@pugi/cli 0.1.0-beta.3 → 0.1.0-beta.31

package/dist/core/context/markdown-traverse.js

@@ -0,0 +1,255 @@
+/**
+ * Per-directory PUGI.md / AGENTS.md / CLAUDE.md / GEMINI.md traverse-up
+ * loader — β5a R4+P5.
+ *
+ * Claude Code, Codex CLI, and Gemini CLI all support a "walk up from
+ * cwd to the workspace root, pick up agent-context markdown at every
+ * level" pattern. Without this, a `pugi explain` invoked from
+ * `apps/admin-api/` cannot see project-local conventions encoded in
+ * `apps/admin-api/PUGI.md` (or the cross-CLI shim files) — the
+ * existing `loadMarkdownContext` only reads files at `workspaceRoot`.
+ *
+ * The β5a quality gate (≥80% win-rate vs Claude Code per CEO 2026-05-26)
+ * surfaces this gap repeatedly: monorepo-local conventions (NestJS
+ * controller style, Prisma migration name format, cabinet brand voice
+ * gates) live in per-app context files, and Pugi was blind to them
+ * pre-β5a.
+ *
+ * Contract:
+ *
+ *   - Walk from `cwd` upward until we reach `workspaceRoot` OR cross
+ *     the filesystem boundary. The workspace root file itself is
+ *     loaded by the legacy `loadMarkdownContext` so we do NOT include
+ *     it here (no double-load, no double-budget-charge).
+ *
+ *   - At each intermediate directory, look for the four canonical
+ *     filenames: `PUGI.md` (native), `AGENTS.md` (cross-CLI shim),
+ *     `CLAUDE.md` (Claude Code compat), `GEMINI.md` (Gemini CLI compat).
+ *
+ *   - HTML comments stripped, identical to the legacy loader.
+ *
+ *   - `@import` expansion is intentionally NOT performed here — the
+ *     per-dir surface is "drop a small file with the local
+ *     conventions"; deep @import chains belong at workspace root.
+ *     Keeping this surface flat means the per-dir budget cannot be
+ *     blown out by a runaway @import in an unrelated subtree.
+ *
+ *   - Aggregate budget: `MAX_TRAVERSE_BYTES` across ALL files found
+ *     in the walk. When exhausted, remaining files are skipped with
+ *     a `budget_exhausted` warning. Default 32 KB — half the
+ *     workspace-root budget, because per-dir files are meant to be
+ *     terse delta conventions, not full project briefs.
+ *
+ *   - The walk is bounded: `MAX_TRAVERSE_DEPTH` levels above
+ *     workspaceRoot are NEVER traversed (defense against being
+ *     invoked from a malicious cwd outside the workspace; in
+ *     practice cwd is always inside workspaceRoot but the symlink
+ *     case demands belt + suspenders).
+ *
+ *   - Order returned: shallowest-first (workspace root would be
+ *     first if included, then each level closer to cwd). Closest-
+ *     to-cwd files are the most specific and the context builder
+ *     emits them LAST so the model treats them as the highest-
+ *     priority conventions.
+ *
+ * This module is pure: no logging, no network, no fs writes. Filesystem
+ * reads only.
+ */
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { stripHtmlComments } from './markdown-loader.js';
+/**
+ * Per-traverse total byte cap. Half the workspace-root budget — these
+ * files are meant to be terse "in this subdir, do X". 32 KB still fits
+ * ~8000 words of guidance.
+ */
+export const MAX_TRAVERSE_BYTES = 32 * 1024;
+/**
+ * Per-file byte cap. A single per-dir file should never dominate; the
+ * 8 KB cap keeps any one level honest. Files larger than this are
+ * loaded up to the cap and flagged truncated.
+ */
+export const MAX_TRAVERSE_PER_FILE_BYTES = 8 * 1024;
+/**
+ * Maximum number of parent directories above workspaceRoot we will
+ * traverse. Zero in normal operation — cwd is always inside the
+ * workspace; the cap exists so a misconfigured invocation never
+ * walks the whole filesystem looking for AGENTS.md.
+ */
+export const MAX_TRAVERSE_DEPTH = 0;
+/**
+ * Filenames we look for at every level of the walk. The order here
+ * also defines the per-directory load order: PUGI.md first (highest
+ * trust), then cross-CLI compat shims. When the same directory has
+ * multiple files (e.g. both PUGI.md AND CLAUDE.md), all are loaded
+ * — operators sometimes keep both during a tool migration.
