gitflash 0.7.0.beta2 → 0.7.0.beta3

data/lib/gitflash/hook/shell_text.rb

@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+module Gitflash
+  module Hook
+    # Reads a shell command line as text, without running it: where commands end, and which
+    # commands run inside `$(...)`, `<(...)` and backticks. Quotes are followed as the shell
+    # does: nothing runs inside single quotes, `$(...)` and backticks run inside double quotes,
+    # and a backslash keeps the next character (outside single quotes).
+    module ShellText
+      SEPARATORS = ";&|\n"
+
+      module_function
+
+      # The command line split on ; & | and newlines outside quotes and substitutions
+      def segments(line)
+        scan(line).first
+      end
+
+      # The scripts the shell runs to build the line: the text inside `$(...)`, `<(...)`,
+      # `>(...)` and backticks. Nested ones are found when the caller reads each script in turn.
+      def substitutions(line)
+        scan(line).last
+      end
+
+      # [segments, scripts] in one pass over the line
+      def scan(line)
+        parts = [+'']
+        scripts = []
+        index = 0
+        quote = nil
+        index, quote = step(line, index, quote, parts, scripts) while index < line.length
+        [parts.reject { |part| part.strip.empty? }, scripts]
+      end
+
+      # Reads what starts at index and returns where to go on, with the quote then open
+      def step(line, index, quote, parts, scripts)
+        char = line[index]
+        return [index + 1, close_single(char, parts)] if quote == "'"
+        return take(line, index, index + 2, parts) + [quote] if char == '\\'
+        return [comment_end(line, index), nil] if quote.nil? && comment?(line, index)
+
+        substituted(line, index, quote, parts, scripts) || plain(char, index, quote, parts)
+      end
+
+      # Takes a substitution that opens at index, or returns nil
+      def substituted(line, index, quote, parts, scripts)
+        script = substitution(line, index, quote)
+        return nil unless script
+
+        scripts << line[script.first...script.last]
+        take(line, index, script.last + 1, parts) + [quote]
+      end
+
+      # A `#` that starts a word outside quotes starts a comment, which runs to the end of the
+      # line; an apostrophe in it (`# don't`) must not open a quote
+      def comment?(line, index)
+        line[index] == '#' && (index.zero? || line[index - 1].match?(/[\s;&|()]/))
+      end
+
+      def comment_end(line, index)
+        line.index("\n", index) || line.length
+      end
+
+      def close_single(char, parts)
+        parts.last << char
+        char == "'" ? nil : "'"
+      end
+
+      def plain(char, index, quote, parts)
+        if !quote && SEPARATORS.include?(char)
+          parts << +''
+          return [index + 1, nil]
+        end
+        parts.last << char
+        [index + 1, next_quote(char, quote)]
+      end
+
+      def next_quote(char, quote)
+        return (char == '"' ? nil : quote) if quote
+        return char if ["'", '"'].include?(char)
+
+        nil
+      end
+
+      def take(line, from, to, parts)
+        parts.last << line[from...to].to_s
+        [to]
+      end
+
+      # [script start, closing index] of a substitution opening at index, or nil. `<(...)` and
+      # `>(...)` only open outside quotes; `$(...)` and backticks also inside double quotes.
+      def substitution(line, index, quote)
+        if line[index] == '`'
+          [index + 1, ShellQuotes.closing_backtick(line, index + 1)]
+        elsif line[index, 2] == '$(' || (quote.nil? && line[index, 2].match?(/\A[<>]\(/))
+          [index + 2, ShellQuotes.closing_paren(line, index + 2)]
+        end
+      end
+    end
+  end
+end

