@pugi/cli 0.1.0-alpha.18 → 0.1.0-alpha.20

package/dist/core/repl/slash-commands.js

@@ -41,7 +41,9 @@ export const SLASH_STUB_MESSAGES = Object.freeze({
     compact: 'Manual context compaction lands in α6.5b.',
     memory: 'Session memory editor lands in α6.5b.',
     config: 'Run `pugi config list` from a fresh shell for the full surface; in-REPL editor lands in α6.5.',
-    privacy: 'Run `pugi privacy show` from a fresh shell; in-REPL toggle lands in α6.5.',
+    // alpha 6.13: /privacy graduated from stub; nothing reads this at
+    // runtime but the type record stays exhaustive.
+    privacy: '',
     budget: 'Run `pugi budget` from a fresh shell; in-REPL summary lands in α6.5.',
     mcp: 'Run `pugi config mcp list` from a fresh shell; in-REPL palette lands in α6.5.',
     undo: 'Run `pugi undo` from a fresh shell; in-REPL undo lands in α6.5.',
@@ -67,7 +69,7 @@ export const SLASH_COMMAND_HELP = Object.freeze([
     { name: 'consensus', args: '[ref]', gloss: '3-model consensus review (codex · claude · deepseek)', group: 'Pugi tools' },
     // Settings
     { name: 'config', args: '', gloss: 'Show config', group: 'Settings', stub: true },
-    { name: 'privacy', args: '', gloss: 'Show privacy mode', group: 'Settings', stub: true },
+    { name: 'privacy', args: '', gloss: 'Show privacy mode + contract', group: 'Settings' },
     { name: 'budget', args: '', gloss: 'Show usage budget', group: 'Settings', stub: true },
     { name: 'mcp', args: '', gloss: 'List MCP servers', group: 'Settings', stub: true },
     { name: 'undo', args: '', gloss: 'Undo last write', group: 'Settings', stub: true },
@@ -205,10 +207,17 @@ export function parseSlashCommand(input) {
             // skeleton size + working-set utilisation at a glance.
             return { kind: 'context' };
         }
+        case 'privacy': {
+            // alpha 6.13: real handler - the session module prints the
+            // contract doc + the current mode banner. Tail is ignored (no
+            // sub-commands today; mode flips go through
+            // `pugi config set privacy=<mode>` from a fresh shell so the
+            // device flow + audit identity are wired correctly).
+            return { kind: 'privacy' };
+        }
         case 'compact':
         case 'memory':
         case 'config':
-        case 'privacy':
         case 'budget':
         case 'mcp':
         case 'undo': {

package/dist/runtime/cli.js

@@ -20,6 +20,7 @@ import { signatureForPlanReview } from '../core/repl/ask.js';
 import { buildRuntimeConfig, loadRuntimeConfig, pollDeviceFlow, pugiHandoffBundleSchema, pugiSyncDryRunPlanSchema, pugiSyncPrivacyModeSchema, pugiSyncRequestSchema, pugiSyncUploadPlanSchema, pugiTripleReviewRequestSchema, startDeviceFlow, submitSync, submitTripleReview, } from '@pugi/sdk';
 import { PUGI_TAGLINE } from '@pugi/personas';
 import { clearApiKey, DEFAULT_API_URL, listStoredCredentials, maskApiKey, normalizeApiUrl, purgeAllCredentials, readCredentialsFile, resolveActiveCredential, storeApiKey, switchActiveAccount, } from '../core/credentials.js';
+import { runDeployCommand } from '../commands/deploy.js';
 import { runJobsCommand } from '../commands/jobs.js';
 import { runConfigCommand } from './commands/config.js';
 import { runPrivacyCommand } from './commands/privacy.js';
@@ -31,6 +32,7 @@ import { resolveWorkspaceLabel } from '../core/repl/workspace-context.js';
 import { runReviewConsensus } from './commands/review-consensus.js';
 import { FtsSyntaxError, SqliteSessionStore, resolveProjectStoreDir } from '../core/repl/store/index.js';
 import { slugForCwd } from '../core/repl/history.js';
+import { dispatchEdit, } from '../core/edits/index.js';
 /**
  * CLI version shown by `pugi version` and embedded in `pugi doctor --json`.
