@pugi/cli 0.1.0-beta.15 → 0.1.0-beta.17

package/dist/core/repl/session.js

@@ -2604,7 +2604,7 @@ export function synthesiseToolCall(input) {
     // Pattern: ToolName(args) optionally suffixed with a result hint.
     // We allow the canonical Claude Code casing AND the snake_case
     // alias `web_fetch` so the synthesiser matches what personas write.
-    const match = /^(Read|Edit|Bash|Grep|Glob|WebFetch|web_fetch)\s*\(\s*([^)]*)\s*\)\s*(.*)$/i
+    const match = /^(Read|Write|Edit|Bash|Grep|Glob|WebFetch|web_fetch)\s*\(\s*([^)]*)\s*\)\s*(.*)$/i
         .exec(detail);
     if (!match)
         return null;
@@ -2628,6 +2628,8 @@ function normaliseToolName(raw) {
         return 'web_fetch';
     if (lower === 'read')
         return 'read';
+    if (lower === 'write')
+        return 'write';
     if (lower === 'edit')
         return 'edit';
     if (lower === 'bash')
@@ -2853,7 +2855,22 @@ export function stripPersonaPrefixEcho(personaSlug, text) {
     // Escape regex specials in the display name even though THE_TEN
     // names are alpha-only today (forward-defense).
     const escaped = display.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    // Match `<DisplayName>` (case-insensitive) followed by EITHER:
+    //   - an end-of-string, OR
+    //   - a separator (whitespace / comma / colon / dash / period+space).
+    // The `i` flag is needed so a model writing "PUGI:" or "pugi," still
+    // strips. After this match the post-fix `noSepUppercaseRe` handles
+    // the "PugiПринял" / "PugiHello" no-separator emission pattern
+    // (CEO red-alert 2026-05-27) using a SEPARATE regex without the `i`
+    // flag so the lookahead is case-strict (Pugineous must NOT strip).
     const re = new RegExp(`^${escaped}(?:[\\s,:;\\-—–]+|$)`, 'i');
+    // No-separator case-strict matcher. Display name in either of its
+    // canonical casings ("Pugi" / "PUGI") immediately followed by an
+    // uppercase Cyrillic or Latin letter. The strip is intentionally
+    // narrower than the case-insensitive `re` above because a lowercase
+    // continuation ("Pugineous") is a single word, not a display-name
+    // echo - we must not eat real content.
+    const noSepUppercaseRe = new RegExp(`^(?:${escaped}|${escaped.toUpperCase()})(?=[А-ЯЁA-Z])`);
     // Loop the strip so cascading echoes ("Pugi Pugi Pugi, координатор ...")
     // collapse to a single name. The model occasionally emits the display
     // name two or three times back-to-back when the pane prefix also
@@ -2865,10 +2882,18 @@ export function stripPersonaPrefixEcho(personaSlug, text) {
     // matches an empty string (defence-in-depth even though the current
     // pattern guarantees at least one consumed char).
     for (let i = 0; i < 3; i += 1) {
-        const m = re.exec(working);
-        if (!m || m[0].length === 0)
-            break;
-        working = working.slice(m[0].length).trimStart();
+        let m = re.exec(working);
+        if (m && m[0].length > 0) {
+            working = working.slice(m[0].length).trimStart();
+            continue;
+        }
+        // Fallback: no-separator match for "PugiПринял" / "PugiHello" shape.
+        m = noSepUppercaseRe.exec(working);
+        if (m && m[0].length > 0) {
+            working = working.slice(m[0].length);
+            continue;
+        }
+        break;
     }
     return working;
 }

package/dist/runtime/cli.js

@@ -29,6 +29,7 @@ import { runDeployCommand } from '../commands/deploy.js';
 import { runJobsCommand } from '../commands/jobs.js';
 import { runConfigCommand } from './commands/config.js';
 import { runPrivacyCommand } from './commands/privacy.js';
+import { runReport } from './commands/report.js';
 import { runUndoCommand } from './commands/undo.js';
 import { runBudgetCommand } from './commands/budget.js';
 import { runSkillsCommand } from './commands/skills.js';
@@ -90,6 +91,10 @@ const handlers = {
     plan: runEngineTask('plan'),
     'plan-review': dispatchPlanReview,
     privacy: dispatchPrivacy,
+    // PAVF-7 (2026-05-27): `pugi report --from-error` captures the
+    // most-recent failed session as a redacted bundle so operators can
+    // file clean bug reports without manual log-grepping.
