@vibe-commit/capture 0.1.0

package/dist/commands/status.js

@@ -0,0 +1,236 @@
+/**
+ * `vibecommit status` and `vibecommit off` — the screen, `CR-021`.
+ *
+ * Style guide §10.3 draws it and D65 makes that drawing the ruling, so this
+ * module renders it rather than designing it: four questions in fixed order
+ * (on for *this* repo? last successful send? where do I look? what do I type to
+ * fix it?), then the revoke link, on §13.5's `LABEL_GUTTER`.
+ *
+ * ## What is deliberately NOT on the screen
+ *
+ * §10.3's `last sent` row reads `4 minutes ago · 3 turns · seq 41`. **The turn
+ * count is not rendered and must not be.** Counting turns means parsing the
+ * transcript's NDJSON and deciding what a turn is, and that is the analysis the
+ * client is barred from holding — D60 §D6: *the client may render; it may not
+ * analyze, hash, or canonicalize*. The one recorded deviation is `CR-024d`'s
+ * redaction parse, authorised by name; there is no such authorisation here, and
+ * the server is the only thing holding sealed turns to count. The age and the
+ * `seq` are both facts this client already wrote down, so both render.
+ *
+ * ## Absence is not a blank
+ *
+ * When nothing has been delivered for this repo the row is OMITTED and
+ * `STATUS.neverSent` says so in a sentence. No sixth absence phrasing is
+ * invented here: `CR-112` (W8) owns the five-absence grammar as one set, and
+ * adding a variant now is what that task exists to prevent.
+ */
+import { COMMANDS, CREDENTIAL, ERRORS, OFF, STATUS, URLS, relativeAge } from "../copy/index.js";
+import { isProjectAllowed, revokeProject } from "../consent.js";
+import { loadCredential } from "../credential.js";
+import { EXIT } from "../exit.js";
+import { resolveRepoSlug } from "../git.js";
+import { emitJson } from "../json.js";
+import { resolveProjectKeys } from "../project.js";
+import { lastSendForRepo } from "../state.js";
+import { LABEL_GUTTER, WRAP_COLUMNS, glyph, labelled, paint, renderErrorBlock, truncatePath, wrap, } from "../term.js";
+import { writeLines } from "./context.js";
+/** §10.3 indents the gutter rows four columns under the state line. */
+const ROW_INDENT = 4;
+export function status(ctx, argv = []) {
+    // ⛔ THIS SCREEN USES BOTH ROLES AT ONCE (`D184 §1`), which is why the whole
+    // function is not flipped: `on` below is CONSENT STATE and keys on the git
+    // common dir, while the repo row, the send scan and the `--json` document are
+    // REPO IDENTITY and stay on the worktree toplevel. The `--json` field is
+    // literally named `toplevel`, so moving it would make the document lie.
+    const keys = resolveProjectKeys(ctx.cwd);
+    if (keys === null) {
+        writeLines(ctx.stderr, renderErrorBlock({ kind: "bad", what: ERRORS.notAGitRepo, why: [] }, ctx.colour));
+        return EXIT.failure;
+    }
+    const projectKey = keys.worktree;
+    // ⛔ CONSENT STATE, on the common dir. A worktree of a consented clone must
+    // report ON here, because the hook that runs there is now admitted — a
+    // `status` still keyed on the toplevel would tell that user they are
+    // disconnected while their session was being captured.
+    const on = isProjectAllowed(ctx.home, keys.consent);
+    const kind = on ? "ok" : "warn";
+    const lines = [
+        `  ${paint(ctx.colour, kind, glyph(ctx.colour, kind))} ${paint(ctx.colour, "strong", on ? STATUS.onForRepo : STATUS.offForRepo)}`,
+        labelled(ROW_INDENT, STATUS.repoLabel, repoValue(ctx, projectKey)),
+    ];
+    // Question 2: the last successful send FOR THIS REPO. `status` has no
+    // session_id — it is interactive — so this is a scan of the repo's session
+    // files rather than a lookup (`lastSendForRepo`).
+    const lastSend = lastSendForRepo(ctx.home, projectKey);
+    if (lastSend !== null) {
+        lines.push(labelled(ROW_INDENT, STATUS.lastSuccessLabel, STATUS.lastSuccessValue(relativeAge(lastSend.at, ctx.now().getTime()), lastSend.seq)));
+    }
+    lines.push(labelled(ROW_INDENT, STATUS.dashboardLabel, paint(ctx.colour, "accent", URLS.dashboard)));
+    const load = loadCredential({ env: ctx.env, home: ctx.home });
+    // §13.3 — `--json` emits NOTHING BUT the JSON document on stdout, so the
+    // screen assembled above is DISCARDED rather than printed beside it.
