@pugi/cli 0.1.0-beta.8 → 0.1.0-beta.87

package/dist/runtime/commands/codegraph-status.js

@@ -0,0 +1,227 @@
+/**
+ * `/codegraph-status` runner —  .
+ *
+ * Single source of truth for the codegraph adoption + index-freshness
+ * surface. Used by:
+ *
+ *  - REPL slash `/codegraph-status` (the discoverable surface)
+ *  - REPL slash `/codegraph`       (short alias)
+ *
+ * The runner is intentionally narrow — every information surface
+ * (installed? / index age / symbol count / last reindex / refresh CTA)
+ * is computed from the workspace-local `.pugi/codegraph-decision.json`
+ * + the live `.pugi/mcp.json` + the bounded scanner at
+ * `core/codegraph/detect-repo.ts`. NO network round-trip; everything
+ * runs offline so an air-gapped operator still gets the status table.
+ *
+ * Flags:
+ *  --install — merge codegraph into .pugi/mcp.json (accept decision)
+ *  --reindex — stamp lastIndexedAt now + hint operator к run
+ *              `codegraph index` from a fresh shell. Pugi does NOT
+ *              spawn codegraph itself (no upstream dep guarantee).
+ *  --offer  — surface the install prompt even after a decline,
+ *              useful when the operator declined three weeks ago and
+ *              wants to revisit без waiting for the 30-day cadence.
+ *
+ * Brand voice gate: ASCII output, no emoji, no decorative dividers.
+ */
+import { resolve } from 'node:path';
+import { detectRepo } from '../../core/codegraph/detect-repo.js';
+import { detectCodegraphInstalled, CODEGRAPH_DOCS_URL, } from '../../core/codegraph/install.js';
+import { readDecision, markIndexed, indexAgeDays, STALE_INDEX_DAYS, } from '../../core/codegraph/decision-store.js';
+import { evaluateOffer, applyOfferDecision, emitOfferShown, } from '../../core/codegraph/offer-hook.js';
+export function parseCodegraphStatusArgs(args) {
+    const out = {
+        install: false,
+        reindex: false,
+        offer: false,
+        unknown: null,
+    };
+    for (const arg of args) {
+        switch (arg) {
+            case '--install':
+            case '-i':
+                out.install = true;
+                break;
+            case '--reindex':
+            case '-r':
+                out.reindex = true;
+                break;
+            case '--offer':
+            case '-o':
+                out.offer = true;
+                break;
+            default:
+                out.unknown = arg;
+                return out;
+        }
+    }
+    return out;
+}
+/**
+ * Render the status table. Pure copy assembly — separates rendering
+ * from side effects so spec callers can pin the exact layout.
+ */
+export function renderStatusLines(input) {
+    const lines = ['Codegraph status:', ''];
+    lines.push(` Installed:       ${input.installed ? 'yes' : 'no'}`);
+    if (input.installed) {
+        lines.push(` Trust state:     ${input.trust ?? 'pending'}`);
+        lines.push(` Config path:     ${input.configPath}`);
+    }
+    if (input.primarySymbolCount !== null) {
+        lines.push(` Symbol count:    ~${input.primarySymbolCount} source files`);
+    }
+    if (input.languages && input.languages.length > 0) {
+        lines.push(` Languages:       ${input.languages.join(', ')}`);
+    }
+    if (input.sizeCategory) {
+        lines.push(` Size category:   ${input.sizeCategory}`);
+    }
+    if (input.installed) {
+        if (input.lastIndexedAt) {
+            lines.push(` Last indexed:    ${input.lastIndexedAt}${input.ageDays !== null ? ` (${input.ageDays} day${input.ageDays === 1 ? '' : 's'} ago)` : ''}`);
+        }
+        else {
+            lines.push(' Last indexed:    never recorded — run `codegraph index` and `/codegraph-status --reindex`');
+        }
+        if (input.staleNudge) {
+            lines.push('');
+            lines.push(` Index is ${input.ageDays} day${input.ageDays === 1 ? '' : 's'} old (threshold ${STALE_INDEX_DAYS}). ` +
+                'Run `codegraph index` then `/codegraph-status --reindex` to refresh.');
+        }
+    }
+    else {
+        lines.push('');
+        lines.push(` Docs: ${CODEGRAPH_DOCS_URL}`);
+        lines.push(' Install via `/codegraph-status --install` OR `pugi mcp install codegraph codegraph serve --mcp`.');
+    }
+    return lines;
+}
+/**
+ * Single entry-point used by the slash dispatch + (future) standalone
+ * `pugi codegraph status` shell command. Pure orchestration — every
+ * side effect lives behind one of the flag branches.