+    report: dispatchReport,
     review,
     resume,
     roster: dispatchRoster,
@@ -271,6 +276,25 @@ async function dispatchPrivacy(args, flags, _session) {
         writeOutput: (payload, text) => writeOutput(flags, payload, text),
     });
 }
+/**
+ * PAVF-7 (2026-05-27): `pugi report --from-error` — bundle the most-
+ * recent failed session into a redacted local report so operators can
+ * file clean bug tickets without manual log-grepping. v1 is local-only
+ * (no auto-upload — see commands/report.ts header for the rationale).
+ */
+async function dispatchReport(args, flags, _session) {
+    const rc = runReport(args, {
+        cwd: process.cwd(),
+        json: flags.json,
+        emit: (line) => {
+            if (!flags.json)
+                process.stdout.write(line);
+        },
+        writeOutput: (payload, text) => writeOutput(flags, payload, text),
+    });
+    if (rc !== 0)
+        process.exitCode = rc;
+}
 /**
  * `pugi roster` - α7.5 Phase 1.
  *
@@ -973,6 +997,16 @@ const COMMAND_HELP_BODIES = {
         'event log, settings), permission mode, and the capability matrix per',
         'engine adapter. Safe to run anywhere; no network calls.',
     ],
+    report: [
+        'pugi report — capture a bug report from the most-recent session.',
+        '',
+        '  --from-error            Bundle the most-recent failed session as a',
+        '                          redacted local report (default + only mode in v1).',
+        '',
+        'Output: writes .pugi/reports/<timestamp>-<session-id>/{report.json, report.md}.',
+        'Secrets (bearer tokens, JWTs, named env values) are stripped before disk write.',
+        'Auto-upload to api.pugi.io planned for a follow-up; v1 keeps everything local.',
+    ],
     ask: [
         'pugi ask "<question>" — surface a yes/no question modal locally.',
         '',
@@ -2140,12 +2174,45 @@ async function performTripleProviderReview(root, session, flags, prompt) {
             `Refusing to submit an empty diff for review.`);
     }
     const resolvedCommit = safeGit(root, ['rev-parse', '--short', commitRef]).trim() || commitRef;
-    const mergeBase = safeGit(root, ['merge-base', baseRef, commitRef]).trim() || '';
+    // merge-base is intentionally a PROBE: an empty result is a valid
+    // signal (orphan branch, shallow clone, moved tag) that the dispatch
+    // path handles by falling back к range-notation. Use the legacy
+    // `safeGit` (probe semantics) explicitly rather than the strict
+    // variant.
+    const mergeBase = safeGitProbe(root, ['merge-base', baseRef, commitRef]).trim() || '';
+    // 2026-05-27 (Claude review followup #489): when merge-base returns empty
+    // (orphan branch, shallow clone, moved tag), we MUST NOT pass the
+    // `<range> <commitRef>` two-arg form to `git diff` — that combo is
+    // invalid syntax, git exits 129, `safeGit` swallows the error, and the
+    // diff payload ships empty. An empty diff is then classified as
+    // `'code'` server-side, dispatched to reviewers who emit a trivial
+    // `VERDICT: PASS` over zero lines — a SILENT GREEN REVIEW on a commit
+    // nobody actually examined. Branch on `mergeBase` так что:
+    //   - mergeBase present  → `git diff <mergeBase> <commitRef> --`
+    //     (both endpoints explicit, only-uncommitted-against-base ignored
+    //     because commitRef is a SHA, not HEAD).
