@pugi/cli 0.1.0-beta.14 → 0.1.0-beta.16

package/bin/run.js

@@ -1,2 +1,34 @@
 #!/usr/bin/env node
-import '../dist/index.js';
+// 2026-05-27 — silence the noisy `node:sqlite` ExperimentalWarning.
+// Node 22.x prints a multi-line warning the first time any consumer
+// imports `node:sqlite` (see core/repl/store/session-store.ts). CEO has
+// pinged this surface twice now ("(node:XXXXX) ExperimentalWarning:
+// SQLite is an experimental feature and might change at any time" +
+// trace-warnings hint). Hiding it cleanly requires a tap on
+// process.emitWarning BEFORE any module loads the sqlite binding —
+// hence wiring it here in the binary entry, not deep inside the CLI.
+//
+// We allowlist only the exact sqlite warning + leave every other
+// runtime warning (deprecation, security, custom code paths) intact.
+// Operator can still re-enable the noise by exporting
+// PUGI_SHOW_EXPERIMENTAL_WARNINGS=1 — useful when debugging a node
+// version bump that might surface a new experimental flag we should
+// notice.
+if (!process.env.PUGI_SHOW_EXPERIMENTAL_WARNINGS) {
+  const originalEmit = process.emit;
+  process.emit = function patchedEmit(name, ...args) {
+    if (name === 'warning') {
+      const w = args[0];
+      const isSqliteExperimental =
+        w &&
+        typeof w === 'object' &&
+        w.name === 'ExperimentalWarning' &&
+        typeof w.message === 'string' &&
+        /SQLite is an experimental feature/i.test(w.message);
+      if (isSqliteExperimental) return false;
+    }
+    return originalEmit.call(this, name, ...args);
+  };
+}
+
+import('../dist/index.js');

