@pugi/cli 0.1.0-alpha.17 → 0.1.0-alpha.19

package/dist/core/repl/slash-commands.js

@@ -1,5 +1,5 @@
 /**
- * REPL slash command registry — Sprint α5.7, expanded α6.14 wave 2.
+ * REPL slash command registry - Sprint α5.7, expanded α6.14 wave 2.
  *
  * The REPL input box surfaces a palette of slash commands the operator
  * can run from inside a persistent session. The wave-2 expansion (CEO
@@ -15,46 +15,35 @@
  *
  * Tiering (per CEO wave-2 spec):
  *
- *   Tier 1 — wired against real state (3 + existing 6 = 9 wired):
+ *   Tier 1 - wired against real state (3 + existing 6 = 9 wired):
  *     brief, agents, stop, help, quit, web, clear, version, jobs.
  *
- *   Tier 2 — best-effort wiring against existing surfaces (3):
+ *   Tier 2 - best-effort wiring against existing surfaces (3):
  *     diff, cost, status.
  *
- *   Tier 3 — deterministic stubs ("coming in αX.Y") (8):
+ *   Tier 3 - deterministic stubs ("coming in αX.Y") (8):
  *     compact, resume, memory, config, privacy, budget, mcp, undo.
  *
  * Brand voice (brandbook §08): power words `brief / dispatch / stop /
  * agents / quit / shipped`. Tagline `Brief it. It ships.` reserved for
- * `/quit` confirmation and `/help` footer — never inline.
+ * `/quit` confirmation and `/help` footer - never inline.
  */
 import { listRoles } from '../agents/registry.js';
 /**
  * Deterministic stub copy returned by the Tier 3 commands. Spec'd
  * inline so the unit test can pin the exact text without poking at
  * the help overlay. The version tag at the end maps to the sprint we
- * intend to land the real wiring in.
+ * intend to land the real wiring in. Keyed by StubSlashCommandName
+ * (not the full SlashCommandName union) so wired commands cannot
+ * silently appear here with empty placeholders.
  */
 export const SLASH_STUB_MESSAGES = Object.freeze({
-    brief: '',
-    agents: '',
-    stop: '',
-    help: '',
-    quit: '',
-    web: '',
-    clear: '',
-    version: '',
-    jobs: '',
-    ask: '',
-    diff: '',
-    cost: '',
-    status: '',
-    consensus: '',
-    compact: 'Manual context compaction lands in α6.5.',
-    resume: '',
-    memory: 'Session memory editor lands in α6.5.',
+    compact: 'Manual context compaction lands in α6.5b.',
+    memory: 'Session memory editor lands in α6.5b.',
     config: 'Run `pugi config list` from a fresh shell for the full surface; in-REPL editor lands in α6.5.',
-    privacy: 'Run `pugi privacy show` from a fresh shell; in-REPL toggle lands in α6.5.',
+    // alpha 6.13: /privacy graduated from stub; nothing reads this at
+    // runtime but the type record stays exhaustive.
