tumwater 0.4.0 → 0.4.2

package/dist/src/build/build-check-scoped.js

@@ -5,34 +5,11 @@ import { MERGE_SCOPES, SCOPE_WORDS, buildCheckEvent, buildCheckSkipWarning, runW
 import { CHECK_TIER, withCheckPermit } from "../concurrency/check-permit.js";
 import { sampleHostLoad, sampleSleepClock } from "./host-sleep.js";
 import { npmInstall } from "./dep-install.js";
-/** Run the project's declared check for a named scope — the detect → run → build_check event →
- * skip-warning sequence the review gate's pre-check (scope "gate"), the merge path's in-lock
- * re-check (scope "merge"), and the batch merger's one check over the whole stacked tree (scope
- * "batch") previously each ran inline, kept in one place so the event's shape and the skip warning
- * cannot drift between them. Split out of build-check.ts — which keeps the check's execution and
- * outcome classification (runBuildCheck, BuildCheckOutcome) — because orchestration is its own
- * concern: the permit, the event emission, the verdict-less retry, the merge-scope unverified
- * remapping, and the skip warning. Every run is an event with its cost: the deterministic checks
- * are where the team's compute goes after the authoring run, and "how long does npm test take per
- * merge" must be answerable from the feed, not by timing it by hand. Returns null when no check is
- * declared (nothing to run — the caller passes, exactly as before this split), otherwise the
- * declared check plus its classified outcome. A "skipped" outcome also logs its standard warning
- * here (wording keyed on the scope, the timeout as actually set — and, when its deadline fired
- * late, as actually enforced); "failed" and "passed" are the caller's to decide (deterministic
- * reject vs. verifiedHead / baseline seeding). A timeout or signal kill at a merge scope is
- * remapped to a deterministic "failed" — the tree is unverified, so it must not merge. A check
- * killed by a signal the harness did not send is retried once at any scope — the first run's death
- * says nothing about the tree (it is another run's `pkill`), so one verdict from a clean attempt is
- * owed before the skip is honored; a timeout whose deadline demonstrably fired late (the harness's
- * own host-sleep evidence) earns that same one retry at any scope, and a failed run the host slept
- * through does too; each attempt is priced as its own build_check event, carrying when the check
- * itself ran (buildCheckRunFields). A configured `check.gateCommand` replaces the command at scope
- * "gate" only (same cwd and timeout); the in-lock command (Fast merge "Defaults", mergeCommandOf) —
- * `check.mergeCommand` when set, else `check.gateCommand`, else the full check — replaces it at the
- * merge and batch scopes, and those events then carry `full: false`. The red-main baseline, which
- * detects on its own, keeps running check.command. `permitWait` hears
- * about a wait for the check permit (the merge cell's "waiting for a check slot"). Never throws. */
-export async function runScopedBuildCheck(root, role, scope, wt, config, timeoutMs = BUILD_CHECK_TIMEOUT_MS, sampleSleep = sampleSleepClock, install = npmInstall, permitWait, sampleLoad = sampleHostLoad) {
+/** Resolve which command to detect for a scope and the effective deadline it runs under — the
+ * command-swap/detect rule (gateCommandOf/mergeCommandOf over detectBuildCheck), the
+ * merge-scope starved deadline, and the cheaper flag. Returns null when no check is declared
+ * (nothing to run). */
+function resolveScopedCheck(wt, scope, config, timeoutMs, sampleLoad) {
     const swapped = scope === "gate" ? gateCommandOf(config) : MERGE_SCOPES.has(scope) ? mergeCommandOf(config) : undefined;
     const check = detectBuildCheck(wt, swapped === undefined ? config : { check: { ...config?.check, command: swapped } });
     if (!check)
@@ -50,6 +27,12 @@ export async function runScopedBuildCheck(root, role, scope, wt, config, timeout
         ? starvedDeadlineMs(checkTimeoutMs(check, timeoutMs), load)
         : checkTimeoutMs(check, timeoutMs);
     const runCheck = { ...check, timeoutMs: effectiveMs };
+    return { check, cheaper, runCheck, effectiveMs, load };
+}
+/** Run the resolved check under one permit, with the one clean retry for a verdict-less death —
+ * the one-permit-two-attempt rule. Prices the first attempt as its own build_check event and
+ * returns the final outcome and its run duration. */
+async function runScopedCheckWithRetry(root, role, scope, wt, runCheck, timeoutMs, config, sampleSleep, install, permitWait, cheaper) {
     // One permit covers both attempts (the killed-check retry re-runs under the permit it
     // holds); durationMs prices the run itself, not the wait for a permit.
