@pugi/cli 0.1.0-beta.10 → 0.1.0-beta.100

package/dist/runtime/commands/undo.js

@@ -3,34 +3,35 @@ import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from
 import { resolve } from 'node:path';
 import { hashContent } from '../../core/file-cache.js';
 import { recordFileMutation, recordToolCall, recordToolResult, } from '../../core/session.js';
+import { writeBlob } from './redo-blob-store.js';
 /**
  * `pugi undo` — revert the file mutations from the most recent successful
  * `write` / `edit` / `multi_edit` tool result.
  *
  * Walk strategy:
- *   1. Read `.pugi/events.jsonl` line by line into an array.
- *   2. Walk backwards. Find the most recent `tool_result` whose
- *      `status === 'success'` and whose linked `tool_call` names a
- *      mutating tool (write / edit / multi_edit).
- *   3. From that point, gather every `file_mutation` event that shares
- *      the same `toolCallId`. M1 records one `file_mutation` per
- *      mutating tool call, but the loop is shaped for the multi_edit
- *      future case where a single tool call mutates many files.
+ *  1. Read `.pugi/events.jsonl` line by line into an array.
+ *  2. Walk backwards. Find the most recent `tool_result` whose
+ *     `status === 'success'` and whose linked `tool_call` names a
+ *     mutating tool (write / edit / multi_edit).
+ *  3. From that point, gather every `file_mutation` event that shares
+ *     the same `toolCallId`. M1 records one `file_mutation` per
+ *     mutating tool call, but the loop is shaped for the multi_edit
+ *     future case where a single tool call mutates many files.
  *
  * Restore strategy (M1 — no blob store yet):
- *   For each mutation we restore from the workspace's git history when
- *   possible, with a strict safety gate to avoid silently overwriting
- *   the user's WORK-IN-PROGRESS:
+ *  For each mutation we restore from the workspace's git history when
+ *  possible, with a strict safety gate to avoid silently overwriting
+ *  the user's WORK-IN-PROGRESS:
  *
- *   - `operation: create`  → unlink the created file iff its current
- *     sha256 matches the recorded `afterHash`. Skip otherwise (the user
- *     has edited it since; refuse to delete their work).
- *   - `operation: update`  → restore from `HEAD:<path>` iff (a) the file
- *     was tracked at HEAD AND (b) the HEAD content's sha256 matches the
- *     recorded `beforeHash`. Otherwise abort the turn (no partial
- *     reverts — the spec is atomic).
- *   - `operation: delete`  → restore the deleted file from `HEAD:<path>`
- *     if tracked there; skip otherwise.
+ *  - `operation: create` → unlink the created file iff its current
+ *    sha256 matches the recorded `afterHash`. Skip otherwise (the user
+ *    has edited it since; refuse to delete their work).
+ *  - `operation: update` → restore from `HEAD:<path>` iff (a) the file
+ *    was tracked at HEAD AND (b) the HEAD content's sha256 matches the
+ *    recorded `beforeHash`. Otherwise abort the turn (no partial
+ *    reverts — the spec is atomic).
+ *  - `operation: delete` → restore the deleted file from `HEAD:<path>`
+ *    if tracked there; skip otherwise.
  *
  * If any single restore is unsafe the whole turn aborts with exit code
  * 1 and no files are touched.
@@ -39,7 +40,7 @@ import { recordFileMutation, recordToolCall, recordToolResult, } from '../../cor
  * but NOT raw content (see `core/file-cache.ts`). M1 ships without a
  * dedicated blob CAS; `git show HEAD:<path>` is the cheapest authoritative
  * source for pre-mutation content as long as the workspace is a git
- * repository. The α6.4 SQLite session store will replace this with a
+ * repository. The SQLite session store will replace this with a
  * proper before-blob ledger.
  */
 const MUTATING_TOOLS = new Set(['write', 'edit', 'multi_edit']);
@@ -81,6 +82,37 @@ export async function runUndoCommand(_args, ctx) {
     const restored = [];
     for (const step of plan.steps) {
         try {
+            // : snapshot the AFTER state into the redo
+            // blob store BEFORE we revert the file on disk. /redo reads this
+            // blob keyed by `step.beforeHash` (= original afterHash) to
+            // reapply the change. We only snapshot for operations that have
+            // on-disk AFTER content: `create` (file exists, about to be
+            // deleted) and `update` (file exists, about to be overwritten).