data/lib/gitflash/hook/wrappers.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module Gitflash
+  module Hook
+    # Commands that run the command after them: `sudo -u me git ...`, `timeout 5 git ...`,
+    # `xargs git ...`. Strips them, with their options, so the parser sees the git command.
+    module Wrappers
+      # Wrapper => its options that take a value as the next word
+      OPTIONS = {
+        'sudo' => %w[-u -g -h -p -C -D -r -t -U -T --user --group --host --prompt --chdir],
+        'env' => %w[-u -C -S --unset --chdir --split-string],
+        'command' => [], 'exec' => %w[-a], 'time' => %w[-f -o --format --output],
+        'nohup' => [], 'nice' => %w[-n --adjustment], 'ionice' => %w[-c -n -p -P -u],
+        'stdbuf' => %w[-i -o -e], 'chronic' => [], 'caffeinate' => %w[-t -w],
+        'timeout' => %w[-k -s --kill-after --signal],
+        # -i, -l and -e take only an attached value (`-i{}`), so they are not listed
+        'xargs' => %w[-I -n -P -L -d -E -s -a --arg-file --delimiter --max-args --max-procs]
+      }.freeze
+      # Wrappers whose first word after the options is not the command (`timeout 5 git ...`)
+      LEADING_ARGUMENT = %w[timeout].freeze
+      CHDIR_OPTIONS = %w[-C -D --chdir].freeze
+      FIND_EXEC = %w[-exec -execdir -ok -okdir].freeze
+      FIND_END = [';', '\;', '+'].freeze
+
+      module_function
+
+      # The words without leading wrappers and their options, and the directory `sudo -D` or
+      # `env -C` switch to (nil when none does)
+      def strip(words)
+        chdir = nil
+        while (options = OPTIONS[File.basename(words.first.to_s)])
+          name = File.basename(words.first)
+          words, dir = drop_options(words.drop(1), options)
+          chdir = dir || chdir
+          words = words.drop(1) if LEADING_ARGUMENT.include?(name)
+        end
+        [words, chdir]
+      end
+
+      # Drops options (and the values of those that take one) up to the command
+      def drop_options(words, with_value)
+        chdir = nil
+        while (word = words.first)&.start_with?('-')
+          words = words.drop(1)
+          break if word == '--'
+          next unless with_value.include?(word)
+
+          chdir = words.first if CHDIR_OPTIONS.include?(word)
+          words = words.drop(1)
+        end
+        [words, chdir]
+      end
+
+      # The command `find ... -exec CMD ... ;` runs, or nil
+      def find_exec(words)
+        return nil unless File.basename(words.first.to_s) == 'find'
+
+        start = words.index { |word| FIND_EXEC.include?(word) }
+        return nil unless start
+
+        command = words[(start + 1)..].take_while { |word| !FIND_END.include?(word) }
+                                      .reject { |word| word == '{}' }
+        command.empty? ? nil : command
+      end
+    end
+  end
+end

data/lib/gitflash/hook_cli.rb

@@ -33,17 +33,33 @@ module Gitflash
       branch NAME, worktree add) as agent work, so `gitflash clean --agent` can find them. A branch
       is only marked when it is new (its reflog says it was created a moment ago) and unmarked.
 
-      Not meant to be run by hand: in a terminal it only prints a note. Errors never block the
-      command: they are printed to stderr and the hook exits with 0.
+      Not meant to be run by hand: in a terminal it only prints a note. Errors are printed to
+      stderr and the hook exits with 0. In snapshot mode the command then runs; in ask mode the
+      user is asked and in deny mode the command is blocked, so an error never turns the
+      protection off. If even that answer cannot be written, ask and deny mode exit with 2,
+      which makes Claude Code block the command.
     TEXT
     option :mode, type: :string, default: 'snapshot', enum: Hook::Claude::MODES
     def claude
       return puts(TERMINAL_NOTE) if $stdin.tty?
 
-      output = Hook::Claude.new(mode: options[:mode]).call($stdin.read)
+      output = hook_output(options[:mode], $stdin.read)
       puts JSON.generate(output) if output
     rescue StandardError => e
       warn "gitflash hook: #{e.message}"
+      # No decision could be written: exit 2 makes Claude Code block the command in ask and
+      # deny mode instead of running it unprotected
+      exit 2 unless options[:mode] == 'snapshot'
+    end
+
+    no_commands do
+      # The hook's output; on an error, what Hook::Failure decides for the mode
+      def hook_output(mode, input)
+        Hook::Claude.new(mode: mode).call(input)
+      rescue StandardError => e
+        warn "gitflash hook: #{e.message}"
+        Hook::Failure.output(mode, e, input)
+      end
     end
 
     desc 'install', 'Register the gitflash hook in Claude Code settings'
@@ -59,13 +75,20 @@ module Gitflash
                        applies to sessions started there
       --scope user     ~/.claude/settings.json; applies to every session
 
+      --mode snapshot|ask|deny sets what the hook does (see `gitflash hook help claude`). Without
+      --mode an installed hook keeps its mode. A mode that protects less than the installed one
+      (deny, then ask, then snapshot) is refused unless you pass --downgrade.
+
       Claude Code reloads settings files, so running sessions pick the hook up without a restart.
       Check the result with `gitflash hook status`.
 
