@pugi/cli 0.1.0-beta.31 → 0.1.0-beta.36

package/dist/runtime/commands/redo-blob-store.js

@@ -0,0 +1,92 @@
+/**
+ * Redo blob store — Wave 6 (2026-05-27).
+ *
+ * `/undo` walks the most recent successful mutating tool result and
+ * reverts each file on disk. `/redo` reapplies that change. To reapply,
+ * we need the post-mutation content — but the event log records only
+ * sha256 hashes, not content (see core/file-cache.ts comment).
+ *
+ * Solution: a content-addressable sidecar store at
+ * `<workspaceRoot>/.pugi/undo-blobs/<sha256>`. The undo runner captures
+ * each file's CURRENT content (which equals the original AFTER state)
+ * into the store BEFORE reverting on disk. The redo runner reads the
+ * blob keyed by `beforeHash` of the inverse mutation (which records
+ * the pre-revert hash = the original AFTER hash) and writes it back.
+ *
+ * The store is deliberately untracked (`.pugi/` already lives in
+ * .gitignore) and self-cleaning — after a successful redo we delete
+ * the blob so a second redo without a fresh undo is a noop. Stale
+ * blobs left behind by an interrupted undo are reaped after 7 days
+ * by the existing `.pugi/cleanup` cadence (best-effort; not a
+ * correctness requirement).
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from 'node:fs';
+import { resolve } from 'node:path';
+import { hashContent } from '../../core/file-cache.js';
+/** Sha256-keyed blob path under `<root>/.pugi/undo-blobs/`. */
+export function blobPathFor(root, sha) {
+    return resolve(root, '.pugi/undo-blobs', sha);
+}
+/** Ensure the blob directory exists. Idempotent. */
+function ensureBlobDir(root) {
+    const dir = resolve(root, '.pugi/undo-blobs');
+    if (!existsSync(dir)) {
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+    }
+    return dir;
+}
+/**
+ * Write `content` into the blob store. Returns the resolved blob path.
+ * Atomic tmp+rename so partial writes never present a half-blob к
+ * future redo invocations.
+ *
+ * Idempotent: if a blob with the same content already exists, the
+ * second write is a noop (the rename target already matches).
+ */
+export function writeBlob(root, content) {
+    ensureBlobDir(root);
+    const sha = hashContent(content);
+    const dst = blobPathFor(root, sha);
+    if (existsSync(dst)) {
+        // Same content already cached; nothing to do.
+        return { sha, path: dst };
+    }
+    const tmp = `${dst}.tmp-${process.pid}-${Date.now()}`;
+    writeFileSync(tmp, content, { encoding: 'utf8', mode: 0o600 });
+    renameSync(tmp, dst);
+    return { sha, path: dst };
+}
+/**
+ * Read a blob by sha. Returns `undefined` when the blob is missing
+ * (cleanup ran, repo cloned fresh, blob never captured). Callers
+ * MUST treat undefined as "redo not available" rather than crashing.
+ */
+export function readBlob(root, sha) {
+    const path = blobPathFor(root, sha);
+    if (!existsSync(path))
+        return undefined;
+    try {
+        return readFileSync(path, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Best-effort blob deletion. Used by the redo runner after a successful
+ * reapply so the blob does not get reused on a second redo (which would
+ * be incorrect — once redone, the next undo must capture fresh state).
+ * Missing-file errors are swallowed — the store self-heals.
+ */
+export function deleteBlob(root, sha) {
+    const path = blobPathFor(root, sha);
+    if (!existsSync(path))
+        return;
+    try {
+        unlinkSync(path);
+    }
+    catch {
+        // Best-effort.
+    }
+}
+//# sourceMappingURL=redo-blob-store.js.map

package/dist/runtime/commands/redo.js

@@ -0,0 +1,361 @@
+import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { hashContent } from '../../core/file-cache.js';
+import { recordFileMutation, recordToolCall, recordToolResult, } from '../../core/session.js';
+import { deleteBlob, readBlob } from './redo-blob-store.js';
+/**
+ * `pugi redo` — counterpart to `pugi undo` (Wave 6, 2026-05-27).
+ *
+ * Reapplies the file mutations that the most recent `/undo` invocation
+ * reverted. Stack-based: each successful redo consumes one undo entry
+ * from the event log, so calling /redo twice after two /undo calls
+ * walks back through the original mutation history in reverse order.
+ *
+ * Walk strategy:
+ *   1. Read `.pugi/events.jsonl` line by line into an array.
