rovecode 0.3.3 → 0.4.0-beta.3

package/src/lanes/opencode.ts

@@ -1,122 +0,0 @@
-/** opencode lane adapter (#47) — agentic-clis.md §2 "opencode · opencode run", flags verified 2026-09-02:
- *    opencode run "<goal>" --format json --dir <dir>     (+ -s <session> · + --attach <url> · + -m <model>)
- *  LIVE-VERIFIED 2026-09-03 against opencode 1.18.23 on Windows (fixture opencode-live-run.jsonl): `--format
- *  json` prints FLAT lines `{type, timestamp, sessionID, part}` where `type` is the part kind — `step_start`,
- *  `text`, `tool_use`, `step_finish` (reasoning parts: same shape, not yet seen live) — and `part` is the SDK
- *  part object (`part.type` step-start | text | tool | step-finish). Text parts arrive once, complete
- *  (`time.end`); a tool part carries `tool`, `state.{status,input,output,metadata}`; a step-finish part
- *  carries `reason` ("tool-calls" = more steps follow, "stop" = the turn is over — the process then exits 0,
- *  there is NO idle event) plus `tokens{input,output,cache{read,write}}` and `cost` (per step: summed by the
- *  runner). A provider that cannot be reached prints NOTHING (opencode retries it in its own log file) —
- *  the job's silent-lane note and the wall-clock cutter are the only signals. The `{type:"message.part.*",
- *  properties:{part}}` / `session.idle` / `permission.*` shapes below are the SDK `client.event.subscribe()`
- *  stream (synthetic fixture opencode.jsonl, the future `opencode serve` port) — kept, not live-verified.
- *  Permissions live in opencode's own config (`permission: "allow"` on the verified box auto-approved the
- *  write; an ask under `--format json` was not observed). SIGINT ends the turn → interruptFirst. */
-
-import type { AgentAdapter, LaneCommand, LaneEvent, LaneOpts, LaneParseState, LaneTask } from "./types.ts";
-import { clip, num, obj, parseJsonLine, str, toolEvent, usageFrom } from "./events.ts";
-
-function argv(prompt: string, opts: LaneOpts, session?: string): LaneCommand {
-  const args = ["run", prompt, "--format", "json", "--dir", opts.cwd];
-  if (session) args.push("-s", session);
-  if (opts.attach) args.push("--attach", opts.attach);
-  if (opts.model) args.push("-m", opts.model);
-  return { bin: "opencode", args, cwd: opts.cwd };
-}
-
-/** the flat `run --format json` line types (1.18.23) — each carries the part under `part` */
-const FLAT: ReadonlySet<string> = new Set(["step_start", "step-start", "text", "reasoning", "tool_use", "tool", "step_finish", "step-finish"]);
-
-type Seen = Record<string, string>;
-const seen = (st: LaneParseState): Seen => (st.scratch["parts"] ??= {}) as Seen;
-const ref = (st: LaneParseState): { sessionId?: string } => (st.sessionId ? { sessionId: st.sessionId } : {});
-
-function part(p: Record<string, unknown>, st: LaneParseState): LaneEvent[] {
-  const sid = str(p["sessionID"]) ?? str(p["sessionId"]);
-  if (sid) st.sessionId = sid;
-  const type = str(p["type"]);
-  switch (type) {
-    case "text": case "reasoning": {
-      // parts are re-sent as they grow: emit a text part once, when it is finished (time.end) or
-      // carries no timing at all, and never the same text twice for one part id
-      const text = (str(p["text"]) ?? "").trim();
-      const time = obj(p["time"]);
-      if (!text || (time && time["end"] === undefined)) return [];
-      const id = str(p["id"]) ?? text;
-      if (seen(st)[id] === text) return [];
-      seen(st)[id] = text;
-      if (type === "reasoning") return [{ kind: "log", text: `thinking: ${clip(text, 160)}` }];
-      st.lastText = text;
-      return [{ kind: "log", text }];
-    }
-    case "tool": {
-      const state = obj(p["state"]);
-      const status = str(state?.["status"]);
-      const name = str(p["tool"]) ?? "tool";
-      if (status === "error") return [{ kind: "log", text: `tool ${name} error: ${clip(str(state?.["error"]) ?? str(state?.["output"]), 120)}` }];
-      if (status !== "completed") return [];
-      const exit = num(obj(state?.["metadata"])?.["exit"]);
-      // one tool part is updated repeatedly (running → completed, fixture opencode.jsonl lines 2-3 share
-      // callID call_1): the CLI's own callID is the dedupe key, and `completed` is what makes a write real
-      const callId = str(p["callID"]) ?? str(p["id"]);
