@pugi/cli 0.1.0-beta.24 → 0.1.0-beta.26

package/dist/core/lsp/post-edit-diagnostics.js

@@ -0,0 +1,171 @@
+/**
+ * Post-edit diagnostics — Leak L15.
+ *
+ * Claude Code's leak intel surfaced this pattern: after a `FileEdit` /
+ * `Write` tool call lands, an LSP diagnostic pass runs on the touched
+ * file and the result is appended to the tool envelope before the
+ * model sees it. The model then self-corrects in the same turn —
+ * "TS2304: Cannot find name 'undef'" comes back, the model fixes the
+ * typo in the next tool call, no operator round-trip needed.
+ *
+ * This module is the Pugi side of that pattern:
+ *
+ *   1. The tool-bridge calls `runPostEditDiagnostics(path, ctx)` after
+ *      a successful `edit` / `write` / `multi_edit`.
+ *   2. We infer the language from the extension (`language-detect`).
+ *      Unsupported extension → `{ skip: true }` and the bridge appends
+ *      nothing.
+ *   3. We borrow (or lazily start) the per-language cached client
+ *      from `cache.ts`. A spawn failure → `{ skip: true }` and the
+ *      envelope stays clean. Silence on failure is intentional: an
+ *      operator who has not installed `typescript-language-server`
+ *      should not see an LSP nag on every edit.
+ *   4. We pull diagnostics with a hard 5s ceiling. A timeout logs a
+ *      warning on stderr (gated on `PUGI_LSP_DEBUG=1`) and skips —
+ *      the envelope is never blocked on LSP.
+ *   5. We format the surviving diagnostics into a readable tail
+ *      mirroring the leak format:
+ *
+ *         LSP DIAGNOSTICS (typescript):
+ *           foo.ts:42:5 error TS2304: Cannot find name 'undef'.
+ *           foo.ts:51:1 warn  TS6133: 'unused' is declared.
+ *
+ * The bridge concatenates this tail onto its existing `wrote ...` /
+ * `edited ...` body with a single newline separator. When there are
+ * zero diagnostics we return `{ skip: true }` so the existing body
+ * is unchanged — the "no news is good news" path stays terse.
+ *
+ * Brand voice: ASCII only, no emoji, no banned words.
+ */
+import { isAbsolute, relative, resolve } from 'node:path';
+import { getOrStartLspClient } from './cache.js';
+import { languageForFile } from './language-detect.js';
+const DEFAULT_TIMEOUT_MS = 5_000;
+/**
+ * Hard cap on how many diagnostics we surface to the model. A file
+ * with 200 errors after a broken bulk edit would otherwise blow the
+ * context window; the model can re-run `pugi lsp diagnostics` if
+ * it needs the full list.
+ */
+const MAX_DIAGNOSTICS = 25;
+export async function runPostEditDiagnostics(filePath, opts) {
+    const lang = languageForFile(filePath);
+    if (!lang) {
+        return { skip: true, reason: 'unsupported_language' };
+    }
+    const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const clientResult = await loadClient(lang, opts);
+    if (!clientResult.ok) {
+        return { skip: true, reason: mapStartFailure(clientResult.reason) };
+    }
+    // Run diagnostics with a hard timeout. The underlying LspClient has
+    // its own per-request timeout (5s default) but a slow handshake
+    // can blow past it; we belt-and-suspenders here so the agent loop
+    // never blocks on LSP.