+    privacy: '',
     budget: 'Run `pugi budget` from a fresh shell; in-REPL summary lands in α6.5.',
     mcp: 'Run `pugi config mcp list` from a fresh shell; in-REPL palette lands in α6.5.',
     undo: 'Run `pugi undo` from a fresh shell; in-REPL undo lands in α6.5.',
@@ -69,8 +58,9 @@ export const SLASH_COMMAND_HELP = Object.freeze([
     // Session
     { name: 'clear', args: '', gloss: 'Clear conversation pane', group: 'Session' },
     { name: 'resume', args: '', gloss: 'Pick a stored session to restore', group: 'Session' },
-    { name: 'compact', args: '', gloss: 'Manual context compaction  (α6.5)', group: 'Session', stub: true },
-    { name: 'memory', args: '', gloss: 'Session memory editor  (α6.5)', group: 'Session', stub: true },
+    { name: 'context', args: '', gloss: 'Show three-tier context summary (Tier 0 skeleton + Tier 1 working set)', group: 'Session' },
+    { name: 'compact', args: '', gloss: 'Manual context compaction  (α6.5b)', group: 'Session', stub: true },
+    { name: 'memory', args: '', gloss: 'Session memory editor  (α6.5b)', group: 'Session', stub: true },
     // Pugi tools
     { name: 'web', args: '<url>', gloss: 'Fetch a URL into context', group: 'Pugi tools' },
     { name: 'diff', args: '', gloss: 'Show pending diff', group: 'Pugi tools' },
@@ -79,7 +69,7 @@ export const SLASH_COMMAND_HELP = Object.freeze([
     { name: 'consensus', args: '[ref]', gloss: '3-model consensus review (codex · claude · deepseek)', group: 'Pugi tools' },
     // Settings
     { name: 'config', args: '', gloss: 'Show config', group: 'Settings', stub: true },
-    { name: 'privacy', args: '', gloss: 'Show privacy mode', group: 'Settings', stub: true },
+    { name: 'privacy', args: '', gloss: 'Show privacy mode + contract', group: 'Settings' },
     { name: 'budget', args: '', gloss: 'Show usage budget', group: 'Settings', stub: true },
     { name: 'mcp', args: '', gloss: 'List MCP servers', group: 'Settings', stub: true },
     { name: 'undo', args: '', gloss: 'Undo last write', group: 'Settings', stub: true },
@@ -105,7 +95,7 @@ export const SLASH_COMMAND_GROUPS = Object.freeze([
  *   - Empty / whitespace-only input returns `noop` with the original
  *     text so the REPL can ignore it without printing anything.
  *   - Input that does not start with `/` is treated as an implicit
- *     `/brief <text>` — the most-common operator action.
+ *     `/brief <text>` - the most-common operator action.
  *   - `/<name> [args]` resolves the name against the registry; unknown
  *     names return `error` so the REPL can render a one-line tip
  *     instead of silently dropping the input.
@@ -113,7 +103,7 @@ export const SLASH_COMMAND_GROUPS = Object.freeze([
  *     can render the deterministic "coming in αX.Y" copy uniformly.
  *
  * The function never throws. Bad input maps to a structured result the
- * REPL can render — the alternative (throwing from a keystroke handler)
+ * REPL can render - the alternative (throwing from a keystroke handler)
  * would unmount Ink mid-frame.
  */
 export function parseSlashCommand(input) {
@@ -210,17 +200,32 @@ export function parseSlashCommand(input) {
             // so the slash-command layer stays UI-agnostic.
             return { kind: 'resume' };
         }
+        case 'context':
+        case 'ctx': {
+            // α6.5: surface Tier 0 + Tier 1 status. The session module
+            // renders the summary as system lines so the operator can see
+            // skeleton size + working-set utilisation at a glance.
+            return { kind: 'context' };
+        }
+        case 'privacy': {
+            // alpha 6.13: real handler - the session module prints the
+            // contract doc + the current mode banner. Tail is ignored (no
+            // sub-commands today; mode flips go through
+            // `pugi config set privacy=<mode>` from a fresh shell so the
+            // device flow + audit identity are wired correctly).
+            return { kind: 'privacy' };
+        }
         case 'compact':
         case 'memory':
         case 'config':
-        case 'privacy':
         case 'budget':
         case 'mcp':
         case 'undo': {
+            const stubName = name;
             return {
                 kind: 'stub',
-                name: name,
-                message: SLASH_STUB_MESSAGES[name],
+                name: stubName,
+                message: SLASH_STUB_MESSAGES[stubName],
             };
         }
         default: {

package/dist/runtime/cli.js

@@ -20,6 +20,7 @@ import { signatureForPlanReview } from '../core/repl/ask.js';
 import { buildRuntimeConfig, loadRuntimeConfig, pollDeviceFlow, pugiHandoffBundleSchema, pugiSyncDryRunPlanSchema, pugiSyncPrivacyModeSchema, pugiSyncRequestSchema, pugiSyncUploadPlanSchema, pugiTripleReviewRequestSchema, startDeviceFlow, submitSync, submitTripleReview, } from '@pugi/sdk';
 import { PUGI_TAGLINE } from '@pugi/personas';
 import { clearApiKey, DEFAULT_API_URL, listStoredCredentials, maskApiKey, normalizeApiUrl, purgeAllCredentials, readCredentialsFile, resolveActiveCredential, storeApiKey, switchActiveAccount, } from '../core/credentials.js';
+import { runDeployCommand } from '../commands/deploy.js';
 import { runJobsCommand } from '../commands/jobs.js';
 import { runConfigCommand } from './commands/config.js';
 import { runPrivacyCommand } from './commands/privacy.js';
@@ -31,6 +32,7 @@ import { resolveWorkspaceLabel } from '../core/repl/workspace-context.js';
 import { runReviewConsensus } from './commands/review-consensus.js';
 import { FtsSyntaxError, SqliteSessionStore, resolveProjectStoreDir } from '../core/repl/store/index.js';
 import { slugForCwd } from '../core/repl/history.js';
+import { dispatchEdit, } from '../core/edits/index.js';
 /**
  * CLI version shown by `pugi version` and embedded in `pugi doctor --json`.