+ *   2. Walk backwards. Find the most recent `tool_result` whose
+ *      `status === 'success'` and whose linked `tool_call` tool is
+ *      `undo` AND for which no later `tool_result` with tool `redo`
+ *      has already consumed it. (We track the consumed-by-redo set
+ *      by walking events forward once and tagging undo results that
+ *      a subsequent redo references.)
+ *   3. Gather every `file_mutation` event that shares the same undo
+ *      `toolCallId`. These are the INVERSE mutations:
+ *        - operation: 'delete' + beforeHash=<original-after-sha>
+ *          → original op was `create`; redo = recreate file from blob
+ *        - operation: 'update' + beforeHash=<original-after-sha>,
+ *          afterHash=<original-before-sha>
+ *          → original op was `update`; redo = restore content from blob
+ *        - operation: 'update' + beforeHash=undefined,
+ *          afterHash=<original-before-sha>
+ *          → original op was `delete`; redo = delete the file again
+ *
+ * Reapply strategy:
+ *   For each step we re-apply with a strict safety gate. If the file
+ *   was modified externally since the undo (current sha ≠ undo's
+ *   `afterHash`) we refuse to overwrite operator work and abort the
+ *   whole redo atomically — no partial reapply per spec parity with
+ *   the undo runner.
+ *
+ *   - inverse `delete` (recreate from create-undo): read blob keyed
+ *     by `beforeHash`, write at path. Path must not exist OR must
+ *     match the post-undo (afterHash = undefined, file deleted).
+ *   - inverse `update` with afterHash present (update-undo or
+ *     delete-undo restoring HEAD): file must currently match
+ *     `afterHash`. Reapply by writing blob content (update case) or
+ *     by unlinking the file (delete case — no blob exists, the
+ *     `beforeHash === undefined` discriminator routes here).
+ *   - any other shape → unsafe → abort.
+ *
+ * After a successful redo:
+ *   - Emit a `tool_call` event with tool `redo` and inputSummary
+ *     `replay <undo-toolCallId>` so the next /undo invocation walks
+ *     PAST it (the redo creates fresh mutations that show up as the
+ *     most recent successful mutating result).
+ *   - Emit one `file_mutation` per reapplied step describing the
+ *     re-applied operation (create / update / delete) so a subsequent
+ *     /undo can reverse the redo if the operator changes their mind.
+ *   - Best-effort delete the consumed blobs from `.pugi/undo-blobs/`
+ *     so a second /redo without a fresh /undo is a noop instead of
+ *     re-applying stale content.
+ */
+const UNDO_TOOL = 'undo';
+export async function runRedoCommand(_args, ctx) {
+    const eventsPath = resolve(ctx.workspaceRoot, '.pugi/events.jsonl');
+    if (!existsSync(eventsPath)) {
+        ctx.writeOutput({ command: 'redo', status: 'noop', reason: 'no_session' }, 'No session events found. Nothing to redo.');
+        return;
+    }
+    const events = parseEvents(eventsPath);
+    const target = findReplayTarget(events);
+    if (!target) {
+        ctx.writeOutput({ command: 'redo', status: 'noop', reason: 'no_undo' }, 'No /undo to redo. Run an undo first, then /redo will replay it.');
+        return;
+    }
+    if (target.mutations.length === 0) {
+        ctx.writeOutput({
+            command: 'redo',
+            status: 'noop',
+            reason: 'no_inverse_mutations',
+            undoToolCallId: target.undoToolCallId,
+        }, `Undo ${target.undoToolCallId} recorded no inverse mutations. Nothing to redo.`);
+        return;
+    }
+    // Pre-flight: every step must be reversible before touching disk.
+    const plan = planReplays(ctx.workspaceRoot, target.mutations);
+    if (plan.aborted) {
+        ctx.writeOutput({
+            command: 'redo',
+            status: 'aborted',
+            reason: plan.reason,
+            undoToolCallId: target.undoToolCallId,
+            unsafe: plan.unsafe,
+        }, `Refusing to redo ${target.undoToolCallId}: ${plan.reason}`);
+        process.exitCode = 1;
+        return;
+    }
+    const replayed = [];
+    for (const step of plan.steps) {
+        try {
+            executeReplay(ctx.workspaceRoot, step);
+            replayed.push({ path: step.path, operation: step.replayOperation });
+        }
+        catch (error) {
+            // Mid-flight failure after pre-flight said it was safe. Surface
+            // the error and bail — parity with the undo runner's "no partial
+            // state on failure" contract.