-      return [toolEvent(name, obj(state?.["input"]), clip(str(state?.["output"]), 120) || undefined, exit, { wrote: true, ...(callId !== undefined ? { callId } : {}) })];
-    }
-    case "step-finish": case "step_finish": {
-      const usage = usageFrom(p["tokens"], p);
-      const out: LaneEvent[] = usage ? [{ kind: "usage", usage }] : [];
-      // live: "tool-calls" → another step follows; "stop" → the turn is complete (the CLI exits right after)
-      const reason = str(p["reason"]);
-      if (reason === "stop") out.push({ kind: "done", summary: st.lastText ?? "", ...ref(st) });
-      else if (reason === "error" || reason === "length" || reason === "content-filter") out.push({ kind: "fail", error: `step finished: ${reason}`, ...ref(st) });
-      return out;
-    }
-    default:
-      return [];
-  }
-}
-
-export const opencodeAdapter: AgentAdapter = {
-  id: "opencode",
-  interruptFirst: true,
-  command: (task: LaneTask, opts: LaneOpts) => argv(task.goal, opts, opts.resume),
-  resume: (sessionId: string, followUp: string, opts: LaneOpts) => argv(followUp, opts, sessionId),
-  permissionSummary: (opts) => `permissions per opencode config (asks surface as lane events)${opts.attach ? ` · attach ${opts.attach}` : ""} · worktree`,
-  parse(line: string, st: LaneParseState): LaneEvent[] {
-    const o = parseJsonLine(line);
-    const type = o ? str(o["type"]) : undefined;
-    if (!o || !type) { st.garbage++; return []; }
-    const props = obj(o["properties"]) ?? o;
-    const sid = str(props["sessionID"]) ?? str(props["sessionId"]) ?? str(obj(props["info"])?.["sessionID"]);
-    if (sid) st.sessionId = sid;
-    // the CLI's flat shape (verified): the part rides at the top level
-    if (FLAT.has(type)) {
-      const p = obj(o["part"]);
-      return p ? part(p, st) : [];
-    }
-    if (type.startsWith("message.part.")) {
-      const p = obj(props["part"]) ?? obj(o["part"]);
-      return p ? part(p, st) : [];
-    }
-    if (type.startsWith("permission.")) {
-      const title = str(props["title"]) ?? str(obj(props["permission"])?.["title"]) ?? str(props["type"]) ?? "permission";
-      return [{ kind: "ask", text: title }];
-    }
-    switch (type) {
-      case "message.updated": {
-        const info = obj(props["info"]);
-        const usage = usageFrom(info?.["tokens"], info);
-        return usage && str(info?.["role"]) !== "user" ? [{ kind: "usage", usage }] : [];
-      }
-      case "session.idle":
-        return [{ kind: "done", summary: st.lastText ?? "", ...ref(st) }];
-      case "session.error": case "error": {
-        const e = obj(props["error"]) ?? obj(o["error"]);
-        const message = str(obj(e?.["data"])?.["message"]) ?? str(e?.["message"]) ?? str(props["message"]) ?? str(e?.["name"]) ?? "error";
-        return [{ kind: "fail", error: message, ...ref(st) }];
-      }
-      default:
-        return [];
-    }
-  },
-};

package/src/lanes/process.ts

@@ -1,184 +0,0 @@
-/** Streaming child-process seam for external lanes (#47). The executor's bunRunner (core/executor.ts)
- *  buffers stdout until exit; a lane needs its JSONL LINE BY LINE while it runs, so this is the
- *  streaming twin riding the SAME kill path: on Windows the launcher goes into a Job Object right after
- *  spawn (core/win-job.ts, KILL_ON_JOB_CLOSE — a rovecode crash takes the tree with it), kill() is
- *  TerminateJobObject plus a `taskkill /T /F` sweep of a live pid, and a normal exit release()s the job
- *  (executor.ts:122-149 choreography); POSIX (#67) spawns the CLI `detached` (its own process group, via
- *  core/proc-group.ts groupSpawnOptions) and kill() is SIGTERM to the GROUP (killGroup, `-pid`) then to the
- *  CLI itself as the fallback — the same choreography as bunRunner's POSIX abort, so a CLI's own tool children
- *  die with it (not live-verified from the Windows box). interrupt() is SIGINT, the "finish the turn"
- *  signal claude/opencode honor — deliverable on POSIX only: Bun's Windows kill() is TerminateProcess
- *  whatever the signal name, so on win32 interrupt() reports false and the runner goes straight to the
- *  tree kill. Lines are bounded (MAX_LINE_BYTES; longer ones are cut) and the reader can be abandoned
- *  when an orphan outside the job keeps the pipe open (executor.ts ABORT_GRACE_MS idiom).