  *
@@ -42,7 +44,7 @@ import { slugForCwd } from '../core/repl/history.js';
  * packages/pugi-sdk/package.json); the publish workflow validates the
  * three are in lockstep.
  */
-const PUGI_CLI_VERSION = "0.1.0-alpha.17";
+const PUGI_CLI_VERSION = "0.1.0-alpha.19";
 const handlers = {
     accounts,
     agents: dispatchAgents,
@@ -51,6 +53,7 @@ const handlers = {
     budget: dispatchBudget,
     code: runEngineTask('code'),
     config: dispatchConfig,
+    deploy: dispatchDeploy,
     doctor,
     explain: runEngineTask('explain'),
     fix: runEngineTask('fix'),
@@ -524,6 +527,16 @@ async function help(_args, flags, _session) {
         '  pugi ask "<question>"          Surface a yes/no question modal locally.',
         '  pugi plan-review <task>        Generate + present a plan-review modal.',
         '',
+        'Deploy:',
+        '  pugi deploy --target vercel <vercelProject> --project <id>',
+        '                          Trigger a Vercel deployment from the bound Git source.',
+        '                          Optional: --target-env production|preview, --ref <ref>,',
+        '                          --integration <id>.',
+        '  pugi deploy --target render <renderService> --project <id>',
+        '                          Trigger a Render deployment (Sprint 2 — stub today).',
+        '  pugi deploy --status <id>            Vendor-agnostic status snapshot.',
+        '  pugi deploy --logs <id> [--tail]     Build-log tail. --tail polls until terminal.',
+        '',
         'Sync safety:',
         '  pugi sync --dry-run --privacy metadata',
         '',
@@ -2138,6 +2151,45 @@ function runEngineTask(kind) {
                 risks: ['adapter terminated without emitting a result event'],
             };
         }
+        // α6.6 diff escalation — Layer A/B/C dispatcher.
+        //
+        // Some models emit file edits as inline SEARCH/REPLACE markers in
+        // the final response rather than through tool calls (especially
+        // Gemini and o1 family, which under-use tool schemas in long
+        // reasoning chains). We run the dispatcher against the model's
+        // final text so those markers still land on disk. Tool-call edits
+        // (Layer-A equivalent already handled by `edit`/`write` tools) are
+        // unaffected — the dispatcher only fires on prose blocks that
+        // happen to contain markers.
+        //
+        // Scope: code / fix / build / explain only. `plan` is read-only
+        // (the engine refuses write tools), so even a stray marker in plan
+        // output gets ignored to honour the plan-mode contract.
+        //
+        // Dry-run + read-only short-circuits: when the flags forbid writes
+        // we dispatch with `dryRun: true` so the operator still sees what
+        // WOULD have been written, but nothing touches disk.
+        let dispatchResults = [];
+        if (kind === 'code' || kind === 'fix' || kind === 'build_task') {
+            dispatchResults = await runMarkerDispatch({
+                root,
+                result: {
+                    status: result.status,
+                    summary: result.summary,
+                    eventRefs: result.eventRefs,
+                },
+                dryRun: flags.dryRun,
+            });
+            // Merge dispatcher-touched files into `result.filesChanged` so the
+            // operator-facing summary lists them alongside tool-driven edits.