+            const message = error instanceof Error ? error.message : String(error);
+            ctx.writeOutput({
+                command: 'redo',
+                status: 'failed',
+                reason: message,
+                undoToolCallId: target.undoToolCallId,
+                replayed,
+                failedAt: step.path,
+            }, `Redo failed mid-flight on ${step.path}: ${message}`);
+            process.exitCode = 1;
+            return;
+        }
+    }
+    // Audit the redo so a future /undo walks back through it. Each
+    // replayed step gets a fresh `file_mutation` event so the next
+    // /undo's walk picks this up as the most-recent successful
+    // mutating tool result.
+    const toolCallId = recordToolCall(ctx.session, 'redo', `replay ${target.undoToolCallId}`);
+    for (const step of plan.steps) {
+        recordFileMutation(ctx.session, {
+            toolCallId,
+            path: step.path,
+            operation: step.replayOperation,
+            beforeHash: step.preReplayHash,
+            afterHash: step.postReplayHash,
+        });
+    }
+    recordToolResult(ctx.session, toolCallId, 'success', `Redid ${replayed.length} mutation(s) from undo ${target.undoToolCallId}`);
+    // Best-effort blob cleanup. After redo the blob is no longer needed
+    // — a future /undo will capture fresh after-state from disk if the
+    // operator un-does this redo.
+    for (const step of plan.steps) {
+        if (step.blobSha)
+            deleteBlob(ctx.workspaceRoot, step.blobSha);
+    }
+    ctx.writeOutput({
+        command: 'redo',
+        status: 'ok',
+        undoToolCallId: target.undoToolCallId,
+        replayed,
+    }, [
+        `Redid ${replayed.length} mutation(s) from undo ${target.undoToolCallId}:`,
+        ...replayed.map((entry) => `  ${entry.operation.padEnd(7)} ${entry.path}`),
+        'Use /undo to revert.',
+    ].join('\n'));
+}
+function parseEvents(eventsPath) {
+    const raw = readFileSync(eventsPath, 'utf8');
+    const lines = raw.split('\n').filter((line) => line.trim().length > 0);
+    const out = [];
+    for (const line of lines) {
+        try {
+            const parsed = JSON.parse(line);
+            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+                out.push(parsed);
+            }
+        }
+        catch {
+            // Partial-write tolerance — same approach as undo.ts.
+        }
+    }
+    return out;
+}
+/**
+ * Find the most recent successful `undo` tool result that has NOT
+ * been consumed by a later `redo` invocation.
+ *
+ * Consumption tracking: we collect every `redo` tool_call's
+ * `inputSummary` of the shape `replay <toolCallId>`. Any matching
+ * undo toolCallId is treated as already-redone — calling /redo a
+ * second time without a fresh /undo must be a noop, not a re-apply
+ * (re-apply would double-write the same content and corrupt the
+ * audit trail).
+ */
+function findReplayTarget(events) {
+    const toolCalls = new Map();
+    const results = [];
+    const consumed = new Set();
+    for (let i = 0; i < events.length; i += 1) {
+        const event = events[i];
+        if (!event)
+            continue;
+        if (event.type === 'tool_call' && typeof event.id === 'string' && typeof event.tool === 'string') {
+            toolCalls.set(event.id, { id: event.id, tool: event.tool, index: i });
+            if (event.tool === 'redo' && typeof event.inputSummary === 'string') {
+                const match = /^replay\s+(\S+)/.exec(event.inputSummary);
+                if (match && match[1])
+                    consumed.add(match[1]);
+            }
+        }
+        else if (event.type === 'tool_result' &&
+            typeof event.id === 'string' &&
+            typeof event.toolCallId === 'string' &&
+            (event.status === 'success' || event.status === 'error' || event.status === 'cancelled')) {
+            results.push({
+                id: event.id,
+                toolCallId: event.toolCallId,
+                status: event.status,
+                index: i,
+            });
+        }
+    }
+    // Newest → oldest walk so the stack pops in LIFO order.
+    for (let i = results.length - 1; i >= 0; i -= 1) {
+        const result = results[i];
+        if (result.status !== 'success')
+            continue;
+        const call = toolCalls.get(result.toolCallId);
+        if (!call)
+            continue;
+        if (call.tool !== UNDO_TOOL)
+            continue;
+        if (consumed.has(result.toolCallId))
+            continue;
+        const mutations = [];
+        for (const event of events) {
+            if (event.type !== 'file_mutation')
+                continue;
+            if (event.toolCallId !== result.toolCallId)
+                continue;
+            if (typeof event.path !== 'string')
+                continue;
+            if (event.operation !== 'create' &&
+                event.operation !== 'update' &&
+                event.operation !== 'delete' &&
+                event.operation !== 'move') {
+                continue;
+            }
+            mutations.push({
+                toolCallId: result.toolCallId,
+                path: event.path,
+                operation: event.operation,
+                beforeHash: typeof event.beforeHash === 'string' ? event.beforeHash : undefined,
+                afterHash: typeof event.afterHash === 'string' ? event.afterHash : undefined,
+            });
+        }
+        return { undoToolCallId: result.toolCallId, mutations };
+    }
+    return null;
+}
+function planReplays(root, mutations) {
+    const steps = [];
+    const unsafe = [];
+    for (const mutation of mutations) {
+        const abs = resolve(root, mutation.path);
+        // The undo emitted three inverse shapes — decode the original op
+        // from the (operation, beforeHash, afterHash) triple.