+ */
+export const TRAVERSE_SOURCES = ['PUGI.md', 'AGENTS.md', 'CLAUDE.md', 'GEMINI.md'];
+/**
+ * Walk from `opts.cwd` upward toward `opts.workspaceRoot`, loading
+ * every PUGI.md / AGENTS.md / CLAUDE.md / GEMINI.md we encounter at
+ * intermediate levels. The workspace root itself is NOT loaded here
+ * — `loadMarkdownContext(workspaceRoot)` owns that file.
+ *
+ * Returned `loaded` is sorted shallowest-first (closest-to-root) so
+ * the caller can emit per-dir context in increasing specificity.
+ *
+ * Safety properties (proven by spec):
+ *
+ *   - Never reads outside the workspace tree (symlinks resolved via
+ *     realpathSync; off-tree symlinks rejected as
+ *     `import_escapes_workspace`).
+ *   - Never reads more than `MAX_TRAVERSE_BYTES` total or more than
+ *     `MAX_TRAVERSE_PER_FILE_BYTES` per file.
+ *   - Never walks above the workspace root.
+ *   - Never visits the workspace root itself (single source of truth
+ *     for workspace-level docs stays with `loadMarkdownContext`).
+ */
+export async function loadTraversedMarkdown(opts) {
+    const warnings = [];
+    const loaded = [];
+    let budgetRemaining = MAX_TRAVERSE_BYTES;
+    let absRoot;
+    let absCwd;
+    try {
+        absRoot = realpathSync(resolve(opts.workspaceRoot));
+        absCwd = realpathSync(resolve(opts.cwd));
+    }
+    catch (error) {
+        warnings.push({
+            kind: 'read_error',
+            message: `realpath failed for traverse anchor: ${error.message}`,
+        });
+        return { loaded, warnings, totalBytes: 0 };
+    }
+    // Containment guard: if cwd is not inside workspaceRoot, refuse
+    // to walk. Returning a clean empty result keeps the engine happy
+    // and surfaces nothing about the off-tree cwd to the model.
+    const relCwd = relative(absRoot, absCwd);
+    if (relCwd.startsWith('..') || isAbsolute(relCwd)) {
+        warnings.push({
+            kind: 'import_escapes_workspace',
+            message: `cwd is outside workspaceRoot; per-dir traverse skipped (cwd=${absCwd}, root=${absRoot})`,
+            path: absCwd,
+        });
+        return { loaded, warnings, totalBytes: 0 };
+    }
+    // Collect the walk: every directory from cwd UP TO (but not
+    // including) workspaceRoot.
+    const dirsToVisit = [];
+    let current = absCwd;
+    while (current !== absRoot) {
+        dirsToVisit.push(current);
+        const parent = dirname(current);
+        if (parent === current)
+            break; // hit filesystem root before workspaceRoot — defensive
+        current = parent;
+        if (dirsToVisit.length > 64)
+            break; // pathological depth, refuse
+    }
+    // Walk shallowest-first so we charge the budget in the order
+    // that matches what we return.
+    dirsToVisit.reverse();
+    for (const dir of dirsToVisit) {
+        if (budgetRemaining <= 0) {
+            warnings.push({
+                kind: 'budget_exhausted',
+                message: `per-dir traverse budget exhausted before reaching ${dir}`,
+                path: dir,
+            });
+            break;
+        }
+        for (const source of TRAVERSE_SOURCES) {
+            const candidate = resolve(dir, source);
+            if (!existsSync(candidate))
+                continue;
+            // Symlink guard: same realpath check as the workspace-root
+            // loader. A symlink inside the workspace that points outside
+            // the workspace must NOT be inlined.
+            let realCandidate;
+            try {
+                realCandidate = realpathSync(candidate);
+            }
+            catch (error) {
+                warnings.push({
+                    kind: 'read_error',
+                    message: `realpath failed for ${candidate}: ${error.message}`,
+                    path: candidate,
+                });
+                continue;
+            }
+            const realRel = relative(absRoot, realCandidate);
+            if (realRel.startsWith('..') || isAbsolute(realRel)) {
+                warnings.push({
+                    kind: 'import_escapes_workspace',
+                    message: `traverse file escapes workspace via symlink: ${candidate} -> ${realCandidate}`,
+                    path: candidate,
+                });
+                continue;
+            }
+            let raw;
+            let rawBytes;
+            try {
+                rawBytes = statSync(candidate).size;
+                raw = readFileSync(candidate, 'utf8');
+            }
+            catch (error) {
+                warnings.push({
+                    kind: 'read_error',
+                    message: `could not read ${candidate}: ${error.message}`,
+                    path: candidate,
+                });
+                continue;
+            }
+            const stripped = stripHtmlComments(raw);
+            // Per-file cap first, then global budget.