+ */
+export async function runCodegraphStatusCommand(args, ctx) {
+    const flags = parseCodegraphStatusArgs(args);
+    if (flags.unknown) {
+        ctx.writeOutput({ command: 'codegraph-status', error: 'unknown-flag', flag: flags.unknown }, `/codegraph-status: unknown flag "${flags.unknown}". Allowed: --install, --reindex, --offer.`);
+        return;
+    }
+    const workspaceRoot = resolve(ctx.workspaceRoot);
+    // --reindex — stamp lastIndexedAt + remind the operator how to actually
+    // refresh the index. We do NOT spawn `codegraph index` — that is the
+    // operator's call (upstream codegraph may or may not be installed; we
+    // refuse to silently spawn a binary we did not vet).
+    if (flags.reindex) {
+        const decision = markIndexed(workspaceRoot);
+        if (!decision) {
+            ctx.writeOutput({ command: 'codegraph-status', error: 'no-decision' }, '/codegraph-status --reindex: no decision recorded yet. Accept the install first via `--install`.');
+            return;
+        }
+        ctx.writeOutput({ command: 'codegraph-status', reindexed: true, lastIndexedAt: decision.lastIndexedAt }, [
+            `Codegraph index timestamp updated to ${decision.lastIndexedAt}.`,
+            'Run `codegraph index` from a fresh shell to actually rebuild the SQLite cache.',
+        ].join('\n'));
+        return;
+    }
+    // --install / --offer — surface the install prompt OR accept it
+    // directly. `--install` skips the prompt + writes the entry; `--offer`
+    // renders the prompt copy even after a decline (operator-initiated
+    // revisit). The two are mutually exclusive at runtime — `--install`
+    // wins when both are set.
+    if (flags.install || flags.offer) {
+        const evaluation = evaluateOffer({
+            workspaceRoot,
+            ...(ctx.nowIso ? { nowIso: ctx.nowIso } : {}),
+            ignorePriorDecision: flags.offer,
+        });
+        if (!evaluation.shouldPrompt) {
+            const detection = detectRepo(workspaceRoot);
+            // Already-installed is the success path for `--install`; treat
+            // it as PASS rather than ERROR so a re-run is idempotent.
+            if (evaluation.reason === 'already-installed') {
+                ctx.writeOutput({ command: 'codegraph-status', alreadyInstalled: true }, 'Codegraph is already declared in .pugi/mcp.json. Run `pugi mcp trust codegraph` if not yet trusted.');
+                return;
+            }
+            ctx.writeOutput({ command: 'codegraph-status', skipped: true, reason: evaluation.reason }, `/codegraph-status --${flags.install ? 'install' : 'offer'}: nothing to do (${evaluation.reason}).` +
+                (detection.isRepo
+                    ? ` Repo: ${detection.sizeCategory}, ${detection.primarySymbolCount} src files.`
+                    : ''));
+            return;
+        }
+        if (flags.install) {
+            const result = applyOfferDecision({
+                workspaceRoot,
+                accepted: true,
+                detection: evaluation.detection,
+                ...(ctx.nowIso ? { nowIso: ctx.nowIso } : {}),
+            });
+            if (result.kind === 'declined') {
+                // Defensive — applyOfferDecision with accepted=true cannot
+                // surface a `declined` verdict by construction. We still
+                // narrow the union so TS understands the safe path below.