+            for (const dr of dispatchResults) {
+                if (dr.ok && dr.absPath) {
+                    const rel = relative(root, dr.absPath);
+                    if (!result.filesChanged.includes(rel))
+                        result.filesChanged.push(rel);
+                }
+            }
+        }
         // For `plan` we always write a plan.md artifact, regardless of
         // outcome. A blocked plan (budget exhausted, tool refusal) still
         // produces a reviewable artifact — the reason is recorded inline.
@@ -2200,6 +2252,16 @@ function runEngineTask(kind) {
             sessionEventsMirror: metrics.mirror,
             risks: result.risks,
             plan: planArtifact ? { path: planArtifact.relPath } : undefined,
+            // α6.6 — per-edit dispatcher trace. Empty array when no inline
+            // markers were detected in the model's final response.
+            diffEdits: dispatchResults.map((dr) => ({
+                layer: dr.layer,
+                file: dr.file,
+                ok: dr.ok,
+                bytesWritten: dr.bytesWritten,
+                reason: dr.reason,
+                detail: dr.detail,
+            })),
             // The full event stream is useful for cabinet UI replay. We surface
             // it in JSON mode only — text mode operators want the summary, not
             // 30 turn-level lines.
@@ -2220,6 +2282,19 @@ function runEngineTask(kind) {
             textLines.push('Files modified: none');
         }
         textLines.push(`Tool calls: ${metrics.toolCalls} · Turns: ${metrics.turns} · Tokens: ${metrics.tokens}`);
+        if (dispatchResults.length > 0) {
+            const okCount = dispatchResults.filter((d) => d.ok).length;
+            const failCount = dispatchResults.length - okCount;
+            textLines.push(`Diff dispatch: ${okCount} applied, ${failCount} rejected (${dispatchResults.length} marker block${dispatchResults.length === 1 ? '' : 's'})`);
+            for (const dr of dispatchResults) {
+                if (dr.ok) {
+                    textLines.push(`  + ${dr.layer} ${dr.file} (${dr.bytesWritten} bytes)`);
+                }
+                else {
+                    textLines.push(`  ! ${dr.layer} ${dr.file}: ${dr.reason ?? 'failure'} — ${dr.detail ?? ''}`);
+                }
+            }
+        }
         if (result.risks.length > 0) {
             textLines.push(`Risks: ${result.risks.join('; ')}`);
         }
@@ -2229,6 +2304,96 @@ function runEngineTask(kind) {
         writeOutput(flags, payload, textLines.join('\n'));
     };
 }
+// Exported for the α6.6.1 triple-review remediation spec
+// (`apps/pugi-cli/test/edits-dispatcher-gate.spec.ts`). The runtime
+// surface is not part of the public CLI API; this is a test seam.
+export async function runMarkerDispatch(input) {
+    const { root, result, dryRun } = input;
+    const dispatch = input.dispatchFn ?? dispatchEdit;
+    // Triple-review 2026-05-25 P2 (Codex): gate the dispatcher on the
+    // engine's terminal status. A `blocked` (budget_exhausted, plan-mode
+    // refusal) or `failed` result may still carry markers in the
+    // partial `summary` text — applying them would mutate files the
+    // CLI then exits non-zero on, leaving the workspace in an
+    // unexpected state with no operator signal that "blocked but with
+    // side effects" happened. Only `done` is allowed to write.
+    if (result.status !== 'done')
+        return [];
+    // Strip the engine's status prefixes (`[budget_exhausted] `, etc.)
+    // from the body before scanning. The prefixes start with `[`; the
+    // dispatcher tolerates leading prose but the cleaner the input the
+    // less chance of accidental marker matches.
+    const body = result.summary;
+    if (!hasAnyMarkerSignal(body))
+        return [];
+    const modelTag = extractModelTag(result.eventRefs);
+    try {
+        return await dispatch(body, {
+            modelTag,
+            cwd: root,
+            dryRun,
+        });
+    }
+    catch (error) {
+        // Triple-review 2026-05-25 P2 (Claude): the previous `catch {}`
+        // swallowed parser/applicator crashes silently — the operator
+        // saw a clean "0 applied" rather than the actual stack trace,
+        // and the bug only surfaced when someone manually `pugi resume`-d
+        // a session and noticed the missing edits. Surface the failure
+        // both to stderr (so live operators see it) and as a synthetic
+        // DispatchResult (so JSON consumers and the audit log record it).
