rovecode 0.3.3 → 0.4.0-beta.3

package/src/tui/cost.ts

@@ -1,108 +0,0 @@
-/** /cost note body (ports #5+#6), extracted from app.ts for the ADR-002 line cap.
- *  Usage is priced PER MESSAGE at the model recorded in Message.origin —
- *  a session that switched models mid-way is not silently re-priced at the current model.
- *  Messages without an origin fall back to the current model WITH an explicit caveat; messages
- *  whose model has no catalog pricing are excluded and flagged (cost becomes a lower bound).
- *  Context health counts ALL parts (partsTokenText): tool calls/results dominate agentic
- *  sessions, and a text-only count reads ~0% forever.
- *  Port #44: the same math feeds the sextant usage panel through sessionUsage(). */
-
-import { partsTokenText } from "../core/loop.ts";
-import { ModelCatalog, ratesFor } from "../providers/catalog.ts";
-import { contextHealth, costUsdTiered, countTokens, countTokensIfLoaded } from "../core/usage.ts";
-import { estimateTokens } from "../core/context.ts";
-import { tokenScaleFor } from "../core/token-scale.ts";
-import type { Message } from "../core/types.ts";
-
-export interface UsageSummary {
-  inTok: number; outTok: number; cacheRead: number; cacheWrite: number;
-  /** USD over the priced messages; `priced`/`unpriced`/`noOrigin` say how much of the transcript it covers */
-  cost: number; priced: number; unpriced: number; noOrigin: number;
-  /** estimated prompt tokens, corrected towards the current model's own tokenizer, and the catalog's
-   *  window when it knows one. `estRaw` is the uncorrected count the correction was applied to, and
-   *  `counter` says which estimator produced it — both are estimates, with different measured errors
-   *  (core/token-scale.ts): "o200k" is countTokens (exact for OpenAI models), "chars" is estimateTokens
-   *  (chars/4, what compaction budgets with). The scale applied is the one measured for that counter. */
-  est: number; estRaw: number; counter: "o200k" | "chars"; scale: { scale: number; measured: boolean; note: string }; window?: number;
-}
-
-export interface SummarizeOptions {
-  /** "exact": count with o200k, loading its table if it is not resident (385–520 ms and ~136 MB the
-   *  first time — fine for /cost, which a person asked for). "cheap": o200k only if the table is already
-   *  resident, else chars/4 — for the sextant usage panel, which is computed at boot and after every
-   *  turn and must never be the reason the table loads. Default "exact". */
-  counter?: "exact" | "cheap";
-}
-
-export function summarizeUsage(messages: Message[], catalog: ModelCatalog, current: { provider: string; model: string }, opts: SummarizeOptions = {}): UsageSummary {
-  const u: UsageSummary = { inTok: 0, outTok: 0, cacheRead: 0, cacheWrite: 0, cost: 0, priced: 0, unpriced: 0, noOrigin: 0, est: 0, estRaw: 0, counter: "o200k", scale: { scale: 1, measured: false, note: "" } };
-  for (const m of messages) {
-    const usage = m.usage;
-    if (!usage) continue;
-    u.inTok += usage.input; u.outTok += usage.output;
-    u.cacheRead += usage.cacheRead ?? 0; u.cacheWrite += usage.cacheWrite ?? 0;
-    if (usage.input === 0 && usage.output === 0 && !usage.cacheRead && !usage.cacheWrite) continue; // nothing to price
-    if (!m.origin) u.noOrigin += 1;
-    const origin = m.origin ?? current;
-    const info = catalog.lookup(origin.provider, origin.model);
-    const n = { input: usage.input, output: usage.output, cacheRead: usage.cacheRead ?? 0, cacheWrite: usage.cacheWrite ?? 0 };
-    // the prompt this turn actually carried decides the rate on a tiered model: xAI and Google bill a
-    // prompt over 200k at the upper rate — xAI for the whole request. A flat model's breakdown is trivial.
-    const c = info?.pricing
-      ? costUsdTiered(n, ratesFor(info, n.input + n.cacheRead + n.cacheWrite))
-      : undefined;
-    if (c === undefined) u.unpriced += 1;
-    else { u.cost += c; u.priced += 1; }
-  }
-  const window = catalog.lookup(current.provider, current.model)?.contextWindow;
-  if (window) u.window = window;
-  const text = messages.map((m) => partsTokenText(m.parts)).join("\n");
-  const exact = opts.counter === "cheap" ? countTokensIfLoaded(text) : countTokens(text);
-  // Neither counter is this model's tokenizer (o200k is OpenAI's; chars/4 is nobody's). `rovecode context`
-  // has corrected for that since the factors were measured; this panel had not, so the live meter a user
-  // actually watches read up to 1.8x low on Claude 5 — the worst place for it, because this is the number
-  // you look at to decide whether there is room for another turn. Each counter gets ITS OWN measured
-  // factor: the chars/4 error is not the o200k error (token-scale.ts charScale).