package/dist/runtime/cli.js

@@ -832,7 +832,176 @@ async function version(_args, flags, _session) {
     };
     writeOutput(flags, payload, `pugi ${payload.version}`);
 }
-async function help(_args, flags, _session) {
+/**
+ * Per-command help bodies (task #100). When the operator types
+ * `pugi <cmd> --help` the dispatcher routes here with `args = [cmd]`.
+ * If we have a focused body for that command, print it instead of the
+ * global summary. Falls back to the global summary so unknown / new
+ * commands still get a useful response.
+ *
+ * Source of truth for each entry: the comment block at the top of the
+ * command's implementation module + any flags the command declares.
+ * Keep entries short — operators want the one-liner of intent + the
+ * 2-5 most useful flags, not a tutorial. The global help still has the
+ * full per-section reference; the per-command body is the "tell me
+ * how to use this NOW" surface.
+ */
+const COMMAND_HELP_BODIES = {
+    init: [
+        'pugi init — bootstrap a new Pugi workspace in the current directory.',
+        '',
+        'Creates .pugi/{PUGI.md, mcp.json, index.json, artifacts/, sessions/} and',
+        'seeds the 6 default skills. Idempotent — running again only fills gaps.',
+        '',
+        'Flags:',
+        '  --no-defaults     Skip the bundled default-skills install.',
+        '',
+        'Env:',
+        '  PUGI_INIT_NO_DEFAULTS=1   Same as --no-defaults.',
+    ],
+    explain: [
+        'pugi explain "<question>" — read-only Q&A about the workspace.',
+        '',
+        'Calls the engine loop in explain mode (budget: 5 calls / 20k tokens).',
+        'No file writes; safe to run against unfamiliar code.',
+        '',
+        'Examples:',
+        '  pugi explain "what does this package.json define?"',
+        '  pugi explain "trace the auth flow in src/auth/"',
+    ],
+    code: [
+        'pugi code "<brief>" — engineering-mode write loop (30k token budget).',
+        '',
+        'Writes files in the current workspace. Use --no-tty in CI / pipes.',
+    ],
+    fix: [
+        'pugi fix "<brief>" — minimal-diff bugfix loop (30k token budget).',
+        '',
+        'Same as `pugi code` but the prompt biases toward the smallest patch',
+        'that closes the brief — refuses scope creep / refactor invitations.',
+    ],
+    build: [
+        'pugi build "<brief>" — feature-build loop (200k token budget).',
+        '',
+        'Multi-turn engineering with plan-review checkpoints. Pairs with',
+        'pugi plan --decompose <idea> when the brief is bigger than one PR.',
+    ],
+    plan: [
+        'pugi plan --decompose <idea> — split an idea into 3-7 components.',
+        '',
+        'Writes .pugi/plan/<session-id>/splits/NN-<name>/spec.md plus',
+        'manifest.md with the dependency DAG. Pass each split to `pugi build`.',
+    ],
+    review: [
+        'pugi review — code review surfaces.',
+        '',
+        '  --triple                3-model consensus via Anvil paid fleet.',
+        '  --triple --commit <SHA> Review a specific commit (vs origin/main).',
+        '  --consensus             Customer-facing consensus review (codex + claude + deepseek).',
+        '                          Optional: --commit <sha> | --pr <num> | --branch <name>.',
+        '',
+        'Exit codes: 0 PASS · 1 WARN · 2 BLOCK · 5 auth_missing · 7 rate_limited.',
+    ],
+    privacy: [
+        'pugi privacy — privacy-mode operations.',
+        '',
+        '  show                    Display effective mode + source.',
+        '  set <mode>              Local-only legacy values (local-only|metadata|full).',
+        '',
+        'For tenant-scoped server-side modes (strict|balanced|permissive), use:',
+        '  pugi config get privacy',
+        '  pugi config set privacy=<mode>',
+    ],
+    config: [
+        'pugi config — read / write CLI + tenant configuration.',
+        '',
+        '  get <key>                                       Local config value.',
+        '  get privacy                                     Tenant privacy snapshot (admin-api).',
+        '  get routing                                     Effective routing table.',
+        '  set <key>=<value>                               Local config write.',
+        '  set privacy=<mode>                              Flip tenant privacy (strict|balanced|permissive).',
+        '  set routing.<tag>.<budget>=<model>              Override one routing lane.',
+        '  unset routing.<tag>.<budget>                    Revert a routing override.',
+        '  mcp trust|deny|list <name>                      MCP server trust + visibility.',
+    ],
+    sync: [
+        'pugi sync — explicit-continuation handoff bundle upload.',
+        '',
+        '  --dry-run               Print the bundle plan without uploading.',
+        '  --privacy <mode>        Override per-bundle privacy posture.',
+    ],
+    whoami: [
+        'pugi whoami — show the active credential + JWT principal + plan tier.',
+        '',
+        'Reads from ~/.pugi/credentials.json. No network call unless --remote.',
+    ],
+    login: [
+        'pugi login — authenticate against an api.pugi.io endpoint.',
+        '',
+        'Interactive picker by default (browser OAuth / PAT / env). Non-interactive:',
+        '  --provider device                                Device-flow OAuth.',
+        '  --provider token --token <jwt>                   Pass a JWT directly.',
+        '  --provider env --env PUGI_API_KEY                Read from an env var.',
+    ],
+    accounts: [
+        'pugi accounts — manage stored credentials across endpoints.',
+        '',
+        '  list                    Every account + its endpoint + active flag.',
+        '  switch <label>          Re-point the active account.',
+        '  remove <label>          Delete a stored credential.',
+    ],
+    jobs: [
+        'pugi jobs — list, tail, or kill background dispatch jobs.',
+        '',
+        '  list                    All jobs in the registry.',
+        '  tail <id>               Stream output from one job.',
+        '  kill <id>               Cancel a running job.',
+    ],
+    delegate: [
+        'pugi delegate <slug> "<brief>" — dispatch a brief to one specialist persona.',
+        '',
+        'Slugs (Tier 1 alpha 7.5): dev qa pm devops researcher analyst designer',
+        'frontend architect. `pugi roster` lists the live set.',
+    ],
+    roster: [
+        'pugi roster — list the live Tier 1 personas + roles.',
+    ],
+    doctor: [
+        'pugi doctor — diagnose CLI + workspace + adapter capabilities.',
+        '',
+        'Prints CLI version, Node version, workspace state (.pugi presence,',
+        'event log, settings), permission mode, and the capability matrix per',
+        'engine adapter. Safe to run anywhere; no network calls.',
+    ],
+    ask: [
+        'pugi ask "<question>" — surface a yes/no question modal locally.',
+        '',
+        'Useful in shell scripts that need a human-confirm before a destructive',
+        'step. Exits 0 on yes, 1 on no, 2 on cancel.',
+    ],
+    deploy: [
+        'pugi deploy — trigger a vendor deployment from the bound Git source.',
+        '',
+        '  --target vercel <vercelProject> --project <id>   Vercel deploy.',
+        '  --target render <renderService> --project <id>   Render deploy (Sprint 2 stub).',
+        '  --status <id>                                    Vendor-agnostic status snapshot.',
+        '  --logs <id> [--tail]                             Build-log tail.',
+        '',
+        'Optional: --target-env production|preview, --ref <ref>, --integration <id>.',
+    ],
+};
+async function help(args, flags, _session) {
+    // 2026-05-27 task #100: per-command help bodies. When dispatcher
+    // routed `pugi <cmd> --help` here it passes `args = [cmd]`; if we
+    // have a focused body, print that. Falls through to the global
+    // summary on unknown / new commands so the dispatcher's redirect
+    // never produces a worse-than-baseline response.
+    const requested = args[0];
+    if (requested && COMMAND_HELP_BODIES[requested]) {
+        const body = COMMAND_HELP_BODIES[requested];
+        writeOutput(flags, { command: requested, lines: body }, body.join('\n'));
+        return;
+    }
     const commands = Object.keys(handlers).sort();
     writeOutput(flags, { commands }, [
         'Pugi CLI',