+        //
+        // R2 triple-review 2026-05-25 P2 (Claude): the earlier remediation
+        // returned `detail: message` — i.e. the raw `Error.message`. That
+        // string is constructed by whatever code path threw (parser,
+        // applicator, fs layer, etc.) and may contain absolute paths,
+        // secret fragments echoed in `oldString` context, or other
+        // stack-bearing internals. The audit log and any JSON consumer
+        // that surfaces `detail` to the operator (or worse, to a remote
+        // monitoring pipe) would leak them. Stack already goes to stderr
+        // for live diagnosis; the returned result must carry a safe,
+        // static string so consumers can still detect "dispatcher
+        // crashed" without re-rendering the underlying exception.
+        const message = error instanceof Error ? error.message : String(error);
+        const stack = error instanceof Error && error.stack ? error.stack : message;
+        process.stderr.write(`pugi diff-dispatch: internal crash in dispatchEdit (${message}); see stack:\n${stack}\n`);
+        return [
+            {
+                layer: 'layer-a',
+                file: '',
+                ok: false,
+                bytesWritten: 0,
+                reason: 'dispatcher_crash',
+                detail: 'dispatcher crashed - see stderr for stack trace',
+            },
+        ];
+    }
+}
+/**
+ * Quick pre-filter: does the body contain ANY of the marker
+ * signatures the dispatcher knows about? Saves a full parse on every
+ * model response (most responses are pure prose and would otherwise
+ * round-trip through the parser pointlessly).
+ */
+function hasAnyMarkerSignal(body) {
+    return (body.includes('+++ NEW') ||
+        body.includes('<<<<<<< SEARCH') ||
+        body.includes('@@@ REWRITE') ||
+        body.includes('@@@ AST') ||
+        /^--- a\//m.test(body));
+}
+/**
+ * Extract `model=<tag>` from eventRefs if the adapter emitted it.
+ * Returns undefined when missing; dispatchEdit then auto-detects from
+ * the payload itself.
+ */
+function extractModelTag(refs) {
+    for (const ref of refs) {
+        if (ref.startsWith('model='))
+            return ref.slice('model='.length);
+    }
+    return undefined;
+}
 /**
  * Extract `key=value` metrics from `EngineResult.eventRefs`. The adapter
  * already emits the canonical strings (`tool_calls=N`, `turns=N`,
@@ -3502,6 +3667,33 @@ async function jobs(args, flags, session) {
         process.exitCode = exitCode;
     }
 }
+/**
+ * `pugi deploy` — Wave 3 P2 (Task #34, 2026-05-25). Thin shim into
+ * `src/commands/deploy.ts`. The shim adapts the global `CliFlags` shape
+ * to the deploy-specific flag set + exposes the credential store via
+ * `resolveRuntimeConfig` so the deploy module stays decoupled from the
+ * CLI's auth bootstrap.
+ */
+async function dispatchDeploy(args, flags, _session) {
+    // Triple-review #391 P2: the global `parseArgs` in this file consumes
+    // `--json` before the per-command args reach us, so `runDeployCommand`'s
+    // internal parser never sees it and the JSON envelope path is silently
+    // skipped. Re-inject the flag so downstream parsing surfaces the JSON
+    // output contract the operator asked for. Idempotent: if the user wrote
+    // `pugi deploy --json ...` the global parser stripped it; if they wrote
+    // `pugi --json deploy ...` ditto. Either way the global flag is the
+    // single source of truth and we forward it verbatim.