+    //
+    // The credential fault below still refuses, and it refuses the same way it
+    // does in prose: §13.6's block to stderr, nothing on stdout, exit 1. A failure
+    // is not an answer, so it gets no document — `src/json.ts`'s docblock states
+    // that split and why it is a builder's reading of §13.3 rather than a ruling.
+    //
+    // ⚠ `last_send` is `null` when nothing has been delivered, never a zeroed
+    // object: absence here is *nothing has been sent*, and a `{ at_ms: 0 }` would
+    // be a timestamp claim. §13.2's glyph rule has no glyph on this surface, so
+    // `outcome` carries the on/off distinction the glyph carries on screen.
+    if (argv.includes("--json")) {
+        if (load.kind !== "ok" && load.kind !== "absent") {
+            writeLines(ctx.stderr, credentialProblem(load, ctx.colour));
+            return EXIT.failure;
+        }
+        emitJson(ctx.stdout, "status", on ? "on" : "off", {
+            repo: resolveRepoSlug(projectKey),
+            toplevel: projectKey,
+            last_send: lastSend === null ? null : { at_ms: lastSend.at, seq: lastSend.seq },
+            dashboard: URLS.dashboard,
+        });
+        return on ? EXIT.ok : EXIT.notConnected;
+    }
+    if (load.kind !== "ok" && load.kind !== "absent") {
+        writeLines(ctx.stdout, lines);
+        writeLines(ctx.stderr, credentialProblem(load, ctx.colour));
+        return EXIT.failure;
+    }
+    // Absence is a SENTENCE, not a blank row. Triggered on the send record rather
+    // than on the credential: a repo that has delivered and then lost its
+    // credential has still recorded a session, and saying otherwise would be false.
+    if (on && lastSend === null)
+        lines.push("", ...wrap(STATUS.neverSent, 2));
+    lines.push("", ...actionLines(ctx, on));
+    writeLines(ctx.stdout, lines);
+    return on ? EXIT.ok : EXIT.notConnected;
+}
+/**
+ * §10.3's repo row: `owner/name (git toplevel ~/path)`.
+ *
+ * The slug is `CR-019d`'s — the same value that goes on the wire as
+ * `X-Repo-Slug` — so what `status` shows is what the server will resolve, which
+ * is the point of `status` being the debugging tool (D57 §DX1). A repo with no
+ * GitHub remote shows its `local:` identity rather than hiding it: that IS the
+ * answer to "why does the dashboard not show my repo under its name?".
+ *
+ * The path is truncated from the LEFT (§13.4) against what the line actually has
+ * left, not a fixed 60, so the row cannot exceed 80 columns for a long slug.
+ */
+function repoValue(ctx, toplevel) {
+    const slug = resolveRepoSlug(toplevel);
+    const shown = tildify(toplevel, ctx.home);
+    const overhead = ROW_INDENT + LABEL_GUTTER + STATUS.repoToplevel(slug, "").length;
+    let budget = Math.max(12, WRAP_COLUMNS - overhead);
+    let value = STATUS.repoToplevel(slug, truncatePath(shown, budget));
+    // Fit the row by BYTES as well as by columns, and pay the difference only on
+    // rows that actually truncate. `truncatePath`'s `…` is one column but three
+    // UTF-8 bytes, so a row filled to exactly 80 columns is 82 bytes — which
+    // passes §13.4 (a terminal renders one column) and fails the byte-counting
+    // `awk` check the verify recipe uses. BSD awk counts bytes whatever the
+    // locale, so satisfying the stricter measure is cheaper than arguing about
+    // which one is right: it costs at most two columns, and only here.
+    while (ROW_INDENT + LABEL_GUTTER + Buffer.byteLength(value) > WRAP_COLUMNS && budget > 12) {
+        budget -= 1;
+        value = STATUS.repoToplevel(slug, truncatePath(shown, budget));
+    }
+    return value;
+}
+/** `/Users/dev/code/x` -> `~/code/x`, as §10.3 draws it. */
+function tildify(path, home) {
+    if (home !== "" && (path === home || path.startsWith(`${home}/`))) {
+        return `~${path.slice(home.length)}`;
+    }
+    return path;
+}
+/**
+ * The two trailing actions, aligned as one pair — §10.3 draws their values in a
+ * shared column, which only holds if both labels pad to the longer of the two.
+ *
+ * When capture is OFF the first line is the reconnect command instead: there is
+ * nothing to turn off, and §10.3 only draws the on-state.