  *
@@ -42,7 +44,7 @@ import { slugForCwd } from '../core/repl/history.js';
  * packages/pugi-sdk/package.json); the publish workflow validates the
  * three are in lockstep.
  */
-const PUGI_CLI_VERSION = "0.1.0-alpha.18";
+const PUGI_CLI_VERSION = "0.1.0-alpha.20";
 const handlers = {
     accounts,
     agents: dispatchAgents,
@@ -51,6 +53,7 @@ const handlers = {
     budget: dispatchBudget,
     code: runEngineTask('code'),
     config: dispatchConfig,
+    deploy: dispatchDeploy,
     doctor,
     explain: runEngineTask('explain'),
     fix: runEngineTask('fix'),
@@ -524,6 +527,16 @@ async function help(_args, flags, _session) {
         '  pugi ask "<question>"          Surface a yes/no question modal locally.',
         '  pugi plan-review <task>        Generate + present a plan-review modal.',
         '',
+        'Deploy:',
+        '  pugi deploy --target vercel <vercelProject> --project <id>',
+        '                          Trigger a Vercel deployment from the bound Git source.',
+        '                          Optional: --target-env production|preview, --ref <ref>,',
+        '                          --integration <id>.',
+        '  pugi deploy --target render <renderService> --project <id>',
+        '                          Trigger a Render deployment (Sprint 2 — stub today).',
+        '  pugi deploy --status <id>            Vendor-agnostic status snapshot.',
+        '  pugi deploy --logs <id> [--tail]     Build-log tail. --tail polls until terminal.',
+        '',
         'Sync safety:',
         '  pugi sync --dry-run --privacy metadata',
         '',
@@ -2138,6 +2151,45 @@ function runEngineTask(kind) {
                 risks: ['adapter terminated without emitting a result event'],
             };
         }
+        // α6.6 diff escalation — Layer A/B/C dispatcher.
+        //
+        // Some models emit file edits as inline SEARCH/REPLACE markers in
+        // the final response rather than through tool calls (especially
+        // Gemini and o1 family, which under-use tool schemas in long
+        // reasoning chains). We run the dispatcher against the model's
+        // final text so those markers still land on disk. Tool-call edits
+        // (Layer-A equivalent already handled by `edit`/`write` tools) are
+        // unaffected — the dispatcher only fires on prose blocks that
+        // happen to contain markers.
+        //
+        // Scope: code / fix / build / explain only. `plan` is read-only
+        // (the engine refuses write tools), so even a stray marker in plan
+        // output gets ignored to honour the plan-mode contract.
+        //
+        // Dry-run + read-only short-circuits: when the flags forbid writes
+        // we dispatch with `dryRun: true` so the operator still sees what
+        // WOULD have been written, but nothing touches disk.
+        let dispatchResults = [];
+        if (kind === 'code' || kind === 'fix' || kind === 'build_task') {
+            dispatchResults = await runMarkerDispatch({
+                root,
+                result: {
+                    status: result.status,
+                    summary: result.summary,
+                    eventRefs: result.eventRefs,
+                },
+                dryRun: flags.dryRun,
+            });
+            // Merge dispatcher-touched files into `result.filesChanged` so the
+            // operator-facing summary lists them alongside tool-driven edits.
+            for (const dr of dispatchResults) {
+                if (dr.ok && dr.absPath) {
+                    const rel = relative(root, dr.absPath);
+                    if (!result.filesChanged.includes(rel))
+                        result.filesChanged.push(rel);
+                }
+            }
+        }
         // For `plan` we always write a plan.md artifact, regardless of
         // outcome. A blocked plan (budget exhausted, tool refusal) still
         // produces a reviewable artifact — the reason is recorded inline.
@@ -2200,6 +2252,16 @@ function runEngineTask(kind) {
             sessionEventsMirror: metrics.mirror,
             risks: result.risks,
             plan: planArtifact ? { path: planArtifact.relPath } : undefined,
+            // α6.6 — per-edit dispatcher trace. Empty array when no inline
+            // markers were detected in the model's final response.