+    const forwardedArgs = flags.json && !args.includes('--json') ? [...args, '--json'] : args;
+    const exitCode = await runDeployCommand(forwardedArgs, {
+        write: (text) => process.stdout.write(text),
+        writeError: (text) => process.stderr.write(text.endsWith('\n') ? text : `${text}\n`),
+    }, {
+        resolveConfig: () => resolveRuntimeConfig(),
+    });
+    if (exitCode !== 0) {
+        process.exitCode = exitCode;
+    }
+}
 function notImplemented(command) {
     return async (_args, flags) => {
         const payload = {

package/dist/runtime/commands/config.js

@@ -58,6 +58,8 @@ export async function runConfigCommand(args, ctx) {
                 'pugi config get routing',
                 'pugi config set routing.<tag>.<budget>=<model>',
                 'pugi config unset routing.<tag>.<budget>',
+                'pugi config get privacy',
+                'pugi config set privacy=strict|balanced|permissive',
             ],
         }, [
             'Usage:',
@@ -71,6 +73,8 @@ export async function runConfigCommand(args, ctx) {
             '  pugi config get routing                          Show effective routing table (defaults + tenant overrides).',
             '  pugi config set routing.<tag>.<budget>=<model>   Override the model for one (tag, budget) lane.',
             '  pugi config unset routing.<tag>.<budget>         Remove a routing override (revert to default).',
+            '  pugi config get privacy                          Show current tenant privacy mode + last-flip metadata.',
+            '  pugi config set privacy=<mode>                   Flip privacy mode (strict | balanced | permissive).',
         ].join('\n'));
         return;
     }
@@ -81,6 +85,13 @@ export async function runConfigCommand(args, ctx) {
             if (args[1] === 'routing') {
                 return runRoutingGet(ctx);
             }
+            // alpha 6.13: `pugi config get privacy` hits the admin-api
+            // /api/admin/privacy/mode surface. The privacy mode is a tenant-
+            // scoped server-side setting (so the Anvil filter can enforce it),
+            // not a local-only preference.
+            if (args[1] === 'privacy') {
+                return runPrivacyGet(ctx);
+            }
             return runConfigGet(args.slice(1), ctx);
         case 'set':
             // Special form: `pugi config set routing.<tag>.<budget>=<model>` hits
@@ -88,6 +99,40 @@ export async function runConfigCommand(args, ctx) {
             if (args[1] && args[1].startsWith('routing.')) {
                 return runRoutingSet(args.slice(1), ctx);
             }
+            // alpha 6.13: `pugi config set privacy=<mode>` (or `privacy <mode>`)
+            // flips the tenant-scoped server-side mode IFF <mode> is one of
+            // the new closed set (strict | balanced | permissive). Legacy
+            // values (local-only | metadata | full) still hit the local
+            // config schema via runConfigSet so existing operators do not
+            // get a surprise 4xx when their playbook still uses the old
+            // names. The unit spec for config.ts has a regression test for
+            // both code paths.
+            //
+            // Triple-review P2 fix (2026-05-25): the prior disambiguation
+            // only excluded the bare form (`privacy local-only`) - the `=`
+            // form (`privacy=local-only`) still routed to runPrivacySet and
+            // 4xx'd. We now check the value AFTER `=` and route legacy local
+            // values to runConfigSet; new-style values + unknown values
+            // continue to runPrivacySet so its client-side validator surfaces
+            // a structured "Unknown privacy mode" error (preserves the
+            // existing UX for typos like `privacy=paranoid`).
+            if (args[1]) {
+                const equalsForm = args[1].startsWith('privacy=');
+                const bareForm = args[1] === 'privacy';
+                if (equalsForm) {
+                    const valueAfterEquals = args[1].slice('privacy='.length);
+                    if (isLegacyLocalPrivacyValue(valueAfterEquals)) {
+                        // Legacy local form (`privacy=local-only|metadata|full`) -
+                        // split into `['privacy', '<value>']` so runConfigSet sees
+                        // the same shape it would for the bare form.
+                        return runConfigSet(['privacy', valueAfterEquals], ctx);
+                    }
+                    return runPrivacySet(args.slice(1), ctx);
+                }
+                if (bareForm && isNewPrivacyModeValue(args[2])) {
+                    return runPrivacySet(args.slice(1), ctx);
+                }
+            }
             return runConfigSet(args.slice(1), ctx);
         case 'unset':
             if (args[1] && args[1].startsWith('routing.')) {
@@ -393,6 +438,97 @@ async function runRoutingUnset(args, ctx) {
         ? `routing.${tag}.${budget} reverted to default.`
         : `routing.${tag}.${budget} had no override (nothing to remove).`);
 }
+/* ------------------------------------------------------------------ */
+/* alpha 6.13 privacy 3-mode - config.privacy.* subcommands             */
+/* ------------------------------------------------------------------ */
+/**
+ * Closed mirror of the server-side PRIVACY_MODES enum
+ * (apps/admin-api/src/privacy/privacy-mode.ts). Pinning the literal
+ * set here lets the CLI reject typos client-side before the round-
+ * trip to admin-api (better UX, smaller blast radius on a flaky
+ * network).