+ */
+function actionLines(ctx, on) {
+    const pairs = on
+        ? [
+            [STATUS.turnOffLabel, COMMANDS.off],
+            [STATUS.revokeLabel, URLS.settings],
+        ]
+        : [
+            [STATUS.fixCommandLabel, COMMANDS.connect],
+            [STATUS.revokeLabel, URLS.settings],
+        ];
+    const width = Math.max(...pairs.map(([label]) => label.length));
+    return pairs.map(([label, value]) => {
+        const painted = value.startsWith("https://") ? paint(ctx.colour, "accent", value) : value;
+        return `  ${`${label}:`.padEnd(width + 2)}${painted}`;
+    });
+}
+export function off(ctx) {
+    const keys = resolveProjectKeys(ctx.cwd);
+    if (keys === null) {
+        writeLines(ctx.stderr, renderErrorBlock({ kind: "bad", what: ERRORS.notAGitRepo, why: [] }, ctx.colour));
+        return EXIT.failure;
+    }
+    // ⛔ THE REVOKE SIDE, AND IT MUST DELETE THE KEY `connect` WROTE (`D184 §9`).
+    // `revokeProject` deletes by exact string and reports `false` when the key is
+    // absent — so a revoke still keyed on the toplevel would find nothing, print
+    // "already off", and LEAVE THE GRANT IN PLACE. The user believes they
+    // withdrew consent; capture continues. That is the worse direction of this
+    // same bug, and it is the second mutation the cells below pin.
+    const changed = revokeProject(ctx.home, keys.consent);
+    writeLines(ctx.stdout, [
+        ...wrap(changed ? OFF.done : OFF.alreadyOff, 2),
+        ...wrap(OFF.note, 2),
+    ]);
+    return EXIT.ok;
+}
+/**
+ * The three credential problems that are worth four different fixes on an
+ * interactive surface. The hook collapses them to one `systemMessage`; here the
+ * user can act, so §13.6 gets its full what / why / fix.
+ *
+ * None of these lines can carry credential bytes: the plaintext leaves
+ * `IngestCredential` only through `expose()`, and no copy path calls it.
+ */
+function credentialProblem(load, colour) {
+    switch (load.kind) {
+        case "wrong-class":
+            return renderErrorBlock({
+                kind: "bad",
+                what: CREDENTIAL.wrongClassWhat,
+                why: [
+                    load.source === "env"
+                        ? CREDENTIAL.wrongClassEnvWhy
+                        : CREDENTIAL.wrongClassFileWhy,
+                ],
+                fixLabel: CREDENTIAL.wrongClassFix,
+                fixes: [COMMANDS.connect],
+            }, colour);
+        case "insecure-file":
+            return renderErrorBlock({
+                kind: "bad",
+                what: CREDENTIAL.insecureFileWhat,
+                why: [
+                    `${CREDENTIAL.insecureFileWhyLabel} ${truncatePath(load.path, 60)}`,
+                    `${CREDENTIAL.insecureFileModeLabel} ${load.mode}`,
+                    CREDENTIAL.insecureFileWhy,
+                ],
+                fixLabel: CREDENTIAL.insecureFileFix,
+                fixes: [COMMANDS.chmodCredentials],
+            }, colour);
+        case "unreadable":
+            return renderErrorBlock({
+                kind: "bad",
+                what: CREDENTIAL.unreadableWhat,
+                why: [
+                    `${CREDENTIAL.insecureFileWhyLabel} ${truncatePath(load.path, 60)}`,
+                    CREDENTIAL.unreadableWhy,
+                ],
+                fixLabel: CREDENTIAL.unreadableFix,
+                fixes: [COMMANDS.connect],
+            }, colour);
+    }
+}
+//# sourceMappingURL=status.js.map

package/dist/commands/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/commands/status.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChG,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,KAAK,EACL,QAAQ,EACR,KAAK,EACL,gBAAgB,EAChB,YAAY,EACZ,IAAI,GACL,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,UAAU,EAAuB,MAAM,cAAc,CAAC;AAE/D,uEAAuE;AACvE,MAAM,UAAU,GAAG,CAAC,CAAC;AAErB,MAAM,UAAU,MAAM,CAAC,GAAmB,EAAE,OAA0B,EAAE;IACtE,4EAA4E;IAC5E,2EAA2E;IAC3E,8EAA8E;IAC9E,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CACjF,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC;IAEjC,2EAA2E;IAC3E,uEAAuE;IACvE,qEAAqE;IACrE,uDAAuD;IACvD,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAChC,MAAM,KAAK,GAAa;QACtB,KAAK,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,CAC5D,GAAG,CAAC,MAAM,EACV,QAAQ,EACR,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAC1C,EAAE;QACH,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;KACnE,CAAC;IAEF,sEAAsE;IACtE,2EAA2E;IAC3E,kDAAkD;IAClD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,QAAQ,CACN,UAAU,EACV,MAAM,CAAC,gBAAgB,EACvB,MAAM,CAAC,gBAAgB,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,CACrF,CACF,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