+            // For `delete` reverts (file was deleted by Pugi, the "after" is
+            // nothing) redo replays the delete itself — no content needed.
+            // Best-effort: a blob-store failure must not abort the undo, so
+            // the writeBlob call is wrapped и any error swallowed.
+            if (step.operation === 'create' || step.operation === 'update') {
+                try {
+                    const abs = resolve(ctx.workspaceRoot, step.path);
+                    if (existsSync(abs) && step.beforeHash) {
+                        const current = readFileSync(abs, 'utf8');
+                        // Defensive: only snapshot if the current sha matches the
+                        // pre-revert hash the planner verified. The planner already
+                        // gated this, but a TOCTOU between plan + execute would
+                        // produce a wrong blob — silently dropping it is safer than
+                        // shipping content under the wrong sha.
+                        if (hashContent(current) === step.beforeHash) {
+                            writeBlob(ctx.workspaceRoot, current);
+                        }
+                    }
+                }
+                catch {
+                    // Best-effort. Failure to snapshot means /redo will report
+                    // "no captured content" — operator can re-run the mutation
+                    // manually. Better than aborting the undo.
+                }
+            }
             executeRevert(ctx.workspaceRoot, step);
             restored.push({ path: step.path, operation: step.operation });
         }
@@ -119,7 +151,7 @@ export async function runUndoCommand(_args, ctx) {
         restored,
     }, [
         `Undid ${restored.length} mutation(s) from ${target.toolCallId}:`,
-        ...restored.map((entry) => `  ${entry.operation.padEnd(7)} ${entry.path}`),
+        ...restored.map((entry) => ` ${entry.operation.padEnd(7)} ${entry.path}`),
     ].join('\n'));
 }
 function parseEvents(eventsPath) {

package/dist/runtime/commands/update.js

@@ -0,0 +1,289 @@
+/**
+ * — `pugi update` dispatcher.
+ *
+ * Top-level command + in-REPL `/update` slash share this handler.
+ * Both surfaces delegate IO + persistence here so the channel
+ * resolution, the registry probe, and the install shell-out stay
+ * single-sourced.
+ *
+ * Command grammar:
+ *
+ *  pugi update                    -> probe + interactive prompt
+ *  pugi update --check            -> probe + JSON envelope (scripted)
+ *  pugi update --channel <name>   -> switch channel + probe
+ *  pugi update --apply            -> probe + shell `npm i -g …`
+ *                                     (confirms unless --yes)
+ *  pugi update --apply --yes      -> probe + shell, no confirmation
+ *
+ * Exit codes:
+ *
+ *  0 — happy path (no update OR update completed) OR `--check` JSON
+ *  1 — install / probe failure with structured error envelope
+ *  2 — argument error (bad channel, conflicting flags)
+ *
+ * R2 atomic swap deferred (sprint plan L27 mention): the upstream behavior
+ * also describes the upstream tool's R2-backed binary swap. Pugi ships
+ * exclusively via npm today; building a parallel R2 distribution
+ * channel + checksum verification + rollback is materially more work
+ * than the L27 acceptance criteria allow. Document the deferral in
+ * the PR body and revisit when npm's once-per-day rate-limit or
+ * outage cadence justifies the parallel pipeline.
+ */
+import { spawn } from 'node:child_process';
+import { homedir } from 'node:os';
+import { DEFAULT_UPDATE_CHANNEL, UPDATE_CHANNELS, describeChannel, npmTagForChannel, parseUpdateChannel, } from '../../core/auto-update/channels.js';
+import { checkForChannelUpdate, } from '../../core/auto-update/checker.js';
+import { resolveEffectiveChannel, setUpdateChannel, writeLastCheckedAt, } from '../../core/auto-update/state.js';
+import { PUGI_CLI_VERSION } from '../version.js';
+/**
+ * Default subprocess runner. Spawns `npm install -g @pugi/cli@<tag>`
+ * inheriting stdio so the operator sees the live npm output.