+    //   - mergeBase empty    → `git diff <baseRef>..<commitRef> --`
+    //     (range form encodes both endpoints; do NOT append commitRef
+    //     again or git rejects the args).
     const diffRange = mergeBase || `${baseRef}..${commitRef}`;
-    const diffArgs = ['diff', diffRange, commitRef, '--', '.', ...PROTECTED_DIFF_EXCLUDES];
-    const diffStatArgs = ['diff', '--shortstat', diffRange, commitRef, '--', '.', ...PROTECTED_DIFF_EXCLUDES];
-    const diffPatch = safeGit(root, diffArgs);
-    const diffStats = parseDiffStats(safeGit(root, diffStatArgs));
+    const diffArgs = mergeBase
+        ? ['diff', mergeBase, commitRef, '--', '.', ...PROTECTED_DIFF_EXCLUDES]
+        : ['diff', diffRange, '--', '.', ...PROTECTED_DIFF_EXCLUDES];
+    const diffStatArgs = mergeBase
+        ? ['diff', '--shortstat', mergeBase, commitRef, '--', '.', ...PROTECTED_DIFF_EXCLUDES]
+        : ['diff', '--shortstat', diffRange, '--', '.', ...PROTECTED_DIFF_EXCLUDES];
+    // Use the strict variant — a non-empty diffPatch is load-bearing for
+    // the review gate. If git fails for ANY reason (bad ref, ENOBUFS, FS
+    // permission), we'd rather surface a hard error than ship a green
+    // review on nothing. The `--shortstat` companion uses the same
+    // helper so the throw is symmetric.
+    const diffPatch = safeGitRequired(root, diffArgs, 'triple-providers diff');
+    const diffStats = parseDiffStats(safeGitRequired(root, diffStatArgs, 'triple-providers diff --shortstat'));
+    if (diffPatch.trim() === '') {
+        throw new Error(`pugi review --triple: empty diff between '${baseRef}' and '${commitRef}'. ` +
+            `Refusing to dispatch a review for zero changes — check the refs ` +
+            `or commit your changes before running.`);
+    }
     const requestBody = pugiTripleReviewRequestSchema.parse({
         schema: 1,
         workspace: {
@@ -5039,7 +5106,31 @@ function fileBytes(path) {
         return 0;
     }
 }
-function safeGit(root, args) {
+/**
+ * Git invocation helpers — probe vs required semantics.
+ *
+ * 2026-05-27 (Claude review followup #489): the historical `safeGit`
+ * collapsed BOTH "tell me the branch name if you can" probes AND
+ * "give me the diff or fail" hard requirements into a single helper
+ * that swallowed every error as an empty string. That's the correct
+ * shape for the probe case (branch / status / dirty flag — empty
+ * result is a valid signal) but catastrophically wrong for the diff
+ * case (empty result === false PASS on a commit nobody reviewed).
+ *
+ * The split:
+ *   - `safeGitProbe`  — best-effort. Returns '' on any error. Use for
+ *     branch name lookups, status probes, opt-in dirty detection.
+ *   - `safeGitRequired` — throws on non-zero exit / ENOBUFS / bad ref.
+ *     Use for diff, merge-base resolution, anything whose empty
+ *     output would silently corrupt downstream behaviour.
+ *
+ * Legacy `safeGit` is kept as a deprecated alias of `safeGitProbe`
+ * so existing call-sites (branch detection, status, etc.) keep their
+ * tolerant semantics until they are individually migrated. Diff /
+ * merge-base / rev-parse-verify call-sites are migrated к
+ * `safeGitRequired` in this same patch.
+ */
+export function safeGitProbe(root, args) {
     try {
         return execFileSync('git', args, {
             cwd: root,
@@ -5057,6 +5148,38 @@ function safeGit(root, args) {
         return '';
     }
 }
+/**
+ * Strict variant — throws on non-zero exit, ENOBUFS, or any git-side
+ * failure. The thrown error carries the operation context so the
+ * caller (triple-review dispatch, etc.) can fail loud rather than
+ * ship an empty diff to a remote reviewer.
+ */
+export function safeGitRequired(root, args, context) {
+    try {
+        return execFileSync('git', args, {
+            cwd: root,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            maxBuffer: 64 * 1024 * 1024,
+        });
+    }
+    catch (err) {
+        const cause = err instanceof Error ? err.message : String(err);
+        throw new Error(`git ${args.slice(0, 2).join(' ')} failed (${context}): ${cause}. ` +
+            `Refusing to proceed — empty git output here would corrupt downstream behaviour.`);
+    }
+}
+/**
+ * Deprecated alias preserved for diff / status / branch probes that
+ * legitimately want a tolerant empty-string-on-error shape. New call
+ * sites should pick `safeGitProbe` or `safeGitRequired` explicitly.