CACR,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CACzF,CAAC;IAEF,MAAM,IAAI,GAAG,cAAc,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAE9D,yEAAyE;IACzE,qEAAqE;IACrE,EAAE;IACF,2EAA2E;IAC3E,+EAA+E;IAC/E,6EAA6E;IAC7E,8EAA8E;IAC9E,EAAE;IACF,0EAA0E;IAC1E,8EAA8E;IAC9E,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACjD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;YAC5D,OAAO,IAAI,CAAC,OAAO,CAAC;QACtB,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE;YAChD,IAAI,EAAE,eAAe,CAAC,UAAU,CAAC;YACjC,QAAQ,EAAE,UAAU;YACpB,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE;YAC/E,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;IAC1C,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC9B,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,8EAA8E;IAC9E,sEAAsE;IACtE,gFAAgF;IAChF,IAAI,EAAE,IAAI,QAAQ,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;IAE1E,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;IACxC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9B,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,GAAmB,EAAE,QAAgB;IACtD,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,UAAU,GAAG,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;IAElF,IAAI,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,YAAY,GAAG,QAAQ,CAAC,CAAC;IACnD,IAAI,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,6EAA6E;IAC7E,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,wEAAwE;IACxE,2EAA2E;IAC3E,mEAAmE;IACnE,OAAO,UAAU,GAAG,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,YAAY,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1F,MAAM,IAAI,CAAC,CAAC;QACZ,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4DAA4D;AAC5D,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,IAAI,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,GAAmB,EAAE,EAAW;IACnD,MAAM,KAAK,GAAuB,EAAE;QAClC,CAAC,CAAC;YACE,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC;YACnC,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC;SACpC;QACH,CAAC,CAAC;YACE,CAAC,MAAM,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC;YAC1C,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC;SACpC,CAAC;IACN,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1F,OAAO,KAAK,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,CAAC;IACxD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,GAAmB;IACrC,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,UAAU,CACR,GAAG,CAAC,MAAM,EACV,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CACjF,CAAC;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IACD,6EAA6E;IAC7E,8EAA8E;IAC9E,6EAA6E;IAC7E,sEAAsE;IACtE,2EAA2E;IAC3E,+DAA+D;IAC/D,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtD,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE;QACrB,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/C,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;KACrB,CAAC,CAAC;IACH,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CACxB,IAAoJ,EACpJ,MAAe;IAEf,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,aAAa;YAChB,OAAO,gBAAgB,CACrB;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,UAAU,CAAC,cAAc;gBAC/B,GAAG,EAAE;oBACH,IAAI,CAAC,MAAM,KAAK,KAAK;wBACnB,CAAC,CAAC,UAAU,CAAC,gBAAgB;wBAC7B,CAAC,CAAC,UAAU,CAAC,iBAAiB;iBACjC;gBACD,QAAQ,EAAE,UAAU,CAAC,aAAa;gBAClC,KAAK,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC;aAC1B,EACD,MAAM,CACP,CAAC;QACJ,KAAK,eAAe;YAClB,OAAO,gBAAgB,CACrB;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,UAAU,CAAC,gBAAgB;gBACjC,GAAG,EAAE;oBACH,GAAG,UAAU,CAAC,oBAAoB,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;oBACnE,GAAG,UAAU,CAAC,qBAAqB,IAAI,IAAI,CAAC,IAAI,EAAE;oBAClD,UAAU,CAAC,eAAe;iBAC3B;gBACD,QAAQ,EAAE,UAAU,CAAC,eAAe;gBACpC,KAAK,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC;aACnC,EACD,MAAM,CACP,CAAC;QACJ,KAAK,YAAY;YACf,OAAO,gBAAgB,CACrB;gBACE,IAAI,EAAE,KAAK;gBACX,IAAI,EAAE,UAAU,CAAC,cAAc;gBAC/B,GAAG,EAAE;oBACH,GAAG,UAAU,CAAC,oBAAoB,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE;oBACnE,UAAU,CAAC,aAAa;iBACzB;gBACD,QAAQ,EAAE,UAAU,CAAC,aAAa;gBAClC,KAAK,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC;aAC1B,EACD,MAAM,CACP,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/commands/why.d.ts

@@ -0,0 +1,349 @@
+/**
+ * `vibecommit why` — the screenshotted surface. `CR-086`, W9.
+ *
+ * *"Show the conversation turns recorded against the commit that last changed
+ * this line."* That sentence is VERBATIM-APPROVED (D61 §PS6), already in
+ * `strings.ts` and already pinned by `test/help.golden.txt`. This module is what
+ * makes it true.
+ *
+ * The screen is style guide §10.4; the copy is §R3's decision table in
+ * `docs/designs/claims-audit-why.md`, which §10.4 says must not be paraphrased.
