@pugi/cli 0.1.0-beta.7 → 0.1.0-beta.87

package/dist/core/repl/dispatch-fsm.js

@@ -1,5 +1,5 @@
 /**
- * Dispatch FSM — Sprint α6.9 Phase 1 (agent loop FSM + cancellation).
+ * Dispatch FSM — Sprint Phase 1 (agent loop FSM + cancellation).
  *
  * Tracks the lifecycle of a single operator-issued brief from the moment
  * `POST /api/pugi/sessions/:id/brief` fires until the persona returns a
@@ -10,16 +10,16 @@
  *
  * State graph:
  *
- *      idle
- *       │ (brief posted)
- *       ▼
- *   awaiting_response ←──────────┐
- *       │                        │ (next turn)
- *       ▼                        │
- *   tool_running ────────────────┘
- *       │
- *       ▼
- *   completed
+ *     idle
+ *      │ (brief posted)
+ *      ▼
+ *  awaiting_response ←──────────┐
+ *      │                       │ (next turn)
+ *      ▼                       │
+ *  tool_running ────────────────┘
+ *      │
+ *      ▼
+ *  completed
  *
  * Terminal states: `completed`, `failed`, `aborted`. The FSM does not
  * transition out of a terminal state; a fresh brief mints a new FSM
@@ -143,7 +143,7 @@ export class DispatchFSM {
         }
         this.firing = true;
         try {
-            // R2 P2 fix (Codex triple-review 2026-05-25): if `commit` throws -
+            // R2 P2 fix (Codex triple-review): if `commit` throws -
             // either the first move or any queued nested move - we MUST flush
             // the pending queue before propagating the error. Otherwise a
             // later `transition()` call would drain stale entries left over

package/dist/core/repl/history-search.js

@@ -1,5 +1,5 @@
 /**
- * FZF-style history search - Sprint α6.14.
+ * FZF-style history search - Sprint .
  *
  * Powers the Ctrl+R (reverse) / Ctrl+S (forward) interactive search
  * mode in the REPL input box. Hand-rolled scorer (no dep) tuned for
@@ -8,14 +8,14 @@
  *
  * Scoring model (mirrors fzf v2 mid-priorities, simplified):
  *
- *   - Substring match required. Non-matching candidates score 0.
- *   - Prefix match: +50
- *   - Word-boundary start (' ', '/', '-', '_'): +20
- *   - Camel boundary (`abcD` → 'D'): +10
- *   - Contiguous run bonus: +5 per consecutive char after the first
- *   - Distance penalty: -1 per gap char between query characters
- *   - Recency bonus: +0.5 × (recencyRank / total) so newer entries
- *     break ties in the operator's favour
+ *  - Substring match required. Non-matching candidates score 0.
+ *  - Prefix match: +50
+ *  - Word-boundary start (' ', '/', '-', '_'): +20
+ *  - Camel boundary (`abcD` → 'D'): +10
+ *  - Contiguous run bonus: +5 per consecutive char after the first
+ *  - Distance penalty: -1 per gap char between query characters
+ *  - Recency bonus: +0.5 × (recencyRank / total) so newer entries
+ *    break ties in the operator's favour
  *
  * The result is a list of matches ordered by descending score with
  * the matched character positions preserved so the UI can highlight
@@ -23,12 +23,12 @@
  * or backward (Ctrl+S) modulo the result length.
  *
  * Contract:
- *   - `searchHistory(query, entries, options)` is pure. No I/O.
- *   - Empty query returns ALL entries newest-first so the operator
- *     can browse without typing.
- *   - Matching is case-insensitive on ASCII; non-ASCII characters
- *     compare as-is.
- *   - `cycle(state, direction)` is a no-op when there are no matches.
+ *  - `searchHistory(query, entries, options)` is pure. No I/O.
+ *  - Empty query returns ALL entries newest-first so the operator
+ *    can browse without typing.
+ *  - Matching is case-insensitive on ASCII; non-ASCII characters
+ *    compare as-is.
+ *  - `cycle(state, direction)` is a no-op when there are no matches.
  */
 const DEFAULT_LIMIT = 50;
 const WORD_BOUNDARIES = new Set([' ', '/', '-', '_', '.', ',', ':', ';', '\t']);