     let durationMs = 0;
@@ -70,6 +53,12 @@ export async function runScopedBuildCheck(root, role, scope, wt, config, timeout
         granted: () => permitWait?.granted?.(),
         waited: (waitedMs, parked) => logCheckWaitEvent(root, role, scope, waitedMs, parked),
     }, `${role} ${scope}`);
+    return { raw, durationMs };
+}
+/** Classify the raw outcome: the merge-scope skip and slept-through rules become a deterministic
+ * unverified reject; anything else passes through. Never logs — the caller warns (see
+ * warnScopedCheck). Returns the unverified reason only when a rule fired. */
+function unverifiedOutcomeFor(scope, check, raw, effectiveMs, load, durationMs) {
     // A signal kill at a merge scope, or a timeout whose deadline fired on time (real slowness, a
     // genuinely hung or oversized suite), made no verdict about the tree — and this is the check
     // whose whole job is to catch a semantic conflict before it merges, so it rejects
@@ -89,6 +78,8 @@ export async function runScopedBuildCheck(root, role, scope, wt, config, timeout
         (((raw.status === "skipped" &&
             (raw.skipReason === "timeout" || raw.skipReason === "killed" || raw.skipReason === "install")) ||
             sleepFailed));
+    if (!unverifiedSkip)
+        return { outcome: raw, unverifiedReason: null };
     const unverifiedReason = raw.skipReason === "install"
         ? installFailedPhrase(SCOPE_WORDS[scope].label, raw.install, UNVERIFIED_TREE)
         : raw.skipReason === "killed"
@@ -99,17 +90,19 @@ export async function runScopedBuildCheck(root, role, scope, wt, config, timeout
                 // An on-time kill (the late-deadline wording already names its own cause) names the
                 // starved host when the load average says the team was the check's competition.
                 (raw.run?.deadlineLateMs ?? 0) > DEADLINE_LATE_TOLERANCE_MS ? "" : loadedHostPhrase(load)}`;
-    const outcome = unverifiedSkip
-        ? {
-            status: "failed",
-            script: checkScriptName(check),
-            outputTail: [unverifiedReason],
-            run: raw.run,
-            unverified: true,
-            ...(raw.install ? { install: raw.install } : {}),
-        }
-        : raw;
-    logEventBestEffort(root, buildCheckEvent(role, scope, outcome, durationMs, cheaper));
+    const outcome = {
+        status: "failed",
+        script: checkScriptName(check),
+        outputTail: [unverifiedReason],
+        run: raw.run,
+        unverified: true,
+        ...(raw.install ? { install: raw.install } : {}),
+    };
+    return { outcome, unverifiedReason };
+}
+/** Warn for the two verdict-less roads: a skipped check (buildCheckSkipWarning) or an unverified
+ * merge reject. Reads the scope word table and the killed signal. */
+function warnScopedCheck(root, role, scope, outcome, effectiveMs, durationMs, unverifiedReason) {
     if (outcome.status === "skipped") {
         // Environmental — deliberately NOT fail-closed, so a hung build script cannot wedge every
         // code run into the 3-strike discard (gate) or a merge behind the merge lock.
@@ -118,8 +111,44 @@ export async function runScopedBuildCheck(root, role, scope, wt, config, timeout
             ? { signal: outcome.killedBy, durationMs }
             : undefined, outcome.run, outcome.install));
     }
-    else if (unverifiedSkip) {
+    else if (unverifiedReason) {
         warnEventBestEffort(root, role, `${unverifiedReason}; rejecting the merge`);
     }
-    return { check, outcome };
+}
+/** Run the project's declared check for a named scope — the detect → run → build_check event →
+ * skip-warning sequence the review gate's pre-check (scope "gate"), the merge path's in-lock
+ * re-check (scope "merge"), and the batch merger's one check over the whole stacked tree (scope
+ * "batch") previously each ran inline, kept in one place so the event's shape and the skip warning
+ * cannot drift between them. Split out of build-check.ts — which keeps the check's execution and
+ * outcome classification (runBuildCheck, BuildCheckOutcome) — because orchestration is its own
+ * concern: the permit, the event emission, the verdict-less retry, the merge-scope unverified
+ * remapping, and the skip warning. Every run is an event with its cost: the deterministic checks
+ * are where the team's compute goes after the authoring run, and "how long does npm test take per
+ * merge" must be answerable from the feed, not by timing it by hand. Returns null when no check is
+ * declared (nothing to run — the caller passes, exactly as before this split), otherwise the
+ * declared check plus its classified outcome. A "skipped" outcome also logs its standard warning
+ * here (wording keyed on the scope, the timeout as actually set — and, when its deadline fired
+ * late, as actually enforced); "failed" and "passed" are the caller's to decide (deterministic
+ * reject vs. verifiedHead / baseline seeding). A timeout or signal kill at a merge scope is
+ * remapped to a deterministic "failed" — the tree is unverified, so it must not merge. A check
+ * killed by a signal the harness did not send is retried once at any scope — the first run's death
+ * says nothing about the tree (it is another run's `pkill`), so one verdict from a clean attempt is
+ * owed before the skip is honored; a timeout whose deadline demonstrably fired late (the harness's
+ * own host-sleep evidence) earns that same one retry at any scope, and a failed run the host slept
+ * through does too; each attempt is priced as its own build_check event, carrying when the check
+ * itself ran (buildCheckRunFields). A configured `check.gateCommand` replaces the command at scope
+ * "gate" only (same cwd and timeout); the in-lock command (Fast merge "Defaults", mergeCommandOf) —