       Accepts the global --json and --dry-run options after the subcommand: gitflash hook install --json
     TEXT
     option :scope, type: :string, default: 'local', enum: Commands::HookInstall::SCOPES
-    option :mode, type: :string, default: 'snapshot', enum: Hook::Claude::MODES
+    option :mode, type: :string, enum: Hook::Claude::MODES,
+                  desc: 'snapshot, ask or deny (default: the installed mode, else snapshot)'
+    option :downgrade, type: :boolean,
+                       desc: 'Allow a --mode that protects less than the installed one'
     def install
       run_command('hook install', Commands::HookInstall, repo_required: options[:scope] != 'user')
     end

data/lib/gitflash/protection.rb

@@ -1,10 +1,14 @@
 # frozen_string_literal: true
 
 module Gitflash
-  # Branches gitflash never deletes: the current and default branch, `main`, `master`, names
-  # matching `protected` in the settings, and any branch checked out in a worktree.
+  # Branches gitflash never deletes: the current and default branch, the usual long-lived
+  # branches (`main`, `master`, `develop`, `development`, `trunk`, `release/*`), names matching
+  # `protected` in the settings, and any branch checked out in a worktree. The long-lived names
+  # count even when the default branch is something else or unknown: in a git-flow repository
+  # `develop` is merged into `main` after every release and would otherwise look done.
   class Protection
-    NAMES = %w[main master].freeze
+    NAMES = %w[main master develop development trunk].freeze
+    PATTERNS = %w[release/*].freeze
 
     def initialize(config:, checked_out: [])
       @config = config
@@ -12,8 +16,12 @@ module Gitflash
     end
 
     def protected?(branch)
-      branch.current? || branch.default? || NAMES.include?(branch.name) ||
+      branch.current? || branch.default? || long_lived?(branch.name) ||
         @config.protected?(branch.name) || @checked_out.include?(branch.name)
     end
+
+    def long_lived?(name)
+      NAMES.include?(name) || PATTERNS.any? { |pattern| File.fnmatch?(pattern, name) }
+    end
   end
 end

data/lib/gitflash/snapshot.rb

@@ -12,9 +12,10 @@ module Gitflash
   # worktree       commit whose tree is the working tree including untracked files (not
   #                ignored ones), nil when the tree was clean
   # skipped_files  untracked files left out because they were too large
+  # excluded_files untracked files left out because `snapshot_exclude` matches them
   Snapshot = Data.define(
     :id, :created_at, :reason, :scope, :worktree_path, :head, :branches, :stashes,
-    :index, :worktree, :skipped_files
+    :index, :worktree, :skipped_files, :excluded_files
   ) do
     def self.from_h(hash)
       new(
@@ -22,10 +23,16 @@ module Gitflash
         scope: hash['scope'], worktree_path: hash['worktree_path'],
         head: { branch: hash.dig('head', 'branch'), sha: hash.dig('head', 'sha') },
         branches: hash['branches'] || {}, stashes: hash['stashes'] || [],
-        index: hash['index'], worktree: hash['worktree'], skipped_files: hash['skipped_files'] || []
+        index: hash['index'], worktree: hash['worktree'],
+        skipped_files: hash['skipped_files'] || [], excluded_files: hash['excluded_files'] || []
       )
     end
 
+    # Untracked files this snapshot cannot bring back
+    def unsaved_files
+      skipped_files + excluded_files
+    end
+
     def scope?(part)
       scope.include?(part)
     end