-  const ts = tokenScaleFor(current);
-  if (exact !== null) {
-    u.counter = "o200k"; u.estRaw = exact;
-    u.scale = { scale: ts.scale, measured: ts.measured, note: ts.note };
-  } else {
-    u.counter = "chars"; u.estRaw = estimateTokens(text);
-    u.scale = { scale: ts.charScale, measured: ts.measured, note: ts.note };
-  }
-  u.est = Math.ceil(u.estRaw * u.scale.scale);
-  return u;
-}
-
-/** the sextant usage panel's numbers: cost = the priced lower bound (null until something is priced), context = the
- *  estimate. Runs at boot and after every turn, so it is the "cheap" counter: the panel's "estimated context fill"
- *  is chars/4 × the model's measured char factor until someone loads the o200k table (/cost, /context), and the
- *  o200k figure from then on. Both are estimates; neither is ever presented as the provider's count — that is
- *  drift() in core/context-report.ts, which counts exactly and compares against what the provider reported. */
-export function sessionUsage(messages: Message[], catalog: ModelCatalog, current: { provider: string; model: string }): { costUsd: number | null; contextTokens: number; counter: "o200k" | "chars" } {
-  const u = summarizeUsage(messages, catalog, current, { counter: "cheap" });
-  return { costUsd: u.priced > 0 ? u.cost : null, contextTokens: u.est, counter: u.counter };
-}
-
-export function buildCostNote(messages: Message[], catalog: ModelCatalog, current: { provider: string; model: string }): string {
-  const u = summarizeUsage(messages, catalog, current);
-  const health = u.window ? contextHealth(u.est, u.window) : undefined;
-  let costLine: string;
-  if (u.priced === 0 && u.unpriced > 0) {
-    costLine = `pricing unknown for ${current.provider}/${current.model}`;
-  } else {
-    costLine = `estimated cost: $${u.cost.toFixed(4)}`;
-    if (u.unpriced > 0) costLine += ` — ${u.unpriced} message${u.unpriced > 1 ? "s" : ""} unpriced (lower bound)`;
-    if (u.noOrigin > 0) costLine += ` — ${u.noOrigin} without origin priced at the current model`;
-  }
-  return [
-    `tokens: ${u.inTok} in / ${u.outTok} out · cache: ${u.cacheRead} read / ${u.cacheWrite} written`,
-    health
-      ? `context: ~${u.est} of ${u.window} (${Math.round(health.fraction * 100)}%${health.nearLimit ? " — near limit" : ""})`
-      : `context: ~${u.est} tokens (window unknown)`,
-    // a corrected number that does not say it was corrected is indistinguishable from a wrong one
-    ...(u.scale.scale !== 1 ? [`  ${u.counter === "o200k" ? "o200k counted" : "chars/4 estimated"} ${u.estRaw}, scaled ${u.scale.scale}× for ${current.model}`] : []),
-    costLine,
-  ].join("\n");
-}

package/src/tui/crash-guard.ts

@@ -1,173 +0,0 @@
-/** What happens to your terminal when rovecode dies badly, and what you get to read afterwards.
- *
- *  THE BUG THIS EXISTS FOR (reported 2026-09-07, with a screenshot). The TUI puts the terminal into a
- *  mode the shell cannot live in: alt screen (`?1049h`), raw stdin, mouse reporting (`?1000/1002/1006h`)
- *  and focus reporting (`?1004h`). Quitting cleanly undoes every one of those. Dying does not. The quit
- *  path was careful and the crash path did not exist, so an uncaught exception left the terminal in that
- *  mode with nobody to speak for it: the shell prompt came back INSIDE the alt screen, still covered by
- *  the last painted frame, and every mouse movement afterwards typed escape sequences at the prompt —
- *  `[<222;39;51M[<222;38;51M…` walking down the screen as the pointer moved. To the person at the
- *  keyboard that is not "rovecode crashed", it is "my terminal is broken", and the actual error had
- *  already scrolled away underneath a frame that was never erased.
- *
- *  So this does two things, in this order, and the order is the point:
- *    1. RESTORE THE TERMINAL, before anything that could itself throw. Whatever else goes wrong, the
- *       person gets their shell back.
- *    2. WRITE THE REASON DOWN, to a file, because the one place a crash message cannot survive is the
- *       screen it was printed on — the alt screen is discarded on restore, taking the stack with it.
- *       Then one line on stderr saying where that file is.
- *
- *  WHY A FILE AND NOT JUST STDERR. Restoring the alt screen erases everything printed while the TUI was
- *  up. A stack trace written a microsecond before `?1049l` is gone by the time the shell redraws. The
- *  log is the only copy that survives the fix.
- *
- *  Handlers, and why exactly these. `uncaughtException` and `unhandledRejection` are the two ways a
- *  surface actually dies — the second is the more common one here, because almost everything in the boot
- *  path is async. `exit` is the belt-and-braces restore for any path that reaches `process.exit()`
- *  without going through the quit code, and it logs nothing, because a normal quit is not a crash.