+    const relPath = toWorkspaceRelative(filePath, opts.cwd);
+    const diagnosticsPromise = clientResult.client.diagnostics(relPath);
+    let timer;
+    const timeoutPromise = new Promise((resolveFn) => {
+        timer = setTimeout(() => resolveFn({ timedOut: true }), timeoutMs);
+        timer.unref();
+    });
+    const race = await Promise.race([
+        diagnosticsPromise.then((value) => ({ timedOut: false, value })),
+        timeoutPromise,
+    ]);
+    if (timer)
+        clearTimeout(timer);
+    if (race.timedOut) {
+        const writeFn = opts.debugWrite ?? ((line) => {
+            if (process.env.PUGI_LSP_DEBUG === '1')
+                process.stderr.write(`${line}\n`);
+        });
+        writeFn(`[pugi-lsp] post-edit diagnostics for ${relPath} timed out after ${timeoutMs}ms (lang=${lang})`);
+        return { skip: true, reason: 'timeout' };
+    }
+    const diag = race.value;
+    if (!diag.ok) {
+        return { skip: true, reason: 'lsp_error' };
+    }
+    if (diag.value.length === 0) {
+        return { skip: true, reason: 'no_diagnostics' };
+    }
+    const tail = formatDiagnosticsTail(relPath, lang, diag.value);
+    return { skip: false, tail, count: diag.value.length, language: lang };
+}
+async function loadClient(lang, opts) {
+    if (opts.clientLoader) {
+        return opts.clientLoader(lang);
+    }
+    const { cwd, timeoutMs, clientLoader: _ignoredA, debugWrite: _ignoredB, ...rest } = opts;
+    const result = await getOrStartLspClient(lang, { cwd, ...rest });
+    if (!result.ok) {
+        return { ok: false, reason: result.reason, detail: result.detail };
+    }
+    return { ok: true, client: result.client };
+}
+function mapStartFailure(reason) {
+    if (reason === 'lsp_unavailable' || reason === 'language_unsupported')
+        return 'lsp_unavailable';
+    if (reason === 'lsp_disabled')
+        return 'lsp_disabled';
+    return 'lsp_error';
+}
+/**
+ * Convert an absolute or workspace-relative path into the form the
+ * LSP client expects — same shape as `runtime/commands/lsp.ts` uses.
+ */
+function toWorkspaceRelative(filePath, cwd) {
+    if (!isAbsolute(filePath))
+        return filePath;
+    const rel = relative(cwd, resolve(cwd, filePath));
+    return rel || filePath;
+}
+/**
+ * Format diagnostics into the leak-shaped envelope tail. Pure function
+ * exported for unit tests to assert the line format independent of
+ * any LSP plumbing.
+ */
+export function formatDiagnosticsTail(relPath, lang, diagnostics) {
+    const visible = diagnostics.slice(0, MAX_DIAGNOSTICS);
+    const truncated = diagnostics.length > visible.length;
+    const lines = [`LSP DIAGNOSTICS (${LANGUAGE_LABELS[lang]}):`];
+    for (const diag of visible) {
+        const line = diag.range.start.line + 1; // LSP is zero-based; humans expect 1-based.
+        const col = diag.range.start.character + 1;
+        const severity = SEVERITY_LABELS[diag.severityLabel];
+        const code = diag.code !== undefined && diag.code !== '' ? ` ${diag.code}` : '';
+        const source = diag.source ? `${diag.source}` : '';
+        const head = source ? `${severity}${code} (${source}):` : `${severity}${code}:`;
+        lines.push(`  ${relPath}:${line}:${col} ${head} ${diag.message}`);
+    }
+    if (truncated) {
+        lines.push(`  ... ${diagnostics.length - visible.length} more diagnostic(s) — re-run pugi lsp diagnostics ${relPath} for the full list`);
+    }
+    return lines.join('\n');
+}
+const LANGUAGE_LABELS = {
+    ts: 'typescript',
+    js: 'javascript',
+    py: 'python',
+    go: 'go',
+    rust: 'rust',
+};
+/**
+ * Map LSP severity label → the short token the leak envelope uses.
+ * "warn" is shorter than "warning" and matches Claude Code's leak
+ * verbatim; the rest mirror LSP terminology.
+ */
+const SEVERITY_LABELS = {
+    error: 'error',
+    warning: 'warn ',
+    info: 'info ',
+    hint: 'hint ',
+};
+/** Test-only surface so specs can poke the pure helpers without LSP. */
+export const __test__ = {
+    formatDiagnosticsTail,
+    MAX_DIAGNOSTICS,
+    DEFAULT_TIMEOUT_MS,
+};
+//# sourceMappingURL=post-edit-diagnostics.js.map

package/dist/core/memory-sync/queue.js

@@ -0,0 +1,158 @@
+/**
+ * Pugi memory sync queue (ADR-0063 Day 4).
