory = join(input.root, input.sessionId);
+    // F-001 · Through the same boundary as the `sessions` subcommands. This is
+    // the write path: before the check, `--resume ../../../x` opened a directory
+    // outside the store and appended to it.
+    let directory;
+    try {
+        directory = resolveSessionDirectory(input.root, input.sessionId);
+    }
+    catch (error) {
+        if (error instanceof InvalidSessionIdError) {
+            return { kind: "unreadable", reason: error.message };
+        }
+        throw error;
+    }
     if (!existsSync(directory))
         return { kind: "missing" };
     let session;
@@ -24,6 +37,18 @@ export function openForResume(input) {
             reason: error instanceof Error ? error.message : String(error),
         };
     }
+    // F-016 · Continuing a conversation with a hole in it sends the model a
+    // history that is missing pieces, and it has no way to know. Reading it is
+    // fine; carrying on from it needs to be a decision, not a default.
+    if (session.corruptLines.length > 0) {
+        return {
+            kind: "unreadable",
+            reason: `${session.corruptLines.length} unreadable line(s) in this transcript ` +
+                `(line ${session.corruptLines.join(", ")}) - part of the conversation ` +
+                `is missing, so continuing it would send the model an incomplete ` +
+                `history. 'mafdet sessions show' still reads what survived.`,
+        };
+    }
     // Taken before anything is written, so two processes cannot interleave into
     // one transcript.
     let lock;
@@ -78,8 +103,9 @@ export function openForResume(input) {
  * know that will be surprised by the bill rather than by the feature.
  */
 export function describeResume(result) {
+    // R-4 · Title and model come off disk and this is drawn on a terminal.
     const lines = [
-        `resuming "${result.metadata.title}" (${result.metadata.model_id})`,
+        `resuming "${stripAnsi(result.metadata.title)}" (${stripAnsi(result.metadata.model_id)})`,
     ];
     if (result.toolRunsSummarised > 0) {
         lines.push(`  ${result.toolRunsSummarised} earlier tool run(s) are summarised, not repeated`);