+            diffEdits: dispatchResults.map((dr) => ({
+                layer: dr.layer,
+                file: dr.file,
+                ok: dr.ok,
+                bytesWritten: dr.bytesWritten,
+                reason: dr.reason,
+                detail: dr.detail,
+            })),
             // The full event stream is useful for cabinet UI replay. We surface
             // it in JSON mode only — text mode operators want the summary, not
             // 30 turn-level lines.
@@ -2220,6 +2282,19 @@ function runEngineTask(kind) {
             textLines.push('Files modified: none');
         }
         textLines.push(`Tool calls: ${metrics.toolCalls} · Turns: ${metrics.turns} · Tokens: ${metrics.tokens}`);
+        if (dispatchResults.length > 0) {
+            const okCount = dispatchResults.filter((d) => d.ok).length;
+            const failCount = dispatchResults.length - okCount;
+            textLines.push(`Diff dispatch: ${okCount} applied, ${failCount} rejected (${dispatchResults.length} marker block${dispatchResults.length === 1 ? '' : 's'})`);
+            for (const dr of dispatchResults) {
+                if (dr.ok) {
+                    textLines.push(`  + ${dr.layer} ${dr.file} (${dr.bytesWritten} bytes)`);
+                }
+                else {
+                    textLines.push(`  ! ${dr.layer} ${dr.file}: ${dr.reason ?? 'failure'} — ${dr.detail ?? ''}`);
+                }
+            }
+        }
         if (result.risks.length > 0) {
             textLines.push(`Risks: ${result.risks.join('; ')}`);
         }
@@ -2229,6 +2304,96 @@ function runEngineTask(kind) {
         writeOutput(flags, payload, textLines.join('\n'));
     };
 }
+// Exported for the α6.6.1 triple-review remediation spec
+// (`apps/pugi-cli/test/edits-dispatcher-gate.spec.ts`). The runtime
+// surface is not part of the public CLI API; this is a test seam.
+export async function runMarkerDispatch(input) {
+    const { root, result, dryRun } = input;
+    const dispatch = input.dispatchFn ?? dispatchEdit;
+    // Triple-review 2026-05-25 P2 (Codex): gate the dispatcher on the
+    // engine's terminal status. A `blocked` (budget_exhausted, plan-mode
+    // refusal) or `failed` result may still carry markers in the
+    // partial `summary` text — applying them would mutate files the
+    // CLI then exits non-zero on, leaving the workspace in an
+    // unexpected state with no operator signal that "blocked but with
+    // side effects" happened. Only `done` is allowed to write.
+    if (result.status !== 'done')
+        return [];
+    // Strip the engine's status prefixes (`[budget_exhausted] `, etc.)
+    // from the body before scanning. The prefixes start with `[`; the
+    // dispatcher tolerates leading prose but the cleaner the input the
+    // less chance of accidental marker matches.
+    const body = result.summary;
+    if (!hasAnyMarkerSignal(body))
+        return [];
+    const modelTag = extractModelTag(result.eventRefs);
+    try {
+        return await dispatch(body, {
+            modelTag,
+            cwd: root,
+            dryRun,
+        });
+    }
+    catch (error) {
+        // Triple-review 2026-05-25 P2 (Claude): the previous `catch {}`
+        // swallowed parser/applicator crashes silently — the operator
+        // saw a clean "0 applied" rather than the actual stack trace,
+        // and the bug only surfaced when someone manually `pugi resume`-d
+        // a session and noticed the missing edits. Surface the failure
+        // both to stderr (so live operators see it) and as a synthetic
+        // DispatchResult (so JSON consumers and the audit log record it).
+        //
+        // R2 triple-review 2026-05-25 P2 (Claude): the earlier remediation
+        // returned `detail: message` — i.e. the raw `Error.message`. That
+        // string is constructed by whatever code path threw (parser,
+        // applicator, fs layer, etc.) and may contain absolute paths,
+        // secret fragments echoed in `oldString` context, or other
+        // stack-bearing internals. The audit log and any JSON consumer
+        // that surfaces `detail` to the operator (or worse, to a remote
+        // monitoring pipe) would leak them. Stack already goes to stderr
+        // for live diagnosis; the returned result must carry a safe,
+        // static string so consumers can still detect "dispatcher
+        // crashed" without re-rendering the underlying exception.
