rovecode 0.3.2

package/src/cli/resume.ts

@@ -0,0 +1,57 @@
+/** Which session `rovecode` reopens at boot, from argv.
+ *
+ *  Three spellings, one rule — an explicit id always wins:
+ *    rovecode --resume <id>     that session (a unique prefix resolves in the TUI, session-cmd.ts resolveBootSession)
+ *    rovecode --resume          the newest session that holds something
+ *    rovecode --continue        the same — the flag every CLI that got this right converged on
+ *  `--resume` followed by another flag (`rovecode --resume --yolo`) is `--resume` with no id, never "resume the
+ *  session named --yolo".
+ *
+ *  Two things changed on 2026-09-07 (the aion sessions port, and Berkay's complaint that a wrong id silently gave
+ *  him an empty session): a typed id that is invalid (`../x`), unknown or ambiguous is REFUSED before the TUI boots
+ *  — exit 2, one stderr line with the reason, through the one resolver every session verb uses (cli/session-arg.ts →
+ *  core/session-ops.ts). It used to start a brand-new session under the typed name. And with nothing to continue
+ *  from, the TUI still starts fresh (there is nothing else to do) but SAYS so on the startup card (`note`) instead of
+ *  looking exactly like a resumed session that happened to be empty. */
+
+import { newestSession } from "../core/session.ts";
+import { resolveSessionArg } from "./session-arg.ts";
+
+export interface ResumeRequest {
+  /** the id or prefix the user named */
+  id?: string;
+  /** `--continue`, or `--resume` with no id: reopen the newest non-empty session */
+  newest: boolean;
+}
+
+export function parseResume(argv: readonly string[]): ResumeRequest {
+  const ix = argv.indexOf("--resume");
+  const arg = ix !== -1 ? argv[ix + 1] : undefined;
+  const id = arg !== undefined && !arg.startsWith("-") ? arg : undefined;
+  return { ...(id !== undefined ? { id } : {}), newest: id === undefined && (ix !== -1 || argv.includes("--continue")) };
+}
+
+export interface BootSession {
+  /** the session to open; undefined = a fresh one */
+  id?: string;
+  /** what the startup card says when the request could not be honoured as a resume (nothing to continue from) */
+  note?: string;
+}
+
+export const NOTHING_TO_CONTINUE = "nothing to continue from — this is a new session";
+
+/** The session to boot with. A typed id goes through the one resolver (validity, exact, unique prefix; anything
+ *  else is `fail`, which by default exits 2 with one stderr line). `--continue` / bare `--resume` with no session
+ *  holding anything starts fresh WITH a note. Reads only: nothing is created here. */
+export function resolveBoot(argv: readonly string[], sessionsDir: string, fail?: (msg: string) => never): BootSession {
+  const r = parseResume(argv);
+  if (r.id !== undefined) return { id: resolveSessionArg("--resume", sessionsDir, r.id, fail) };
+  if (!r.newest) return {};
+  const newest = newestSession(sessionsDir);
+  return newest ? { id: newest.id } : { note: NOTHING_TO_CONTINUE };
+}
+
+/** The session id to boot with, or undefined for a fresh one (the id half of resolveBoot). */
+export function resolveResume(argv: readonly string[], sessionsDir: string, fail?: (msg: string) => never): string | undefined {
+  return resolveBoot(argv, sessionsDir, fail).id;
+}

package/src/cli/run-flags.ts

@@ -0,0 +1,43 @@
+/** `--add-dir <dir>` (ported from the Nimbus harness, PORT #81; the rest of Nimbus's run-flags.ts — --continue, --resume,
+ *  --cwd, --model — rovecode already has in cli/resume.ts, cli/run-limits.ts and main.ts, so only the flag that was
+ *  missing lives here).
+ *
+ *  Repeatable, `--add-dir=<dir>` form too, EVERY occurrence of argv (unlike the last-wins value flags), each resolved
+ *  against `base` — the LAUNCH dir — and validated NOW, before any boot: a missing path or a file is
+ *  `--add-dir "<v>" is not a directory`, a filesystem root the "would disable the workspace boundary — pass --yolo"
+ *  line (core/workspace.ts rootProblem), a missing or flag-shaped value `--add-dir needs a value`. Exact duplicates
+ *  collapse here; canonical duplicates / nesting are dropped with a note by resolveRoots at boot. A usage error is
+ *  exit 2 and leaves no session dir behind; `fail` is injectable for tests. `--add-dir` must also sit in
+ *  cli/dispatch.ts VALUE_FLAGS so its value never becomes the command or a prompt word — the --max-cost bug class. */
+
+import { resolve } from "node:path";
+import { rootProblem } from "../core/workspace.ts";
+
+export const ADD_DIR_FLAG = "--add-dir";
+export const ADD_DIR_USAGE = 'usage: rovecode [run] [--add-dir <dir>]… — an extra workspace root beside the cwd (repeatable; --add-dir=<dir> too)';
+
+const usageExit = (msg: string): never => {
+  process.stderr.write(`error: ${msg} — ${ADD_DIR_USAGE}\n`); // ONE stderr line, like the sibling usage errors
+  return process.exit(2);
+};
+
+/** a token that is a flag, not a value: `-x`, `--x` (a lone `-` is stdin, a value) */
+const isFlagToken = (a: string): boolean => a.length > 1 && a.startsWith("-");
+
+export function parseAddDirs(argv: readonly string[], fail: (msg: string) => never = usageExit, base = process.cwd()): string[] {
+  const args = argv.slice(2);
+  const out: string[] = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i]!;
+    let v: string | undefined;
+    if (a === ADD_DIR_FLAG) { v = args[i + 1]; if (v === undefined || isFlagToken(v)) return fail(`${ADD_DIR_FLAG} needs a value`); i++; }
+    else if (a.startsWith(`${ADD_DIR_FLAG}=`)) v = a.slice(ADD_DIR_FLAG.length + 1);
+    else continue;
+    if (v.trim().length === 0) return fail(`${ADD_DIR_FLAG} needs a directory`);
+    const abs = resolve(base, v);
+    const problem = rootProblem(abs, v);
+    if (problem !== undefined) return fail(problem);
+    if (!out.includes(abs)) out.push(abs);
+  }
+  return out;
+}