- *  SIGINT is deliberately NOT handled: in raw mode the terminal delivers Ctrl+C as a keystroke to the
- *  app rather than as a signal, so a handler here would be dead code on the path it looks like it covers
- *  and would silently change Ctrl+C's meaning if raw mode ever failed to engage. */
-
-import { appendFileSync, mkdirSync } from "node:fs";
-import { join } from "node:path";
-
-/** the process surface this guard binds to — an object in tests, `process` in production */
-export interface CrashProcess {
-  on(event: string, listener: (...args: unknown[]) => void): unknown;
-  off(event: string, listener: (...args: unknown[]) => void): unknown;
-  exit(code: number): void;
-}
-
-export interface CrashGuardDeps {
-  /** put the terminal back the way it was found. MUST be idempotent and MUST NOT throw — it runs first,
-   *  on every path, including inside the `exit` handler where nothing async can be awaited. */
-  restore: () => void;
-  /** where crash logs go; `<rovecodeHome>/logs` in production */
-  logDir: string;
-  /** version stamped into the log, so a report names the build it came from */
-  version?: string;
-  process?: CrashProcess;
-  /** seams (tests) */
-  now?: () => Date;
-  writeFile?: (path: string, text: string) => void;
-  stderr?: (line: string) => void;
-}
-
-/** what a crash log is called: one file per crash, sortable, no collisions within a second */
-export function crashLogName(at: Date, seq = 0): string {
-  const p = (n: number, w = 2): string => String(n).padStart(w, "0");
-  const stamp = `${at.getFullYear()}${p(at.getMonth() + 1)}${p(at.getDate())}-${p(at.getHours())}${p(at.getMinutes())}${p(at.getSeconds())}`;
-  return seq === 0 ? `crash-${stamp}.log` : `crash-${stamp}-${seq}.log`;
-}
-
-/** An error rendered for someone reading the file a day later: name, message, stack, and the plain
- *  value when what was thrown is not an Error at all (a rejected string, a thrown object — common
- *  enough in async code that omitting it would blank out the interesting cases). */
-export function describeError(err: unknown): string {
-  if (err instanceof Error) {
-    const cause = err.cause !== undefined ? `\ncaused by: ${describeError(err.cause)}` : "";
-    return `${err.name}: ${err.message}\n${err.stack ?? "(no stack)"}${cause}`;
-  }
-  if (typeof err === "object" && err !== null) {
-    try { return `non-Error value thrown: ${JSON.stringify(err)}`; } catch { return `non-Error value thrown: ${String(err)}`; }
-  }
-  return `non-Error value thrown: ${String(err)}`;
-}
-
-/** Is this error a TRANSIENT NETWORK failure that cannot be fixed from inside the process — Bun's
- *  fetch emits DNS/resolve failures BOTH as the promise rejection every caller catches AND as a
- *  stream `error` event on an internal socket (node:streams/destroy → emitErrorNT), and when the
- *  network died mid-boot (adapter switch, VPN drop, DNS unresponsive) that second emission reaches
- *  `uncaughtException` with an empty ResolveMessage. Killing the TUI for it loses the session and
- *  the terminal for something that heals on its own; the honest move is to log it and keep going.
- *  Deliberately NARROW: only the resolve/connect family, only as an uncaught stream error — a
- *  rejected promise with the same text still travels its normal path. */
-export function recoverableNetworkError(err: unknown): boolean {
-  // "Unhandled error. (ResolveMessage {})" — the stream wrapper stringifies its payload into the message
-  const msg = err instanceof Error ? err.message : typeof err === "string" ? err : "";
-  if (/\(ResolveMessage \{\}\)|getAddrInfo|EAI_AGAIN|ENOTFOUND|ECONNRESET|ECONNREFUSED|ECONNABORTED|ETIMEDOUT|EHOSTUNREACH|ENETUNREACH/.test(msg)) return true;
-  // the payload's own facts: a `code` property rides on Errors (Node convention) and bare objects alike
-  if (typeof err === "object" && err !== null) {
-    const name = (err as { name?: unknown }).name;
-    const code = (err as { code?: unknown }).code;
-    if (String(name).includes("Resolve") || /^(EAI_AGAIN|ENOTFOUND|ECONNRESET|ECONNREFUSED|ECONNABORTED|ETIMEDOUT|EHOSTUNREACH|ENETUNREACH)$/.test(String(code))) return true;
-  }
-  return false;
-}
-
-/** the body of a crash log. Kept plain text and self-describing: it is meant to be pasted into a
- *  message, so it must make sense with no surrounding context. */
-export function crashReport(kind: string, err: unknown, at: Date, version?: string): string {
-  return [
-    `rovecode crash — ${kind}`,
-    `when:     ${at.toISOString()}`,
-    `version:  ${version ?? "unknown"}`,
-    `platform: ${process.platform} ${process.arch}`,
-    `cwd:      ${process.cwd()}`,
-    "",
-    describeError(err),
-    "",
-  ].join("\n");
-}
-
-/** Install the guard. Returns an uninstall function — the clean quit path calls it, so a normal exit
- *  does not run a restore twice and a test does not leave listeners on the real process. */
-export function installCrashGuard(deps: CrashGuardDeps): () => void {
-  const proc = deps.process ?? (process as unknown as CrashProcess);
-  const now = deps.now ?? (() => new Date());
-  const stderr = deps.stderr ?? ((line: string) => { try { process.stderr.write(line + "\n"); } catch { /* the pipe may be gone too */ } });
-  const writeFile = deps.writeFile ?? ((path: string, text: string) => { appendFileSync(path, text, "utf8"); });
-
-  let restored = false;
-  const restoreOnce = (): void => {
-    if (restored) return;
-    restored = true;
-    try { deps.restore(); } catch { /* a restore that throws must not stop the log or the exit */ }
-  };
-
-  /** returns the path written, or null when the log could not be written — which must not be fatal:
-   *  a crash we cannot record is still a crash we have to get the terminal back from */
-  const log = (kind: string, err: unknown): string | null => {
-    const at = now();
-    try {
-      mkdirSync(deps.logDir, { recursive: true });
-      const path = join(deps.logDir, crashLogName(at));
-      writeFile(path, crashReport(kind, err, at, deps.version));
-      return path;
-    } catch {
-      return null;
-    }
-  };
-
-  const fatal = (kind: string) => (err: unknown): void => {
-    // a transient network failure arriving as a stream error (Bun's fetch emits DNS/resolve failures
-    // both ways) is NOT a crash: log it to the same file the crashes go to, keep the session alive.