+ *
+ * Local pending-write queue for `pugi memory` commands when the
+ * operator is offline or the admin-api is unreachable. Each pending
+ * mutation lands on disk as one JSONL line; `pugi memory sync` reads
+ * the queue, fires them to the admin-api in order, and rewrites the
+ * file with only the entries that still failed.
+ *
+ * Storage:
+ *
+ *   ~/.pugi/memory-queue.jsonl          (mode 0600)
+ *
+ * Each line is a fully-typed `PendingMemoryOperation` envelope. The
+ * envelope is forward-compatible: an older CLI reading a JSONL file
+ * written by a newer CLI silently skips lines whose `op` field is
+ * not in its known set (so a partial-rollback scenario doesn't crash
+ * the queue).
+ *
+ * Design intent:
+ *   - Append-only on disk for the hot path (`pugi memory write` /
+ *     `pugi memory forget` queue when offline). Rewrites only on
+ *     successful sync.
+ *   - One file per operator (PUGI_HOME-aware). Queue is local to the
+ *     machine — no cross-host coordination. Multi-device sync is
+ *     deferred to Phase 6 (server-side outbox).
+ *   - No fsync / atomic rename ceremony in v1 — best effort. The
+ *     queue is a convenience surface, not a durability primitive;
+ *     the source of truth is the admin-api row.
+ */
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync, } from 'node:fs';
+import { homedir } from 'node:os';
+import { dirname, resolve } from 'node:path';
+import { z } from 'zod';
+/** Six canonical kinds — must mirror `apps/admin-api/src/persona-memory/persona-memory.types.ts`. */
+export const PERSONA_MEMORY_KINDS = [
+    'pattern',
+    'preference',
+    'architecture',
+    'bug',
+    'workflow',
+    'fact',
+];
+const writeOpSchema = z.object({
+    op: z.literal('write'),
+    enqueuedAt: z.string().datetime(),
+    personaSlug: z.string().min(1).max(64),
+    kind: z.enum(PERSONA_MEMORY_KINDS),
+    content: z.string().min(1).max(4000),
+    forgetAfter: z.string().datetime().nullable().optional(),
+});
+const forgetOpSchema = z.object({
+    op: z.literal('forget'),
+    enqueuedAt: z.string().datetime(),
+    id: z.string().min(1),
+});
+const pendingMemoryOpSchema = z.discriminatedUnion('op', [
+    writeOpSchema,
+    forgetOpSchema,
+]);
+/** Default storage path. Override via `PUGI_HOME` for tests / multi-account. */
+export function defaultQueuePath() {
+    const root = process.env.PUGI_HOME ?? resolve(homedir(), '.pugi');
+    return resolve(root, 'memory-queue.jsonl');
+}
+/**
+ * Append one pending operation to the queue file. Creates the parent
+ * directory + file with mode 0600 if missing. Pure-disk, no network.
+ *
+ * Returns the count of pending ops after the append (1-based) so the
+ * CLI command can render "queued (3 pending) — run `pugi memory sync`".
+ */
+export function enqueueMemoryOp(op, pathOverride) {
+    const fullOp = {
+        ...op,
+        enqueuedAt: new Date().toISOString(),
+    };
+    pendingMemoryOpSchema.parse(fullOp);
+    const queuePath = pathOverride ?? defaultQueuePath();
+    ensureQueueFile(queuePath);
+    const existing = readFileSync(queuePath, 'utf-8');
+    const line = `${JSON.stringify(fullOp)}\n`;
+    writeFileSync(queuePath, `${existing}${line}`, { encoding: 'utf-8', mode: 0o600 });
+    // Best-effort chmod (in case the file existed already at the wrong mode).
+    try {
+        chmodSync(queuePath, 0o600);
+    }
+    catch {
+        // ignore — the file was just written above, mode might be platform-dependent.
+    }
+    return countPending(queuePath);
+}
+/** Read the queue file and return parsed entries. Skips unknown / malformed lines. */
+export function readMemoryQueue(pathOverride) {
+    const queuePath = pathOverride ?? defaultQueuePath();
+    if (!existsSync(queuePath))
+        return [];
+    const raw = readFileSync(queuePath, 'utf-8');
+    const out = [];
+    for (const line of raw.split(/\r?\n/)) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            const parsed = pendingMemoryOpSchema.parse(JSON.parse(trimmed));
+            out.push(parsed);
+        }
+        catch {
+            // forward-compat: a future op kind we don't recognise should not
+            // crash the queue; just drop the line during this read.