+ * `check.mergeCommand` when set, else `check.gateCommand`, else the full check — replaces it at the
+ * merge and batch scopes, and those events then carry `full: false`. The red-main baseline, which
+ * detects on its own, keeps running check.command. `permitWait` hears
+ * about a wait for the check permit (the merge cell's "waiting for a check slot"). Never throws. */
+export async function runScopedBuildCheck(root, role, scope, wt, config, timeoutMs = BUILD_CHECK_TIMEOUT_MS, sampleSleep = sampleSleepClock, install = npmInstall, permitWait, sampleLoad = sampleHostLoad) {
+    const r = resolveScopedCheck(wt, scope, config, timeoutMs, sampleLoad);
+    if (!r)
+        return null;
+    const { raw, durationMs } = await runScopedCheckWithRetry(root, role, scope, wt, r.runCheck, timeoutMs, config, sampleSleep, install, permitWait, r.cheaper);
+    const { outcome, unverifiedReason } = unverifiedOutcomeFor(scope, r.check, raw, r.effectiveMs, r.load, durationMs);
+    logEventBestEffort(root, buildCheckEvent(role, scope, outcome, durationMs, r.cheaper));
+    warnScopedCheck(root, role, scope, outcome, r.effectiveMs, durationMs, unverifiedReason);
+    return { check: r.check, outcome };
 }

package/dist/src/change/change-data.js

@@ -10,6 +10,7 @@ import { knownRoleIdsCached, loadConfigSafe } from "../config/config.js";
 import { aheadOfMain, branchExists, countCommitsInRange, currentBranch, targetBranch } from "../git/git.js";
 import { gitTry } from "../git/git-run.js";
 import { aheadOfMainDiff, aheadOfMainFiles, changedFiles } from "../git/git-diff.js";
+import { compareCodeUnits } from "../collections.js";
 import { isAbsolute } from "node:path";
 import { branchName } from "../paths.js";
 import { isUsableWorktree } from "../git/worktree.js";
@@ -152,7 +153,8 @@ async function cappedWorkingDiff(wt, spec = []) {
     return (`[uncommitted diff truncated: the full diff is ${full.length} bytes; showing --stat]\n\n` + stat);
 }
 /** The paths two or more distinct roles hold: a role's duplicate path counts once, roles stay
- * in holdings order, paths sort by plain `<` comparison. */
+ * in holdings order, paths sort in code-unit order (`compareCodeUnits`, the locale-independent
+ * order a plain `<` comparison gives). */
 export function fileOverlaps(holdings) {
     const byPath = new Map();
     for (const { role, files } of holdings) {
@@ -166,7 +168,7 @@ export function fileOverlaps(holdings) {
     }
     return [...byPath.entries()]
         .filter(([, roles]) => roles.length >= 2)
-        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .sort(([a], [b]) => compareCodeUnits(a, b))
         .map(([path, roles]) => ({ path, roles }));
 }
 /** Keep only the overlaps naming a listed role; each kept entry still names every holder. */

package/dist/src/cli/cli-args.js

@@ -341,6 +341,15 @@ export function durationLabel(ms) {
     }
     return rest === 0 ? parts.join("") : `${ms}ms`;
 }
+/** The human phrase for a two-ended time window — `between 2h and 1h ago` — the shape
+ * `--since/--until` windows share with the history TUI and `history`'s bounded empties.
+ * Unbounded windows keep their own "last …"/"in …" phrasing; only the two-ended form is
+ * folded here so the three sites cannot drift. The two bounds are labeled in caller order
+ * (older before newer at every current site), and each is run through durationLabel, so a
+ * phrase always echoes a form the parser accepts. Lives beside durationLabel for that reason. */
+export function betweenWindow(older, newer) {
+    return `between ${durationLabel(older)} and ${durationLabel(newer)} ago`;
+}
 /** The shared over-cap check for duration-valued flags: fail with the one message shape —
  * `<flag> is capped at <max label> (got <value label>)` — so every capped duration names
  * both bounds in the same phrasing and the sites cannot drift apart (the same idiom the

package/dist/src/cli/cli-command-args.js

@@ -247,19 +247,19 @@ const PROMPT_FLAG_SPECS = [
     { names: ["--attach"], value: true, valueName: "<path>" },
     { names: ["--grep"], value: true, valueName: "<text>" },
 ];
-/** `tumwater prompt` argument handling, following parseInitArgs' pattern. Like init's,
- * positionals are free-form prompt content — but a double-dash token must be a real flag
- * (`--role <id>`, `--list`, `--json`, `--grep <text>`, `--cancel <n>`, `--edit <n>`,
- * `--top <n>`, `--file <path>`, `--at <duration>`), or
- * it would be baked into the queued prompt (the same class of bug parseInitArgs fixed: today
- * `tumwater prompt --foo text` enqueues "--foo text"). Single-dash positionals remain prompt
- * content. `--list`, `--cancel`, `--edit` and `--top` are mutually exclusive and may
- * not combine with positional text; `--role` is accepted in every mode and is never
- * prompt content. `--at <duration>` (PLANS.md "tumwater prompt --at <duration>") only queues
- * a prompt: it defers delivery — parsed here with parseDurationFlag, riding the enqueue as
- * the queue file's not-before marker — so the read-only and destructive modes refuse it
- * rather than silently ignore it. */
-export function parsePromptArgs(args) {
+/** The six `--list`/`--cancel`/`--edit`/`--top` mode pairs that may not combine, in today's
+ * exact order. */
+const PROMPT_MODE_EXCLUSIONS = [
+    ["--list", "--cancel"],
+    ["--list", "--edit"],
+    ["--cancel", "--edit"],
+    ["--list", "--top"],
+    ["--cancel", "--top"],
+    ["--edit", "--top"],
+];
+/** The flag-vocabulary gate and the once-check: the unknown-double-dash gate, the ten index
+ * collections and rejectDuplicateFlags's once-check all ride here, one scan, one home. */
+function scanPromptFlags(args) {
     // The unknown-double-dash gate reads PROMPT_FLAG_SPECS, so the list its error names admits
     // exactly what the duplicate-flag check below accepts — one vocabulary, one message renderer.