+        const message = error instanceof Error ? error.message : String(error);
+        const stack = error instanceof Error && error.stack ? error.stack : message;
+        process.stderr.write(`pugi diff-dispatch: internal crash in dispatchEdit (${message}); see stack:\n${stack}\n`);
+        return [
+            {
+                layer: 'layer-a',
+                file: '',
+                ok: false,
+                bytesWritten: 0,
+                reason: 'dispatcher_crash',
+                detail: 'dispatcher crashed - see stderr for stack trace',
+            },
+        ];
+    }
+}
+/**
+ * Quick pre-filter: does the body contain ANY of the marker
+ * signatures the dispatcher knows about? Saves a full parse on every
+ * model response (most responses are pure prose and would otherwise
+ * round-trip through the parser pointlessly).
+ */
+function hasAnyMarkerSignal(body) {
+    return (body.includes('+++ NEW') ||
+        body.includes('<<<<<<< SEARCH') ||
+        body.includes('@@@ REWRITE') ||
+        body.includes('@@@ AST') ||
+        /^--- a\//m.test(body));
+}
+/**
+ * Extract `model=<tag>` from eventRefs if the adapter emitted it.
+ * Returns undefined when missing; dispatchEdit then auto-detects from
+ * the payload itself.
+ */
+function extractModelTag(refs) {
+    for (const ref of refs) {
+        if (ref.startsWith('model='))
+            return ref.slice('model='.length);
+    }
+    return undefined;
+}
 /**
  * Extract `key=value` metrics from `EngineResult.eventRefs`. The adapter
  * already emits the canonical strings (`tool_calls=N`, `turns=N`,
@@ -3502,6 +3667,33 @@ async function jobs(args, flags, session) {
         process.exitCode = exitCode;
     }
 }
+/**
+ * `pugi deploy` — Wave 3 P2 (Task #34, 2026-05-25). Thin shim into
+ * `src/commands/deploy.ts`. The shim adapts the global `CliFlags` shape
+ * to the deploy-specific flag set + exposes the credential store via
+ * `resolveRuntimeConfig` so the deploy module stays decoupled from the
+ * CLI's auth bootstrap.
+ */
+async function dispatchDeploy(args, flags, _session) {
+    // Triple-review #391 P2: the global `parseArgs` in this file consumes
+    // `--json` before the per-command args reach us, so `runDeployCommand`'s
+    // internal parser never sees it and the JSON envelope path is silently
+    // skipped. Re-inject the flag so downstream parsing surfaces the JSON
+    // output contract the operator asked for. Idempotent: if the user wrote
+    // `pugi deploy --json ...` the global parser stripped it; if they wrote
+    // `pugi --json deploy ...` ditto. Either way the global flag is the
+    // single source of truth and we forward it verbatim.
+    const forwardedArgs = flags.json && !args.includes('--json') ? [...args, '--json'] : args;
+    const exitCode = await runDeployCommand(forwardedArgs, {
+        write: (text) => process.stdout.write(text),
+        writeError: (text) => process.stderr.write(text.endsWith('\n') ? text : `${text}\n`),
+    }, {
+        resolveConfig: () => resolveRuntimeConfig(),
+    });
+    if (exitCode !== 0) {
+        process.exitCode = exitCode;
+    }
+}
 function notImplemented(command) {
     return async (_args, flags) => {
         const payload = {

package/dist/runtime/commands/config.js

@@ -58,6 +58,8 @@ export async function runConfigCommand(args, ctx) {
                 'pugi config get routing',
                 'pugi config set routing.<tag>.<budget>=<model>',
                 'pugi config unset routing.<tag>.<budget>',
+                'pugi config get privacy',
+                'pugi config set privacy=strict|balanced|permissive',
             ],
         }, [
             'Usage:',
@@ -71,6 +73,8 @@ export async function runConfigCommand(args, ctx) {
             '  pugi config get routing                          Show effective routing table (defaults + tenant overrides).',
             '  pugi config set routing.<tag>.<budget>=<model>   Override the model for one (tag, budget) lane.',
             '  pugi config unset routing.<tag>.<budget>         Remove a routing override (revert to default).',
+            '  pugi config get privacy                          Show current tenant privacy mode + last-flip metadata.',
+            '  pugi config set privacy=<mode>                   Flip privacy mode (strict | balanced | permissive).',
         ].join('\n'));
         return;
     }
@@ -81,6 +85,13 @@ export async function runConfigCommand(args, ctx) {
             if (args[1] === 'routing') {
                 return runRoutingGet(ctx);
             }
+            // alpha 6.13: `pugi config get privacy` hits the admin-api
+            // /api/admin/privacy/mode surface. The privacy mode is a tenant-
+            // scoped server-side setting (so the Anvil filter can enforce it),
+            // not a local-only preference.