+            continue;
+        }
+    }
+    return out;
+}
+/** Rewrite the queue file with `remaining` entries only. Empty array clears the file. */
+export function rewriteMemoryQueue(remaining, pathOverride) {
+    const queuePath = pathOverride ?? defaultQueuePath();
+    ensureQueueFile(queuePath);
+    if (remaining.length === 0) {
+        writeFileSync(queuePath, '', { encoding: 'utf-8', mode: 0o600 });
+        return;
+    }
+    const body = remaining.map((op) => JSON.stringify(op)).join('\n') + '\n';
+    writeFileSync(queuePath, body, { encoding: 'utf-8', mode: 0o600 });
+}
+/** Count pending ops without re-parsing every line individually for the typed shape. */
+export function countPending(pathOverride) {
+    const queuePath = pathOverride ?? defaultQueuePath();
+    if (!existsSync(queuePath))
+        return 0;
+    const raw = readFileSync(queuePath, 'utf-8');
+    let n = 0;
+    for (const line of raw.split(/\r?\n/)) {
+        if (line.trim().length > 0)
+            n++;
+    }
+    return n;
+}
+/** Quick predicate — was anything ever queued? */
+export function hasPendingOps(pathOverride) {
+    return countPending(pathOverride) > 0;
+}
+function ensureQueueFile(queuePath) {
+    const dir = dirname(queuePath);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    if (!existsSync(queuePath)) {
+        writeFileSync(queuePath, '', { encoding: 'utf-8', mode: 0o600 });
+        try {
+            chmodSync(queuePath, 0o600);
+        }
+        catch {
+            // ignore
+        }
+    }
+}
+//# sourceMappingURL=queue.js.map

package/dist/core/memory-sync/queue.spec.js

@@ -0,0 +1,105 @@
+import { strict as assert } from 'node:assert';
+import { afterEach, beforeEach, describe, it } from 'node:test';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { resolve } from 'node:path';
+import { countPending, enqueueMemoryOp, hasPendingOps, readMemoryQueue, rewriteMemoryQueue, } from './queue.js';
+let tmpRoot = '';
+let queuePath = '';
+beforeEach(() => {
+    tmpRoot = mkdtempSync(resolve(tmpdir(), 'pugi-memory-queue-'));
+    queuePath = resolve(tmpRoot, 'memory-queue.jsonl');
+});
+afterEach(() => {
+    try {
+        rmSync(tmpRoot, { recursive: true, force: true });
+    }
+    catch {
+        // ignore
+    }
+});
+describe('memory-sync queue', () => {
+    it('countPending returns 0 for missing file', () => {
+        assert.equal(countPending(queuePath), 0);
+        assert.equal(hasPendingOps(queuePath), false);
+    });
+    it('enqueueMemoryOp appends a write op and returns 1', () => {
+        const n = enqueueMemoryOp({
+            op: 'write',
+            personaSlug: 'mira',
+            kind: 'preference',
+            content: 'operator prefers pnpm',
+        }, queuePath);
+        assert.equal(n, 1);
+        assert.equal(hasPendingOps(queuePath), true);
+    });
+    it('enqueueMemoryOp appends multiple ops sequentially', () => {
+        enqueueMemoryOp({ op: 'write', personaSlug: 'mira', kind: 'fact', content: 'a' }, queuePath);
+        enqueueMemoryOp({ op: 'forget', id: 'mem-abc' }, queuePath);
+        assert.equal(countPending(queuePath), 2);
+    });
+    it('readMemoryQueue returns parsed entries in order', () => {
+        enqueueMemoryOp({ op: 'write', personaSlug: 'mira', kind: 'workflow', content: 'first' }, queuePath);
+        enqueueMemoryOp({ op: 'forget', id: 'mem-1' }, queuePath);
+        const ops = readMemoryQueue(queuePath);
+        assert.equal(ops.length, 2);
+        assert.equal(ops[0]?.op, 'write');
+        if (ops[0]?.op === 'write')
+            assert.equal(ops[0].content, 'first');
+        assert.equal(ops[1]?.op, 'forget');