+ *
+ * @deprecated 2026-05-27 — prefer `safeGitProbe` (tolerant) or
+ * `safeGitRequired` (strict, throws).
+ */
+function safeGit(root, args) {
+    return safeGitProbe(root, args);
+}
 /**
  * Glob patterns excluded from triple-review `diffPatch` before egress.
  *

package/dist/runtime/commands/report.js

@@ -0,0 +1,299 @@
+/**
+ * PAVF-7 — `pugi report --from-error` field-bug capture.
+ *
+ * Operator hit a CLI failure ("pugi explain: failed [auth_missing]...")
+ * and wants to file a clean report без manual log-grepping. This command:
+ *
+ *   1. Locates the most-recently-modified session under .pugi/sessions/
+ *      (the engine adapter mirrors EVERY dispatch's events to a fresh
+ *      session dir; the latest one is always the failure that just
+ *      surprised the operator).
+ *   2. Reads events.jsonl + extracts the terminal-state event +
+ *      the last 50 frames before it (enough context to triage; small
+ *      enough for a GH issue body or email paste).
+ *   3. Captures workspace metadata (CLI version, Node version, OS,
+ *      tenant id from credentials, current dir, .pugi/PUGI.md presence).
+ *   4. Strips secrets — auth tokens, env values, JWT signatures —
+ *      before the report ever touches disk OR network.
+ *   5. Writes the bundle к .pugi/reports/<ISO-timestamp>-<session-id>/
+ *      with both a machine-readable report.json and a human-readable
+ *      report.md the operator can paste into a GH issue / email.
+ *   6. Prints the path + the canonical share command the operator can
+ *      run when ready to upload (the upload endpoint is deferred to a
+ *      follow-up; v1 keeps everything LOCAL so an operator working
+ *      offline / behind a corporate firewall can still file a clean
+ *      report).
+ *
+ * Why not auto-upload in v1:
+ *   The CEO HARD rule `feedback_no_fake_dispatch_promises` says we do
+ *   not invent dispatch we cannot deliver. Without a live
+ *   /api/pugi/report endpoint, an auto-upload would either silently
+ *   no-op or claim shipped и lie. v1 emits the artifacts + a clear
+ *   "upload pending" status; v2 (separate PR) wires the endpoint и
+ *   flips the default к upload-on-success.
+ *
+ * Exit codes (match the existing PAVF-1 stage_code table):
+ *   0  = report written successfully
+ *   8  = no sessions found (operator ran in a workspace без .pugi/)
+ *   9  = session events.jsonl unreadable / corrupted
+ *  20  = output path not writable (disk full / perms)
+ *
+ * Secret-redaction posture: PII / tokens / env values are stripped at
+ * the report-generation layer, NOT at upload time. Even if the operator
+ * never uploads, the report dir on disk MUST NOT carry plaintext
+ * secrets — a colleague who later runs `cat .pugi/reports/.../report.md`
+ * over the shoulder sees the bug context but not the bearer token.
+ */
+import { existsSync, readdirSync, readFileSync, mkdirSync, statSync, writeFileSync } from 'node:fs';
+import { join, resolve as resolvePath } from 'node:path';
+import { homedir, platform, release } from 'node:os';
+import { PUGI_CLI_VERSION } from '../version.js';
+const MAX_TAIL_FRAMES = 50;
+const MAX_DETAIL_CHARS = 400;
+const TERMINAL_TYPES = new Set([
+    'agent.completed',
+    'agent.failed',
+    'agent.blocked',
+    'subagent.outcome',
+    'result',
+]);
+/**
+ * Bearer / JWT / env-secret patterns. We do NOT try to be exhaustive
+ * (cat-and-mouse with custom secret formats is unwinnable); we cover
+ * the shapes that actually appear in Pugi sessions:
+ *
+ *   - `Authorization: Bearer eyJ...` (JWT header.payload.signature)
+ *   - `apiKey: eyJ...` inside captured JSON envelopes
+ *   - any long base64-ish token (>= 20 chars, [A-Za-z0-9_-]) following
+ *     `token`, `password`, `secret`, or `key` field names
+ *
+ * Replacement is a length-preserving `[REDACTED:<n>]` marker so the
+ * operator can still verify the report at-a-glance ("yes, a 32-char
+ * token was here") без leaking the value.