+            const perFileCap = Math.min(MAX_TRAVERSE_PER_FILE_BYTES, budgetRemaining);
+            let content = stripped;
+            let truncated = false;
+            let contentBytes = Buffer.byteLength(content, 'utf8');
+            if (contentBytes > perFileCap) {
+                // Codepoint-safe slice: convert byte cap to char cap by
+                // taking min(byte cap, char-length-up-to-cap). We accept
+                // mild over-trim for safety.
+                content = content.slice(0, perFileCap);
+                truncated = true;
+                contentBytes = Buffer.byteLength(content, 'utf8');
+            }
+            const distance = distanceSegments(absCwd, dir);
+            loaded.push({
+                source,
+                resolvedPath: candidate,
+                dir,
+                distanceFromCwd: distance,
+                rawBytes,
+                loadedBytes: contentBytes,
+                truncated,
+                content,
+            });
+            budgetRemaining -= contentBytes;
+            if (budgetRemaining <= 0)
+                break;
+        }
+    }
+    return {
+        loaded,
+        warnings,
+        totalBytes: MAX_TRAVERSE_BYTES - budgetRemaining,
+    };
+}
+/**
+ * How many path segments separate `from` and `to`. Both must be
+ * absolute. `to` is assumed to be an ancestor of (or equal to)
+ * `from`; if not, returns -1 so callers can ignore the file.
+ */
+function distanceSegments(from, to) {
+    if (from === to)
+        return 0;
+    const rel = relative(to, from);
+    if (rel.startsWith('..') || isAbsolute(rel))
+        return -1;
+    if (rel.length === 0)
+        return 0;
+    return rel.split(sep).length;
+}
+//# sourceMappingURL=markdown-traverse.js.map

package/dist/core/cost/rate-card.js

@@ -0,0 +1,129 @@
+/**
+ * Rate card for the `pugi cost` / `/cost` / `/usage` surface — L19 sprint.
+ *
+ * Distinct from `core/repl/model-pricing.ts` on purpose:
+ *
+ *   - `model-pricing.ts` powers the TUI cost meter (per-turn flash, status
+ *     row USD). Its ladder is keyed against the live Anvil model slugs and
+ *     intentionally inflates an honest worst-case figure via the Sonnet
+ *     fallback so an operator on a quiet model never gets billed by a
+ *     surprise. It rounds to USD per 1M tokens at runtime.
+ *
+ *   - `rate-card.ts` (this file) powers the persisted `/cost` table the
+ *     operator reads to plan budget. It distinguishes open-weight models
+ *     ($0 / $0 — infra cost only) from hosted closed models so the table
+ *     does not double-charge an operator running a self-hosted Qwen or
+ *     Kimi behind Pugi. The L19 spec calls these out by name.
+ *
+ * Both ladders intentionally agree on Anthropic Claude family pricing so
+ * the TUI flash and the persisted table cannot disagree on a Claude turn.
+ * If they diverge, the per-model-pricing ladder wins for live UI; the
+ * rate card here wins for the persisted `.pugi/cost.json` aggregate.
+ *
+ * Prices are USD per 1,000,000 tokens, sourced from the L19 spec
+ * (2026-05-27) which mirrors provider list-price pages as of that date.
+ */
+/**
+ * Exact-match price ladder keyed by model slug. Slugs match the L19 task
+ * spec verbatim so a copy-paste from the sprint doc resolves without
+ * normalisation.
+ */
+export const RATES_PER_MTOKEN = Object.freeze({
+    // Anthropic Claude family (hosted, billed).
+    'claude-opus-4-7': { input: 15, output: 75 },
+    'claude-opus-4-6': { input: 15, output: 75 },
+    'claude-sonnet-4-6': { input: 3, output: 15 },
+    'claude-sonnet-4-5': { input: 3, output: 15 },
+    'claude-haiku-4-5-20251001': { input: 1, output: 5 },
+    'claude-haiku-4-5': { input: 1, output: 5 },
+    // Open-weight models — infra cost only, never per-token billed. The
+    // note column surfaces the reason so a CFO reading the JSON envelope
+    // does not assume the row is broken.