     rejectUnknownDoubleDash("prompt", args, PROMPT_FLAG_SPECS);
@@ -276,21 +276,30 @@ export function parsePromptArgs(args) {
     // --attach is repeatable: every occurrence claims itself and its value token, like --role's
     // single pair, so the pairs ride out of the prompt text in every mode.
     const attachFlags = args.flatMap((a, i) => (a === "--attach" ? [i] : []));
+    const roleFlag = args.indexOf("--role");
     const known = PROMPT_FLAG_SPECS.flatMap((s) => s.names).filter((f) => f !== "--attach"); // repeatable: the once-check skips it
     rejectDuplicateFlags(args, known);
-    if (listFlag >= 0 && cancelFlag >= 0)
-        fail("--list and --cancel are mutually exclusive");
-    if (listFlag >= 0 && editFlag >= 0)
-        fail("--list and --edit are mutually exclusive");
-    if (cancelFlag >= 0 && editFlag >= 0)
-        fail("--cancel and --edit are mutually exclusive");
-    if (listFlag >= 0 && topFlag >= 0)
-        fail("--list and --top are mutually exclusive");
-    if (cancelFlag >= 0 && topFlag >= 0)
-        fail("--cancel and --top are mutually exclusive");
-    if (editFlag >= 0 && topFlag >= 0)
-        fail("--edit and --top are mutually exclusive");
-    const roleFlag = args.indexOf("--role");
+    return { jsonFlags, listFlag, cancelFlag, editFlag, topFlag, fileFlag, atFlag, grepFlag, attachFlags, roleFlag };
+}
+/** The six mode mutual exclusions: the mutually-exclusive `--list`/`--cancel`/`--edit`/
+ * `--top` pairs, in the table's order, so the first failing pair reports as it did before. */
+function assertPromptModesDisjoint(scan) {
+    const index = {
+        "--list": scan.listFlag,
+        "--cancel": scan.cancelFlag,
+        "--edit": scan.editFlag,
+        "--top": scan.topFlag,
+    };
+    for (const [a, b] of PROMPT_MODE_EXCLUSIONS) {
+        // All four keys are always present in the object; ?? -1 just satisfies the strict
+        // indexed-access typing without changing the (never-undefined) compare.
+        if ((index[a] ?? -1) >= 0 && (index[b] ?? -1) >= 0)
+            fail(`${a} and ${b} are mutually exclusive`);
+    }
+}
+/** The `--role <id>` value pair: its raw value, its missing-value refusal and the pair it
+ * claims, verbatim. */
+function parsePromptRole(args, roleFlag) {
     const roleRaw = roleFlag >= 0 ? args[roleFlag + 1] : undefined;
     if (roleFlag >= 0 && (!roleRaw || roleRaw.startsWith("--")))
         fail(ROLE_VALUE_ERROR);
@@ -298,17 +307,30 @@ export function parsePromptArgs(args) {
     // The flag and its value are never prompt content: --role is a scope, not text. Only claimed
     // when actually present — negative indexes would over-claim real tokens.
     const roleClaim = roleFlag >= 0 ? [roleFlag, roleFlag + 1] : [];
+    return { role, roleClaim };
+}
+/** The `--json` list-only refusal: in enqueue or cancel mode it must never silently ride
+ * along as prompt text (or beside a state change). */
+function assertPromptJsonListOnly(scan) {
     // --json is list-only: in enqueue or cancel mode it must never silently ride along as
     // prompt text (or beside a state change), so it is refused before either branch runs.
-    if (jsonFlags.length > 0 && listFlag < 0)
+    if (scan.jsonFlags.length > 0 && scan.listFlag < 0)
         fail("--json only applies to --list");
-    if (grepFlag >= 0 && listFlag < 0)
+}
+/** The `--grep <text>` value pair and its list-only refusal, verbatim. */
+function parsePromptGrep(args, scan) {
+    if (scan.grepFlag >= 0 && scan.listFlag < 0)
         fail("--grep only applies to --list");
-    const grepRaw = grepFlag >= 0 ? args[grepFlag + 1] : undefined;
-    if (grepFlag >= 0 && (!grepRaw || grepRaw.startsWith("--"))) {
+    const grepRaw = scan.grepFlag >= 0 ? args[scan.grepFlag + 1] : undefined;
+    if (scan.grepFlag >= 0 && (!grepRaw || grepRaw.startsWith("--"))) {
         fail("--grep needs text (usage: tumwater prompt --list --grep <text>)");
     }
-    const grepClaim = grepFlag >= 0 ? [grepFlag, grepFlag + 1] : [];
+    const grepClaim = scan.grepFlag >= 0 ? [scan.grepFlag, scan.grepFlag + 1] : [];
+    return { grepRaw, grepClaim };
+}
+/** The queue-only-mode refusals: --file and --at have nothing to mean except in the enqueue
+ * mode, and --attach is refused by --list and --cancel (--edit accepts it). */
+function assertPromptQueueOnlyFlags(scan) {
     // The queue-only flags --file and --at have nothing to mean in the read-only and destructive
     // modes (--list and --cancel): --file is the file-shaped twin of free-form text (--edit
     // accepts it as its replacement text, so the editFlag test below exempts that one mode), and
@@ -318,16 +340,16 @@ export function parsePromptArgs(args) {
     // predicate and the `<flag> only queues a prompt` wording, so a new mode or queue-only flag
     // is added here.