+ */
+function redact(text) {
+    if (!text)
+        return text;
+    // Bearer + JWT shape.
+    text = text.replace(/(Bearer\s+)([A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+)/gi, (_m, prefix, tok) => `${prefix}[REDACTED:${tok.length}]`);
+    // Bare JWTs (no Bearer prefix) inside JSON / log lines.
+    text = text.replace(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, (tok) => `[REDACTED:${tok.length}]`);
+    // `"token": "..."` / `"apiKey": "..."` / `"password": "..."` shapes.
+    text = text.replace(/("(?:apiKey|api_key|token|access_token|refresh_token|password|secret|bearer)"\s*:\s*")([^"]{10,})(")/gi, (_m, before, val, after) => `${before}[REDACTED:${val.length}]${after}`);
+    // Bare env-style KEY=VALUE на длинных значениях.
+    text = text.replace(/\b((?:PUGI_API_KEY|GITHUB_TOKEN|NPM_TOKEN|ANVIL_API_KEY|OPENAI_API_KEY|ANTHROPIC_API_KEY|GEMINI_API_KEY)=)([^\s"']{10,})/g, (_m, prefix, val) => `${prefix}[REDACTED:${val.length}]`);
+    return text;
+}
+function clampDetail(value) {
+    if (typeof value !== 'string')
+        return undefined;
+    const redacted = redact(value);
+    return redacted.length > MAX_DETAIL_CHARS
+        ? `${redacted.slice(0, MAX_DETAIL_CHARS)}…`
+        : redacted;
+}
+function findLatestSession(cwd) {
+    const dir = resolvePath(cwd, '.pugi/sessions');
+    if (!existsSync(dir))
+        return null;
+    const entries = readdirSync(dir, { withFileTypes: true })
+        .filter((e) => e.isDirectory())
+        .map((e) => {
+        const path = join(dir, e.name);
+        let mtime = 0;
+        try {
+            mtime = statSync(join(path, 'events.jsonl')).mtimeMs;
+        }
+        catch {
+            // Session dir without events.jsonl yet — never opened. Skip.
+            return null;
+        }
+        return { name: e.name, path, mtime };
+    })
+        .filter((x) => x !== null)
+        .sort((a, b) => b.mtime - a.mtime);
+    return entries[0]?.path ?? null;
+}
+function readTenantIdSafely() {
+    const credPath = resolvePath(homedir(), '.pugi/credentials.json');
+    if (!existsSync(credPath))
+        return undefined;
+    try {
+        const raw = JSON.parse(readFileSync(credPath, 'utf8'));
+        const first = raw.tokens?.[0]?.apiKey;
+        if (!first || typeof first !== 'string')
+            return undefined;
+        // JWT payload is the middle segment; base64-decode + parse for the
+        // `customerId` claim. Failure here returns undefined (the report
+        // still emits useful context without it).
+        const parts = first.split('.');
+        if (parts.length !== 3)
+            return undefined;
+        const payload = JSON.parse(Buffer.from(parts[1] ?? '', 'base64').toString('utf8'));
+        return typeof payload.customerId === 'string' ? payload.customerId : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function captureFrames(eventsPath) {
+    const lines = readFileSync(eventsPath, 'utf8')
+        .split('\n')
+        .filter((l) => l.trim().length > 0);
+    const parsed = lines
+        .map((line) => {
+        try {
+            return JSON.parse(line);
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter((f) => f !== null);
+    // Keep the LAST MAX_TAIL_FRAMES frames — failures cluster at the
+    // end, and the tail is where the operator's context actually lives.