data/lib/gitflash/snapshot_check.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+module Gitflash
+  # Checks a snapshot read from a ref before gitflash trusts it. Anyone with write access to the
+  # repository can create such a ref, and its fields go into git commands and paths.
+  module SnapshotCheck
+    SHA = /\A\h{40}(?:\h{24})?\z/
+    # What git accepts in a branch name, roughly: no control characters, spaces, `~^:?*[\`, `..`
+    # or `@{`, no leading `-` or `/`, no `//`, no trailing `/`, `.` or `.lock`
+    BRANCH = %r{\A(?!-|/)(?!.*(?:\.\.|@\{|//))[^\x00-\x20\x7F~^:?*\[\\]+(?<![/.])(?<!\.lock)\z}
+
+    module_function
+
+    # Why the snapshot read from ref cannot be trusted, or nil
+    def problem(ref, snapshot)
+      shape_problem(snapshot) || field_problem(ref, snapshot)
+    end
+
+    # Fields of the wrong type, which the other checks could not even read
+    def shape_problem(snapshot)
+      return 'branches is not an object' unless snapshot.branches.is_a?(Hash)
+      return 'stashes is not a list' unless snapshot.stashes.is_a?(Array)
+      return 'scope is not a list of names' unless snapshot.scope.is_a?(Array) &&
+                                                   snapshot.scope.all?(String)
+
+      nil
+    end
+
+    def field_problem(ref, snapshot)
+      expected = Snapshots::REF_PREFIX + snapshot.id.to_s
+      return 'its name does not match its id' unless ref == expected
+      return 'a commit id is not a full hex SHA' unless snapshot.object_ids.all? { |id| sha?(id) }
+      return 'a branch name is not valid' unless branch_names(snapshot).all? { |n| branch?(n) }
+      return 'worktree_path is not an absolute path' unless path?(snapshot.worktree_path)
+
+      nil
+    end
+
+    # BRANCH, and each slash-separated part non-empty, not starting with `.` and not ending in
+    # `.lock`; `@` alone is not a branch name either
+    def branch?(name)
+      name.match?(BRANCH) && name != '@' && name.split('/', -1).all? do |part|
+        !part.empty? && !part.start_with?('.') && !part.end_with?('.lock')
+      end
+    end
+
+    def sha?(id)
+      id.is_a?(String) && id.match?(SHA)
+    end
+
+    def branch_names(snapshot)
+      (snapshot.branches.keys + [snapshot.head[:branch]]).compact.map(&:to_s)
+    end
+
+    # nil for snapshots from before worktree_path was recorded
+    def path?(path)
+      path.nil? || (path.is_a?(String) && path.start_with?('/') && !path.match?(/[\x00-\x1F]/))
+    end
+  end
+end

data/lib/gitflash/snapshots.rb

@@ -31,11 +31,34 @@ module Gitflash
       store(Snapshot.new(**identity, reason: reason, **state))
     end
 
-    # Snapshots, newest first
+    # Snapshots, newest first. A ref whose message is not a snapshot is skipped with a warning,
+    # so one damaged ref cannot stop every command that lists or takes snapshots.
+    # Ordered by the time inside each snapshot, not by ref name, so a ref named to sort first
+    # cannot become the default for `undo`.
     def list
-      git('for-each-ref', '--sort=-refname', '--format=%(contents:subject)', REF_PREFIX)
+      git('for-each-ref', '--format=%(refname)%00%(contents:subject)', REF_PREFIX)
         .each_line(chomp: true).reject(&:empty?)
-        .map { |line| Snapshot.from_h(JSON.parse(line)) }
+        .filter_map { |line| parse(*line.split("\0", 2)) }
+        .sort_by { |snapshot| [Time.iso8601(snapshot.created_at), snapshot.id] }.reverse
+    end
+
+    def parse(ref, message)
+      data = JSON.parse(message.to_s)
+      raise TypeError, 'not an object' unless data.is_a?(Hash)
+
+      checked(ref, Snapshot.from_h(data))
+    rescue JSON::ParserError, TypeError, ArgumentError => e
+      warn "gitflash: skipping #{TerminalText.line(ref)}, which is not a readable snapshot " \
+           "(#{e.message.lines.first&.strip})"
+      nil
+    end
+
+    def checked(ref, snapshot)
+      Time.iso8601(snapshot.created_at.to_s)
+      problem = SnapshotCheck.problem(ref, snapshot)
+      raise TypeError, problem if problem
+
+      snapshot
     end
 
     def find(id)

data/lib/gitflash/state_capture.rb

@@ -18,8 +18,11 @@ module Gitflash
       'GIT_AUTHOR_DATE' => '1970-01-01T00:00:00Z', 'GIT_COMMITTER_DATE' => '1970-01-01T00:00:00Z'
     }.freeze
 
-    def initialize(bash: Git::BashCommand)
+    # `exclude` says whether an untracked path must stay out of snapshots; by default the
+    # `snapshot_exclude` setting of the repository decides
+    def initialize(bash: Git::BashCommand, exclude: nil)
       @bash = bash
+      @exclude = exclude
     end
 