+                ctx.writeOutput({ command: 'codegraph-status', installFailed: true, reason: 'unexpected-decline' }, '/codegraph-status --install: install path returned a decline verdict (internal bug).');
+                return;
+            }
+            if (result.kind === 'accepted-install-failed') {
+                ctx.writeOutput({ command: 'codegraph-status', installFailed: true, reason: result.install.reason }, `/codegraph-status --install failed: ${result.install.reason}`);
+                return;
+            }
+            ctx.writeOutput({
+                command: 'codegraph-status',
+                installed: true,
+                configPath: result.install.status === 'installed' ? result.install.configPath : null,
+                docsUrl: result.docsUrl,
+                trustCommand: result.trustCommand,
+            }, [
+                result.install.status === 'installed'
+                    ? `Codegraph added к .pugi/mcp.json. Trust gate: ${result.trustCommand}`
+                    : 'Codegraph already declared. Trust gate: ' + result.trustCommand,
+                `Docs: ${result.docsUrl}`,
+            ].join('\n'));
+            return;
+        }
+        // --offer path — surface the copy but do not install yet
+        emitOfferShown(evaluation.detection);
+        ctx.writeOutput({
+            command: 'codegraph-status',
+            offered: true,
+            copy: evaluation.promptCopy,
+            docsUrl: evaluation.docsUrl,
+        }, [
+            evaluation.promptCopy,
+            `Docs: ${evaluation.docsUrl}`,
+            'Accept: /codegraph-status --install',
+            'Decline: do nothing (the prompt re-appears in 30 days).',
+        ].join('\n'));
+        return;
+    }
+    // Bare invocation — render the status table.
+    const installed = detectCodegraphInstalled(workspaceRoot);
+    const detection = detectRepo(workspaceRoot);
+    const decision = readDecision(workspaceRoot);
+    const ageDays = decision ? indexAgeDays(decision, ctx.nowIso) : null;
+    const lines = renderStatusLines({
+        installed: installed.installed,
+        trust: installed.trust,
+        configPath: installed.configPath,
+        ageDays,
+        primarySymbolCount: detection.isRepo ? detection.primarySymbolCount : null,
+        languages: detection.isRepo ? detection.languages : null,
+        sizeCategory: detection.isRepo ? detection.sizeCategory : null,
+        lastIndexedAt: decision?.lastIndexedAt ?? null,
+        staleNudge: ageDays !== null && ageDays >= STALE_INDEX_DAYS,
+    });
+    ctx.writeOutput({
+        command: 'codegraph-status',
+        installed: installed.installed,
+        trust: installed.trust,
+        configPath: installed.configPath,
+        detection,
+        decision,
+        ageDays,
+    }, lines.join('\n'));
+}
+//# sourceMappingURL=codegraph-status.js.map

package/dist/runtime/commands/compact.js

@@ -0,0 +1,297 @@
+/**
+ * `pugi compact` — top-level command + companion to the REPL slash.
+ *
+ * Summarises older events from the most recent SessionStore session
+ * into a single boundary marker, freeing context budget for the next
+ * REPL session that resumes the same id.
+ *
+ * Wire: writeOutput contract matches every other dispatch in cli.ts
+ * (one structured payload + one human line). Exit code:
+ *  0 — boundary marker appended
+ *  1 — summarizer transport failed / store unavailable
+ *  2 — no events to compact / nothing to do
+ *
+ * The companion REPL slash dispatches through this same runner so the
+ * surface stays single-sourced.
+ */
+import { homedir } from 'node:os';
+import { loadRuntimeConfig } from '@pugi/sdk';
+import { AnvilEngineLoopClient } from '../../core/engine/anvil-client.js';
+import { SqliteSessionStore, resolveProjectStoreDir, } from '../../core/repl/store/session-store.js';
+import { appendCompactBoundary, isCompactBoundary, } from '../../core/compact/buffer-rewriter.js';
+import { summarizeEvents, SummarizerError } from '../../core/compact/summarizer.js';
+/** Number of tail turns preserved verbatim on every compaction. */
+export const KEPT_TAIL_TURNS = 5;
+/** Minimum source events before we accept a compaction. */
+const MIN_EVENTS_TO_COMPACT = 6;
+/**
+ * Entry point reused by the slash command + the top-level dispatcher.
+ *
+ * The function is exhaustive: every early-exit branch produces a
+ * structured `CompactCommandResult` for the JSON path AND a one-line
+ * human message for the TTY path. Tests assert on the returned shape;
+ * the top-level dispatcher forwards it to `writeOutput`.
+ */
+export async function runCompactCommand(_args, ctx) {
+    const trigger = ctx.trigger ?? 'manual';
+    // Resolve the target session id. When the caller supplied a store
+    // (REPL slash path, tests) we trust it has the session bound; the
+    // standalone CLI path needs to discover the most-recent id via the
+    // read-only view + then open the live store on that id.