package/dist/core/repl/history.js

@@ -1,5 +1,5 @@
 /**
- * Persistent REPL history (per-workspace) - Sprint α6.14.
+ * Persistent REPL history (per-workspace) - Sprint .
  *
  * Stores submitted briefs in `~/.pugi/history/<workspace-slug>.jsonl`,
  * one JSON object per line. The format is line-delimited JSON so the
@@ -11,26 +11,27 @@
  *
  * Contract:
  *
- *   - `append({ home, workspaceSlug, brief })` writes one line. Dedups
- *     a brief that is identical to the immediately preceding entry
- *     (most common operator pattern: Up + Enter to re-run).
- *   - `read({ home, workspaceSlug })` returns entries oldest-first so
- *     the caller can navigate with `index = entries.length - 1` for
- *     "most recent" semantics.
- *   - The file is capped at MAX_ENTRIES; on overflow we keep the most
- *     recent slice and rewrite. Cheap because briefs are short text
- *     and the cap is 1000.
- *   - `slugForCwd(cwd)` normalises a working directory into a safe
- *     filename component (alphanumerics + `-`, lowercase, slashes
- *     collapsed). Empty cwd resolves to `default`.
- *   - Failures (missing $HOME, disk full, EACCES) NEVER throw. History
- *     is operator comfort, not a contract surface; degrading to "no
- *     history this session" is correct.
+ *  - `append({ home, workspaceSlug, brief })` writes one line. Dedups
+ *    a brief that is identical to the immediately preceding entry
+ *    (most common operator pattern: Up + Enter to re-run).
+ *  - `read({ home, workspaceSlug })` returns entries oldest-first so
+ *    the caller can navigate with `index = entries.length - 1` for
+ *    "most recent" semantics.
+ *  - The file is capped at MAX_ENTRIES; on overflow we keep the most
+ *    recent slice and rewrite. Cheap because briefs are short text
+ *    and the cap is 1000.
+ *  - `slugForCwd(cwd)` normalises a working directory into a safe
+ *    filename component (alphanumerics + `-`, lowercase, slashes
+ *    collapsed). Empty cwd resolves to `default`.
+ *  - Failures (missing $HOME, disk full, EACCES) NEVER throw. History
+ *    is operator comfort, not a contract surface; degrading to "no
+ *    history this session" is correct.
  *
  * Brand voice: file is operator-facing if they `cat` it, so the JSON
  * keys stay readable English (`brief`, `ts`). No forbidden words.
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync, appendFileSync, renameSync, unlinkSync, } from 'node:fs';
+import { randomBytes } from 'node:crypto';
 import { homedir } from 'node:os';
 import { dirname, join } from 'node:path';
 /** Cap on stored entries per workspace. Drops oldest on overflow. */
@@ -74,10 +75,19 @@ export function append(input) {
     // half-written file or race a parallel appendFileSync into oblivion.
     // POSIX renameSync is atomic within a directory; on Windows fs.rename
     // is atomic too as long as both paths are on the same volume (the tmp
-    // sibling guarantees that). P2 fix from PR #335 triple-review.
+    // sibling guarantees that). P2 fix from PR triple-review.
     if (existing.length + 1 > MAX_HISTORY_ENTRIES) {
         const trimmed = [...existing.slice(existing.length + 1 - MAX_HISTORY_ENTRIES), entry];
-        const tmpPath = `${path}.tmp`;
+        // β1b #52 : unique-per-call tmp suffix.
+        // Previous form was a fixed `${path}.tmp`, which means two CLI
+        // processes hitting the overflow rewrite at the same moment race
+        // on the same sibling file. Whichever writeFileSync lands second
+        // can corrupt the renameSync target's content (one process's
+        // serialized buffer overwrites the other mid-flight). Append a
+        // pid + monotonic-ish timestamp + 8 hex random bytes so the tmp
+        // names are collision-proof across PIDs, concurrent calls inside
+        // one PID, and rapid re-runs that share the same ms timestamp.
+        const tmpPath = `${path}.${process.pid}.${Date.now()}.${randomBytes(4).toString('hex')}.tmp`;
         try {
             writeFileSync(tmpPath, trimmed.map(serialize).join('\n') + '\n', { mode: 0o600 });
             renameSync(tmpPath, path);