+ * Layout is `DESIGN.md` §13 — six SGR roles, base-16 only, 80-column HARD WRAP,
+ * §13.6's error shape, §13.7's exit contract.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * ## ⚠ WHAT THIS VERB SHIPS WITHOUT, AND WHY IT SHIPS ANYWAY
+ *
+ * `why` is *blame → commit → attribution*. The third arrow has no producer, and
+ * two more of this screen's inputs do not exist either. All four were
+ * re-measured for this task rather than taken on trust (every tracked blob at
+ * `vibecommit-capture` `4dcf47d`, `vibecommit-mcp` `eeda878`,
+ * and `vibecommit-schema` `2c77400`, read as utf8 in
+ * Python — never `grep`, because `src/redact.ts` carries literal NUL bytes and
+ * `grep -I` skips it silently):
+ *
+ *   1. **`observed` has no producer in any repo** — 0 client git probes on the
+ *      write path, and `vibecommit-mcp/src/conversation/edge_derivation.ts:36-47`
+ *      states it outright. This module does not build one and must not be read
+ *      as building one: `git blame` here is an INTERACTIVE READ-PATH probe whose
+ *      output never crosses the ingest wire. `src/hooks/`, `src/post.ts` and
+ *      `src/state.ts` are untouched.
+ *   2. **Nothing writes `commit_file_attribution`** — the table `agent_id` lives
+ *      on. `CR-070` created it; `CR-072` shipped the edge only and said so.
+ *   3. **`capture_turns.subagent_count` EXISTS AND STILL HAS NO PRODUCER.**
+ *      `CR-129a` added it (`vibecommit-schema` `f3022c5`), `integer`, nullable,
+ *      no default. Nothing can carry it: mcp's `insertCaptureTurns` is an
+ *      explicit seven-key literal and `blame_commit` selects
+ *      `position, turn_hash`, so the column never reaches this client. The
+ *      measurement, with the file and line for each answer, lives in
+ *      `test/subagent-count.test.ts`.
+ *
+ *      ⚠ **A COLUMN LIST STOOD HERE AND IT WAS A TALLY — D101, WRITE THE
+ *      PREDICATE, NEVER THE COUNT.** It read `capture_id, position,
+ *      workspace_id, conversation_id, turn_hash, is_human_prompt`, and it was
+ *      an exact transcription of the original `create table` when it was
+ *      written. **Three later migrations emptied it, none of them wrong:**
+ *      `20260610140000` added `human_prompt_hash`; `20260620180000` renamed
+ *      `workspace_id` to `org_id` across fourteen tables; `20260820000000`
+ *      added `subagent_count`. So the list decayed to naming a column that no
+ *      longer exists — D97's species, a statement that was genuine when
+ *      authored and was emptied later by someone else's correct change. **The
+ *      live set is not restated here**, because restating it would start the
+ *      same decay again; ask the catalog.
+ *   4. **`blame_commit` does not exist** — it is `CR-085`, being built in
+ *      another repo in this same wave, and D106 §1 measured production mcp still
+ *      serving release v4, which has no ingest route at all. **There is no
+ *      deployed server to test this against.**
+ *
+ * (1) and (2) are recorded in D104 §2 as owed their own `CR-###` and are
+ * explicitly not this task's. (3) was `CR-129`: `CR-129a` shipped the column in
+ * W10 and `CR-129d` verified the consumer against it — **the gap is narrower
+ * than it was and it is not closed**, because a producer needs an mcp write
+ * path AND an mcp read path, and no row owns either.
+ *
+ * D81 governs the shape of the answer: *"A task can be un-shippable because of
+ * what it CLAIMS, not because of what it lacks… making the claim honest is
+ * usually cheaper than building the thing, and it is always the correct
+ * order."* So every one of those holes renders as an absence in this project's
+ * grammar — **state the absence, state the cause, state what would change it** —
+ * and none of them renders as a zero, a placeholder, or a silence.
+ *
+ * ─────────────────────────────────────────────────────────────────────────────
+ * ## THE THREE RULES THIS FILE IS BUILT AROUND
+ *
+ * **The payload is UNTRUSTED JSON.** `blame_commit` has no implementation to
+ * agree with, so `BlameCommitPayload` below is a contract this repo DECLARES and
+ * `CR-085` owns the other side of. Every field is validated; anything
+ * unrecognised is `malformed` and renders as such rather than being partly
+ * guessed at.
+ *
+ * **The client may render; it may not analyze** (D60 §D1a). The one authorised
+ * deviation in this package is `CR-024d`'s redaction parse, by name; there is no
+ * authorisation here. So the truncation totals come from the payload and this
+ * module never counts the array it was handed, never ranks it, and never
+ * reorders it.
+ *
+ * **`null` and ABSENT are different facts.** The schema comment on `agent_id`
+ * says *"NULL = the main thread"* — so a null we were SENT is knowledge, and a
+ * field that never arrived is not. An unmarked turn rendered from an absent
+ * field is the overclaim, so a turn is rendered unmarked only when the field was
+ * actually present.