+    let store = ctx.store ?? null;
+    let sessionId = ctx.sessionId ?? null;
+    if (store === null) {
+        sessionId = sessionId ?? (await pickMostRecentSessionIdReadOnly(ctx.workspaceRoot));
+        if (!sessionId) {
+            return emit(ctx, {
+                command: 'compact',
+                status: 'failed_no_session',
+                trigger,
+                reason: 'No active session to compact. Start a REPL with `pugi`.',
+            });
+        }
+        store = await openStoreForCwd(ctx.workspaceRoot, sessionId);
+        if (!store) {
+            return emit(ctx, {
+                command: 'compact',
+                status: 'failed_no_session',
+                trigger,
+                reason: 'Local session store unavailable (lock held by REPL?).',
+            });
+        }
+    }
+    else if (sessionId === null) {
+        // Caller supplied a store but no session id — try to discover one.
+        sessionId = await pickMostRecentSessionId(store, ctx.workspaceRoot);
+        if (!sessionId) {
+            return emit(ctx, {
+                command: 'compact',
+                status: 'failed_no_session',
+                trigger,
+                reason: 'No active session to compact.',
+            });
+        }
+    }
+    // Snapshot the events. We pass `coversUntilOffset` as the count of
+    // events at the moment of the snapshot so the marker's anchor is
+    // accurate even if other writers race afterwards.
+    let events;
+    try {
+        events = await store.loadEvents(sessionId);
+    }
+    catch (error) {
+        return emit(ctx, {
+            command: 'compact',
+            status: 'failed_store',
+            sessionId,
+            trigger,
+            reason: `Could not load events: ${errMsg(error)}`,
+        });
+    }
+    if (events.length < MIN_EVENTS_TO_COMPACT && ctx.force !== true) {
+        return emit(ctx, {
+            command: 'compact',
+            status: 'noop_empty',
+            sessionId,
+            trigger,
+            reason: `Only ${events.length} events on disk; need at least ${MIN_EVENTS_TO_COMPACT}. `
+                + 'Pass --force to compact anyway.',
+        });
+    }
+    // Locate the source slice: everything strictly after the latest
+    // compact-boundary, EXCLUDING the kept-tail window. If no prior
+    // boundary exists, walk from offset 0.
+    const lastBoundaryIdx = findLastCompactBoundaryIndex(events);
+    const sliceStart = lastBoundaryIdx === -1 ? 0 : lastBoundaryIdx + 1;
+    const sliceEnd = Math.max(sliceStart, events.length - KEPT_TAIL_TURNS);
+    const sourceSlice = events.slice(sliceStart, sliceEnd);
+    if (sourceSlice.length === 0) {
+        return emit(ctx, {
+            command: 'compact',
+            status: 'noop_recent_marker',
+            sessionId,
+            trigger,
+            reason: 'Conversation already compact — nothing new to fold.',
+        });
+    }
+    // Build the engine client. Production uses Anvil; tests inject a
+    // fixture client to avoid the network round-trip.
+    const engineClient = ctx.engineClient ?? buildAnvilClient();
+    if (!engineClient) {
+        return emit(ctx, {
+            command: 'compact',
+            status: 'failed_transport',
+            sessionId,
+            trigger,
+            reason: 'Could not build engine client (run `pugi login`).',
+        });
+    }
+    // Run the summariser.
+    let summary;
+    try {
+        summary = await summarizeEvents({
+            events: sourceSlice,
+            client: engineClient,
+            personaSlug: 'mira',
+        });
+    }
+    catch (error) {
+        const code = error instanceof SummarizerError ? error.code : 'unknown';
+        const message = error instanceof Error ? error.message : String(error);
+        return emit(ctx, {
+            command: 'compact',
+            status: 'failed_transport',
+            sessionId,
+            trigger,
+            reason: `Summarizer failed (${code}): ${message}`,
+        });
+    }
+    // Append the boundary marker. Recompute `coversUntilOffset` AFTER
+    // the summariser round-trip so any events that landed mid-flight
+    // fall into the kept-tail window — the operator does not lose work
+    // that arrived during compaction. The next event we append (the
+    // marker itself) lands at index `coversUntilOffset` in the on-disk
+    // log.