+ */
+export function defaultSpawnInstaller(channel) {
+    const tag = npmTagForChannel(channel);
+    const args = ['install', '-g', `@pugi/cli@${tag}`];
+    return new Promise((resolvePromise) => {
+        const child = spawn('npm', args, { stdio: 'inherit' });
+        child.on('exit', (code) => {
+            resolvePromise(typeof code === 'number' ? code : 1);
+        });
+        child.on('error', () => {
+            // ENOENT / EACCES — npm not on PATH or permission denied. We
+            // surface a non-zero code so the dispatcher's JSON envelope
+            // tells the operator the apply failed; the inherited stdio
+            // already printed the underlying error to the terminal.
+            resolvePromise(127);
+        });
+    });
+}
+/**
+ * Parse a CLI / slash argv into our `UpdateCommandFlags`. Returns
+ * `null` AND writes the usage error via `writeError` for conflicting
+ * combinations. Both `pugi update` and the in-REPL `/update <args>`
+ * surface call through this so the validation lives in one place.
+ */
+export function parseUpdateArgs(argv, options = {}) {
+    let check = false;
+    let apply = false;
+    let yes = false;
+    let json = options.jsonDefault ?? false;
+    let channel = null;
+    let channelInvalid;
+    for (let i = 0; i < argv.length; i += 1) {
+        const token = argv[i] ?? '';
+        if (token === '--check') {
+            check = true;
+        }
+        else if (token === '--apply') {
+            apply = true;
+        }
+        else if (token === '--yes' || token === '-y') {
+            yes = true;
+        }
+        else if (token === '--json') {
+            json = true;
+        }
+        else if (token === '--channel') {
+            const value = argv[i + 1];
+            i += 1;
+            const parsed = parseUpdateChannel(value);
+            if (!parsed) {
+                channelInvalid = value ?? '';
+                continue;
+            }
+            channel = parsed;
+        }
+        else if (token.startsWith('--channel=')) {
+            const value = token.slice('--channel='.length);
+            const parsed = parseUpdateChannel(value);
+            if (!parsed) {
+                channelInvalid = value;
+                continue;
+            }
+            channel = parsed;
+        }
+        else {
+            return {
+                error: `pugi update: unknown argument '${token}'. See \`pugi update --help\`.`,
+            };
+        }
+    }
+    if (channelInvalid !== undefined) {
+        return {
+            error: `pugi update: unknown channel '${channelInvalid}'. Allowed: ${UPDATE_CHANNELS.join(' / ')}.`,
+        };
+    }
+    return {
+        check,
+        apply,
+        yes,
+        json,
+        channel,
+    };
+}
+/**
+ * Run the full command. Returns the structured envelope so the in-
+ * REPL slash can decide whether to render the human-readable text OR
+ * pretty-print the JSON.
+ */
+export async function runUpdateCommand(ctx) {
+    const flags = ctx.flags;
+    const home = ctx.home;
+    // 1. Resolve channel. `--channel <name>` wins; otherwise read the
+    //   persisted preference; otherwise hard default `beta`.
+    const cliFlagChannel = flags.channel;
+    const effectiveChannel = resolveEffectiveChannel({
+        cliFlag: cliFlagChannel,
+        homeDir: home,
+    });
+    // 2. Persist the channel switch BEFORE the probe so a probe failure
+    //   still leaves the operator on the channel they asked for.
+    let switched = false;
+    if (cliFlagChannel) {
+        setUpdateChannel(cliFlagChannel, home);
+        switched = true;
+    }
+    // 3. Probe the registry.
+    const outcome = await checkForChannelUpdate({
+        channel: effectiveChannel,
+        currentVersion: PUGI_CLI_VERSION,
+        ...(ctx.fetchImpl ? { fetchImpl: ctx.fetchImpl } : {}),
+        ...(ctx.registryUrl ? { registryUrl: ctx.registryUrl } : {}),
+    });
+    // 4. Record the timestamp on a successful probe (regardless of
+    //   whether an update is available). Failed probes do NOT update
+    //   the timestamp so the cold-start banner retries on the next
+    //   invocation.
+    if (!outcome.error) {
+        const now = ctx.now ? new Date(ctx.now()) : new Date();
+        try {
+            writeLastCheckedAt(now, home);
+        }
+        catch {
+            // Best-effort — a read-only home should not crash the dispatcher.