package/dist/runtime/commands/report.js

@@ -0,0 +1,299 @@
+/**
+ * PAVF-7 — `pugi report --from-error` field-bug capture.
+ *
+ * Operator hit a CLI failure ("pugi explain: failed [auth_missing]...")
+ * and wants to file a clean report без manual log-grepping. This command:
+ *
+ *   1. Locates the most-recently-modified session under .pugi/sessions/
+ *      (the engine adapter mirrors EVERY dispatch's events to a fresh
+ *      session dir; the latest one is always the failure that just
+ *      surprised the operator).
+ *   2. Reads events.jsonl + extracts the terminal-state event +
+ *      the last 50 frames before it (enough context to triage; small
+ *      enough for a GH issue body or email paste).
+ *   3. Captures workspace metadata (CLI version, Node version, OS,
+ *      tenant id from credentials, current dir, .pugi/PUGI.md presence).
+ *   4. Strips secrets — auth tokens, env values, JWT signatures —
+ *      before the report ever touches disk OR network.
+ *   5. Writes the bundle к .pugi/reports/<ISO-timestamp>-<session-id>/
+ *      with both a machine-readable report.json and a human-readable
+ *      report.md the operator can paste into a GH issue / email.
+ *   6. Prints the path + the canonical share command the operator can
+ *      run when ready to upload (the upload endpoint is deferred to a
+ *      follow-up; v1 keeps everything LOCAL so an operator working
+ *      offline / behind a corporate firewall can still file a clean
+ *      report).
+ *
+ * Why not auto-upload in v1:
+ *   The CEO HARD rule `feedback_no_fake_dispatch_promises` says we do
+ *   not invent dispatch we cannot deliver. Without a live
+ *   /api/pugi/report endpoint, an auto-upload would either silently
+ *   no-op or claim shipped и lie. v1 emits the artifacts + a clear
+ *   "upload pending" status; v2 (separate PR) wires the endpoint и
+ *   flips the default к upload-on-success.
+ *
+ * Exit codes (match the existing PAVF-1 stage_code table):
+ *   0  = report written successfully
+ *   8  = no sessions found (operator ran in a workspace без .pugi/)
+ *   9  = session events.jsonl unreadable / corrupted
+ *  20  = output path not writable (disk full / perms)
+ *
+ * Secret-redaction posture: PII / tokens / env values are stripped at
+ * the report-generation layer, NOT at upload time. Even if the operator
+ * never uploads, the report dir on disk MUST NOT carry plaintext
+ * secrets — a colleague who later runs `cat .pugi/reports/.../report.md`
+ * over the shoulder sees the bug context but not the bearer token.
+ */
+import { existsSync, readdirSync, readFileSync, mkdirSync, statSync, writeFileSync } from 'node:fs';
+import { join, resolve as resolvePath } from 'node:path';
+import { homedir, platform, release } from 'node:os';
+import { PUGI_CLI_VERSION } from '../version.js';
+const MAX_TAIL_FRAMES = 50;
+const MAX_DETAIL_CHARS = 400;
+const TERMINAL_TYPES = new Set([
+    'agent.completed',
+    'agent.failed',
+    'agent.blocked',
+    'subagent.outcome',
+    'result',
+]);
+/**
+ * Bearer / JWT / env-secret patterns. We do NOT try to be exhaustive
+ * (cat-and-mouse with custom secret formats is unwinnable); we cover
+ * the shapes that actually appear in Pugi sessions:
+ *
+ *   - `Authorization: Bearer eyJ...` (JWT header.payload.signature)
+ *   - `apiKey: eyJ...` inside captured JSON envelopes
+ *   - any long base64-ish token (>= 20 chars, [A-Za-z0-9_-]) following
+ *     `token`, `password`, `secret`, or `key` field names
+ *
+ * Replacement is a length-preserving `[REDACTED:<n>]` marker so the
+ * operator can still verify the report at-a-glance ("yes, a 32-char
+ * token was here") без leaking the value.
+ */
+function redact(text) {
+    if (!text)
+        return text;
+    // Bearer + JWT shape.
+    text = text.replace(/(Bearer\s+)([A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)/gi, (_m, prefix, tok) => `${prefix}[REDACTED:${tok.length}]`);
+    // Bare JWTs (no Bearer prefix) inside JSON / log lines.
+    text = text.replace(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, (tok) => `[REDACTED:${tok.length}]`);
+    // `"token": "..."` / `"apiKey": "..."` / `"password": "..."` shapes.
+    text = text.replace(/("(?:apiKey|api_key|token|access_token|refresh_token|password|secret|bearer)"\s*:\s*")([^"]{10,})(")/gi, (_m, before, val, after) => `${before}[REDACTED:${val.length}]${after}`);