     const refuseQueueOnlyFlag = (flag, present) => {
-        if (present && (listFlag >= 0 || cancelFlag >= 0 || editFlag >= 0 || topFlag >= 0))
+        if (present && (scan.listFlag >= 0 || scan.cancelFlag >= 0 || scan.editFlag >= 0 || scan.topFlag >= 0))
             fail(`${flag} only queues a prompt`);
     };
-    refuseQueueOnlyFlag("--file", fileFlag >= 0 && editFlag < 0);
-    refuseQueueOnlyFlag("--at", atFlag >= 0);
-    refuseQueueOnlyFlag("--attach", attachFlags.length > 0 && editFlag < 0);
-    // An edit keeps the target prompt's existing deferral exactly as it was (the marker is
-    // plumbing the edit carries over), so a --at alongside it has nothing to mean.
-    // The pair is claimed like --role's: the flag and its value are never prompt content.
-    const atClaim = atFlag >= 0 ? [atFlag, atFlag + 1] : [];
+    refuseQueueOnlyFlag("--file", scan.fileFlag >= 0 && scan.editFlag < 0);
+    refuseQueueOnlyFlag("--at", scan.atFlag >= 0);
+    refuseQueueOnlyFlag("--attach", scan.attachFlags.length > 0 && scan.editFlag < 0);
+}
+/** The `--attach <path>` value pair(s): every occurrence claims itself and its value token,
+ * with the missing-value refusal, verbatim. */
+function parsePromptAttachments(args, attachFlags) {
     // Each --attach pair claims the flag and its value; a trailing flag with no value names the
     // flag here, like --cancel's missing-value wording, before any queue write.
     const attachPaths = attachFlags.map((i) => args[i + 1]);
@@ -336,6 +358,14 @@ export function parsePromptArgs(args) {
         if (args[i + 1] === undefined)
             fail(`--attach needs a path (e.g. \`--attach shot.png\`)`);
     }
+    return { attachPaths, attachClaims };
+}
+/** The `--at <duration>` parse and its 90-day cap, verbatim. */
+function parsePromptDeferral(args, atFlag) {
+    // An edit keeps the target prompt's existing deferral exactly as it was (the marker is
+    // plumbing the edit carries over), so a --at alongside it has nothing to mean.
+    // The pair is claimed like --role's: the flag and its value are never prompt content.
+    const atClaim = atFlag >= 0 ? [atFlag, atFlag + 1] : [];
     let atDelayMs = null;
     if (atFlag >= 0) {
         atDelayMs = parseDurationFlag("--at", args[atFlag + 1]);
@@ -344,75 +374,146 @@ export function parsePromptArgs(args) {
         // (about 106751991d from now) made notBeforeMarker's toISOString throw a raw RangeError.
         failOverDurationCap("--at", atDelayMs, PAUSE_FOR_MAX_MS);
     }
-    if (listFlag >= 0) {
-        failStrayArg(args, "with --list there is no prompt text", listFlag, ...jsonFlags, ...roleClaim, ...grepClaim);
-        return { mode: "list", role, json: jsonFlags.length > 0, grep: grepRaw ?? null };
-    }
-    if (cancelFlag >= 0) {
-        const n = parsePositionFlag("--cancel", args[cancelFlag + 1], "--cancel 2");
-        // The position is the only token --cancel may carry; anything else alongside it would be
-        // prompt text, and this mode has none.
-        failStrayArg(args, "with --cancel there is no prompt text", cancelFlag, cancelFlag + 1, ...roleClaim);
-        return { mode: "cancel", role, position: n };
-    }
-    if (editFlag >= 0) {
-        const n = parsePositionFlag("--edit", args[editFlag + 1], '--edit 2 "new text"');
-        // The --edit pair, the --role pair, and any --attach pairs are the only flags this mode
-        // claims. Tokens preceding --edit (other than a claimed flag) would be silently dropped —
-        // a mistyped command would edit prompt N with only the trailing fragment — so they are
-        // refused here by the same stray-argument wording the sibling modes use; tokens after the
-        // position are the replacement text, minus any claimed attach pair (none: edit in $EDITOR).