-    // Everything else keeps the old contract — restore first, then the reason, then exit 1.
-    if (recoverableNetworkError(err)) {
-      const path = log(`transient network error (recovered, ${kind})`, err);
-      if (path !== null) stderr(`rovecode: a network call failed and was left behind (${describeError(err).split("\n")[0]}) — details: ${path}`);
-      return;
-    }
-    restoreOnce();                       // FIRST: the terminal is usable even if everything below fails
-    const path = log(kind, err);
-    // Both lines go to stderr because the screen they would have been printed on has just been erased.
-    stderr(`rovecode crashed (${kind}). ${path !== null ? `Details: ${path}` : "The crash log could not be written."}`);
-    stderr(describeError(err));
-    proc.exit(1);
-  };
-
-  const onUncaught = fatal("uncaught exception");
-  const onRejection = fatal("unhandled rejection");
-  const onExit = (): void => { restoreOnce(); };   // no log: a normal exit is not a crash
-
-  proc.on("uncaughtException", onUncaught as (...a: unknown[]) => void);
-  proc.on("unhandledRejection", onRejection as (...a: unknown[]) => void);
-  proc.on("exit", onExit);
-
-  return () => {
-    proc.off("uncaughtException", onUncaught as (...a: unknown[]) => void);
-    proc.off("unhandledRejection", onRejection as (...a: unknown[]) => void);
-    proc.off("exit", onExit);
-  };
-}

package/src/tui/focus-terminal.ts

@@ -1,34 +0,0 @@
-/** FocusTerminal: a pi-tui `Terminal` decorator for the classic surface. Every post-StdinBuffer input sequence goes through
- *  a FocusTracker BEFORE the TUI's input handlers — CSI I / CSI O flip the tracker and never reach the editor; a chunk
- *  emptied by the filter is not forwarded. Nothing else changes: the remaining members forward to the inner terminal
- *  (vendor/pi-tui/src/terminal.ts Terminal). The DECSET 1004 writes are NOT here: withNotifications (tui/notify.ts) writes
- *  them around the surface's own start / stop writes, on both surfaces, only when something can fire — so this decorator
- *  alone adds zero bytes to the stdout stream. Compose any further Terminal decorator OUTSIDE this one (it must stay
- *  innermost after ProcessTerminal to see complete sequences). */
-
-import type { Terminal } from "../../vendor/pi-tui/src/index.ts";
-import type { FocusTracker } from "./notify-seq.ts";
-
-export class FocusTerminal implements Terminal {
-  constructor(private readonly inner: Terminal, private readonly tracker: FocusTracker) {}
-  start(onInput: (data: string) => void, onResize: () => void): void {
-    this.inner.start((data) => {
-      const rest = this.tracker.feed(data); // CSI I / CSI O consumed here; the editor never sees them
-      if (rest.length > 0) onInput(rest);
-    }, onResize);
-  }
-  stop(): void { this.inner.stop(); }
-  drainInput(maxMs?: number, idleMs?: number): Promise<void> { return this.inner.drainInput(maxMs, idleMs); }
-  write(data: string): void { this.inner.write(data); }
-  get columns(): number { return this.inner.columns; }
-  get rows(): number { return this.inner.rows; }
-  get kittyProtocolActive(): boolean { return this.inner.kittyProtocolActive; }
-  moveBy(lines: number): void { this.inner.moveBy(lines); }
-  hideCursor(): void { this.inner.hideCursor(); }
-  showCursor(): void { this.inner.showCursor(); }
-  clearLine(): void { this.inner.clearLine(); }
-  clearFromCursor(): void { this.inner.clearFromCursor(); }
-  clearScreen(): void { this.inner.clearScreen(); }
-  setTitle(title: string): void { this.inner.setTitle(title); }
-  setProgress(active: boolean): void { this.inner.setProgress(active); }
-}

package/src/tui/git-cmds.ts

@@ -1,273 +0,0 @@
-/** `/commit` and `/undo` (port #65). Pattern sources, no code copied: aider `cmd_commit` / `cmd_undo`
- *  (Apache-2.0 — research/source_snapshots/Aider-AI-aider/aider/commands.py:337-350 dirty-check → model-drafted
- *  message unless one is given; :553-640 undo = restore the files the last change touched and say what moved) and
- *  opencode `messages_undo` / session revert (MIT — packages/opencode/src/session/revert.ts: files go back to a
- *  snapshot; deviation here: the conversation is left untouched).