+    let postRoundTripEvents;
+    try {
+        postRoundTripEvents = await store.loadEvents(sessionId);
+    }
+    catch (error) {
+        return emit(ctx, {
+            command: 'compact',
+            status: 'failed_store',
+            sessionId,
+            trigger,
+            reason: `Could not refresh events: ${errMsg(error)}`,
+        });
+    }
+    const coversUntilOffset = postRoundTripEvents.length;
+    try {
+        await appendCompactBoundary({
+            store,
+            trigger,
+            summary: summary.summary,
+            summaryTokenCount: summary.tokensSummarised,
+            summaryTurnsBefore: summary.eventsSummarised,
+            keptTailTurns: KEPT_TAIL_TURNS,
+            coversUntilOffset,
+            ...(ctx.now !== undefined ? { now: ctx.now } : {}),
+        });
+    }
+    catch (error) {
+        return emit(ctx, {
+            command: 'compact',
+            status: 'failed_store',
+            sessionId,
+            trigger,
+            reason: `Could not append marker: ${errMsg(error)}`,
+        });
+    }
+    return emit(ctx, {
+        command: 'compact',
+        status: 'compacted',
+        sessionId,
+        trigger,
+        turnsBefore: summary.eventsSummarised,
+        tailKept: KEPT_TAIL_TURNS,
+        tokensSummarised: summary.tokensSummarised,
+    }, `Compacted ${summary.eventsSummarised} events (~${summary.tokensSummarised} tokens) into 1 summary. ` +
+        `Last ${KEPT_TAIL_TURNS} turns kept verbatim.`);
+}
+/* ------------------------------------------------------------------ */
+/* Helpers                                                           */
+/* ------------------------------------------------------------------ */
+/**
+ * Emit a payload through the context and return it for the caller. We
+ * keep the function exhaustive so every branch lands on the same
+ * writeOutput contract (JSON-mode + text-mode).
+ */
+function emit(ctx, payload, text) {
+    const human = text ?? payload.reason ?? `compact: ${payload.status}`;
+    ctx.writeOutput(payload, human);
+    return payload;
+}
+function findLastCompactBoundaryIndex(events) {
+    for (let i = events.length - 1; i >= 0; i -= 1) {
+        if (isCompactBoundary(events[i]))
+            return i;
+    }
+    return -1;
+}
+function errMsg(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+/**
+ * Open the SqliteSessionStore for the workspace's project slug and
+ * bind the active log to `sessionId`. Returns null when the open
+ * fails (lock contention, IO error, missing project dir).
+ *
+ * The PID lockfile contention is the expected failure mode here — a
+ * running REPL holds the lock, and `pugi compact` from a second
+ * terminal cannot grab it. The caller surfaces a clear message rather
+ * than crashing the dispatch.
+ */
+async function openStoreForCwd(workspaceRoot, sessionId) {
+    try {
+        const slug = projectSlugForCwd(workspaceRoot);
+        const store = new SqliteSessionStore({ projectSlug: slug, home: homedir() });
+        await store.open({
+            id: sessionId,
+            workspaceRoot,
+            projectSlug: slug,
+        });
+        return store;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read-only-view variant of `pickMostRecentSessionId` for the
+ * pre-open phase. Walks `~/.pugi/projects/<slug>/session.db` without
+ * taking the lockfile so a live REPL in another terminal does not
+ * make discovery fail.
+ */
+async function pickMostRecentSessionIdReadOnly(workspaceRoot) {
+    try {
+        const slug = projectSlugForCwd(workspaceRoot);
+        const dir = resolveProjectStoreDir(slug, homedir());
+        const view = await SqliteSessionStore.openReadOnly(dir);
+        try {
+            const rows = await view.list({ project: slug, limit: 1, status: 'active' });
+            return rows.length > 0 ? rows[0].id : null;
+        }
+        finally {
+            await view.close();
+        }
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Locate the most recent active session for the workspace. Returns
+ * null when no session row exists.