+    'qwen3-coder-480b-instruct-fp8': { input: 0, output: 0, note: 'open-weight' },
+    'kimi-k2.6': { input: 0, output: 0, note: 'open-weight' },
+    'deepseek-v4-pro': { input: 0, output: 0, note: 'open-weight' },
+});
+/**
+ * Family-prefix fallback — used only when an exact slug miss. Mirrors the
+ * approach in `model-pricing.ts` so a future model rebind (e.g.
+ * `claude-opus-4-8`) prices reasonably without a code edit.
+ */
+const FAMILY_FALLBACKS = [
+    ['claude-opus-', { input: 15, output: 75 }],
+    ['claude-sonnet-', { input: 3, output: 15 }],
+    ['claude-haiku-', { input: 1, output: 5 }],
+    ['qwen', { input: 0, output: 0, note: 'open-weight' }],
+    ['kimi', { input: 0, output: 0, note: 'open-weight' }],
+    ['deepseek', { input: 0, output: 0, note: 'open-weight' }],
+];
+/**
+ * Final fallback for unknown slugs. Pinned to Sonnet-tier — same posture
+ * as `model-pricing.ts`'s default, so an unrecognised hosted model bills
+ * "honestly conservative" rather than $0 (which would silently hide cost
+ * from the operator).
+ */
+const DEFAULT_RATE = { input: 3, output: 15, note: 'unknown model — Sonnet-tier estimate' };
+/**
+ * Look up the rate for a model slug.
+ *
+ * Resolution order:
+ *   1. Exact match in `RATES_PER_MTOKEN`.
+ *   2. Family-prefix match (first hit wins).
+ *   3. Default Sonnet-tier estimate.
+ *
+ * Pure, never throws. Called on every cost-tracker write so the hot path
+ * stays branch-cheap.
+ */
+export function rateFor(model) {
+    if (!model || typeof model !== 'string')
+        return DEFAULT_RATE;
+    const exact = RATES_PER_MTOKEN[model];
+    if (exact)
+        return exact;
+    for (const [prefix, rate] of FAMILY_FALLBACKS) {
+        if (model.startsWith(prefix))
+            return rate;
+    }
+    return DEFAULT_RATE;
+}
+/**
+ * Compute the USD cost for a single (model, inputTokens, outputTokens)
+ * triple. Defensive against negative / NaN inputs — out-of-range values
+ * floor to zero so a buggy upstream cannot credit a negative cost.
+ */
+export function estimateUsd(model, inputTokens, outputTokens) {
+    const rate = rateFor(model);
+    const safeIn = Number.isFinite(inputTokens) && inputTokens > 0 ? inputTokens : 0;
+    const safeOut = Number.isFinite(outputTokens) && outputTokens > 0 ? outputTokens : 0;
+    const usd = (safeIn * rate.input + safeOut * rate.output) / 1_000_000;
+    return Number.isFinite(usd) && usd > 0 ? usd : 0;
+}
+/**
+ * Format a USD figure for the `/cost` table.
+ *
+ *   - `≥ $0.01` → two decimals (`$0.46`).
+ *   - `< $0.01` but `> 0` → three decimals (`$0.003`) so fractions of a
+ *     cent are honest instead of rounding to `$0.00`.
+ *   - Exactly `0` or NaN → `$0.00`.
+ *
+ * Mirrors `formatCostUsd` from `model-pricing.ts` intentionally — both
+ * surfaces should print the same number in the same shape.
+ */
+export function formatUsd(value) {
+    if (!Number.isFinite(value) || value <= 0)
+        return '$0.00';
+    if (value >= 0.01)
+        return `$${value.toFixed(2)}`;
+    return `$${value.toFixed(3)}`;
+}
+/**
+ * Format a token count for the `/cost` table. Uses comma-thousands so the
+ * table reads `14,300` instead of `14.3k` — distinct from the TUI status
+ * row which uses `k`/`m` shortening to save column width.
+ */
+export function formatTokensWithCommas(value) {
+    if (!Number.isFinite(value) || value <= 0)
+        return '0';
+    return Math.floor(value).toLocaleString('en-US');
+}
+//# sourceMappingURL=rate-card.js.map

package/dist/core/cost/tracker.js

@@ -0,0 +1,221 @@
+/**
+ * Persisted per-session cost tracker — L19 sprint (2026-05-27).