- *  `bunLaneSpawn` is `makeLaneSpawn()` over an injectable `LaneSpawnDeps` (platform, spawn, kill, createJob —
- *  makeRunner's RunnerDeps shape; production passes nothing), so the POSIX branch is pinned BEHAVIOURALLY
- *  under `platform: "linux"` with a fake spawn (test/unit/lanes-process-group.test.ts) while the real-process
- *  pins run the Windows branch. Runner tests inject a fake LaneProcess — never a real CLI. */
-
-import { groupSpawnOptions, killGroup } from "../core/proc-group.ts";
-import type { KillFn, SpawnedProc } from "../core/proc-group.ts";
-import { createWinJob, type WinJob } from "../core/win-job.ts";
-import type { LaneCommand } from "./types.ts";
-
-export interface LaneProcess {
-  pid: number;
-  /** stdout as lines (newline stripped); ends at EOF or abandon() */
-  lines(): AsyncIterable<string>;
-  /** resolves with the exit code; 143 when killed */
-  exited: Promise<number>;
-  /** SIGINT-style "finish the turn": true when delivered, false when not deliverable here */
-  interrupt(): boolean;
-  /** tree kill (Job Object + taskkill sweep on win32; SIGTERM on POSIX); idempotent */
-  kill(): void;
-  /** drop our stdout end so lines() ends even if something still holds the pipe */
-  abandon(): void;
-  /** bounded stderr tail for failure reports */
-  stderrTail(): string;
-}
-
-export type LaneSpawn = (cmd: LaneCommand) => LaneProcess;
-
-export const MAX_LINE_BYTES = 1 << 20;
-const STDERR_TAIL = 2_000;
-
-/** A lane is a NEW top-level CLI session, never a child of the Claude Code session rovecode itself may be
- *  running in. When rovecode is launched from a Claude Code terminal the environment carries `CLAUDECODE=1`
- *  and the parent session's plumbing under `CLAUDE_CODE_*` — verified on 2026-09-03 (claude 2.1.257,
- *  Windows): 25 names including the session id, the host-session id, the host-managed-provider marker +
- *  the name of its auth env var, the messaging socket AND its token, and the child-session marker. A
- *  nested `claude -p` did start under them (no refusal observed), but a lane must never present itself as
- *  the parent session's child nor carry its credentials, so both patterns are dropped (case-insensitive:
- *  Windows env names are) before `cmd.env` is applied. The other CLIs ignore these names — unconditional.
- *  EXCEPT the claude CLI's own DOCUMENTED user knobs, which share the prefix but are the user's
- *  configuration, not the host session's — KEPT_ENV_EXACT is checked before the prefix rule (a lane the
- *  user authenticated the documented token way otherwise got the CLI's "Not logged in" with no hint).