+        if (mutation.operation === 'delete' && mutation.beforeHash) {
+            // Original op was `create`. Redo = recreate from blob.
+            if (existsSync(abs)) {
+                unsafe.push(`${mutation.path}: post-undo expected file to be absent, found existing content`);
+                continue;
+            }
+            const content = readBlob(root, mutation.beforeHash);
+            if (content === undefined) {
+                unsafe.push(`${mutation.path}: no captured AFTER content blob (sha=${mutation.beforeHash.slice(0, 12)}…) — redo not available`);
+                continue;
+            }
+            if (hashContent(content) !== mutation.beforeHash) {
+                unsafe.push(`${mutation.path}: blob sha mismatch (store may have been tampered with) — refusing to write`);
+                continue;
+            }
+            steps.push({
+                path: mutation.path,
+                replayOperation: 'create',
+                preReplayHash: undefined,
+                postReplayHash: mutation.beforeHash,
+                content,
+                blobSha: mutation.beforeHash,
+            });
+            continue;
+        }
+        if (mutation.operation === 'update' && mutation.beforeHash && mutation.afterHash) {
+            // Original op was `update`. Post-undo file matches afterHash
+            // (= original beforeHash). Redo = restore beforeHash content
+            // from blob (= original afterHash content).
+            if (!existsSync(abs)) {
+                unsafe.push(`${mutation.path}: file expected to exist for update redo, not found`);
+                continue;
+            }
+            const current = readFileSync(abs, 'utf8');
+            if (hashContent(current) !== mutation.afterHash) {
+                unsafe.push(`${mutation.path}: modified externally since /undo — refusing to overwrite operator work`);
+                continue;
+            }
+            const content = readBlob(root, mutation.beforeHash);
+            if (content === undefined) {
+                unsafe.push(`${mutation.path}: no captured AFTER content blob (sha=${mutation.beforeHash.slice(0, 12)}…) — redo not available`);
+                continue;
+            }
+            if (hashContent(content) !== mutation.beforeHash) {
+                unsafe.push(`${mutation.path}: blob sha mismatch (store may have been tampered with) — refusing to write`);
+                continue;
+            }
+            steps.push({
+                path: mutation.path,
+                replayOperation: 'update',
+                preReplayHash: mutation.afterHash,
+                postReplayHash: mutation.beforeHash,
+                content,
+                blobSha: mutation.beforeHash,
+            });
+            continue;
+        }
+        if (mutation.operation === 'update' && !mutation.beforeHash && mutation.afterHash) {
+            // Original op was `delete`. Post-undo file matches afterHash
+            // (= original beforeHash, restored from git HEAD). Redo = delete
+            // the file again. No blob lookup needed.
+            if (!existsSync(abs)) {
+                // Already gone — nothing to redo for this entry.
+                continue;
+            }
+            const current = readFileSync(abs, 'utf8');
+            if (hashContent(current) !== mutation.afterHash) {
+                unsafe.push(`${mutation.path}: modified externally since /undo — refusing to delete operator work`);
+                continue;
+            }
+            steps.push({
+                path: mutation.path,
+                replayOperation: 'delete',
+                preReplayHash: mutation.afterHash,
+                postReplayHash: undefined,
+            });
+            continue;
+        }
+        // Anything else (move undo, malformed entry) — refuse rather than
+        // partial-replay. Matches the undo runner's posture.
+        unsafe.push(`${mutation.path}: redo of inverse op '${mutation.operation}' is not supported in this build`);
+    }
+    if (unsafe.length > 0) {
+        return {
+            aborted: true,
+            reason: 'one or more files are unsafe to redo',
+            unsafe,
+            steps: [],
+        };
+    }
+    return { aborted: false, steps };
+}
+function executeReplay(root, step) {
+    const abs = resolve(root, step.path);
+    if (step.replayOperation === 'delete') {
+        if (existsSync(abs))
+            unlinkSync(abs);
+        return;
+    }
+    if (step.content === undefined) {
+        throw new Error(`internal: replay content missing for ${step.path}`);
+    }
+    // Atomic tmp+rename — same pattern as undo's executeRevert.