+    });
+    it('readMemoryQueue skips malformed lines without crashing', () => {
+        writeFileSync(queuePath, [
+            JSON.stringify({
+                op: 'write',
+                personaSlug: 'mira',
+                kind: 'fact',
+                content: 'a',
+                enqueuedAt: new Date().toISOString(),
+            }),
+            '{not valid json',
+            JSON.stringify({ op: 'future_op', whatever: true }),
+        ].join('\n'));
+        const ops = readMemoryQueue(queuePath);
+        assert.equal(ops.length, 1);
+    });
+    it('rewriteMemoryQueue with empty array clears the file', () => {
+        enqueueMemoryOp({ op: 'write', personaSlug: 'mira', kind: 'fact', content: 'a' }, queuePath);
+        rewriteMemoryQueue([], queuePath);
+        assert.equal(countPending(queuePath), 0);
+        const raw = readFileSync(queuePath, 'utf-8');
+        assert.equal(raw, '');
+    });
+    it('rewriteMemoryQueue with remaining entries persists them', () => {
+        enqueueMemoryOp({ op: 'write', personaSlug: 'mira', kind: 'fact', content: 'a' }, queuePath);
+        enqueueMemoryOp({ op: 'write', personaSlug: 'mira', kind: 'fact', content: 'b' }, queuePath);
+        const all = readMemoryQueue(queuePath);
+        rewriteMemoryQueue([all[1]], queuePath);
+        const after = readMemoryQueue(queuePath);
+        assert.equal(after.length, 1);
+        if (after[0]?.op === 'write')
+            assert.equal(after[0].content, 'b');
+    });
+    it('enqueueMemoryOp rejects an invalid kind via Zod', () => {
+        assert.throws(() => enqueueMemoryOp({
+            op: 'write',
+            personaSlug: 'mira',
+            // @ts-expect-error — intentional bad value
+            kind: 'whatever',
+            content: 'a',
+        }, queuePath));
+    });
+    it('enqueueMemoryOp rejects oversized content (>4000 chars)', () => {
+        assert.throws(() => enqueueMemoryOp({
+            op: 'write',
+            personaSlug: 'mira',
+            kind: 'fact',
+            content: 'x'.repeat(4001),
+        }, queuePath));
+    });
+    it('countPending counts non-empty lines only', () => {
+        writeFileSync(queuePath, 'line1\n\n\nline2\n');
+        assert.equal(countPending(queuePath), 2);
+    });
+});
+//# sourceMappingURL=queue.spec.js.map

package/dist/core/repl/session.js

@@ -36,6 +36,7 @@ import { webFetchTool } from '../../tools/web-fetch.js';
 import { loadSettings } from '../settings.js';
 import { getJobRegistry } from '../jobs/registry.js';
 import { applyCompactMask } from '../compact/buffer-rewriter.js';
+import { applyRewindMask } from '../checkpoint/rewinder.js';
 import { evaluateAutoCompact } from '../compact/auto-trigger.js';
 import { estimateTokensInMany } from '../compact/token-counter.js';
 import { extractAskTags, extractPlanReviewTags, signatureForAsk, } from './ask.js';
@@ -1015,6 +1016,37 @@ export class ReplSession {
                 await this.dispatchCompact('manual');
                 return verdict;
             }
+            case 'rewind': {
+                // Leak L9 (2026-05-27): /rewind appends an append-only
+                // tombstone marker that rolls the conversation back to a
+                // checkpoint. The actual replay-mask is advisory — the on-disk
+                // events stay durable so `pugi sessions undo-rewind` can
+                // reverse the operation. We forward to the same runner the
+                // top-level `pugi rewind` command uses to keep the surface
+                // single-sourced. Dynamic import avoids pulling the checkpoint
+                // graph into the dispatcher at module load.