+ *
+ * @provenance vibecommit-mcp src/read/envelope.ts — the one-text-part wire shape, retyped
+ * @provenance vibecommit-schema capture_turns + commit_file_attribution — MEASURED ABSENCE, cited
+ */
+import { type BlamedCommit, type EdgeGrade } from "../copy/index.js";
+import { readWithSession } from "../oauth/signin.js";
+import { type CommandContext } from "./context.js";
+/**
+ * THE SHA-LENGTH RULE — read this before "fixing" the asymmetry.
+ *
+ * ⚠⚠ **THE TWO SHAS ON THE SQUASH SCREEN ARE ABBREVIATED DIFFERENTLY, ON
+ * PURPOSE, AND THE SCREEN SAYS SO** (D120 §1 as revised).
+ *
+ * The BLAMED sha renders at `ABBREV`, like every other sha this product prints:
+ * it is on the reader's ref, so seven hex resolves under `git show` — which is
+ * §10.6 E's stated purpose — and seven is also git's own dynamic `--short`
+ * length for repositories this size.
+ *
+ * **The RECORDED sha renders IN FULL, and the first ruling to abbreviate it was
+ * reversed.** This state exists for the squash case, and after a squash-merge
+ * WITH BRANCH DELETE the original commit is **not in the reader's clone at
+ * all** — measured, not assumed: cloned over the git transport, the original
+ * object is ABSENT and `git show` fails while the squashed commit resolves.
+ *
+ * ⚠ **AND THE MECHANISM IS NOT THE ONE THE RULING ASSUMED.** The full sha does
+ * NOT resolve locally either — if the object is gone, both forms fail. What the
+ * full value buys is that it stays a COMPLETE IDENTIFIER, resolvable off this
+ * machine: it can be looked up on the host, quoted in a record, or matched
+ * against another system. **A seven-character prefix is not addressable that
+ * way** — prefix resolution needs a store that already holds the object, and
+ * nothing here does. Truncating it would make the value unrecoverable
+ * anywhere, which is a claims problem rather than a formatting one.
+ */
+/**
+ * What `why` requires of `blame_commit`.
+ *
+ * ⚠ **UNRECONCILED AS OF `vibecommit-mcp` `eeda878`.** No tool of this name
+ * exists there: `src/read/envelope.ts:18` says *"`blame_commit` DOES NOT EXIST
+ * until W9"*, and `CR-085` — the last link of W9's serial mcp chain — is being
+ * written in parallel with this file, by a different builder, in a repo this
+ * task may not touch. This declaration was reported to the orchestrator so the
+ * two sides could be AGREED rather than discovered at merge.
+ *
+ * The transport contract it rides on IS settled and golden-tested on both sides
+ * (`vibecommit-mcp/src/read/envelope.ts`, `src/oauth/read.ts` here): exactly one
+ * `text` part whose text is `JSON.stringify(payload)`, consumed by a single
+ * `JSON.parse`, with an optional `isError: true` on the same shape.
+ *
+ * ### Request
+ *
+ * ```jsonc
+ * { "repo": "acohan/blog",            // resolveRepoSlug — the X-Repo-Slug value
+ *   "commit_sha": "<40 hex>",          // what `git blame` returned, in full
+ *   "file_path": "src/auth/session.ts" // repo-relative, as blame reported it
+ * }
+ * ```
+ *
+ * ### Response — a discriminated union on `state`, and every arm must render
+ *
+ * ```jsonc
+ * { "state": "cold_start" }                        // no capture for this repo, ever
+ * { "state": "no_edge" }                           // repo captured; this commit has none
+ * { "state": "squash_resolved", "recorded_sha": "<40 hex>" }
+ * { "state": "turns",
+ *   "grades": ["derived"],                         // EVERY edge grade held; the floor governs
+ *   "turns": [ { "position": 12, "tool": "Edit",   // ⚠ string | null | ABSENT — see below
+ *                "files": ["src/auth/session.ts"],
+ *                "excerpt": ["…verbatim scrubbed…"],
+ *                "agent_id": null,                 // ⚠ REQUIRED — see below
+ *                "subagent_count": 2 } ],          // ⚠ optional; no producer (CR-129)
+ *   "window": { "first": 12, "last": 16, "total": 23 }, // server-computed; never counted here
+ *   "files_without_turn": 2 }
+ * ```
+ *
+ * ### ⚠ `tool` IS `string | null | ABSENT`, AND THE SERVER MUST NOT NAME THE HOLE
+ *
+ * **The wire carries the FACT; the client owns the WORDS** (D112 §3). A turn that
+ * ran no tool sends `null` or omits the key, and this module renders **no
+ * bracket and no space where the bracket was**. All three inputs are accepted
+ * and the two absence forms render identical bytes.