- *
- *  /commit — the staged diff (the working-tree diff of tracked files when nothing is staged, with a note; `commit -a`
- *  then) is collected, the COMMIT router role drafts a conventional message (`rt.router.resolve("commit")` —
- *  ROVECODE_MODEL_COMMIT, else the default chain; ONE stream invocation, no agent loop), the message rides in the
- *  approval card's detail, and `git commit -m <message>` runs through the ONE bash tool dispatch — ToolRegistry.dispatch
- *  under the session's permission rules and buildCfg's approval chain (lane → execpolicy → approval hook → the human
- *  card), exactly like a model-issued or `!cmd` bash call (ADR-005; shell-cmd.ts idiom). `/commit <message>` skips the
- *  draft (no model call). The argv never carries --amend or --no-verify. EVERY git invocation here — the diffs too — goes
- *  through that dispatch: this module owns no spawn path (pinned by a source grep in its test); read-only git argv is
- *  allow-listed by execpolicy, so the diffs never prompt. A denied card commits nothing and puts `/commit <draft>` in
- *  the prompt so the message can be edited and resubmitted.
- *
- *  /undo — steps the workspace back ONE snapshot through the existing Checkpoints.restore(hash, "files") after a
- *  confirmation card listing what will change; the transcript is untouched (a conversation rewind stays /restore's job).
- *  Snapshots land AFTER each mutating tool call, so the last one IS the agent's latest change: when the workspace still
- *  matches a snapshot (Checkpoints.position) the target is that snapshot's nearest differing ancestor — the pre-edit
- *  state — and a second /undo walks one more back (or notes that nothing older differs); a workspace that drifted from
- *  the last snapshot (your own edits, an interrupted run's partial writes) goes back to the last snapshot first,
- *  discarding the drift. No checkpoint → a note. */
-
-import { randomUUID } from "node:crypto";
-import type { Runtime } from "../cli/runtime.ts";
-import type { Checkpoint } from "../coding/checkpoints.ts";
-import { OUTPUT_CAP_CHARS } from "../core/executor.ts"; // the bash tool's output cap — a constant, not a spawn path
-import { partsText } from "../core/loop.ts";
-import type { SessionStore } from "../core/session.ts";
-import type { AssistantTurn, Message, ModelRef, RunEvent, ToolCallPart, ToolContext } from "../core/types.ts";
-import type { Renderer } from "./renderer.ts";
-import type { ApprovalFn } from "../core/types.ts";
-import { REFUSED_DETAIL } from "./shell-cmd.ts";
-
-export interface GitCmdCtx {
-  renderer: Renderer;
-  rt: Pick<Runtime, "registry" | "hooks" | "buildCfg" | "cwd" | "stream" | "router" | "checkpointsFor">;
-  /** the surface's own human approver — undefined under `auto`/yolo, where nothing is asked. /commit's
-   *  card, like a model-issued bash call's, only exists when the session has an approver at all. */
-  approve(): ApprovalFn | undefined;
-  /** the ACTIVE store, read live */
-  store(): SessionStore;
-  yolo(): boolean;
-  /** the app's busy flag (a live run, a `!cmd`, or another git command) */
-  busy(): boolean;
-  setBusy(b: boolean): void;
-  /** the app's interrupt target — Esc / ⌃c abort the command; bound for its lifetime, then cleared */
-  bindAbort(ac: AbortController | null): void;
-}
-
-const BUSY_NOTE = "finish or interrupt the run first (Esc) — /commit and /undo run only while the agent is idle";
-/** the bash tool caps its output (OUTPUT_CAP_CHARS): a capped diff is flagged to the model and on the card */
-const CAP_NOTE = "(diff truncated at the 10k output cap for the model)";
-/** a dash-led message word would reach git as a flag (the quoting keeps bare dash-led words) — refused before any git call */
-const DASH_NOTE = "a commit message cannot start with -; quote it or begin with a word — git would read a dash-led message as a flag, so nothing was committed";
-
-export const COMMIT_SYSTEM =
-  "You write git commit messages. Reply with the commit message only: a first line `type(scope): summary` in the imperative mood, " +
-  "at most 72 characters, type one of feat, fix, refactor, docs, test, chore, perf, build, ci, style; then, only when the change needs it, " +
-  "one blank line and a short body. No quotes, no code fences, no commentary.";
-
-// ------------------------------------------------------------------ shell quoting + git through the seam
-
-/** POSIX single-quoting for one argv word (the executor runs the line through bash); safe words pass bare */
-export function shellQuote(word: string): string {
-  return /^[A-Za-z0-9_./:=@%+,-]+$/.test(word) ? word : `'${word.replace(/'/g, "'\\''")}'`;
-}
-
-/** the exact bash line a git argv becomes — exported so tests can pin the emitted command */
-export function gitCommand(args: readonly string[]): string {
-  return ["git", ...args.map(shellQuote)].join(" ");
-}
-
-export interface GitResult {
-  /** the bash tool ran (a refusal — policy, hook, a denied card — leaves it false) */
-  executed: boolean;
-  /** the human saw the approval card */
-  asked: boolean;
-  /** the tool's `exit=N` header; -1 when absent */
-  exit: number;
-  /** the output minus that header */
-  body: string;
-  /** the body filled the bash tool's output cap — a diff this long is a prefix, not the whole change */
-  capped: boolean;
-  command: string;
-}
-
-/** One git invocation through the ONE bash tool dispatch — the session's rules + buildCfg's approval chain; `detail`
- *  is what the approval card shows above the verdicts (the drafted commit message). Never spawns anything itself. */
-export async function runGit(ctx: GitCmdCtx, args: readonly string[], signal: AbortSignal, detail?: string): Promise<GitResult> {
-  const command = gitCommand(args);
-  const call: ToolCallPart = { kind: "tool_call", id: `git-${randomUUID().slice(0, 8)}`, tool: "bash", args: { command } };
-  let asked = false, executed = false;
-  // the SAME chain a model-issued bash call gets: buildCfg wraps the surface's approver in the rules,
-  // execpolicy and the hooks. The wrapper IS the card: /commit's detail (the drafted message) is what
-  // the card shows above the verdicts, and `asked` records that the human was reached so a policy
-  // refusal is never misreported as their denial.