+                if (!this.store || !this.localSessionId) {
+                    this.appendSystemLine('Local session store is disabled — /rewind is unavailable.');
+                    return verdict;
+                }
+                try {
+                    const { runRewindCommand } = await import('../../runtime/commands/rewind.js');
+                    await runRewindCommand(verdict.args, {
+                        workspaceRoot: process.cwd(),
+                        sessionId: this.localSessionId,
+                        store: this.store,
+                        writeOutput: (_payload, text) => {
+                            if (text.length > 0)
+                                this.appendSystemLine(text);
+                        },
+                    });
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    this.appendSystemLine(`/rewind failed: ${message}`);
+                }
+                return verdict;
+            }
             case 'share': {
                 // Leak L20 (2026-05-27): /share forwards to the same runner the
                 // top-level `pugi share` command uses. The session module
@@ -1233,6 +1265,41 @@ export class ReplSession {
                 }
                 return verdict;
             }
+            case 'repo-map': {
+                // Leak L28 (2026-05-27): AST-light workspace summary. Delegate
+                // к the shared `runRepoMapCommand` so the slash + top-level
+                // paths stay single-sourced. The rendered text lands on the
+                // system pane via `appendSystemLine` (no fresh Ink mount) so
+                // the listing flows into the conversation transcript like
+                // any other command output.
+                try {
+                    const { runRepoMapCommand } = await import('../../runtime/commands/repo-map.js');
+                    const lines = [];
+                    await runRepoMapCommand({
+                        cwd: process.cwd(),
+                        refresh: verdict.refresh,
+                        json: false,
+                        writeOutput: (_payload, text) => {
+                            for (const line of text.split('\n')) {
+                                const trimmed = line.replace(/\s+$/u, '');
+                                lines.push(trimmed);
+                            }
+                        },
+                    });
+                    if (lines.length === 0) {
+                        this.appendSystemLine('/repo-map: no output.');
+                    }
+                    else {
+                        for (const line of lines)
+                            this.appendSystemLine(line);
+                    }
+                }
+                catch (error) {
+                    const message = error instanceof Error ? error.message : String(error);
+                    this.appendSystemLine(`/repo-map failed: ${message}`);
+                }
+                return verdict;
+            }
             case 'stub': {
                 this.appendSystemLine(verdict.message);
                 return verdict;
@@ -2997,7 +3064,12 @@ export class ReplSession {
         // condensed into the boundary's `keptTailTurns + marker` slice so
         // the post-resume transcript starts at the most-recent context
         // floor rather than re-playing the full pre-compaction history.
-        const masked = applyCompactMask(events);
+        //
+        // Leak L9 (2026-05-27): then apply rewind-marker masking. Any
+        // event inside an active rewind range is stripped from the
+        // visible transcript; the on-disk events stay durable so a
+        // follow-up `pugi sessions undo-rewind` can restore them.
+        const masked = applyRewindMask(applyCompactMask(events));
         const rows = [];
         for (const event of masked) {
             const row = eventToTranscriptRow(event);

package/dist/core/repl/slash-commands.js

@@ -66,6 +66,7 @@ export const SLASH_COMMAND_HELP = Object.freeze([
     { name: 'resume', args: '', gloss: 'Pick a stored session to restore', group: 'Session' },
     { name: 'context', args: '', gloss: 'Show three-tier context summary (Tier 0 skeleton + Tier 1 working set)', group: 'Session' },
     { name: 'compact', args: '', gloss: 'Summarise older turns into a boundary marker (leak L8)', group: 'Session' },
+    { name: 'rewind', args: '[N | --to <id>]', gloss: 'Roll the conversation back to a checkpoint (leak L9)', group: 'Session' },
     { name: 'memory', args: '', gloss: 'Session memory editor  (α6.5b)', group: 'Session', stub: true },
     { name: 'init', args: '', gloss: 'Scaffold .pugi/ in the current workspace (β1 Sl11)', group: 'Session' },
     // Pugi tools
@@ -75,6 +76,7 @@ export const SLASH_COMMAND_HELP = Object.freeze([
     { name: 'quota', args: '', gloss: 'Plan tier + monthly usage caps (sync / review / engine)', group: 'Pugi tools' },
     { name: 'status', args: '', gloss: 'Session snapshot — id · cwd · mode · tokens · dispatches · auth', group: 'Pugi tools' },
     { name: 'consensus', args: '[ref]', gloss: '3-model consensus review (codex · claude · deepseek)', group: 'Pugi tools' },
+    { name: 'repo-map', args: '[refresh]', gloss: 'AST-light symbol summary of the workspace (leak L28)', group: 'Pugi tools' },
     // Settings
     { name: 'config', args: '', gloss: 'Show config', group: 'Settings', stub: true },
     { name: 'privacy', args: '', gloss: 'Show privacy mode + contract', group: 'Settings' },
@@ -438,6 +440,15 @@ export function parseSlashCommand(input) {
             // fresh shell.