-        const fileClaim = fileFlag >= 0 ? [fileFlag, fileFlag + 1] : [];
-        for (let i = 0; i < editFlag; i++) {
-            if (roleClaim.includes(i) || attachClaims.includes(i) || fileClaim.includes(i))
-                continue;
-            fail(`unexpected argument ${JSON.stringify(args[i])} — with --edit the replacement text comes after the position`);
-        }
-        if (fileFlag >= 0) {
-            // The replacement comes from the file (`-` reads stdin), kept line for line; editPromptAtFile
-            // trims it. Typed text beside it would be ambiguous, so it is refused.
-            const file = promptFileValue(args[fileFlag + 1]);
-            failStrayArg(args, "with --file the replacement text comes from the file", editFlag, editFlag + 1, ...fileClaim, ...roleClaim, ...attachClaims);
-            return { mode: "edit", role, position: n, text: readPromptFileArg(file), attachPaths };
-        }
-        const textTokens = [];
-        for (let i = editFlag + 2; i < args.length; i++) {
-            if (roleClaim.includes(i) || attachClaims.includes(i))
-                continue;
-            textTokens.push(args[i]);
-        }
-        const text = textTokens.join(" ").trim();
-        // No text and no --file: the caller opens the prompt's current body in the editor.
-        return { mode: "edit", role, position: n, text: text === "" ? null : text, attachPaths };
+    return { atDelayMs, atClaim };
+}
+/** `tumwater prompt`'s flag scan and the checks it owns — everything shared by two or more
+ * modes, so a new mode or queue-only flag is added here: the unknown-double-dash gate, the
+ * index collection, the once-check, the six mutual exclusions, the --role pair, the
+ * --json/--grep list-only refusals, the queue-only-flag refusals, the --attach pairs and the
+ * --at parse and cap. Each job lives in one helper — scanPromptFlags, assertPromptModesDisjoint,
+ * parsePromptRole, assertPromptJsonListOnly, parsePromptGrep, assertPromptQueueOnlyFlags,
+ * parsePromptAttachments and parsePromptDeferral — so a check is found by name. Returns a
+ * struct the mode branches read. */
+function parsePromptFlags(args) {
+    const scan = scanPromptFlags(args);
+    assertPromptModesDisjoint(scan);
+    const { role, roleClaim } = parsePromptRole(args, scan.roleFlag);
+    assertPromptJsonListOnly(scan);
+    const { grepRaw, grepClaim } = parsePromptGrep(args, scan);
+    assertPromptQueueOnlyFlags(scan);
+    const { attachPaths, attachClaims } = parsePromptAttachments(args, scan.attachFlags);
+    const { atDelayMs, atClaim } = parsePromptDeferral(args, scan.atFlag);
+    return {
+        role,
+        jsonFlags: scan.jsonFlags,
+        listFlag: scan.listFlag,
+        cancelFlag: scan.cancelFlag,
+        editFlag: scan.editFlag,
+        topFlag: scan.topFlag,
+        fileFlag: scan.fileFlag,
+        grepRaw,
+        grepClaim,
+        roleClaim,
+        attachPaths,
+        attachClaims,
+        atDelayMs,
+        atClaim,
+    };
+}
+/** `--list`: the queue listing, optionally machine-readable and filtered by --grep. */
+function listPromptArgs(args, f) {
+    failStrayArg(args, "with --list there is no prompt text", f.listFlag, ...f.jsonFlags, ...f.roleClaim, ...f.grepClaim);
+    return { mode: "list", role: f.role, json: f.jsonFlags.length > 0, grep: f.grepRaw ?? null };
+}
+/** `--cancel <n>`: remove one entry by its 1-based queue position. */
+function cancelPromptArgs(args, f) {
+    const n = parsePositionFlag("--cancel", args[f.cancelFlag + 1], "--cancel 2");
+    // The position is the only token --cancel may carry; anything else alongside it would be
+    // prompt text, and this mode has none.
+    failStrayArg(args, "with --cancel there is no prompt text", f.cancelFlag, f.cancelFlag + 1, ...f.roleClaim);
+    return { mode: "cancel", role: f.role, position: n };
+}
+/** `--edit <n>`: rewrite one entry's text in place — the replacement is the --file contents,
+ * the tokens after the position, or (with neither) an editor open in the caller. */
+function editPromptArgs(args, f) {
+    const n = parsePositionFlag("--edit", args[f.editFlag + 1], '--edit 2 "new text"');
+    // The --edit pair, the --role pair, and any --attach pairs are the only flags this mode
+    // claims. Tokens preceding --edit (other than a claimed flag) would be silently dropped —
+    // a mistyped command would edit prompt N with only the trailing fragment — so they are
+    // refused here by the same stray-argument wording the sibling modes use; tokens after the
+    // position are the replacement text, minus any claimed attach pair (none: edit in $EDITOR).
+    const fileClaim = f.fileFlag >= 0 ? [f.fileFlag, f.fileFlag + 1] : [];
+    for (let i = 0; i < f.editFlag; i++) {
+        if (f.roleClaim.includes(i) || f.attachClaims.includes(i) || fileClaim.includes(i))
+            continue;
+        fail(`unexpected argument ${JSON.stringify(args[i])} — with --edit the replacement text comes after the position`);
     }
-    if (topFlag >= 0) {
-        const n = parsePositionFlag("--top", args[topFlag + 1], "--top 2");
-        // The position is the only token --top may carry; anything else alongside it would be
-        // prompt text, and this mode has none.