- *  Each name verified 2026-09-03 against `claude --help` (2.1.257) or code.claude.com/docs:
- *    CLAUDE_CODE_OAUTH_TOKEN            docs/en/authentication — `claude setup-token`, the headless/CI login
- *                                       (precedence rank 5; `--bare` never reads it: key-only)
- *    CLAUDE_CODE_USE_BEDROCK / _USE_VERTEX / _USE_FOUNDRY
- *                                       docs/en/authentication — third-party-provider auth (rank 1)
- *    CLAUDE_CODE_SIMPLE                 `--help --bare`: "Sets CLAUDE_CODE_SIMPLE=1"
- *    CLAUDE_CODE_SAFE_MODE              `--help --safe-mode`: "Sets CLAUDE_CODE_SAFE_MODE=1"
- *    CLAUDE_CODE_MAX_OUTPUT_TOKENS      docs/en/env-vars
- *    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC   docs/en/env-vars
- *  None of the 24 names an enclosing session exported on this box is on the list (CLAUDE_CODE_OAUTH_SCOPES,
- *  _HOST_AUTH_ENV_VAR, _SESSION_ID, _MESSAGING_TOKEN, … are plumbing and stay dropped). */
-export const SCRUBBED_ENV_EXACT: readonly string[] = ["CLAUDECODE"];
-export const SCRUBBED_ENV_PREFIX = "CLAUDE_CODE_";
-/** documented claude knobs under the scrubbed prefix — the user's, not the host session's; pass through */
-export const KEPT_ENV_EXACT: readonly string[] = [
-  "CLAUDE_CODE_OAUTH_TOKEN",
-  "CLAUDE_CODE_USE_BEDROCK", "CLAUDE_CODE_USE_VERTEX", "CLAUDE_CODE_USE_FOUNDRY",
-  "CLAUDE_CODE_SIMPLE", "CLAUDE_CODE_SAFE_MODE",
-  "CLAUDE_CODE_MAX_OUTPUT_TOKENS", "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC",
-];
-export function laneChildEnv(parent: Record<string, string | undefined>, extra?: Record<string, string>): Record<string, string> {
-  const out: Record<string, string> = {};
-  for (const [k, v] of Object.entries(parent)) {
-    if (v === undefined) continue;
-    const key = k.toUpperCase();
-    if (!KEPT_ENV_EXACT.includes(key) && (SCRUBBED_ENV_EXACT.includes(key) || key.startsWith(SCRUBBED_ENV_PREFIX))) continue;
-    out[k] = v;
-  }
-  return { ...out, ...(extra ?? {}) };
-}
-
-/** Split a byte stream into lines; a line over MAX_LINE_BYTES is cut (the rest is dropped). */
-export async function* splitLines(reader: ReadableStreamDefaultReader<Uint8Array>): AsyncGenerator<string> {
-  const dec = new TextDecoder();
-  let buf = "", dropping = false;
-  try {
-    for (;;) {
-      const c = await reader.read();
-      if (c.done) break;
-      buf += dec.decode(c.value, { stream: true });
-      for (let nl = buf.indexOf("\n"); nl >= 0; nl = buf.indexOf("\n")) {
-        let line = buf.slice(0, nl);
-        buf = buf.slice(nl + 1);
-        if (dropping) { dropping = false; continue; } // the tail of a line already cut below
-        if (line.endsWith("\r")) line = line.slice(0, -1);
-        yield line.length > MAX_LINE_BYTES ? line.slice(0, MAX_LINE_BYTES) : line;
-      }
-      if (buf.length > MAX_LINE_BYTES) { yield buf.slice(0, MAX_LINE_BYTES); buf = ""; dropping = true; }
-    }
-    buf += dec.decode();
-    if (buf && !dropping) yield buf;
-  } catch {
-    /* cancelled reader (abandon) — end the stream */
-  }
-}
-
-// ---------- #67: the injectable process seam (makeRunner's RunnerDeps, twinned) ----------
-
-/** The options object handed to spawn — tests pin it byte-for-byte (the Windows shape must never gain a key). */
-export interface LaneSpawnOptions {
-  cwd?: string; env?: Record<string, string>; stdin?: Blob | "ignore";
-  stdout: "pipe" | "ignore"; stderr: "pipe" | "ignore"; detached?: boolean;
-}
-export type LaneSpawnFn = (argv: string[], options: LaneSpawnOptions) => SpawnedProc;
-
-export interface LaneSpawnDeps {
-  /** defaults to process.platform — "win32" selects the Job Object path, anything else the group path */
-  platform?: NodeJS.Platform;
-  /** defaults to Bun.spawn (the CLI and the win32 taskkill sweep both go through it) */
-  spawn?: LaneSpawnFn;
-  /** defaults to process.kill (killGroup's own default) — `kill(-pid, signal)` addresses the group */
-  kill?: KillFn;
-  /** defaults to win-job.ts createWinJob (Windows only) */