     # Snapshot fields except id, time and reason. `branch_names` nil records every branch.
@@ -30,7 +33,7 @@ module Gitflash
         head: { branch: current_branch, sha: head_sha },
         branches: scope.include?('branches') ? branch_tips(branch_names) : {},
         stashes: scope.include?('stashes') ? try('stash', 'list', '--format=%H').to_s.split : [],
-        index: nil, worktree: nil, skipped_files: []
+        index: nil, worktree: nil, skipped_files: [], excluded_files: []
       }
       state.merge!(worktree(head_sha)) if scope.include?('worktree') && dirty?
       state
@@ -80,11 +83,11 @@ module Gitflash
     def worktree(head_sha)
       parents = [head_sha].compact
       index_tree = try('write-tree') # nil while a merge conflict is unresolved
-      tree, skipped = worktree_tree
+      tree, skipped, excluded = worktree_tree
       {
         index: index_tree && content_commit(index_tree, parents, 'gitflash index'),
         worktree: content_commit(tree, parents, 'gitflash worktree'),
-        skipped_files: skipped
+        skipped_files: skipped, excluded_files: excluded
       }
     end
 
@@ -102,33 +105,27 @@ module Gitflash
         env = { 'GIT_INDEX_FILE' => file.path }
 
         git('-C', top, 'add', '--update', env: env)
-        skipped = add_untracked(top, env)
-        [git('write-tree', env: env), skipped]
+        skipped, excluded = add_untracked(top, env)
+        [git('write-tree', env: env), skipped, excluded]
       end
     end
 
-    # [path, size] pairs. A file removed since `ls-files` ran (a build writing temporary files)
-    # is left out, so `git add` is not given a path that is gone.
-    def file_sizes(top, paths)
-      paths.filter_map do |path|
-        [path, File.lstat(File.join(top, path)).size]
-      rescue Errno::ENOENT
-        nil
-      end
-    end
-
-    # Adds untracked files that are not ignored; returns the ones skipped for their size
+    # Adds untracked files that are not ignored; returns [skipped for their size, excluded by
+    # snapshot_exclude]
     def add_untracked(top, env)
       paths = git('-C', top, 'ls-files', '-z', '--others', '--exclude-standard')
               .split("\0").reject { |path| path.end_with?('/') }
-      sizes = file_sizes(top, paths)
-      small, large = sizes.partition { |_path, size| size <= MAX_UNTRACKED_FILE_BYTES }
-                          .map { |group| group.map(&:first) }
+      excluded, paths = paths.partition { |path| exclude.call(path) }
+      small, large = UntrackedFiles.split_by_size(top, paths, MAX_UNTRACKED_FILE_BYTES)
       # File names are literal paths, never pathspec magic such as `:(exclude)*`
       small.each_slice(ADD_BATCH_SIZE) do |batch|
         git('--literal-pathspecs', '-C', top, 'add', '--', *batch, env: env)
       end
-      large
+      [large, excluded]
+    end
+
+    def exclude
+      @exclude ||= Config.load(root: Repo.new(bash: @bash).main_root).method(:snapshot_excluded?)
     end
   end
 end

data/lib/gitflash/ui.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require 'digest'
 require 'json'
 
 module Gitflash
@@ -12,11 +13,12 @@ module Gitflash
     JSON_SCHEMA_VERSION = 1
     OK_STATUSES = %w[done planned noop cancelled].freeze
 
-    def initialize(command:, json: false, yes: false, dry_run: false)
+    def initialize(command:, json: false, yes: false, dry_run: false, confirm: nil)
       @command = command
       @json = json
       @yes = yes
       @dry_run = dry_run
+      @confirm = confirm
     end
 
     def json?
@@ -46,7 +48,9 @@ module Gitflash
 
     def error(error)
       if json?
-        details = { code: error.code, message: error.message, exit_code: error.exit_code }
+        details = { code: error.code, message: error.message, exit_code: error.exit_code,
+                    confirm_token: error.respond_to?(:confirm_token) ? error.confirm_token : nil }
+                  .compact
         $stdout.puts JSON.generate(envelope(status: error.status, plan: error.plan, error: details))
       else
         warn TerminalText.safe(error.message)
@@ -63,7 +67,12 @@ module Gitflash
 
     # True when the action may proceed: --yes was given or the user confirmed in a terminal.
     # Raises ConfirmationRequired, carrying the plan, when nobody can confirm.
-    def confirm?(summary, plan:)
+    #
+    # An irreversible action (one `gitflash undo` cannot revert) is not covered by --yes: it
+    # needs --confirm with a token made from its plan, or the token typed in a terminal. The
+    # token changes with the plan, so a confirmation never carries over to a different change.
+    def confirm?(summary, plan:, irreversible: false)
+      return confirm_irreversible?(summary, plan) if irreversible
       return true if @yes
 
       message = "#{summary}\nRe-run with --yes to confirm."
@@ -72,8 +81,27 @@ module Gitflash
       prompt.proceed_with_warning(TerminalText.safe(summary)) { true } == true
     end
 