+        }
+    }
+    // 5. Build the envelope shape ALL action paths share.
+    const baseEnvelope = {
+        command: 'update',
+        ok: outcome.error === null,
+        available: outcome.available,
+        channel: outcome.channel,
+        npmTag: outcome.npmTag,
+        current: outcome.current,
+        latest: outcome.latest,
+        gap: outcome.gap,
+        installCommand: outcome.installCommand,
+        action: outcome.error ? 'error' : 'probe',
+        error: outcome.error,
+        meta: { cliVersion: PUGI_CLI_VERSION },
+    };
+    // 6. --check: emit the envelope, never prompt, never apply.
+    if (flags.check) {
+        const text = renderHumanText(baseEnvelope, { switched });
+        ctx.writeOutput(baseEnvelope, text);
+        return baseEnvelope;
+    }
+    // 7. No update available — bail with a friendly message.
+    if (!outcome.available || !outcome.latest) {
+        const envelope = {
+            ...baseEnvelope,
+            action: outcome.error ? 'error' : (switched ? 'switch' : 'no_update'),
+        };
+        const text = renderHumanText(envelope, { switched });
+        ctx.writeOutput(envelope, text);
+        return envelope;
+    }
+    // 8. Update IS available. Branch on --apply.
+    if (!flags.apply) {
+        // Default: print the offer, suggest the install command, leave
+        // the install to the operator. Mirrors the upstream behavior note:
+        // operators install side-effects must remain explicit on the CLI
+        // happy path — `pugi update` showing the gap is informational,
+        // `pugi update --apply` is the destructive verb.
+        const envelope = {
+            ...baseEnvelope,
+            action: switched ? 'switch' : 'probe',
+        };
+        const text = renderHumanText(envelope, { switched });
+        ctx.writeOutput(envelope, text);
+        return envelope;
+    }
+    // 9. --apply path. Confirm unless --yes, then spawn npm.
+    const installer = ctx.spawnInstaller ?? defaultSpawnInstaller;
+    let confirmed = flags.yes;
+    if (!confirmed) {
+        confirmed = await ctx.promptConfirm(`Run \`${outcome.installCommand}\` to update ${outcome.current} -> ${outcome.latest}? [y/N]`);
+    }
+    if (!confirmed) {
+        const envelope = {
+            ...baseEnvelope,
+            action: 'probe',
+            ok: false,
+            error: 'apply_cancelled_by_operator',
+        };
+        const text = `Cancelled. Run \`${outcome.installCommand}\` manually when you are ready.`;
+        ctx.writeOutput(envelope, text);
+        return envelope;
+    }
+    const exitCode = await installer(outcome.channel);
+    const applyEnvelope = {
+        ...baseEnvelope,
+        action: 'apply',
+        installExitCode: exitCode,
+        ok: exitCode === 0,
+        error: exitCode === 0 ? null : `npm_install_exit_${exitCode}`,
+    };
+    const applyText = exitCode === 0
+        ? `Updated to @pugi/cli@${outcome.latest}. Restart your shell so the new binary takes effect.`
+        : `Update failed (npm exit ${exitCode}). Try \`${outcome.installCommand}\` manually.`;
+    ctx.writeOutput(applyEnvelope, applyText);
+    return applyEnvelope;
+}
+/**
+ * Build the operator-readable hint that lives next to the JSON
+ * envelope. The text + the JSON are both passed to `writeOutput`; the
+ * caller (`writeOutput` in cli.ts) picks based on `--json`. Exported
+ * so the spec can assert the literal strings the operator sees.