-  createJob?: () => WinJob | null;
-}
-
-const defaultSpawn: LaneSpawnFn = (argv, options) => Bun.spawn(argv, options) as unknown as SpawnedProc;
-
-/** Build the lane seam over `deps` (production: none — `bunLaneSpawn` below); the choreography is the header's. */
-export function makeLaneSpawn(deps: LaneSpawnDeps = {}): LaneSpawn {
-  const platform = deps.platform ?? process.platform;
-  const spawn = deps.spawn ?? defaultSpawn;
-  const kill = deps.kill; // undefined → killGroup's default (process.kill)
-  const createJob = deps.createJob ?? createWinJob;
-  const win = platform === "win32";
-  return (cmd) => {
-    const proc = spawn([cmd.bin, ...cmd.args], {
-      cwd: cmd.cwd,
-      env: laneChildEnv(process.env, cmd.env),
-      stdin: cmd.stdin !== undefined ? new Blob([cmd.stdin]) : "ignore",
-      stdout: "pipe", stderr: "pipe",
-      ...groupSpawnOptions(platform), // #67: POSIX `detached: true` (own process group); nothing on win32
-    });
-    let job: WinJob | null = win ? createJob() : null;
-    if (job && !job.assign(proc.pid)) job = null; // fail-safe: taskkill-only, as bunRunner reports "taskkill-only"
-    let killed = false, reader: ReadableStreamDefaultReader<Uint8Array> | null = null;
-    let err = "";
-    void (async () => {
-      const r = proc.stderr.getReader(), dec = new TextDecoder();
-      for (let c = await r.read(); !c.done; c = await r.read()) err = (err + dec.decode(c.value, { stream: true })).slice(-STDERR_TAIL);
-    })().catch(() => {});
-    const exited = proc.exited.then((code) => (killed ? 143 : code)).finally(() => { if (killed) job?.terminate(); else job?.release(); });
-    return {
-      pid: proc.pid,
-      exited,
-      lines: () => splitLines((reader = proc.stdout.getReader())),
-      interrupt() {
-        if (win || proc.exitCode !== null) return false;
-        try { proc.kill("SIGINT"); return true; } catch { return false; }
-      },
-      kill() {
-        if (killed) return;
-        killed = true;
-        if (win) {
-          job?.terminate();
-          if (proc.exitCode === null) { try { spawn(["taskkill", "/T", "/F", "/PID", String(proc.pid)], { stdout: "ignore", stderr: "ignore" }); } catch { /* best-effort sweep */ } }
-        } else {
-          killGroup(proc.pid, "SIGTERM", kill); // #67: the whole group first (bunRunner's POSIX abort order) …
-          try { proc.kill("SIGTERM"); } catch { /* already gone */ } // … then the CLI itself as the fallback
-        }
-      },
-      abandon() { reader?.cancel().catch(() => {}); },
-      stderrTail: () => err.trim(),
-    };
-  };
-}
-
-/** Default seam: the process's own platform, Bun.spawn, process.kill, the real Job Object. */
-export const bunLaneSpawn: LaneSpawn = makeLaneSpawn();

package/src/lanes/progress.ts

@@ -1,183 +0,0 @@
-/** What a RUNNING lane has actually done (#47 follow-up): tool calls made, files written, tokens
- *  burned — folded from the same LaneEvents the log ring renders, so nothing new is parsed and nothing
- *  parsed is thrown away. Today job.ts collapses the whole stream into a log-tail string; this keeps the
- *  structure beside it so a surface can show "12 calls · 3 files · 5.3k in / 900 out" while the CLI is
- *  still running, instead of one log line whose meaning depends on which CLI produced it.
- *
- *  Three rules, each of which is a way this could lie:
- *
- *  1. A CALL IS COUNTED ONCE. Two of the four CLIs report the same call twice — codex emits
- *     `item.started` then `item.completed` for one `command_execution`, opencode updates one tool part
- *     from `running` to `completed` — so a fold that counted events would climb at twice the rate for
- *     those two and nobody would notice, because there is no independent number to compare it against.
- *     Dedupe is by the adapter's own call id (`callId`: claude's `tool_use.id`, codex's `item.id`,
- *     opencode's `callID`). An event with no id counts as its own call, which is the honest reading for
- *     agy, whose stream carries no ids at all.