+    # The token that confirms this plan with --confirm
+    def self.confirm_token(plan)
+      Digest::SHA256.hexdigest(JSON.generate(plan))[0, 8]
+    end
+
     private
 
+    def confirm_irreversible?(summary, plan)
+      token = self.class.confirm_token(plan)
+      return true if @confirm == token
+
+      summary = "#{summary}\ngitflash undo cannot revert this."
+      unless interactive?
+        message = "#{summary}\nRe-run with --confirm #{token} to confirm (--yes is not enough)."
+        raise ConfirmationRequired.new(message, plan: plan, confirm_token: token)
+      end
+
+      warn TerminalText.safe(summary)
+      prompt.ask("Type #{token} to confirm:").to_s.strip == token
+    end
+
     def envelope(status:, plan: nil, result: nil, error: nil, undo: nil)
       {
         schema: JSON_SCHEMA_VERSION,

data/lib/gitflash/untracked_files.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Gitflash
+  # Sizes of untracked files, for StateCapture
+  module UntrackedFiles
+    module_function
+
+    # [paths up to max bytes, larger paths]. A file removed since `ls-files` ran (a build
+    # writing temporary files) is left out, so `git add` is not given a path that is gone.
+    def split_by_size(top, paths, max)
+      sizes = paths.filter_map do |path|
+        [path, File.lstat(File.join(top, path)).size]
+      rescue Errno::ENOENT
+        nil
+      end
+      sizes.partition { |_path, size| size <= max }.map { |group| group.map(&:first) }
+    end
+  end
+end

data/lib/gitflash/usage_report.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+module Gitflash
+  # Prints an error Thor raised while reading the command line (an unknown option, a value
+  # outside an enum, a missing argument) as gitflash's own errors are printed: in the JSON
+  # envelope with --json, else as text on stderr.
+  class UsageReport
+    TRUE_VALUES = %w[true TRUE t T].freeze
+    FALSE_VALUES = %w[false FALSE f F].freeze
+
+    # The command names the JSON envelope knows (schema/v1.json)
+    def self.commands
+      @commands ||= JSON.parse(File.read(Cli::SCHEMA_PATH)).dig('properties', 'command', 'enum')
+    end
+
+    def initialize(args)
+      @args = args
+    end
+
+    def print(error)
+      error = UsageError.new(error.message)
+      return Ui.new(command: command, json: true).error(error) if json?
+
+      warn TerminalText.safe(error.message)
+    end
+
+    private
+
+    # Whether the command line asks for JSON, read as Thor reads a boolean: `--json`,
+    # `--json=t` and the like, `--json false`; the last one given wins
+    def json?
+      @args.each_with_index.reduce(false) do |json, (arg, index)|
+        if arg == '--json' then !FALSE_VALUES.include?(@args[index + 1])
+        elsif arg.start_with?('--json=') then TRUE_VALUES.include?(arg.delete_prefix('--json='))
+        elsif arg == '--no-json' then false
+        else json
+        end
+      end
+    end
+
+    # The command as the envelope names it: `wt` and `worktree` subcommands as
+    # `worktree SUBCOMMAND`, `hook SUBCOMMAND`, else the first word; `gitflash` when the line
+    # names no known command
+    def command
+      words = @args.reject { |arg| arg.start_with?('-') }
+      first = resolve(Cli, words.first.to_s)
+      first = 'worktree' if first == 'wt'
+      name = case first
+             when 'worktree' then "worktree #{resolve(WorktreeCli, words[1].to_s)}"
+             when 'hook' then "hook #{resolve(HookCli, words[1].to_s)}"
+             else first
+             end
+      self.class.commands.include?(name) ? name : 'gitflash'
+    end
+
+    # The command Thor runs for a word: itself, or the one command it is an unambiguous prefix
+    # of (Thor runs `mar` as `mark`)
+    def resolve(klass, word)
+      names = klass.all_commands.keys.map { |key| key.tr('_', '-') }
+      return word if names.include?(word)
+
+      matches = names.select { |key| key.start_with?(word) }
+      matches.one? && !word.empty? ? matches.first : word
+    end
+  end
+end

data/lib/gitflash/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Gitflash
-  VERSION = '0.7.0.beta2'
+  VERSION = '0.7.0.beta3'
 end