             return { kind: 'compact' };
         }
+        case 'rewind': {
+            // Leak L9 (2026-05-27): `/rewind [N | --to <id>]`. Tokenize the
+            // tail unchanged so `runRewindCommand` (in `runtime/commands/
+            // rewind.ts`) handles every mode (picker / turns / to-event)
+            // through one parser. The slash + top-level CLI surfaces stay
+            // single-sourced — same separation as `/compact`.
+            const tokens = tail.length === 0 ? [] : tail.split(/\s+/).filter((s) => s.length > 0);
+            return { kind: 'rewind', args: tokens };
+        }
         case 'stickers': {
             // Leak L33 (2026-05-27): brand-personality gimmick. Tail args
             // are ignored — the surface is intentionally parameterless. The
@@ -462,6 +473,15 @@ export function parseSlashCommand(input) {
             const tokens = tail.length === 0 ? [] : tail.split(/\s+/).filter((s) => s.length > 0);
             return { kind: 'share', args: tokens };
         }
+        case 'repo-map':
+        case 'repomap': {
+            // Leak L28 (2026-05-27): build + show the AST-light symbol
+            // summary. Accepts `refresh` as a positional или `--refresh`
+            // flag so muscle memory from both shells lands the same way.
+            const tokens = tail.length === 0 ? [] : tail.split(/\s+/).filter((s) => s.length > 0);
+            const refresh = tokens.includes('--refresh') || tokens.includes('refresh') || tokens.includes('-r');
+            return { kind: 'repo-map', refresh };
+        }
         case 'release-notes':
         case 'releasenotes':
         case 'changelog': {

package/dist/core/repl/store/session-store.js

@@ -361,7 +361,7 @@ export class SqliteSessionStore {
         // which maps to SQLITE_OPEN_READONLY. The option form is the
         // documented API; the file-URI form (file:...?mode=ro) also works.
         const db = new DatabaseSync(dbPath, { readOnly: true });
-        return new SqliteSessionStoreReadOnlyView(db);
+        return new SqliteSessionStoreReadOnlyView(db, projectStoreDir);
     }
     /* ------------------------------------------------------------ */
     /* Internals                                                    */
@@ -584,8 +584,37 @@ export class SqliteSessionStore {
  */
 export class SqliteSessionStoreReadOnlyView {
     db;
-    constructor(db) {
+    projectStoreDir;
+    constructor(db, 
+    /**
+     * Project store directory — required for the JSONL event read path.
+     * L9 (2026-05-27): `/rewind` + `/resume` need to walk events from
+     * inside the read-only view so the rewind picker + resume preview
+     * never take the writer lockfile.
+     */
+    projectStoreDir) {
         this.db = db;
+        this.projectStoreDir = projectStoreDir;
+    }
+    /**
+     * Read every event for a session via the durable JSONL log. The
+     * SQLite cache is NOT used here — JSONL is the source of truth and
+     * the cache only holds counters. The walk stitches across rotation
+     * files (`events.<n>.jsonl`) in the same order `JsonlEventLog.read`
+     * uses inside the writer path so consumers see one consistent stream
+     * whether they came in via the writer store OR the read-only view.
+     */
+    async events(sessionId, opts) {
+        const sessionDir = resolve(this.projectStoreDir, 'sessions', sessionId);
+        if (!existsSync(sessionDir))
+            return [];
+        const log = new JsonlEventLog({ sessionDir });
+        try {
+            return log.read(opts);
+        }
+        finally {
+            log.close();
+        }
     }
     async list(opts) {
         const limit = clampLimit(opts?.limit ?? DEFAULT_LIST_LIMIT, MAX_LIST_LIMIT);