+    const tmp = `${abs}.pugi-redo-${Date.now()}`;
+    writeFileSync(tmp, step.content, { encoding: 'utf8', mode: 0o600 });
+    renameSync(tmp, abs);
+}
+//# sourceMappingURL=redo.js.map

package/dist/runtime/commands/status.js

@@ -108,6 +108,8 @@ export async function runStatusCommand(ctx) {
         liveTokensUsed: ctx.liveTokensUsed ?? null,
         lastCommand: ctx.lastCommand ?? null,
         lastCommandAtEpochMs: ctx.lastCommandAtEpochMs ?? null,
+        liveApiUrl: ctx.liveApiUrl ?? null,
+        workspaceLabel: ctx.workspaceLabel ?? null,
         fs: ctx.fs ?? DEFAULT_FS,
         resolveCredential: ctx.resolveCredential ?? (() => defaultResolveCredential(ctx.env, ctx.home)),
         resolvePermissionMode: ctx.resolvePermissionMode ?? (() => permissionMode),
@@ -155,13 +157,19 @@ export async function runStatusCommand(ctx) {
  * narrow terminals stay legible without a layout library.
  */
 export function renderStatusTable(snapshot) {
-    const labelWidth = Math.max('Label'.length, ...snapshot.fields.map((f) => f.label.length));
+    // Row syntax: `${Label}: ${value}` with exactly ONE space after the
+    // colon, then the value verbatim. The colon doubles as a visual
+    // anchor and the REPL spec assertions match on the single-space
+    // form (`Backend: https://api.pugi.io`) — multi-space column
+    // padding broke `.includes('Backend: https://...')` substring
+    // checks. Operators who want a column layout can run the Ink
+    // renderer (`<StatusTable>`); the plain-text fallback stays
+    // narrow-terminal friendly without padding columns.
     const lines = [];
     lines.push('Pugi status');
     lines.push('═'.repeat(50));
     for (const field of snapshot.fields) {
-        const labelPart = field.label.padEnd(labelWidth, ' ');
-        lines.push(`${labelPart}  ${field.value}`);
+        lines.push(`${field.label}: ${field.value}`);
     }
     lines.push('');
     lines.push(`CLI ${snapshot.meta.cliVersion}  Node ${snapshot.meta.nodeVersion}  cwd ${snapshot.meta.cwd}`);

package/dist/runtime/commands/undo.js

@@ -3,6 +3,7 @@ import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from
 import { resolve } from 'node:path';
 import { hashContent } from '../../core/file-cache.js';
 import { recordFileMutation, recordToolCall, recordToolResult, } from '../../core/session.js';
+import { writeBlob } from './redo-blob-store.js';
 /**
  * `pugi undo` — revert the file mutations from the most recent successful
  * `write` / `edit` / `multi_edit` tool result.
@@ -81,6 +82,37 @@ export async function runUndoCommand(_args, ctx) {
     const restored = [];
     for (const step of plan.steps) {
         try {
+            // Wave 6 (2026-05-27): snapshot the AFTER state into the redo
+            // blob store BEFORE we revert the file on disk. /redo reads this
+            // blob keyed by `step.beforeHash` (= original afterHash) to
+            // reapply the change. We only snapshot for operations that have
+            // on-disk AFTER content: `create` (file exists, about to be
+            // deleted) and `update` (file exists, about to be overwritten).
+            // For `delete` reverts (file was deleted by Pugi, the "after" is
+            // nothing) redo replays the delete itself — no content needed.
+            // Best-effort: a blob-store failure must not abort the undo, so
+            // the writeBlob call is wrapped и any error swallowed.
+            if (step.operation === 'create' || step.operation === 'update') {
+                try {
+                    const abs = resolve(ctx.workspaceRoot, step.path);
+                    if (existsSync(abs) && step.beforeHash) {
+                        const current = readFileSync(abs, 'utf8');
+                        // Defensive: only snapshot if the current sha matches the
+                        // pre-revert hash the planner verified. The planner already
+                        // gated this, but a TOCTOU between plan + execute would
+                        // produce a wrong blob — silently dropping it is safer than
+                        // shipping content under the wrong sha.
+                        if (hashContent(current) === step.beforeHash) {
+                            writeBlob(ctx.workspaceRoot, current);
+                        }
+                    }
+                }
+                catch {
+                    // Best-effort. Failure to snapshot means /redo will report
+                    // "no captured content" — operator can re-run the mutation
+                    // manually. Better than aborting the undo.
+                }
+            }
             executeRevert(ctx.workspaceRoot, step);
             restored.push({ path: step.path, operation: step.operation });
         }