+    // Bare env-style KEY=VALUE на длинных значениях.
+    text = text.replace(/\b((?:PUGI_API_KEY|GITHUB_TOKEN|NPM_TOKEN|ANVIL_API_KEY|OPENAI_API_KEY|ANTHROPIC_API_KEY|GEMINI_API_KEY)=)([^\s"']{10,})/g, (_m, prefix, val) => `${prefix}[REDACTED:${val.length}]`);
+    return text;
+}
+function clampDetail(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const redacted = redact(value);
+    return redacted.length > MAX_DETAIL_CHARS
+        ? `${redacted.slice(0, MAX_DETAIL_CHARS)}…`
+        : redacted;
+}
+function findLatestSession(cwd) {
+    const dir = resolvePath(cwd, '.pugi/sessions');
+    if (!existsSync(dir))
+        return null;
+    const entries = readdirSync(dir, { withFileTypes: true })
+        .filter((e) => e.isDirectory())
+        .map((e) => {
+        const path = join(dir, e.name);
+        let mtime = 0;
+        try {
+            mtime = statSync(join(path, 'events.jsonl')).mtimeMs;
+        }
+        catch {
+            // Session dir without events.jsonl yet — never opened. Skip.
+            return null;
+        }
+        return { name: e.name, path, mtime };
+    })
+        .filter((x) => x !== null)
+        .sort((a, b) => b.mtime - a.mtime);
+    return entries[0]?.path ?? null;
+}
+function readTenantIdSafely() {
+    const credPath = resolvePath(homedir(), '.pugi/credentials.json');
+    if (!existsSync(credPath))
+        return undefined;
+    try {
+        const raw = JSON.parse(readFileSync(credPath, 'utf8'));
+        const first = raw.tokens?.[0]?.apiKey;
+        if (!first || typeof first !== 'string')
+            return undefined;
+        // JWT payload is the middle segment; base64-decode + parse for the
+        // `customerId` claim. Failure here returns undefined (the report
+        // still emits useful context without it).
+        const parts = first.split('.');
+        if (parts.length !== 3)
+            return undefined;
+        const payload = JSON.parse(Buffer.from(parts[1] ?? '', 'base64').toString('utf8'));
+        return typeof payload.customerId === 'string' ? payload.customerId : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function captureFrames(eventsPath) {
+    const lines = readFileSync(eventsPath, 'utf8')
+        .split('\n')
+        .filter((l) => l.trim().length > 0);
+    const parsed = lines
+        .map((line) => {
+        try {
+            return JSON.parse(line);
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter((f) => f !== null);
+    // Keep the LAST MAX_TAIL_FRAMES frames — failures cluster at the
+    // end, and the tail is where the operator's context actually lives.
+    const tail = parsed.slice(-MAX_TAIL_FRAMES);
+    return tail.map((f) => {
+        const out = {
+            type: typeof f.type === 'string' ? f.type : 'unknown',
+        };
+        if (typeof f.taskId === 'string')
+            out.taskId = f.taskId;
+        if (typeof f.timestamp === 'string')
+            out.timestamp = f.timestamp;
+        if (typeof f.outcome === 'string')
+            out.outcome = f.outcome;
+        // Keep detail / error ONLY on terminal frames (full reply text on
+        // every agent.message would blow the report past the GH issue cap).
+        if (TERMINAL_TYPES.has(out.type)) {
+            const detail = clampDetail(f.detail) ?? clampDetail(f.error);
+            if (detail)
+                out.detail = detail;
+            if (typeof f.error === 'string')
+                out.error = clampDetail(f.error);
+        }
+        return out;
+    });
+}
+export function runReport(args, ctx) {
+    const fromError = args.includes('--from-error');
+    if (!fromError) {
+        ctx.writeOutput({
+            command: 'report',
+            status: 'no_sessions',
+            message: 'pugi report — capture a bug report from the most-recent session.\n\n' +
+                'Usage:\n' +
+                '  pugi report --from-error           Bundle the most-recent failed session as a report.\n\n' +
+                'Output: writes .pugi/reports/<timestamp>-<session-id>/{report.json, report.md}.\n' +
+                'Secrets (bearer tokens, JWTs, named env values) are stripped before disk write.',
+        }, 'pugi report — see `pugi report --help`');