-        failStrayArg(args, "with --top there is no prompt text", topFlag, topFlag + 1, ...roleClaim);
-        return { mode: "top", role, position: n };
+    if (f.fileFlag >= 0) {
+        // The replacement comes from the file (`-` reads stdin), kept line for line; editPromptAtFile
+        // trims it. Typed text beside it would be ambiguous, so it is refused.
+        const file = promptFileValue(args[f.fileFlag + 1]);
+        failStrayArg(args, "with --file the replacement text comes from the file", f.editFlag, f.editFlag + 1, ...fileClaim, ...f.roleClaim, ...f.attachClaims);
+        return { mode: "edit", role: f.role, position: n, text: readPromptFileArg(file), attachPaths: f.attachPaths };
     }
-    if (fileFlag >= 0) {
-        // The file is the prompt: read it whole (a path of `-` reads stdin, so a pipe or heredoc
-        // works), following parseInitArgs' --file branch — the same claim/stray/read/empty shape,
-        // so the two commands speak one idiom. The stdin read is memoized at module level: cli.ts
-        // pre-parses prompt's args and cmdPrompt re-parses them, and a second readFileSync(0) on a
-        // drained pipe would see an empty prompt (readFileSync(0) fails with EAGAIN on a TTY's
-        // stdin; errorMessage names it, and the operator passes a real pipe instead).
-        const file = promptFileValue(args[fileFlag + 1]);
-        failStrayArg(args, "with --file the prompt comes from the file", fileFlag, fileFlag + 1, ...roleClaim, ...atClaim, ...attachClaims);
-        const contents = readPromptFileArg(file);
-        return { mode: "enqueue", role, text: contents, atDelayMs, attachPaths: attachPaths };
+    const textTokens = [];
+    for (let i = f.editFlag + 2; i < args.length; i++) {
+        if (f.roleClaim.includes(i) || f.attachClaims.includes(i))
+            continue;
+        textTokens.push(args[i]);
     }
+    const text = textTokens.join(" ").trim();
+    // No text and no --file: the caller opens the prompt's current body in the editor.
+    return { mode: "edit", role: f.role, position: n, text: text === "" ? null : text, attachPaths: f.attachPaths };
+}
+/** `--top <n>`: move one entry to the head of its role's queue. */
+function topPromptArgs(args, f) {
+    const n = parsePositionFlag("--top", args[f.topFlag + 1], "--top 2");
+    // The position is the only token --top may carry; anything else alongside it would be
+    // prompt text, and this mode has none.
+    failStrayArg(args, "with --top there is no prompt text", f.topFlag, f.topFlag + 1, ...f.roleClaim);
+    return { mode: "top", role: f.role, position: n };
+}
+/** `--file <path>`: enqueue the file's (or stdin's) whole contents as the prompt. */
+function filePromptArgs(args, f) {
+    // The file is the prompt: read it whole (a path of `-` reads stdin, so a pipe or heredoc
+    // works), following parseInitArgs' --file branch — the same claim/stray/read/empty shape,
+    // so the two commands speak one idiom. The stdin read is memoized at module level: cli.ts
+    // pre-parses prompt's args and cmdPrompt re-parses them, and a second readFileSync(0) on a
+    // drained pipe would see an empty prompt (readFileSync(0) fails with EAGAIN on a TTY's
+    // stdin; errorMessage names it, and the operator passes a real pipe instead).
+    const file = promptFileValue(args[f.fileFlag + 1]);
+    failStrayArg(args, "with --file the prompt comes from the file", f.fileFlag, f.fileFlag + 1, ...f.roleClaim, ...f.atClaim, ...f.attachClaims);
+    const contents = readPromptFileArg(file);
+    return { mode: "enqueue", role: f.role, text: contents, atDelayMs: f.atDelayMs, attachPaths: f.attachPaths };
+}
+/** The default mode: free-form text (minus the claimed --role/--at/--attach tokens) is joined
+ * and enqueued. */
+function enqueuePromptArgs(args, f) {
     // Everything except the --role pair and the --at pair is prompt text; the join keeps
     // multi-word requests as one string exactly like the pre-1/2 behavior.
     const text = args
-        .filter((_, i) => !roleClaim.includes(i) && !atClaim.includes(i) && !attachClaims.includes(i))
+        .filter((_, i) => !f.roleClaim.includes(i) && !f.atClaim.includes(i) && !f.attachClaims.includes(i))
         .join(" ")
         .trim();
     // Name the fix, like the sibling operator commands' usage errors (bug/plan carry their
     // BUG_USAGE/PLAN_USAGE lines): "prompt text required" alone never said what to type.