+ *
+ * Mission: every Anvil-mediated LLM call goes through `recordCall`, which
+ * aggregates per-model token + USD totals and atomically persists them
+ * to `.pugi/cost.json` so the operator can read `/cost` across REPL
+ * restarts and reconcile a 14-min session that crossed a process boundary.
+ *
+ * Why a fresh module instead of bolting onto `core/repl/session.ts`?
+ *
+ *   - `session.ts` accumulates in-memory state for the live TUI status
+ *     row, which is by-design ephemeral and cleared on REPL boot. The
+ *     operator's "what did I spend across the project?" question needs
+ *     a durable surface that survives a process restart.
+ *   - L19 also has to read `--all-sessions` (last 30 days). The natural
+ *     store for that is a per-workspace history of session aggregates,
+ *     which is easy with the JSON file pattern below and would be
+ *     awkward stitched into the REPL reducer.
+ *
+ * On-disk shape (single JSON file, atomic tmp+rename writes):
+ *
+ *   {
+ *     "version": 1,
+ *     "current": { sessionId, startedAt, models: { <slug>: ModelEntry } },
+ *     "history": [
+ *       { sessionId, startedAt, endedAt, models: { ... } }
+ *     ]
+ *   }
+ *
+ * History rotation: when `recordCall` is invoked with a sessionId
+ * different from `current.sessionId`, the existing `current` row is
+ * stamped with `endedAt = now()` and pushed onto `history`, then a new
+ * `current` row is initialised. History is capped at 90 entries (the L19
+ * `--all-sessions` window is 30 days; 90 gives a generous buffer for
+ * operators on >1 session/day cadence without unbounded growth).
+ *
+ * The tracker is workspace-scoped — every workspace has its own
+ * `.pugi/cost.json`. This matches the existing `.pugi/events.jsonl` /
+ * `.pugi/index.json` pattern and means a multi-repo operator's costs
+ * are billed against the repo they were incurred in.
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync, unlinkSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { estimateUsd } from './rate-card.js';
+/** On-disk schema version. Bump if the file shape changes. */
+export const COST_FILE_SCHEMA_VERSION = 1;
+/** Maximum number of historical sessions persisted in `.pugi/cost.json`. */
+export const COST_HISTORY_CAP = 90;
+export function createCostTracker(opts) {
+    const filePath = resolve(opts.workspaceRoot, '.pugi/cost.json');
+    const now = opts.now ?? Date.now;
+    let state = readOrInit(filePath);
+    function ensureCurrent(sessionId) {
+        if (state.current && state.current.sessionId === sessionId) {
+            return state.current;
+        }
+        // Session rotation: stamp the previous current with endedAt and push
+        // onto history. Idempotent — calling rotate twice with the same
+        // session id is a no-op.
+        if (state.current) {
+            const ended = {
+                ...state.current,
+                endedAt: new Date(now()).toISOString(),
+            };
+            state.history = [ended, ...state.history].slice(0, COST_HISTORY_CAP);
+        }
+        state.current = {
+            sessionId,
+            startedAt: new Date(now()).toISOString(),
+            models: {},
+        };
+        return state.current;
+    }
+    function persist() {
+        try {
+            mkdirSync(dirname(filePath), { recursive: true });
+        }
+        catch {
+            // best-effort directory create; the write below surfaces the real
+            // error if the parent is genuinely unwritable
+        }
+        const tmp = `${filePath}.tmp`;
+        writeFileSync(tmp, JSON.stringify(state, null, 2), 'utf8');
+        renameSync(tmp, filePath);
+    }
+    return {
+        recordCall(input) {
+            const sessionId = opts.sessionIdProvider();
+            if (!sessionId)
+                return;
+            const current = ensureCurrent(sessionId);
+            const slug = typeof input.model === 'string' && input.model.length > 0 ? input.model : 'unknown';
+            const safeIn = Number.isFinite(input.inputTokens) && input.inputTokens > 0 ? input.inputTokens : 0;
+            const safeOut = Number.isFinite(input.outputTokens) && input.outputTokens > 0 ? input.outputTokens : 0;
+            const existing = current.models[slug] ?? { input: 0, output: 0, callCount: 0 };
+            current.models[slug] = {
+                input: existing.input + safeIn,
+                output: existing.output + safeOut,
+                callCount: existing.callCount + 1,
+            };
+            persist();
+        },
+        current() {
+            return state.current;
+        },
+        history() {