+            if (args[1] === 'privacy') {
+                return runPrivacyGet(ctx);
+            }
             return runConfigGet(args.slice(1), ctx);
         case 'set':
             // Special form: `pugi config set routing.<tag>.<budget>=<model>` hits
@@ -88,6 +99,40 @@ export async function runConfigCommand(args, ctx) {
             if (args[1] && args[1].startsWith('routing.')) {
                 return runRoutingSet(args.slice(1), ctx);
             }
+            // alpha 6.13: `pugi config set privacy=<mode>` (or `privacy <mode>`)
+            // flips the tenant-scoped server-side mode IFF <mode> is one of
+            // the new closed set (strict | balanced | permissive). Legacy
+            // values (local-only | metadata | full) still hit the local
+            // config schema via runConfigSet so existing operators do not
+            // get a surprise 4xx when their playbook still uses the old
+            // names. The unit spec for config.ts has a regression test for
+            // both code paths.
+            //
+            // Triple-review P2 fix (2026-05-25): the prior disambiguation
+            // only excluded the bare form (`privacy local-only`) - the `=`
+            // form (`privacy=local-only`) still routed to runPrivacySet and
+            // 4xx'd. We now check the value AFTER `=` and route legacy local
+            // values to runConfigSet; new-style values + unknown values
+            // continue to runPrivacySet so its client-side validator surfaces
+            // a structured "Unknown privacy mode" error (preserves the
+            // existing UX for typos like `privacy=paranoid`).
+            if (args[1]) {
+                const equalsForm = args[1].startsWith('privacy=');
+                const bareForm = args[1] === 'privacy';
+                if (equalsForm) {
+                    const valueAfterEquals = args[1].slice('privacy='.length);
+                    if (isLegacyLocalPrivacyValue(valueAfterEquals)) {
+                        // Legacy local form (`privacy=local-only|metadata|full`) -
+                        // split into `['privacy', '<value>']` so runConfigSet sees
+                        // the same shape it would for the bare form.
+                        return runConfigSet(['privacy', valueAfterEquals], ctx);
+                    }
+                    return runPrivacySet(args.slice(1), ctx);
+                }
+                if (bareForm && isNewPrivacyModeValue(args[2])) {
+                    return runPrivacySet(args.slice(1), ctx);
+                }
+            }
             return runConfigSet(args.slice(1), ctx);
         case 'unset':
             if (args[1] && args[1].startsWith('routing.')) {
@@ -393,6 +438,97 @@ async function runRoutingUnset(args, ctx) {
         ? `routing.${tag}.${budget} reverted to default.`
         : `routing.${tag}.${budget} had no override (nothing to remove).`);
 }
+/* ------------------------------------------------------------------ */
+/* alpha 6.13 privacy 3-mode - config.privacy.* subcommands             */
+/* ------------------------------------------------------------------ */
+/**
+ * Closed mirror of the server-side PRIVACY_MODES enum
+ * (apps/admin-api/src/privacy/privacy-mode.ts). Pinning the literal
+ * set here lets the CLI reject typos client-side before the round-
+ * trip to admin-api (better UX, smaller blast radius on a flaky
+ * network).