+ */
+async function pickMostRecentSessionId(store, workspaceRoot) {
+    const slug = projectSlugForCwd(workspaceRoot);
+    const rows = await store.listSessions({ project: slug, limit: 1, status: 'active' });
+    if (rows.length === 0)
+        return null;
+    return rows[0].id;
+}
+function projectSlugForCwd(workspaceRoot) {
+    const base = workspaceRoot.split('/').filter((s) => s.length > 0).pop() ?? 'workspace';
+    return base.toLowerCase().replace(/[^a-z0-9-]/g, '-').slice(0, 64);
+}
+/**
+ * Construct an Anvil-backed engine client from env-resolved runtime
+ * config. Returns null when the operator is not authenticated.
+ */
+function buildAnvilClient() {
+    const config = loadRuntimeConfig();
+    if (!config)
+        return null;
+    return new AnvilEngineLoopClient(config);
+}
+//# sourceMappingURL=compact.js.map

package/dist/runtime/commands/config.js

@@ -11,21 +11,21 @@ import { resolveActiveCredential } from '../../core/credentials.js';
  * `pugi config` — operator-level configuration surface.
  *
  * Subcommands:
- *   - `pugi config get <key>`              read a value from `~/.pugi/config.json`
- *   - `pugi config set <key> <value>`      write a value
- *   - `pugi config list`                   dump all values
- *   - `pugi config trust .`                trust the current workspace (delegates to core/trust.ts)
- *   - `pugi config mcp trust <name>`       flip MCP server to trusted
- *   - `pugi config mcp deny <name>`        flip MCP server to denied
- *   - `pugi config mcp list`               show declared servers + their trust state
+ *  - `pugi config get <key>`             read a value from `~/.pugi/config.json`
+ *  - `pugi config set <key> <value>`     write a value
+ *  - `pugi config list`                  dump all values
+ *  - `pugi config trust .`               trust the current workspace (delegates to core/trust.ts)
+ *  - `pugi config mcp trust <name>`      flip MCP server to trusted
+ *  - `pugi config mcp deny <name>`       flip MCP server to denied
+ *  - `pugi config mcp list`              show declared servers + their trust state
  *
  * Schema (pugi-config-v1):
- *   {
- *     "permissionMode": "ask" | "acceptEdits" | "auto" | "plan" | "dontAsk" | "bypassPermissions",
- *     "privacy":        "local-only" | "metadata" | "full",
- *     "model":          "<id>" | null,
- *     "preferredEndpoint": "https://api.pugi.io"
- *   }
+ *  {
+ *    "permissionMode": "ask" | "acceptEdits" | "auto" | "plan" | "dontAsk" | "bypassPermissions",
+ *    "privacy":       "local-only" | "metadata" | "full",
+ *    "model":         "<id>" | null,
+ *    "preferredEndpoint": "https://api.pugi.io"
+ *  }
  *
  * The config file lives at `~/.pugi/config.json` (PUGI_HOME-aware) and uses
  * mode 0o600. Unknown keys are rejected by `set` so a typo never silently
@@ -63,18 +63,18 @@ export async function runConfigCommand(args, ctx) {
             ],
         }, [
             'Usage:',
-            '  pugi config get <key>                            Read a config value.',
-            '  pugi config set <key> <value>                    Write a config value.',
-            '  pugi config list                                 Show all config values.',
-            '  pugi config trust .                              Trust the current workspace for hooks + MCP.',
-            '  pugi config mcp trust <name>                     Mark an MCP server as trusted.',
-            '  pugi config mcp deny <name>                      Block an MCP server.',
-            '  pugi config mcp list                             Show declared MCP servers + trust state.',
-            '  pugi config get routing                          Show effective routing table (defaults + tenant overrides).',
-            '  pugi config set routing.<tag>.<budget>=<model>   Override the model for one (tag, budget) lane.',
-            '  pugi config unset routing.<tag>.<budget>         Remove a routing override (revert to default).',
-            '  pugi config get privacy                          Show current tenant privacy mode + last-flip metadata.',
-            '  pugi config set privacy=<mode>                   Flip privacy mode (strict | balanced | permissive).',
+            ' pugi config get <key>                           Read a config value.',
+            ' pugi config set <key> <value>                   Write a config value.',
+            ' pugi config list                                Show all config values.',
+            ' pugi config trust .                             Trust the current workspace for hooks + MCP.',
+            ' pugi config mcp trust <name>                    Mark an MCP server as trusted.',
+            ' pugi config mcp deny <name>                     Block an MCP server.',
+            ' pugi config mcp list                            Show declared MCP servers + trust state.',
+            ' pugi config get routing                         Show effective routing table (defaults + tenant overrides).',
+            ' pugi config set routing.<tag>.<budget>=<model>  Override the model for one (tag, budget) lane.',
+            ' pugi config unset routing.<tag>.<budget>        Remove a routing override (revert to default).',
+            ' pugi config get privacy                         Show current tenant privacy mode + last-flip metadata.',
+            ' pugi config set privacy=<mode>                  Flip privacy mode (strict | balanced | permissive).',
         ].join('\n'));
         return;
     }
@@ -108,7 +108,7 @@ export async function runConfigCommand(args, ctx) {
             // names. The unit spec for config.ts has a regression test for
             // both code paths.