+    const tail = parsed.slice(-MAX_TAIL_FRAMES);
+    return tail.map((f) => {
+        const out = {
+            type: typeof f.type === 'string' ? f.type : 'unknown',
+        };
+        if (typeof f.taskId === 'string')
+            out.taskId = f.taskId;
+        if (typeof f.timestamp === 'string')
+            out.timestamp = f.timestamp;
+        if (typeof f.outcome === 'string')
+            out.outcome = f.outcome;
+        // Keep detail / error ONLY on terminal frames (full reply text on
+        // every agent.message would blow the report past the GH issue cap).
+        if (TERMINAL_TYPES.has(out.type)) {
+            const detail = clampDetail(f.detail) ?? clampDetail(f.error);
+            if (detail)
+                out.detail = detail;
+            if (typeof f.error === 'string')
+                out.error = clampDetail(f.error);
+        }
+        return out;
+    });
+}
+export function runReport(args, ctx) {
+    const fromError = args.includes('--from-error');
+    if (!fromError) {
+        ctx.writeOutput({
+            command: 'report',
+            status: 'no_sessions',
+            message: 'pugi report — capture a bug report from the most-recent session.\n\n' +
+                'Usage:\n' +
+                '  pugi report --from-error           Bundle the most-recent failed session as a report.\n\n' +
+                'Output: writes .pugi/reports/<timestamp>-<session-id>/{report.json, report.md}.\n' +
+                'Secrets (bearer tokens, JWTs, named env values) are stripped before disk write.',
+        }, 'pugi report — see `pugi report --help`');
+        return 0;
+    }
+    const sessionPath = findLatestSession(ctx.cwd);
+    if (!sessionPath) {
+        ctx.writeOutput({
+            command: 'report',
+            status: 'no_sessions',
+            message: 'No sessions found under .pugi/sessions/. Run a `pugi` command first.',
+        }, 'pugi report: no sessions found under .pugi/sessions/ — run a `pugi` command first.');
+        return 8;
+    }
+    const eventsPath = join(sessionPath, 'events.jsonl');
+    let frames;
+    try {
+        frames = captureFrames(eventsPath);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        ctx.writeOutput({
+            command: 'report',
+            status: 'unreadable',
+            message: `Failed to read ${eventsPath}: ${message}`,
+        }, `pugi report: cannot read session events (${message})`);
+        return 9;
+    }
+    const sessionId = sessionPath.split('/').pop() ?? 'unknown';
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const reportDir = resolvePath(ctx.cwd, '.pugi/reports', `${timestamp}-${sessionId}`);
+    let reportJson;
+    let reportMd;
+    try {
+        mkdirSync(reportDir, { recursive: true });
+        reportJson = join(reportDir, 'report.json');
+        reportMd = join(reportDir, 'report.md');
+        const meta = {
+            schema: 1,
+            generatedAt: new Date().toISOString(),
+            cliVersion: PUGI_CLI_VERSION,
+            nodeVersion: process.version,
+            os: `${platform()} ${release()}`,
+            cwd: ctx.cwd,
+            sessionId,
+            tenantId: readTenantIdSafely() ?? '(not resolvable)',
+            pugiMd: existsSync(resolvePath(ctx.cwd, '.pugi/PUGI.md')),
+            frames,
+        };
+        writeFileSync(reportJson, JSON.stringify(meta, null, 2), 'utf8');
+        const mdLines = [
+            `# Pugi bug report — ${sessionId}`,
+            '',
+            `Generated: \`${meta.generatedAt}\``,
+            `CLI version: \`${meta.cliVersion}\``,
+            `Node: \`${meta.nodeVersion}\` · OS: \`${meta.os}\``,
+            `Workspace: \`${meta.cwd}\` (PUGI.md present: ${meta.pugiMd ? 'yes' : 'no'})`,
+            `Tenant: \`${meta.tenantId}\``,
+            '',
+            `## Last ${frames.length} frames`,
+            '',
+            '```jsonl',
+            ...frames.map((f) => JSON.stringify(f)),
+            '```',
+            '',
+            '## How to share',
+            '',