+ */
+const PRIVACY_MODES = ['strict', 'balanced', 'permissive'];
+function isNewPrivacyModeValue(value) {
+    return typeof value === 'string' && PRIVACY_MODES.includes(value);
+}
+function isPrivacyMode(value) {
+    return PRIVACY_MODES.includes(value);
+}
+/**
+ * Legacy local-config privacy values from before alpha 6.13. Kept so
+ * `pugi config set privacy=local-only` continues to write to the local
+ * config file (matching the bare-form behaviour). Triple-review P2 fix
+ * (2026-05-25): the prior disambiguation only excluded the bare form;
+ * the `=` form routed to runPrivacySet and 4xx'd on the unknown mode.
+ */
+const LEGACY_LOCAL_PRIVACY_VALUES = [
+    'local-only',
+    'metadata',
+    'full',
+];
+function isLegacyLocalPrivacyValue(value) {
+    return (typeof value === 'string' &&
+        LEGACY_LOCAL_PRIVACY_VALUES.includes(value));
+}
+/**
+ * `pugi config get privacy` - fetch the current privacy mode snapshot
+ * from /api/admin/privacy/mode + render it in human-readable form.
+ */
+async function runPrivacyGet(ctx) {
+    const { apiUrl, apiKey } = resolveAdminApi();
+    const snapshot = await fetchJson(`${apiUrl}/api/admin/privacy/mode`, apiKey);
+    const lastUpdatedLine = snapshot.lastUpdated
+        ? `(last set by ${snapshot.lastUpdatedBy ?? 'unknown'} on ${snapshot.lastUpdated})`
+        : '(no flips recorded; on implicit default)';
+    const text = [
+        `privacy.mode = ${snapshot.mode}`,
+        `privacy.defaultMode = ${snapshot.defaultMode}`,
+        lastUpdatedLine,
+    ].join('\n');
+    ctx.writeOutput({
+        command: 'config.privacy.get',
+        apiUrl,
+        snapshot,
+    }, text);
+}
+/**
+ * `pugi config set privacy=<mode>` - PUT to /api/admin/privacy/mode.
+ * Validates the mode client-side against the closed set before
+ * round-tripping.
+ *
+ * Accepts both `privacy <mode>` and `privacy=<mode>` argument forms so
+ * the operator can type it either way.
+ */
+async function runPrivacySet(args, ctx) {
+    const raw = args.join(' ').trim();
+    let mode;
+    if (raw.startsWith('privacy=')) {
+        mode = raw.slice('privacy='.length).trim();
+    }
+    else if (raw === 'privacy') {
+        throw new Error('pugi config set privacy requires a mode. Try: pugi config set privacy=balanced');
+    }
+    else if (raw.startsWith('privacy ')) {
+        mode = raw.slice('privacy '.length).trim();
+    }
+    else {
+        throw new Error(`pugi config set privacy: unrecognised argument "${raw}". Try: pugi config set privacy=balanced`);
+    }
+    if (mode.length === 0) {
+        throw new Error('pugi config set privacy requires a mode. Try: pugi config set privacy=balanced');
+    }
+    if (!isPrivacyMode(mode)) {
+        throw new Error(`Unknown privacy mode "${mode}". Allowed: ${PRIVACY_MODES.join(', ')}.`);
+    }
+    const { apiUrl, apiKey } = resolveAdminApi();
+    const snapshot = await fetchJson(`${apiUrl}/api/admin/privacy/mode`, apiKey, { method: 'PUT', body: { mode } });
+    ctx.writeOutput({
+        command: 'config.privacy.set',
+        mode: snapshot.mode,
+        snapshot,
+    }, `privacy.mode = ${snapshot.mode}`);
+}
 /**
  * Thin authenticated fetch helper. Adds the bearer token + accepts JSON +
  * surfaces structured errors. Uses undici `request` (not native `fetch`)

package/dist/tools/file-tools.js

@@ -6,6 +6,35 @@ import { decidePermission } from '../core/permission.js';
 import { createReadRecord, hashContent } from '../core/file-cache.js';
 import { resolveWorkspacePath } from '../core/path-security.js';
 import { recordFileMutation, recordToolCall, recordToolResult } from '../core/session.js';
+/**
+ * α6.9 WriteGate marker — thrown by `gateOnCancellation` when the
+ * caller supplied a cancellation token that has already aborted. The
+ * tool dispatch loop in `tool-bridge.ts` recognises the name and folds
+ * the throw into a `status: 'aborted'` tool result rather than a hard
+ * error so the loop terminates cleanly.
