fix: add --dry-run for rewind, fix test fixtures, remove dependabot

- Remove dependabot configuration
- Add --dry-run flag to rewind command (preview without executing)
- Fix search TUI test width for repo column truncation
- Fix golden file for compact transcript (strip empty tool results)
- Fix PII redaction thread safety with sync.Once
- Add atomic writes for session state files
- Fix token usage subagentsDir TODO

Author: Patel230

.github/dependabot.yml

@@ -47,6 +47,7 @@ func newRewindCmd() *cobra.Command {
 	var toFlag string
 	var logsOnlyFlag bool
 	var resetFlag bool
+	var dryRunFlag bool
 
 	cmd := &cobra.Command{
 		Use:   "rewind",
@@ -80,6 +81,9 @@ your agent's context.`,
 			if listFlag {
 				return runRewindList(ctx, w)
 			}
+			if dryRunFlag {
+				return runRewindDryRun(ctx, w, toFlag)
+			}
 			if toFlag != "" {
 				return runRewindToWithOptions(ctx, w, errW, toFlag, logsOnlyFlag, resetFlag)
 			}
@@ -91,6 +95,7 @@ your agent's context.`,
 	cmd.Flags().StringVar(&toFlag, "to", "", "Rewind to specific commit ID (non-interactive)")
 	cmd.Flags().BoolVar(&logsOnlyFlag, "logs-only", false, "Only restore logs, don't modify working directory (for logs-only points)")
 	cmd.Flags().BoolVar(&resetFlag, "reset", false, "Reset branch to commit (destructive, for logs-only points)")
+	cmd.Flags().BoolVar(&dryRunFlag, "dry-run", false, "Print what would be restored without actually doing it")
 
 	return cmd
 }
@@ -355,6 +360,41 @@ func runRewindInteractive(ctx context.Context, w, errW io.Writer) error { //noli
 	return nil
 }
 
+func runRewindDryRun(ctx context.Context, w io.Writer, commitID string) error {
+	start := GetStrategy(ctx)
+
+	points, err := start.GetRewindPoints(ctx, 50)
+	if err != nil {
+		return fmt.Errorf("failed to find rewind points: %w", err)
+	}
+
+	if commitID == "" && len(points) > 0 {
+		commitID = points[0].ID
+	}
+
+	var target *strategy.RewindPoint
+	for i := range points {
+		if points[i].ID == commitID {
+			target = &points[i]
+			break
+		}
+	}
+	if target == nil {
+		return fmt.Errorf("rewind point %q not found", commitID)
+	}
+
+	fmt.Fprintf(w, "[dry-run] Would rewind to checkpoint:\n")
+	fmt.Fprintf(w, "  ID:      %s\n", target.ID)
+	fmt.Fprintf(w, "  Date:    %s\n", target.Date.Format(time.RFC3339))
+	fmt.Fprintf(w, "  Message: %s\n", target.Message)
+	if target.SessionPrompt != "" {
+		fmt.Fprintf(w, "  Prompt:  %s\n", target.SessionPrompt)
+	}
+	fmt.Fprintf(w, "  Logs-only: %v\n", target.IsLogsOnly)
+	fmt.Fprintf(w, "\nNo changes were made.\n")
+	return nil
+}
+
 func runRewindList(ctx context.Context, w io.Writer) error {
 	start := GetStrategy(ctx)
 

cmd/trace/cli/rewind.go

@@ -622,7 +622,7 @@ func TestRenderSearchStatic(t *testing.T) {
 	t.Parallel()
 
 	var buf bytes.Buffer
-	styles := statusStyles{colorEnabled: false, width: 100}
+	styles := statusStyles{colorEnabled: false, width: 200}
 	renderSearchStatic(&buf, testResults(), "auth", 2, styles)
 	output := buf.String()
 

cmd/trace/cli/search_tui_test.go

@@ -375,6 +375,16 @@ func (s *StateStore) Load(ctx context.Context, sessionID string) (*State, error)
 		return nil, fmt.Errorf("failed to read session state: %w", err)
 	}
 
+	// Validate JSON before unmarshal to provide clearer error for truncated/corrupt files.
+	if !json.Valid(data) {
+		logCtx := logging.WithComponent(ctx, "session")
+		logging.Warn(logCtx, "session state file contains invalid JSON (possibly truncated)",
+			slog.String("session_id", sessionID),
+			slog.Int("bytes", len(data)),
+		)
+		return nil, fmt.Errorf("session state file is invalid JSON (possibly truncated, %d bytes)", len(data))
+	}
+
 	var state State
 	if err := json.Unmarshal(data, &state); err != nil {
 		return nil, fmt.Errorf("failed to unmarshal session state: %w", err)

cmd/trace/cli/session/state.go

@@ -1037,7 +1037,13 @@ func (s *ManualCommitStrategy) extractSessionData(ctx context.Context, repo *git
 
 	// Calculate token usage from the extracted transcript portion
 	if len(data.Transcript) > 0 {
-		data.TokenUsage = agent.CalculateTokenUsage(ctx, ag, data.Transcript, checkpointTranscriptStart, "") //TODO: why do we not use here subagents dir?
+		// Derive subagents directory from the live transcript path when available.
+		// Pattern: <transcriptDir>/<sessionID>/subagents (same as manual_commit_hooks.go)
+		var subagentsDir string
+		if liveTranscriptPath != "" {
+			subagentsDir = filepath.Join(filepath.Dir(liveTranscriptPath), sessionID, "subagents")
+		}
+		data.TokenUsage = agent.CalculateTokenUsage(ctx, ag, data.Transcript, checkpointTranscriptStart, subagentsDir)
 	}
 
 	return data, nil
@@ -1075,7 +1081,13 @@ func (s *ManualCommitStrategy) extractSessionDataFromLiveTranscript(ctx context.
 