+ */
+export function renderHumanText(envelope, options = {}) {
+    const { current, latest, channel, installCommand, available, error } = envelope;
+    const lines = [];
+    lines.push(`Channel: ${channel} — ${describeChannel(channel)}`);
+    if (options.switched) {
+        lines.push(`Persisted channel selection -> ${channel}.`);
+    }
+    if (error) {
+        lines.push(`Update check failed: ${error}`);
+        lines.push(`Manual: \`${installCommand}\` (no probe necessary).`);
+        return lines.join('\n');
+    }
+    if (available && latest) {
+        lines.push(`Update available: ${current} -> ${latest}.`);
+        lines.push(`Run \`${installCommand}\` to upgrade.`);
+        lines.push(`Or \`pugi update --apply\` to upgrade with confirmation.`);
+        return lines.join('\n');
+    }
+    lines.push(`Up to date (${current} is the latest on ${channel}).`);
+    return lines.join('\n');
+}
+/**
+ * Render a one-line cold-start hint that callers (REPL boot, doctor
+ * banner) splice above their own UI. Returns `null` when there is
+ * nothing to nudge the operator about. Pure — no IO.
+ */
+export function renderUpdateHint(outcome) {
+    if (!outcome.available || !outcome.latest)
+        return null;
+    return `Update available: ${outcome.current} -> ${outcome.latest}. Run \`pugi update\`.`;
+}
+/**
+ * Convenience entry point — resolve the effective channel from
+ * `~/.pugi/config.json` + DEFAULT_UPDATE_CHANNEL without forcing the
+ * caller to import multiple modules. Used by the cold-start banner +
+ * the doctor probe.
+ */
+export function effectiveChannel(home = homedir()) {
+    return resolveEffectiveChannel({ homeDir: home }) ?? DEFAULT_UPDATE_CHANNEL;
+}
+//# sourceMappingURL=update.js.map

package/dist/runtime/commands/vim.js

@@ -0,0 +1,140 @@
+/**
+ * — `pugi vim` top-level command + REPL slash
+ * companion.
+ *
+ * Operator surface:
+ *
+ *  pugi vim                      Show current vim-mode state.
+ *  pugi vim on                   Enable + persist (~/.pugi/config.json).
+ *  pugi vim off                  Disable + persist (default).
+ *  /vim                          Toggle from inside the REPL.
+ *  /vim on                       Enable from inside the REPL.
+ *  /vim off                      Disable from inside the REPL.
+ *
+ * The same runner backs both surfaces so the slash + the shell verb
+ * stay single-sourced — operators trained on one read the same
+ * payload + banner on the other.
+ *
+ * Exit codes:
+ *  0 — show / enable / disable / toggle happy path
+ *  2 — unknown subcommand (e.g. `pugi vim chaos`)
+ *
+ * NOTE: there are NO `--persist` flag and no workspace tier. Vim mode
+ * is a single user-level preference, matching the upstream behavior note
+ * that operators expect modal editing to be a body-memory trait, not
+ * a per-repo concern (see `core/vim/state.ts` header).
+ */
+import { resolveVimMode, setVimMode } from '../../core/vim/state.js';
+/**
+ * Banner shown on enable so the operator can see the binding cheat
+ * sheet without reaching for `/help`. Echoed by both surfaces.
+ */
+export const VIM_ENABLED_BANNER = 'Vim mode on. Esc=normal, i=insert, :w=submit, :q=cancel.';
+/**
+ * Entry point. Parses `args`, flips persistence as needed, emits the
+ * payload + text via `ctx.writeOutput`, and returns the exit code.
+ */
+export async function runVimCommand(args, ctx) {
+    // Validate args before reading state so a bad call never has a
+    // side-effect.
+    if (args.length > 1) {
+        const payload = {
+            command: 'vim',
+            status: 'invalid_args',
+            active: resolveVimMode({ env: ctx.env }),
+            message: `pugi vim takes at most one argument (on / off / toggle). Got: ${args.join(' ')}`,
+            attemptedArg: args.join(' '),
+        };
+        ctx.writeOutput(payload, payload.message);
+        return 2;
+    }
+    const current = resolveVimMode({ env: ctx.env });
+    const verb = args[0]?.toLowerCase() ?? '';
+    // No args → toggle (slash convention from the upstream behavior ). The
+    // CLI shell surface ALSO toggles on bare invocation so the two
+    // surfaces converge; if the operator wants the read-only show they
+    // can pipe through `pugi vim --json` or query the config directly.
+    // We surface the change as a `show` status when nothing flipped so
+    // scripts can distinguish read from write.