- *
- *  2. A FILE IS "WRITTEN" ONLY WHEN THE CLI SAID SO. `edit` events are issued at the tool CALL for
- *     claude (a `tool_use` block), so a path appearing in one means the model asked, not that anything
- *     changed — a refused, failed or hallucinated edit looks identical. Only an event carrying
- *     `wrote: true` counts, which each adapter sets exactly where its own CLI confirms the write
- *     (claude: a `tool_result` for that call id without `is_error`; codex: a `file_change` item whose
- *     status is completed; opencode: a tool part whose state is `completed`). agy confirms nothing —
- *     its `step_update` carries no result and its own header records that `status: SUCCESS` is not
- *     proof of work — so an agy lane reports 0 files written LIVE, and that is the truthful answer to
- *     "what do we know right now" rather than a guess dressed as a count.
- *
- *  3. THE PATCH IS THE ONLY PROOF AT THE END. When the lane finishes, its worktree diff names the files
- *     that really changed (`filesFromPatch`), which no stream can contradict: it is the tree. job.ts
- *     replaces the live list with that one, so a finished lane's count is measured, and the live count
- *     is understood as "what the CLI has told us so far". For agy this is the only count it ever gets.
- *
- *  4. A MEASURED WRITE IS NOT A LANDED WRITE. Every lane writes into its OWN worktree, and only a lane
- *     that finished has its patch merged back into the parent tree. So "the diff names these files" and
- *     "these files changed in your repo" are different claims, and three reachable cases separate them:
- *     a cancelled lane, a failed one, and — the one that is easy to miss — a lane that finished cleanly
- *     whose patch would not apply, because a concurrent task had already touched the same lines. That
- *     last one still reports `ok`, so status alone cannot tell you it landed. `applied` carries the
- *     answer from the code that did the applying: absent while the lane runs (nothing has been offered
- *     to the tree yet), true once the merge-back succeeded, false when the writes stayed in a worktree
- *     that was then deleted. Anything reading `filesWritten` as "your repo changed" must read this too.
- *
- *  Usage is folded through events.ts addUsage and stays ABSENT when the CLI reported none — the same
- *  rule the OTel lane spans keep (telemetry/otel-lanes.ts): a lane that burned tokens we failed to read
- *  must not look identical to one that burned none. */
-
-import type { TokenUsage } from "../core/types.ts";
-import { addUsage } from "./events.ts";
-import type { LaneEvent } from "./types.ts";
-
-/** Paths kept by name; past this only the count grows (a thousand-file refactor must not be held in
- *  memory per lane, and no surface shows more than a handful). */
-export const MAX_TRACKED_FILES = 100;
-
-export interface LaneProgress {
-  /** distinct tool calls the CLI has reported (deduped by call id; see rule 1) */
-  toolCalls: number;
-  /** files the CLI CONFIRMED it wrote, sorted, at most MAX_TRACKED_FILES of them (see rule 2) */
-  filesWritten: readonly string[];
-  /** how many confirmed writes there were in total — ≥ filesWritten.length once the cap is hit */
-  filesWrittenTotal: number;
-  /** absent when the CLI reported no usage at all (see the header) */
-  usage?: TokenUsage;
-  /** whether these files reached the PARENT tree (rule 4): absent while the lane is still running,
-   *  `true` once its patch merged back, `false` when it was cancelled, failed, or finished with a patch
-   *  that would not apply. Not derivable from status — a done lane's patch can still fail to apply. */
-  applied?: boolean;
-}
-
-/** The running fold. One per lane; the runner owns it and hands out snapshots. */
-export class LaneTally {
-  private readonly calls = new Set<string>();
-  /** calls with no id of their own — counted, not deduped (agy) */
-  private anonymousCalls = 0;
-  private readonly files = new Set<string>();
-  private filesTotal = 0;
-  private usage: TokenUsage | undefined;
-