package/dist/core/repl/kill-ring.js

@@ -1,12 +1,12 @@
 /**
- * Kill ring for the REPL input - Sprint α6.14.
+ * Kill ring for the REPL input - Sprint .
  *
  * Tiny LIFO buffer that backs the readline-style kill commands:
  *
- *   Ctrl+U  - kill from cursor to line start
- *   Ctrl+K  - kill from cursor to line end
- *   Ctrl+W  - kill word backwards (whitespace + punctuation delimiter)
- *   Ctrl+Y  - yank the most recent kill at the cursor
+ *  Ctrl+U - kill from cursor to line start
+ *  Ctrl+K - kill from cursor to line end
+ *  Ctrl+W - kill word backwards (whitespace + punctuation delimiter)
+ *  Ctrl+Y - yank the most recent kill at the cursor
  *
  * The ring is bounded (MAX_RING_ENTRIES = 10) so the operator's
  * recent kills are reachable without leaking memory across long

package/dist/core/repl/model-pricing.js

@@ -0,0 +1,135 @@
+/**
+ * Static price ladder keyed by exact model slug.
+ *
+ * Source: provider list-price pages as of. Keep prefix lookup
+ * (`priceForModel`) for forward compat — a `claude-opus-4-8` from a future
+ * model-router rebind falls back onto the `claude-opus-` family entry.
+ */
+const PRICE_LADDER = new Map([
+    // Anthropic Claude family
+    ['claude-opus-4-7', { inputUsdPerM: 15.0, outputUsdPerM: 75.0 }],
+    ['claude-opus-4-6', { inputUsdPerM: 15.0, outputUsdPerM: 75.0 }],
+    ['claude-sonnet-4-6', { inputUsdPerM: 3.0, outputUsdPerM: 15.0 }],
+    ['claude-sonnet-4-5', { inputUsdPerM: 3.0, outputUsdPerM: 15.0 }],
+    ['claude-haiku-4-5', { inputUsdPerM: 0.8, outputUsdPerM: 4.0 }],
+    // OpenAI family — sentinel entries so a `pugi config set` override lands clean.
+    ['gpt-4o', { inputUsdPerM: 2.5, outputUsdPerM: 10.0 }],
+    ['gpt-4o-mini', { inputUsdPerM: 0.15, outputUsdPerM: 0.6 }],
+    ['o3', { inputUsdPerM: 10.0, outputUsdPerM: 40.0 }],
+    ['o3-mini', { inputUsdPerM: 1.1, outputUsdPerM: 4.4 }],
+    // Mistral
+    ['mistral-large', { inputUsdPerM: 2.0, outputUsdPerM: 6.0 }],
+    ['mistral-small', { inputUsdPerM: 0.2, outputUsdPerM: 0.6 }],
+    // Embeddings — input-only; output is zero so the meter shows a
+    // flat per-call cost without inflating the "output" column.
+    ['voyage-3', { inputUsdPerM: 0.12, outputUsdPerM: 0 }],
+    ['voyage-3-large', { inputUsdPerM: 0.18, outputUsdPerM: 0 }],
+]);
+/**
+ * Family-prefix fallback. Used when an unknown slug starts with a
+ * known family stem (e.g. `claude-sonnet-4-7`).
+ */
+const FAMILY_PREFIX = [
+    ['claude-opus-', { inputUsdPerM: 15.0, outputUsdPerM: 75.0 }],
+    ['claude-sonnet-', { inputUsdPerM: 3.0, outputUsdPerM: 15.0 }],
+    ['claude-haiku-', { inputUsdPerM: 0.8, outputUsdPerM: 4.0 }],
+    ['gpt-4o', { inputUsdPerM: 2.5, outputUsdPerM: 10.0 }],
+    ['o3', { inputUsdPerM: 10.0, outputUsdPerM: 40.0 }],
+    ['mistral-', { inputUsdPerM: 2.0, outputUsdPerM: 6.0 }],
+    ['voyage-', { inputUsdPerM: 0.12, outputUsdPerM: 0 }],
+];
+/**
+ * Default ladder when no model slug is known (e.g. the older admin-api
+ * still on the pre- event shape that does not carry `model`). Pinned
+ * to Sonnet-tier so the meter is "honestly conservative" — close to the
+ * default dispatch lane for `reason` + `codegen` tags.
+ */
+const DEFAULT_PRICE = { inputUsdPerM: 3.0, outputUsdPerM: 15.0 };
+/**