+ *
+ * ⚠ **A placeholder here is refused even when it is TRUE.** `"(none)"` is
+ * derivable from a turn actually fetched, so it is a claim about content rather
+ * than an invention — and it is still rejected, because a user-facing string
+ * minted in `vibecommit-mcp` bypasses **every copy gate this repo has**:
+ * `test/copy-claims.test.ts` maps exports of `strings.ts` and a wire string is
+ * in no export; `test/copy-width.test.ts` never measures it at 80 columns;
+ * `test/copy-inline-literals.test.ts` cannot see a literal that is not in this
+ * tree. `CR-090d` centralised this package's copy for exactly one reason — **the
+ * claims gate can only check copy it can find.**
+ *
+ * ⚠ **AND PRESENCE IS DELIBERATELY NOT REQUIRED.** Requiring a key the server
+ * could not satisfy is what broke this screen once already: `typeof value.tool
+ * !== "string"` rejected one turn, one rejected turn made the WHOLE document
+ * malformed, and `why` exited 1 on every payload (D110 §1). A required-but-
+ * nullable `tool` reproduces that defect one field over, so `parseTurn` accepts
+ * a turn object with no `tool` key at all.
+ *
+ * ### ⚠ THE ONE REQUIREMENT THIS FILE MAKES OF `CR-085`, AND WHY
+ *
+ * **`agent_id` must be PRESENT on every turn object — `null` for the main
+ * thread, a string for a delegated agent — and its absence must never be used to
+ * mean "main thread".** The schema comment on the column is explicit that *"NULL
+ * = the main thread"* and that the empty string is refused because it *"would
+ * render as an unnamed sub-agent — a plausible wrong answer rather than an
+ * error"*. The same reasoning one level up makes an ABSENT field and a null
+ * field different facts, so this module marks every turn `actor not recorded`
+ * unless the key was actually there.
+ *
+ * **Today `CR-085` cannot satisfy that**, because `commit_file_attribution` has
+ * no writer — which is why the absence branch is the one that ships, named on
+ * screen rather than hidden. `subagent_count` is worse: the column does not
+ * exist in any schema, so the second attribution row is implemented, exercised
+ * against a synthetic payload, and unreachable on the wire. Both are `CR-129`.
+ */
+export interface BlameCommitPayload {
+    readonly state: "cold_start" | "no_edge" | "edge_unreadable" | "squash_resolved" | "turns";
+    /**
+     * The sha the session was actually recorded against, when a rewrite was
+     * resolved. ⚠ **Legal on the `turns` branch too** (D112 §4) — that is the
+     * whole of `CR-138`: `squash_resolved` was TERMINAL, and `parseTarget`
+     * accepts only `<file>:<line>`, so the state handed the reader a sha and no
+     * verb that takes it. A dead end by construction. Carried on `turns`, both
+     * shas render AND the session is readable underneath them.
+     */
+    readonly recordedSha: string | null;
+    /**
+     * HOW the pair was established, and it RENDERS rather than being carried.
+     * `null` when no rewrite was resolved — the ordinary case.
+     */
+    readonly matchKind: MatchKind | null;
+    readonly grades: readonly EdgeGrade[];
+    readonly turns: readonly WhyTurn[];
+    readonly window: TurnWindow | null;
+    readonly filesWithoutTurn: number | null;
+}
+/** One turn, exactly as §10.4 draws its row. */
+export interface WhyTurn {
+    readonly position: number;
+    /**
+     * The tool this turn ran, or `null` when none is recorded — and on this field
+     * ALONE, `null` and ABSENT are the same fact (D112 §3). Both render no
+     * bracket, which is the point: **no bracket makes no claim**, where an
+     * `[(none)]` would be words this repo's copy gates cannot see. The opposite
+     * of the `agent_id` rule below, deliberately, because `tool` has no reading
+     * under which absence could mean "the main thread".
+     */
+    readonly tool: string | null;
+    readonly files: readonly string[];
+    readonly excerpt: readonly string[];
+    /**
+     * `null` = the main thread, a string = that sub-agent. ⚠ Meaningful ONLY when
+     * `agentIdPresent` — otherwise it is this module's default, not the server's
+     * answer, and rendering an unmarked turn from it would be the overclaim.
+     */
+    readonly agentId: string | null;
+    readonly agentIdPresent: boolean;
+    /** §R3 row 2. NO PRODUCER EXISTS — `capture_turns.subagent_count` is not a column. */
+    readonly subagentCount: number | null;
+}
+/**
+ * §R3's truncation notice. Every number is the server's (D60 §D1a).
+ *
+ * ⚠ `first` / `last`, NOT `from` / `to`, and the reason is a known scanner shape
+ * rather than taste. `test/provenance.test.ts`'s linkage wall is a REGEX over
+ * raw text — `/(?:from|import)\s*\(?\s*"([^"]+)"/` — so the token `from`
+ * immediately followed by a double quote reads as an import specifier escaping
+ * the package, ANYWHERE in the file including a JSON example in a docblock.