+    if (verb === '') {
+        const next = !current;
+        setVimMode(next, { env: ctx.env });
+        const status = next ? 'enabled' : 'disabled';
+        const message = next ? VIM_ENABLED_BANNER : 'Vim mode off.';
+        const payload = {
+            command: 'vim',
+            status,
+            active: next,
+            previous: current,
+            message,
+        };
+        ctx.writeOutput(payload, payload.message);
+        return 0;
+    }
+    if (verb === 'on' || verb === 'enable' || verb === 'true') {
+        if (current) {
+            const payload = {
+                command: 'vim',
+                status: 'unchanged',
+                active: true,
+                previous: true,
+                message: 'Vim mode already on.',
+            };
+            ctx.writeOutput(payload, payload.message);
+            return 0;
+        }
+        setVimMode(true, { env: ctx.env });
+        const payload = {
+            command: 'vim',
+            status: 'enabled',
+            active: true,
+            previous: current,
+            message: VIM_ENABLED_BANNER,
+        };
+        ctx.writeOutput(payload, payload.message);
+        return 0;
+    }
+    if (verb === 'off' || verb === 'disable' || verb === 'false') {
+        if (!current) {
+            const payload = {
+                command: 'vim',
+                status: 'unchanged',
+                active: false,
+                previous: false,
+                message: 'Vim mode already off.',
+            };
+            ctx.writeOutput(payload, payload.message);
+            return 0;
+        }
+        setVimMode(false, { env: ctx.env });
+        const payload = {
+            command: 'vim',
+            status: 'disabled',
+            active: false,
+            previous: current,
+            message: 'Vim mode off.',
+        };
+        ctx.writeOutput(payload, payload.message);
+        return 0;
+    }
+    if (verb === 'status' || verb === 'show') {
+        const payload = {
+            command: 'vim',
+            status: 'show',
+            active: current,
+            message: current ? 'Vim mode is on.' : 'Vim mode is off.',
+        };
+        ctx.writeOutput(payload, payload.message);
+        return 0;
+    }
+    const payload = {
+        command: 'vim',
+        status: 'invalid_args',
+        active: current,
+        message: `Unknown vim subcommand "${verb}". Try one of: on, off, status.`,
+        attemptedArg: verb,
+    };
+    ctx.writeOutput(payload, payload.message);
+    return 2;
+}
+//# sourceMappingURL=vim.js.map

package/dist/runtime/commands/worktree.js

@@ -1,11 +1,11 @@
 /**
- * `pugi worktree <op>` — α7.7 Phase 1.
+ * `pugi worktree <op>` — Phase 1.
  *
  * Manual control over the scratch worktree primitive. Three subcommands:
  *
- *   pugi worktree create [branch]    # spawns `.pugi/worktrees/<uuid>`
- *   pugi worktree promote <path>     # applies the worktree's diff back to cwd
- *   pugi worktree drop <path>        # removes the worktree (idempotent)
+ *  pugi worktree create [branch]   # spawns `.pugi/worktrees/<uuid>`
+ *  pugi worktree promote <path>    # applies the worktree's diff back to cwd
+ *  pugi worktree drop <path>       # removes the worktree (idempotent)
  *
  * Output: human-readable by default, structured JSON under --json so
  * scripted callers can chain (`pugi worktree create --json | jq .path`).
@@ -20,7 +20,7 @@ import { spawnSync } from 'node:child_process';
 import { resolve, sep } from 'node:path';
 import { createWorktree, dropWorktree, promoteWorktree } from '../../core/edits/worktree.js';
 /**
- * R1 fix (2026-05-26, PR #413 r1, P2 #10): operator-facing path
+ * R1 fix (2026-05-26, PR r1, P2 #10): operator-facing path
  * validation. The core `promoteWorktree` / `dropWorktree` primitives
  * already gate their inputs, but mirroring the check at the CLI surface
  * gives the operator a clean error message before we even attempt the
@@ -168,9 +168,9 @@ function usage() {
     return {
         ok: false,
         text: 'Usage: pugi worktree <op>\n' +
-            '  pugi worktree create [branch]\n' +
-            '  pugi worktree promote <path>\n' +
-            '  pugi worktree drop <path>',
+            ' pugi worktree create [branch]\n' +
+            ' pugi worktree promote <path>\n' +
+            ' pugi worktree drop <path>',
         exitCode: 2,
     };
 }