package/src/cli/run-limits.ts

@@ -0,0 +1,78 @@
+/** The three ceilings on one run — turns, wall-clock seconds and dollars — from flags and environment, in one
+ *  place so `rovecode run` (flags + a headless default) and the runtime (env, every surface) agree.
+ *  Why a wall clock at all: a headless run that has finished its files can keep verifying — screenshots,
+ *  probe pages, pixel measurements — until something external kills it, and a killed run leaves no result
+ *  object. The loop checks the clock at each turn boundary (core/loop.ts) and ends with status "budget". */
+
+export interface RunLimits {
+  /** RunConfig.maxTurns override; unset = the runtime default (60) */
+  maxTurns?: number;
+  /** RunConfig.maxSeconds; unset = no clock */
+  maxSeconds?: number;
+  /** RunConfig.maxCostUsd; unset = no spend cap */
+  maxCostUsd?: number;
+}
+
+/** a positive whole number, or undefined for anything else (unset, junk, zero, negative) */
+export function positiveInt(v: string | undefined): number | undefined {
+  if (v === undefined) return undefined;
+  const n = Number(v.trim());
+  return Number.isInteger(n) && n > 0 ? n : undefined;
+}
+
+/** a positive amount of money — `0.50`, `2`, `$1.25` (a leading $ is forgiven: it is what people type) — or
+ *  undefined for anything else. Zero is not an amount: a bare "0" is "off" (the shared OFF set, as for
+ *  --max-seconds) and "0.00" is a usage error — neither may become a cap that ends every run before its
+ *  first priced turn, which nobody means. */
+export function positiveUsd(v: string | undefined): number | undefined {
+  if (v === undefined) return undefined;
+  const n = Number(v.trim().replace(/^\$/, ""));
+  return Number.isFinite(n) && n > 0 ? n : undefined;
+}
+
+const OFF = new Set(["off", "none", "0", "false"]);
+const flagValue = (argv: readonly string[], name: string): string | undefined => { const i = argv.indexOf(name); return i === -1 ? undefined : argv[i + 1]; };
+
+/** `--max-turns N` · `--max-seconds S|off` · `--max-cost D|off`, then ROVECODE_MAX_TURNS / ROVECODE_MAX_SECONDS /
+ *  ROVECODE_MAX_COST, then `defaultSeconds` (the headless default; omit it for surfaces that want no clock).
+ *  A flag that is present but not a positive number is a usage error, not a silent default. */
+export function parseRunLimits(argv: readonly string[], env: Record<string, string | undefined>, opts: { defaultSeconds?: number } = {}): RunLimits | { error: string } {
+  const out: RunLimits = {};
+  // the spend cap first: it has no default and no interaction with the other two
+  const cost = flagValue(argv, "--max-cost");
+  if (cost !== undefined || argv.includes("--max-cost")) {
+    if (cost === undefined || !OFF.has(cost.trim().toLowerCase())) {
+      const n = positiveUsd(cost);
+      if (n === undefined) return { error: `--max-cost wants a positive amount in dollars (or "off"), not "${cost ?? ""}"` };
+      out.maxCostUsd = n;
+    }
+  } else {
+    const envCost = env["ROVECODE_MAX_COST"];
+    if (envCost !== undefined && !OFF.has(envCost.trim().toLowerCase())) {
+      const n = positiveUsd(envCost);
+      if (n !== undefined) out.maxCostUsd = n;
+    }
+  }
+  const turns = flagValue(argv, "--max-turns");
+  if (turns !== undefined || argv.includes("--max-turns")) {
+    const n = positiveInt(turns);
+    if (n === undefined) return { error: `--max-turns wants a positive whole number, not "${turns ?? ""}"` };
+    out.maxTurns = n;
+  } else {
+    const n = positiveInt(env["ROVECODE_MAX_TURNS"]);
+    if (n !== undefined) out.maxTurns = n;
+  }
+  const secs = flagValue(argv, "--max-seconds");
+  if (secs !== undefined || argv.includes("--max-seconds")) {
+    if (secs !== undefined && OFF.has(secs.trim().toLowerCase())) return out; // an explicit "no clock"
+    const n = positiveInt(secs);
+    if (n === undefined) return { error: `--max-seconds wants a positive whole number of seconds (or "off"), not "${secs ?? ""}"` };
+    out.maxSeconds = n;
+    return out;
+  }
+  const envSecs = env["ROVECODE_MAX_SECONDS"];
+  if (envSecs !== undefined && OFF.has(envSecs.trim().toLowerCase())) return out;
+  const n = positiveInt(envSecs) ?? opts.defaultSeconds;
+  if (n !== undefined) out.maxSeconds = n;
+  return out;
+}