+ */
+const PRIVACY_MODES = ['strict', 'balanced', 'permissive'];
+function isNewPrivacyModeValue(value) {
+    return typeof value === 'string' && PRIVACY_MODES.includes(value);
+}
+function isPrivacyMode(value) {
+    return PRIVACY_MODES.includes(value);
+}
+/**
+ * Legacy local-config privacy values from before alpha 6.13. Kept so
+ * `pugi config set privacy=local-only` continues to write to the local
+ * config file (matching the bare-form behaviour). Triple-review P2 fix
+ * (2026-05-25): the prior disambiguation only excluded the bare form;
+ * the `=` form routed to runPrivacySet and 4xx'd on the unknown mode.
+ */
+const LEGACY_LOCAL_PRIVACY_VALUES = [
+    'local-only',
+    'metadata',
+    'full',
+];
+function isLegacyLocalPrivacyValue(value) {
+    return (typeof value === 'string' &&
+        LEGACY_LOCAL_PRIVACY_VALUES.includes(value));
+}
+/**
+ * `pugi config get privacy` - fetch the current privacy mode snapshot
+ * from /api/admin/privacy/mode + render it in human-readable form.
+ */
+async function runPrivacyGet(ctx) {
+    const { apiUrl, apiKey } = resolveAdminApi();
+    const snapshot = await fetchJson(`${apiUrl}/api/admin/privacy/mode`, apiKey);
+    const lastUpdatedLine = snapshot.lastUpdated
+        ? `(last set by ${snapshot.lastUpdatedBy ?? 'unknown'} on ${snapshot.lastUpdated})`
+        : '(no flips recorded; on implicit default)';
+    const text = [
+        `privacy.mode = ${snapshot.mode}`,
+        `privacy.defaultMode = ${snapshot.defaultMode}`,
+        lastUpdatedLine,
+    ].join('\n');
+    ctx.writeOutput({
+        command: 'config.privacy.get',
+        apiUrl,
+        snapshot,
+    }, text);
+}
+/**
+ * `pugi config set privacy=<mode>` - PUT to /api/admin/privacy/mode.
+ * Validates the mode client-side against the closed set before
+ * round-tripping.
+ *
+ * Accepts both `privacy <mode>` and `privacy=<mode>` argument forms so
+ * the operator can type it either way.
+ */
+async function runPrivacySet(args, ctx) {
+    const raw = args.join(' ').trim();
+    let mode;
+    if (raw.startsWith('privacy=')) {
+        mode = raw.slice('privacy='.length).trim();
+    }
+    else if (raw === 'privacy') {
+        throw new Error('pugi config set privacy requires a mode. Try: pugi config set privacy=balanced');
+    }
+    else if (raw.startsWith('privacy ')) {
+        mode = raw.slice('privacy '.length).trim();
+    }
+    else {
+        throw new Error(`pugi config set privacy: unrecognised argument "${raw}". Try: pugi config set privacy=balanced`);
+    }
+    if (mode.length === 0) {
+        throw new Error('pugi config set privacy requires a mode. Try: pugi config set privacy=balanced');
+    }
+    if (!isPrivacyMode(mode)) {
+        throw new Error(`Unknown privacy mode "${mode}". Allowed: ${PRIVACY_MODES.join(', ')}.`);
+    }
+    const { apiUrl, apiKey } = resolveAdminApi();
+    const snapshot = await fetchJson(`${apiUrl}/api/admin/privacy/mode`, apiKey, { method: 'PUT', body: { mode } });
+    ctx.writeOutput({
+        command: 'config.privacy.set',
+        mode: snapshot.mode,
+        snapshot,
+    }, `privacy.mode = ${snapshot.mode}`);
+}
 /**
  * Thin authenticated fetch helper. Adds the bearer token + accepts JSON +
  * surfaces structured errors. Uses undici `request` (not native `fetch`)