-  const human = ctx.approve();
-  const cfg = ctx.rt.buildCfg(ctx.yolo(), human === undefined ? undefined : async (req) => {
-    asked = true;
-    return (await ctx.renderer.askApproval(req.tool, JSON.stringify(req.revisedArgs).slice(0, 140), detail)) === "deny" ? "deny" : "once";
-  });
-  const toolCtx: ToolContext = { sessionId: ctx.store().id, cwd: ctx.rt.cwd, signal, permissions: { effect: "allow" } };
-  const { renderer } = ctx;
-  // the app's per-event Renderer calls (shell-cmd.ts idiom): onEvent FIRST for a renderer that owns its rows (sextant);
-  // a policy refusal (no card) is corrected to the honest detail so neither surface says "user denied" for it
-  const emit = (raw: RunEvent): void => {
-    const ev = raw.type === "tool_call_failed" && !asked && raw.detail === "user denied" ? { ...raw, detail: REFUSED_DETAIL } : raw;
-    renderer.onEvent?.(ev);
-    if (ev.type === "tool_execution_start") renderer.toolStart(ev.callId, ev.tool, JSON.stringify(ev.args).slice(0, 120));
-    else if (ev.type === "tool_execution_update") renderer.toolUpdate(ev.callId, ev.note);
-    else if (ev.type === "tool_execution_end") { executed = true; renderer.toolEnd(ev.callId, ev.ok, ev.output.slice(0, 160).replace(/\n/g, " ⏎ "), ev.durationMs); }
-    else if (ev.type === "tool_call_failed") renderer.toolEnd(ev.callId, false, `${ev.reason}: ${ev.detail}`.slice(0, 160), 0);
-  };
-  // no loop guard: the user's own commands are not a model loop
-  const out = await ctx.rt.registry.dispatch(call, toolCtx, ctx.rt.hooks, cfg.permissionRules, cfg.approval, emit, undefined);
-  const m = /^exit=(-?\d+)\r?\n?/.exec(out.output);
-  const raw = m ? out.output.slice(m[0].length) : out.output;
-  return { executed, asked, exit: m ? Number(m[1]) : -1, body: raw.replace(/\r\n/g, "\n"), capped: raw.length >= OUTPUT_CAP_CHARS, command };
-}
-
-const firstLine = (s: string): string => s.trim().split("\n")[0] ?? "";
-const refusalNote = (r: GitResult, signal: AbortSignal): string =>
-  signal.aborted ? "was interrupted before it ran" : r.asked ? "was denied at the approval card" : "was refused before any approval prompt (exec policy, a permission rule or a hook)";
-/** a failed git call as one honest line: the first real output line (the executor's `stderr:` label skipped); outside a
- *  repository `git diff` degrades to `--no-index` usage (exit 129) or says "not a git repository" (128) — name the cwd then */
-export function gitFailure(r: GitResult, cwd: string): string {
-  const line = r.body.split("\n").map((l) => l.trim()).find((l) => l !== "" && l !== "stderr:") ?? "no output";
-  const notRepo = /not a git repository|--no-index/.test(r.body);
-  return `${r.command.split(" ").slice(0, 2).join(" ")} failed (exit ${r.exit}): ${line}${notRepo ? ` — ${cwd} is not inside a git repository` : ""}`;
-}
-
-// ------------------------------------------------------------------ the commit message
-
-/** strip the wrappers models add around a message: code fences, surrounding quotes, a `commit message:` label */
-export function cleanMessage(raw: string): string {
-  let t = raw.replace(/\r\n/g, "\n").trim();
-  const fence = /^```[^\n]*\n([\s\S]*?)\n?```$/.exec(t);
-  if (fence) t = fence[1]!.trim();
-  t = t.replace(/^commit message:\s*/i, "");
-  if ((t.startsWith('"') && t.endsWith('"')) || (t.startsWith("'") && t.endsWith("'"))) t = t.slice(1, -1).trim();
-  return t.split("\n").map((l) => l.trimEnd()).join("\n").replace(/\n{3,}/g, "\n\n").trim();
-}
-
-/** ONE stream invocation on the COMMIT role's model (router: ROVECODE_MODEL_COMMIT, else the default chain) — a system
- *  message + the diff; the terminal turn's text is the draft. Errors come back structured, never thrown. */
-export async function draftMessage(ctx: GitCmdCtx, diff: string, model: ModelRef, signal: AbortSignal): Promise<{ text: string } | { error: string }> {
-  const stream = ctx.rt.stream;
-  if (!stream) return { error: "no provider configured — nothing can draft a message" };
-  const now = Date.now();
-  const sys: Message = { id: randomUUID(), role: "system", parts: [{ kind: "text", text: COMMIT_SYSTEM }], parentId: null, createdAt: now };
-  const user: Message = { id: randomUUID(), role: "user", parts: [{ kind: "text", text: `Write the commit message for this diff:\n\n${diff}` }], parentId: sys.id, createdAt: now };
-  let turn: AssistantTurn | null = null;