+ * Look up the price for a model slug. Resolution order:
+ *  1. Exact match in `PRICE_LADDER`.
+ *  2. Family-prefix match (`startsWith`).
+ *  3. Default Sonnet-tier rate.
+ *
+ * Pure — never throws. The cost meter calls this on every `agent.tokens`
+ * frame so it must stay branch-cheap.
+ */
+export function priceForModel(model) {
+    if (!model || typeof model !== 'string')
+        return DEFAULT_PRICE;
+    const exact = PRICE_LADDER.get(model);
+    if (exact)
+        return exact;
+    for (const [prefix, price] of FAMILY_PREFIX) {
+        if (model.startsWith(prefix))
+            return price;
+    }
+    return DEFAULT_PRICE;
+}
+/**
+ * Compute the USD cost for a single (input, output, model) triple.
+ * Returns a finite number, never NaN/Infinity, capped at zero floor so
+ * a buggy upstream that emits negative deltas (theoretically impossible
+ * via Anvil but we stay defensive) does not credit the operator's meter.
+ *
+ * Pure, deterministic, branch-cheap — called on every `agent.tokens`
+ * event so the hot path keeps the math inline.
+ */
+export function computeCostUsd(tokensIn, tokensOut, model) {
+    const price = priceForModel(model);
+    const safeIn = Number.isFinite(tokensIn) && tokensIn > 0 ? tokensIn : 0;
+    const safeOut = Number.isFinite(tokensOut) && tokensOut > 0 ? tokensOut : 0;
+    const usd = (safeIn * price.inputUsdPerM + safeOut * price.outputUsdPerM) / 1_000_000;
+    return Number.isFinite(usd) && usd > 0 ? usd : 0;
+}
+/**
+ * Format a token count for the status row. Spec (CEO):
+ *  - `<1000` → raw integer (e.g. `42`)
+ *  - `≥1000` → one-decimal `k` (e.g. `1.2k`)
+ *  - `≥1_000_000` → one-decimal `m` (e.g. `1.0m`)
+ *
+ * Negative / NaN inputs render as `0`.
+ */
+export function formatTokens(value) {
+    if (!Number.isFinite(value) || value <= 0)
+        return '0';
+    if (value < 1_000)
+        return Math.floor(value).toString();
+    if (value < 1_000_000)
+        return `${(value / 1_000).toFixed(1)}k`;
+    return `${(value / 1_000_000).toFixed(1)}m`;
+}
+/**
+ * Format USD cost for the status row. Spec (CEO):
+ *  - `≥ $0.01` → `$X.XX` (two decimals)
+ *  - `< $0.01` (but > 0) → `$X.XXX` (three decimals, shows fractions
+ *    of a cent honestly instead of rounding to `$0.00`)
+ *  - `0` / NaN → `$0.00`
+ */
+export function formatCostUsd(usd) {
+    if (!Number.isFinite(usd) || usd <= 0)
+        return '$0.00';
+    if (usd >= 0.01)
+        return `$${usd.toFixed(2)}`;
+    return `$${usd.toFixed(3)}`;
+}
+/**
+ * Format an elapsed-ms duration as `1m2s` / `45s` / `2h3m`. Used by the
+ * status row's session-duration slot. Floors aggressively — we don't
+ * want sub-second decimals stealing column width.
+ */
+export function formatDuration(elapsedMs) {
+    if (!Number.isFinite(elapsedMs) || elapsedMs <= 0)
+        return '0s';
+    const totalSec = Math.floor(elapsedMs / 1000);
+    if (totalSec < 60)
+        return `${totalSec}s`;
+    const min = Math.floor(totalSec / 60);
+    const sec = totalSec % 60;
+    if (min < 60)
+        return `${min}m${sec.toString().padStart(2, '0')}s`;
+    const hr = Math.floor(min / 60);
+    const restMin = min % 60;
+    return `${hr}h${restMin.toString().padStart(2, '0')}m`;
+}
+//# sourceMappingURL=model-pricing.js.map