+            '1. Review `report.md` for accidental PII or sensitive paths.',
+            '2. Paste the contents into a GH issue at https://github.com/pugi-io/pugi/issues',
+            '   OR attach the `report.json` as a file.',
+            '',
+            'Auto-upload to api.pugi.io is planned (`pugi report --upload`) but',
+            'NOT shipped in this build — v1 keeps everything local so an operator',
+            'behind a firewall can still file a clean report.',
+        ];
+        writeFileSync(reportMd, mdLines.join('\n'), 'utf8');
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        ctx.writeOutput({
+            command: 'report',
+            status: 'output_not_writable',
+            message: `Failed to write report bundle to ${reportDir}: ${message}`,
+        }, `pugi report: cannot write report dir (${message})`);
+        return 20;
+    }
+    ctx.writeOutput({
+        command: 'report',
+        status: 'written',
+        reportDir,
+        reportJson,
+        reportMd,
+        sessionId,
+        message: `Report written: ${reportDir}`,
+    }, [
+        `pugi report: bundle written`,
+        `  Session: ${sessionId}`,
+        `  Frames captured: ${frames.length}`,
+        `  Files:`,
+        `    ${reportJson}`,
+        `    ${reportMd}`,
+        ``,
+        `Review report.md for accidental PII, then paste into a GH issue OR`,
+        `attach report.json. Auto-upload is planned for a follow-up build.`,
+    ].join('\n'));
+    return 0;
+}
+// Test seam — the redactor is the most-tested piece (false negatives
+// leak secrets; false positives garble bug context). Exported so
+// apps/pugi-cli/test/report.spec.ts can assert the regex behaviour
+// без spinning up a full session.
+export const __INTERNAL_FOR_TESTS = { redact, clampDetail };
+//# sourceMappingURL=report.js.map

package/dist/runtime/version.js

@@ -44,7 +44,7 @@ export function sanitizeSemver(raw) {
  * during import). When bumping the CLI version BOTH literals must be
  * updated; the release smoke-test (`pack:smoke`) verifies they agree.
  */
-export const PUGI_CLI_VERSION = sanitizeSemver('0.1.0-beta.15');
+export const PUGI_CLI_VERSION = sanitizeSemver('0.1.0-beta.17');
 /**
  * Outbound: the CLI's installed semver. Read at request time by
  * `version-interceptor.ts` and injected on every `fetch` call.

package/dist/tools/file-tools.js

@@ -1,3 +1,31 @@
+/**
+ * file-tools - Pugi CLI file/bash/glob/grep tool surface.
+ *
+ * Workspace-binding contract (CEO red-alert 2026-05-27 follow-up):
+ *
+ *   Every tool dispatch path threads `ctx.root` from the operator's
+ *   `process.cwd()` through `EngineTask.workspaceRoot` ->
+ *   `native-pugi.run()` -> `toolCtx.root` -> here. Tools call
+ *   `resolveWorkspacePath(ctx.root, path)` for every on-disk operation
+ *   so a dispatched specialist (e.g. Hiroshi writing tic-tac-toe HTML)
+ *   produces files in the OPERATOR'S cwd, never in a server-side temp
+ *   space. The path-security gate refuses traversal (`../etc/passwd`,
+ *   URL-encoded variants, symlink escapes at the target).
+ *
+ *   Wiring chain:
+ *     1. runtime/cli.ts:    workspaceRoot = process.cwd()
+ *     2. EngineTask.workspaceRoot threads through to native-pugi.run().
+ *     3. native-pugi:       const root = task.workspaceRoot
+ *     4. tool-bridge:       passes ctx.root to file-tools / bash.
+ *     5. file-tools:        resolveWorkspacePath(ctx.root, path).
+ *
+ *   The contract is locked by `test/tools-write-to-workspace.spec.ts`
+ *   (6 cases covering relative + nested + absolute paths + traversal
+ *   refusal). If any layer of the chain regressed silently, dispatched
+ *   files would land in `/tmp` instead of the operator's repo, which
+ *   is the same failure surface as the menu-mode anti-pattern the
+ *   sibling commits close.
+ */
 import { spawnSync } from 'node:child_process';
 import { existsSync, readFileSync, realpathSync, renameSync, writeFileSync } from 'node:fs';
 import { dirname, isAbsolute, relative } from 'node:path';