-  /** Fold one event. Anything that is not a tool call, a confirmed write or usage is ignored — a `log`,
-   *  `progress`, `ask`, `done` or `fail` event tells us nothing countable, and guessing from their text
-   *  is how a counter starts drifting. */
-  add(ev: LaneEvent): void {
-    switch (ev.kind) {
-      case "edit":
-        this.countCall(ev.callId);
-        if (ev.wrote === true && !this.files.has(ev.path)) {
-          this.filesTotal += 1;
-          if (this.files.size < MAX_TRACKED_FILES) this.files.add(ev.path);
-        }
-        return;
-      case "bash":
-      case "tool":
-        this.countCall(ev.callId);
-        return;
-      case "usage":
-        this.usage = addUsage(this.usage, ev.usage);
-        return;
-      default:
-        return;
-    }
-  }
-
-  private countCall(callId: string | undefined): void {
-    if (callId === undefined || callId === "") this.anonymousCalls += 1;
-    else this.calls.add(callId);
-  }
-
-  /** An immutable snapshot — safe to hand to a surface that keeps it across frames. */
-  snapshot(): LaneProgress {
-    return {
-      toolCalls: this.calls.size + this.anonymousCalls,
-      filesWritten: [...this.files].sort(),
-      filesWrittenTotal: this.filesTotal,
-      ...(this.usage ? { usage: { ...this.usage } } : {}),
-    };
-  }
-
-  /** Replace the live file list with the measured one (job.ts, once the worktree diff exists). */
-  withFiles(paths: readonly string[]): LaneProgress {
-    const sorted = [...new Set(paths)].sort();
-    return {
-      ...this.snapshot(),
-      filesWritten: sorted.slice(0, MAX_TRACKED_FILES),
-      filesWrittenTotal: sorted.length,
-    };
-  }
-}
-
-/** Files a unified diff actually changes — the proof at the end (rule 3).
- *
- *  Reads the `diff --git a/<x> b/<y>` headers rather than the `+++` lines, because a deletion's `+++` is
- *  `/dev/null` and a rename's two sides differ: `b/` is the path that exists after the patch, `a/` the
- *  one that existed before, and a delete is only visible under `a/`. Quoted paths (git quotes anything
- *  with a space or a non-ASCII byte) are unquoted; a header we cannot read is skipped rather than
- *  guessed at, so a strange path is missing from the list instead of poisoning it. */
-export function filesFromPatch(patch: string): string[] {
-  const out = new Set<string>();
-  for (const line of patch.split(/\r?\n/)) {
-    if (!line.startsWith("diff --git ")) continue;
-    const rest = line.slice("diff --git ".length);
-    const pair = splitDiffPair(rest);
-    if (pair === null) continue;
-    const [a, b] = pair;
-    const path = b === "/dev/null" ? a : b;
-    if (path !== "" && path !== "/dev/null") out.add(path);
-  }
-  return [...out].sort();
-}
-
-/** `a/x b/y` → ["x", "y"], honouring git's quoting; null when the halves cannot be told apart. */
-function splitDiffPair(rest: string): [string, string] | null {
-  if (rest.startsWith('"')) {
-    const close = findQuoteEnd(rest);
-    if (close === -1) return null;
-    const first = unquote(rest.slice(0, close + 1));
-    const tail = rest.slice(close + 1).trimStart();
-    const second = tail.startsWith('"') ? unquote(tail) : tail;
-    return [strip(first), strip(second)];
-  }
-  // unquoted: split on " b/" so a path containing a space still resolves (git only quotes when it must,
-  // but a repository can carry `a/my file b/my file`)
-  const at = rest.indexOf(" b/");
-  if (at === -1) {
-    const sp = rest.indexOf(" ");
-    return sp === -1 ? null : [strip(rest.slice(0, sp)), strip(rest.slice(sp + 1))];
-  }
-  return [strip(rest.slice(0, at)), strip(rest.slice(at + 1))];
-}
-
-const findQuoteEnd = (s: string): number => {
-  for (let i = 1; i < s.length; i++) {
-    if (s[i] === "\\") { i++; continue; }
-    if (s[i] === '"') return i;
-  }
-  return -1;
-};
-
-const unquote = (s: string): string => {
-  const inner = s.startsWith('"') ? s.slice(1, s.lastIndexOf('"')) : s;
-  return inner.replace(/\\(.)/g, "$1");
-};
-
-/** drop the `a/` or `b/` prefix git puts on both halves */
-const strip = (p: string): string => (/^[ab]\//.test(p) ? p.slice(2) : p);