             //
-            // Triple-review P2 fix (2026-05-25): the prior disambiguation
+            // Triple-review P2 fix : the prior disambiguation
             // only excluded the bare form (`privacy local-only`) - the `=`
             // form (`privacy=local-only`) still routed to runPrivacySet and
             // 4xx'd. We now check the value AFTER `=` and route legacy local
@@ -279,7 +279,7 @@ async function runConfigMcpList(ctx) {
     }
     ctx.writeOutput({ command: 'config.mcp.list', servers: declared, ledger }, [
         'MCP servers:',
-        ...declared.map((server) => `  ${server.name.padEnd(20)} ${server.trust.padEnd(8)} ${server.command} ${server.args.join(' ')}`),
+        ...declared.map((server) => ` ${server.name.padEnd(20)} ${server.trust.padEnd(8)} ${server.command} ${server.args.join(' ')}`),
     ].join('\n'));
 }
 async function runConfigMcpFlip(args, ctx, state) {
@@ -297,7 +297,7 @@ async function runConfigMcpFlip(args, ctx, state) {
         : `MCP server "${name}" is now denied.`);
 }
 /* ------------------------------------------------------------------ */
-/* α6.10 multi-model routing — config.routing.* subcommands            */
+/* multi-model routing — config.routing.* subcommands           */
 /* ------------------------------------------------------------------ */
 /**
  * Closed sets — match
@@ -360,7 +360,7 @@ async function runRoutingGet(ctx) {
     });
     const text = [
         'Routing table (effective = override | default):',
-        ...cells.map((cell) => `  routing.${cell.tag.padEnd(10)}.${cell.budgetHint.padEnd(3)} = ${cell.model.padEnd(28)} (${cell.source})`),
+        ...cells.map((cell) => ` routing.${cell.tag.padEnd(10)}.${cell.budgetHint.padEnd(3)} = ${cell.model.padEnd(28)} (${cell.source})`),
     ].join('\n');
     ctx.writeOutput({
         command: 'config.routing.get',
@@ -439,7 +439,7 @@ async function runRoutingUnset(args, ctx) {
         : `routing.${tag}.${budget} had no override (nothing to remove).`);
 }
 /* ------------------------------------------------------------------ */
-/* alpha 6.13 privacy 3-mode - config.privacy.* subcommands             */
+/* alpha 6.13 privacy 3-mode - config.privacy.* subcommands            */
 /* ------------------------------------------------------------------ */
 /**
  * Closed mirror of the server-side PRIVACY_MODES enum
@@ -459,7 +459,7 @@ function isPrivacyMode(value) {
  * Legacy local-config privacy values from before alpha 6.13. Kept so
  * `pugi config set privacy=local-only` continues to write to the local
  * config file (matching the bare-form behaviour). Triple-review P2 fix
- * (2026-05-25): the prior disambiguation only excluded the bare form;
+ * : the prior disambiguation only excluded the bare form;
  * the `=` form routed to runPrivacySet and 4xx'd on the unknown mode.
  */
 const LEGACY_LOCAL_PRIVACY_VALUES = [
@@ -536,7 +536,7 @@ async function runPrivacySet(args, ctx) {
  * — undici's `request` honours the global dispatcher reliably across the
  * pinned undici version. Kept local (not shared with `pugi whoami`) so
  * the routing surface is self-contained — extracting a common helper is
- * α6.10b cleanup once we see two callers.
+ * cleanup once we see two callers.
  */
 async function fetchJson(url, apiKey, options = {}) {
     const method = options.method ?? 'GET';