+        return 0;
+    }
+    const sessionPath = findLatestSession(ctx.cwd);
+    if (!sessionPath) {
+        ctx.writeOutput({
+            command: 'report',
+            status: 'no_sessions',
+            message: 'No sessions found under .pugi/sessions/. Run a `pugi` command first.',
+        }, 'pugi report: no sessions found under .pugi/sessions/ — run a `pugi` command first.');
+        return 8;
+    }
+    const eventsPath = join(sessionPath, 'events.jsonl');
+    let frames;
+    try {
+        frames = captureFrames(eventsPath);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        ctx.writeOutput({
+            command: 'report',
+            status: 'unreadable',
+            message: `Failed to read ${eventsPath}: ${message}`,
+        }, `pugi report: cannot read session events (${message})`);
+        return 9;
+    }
+    const sessionId = sessionPath.split('/').pop() ?? 'unknown';
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const reportDir = resolvePath(ctx.cwd, '.pugi/reports', `${timestamp}-${sessionId}`);
+    let reportJson;
+    let reportMd;
+    try {
+        mkdirSync(reportDir, { recursive: true });
+        reportJson = join(reportDir, 'report.json');
+        reportMd = join(reportDir, 'report.md');
+        const meta = {
+            schema: 1,
+            generatedAt: new Date().toISOString(),
+            cliVersion: PUGI_CLI_VERSION,
+            nodeVersion: process.version,
+            os: `${platform()} ${release()}`,
+            cwd: ctx.cwd,
+            sessionId,
+            tenantId: readTenantIdSafely() ?? '(not resolvable)',
+            pugiMd: existsSync(resolvePath(ctx.cwd, '.pugi/PUGI.md')),
+            frames,
+        };
+        writeFileSync(reportJson, JSON.stringify(meta, null, 2), 'utf8');
+        const mdLines = [
+            `# Pugi bug report — ${sessionId}`,
+            '',
+            `Generated: \`${meta.generatedAt}\``,
+            `CLI version: \`${meta.cliVersion}\``,
+            `Node: \`${meta.nodeVersion}\` · OS: \`${meta.os}\``,
+            `Workspace: \`${meta.cwd}\` (PUGI.md present: ${meta.pugiMd ? 'yes' : 'no'})`,
+            `Tenant: \`${meta.tenantId}\``,
+            '',
+            `## Last ${frames.length} frames`,
+            '',
+            '```jsonl',
+            ...frames.map((f) => JSON.stringify(f)),
+            '```',
+            '',
+            '## How to share',
+            '',
+            '1. Review `report.md` for accidental PII or sensitive paths.',
+            '2. Paste the contents into a GH issue at https://github.com/pugi-io/pugi/issues',
+            '   OR attach the `report.json` as a file.',
+            '',
+            'Auto-upload to api.pugi.io is planned (`pugi report --upload`) but',
+            'NOT shipped in this build — v1 keeps everything local so an operator',
+            'behind a firewall can still file a clean report.',
+        ];
+        writeFileSync(reportMd, mdLines.join('\n'), 'utf8');
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        ctx.writeOutput({
+            command: 'report',
+            status: 'output_not_writable',
+            message: `Failed to write report bundle to ${reportDir}: ${message}`,
+        }, `pugi report: cannot write report dir (${message})`);
+        return 20;
+    }
+    ctx.writeOutput({
+        command: 'report',
+        status: 'written',
+        reportDir,
+        reportJson,
+        reportMd,
+        sessionId,
+        message: `Report written: ${reportDir}`,
+    }, [
+        `pugi report: bundle written`,
+        `  Session: ${sessionId}`,
+        `  Frames captured: ${frames.length}`,
+        `  Files:`,
+        `    ${reportJson}`,
+        `    ${reportMd}`,
+        ``,
+        `Review report.md for accidental PII, then paste into a GH issue OR`,
+        `attach report.json. Auto-upload is planned for a follow-up build.`,
+    ].join('\n'));
+    return 0;
+}
+// Test seam — the redactor is the most-tested piece (false negatives
+// leak secrets; false positives garble bug context). Exported so
+// apps/pugi-cli/test/report.spec.ts can assert the regex behaviour
+// без spinning up a full session.
+export const __INTERNAL_FOR_TESTS = { redact, clampDetail };
+//# sourceMappingURL=report.js.map