package/dist/core/repl/privacy-banner.js

@@ -3,15 +3,15 @@
  *
  * Two surfaces:
  *
- *   1. `renderPrivacyBanner(mode)` - one-line banner shown on REPL
- *      bootstrap (mirrors `apps/admin-api/src/privacy/privacy-mode.ts`
- *      `PRIVACY_MODE_BANNER` verbatim - keep in sync, the unit spec
- *      asserts they match).
+ *  1. `renderPrivacyBanner(mode)` - one-line banner shown on REPL
+ *     bootstrap (mirrors `apps/admin-api/src/privacy/privacy-mode.ts`
+ *     `PRIVACY_MODE_BANNER` verbatim - keep in sync, the unit spec
+ *     asserts they match).
  *
- *   2. `renderPrivacyContractDoc(mode)` - multi-line contract doc the
- *      `/privacy` slash command prints. Shows the active mode header
- *      + the full 3-mode contract so the operator can compare their
- *      current posture to the alternatives without leaving the REPL.
+ *  2. `renderPrivacyContractDoc(mode)` - multi-line contract doc the
+ *     `/privacy` slash command prints. Shows the active mode header
+ *     + the full 3-mode contract so the operator can compare their
+ *     current posture to the alternatives without leaving the REPL.
  *
  * The strings are pinned client-side so the contract doc is
  * available even when the operator is offline / has not authenticated
@@ -46,22 +46,22 @@ export function renderPrivacyBanner(mode) {
 const CONTRACT_DOC = `
 Pugi privacy mode contract (alpha 6.13):
 
-  strict      Maximum privacy. Nothing leaves tenant infra.
-              - Upstream LLM calls REFUSED (use self-hosted Ollama / llama.cpp).
-              - External tool calls require per-call confirm.
-              - Session.db, blobs, transcripts stay on operator disk.
-              - No telemetry. No error reporting.
+ strict     Maximum privacy. Nothing leaves tenant infra.
+             - Upstream LLM calls REFUSED (use self-hosted Ollama / llama.cpp).
+             - External tool calls require per-call confirm.
+             - Session.db, blobs, transcripts stay on operator disk.
+             - No telemetry. No error reporting.
 
-  balanced    Default. PII-scrubbed content goes to the upstream LLM.
-              - 3-layer PII scrubber runs before egress (regex + NER + LLM).
-              - Tool calls to external services allowed (logged).
-              - Anonymized telemetry only (counts + error categories).
+ balanced   Default. PII-scrubbed content goes to the upstream LLM.
+             - 3-layer PII scrubber runs before egress (regex + NER + LLM).
+             - Tool calls to external services allowed (logged).
+             - Anonymized telemetry only (counts + error categories).
 
-  permissive  Verbatim. Power-user mode.
-              - Raw prompts forwarded to upstream provider (no scrubbing).
-              - Tool calls to external services allowed.
-              - Full error reporting (may include prompt fragments).
-              - Accepts the upstream provider's data retention policy.
+ permissive Verbatim. Power-user mode.
+             - Raw prompts forwarded to upstream provider (no scrubbing).
+             - Tool calls to external services allowed.
+             - Full error reporting (may include prompt fragments).
+             - Accepts the upstream provider's data retention policy.
 
 Switch with: pugi config set privacy=strict|balanced|permissive
 `.trim();