+ */
+export class OperatorAbortedError extends Error {
+    constructor(toolName) {
+        super(`operator_aborted: ${toolName} refused — operator cancelled the dispatch.`);
+        this.name = 'OperatorAbortedError';
+    }
+}
+/**
+ * α6.9 WriteGate: refuse the tool dispatch when the active
+ * cancellation token has aborted. Idempotent (the token's `isAborted`
+ * is a getter, no side effects). Returns void on the happy path so the
+ * tool can proceed; throws `OperatorAbortedError` when cancelled.
+ *
+ * The audit trail still gets the call: `recordToolCall` already fired
+ * upstream of this guard so the abort + reason are persisted. The
+ * matching `recordToolResult` is fired by the caller in its catch
+ * block with `status: 'cancelled'` (see existing path for `error`).
+ */
+export function gateOnCancellation(ctx, toolName) {
+    if (ctx.cancellation && ctx.cancellation.isAborted) {
+        throw new OperatorAbortedError(toolName);
+    }
+}
 /**
  * Re-check the permission decision against the *resolved* real path so
  * a workspace-local symlink (`alias -> .env`) cannot bypass the protected
@@ -42,6 +71,13 @@ function permissionGatedResolve(ctx, inputPath, action, toolName) {
 }
 export function readTool(ctx, path) {
     const toolCallId = recordToolCall(ctx.session, 'read', path);
+    // α6.9 WriteGate: fail fast on operator cancel BEFORE permission
+    // decision so a half-second post-cancel race never lands the read.
+    if (ctx.cancellation && ctx.cancellation.isAborted) {
+        const reason = 'operator_aborted: read refused';
+        recordToolResult(ctx.session, toolCallId, 'cancelled', reason);
+        throw new OperatorAbortedError('read');
+    }
     const decision = decidePermission({ tool: 'read', kind: 'read', target: path }, ctx.settings, ctx.root);
     if (decision.decision !== 'allow') {
         const reason = `Permission ${decision.decision} for read ${path}: ${decision.reason}`;
@@ -64,6 +100,14 @@ export function readTool(ctx, path) {
 }
 export function writeTool(ctx, path, content) {
     const toolCallId = recordToolCall(ctx.session, 'write', path);
+    // α6.9 WriteGate: refuse the write when the operator has cancelled
+    // the dispatch. The audit log captures the cancellation reason so a
+    // post-mortem can distinguish operator_aborted from settings-deny.
+    if (ctx.cancellation && ctx.cancellation.isAborted) {
+        const reason = 'operator_aborted: write refused';
+        recordToolResult(ctx.session, toolCallId, 'cancelled', reason);
+        throw new OperatorAbortedError('write');
+    }
     const decision = decidePermission({ tool: 'write', kind: 'edit', target: path }, ctx.settings, ctx.root);
     if (decision.decision !== 'allow') {
         const reason = `Permission ${decision.decision} for write ${path}: ${decision.reason}`;
@@ -95,6 +139,15 @@ export function writeTool(ctx, path, content) {
 }
 export function editTool(ctx, path, oldString, newString) {
     const toolCallId = recordToolCall(ctx.session, 'edit', path);
+    // α6.9 WriteGate: refuse the edit when the operator has cancelled
+    // the dispatch. Edits are higher-risk than reads — surface the abort
+    // BEFORE we even consult permissions so a cancel-during-tool-loop
+    // never partially mutates the workspace.