+ * `src/oauth/signin.ts` already carries the same warning for prose. A false RED
+ * is the more dangerous direction (it justifies "fixing" correct content and
+ * nothing later flags it), so the field is named around it and the reason is
+ * written down. `first`/`last` also says INCLUSIVE, which `from`/`to` does not.
+ */
+export interface TurnWindow {
+    readonly first: number;
+    readonly last: number;
+    readonly total: number;
+}
+/**
+ * How a squash rewrite was established — `commit_sha_successors.match_kind`.
+ *
+ * ⚠ **THE SET IS EXACTLY TWO AND AN UNRECOGNISED VALUE IS MALFORMED, NEVER
+ * DEFAULTED.** Defaulting would silently downgrade a claim: `exact` came from a
+ * recorded successor row, `probable` from a patch-id match, and D67 forbids
+ * folding them. The far side freezes the same pair
+ * (`vibecommit-mcp/src/db/commit_sha_successors.ts`, `SUCCESSOR_MATCH_KINDS`),
+ * and its own comment says a third value is *"a `DECISIONS.md` question, not a
+ * widening"* — so a value we do not recognise means the two repos disagree,
+ * which is precisely the thing to refuse rather than paper over.
+ */
+export type MatchKind = "exact" | "probable";
+/**
+ * ⛔ THE SKEW SENTINEL. Returned when the document is WELL-FORMED but names a
+ * `state` this build does not know — which means the server is newer than this
+ * client, not that the answer is broken.
+ *
+ * ⚠ A UNIQUE OBJECT, compared by identity. A string sentinel could collide with
+ * a future legitimate return, and `null` is already taken by "malformed" — the
+ * two must stay distinguishable, because they send the user to opposite
+ * remedies: "report this" versus "update the plugin".
+ */
+export declare const PAYLOAD_VERSION_SKEW: Readonly<{
+    skew: true;
+}>;
+export type PayloadVersionSkew = typeof PAYLOAD_VERSION_SKEW;
+/**
+ * ⚠ A TYPE GUARD RATHER THAN A BARE `===`. TypeScript does not narrow a union
+ * on object identity — the two members share no discriminant literal — so
+ * `payload === PAYLOAD_VERSION_SKEW` compiles but leaves `payload` wide, and
+ * the next line passing it to a renderer fails to typecheck. The guard makes
+ * the narrowing explicit and keeps the identity comparison as the actual test.
+ */
+export declare function isVersionSkew(p: BlameCommitPayload | PayloadVersionSkew): p is PayloadVersionSkew;
+/**
+ * The whole document.
+ *
+ * - `null` — MALFORMED. The server sent something that is not a valid document
+ *   in any version, and the remedy is to report it.
+ * - `PAYLOAD_VERSION_SKEW` — WELL-FORMED, UNKNOWN STATE. The server is newer
+ *   than this client and the remedy is to upgrade. ⛔ Added by `U1`
+ *   (2026-08-30): before it, this case returned `null` and told the user a
+ *   perfectly good answer was broken. See `WHY.skewWhat` for why that mattered
+ *   more here than in most protocols.
+ * - a payload — parsed.
+ */
+export declare function parseBlameCommitPayload(document: unknown): BlameCommitPayload | PayloadVersionSkew | null;
+export interface BlameResult {
+    readonly sha: string;
+    readonly commit: BlamedCommit;
+}
+/**
+ * `git blame` one line, via `--porcelain`.
+ *
+ * Porcelain rather than the human format: the human format embeds the author's
+ * NAME, which can contain spaces, parentheses and digits, so every field after
+ * it is positional guesswork. Porcelain puts the SHA first on its own line and
+ * the timestamp on a labelled one.
+ */
+export declare function blameLine(dir: string, file: string, line: number): BlameResult | null;
+/** Exported so the parser can be driven against captured git output in the suite. */
+export declare function parseBlamePorcelain(out: string): BlameResult | null;
+export interface WhyTarget {
+    readonly file: string;
+    readonly line: number;
+}
+/**
+ * `<file>:<line>`.
+ *
+ * `lastIndexOf` rather than a split, because a path may legitimately contain a
+ * colon and only the last one can be the line number. The tail must be all
+ * digits and at least 1 — `file:0` and `file:-3` are not lines, and `file:1e3`
+ * is the kind of input `parseInt` would quietly accept as 1.
+ */
+export declare function parseTarget(argv: readonly string[]): WhyTarget | null;
+export interface WhyDeps {
+    /** Injected so the suite can drive every arm without a server — there is none. */
+    readonly read?: typeof readWithSession;
+}
+export declare function why(ctx: CommandContext, argv: readonly string[], deps?: WhyDeps): Promise<number>;