-  try { for await (const ev of stream(model, [sys, user], { signal })) if (ev.type === "turn") turn = ev.turn; }
-  catch (e) { return { error: `commit model failed: ${e instanceof Error ? e.message : String(e)}` }; }
-  if (signal.aborted) return { error: "interrupted while drafting the message" };
-  if (!turn) return { error: "commit model returned no turn" };
-  if (turn.stopReason === "error") return { error: `commit model failed: ${turn.error ?? "error"}` };
-  const text = cleanMessage(partsText(turn.parts));
-  return text ? { text } : { error: "the commit model returned an empty message" };
-}
-
-/** file paths named by a unified diff's `diff --git a/x b/x` headers — the card's file list without a second git call */
-export function diffFiles(diff: string): string[] {
-  const out: string[] = [];
-  for (const m of diff.matchAll(/^diff --git a\/(.+?) b\/(.+)$/gm)) out.push(m[2]!);
-  return out;
-}
-
-// ------------------------------------------------------------------ /commit
-
-/** /commit [message] — see the header. `rawArg` is the raw remainder of the typed line (newlines intact: a body). */
-export async function cmdCommit(ctx: GitCmdCtx, rawArg = ""): Promise<void> {
-  const { renderer } = ctx;
-  if (ctx.busy()) { renderer.addSystemNote(BUSY_NOTE, "warn"); return; }
-  const given = rawArg.replace(/\r\n/g, "\n").trim();
-  if (given.startsWith("-")) { renderer.addSystemNote(DASH_NOTE, "warn"); return; }
-  const ac = new AbortController();
-  ctx.setBusy(true);
-  ctx.bindAbort(ac);
-  renderer.setBusy(true, "collecting the diff…");
-  let outcome: "done" | "error" = "error";
-  try {
-    // 1. the staged diff (allow-listed argv → no card under gated rules); nothing staged → the working-tree diff of tracked files
-    const staged = await runGit(ctx, ["diff", "--cached"], ac.signal);
-    if (!staged.executed) { renderer.addSystemNote(`\`${staged.command}\` ${refusalNote(staged, ac.signal)} — nothing committed`, "warn"); return; }
-    if (staged.exit !== 0) { renderer.addSystemNote(gitFailure(staged, ctx.rt.cwd), "error"); return; }
-    let scope: "staged" | "working" = "staged", diff = staged.body, capped = staged.capped;
-    if (!diff.trim()) {
-      const work = await runGit(ctx, ["diff"], ac.signal);
-      if (!work.executed) { renderer.addSystemNote(`\`${work.command}\` ${refusalNote(work, ac.signal)} — nothing committed`, "warn"); return; }
-      if (work.exit !== 0) { renderer.addSystemNote(gitFailure(work, ctx.rt.cwd), "error"); return; }
-      if (!work.body.trim()) { renderer.addSystemNote("nothing to commit — the index and the tracked working tree are clean (untracked files need `git add` first)"); outcome = "done"; return; }
-      scope = "working"; diff = work.body; capped = work.capped;
-      renderer.addSystemNote("nothing staged — committing the working-tree changes to tracked files instead (`git commit -a`)");
-    }
-    // a complete diff names every file in its headers; a capped one is a prefix, so the card's list comes from git itself
-    // (`--name-only`, the same allow-listed reader through the seam) and both the model and the human are told it was cut
-    let files = diffFiles(diff);
-    if (capped) {
-      const named = await runGit(ctx, scope === "working" ? ["diff", "--name-only"] : ["diff", "--cached", "--name-only"], ac.signal);
-      if (named.executed && named.exit === 0) files = named.body.split("\n").map((l) => l.trim()).filter((l) => l !== "");
-    }
-    // 2. the message: given → no model call; else ONE stream invocation on the COMMIT role's model
-    let message = given, drafted = "";
-    if (!message) {
-      const model = ctx.rt.router.resolve("commit");
-      renderer.setBusy(true, `drafting the commit message (${model.model})…`);
-      const d = await draftMessage(ctx, capped ? `${diff}\n… ${CAP_NOTE}` : diff, model, ac.signal);
-      if ("error" in d) { renderer.addSystemNote(`${d.error} — pass the message yourself: /commit <message>`, "error"); return; }
-      message = d.text; drafted = `${model.provider}/${model.model}`;
-      if (message.startsWith("-")) { renderer.addSystemNote(`the drafted message starts with - (${firstLine(message)}); ${DASH_NOTE}`, "error"); return; }
-    }
-    // 3. the commit through the seam — the card shows the message; never --amend, never --no-verify
-    renderer.setBusy(true, "committing…");
-    const detail = [
-      `commit message${drafted ? ` (drafted by ${drafted}${given ? "" : " — deny to edit it in the prompt"})` : ""}:`,