     if (!text)
         fail('prompt text required — usage: tumwater prompt "<text>" (add --role <id> to aim it at one role)');
-    return { mode: "enqueue", role, text, atDelayMs, attachPaths: attachPaths };
+    return { mode: "enqueue", role: f.role, text, atDelayMs: f.atDelayMs, attachPaths: f.attachPaths };
+}
+/** `tumwater prompt` argument handling, following parseInitArgs' pattern. Like init's,
+ * positionals are free-form prompt content — but a double-dash token must be a real flag
+ * (`--role <id>`, `--list`, `--json`, `--grep <text>`, `--cancel <n>`, `--edit <n>`,
+ * `--top <n>`, `--file <path>`, `--at <duration>`), or
+ * it would be baked into the queued prompt (the same class of bug parseInitArgs fixed: today
+ * `tumwater prompt --foo text` enqueues "--foo text"). Single-dash positionals remain prompt
+ * content. `--list`, `--cancel`, `--edit` and `--top` are mutually exclusive and may
+ * not combine with positional text; `--role` is accepted in every mode and is never
+ * prompt content. `--at <duration>` (PLANS.md "tumwater prompt --at <duration>") only queues
+ * a prompt: it defers delivery — parsed here with parseDurationFlag, riding the enqueue as
+ * the queue file's not-before marker — so the read-only and destructive modes refuse it
+ * rather than silently ignore it. */
+export function parsePromptArgs(args) {
+    const f = parsePromptFlags(args);
+    if (f.listFlag >= 0)
+        return listPromptArgs(args, f);
+    if (f.cancelFlag >= 0)
+        return cancelPromptArgs(args, f);
+    if (f.editFlag >= 0)
+        return editPromptArgs(args, f);
+    if (f.topFlag >= 0)
+        return topPromptArgs(args, f);
+    if (f.fileFlag >= 0)
+        return filePromptArgs(args, f);
+    return enqueuePromptArgs(args, f);
 }

package/dist/src/cli/cli-flag-specs.js

@@ -98,6 +98,11 @@ export const ROLE_FLAG = {
     valueName: "<id>",
     missingValue: ROLE_VALUE_ERROR,
 };
+/** The `--all` flag spec, taken only by `tumwater abort` (`abort --all` aborts every enabled
+ * role in one request). A valueless targeting flag, so its spec carries only its spelling; the
+ * abort command body keeps the --role-vs--all rivalry rule. Every other marker command keeps
+ * its own flag set, so `pause --all` and the rest still fail as unknown flags. */
+export const ABORT_ALL_FLAG = { names: ["--all"] };
 /** The missing-value error for `logs --transcript` (LOGS_TRANSCRIPT_FLAG's trailing gate). */
 export const LOGS_TRANSCRIPT_VALUE_ERROR = "--transcript needs a role id (e.g. `--transcript feature`)";
 /** The `--transcript <id>` flag spec of `logs`: the role whose agent transcript to print. A
@@ -252,11 +257,8 @@ export function hasFollowFlag(args) {
 /** The `--ready` flag spec, accepted by `backlog`: keep only the entries no hold keeps from
  * being picked. Value-less, like STAT_FLAG. */
 export const READY_FLAG = { names: ["--ready"] };
-/** Force re-probing of every claimed image-input model in `tumwater doctor` (part 2/5),
- * bypassing the 7-day cache: `--reprobe` (a value-less flag like JSON_FLAG). */
-export const REPROBE_FLAG = { names: ["--reprobe"] };
 /** The `--problems` flag spec, accepted by `doctor`: print only the warn and fail rows. Value-less,
- * like REPROBE_FLAG. */
+ * like KILL_ORPHANS_FLAG. */
 export const PROBLEMS_FLAG = { names: ["--problems"] };
 /** The `--kill-orphans` flag spec, accepted by `doctor`: first kill the orphaned processes the
  * orphans check lists, each with its descendants. Value-less, like PROBLEMS_FLAG. */

package/dist/src/cli/cli-marker-commands.js

@@ -1,4 +1,4 @@
-import { DRY_RUN_FLAG, JSON_FLAG, durationFlagSpec, PAUSE_FOR_OVERFLOW_HINT, REASON_FLAG, WAKE_CANCEL_FLAG, WAKE_LIST_FLAG, WAKE_IN_FLAG, rejectUnknownArgs, ROLE_FLAG, } from "./cli-flag-specs.js";
+import { ABORT_ALL_FLAG, DRY_RUN_FLAG, JSON_FLAG, durationFlagSpec, PAUSE_FOR_OVERFLOW_HINT, REASON_FLAG, WAKE_CANCEL_FLAG, WAKE_LIST_FLAG, WAKE_IN_FLAG, rejectUnknownArgs, ROLE_FLAG, } from "./cli-flag-specs.js";
 import { requireReadyRepo } from "./cli-repo-gate.js";
 import { cmdAbort, cmdPause, cmdReclaim, cmdResetCounters, cmdRestart, cmdResume, cmdWake } from "../operator/operator-commands.js";
 /** The CLI command layer of each marker command, keyed by its CLI name (the command bodies
@@ -31,7 +31,7 @@ export async function runMarkerCommand(root, command, args) {
     const perCommandFlags = {
         "reset-counters": [ROLE_FLAG],
         wake: [ROLE_FLAG, WAKE_IN_FLAG, WAKE_CANCEL_FLAG, WAKE_LIST_FLAG, JSON_FLAG],
-        abort: [ROLE_FLAG],
+        abort: [ROLE_FLAG, ABORT_ALL_FLAG],
         pause: [
             ROLE_FLAG,
             durationFlagSpec("pause --for", PAUSE_FOR_OVERFLOW_HINT),