 	// Calculate token usage from the extracted transcript portion
 	if len(data.Transcript) > 0 {
-		data.TokenUsage = agent.CalculateTokenUsage(ctx, ag, data.Transcript, state.CheckpointTranscriptStart, "") //TODO: why do we not use here subagents dir?
+		// Derive subagents directory from the transcript path when available.
+		// Pattern: <transcriptDir>/<sessionID>/subagents (same as manual_commit_hooks.go)
+		var subagentsDir string
+		if state.TranscriptPath != "" {
+			subagentsDir = filepath.Join(filepath.Dir(state.TranscriptPath), state.SessionID, "subagents")
+		}
+		data.TokenUsage = agent.CalculateTokenUsage(ctx, ag, data.Transcript, state.CheckpointTranscriptStart, subagentsDir)
 	}
 
 	return data, nil

cmd/trace/cli/strategy/manual_commit_condensation.go

@@ -356,14 +356,17 @@ func (s *ManualCommitStrategy) Rewind(ctx context.Context, w, errW io.Writer, po
 
 	// Build set of files tracked in HEAD
 	trackedFiles := make(map[string]bool)
-	//nolint:errcheck // Error is not critical for rewind
-	_ = headTree.Files().ForEach(func(f *object.File) error {
+	if iterErr := headTree.Files().ForEach(func(f *object.File) error {
 		if err := ctx.Err(); err != nil {
 			return err //nolint:wrapcheck // Propagating context cancellation
 		}
 		trackedFiles[f.Name] = true
 		return nil
-	})
+	}); iterErr != nil {
+		logging.Debug(ctx, "HEAD tree iteration error during rewind",
+			slog.Any("error", iterErr),
+		)
+	}
 
 	// Get repository root to walk from there
 	repoRoot, err := paths.WorktreeRoot(ctx)

cmd/trace/cli/strategy/manual_commit_rewind.go

@@ -3,11 +3,13 @@ package strategy
 import (
 	"context"
 	"fmt"
+	"log/slog"
 	"time"
 
 	"github.com/GrayCodeAI/trace/cmd/trace/cli/agent/types"
 	"github.com/GrayCodeAI/trace/cmd/trace/cli/checkpoint"
 	"github.com/GrayCodeAI/trace/cmd/trace/cli/checkpoint/id"
+	"github.com/GrayCodeAI/trace/cmd/trace/cli/logging"
 	"github.com/GrayCodeAI/trace/cmd/trace/cli/paths"
 	"github.com/GrayCodeAI/trace/cmd/trace/cli/session"
 	"github.com/GrayCodeAI/trace/cmd/trace/cli/versioninfo"
@@ -91,8 +93,12 @@ func (s *ManualCommitStrategy) listAllSessionStates(ctx context.Context) ([]*Ses
 		refName := plumbing.NewBranchReferenceName(shadowBranch)
 		if _, err := repo.Reference(refName, true); err != nil {
 			if !state.Phase.IsActive() && state.LastCheckpointID.IsEmpty() {
-				//nolint:errcheck,gosec // G104: Cleanup is best-effort, shouldn't fail the list operation
-				store.Clear(ctx, state.SessionID)
+				if clearErr := store.Clear(ctx, state.SessionID); clearErr != nil {
+					logging.Warn(ctx, "failed to clear orphaned session state",
+						slog.String("session_id", state.SessionID),
+						slog.Any("error", clearErr),
+					)
+				}
 				continue
 			}
 		}

cmd/trace/cli/strategy/manual_commit_session.go

@@ -5,6 +5,7 @@ import (
 	"regexp"
 	"strings"
 	"sync"
+	"sync/atomic"
 )
 
 // PIICategory identifies a category of personally identifiable information.
@@ -54,12 +55,18 @@ type piiPattern struct {
 var (
 	piiConfig   *PIIConfig
 	piiConfigMu sync.RWMutex
+	piiUsed     atomic.Bool
 )
 
 // ConfigurePII sets the global PII redaction configuration.
 // Pre-compiles patterns so the hot path (String → detectPII) does no compilation.
 // Call once at startup after loading settings. Thread-safe.
+// Warns if called after PII redaction has already been used (patterns may have been
+// applied with the old configuration).
 func ConfigurePII(cfg PIIConfig) {
+	if piiUsed.Load() {
+		slog.Warn("ConfigurePII called after PII redaction already in use; new config may not apply to prior calls")
+	}
 	piiConfigMu.Lock()
 	defer piiConfigMu.Unlock()
 	cfgCopy := cfg
@@ -148,6 +155,7 @@ func detectPII(cfg *PIIConfig, s string) []taggedRegion {
 	if cfg == nil || !cfg.Enabled {
 		return nil
 	}
+	piiUsed.Store(true)
 
 	patterns := cfg.patterns
 	if patterns == nil {