package/dist/runtime/version.js

@@ -44,7 +44,7 @@ export function sanitizeSemver(raw) {
  * during import). When bumping the CLI version BOTH literals must be
  * updated; the release smoke-test (`pack:smoke`) verifies they agree.
  */
-export const PUGI_CLI_VERSION = sanitizeSemver('0.1.0-beta.14');
+export const PUGI_CLI_VERSION = sanitizeSemver('0.1.0-beta.16');
 /**
  * Outbound: the CLI's installed semver. Read at request time by
  * `version-interceptor.ts` and injected on every `fetch` call.

package/dist/tui/repl-render.js

@@ -16,6 +16,8 @@
  * a tiny `event:`/`data:`/`id:` parser. This keeps the dependency
  * graph at zero new packages.
  */
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
 import React from 'react';
 import { render } from 'ink';
 import { Repl } from './repl.js';
@@ -314,11 +316,9 @@ export function drainBufferedStdin(stdin = process.stdin) {
  * future unit spec can lock the contract.
  */
 export function isProjectRoot(cwd) {
-    // Local import keeps the bootstrap free of top-of-file `fs` calls
-    // that would run at module-load time — Ink + the SSE transport are
-    // happier when this file's side-effect surface stays small.
-    const { existsSync } = require('node:fs');
-    const { resolve } = require('node:path');
+    // ESM static imports — `require()` is not defined in a `"type": "module"`
+    // bundle and would throw `ReferenceError: require is not defined` the
+    // moment the REPL bootstrap calls this gate. Beta.16 P0 fix 2026-05-27.
     return (existsSync(resolve(cwd, 'package.json')) ||
         existsSync(resolve(cwd, '.git')) ||
         existsSync(resolve(cwd, '.pugi')) ||

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pugi/cli",
-  "version": "0.1.0-beta.14",
+  "version": "0.1.0-beta.16",
   "description": "Pugi CLI - terminal-native software execution system",
   "homepage": "https://pugi.io",
   "repository": {
@@ -48,13 +48,13 @@
     "ink": "^5.0.1",
     "linkedom": "^0.18.12",
     "react": "^18.3.1",
-    "tar": "^6.2.1",
+    "tar": "^7.5.11",
     "tinyglobby": "^0.2.16",
     "turndown": "^7.2.4",
     "undici": "^8.3.0",
     "zod": "^3.23.0",
     "@pugi/personas": "0.1.2",
-    "@pugi/sdk": "0.1.0-beta.14"
+    "@pugi/sdk": "0.1.0-beta.16"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",