-      ...message.split("\n").map((l) => `  ${l}`),
-      "",
-      scope === "working" ? "scope: working-tree changes to tracked files (git commit -a)" : "scope: the staged changes",
-      `files (${files.length}): ${files.slice(0, 12).join(", ")}${files.length > 12 ? ", …" : ""}`,
-      ...(capped ? [CAP_NOTE] : []),
-    ].join("\n");
-    const r = await runGit(ctx, scope === "working" ? ["commit", "-a", "-m", message] : ["commit", "-m", message], ac.signal, detail);
-    if (!r.executed) {
-      renderer.addSystemNote(`commit ${refusalNote(r, ac.signal)} — nothing committed`, "warn");
-      if (r.asked && !ac.signal.aborted) { renderer.prefillEditor(`/commit ${message}`); renderer.addSystemNote("the message is in the prompt — edit it and press Enter to commit"); }
-      return;
-    }
-    if (r.exit !== 0) { renderer.addSystemNote(`${gitFailure(r, ctx.rt.cwd)}\n${r.body.trim().split("\n").slice(-8).join("\n")}`, "error"); return; }
-    outcome = "done";
-    renderer.addSystemNote(`committed ${firstLine(r.body) || firstLine(message)}${drafted ? ` · message by ${drafted}` : ""}`);
-  } finally {
-    ctx.bindAbort(null);
-    renderer.setBusy(false, outcome);
-    ctx.setBusy(false);
-  }
-}
-
-// ------------------------------------------------------------------ /undo
-
-const when = (c: Checkpoint): string => new Date(c.createdAt).toLocaleTimeString();
-const ident = (c: Checkpoint): string => `${c.hash.slice(0, 8)} (${c.label}, ${when(c)})`;
-const STATUS_WORD: Record<string, string> = { M: "rewritten", D: "recreated", A: "removed (added since that checkpoint)", "?": "removed (created after the checkpoint)" };
-
-/** /undo — step the workspace back one snapshot (see the header): confirmation card first, conversation untouched. */
-export async function cmdUndo(ctx: GitCmdCtx): Promise<void> {
-  const { renderer } = ctx;
-  if (ctx.busy()) { renderer.addSystemNote(BUSY_NOTE, "warn"); return; }
-  const cp = await ctx.rt.checkpointsFor(ctx.store().id);
-  if (!cp) { renderer.addSystemNote("checkpoints unavailable (git missing or ROVECODE_NO_CHECKPOINTS=1) — nothing to undo", "warn"); return; }
-  const last = cp.list().at(-1);
-  if (!last) { renderer.addSystemNote("no checkpoint to undo to — snapshots land after each mutating tool call (edit, write, bash)"); return; }
-  // where the workspace sits: AT a snapshot → its pre-edit ancestor is the target (the agent's last change); drifted → the last snapshot
-  const pos = await cp.position();
-  const target = pos.at ? pos.previous : last;
-  if (!target) { renderer.addSystemNote(`nothing to undo — the workspace matches checkpoint ${ident(pos.at!)} and no older snapshot differs from it (/checkpoints lists them; /restore <ref> reaches any)`); return; }
-  const id = ident(target);
-  const changes = await cp.changedSince(target.hash);
-  if (changes !== null && changes.length === 0) { renderer.addSystemNote(`nothing to undo — the workspace already matches the last checkpoint ${id}`); return; }
-  const head = pos.at ? `undo the agent's last change (checkpoint ${pos.at.hash.slice(0, 8)}, ${pos.at.label}): restore ${id}` : `restore the workspace to checkpoint ${id}`;
-  const detail = changes === null
-    ? `${head}: every file goes back to that snapshot (the change list could not be computed)`
-    : [`${head} — ${changes.length} path${changes.length === 1 ? "" : "s"}:`, ...changes.slice(0, 40).map((c) => `  ${c.status} ${c.path} — ${STATUS_WORD[c.status] ?? c.status}`), ...(changes.length > 40 ? [`  … ${changes.length - 40} more`] : []), "", "the conversation is untouched; /restore <ref> conversation branches it too"].join("\n");
-  const answer = await renderer.askApproval("undo", `restore checkpoint ${target.hash.slice(0, 8)} · files only`, detail);
-  if (answer === "deny") { renderer.addSystemNote("undo cancelled — nothing changed", "warn"); return; }
-  const res = await cp.restore(target.hash, "files");
-  if (!res.ok) { renderer.addSystemNote(`undo failed: ${res.error}`, "error"); return; }
-  const what = changes === null ? "the workspace" : `${changes.length} path${changes.length === 1 ? "" : "s"}: ${changes.slice(0, 8).map((c) => c.path).join(", ")}${changes.length > 8 ? ", …" : ""}`;
-  renderer.addSystemNote(`undo: restored ${what} to checkpoint ${id} — files only; the conversation is untouched (snapshots keep history: /checkpoints)`);
-}