+            return state.history;
+        },
+        aggregateWithin(withinDays) {
+            const cutoffMs = now() - withinDays * 24 * 60 * 60 * 1000;
+            const aggregate = {
+                sessionId: 'aggregate',
+                startedAt: new Date(cutoffMs).toISOString(),
+                endedAt: new Date(now()).toISOString(),
+                models: {},
+            };
+            const rows = [];
+            if (state.current)
+                rows.push(state.current);
+            for (const row of state.history) {
+                const stamp = Date.parse(row.startedAt);
+                if (Number.isFinite(stamp) && stamp >= cutoffMs)
+                    rows.push(row);
+            }
+            for (const row of rows) {
+                for (const [slug, entry] of Object.entries(row.models)) {
+                    const existing = aggregate.models[slug] ?? { input: 0, output: 0, callCount: 0 };
+                    aggregate.models[slug] = {
+                        input: existing.input + entry.input,
+                        output: existing.output + entry.output,
+                        callCount: existing.callCount + entry.callCount,
+                    };
+                }
+            }
+            return aggregate;
+        },
+        resetCurrent() {
+            const wiped = state.current;
+            state.current = null;
+            persist();
+            return wiped;
+        },
+        flush() {
+            persist();
+        },
+    };
+}
+/**
+ * Compute the per-session USD total from a `SessionAggregate`. Pure —
+ * uses the rate card to bind a price to every model entry. Open-weight
+ * models contribute $0 (their entries always have $0/$0 rate).
+ */
+export function totalUsd(aggregate) {
+    let total = 0;
+    for (const [slug, entry] of Object.entries(aggregate.models)) {
+        total += estimateUsd(slug, entry.input, entry.output);
+    }
+    return total;
+}
+/**
+ * Compute total input + output token sums across all models in an
+ * aggregate. Used by the CLI table footer.
+ */
+export function totalTokens(aggregate) {
+    let input = 0;
+    let output = 0;
+    for (const entry of Object.values(aggregate.models)) {
+        input += entry.input;
+        output += entry.output;
+    }
+    return { input, output };
+}
+/**
+ * Read the persisted file (or initialise an empty one). Tolerates a
+ * corrupted file by returning a fresh empty state — losing one
+ * session's history is preferable to throwing from the boot path of
+ * every `pugi cost` invocation.
+ */
+function readOrInit(filePath) {
+    if (!existsSync(filePath)) {
+        return { version: COST_FILE_SCHEMA_VERSION, current: null, history: [] };
+    }
+    try {
+        const raw = readFileSync(filePath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return { version: COST_FILE_SCHEMA_VERSION, current: null, history: [] };
+        }
+        const obj = parsed;
+        return {
+            version: typeof obj.version === 'number' ? obj.version : COST_FILE_SCHEMA_VERSION,
+            current: isAggregate(obj.current) ? obj.current : null,
+            history: Array.isArray(obj.history) ? obj.history.filter(isAggregate) : [],
+        };
+    }
+    catch {
+        return { version: COST_FILE_SCHEMA_VERSION, current: null, history: [] };
+    }
+}
+function isAggregate(v) {
+    if (!v || typeof v !== 'object' || Array.isArray(v))
+        return false;
+    const obj = v;
+    if (typeof obj.sessionId !== 'string' || typeof obj.startedAt !== 'string')
+        return false;
+    if (!obj.models || typeof obj.models !== 'object')
+        return false;
+    return true;
+}
+/**
+ * Test helper — wipe the `.pugi/cost.json` file. Not exported through the
+ * public CostTracker surface because production code must never call
+ * this; an operator-facing reset goes through `resetCurrent()` which
+ * preserves history.
+ */
+export function _danger_wipeCostFile_forTests(workspaceRoot) {
+    const filePath = resolve(workspaceRoot, '.pugi/cost.json');
+    if (existsSync(filePath))
+        unlinkSync(filePath);
+}
+//# sourceMappingURL=tracker.js.map

package/dist/core/denial-tracking/index.js

@@ -0,0 +1,8 @@
+/**
+ * Public re-exports for the denial-tracking surface. Engine adapter
+ * code imports from here so we can move internals around (e.g. split
+ * the diagnostics probe into a sibling file) without churning every
+ * call site.
+ */
+export { DenialTrackingState, buildDenialContext, canonicalArgHash, DENIAL_TRACKING_MAX_ENTRIES, DENIAL_REMINDER_THRESHOLD, DENIAL_ARGS_SUMMARY_BYTES, } from './state.js';
+//# sourceMappingURL=index.js.map