+    if (ctx.cancellation && ctx.cancellation.isAborted) {
+        const reason = 'operator_aborted: edit refused';
+        recordToolResult(ctx.session, toolCallId, 'cancelled', reason);
+        throw new OperatorAbortedError('edit');
+    }
     const decision = decidePermission({ tool: 'edit', kind: 'edit', target: path }, ctx.settings, ctx.root);
     if (decision.decision !== 'allow') {
         const reason = `Permission ${decision.decision} for edit ${path}: ${decision.reason}`;
@@ -140,6 +193,14 @@ export function editTool(ctx, path, oldString, newString) {
 }
 export function globTool(ctx, pattern) {
     const toolCallId = recordToolCall(ctx.session, 'glob', pattern);
+    // α6.9 WriteGate: cancel-aware short-circuit. Glob is read-only but
+    // can be expensive on large trees; respecting the abort here keeps
+    // the tool loop responsive when the operator hits Ctrl+C mid-scan.
+    if (ctx.cancellation && ctx.cancellation.isAborted) {
+        const reason = 'operator_aborted: glob refused';
+        recordToolResult(ctx.session, toolCallId, 'cancelled', reason);
+        throw new OperatorAbortedError('glob');
+    }
     // Pugi globs are workspace-scoped. Reject any pattern that could enumerate
     // outside the workspace:
     //   1. absolute paths (`/etc/**/*`) — globSync resolves these against `/`
@@ -169,11 +230,28 @@ export function globTool(ctx, pattern) {
 }
 export function grepTool(ctx, query) {
     const toolCallId = recordToolCall(ctx.session, 'grep', query);
+    // α6.9 WriteGate: refuse before scanning. Grep walks the whole
+    // workspace and can take seconds on a large repo; check abort first
+    // so a cancel mid-scan returns immediately rather than after the
+    // full walk completes.
+    if (ctx.cancellation && ctx.cancellation.isAborted) {
+        const reason = 'operator_aborted: grep refused';
+        recordToolResult(ctx.session, toolCallId, 'cancelled', reason);
+        throw new OperatorAbortedError('grep');
+    }
     const files = globTool(ctx, '**/*').filter((path) => !path.endsWith('/'));
     const matches = [];
     for (const path of files) {
         if (matches.length >= 200)
             break;
+        // α6.9 WriteGate: poll abort inside the file loop so a cancel
+        // arriving mid-scan terminates early. The per-file branch keeps
+        // the responsiveness bounded by the slowest single-file read.
+        if (ctx.cancellation && ctx.cancellation.isAborted) {
+            const reason = `operator_aborted: grep stopped mid-scan after ${matches.length} matches`;
+            recordToolResult(ctx.session, toolCallId, 'cancelled', reason);
+            throw new OperatorAbortedError('grep');
+        }
         // Permission gate every file read individually — grep used to bypass
         // `decidePermission` and could surface lines from protected files
         // (.env, *.sql, *.pem, ~/.ssh/**) when invoked from a directory walk.
@@ -241,6 +319,18 @@ export const BASH_DEFAULT_TIMEOUT_MS = 30_000;
 export const BASH_CHILD_MAXBUFFER = 10 * 1024 * 1024;
 export function bashTool(ctx, command, options = {}) {
     const toolCallId = recordToolCall(ctx.session, 'bash', command);
+    // α6.9 WriteGate: bash is the highest-risk tool surface. Refuse
+    // before the destructive-pattern classifier even runs so a
+    // cancelled dispatch never spawns a child process. Note: this is
+    // pre-spawn cancellation only; once the /bin/sh -c process is
+    // running, the synchronous spawnSync wait blocks until it exits or
+    // the 30s timeout fires. Phase 2 will wire SIGTERM forwarding via
+    // an async wrapper.
+    if (ctx.cancellation && ctx.cancellation.isAborted) {
+        const reason = 'operator_aborted: bash refused';
+        recordToolResult(ctx.session, toolCallId, 'cancelled', reason);
+        throw new OperatorAbortedError('bash');
+    }
     const decision = decidePermission({ tool: 'bash', kind: 'bash', target: command }, ctx.settings, ctx.root);
     if (decision.decision !== 'allow') {
         const reason = `Permission ${decision.decision} for bash: ${decision.reason}`;