@1agh/maude 0.60.7 → 1.0.2

package/cli/lib/design-link.mjs

@@ -15,8 +15,17 @@ import { dirname, resolve } from 'node:path';
 import { createInterface } from 'node:readline';
 
 import { parseArgs } from './argv.mjs';
+import { adoptToHub, detachToRepo, ownershipState } from './design-ownership.mjs';
 import { BEGIN_MARKER, writeGitignoreBlock } from './gitignore-block.mjs';
-import { addHub, getHub, isHubTrusted, normalizeUrl, removeHub, trustHub } from './hubs-config.mjs';
+import {
+  addHub,
+  getHub,
+  isHubTrusted,
+  normalizeUrl,
+  removeHub,
+  setHubCodeModules,
+  trustHub,
+} from './hubs-config.mjs';
 
 const DESIGN_CONFIG_PATH = '.design/config.json';
 const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
@@ -164,6 +173,25 @@ export async function runLink({ args, cwd = process.cwd(), forceAdopt = false })
     await maybeWriteGitignoreBlock(cwd, !!flags.yes);
   }
 
+  // The code-module consent (DDR-226 §9 / review finding A5). This is the
+  // ONLY writer: the receiver reads `codeModulesAllowed` from the stored hub
+  // record and nothing else may set it — least of all a sign-in response,
+  // which is the hub telling you what your own role is.
+  //
+  // Without a writer the field could never be true, so `code-module` had no
+  // transport at all in hub-owned mode: an owner could push one through the
+  // door and no peer would ever accept it. Closed harder than intended is
+  // still closed wrong.
+  await askCodeModuleConsent(normUrl, { assumeYes: !!flags.yes, loopback });
+
+  // DDR-228 — a link must land in ONE of the two ownership modes.
+  //
+  // Linked-and-committed is not a lighter version of hub-owned; it is two
+  // systems owning the same bytes with different merge rules, where a `git
+  // pull` and a sync pass can each undo the other and which wins is timing.
+  // It also reads as extra safety right up until they disagree.
+  await settleOwnership(cwd, { assumeYes: !!flags.yes, adopt });
+
   const tsxSyncLine =
     syncTsx === false
       ? 'off (opted out — linkedHub.syncTsx: false)'
@@ -211,6 +239,148 @@ export async function runUnlink({ args, cwd = process.cwd() }) {
   );
 }
 
+/**
+ * Ask, once per hub, whether it may deliver executable modules.
+ *
+ * `.ts`/`.mjs` outside a canvas body are read by the AGENT and by every
+ * `maude design *` helper — a different blast radius from a `.tsx` rendering
+ * in the sandboxed canvas origin. Default NO on every non-answer (non-TTY,
+ * declined, anything unparsed): the pessimistic branch, same as every other
+ * default in this lane.
+ */
+async function askCodeModuleConsent(normUrl, { assumeYes = false, loopback = false } = {}) {
+  // A loopback pairing is this machine talking to itself; there is no remote
+  // party to consent about.
+  if (loopback) return;
+  const existing = getHub(normUrl);
+  if (existing && typeof existing.codeModulesAllowed === 'boolean') return;
+
+  let allow = false;
+  if (assumeYes) {
+    allow = false; // --yes accepts DEFAULTS, and this default is no.
+  } else if (process.stdin.isTTY) {
+    process.stdout.write(
+      '\n  Shared code (.ts / .mjs outside a canvas) is read by Claude and by the\n' +
+        '  maude helpers on this machine, not just rendered in a preview.\n'
+    );
+    allow = await promptYesNo(`  Let ${normUrl} deliver those to this machine? [y/N] `, false);
+  }
+  setHubCodeModules(normUrl, allow);
+  process.stdout.write(
+    allow
+      ? '[design link] this hub may deliver shared code modules to this machine.\n'
+      : `[design link] shared code modules from ${normUrl} will NOT be written here (design files still sync). Re-link and answer yes to change it.\n`
+  );
+}
+
+// ------------------------------------------------------- ownership (DDR-228)
+
+/**
+ * Put this repo in exactly one ownership mode, asking once if it is unclear.
+ *
+ * Called at the END of a link, so the hub already has the credential and the
+ * push is about to happen — the folder is not orphaned for a moment in
+ * between. Non-TTY takes the safe branch (leave it committed, say so) rather
+ * than untracking a person's files with nobody watching.
+ */
+async function settleOwnership(cwd, { assumeYes = false, adopt = false } = {}) {
+  const st = ownershipState(cwd, { linked: true });
+  // No repo ⇒ no second owner ⇒ nothing to settle.
+  if (!st.git || st.mode === 'hub-owned') return;
+  if (st.trackedCount === 0 && !st.ignored) {
+    // A fresh clone of a Mode-B repo: nothing tracked because there is nothing
+    // here yet. Declare the mode now so the first pull lands ignored.
+    adoptToHub(cwd);
+    process.stdout.write(
+      '[design link] this project is hub-owned — .design/ is gitignored and mirrored by the hub.\n'
+    );
+    warnSyncthing(st);
+    return;
+  }
+
+  process.stdout.write(
+    `\n  This repo currently commits .design/ (${st.trackedCount} file${st.trackedCount === 1 ? '' : 's'}) AND is now linked to a hub.\n` +
+      '  Those are two owners for the same files, which is the one state Maude does not support:\n' +
+      '  a git pull and a sync pass can each undo the other.\n\n' +
+      '  Hub-owned  — stop committing .design/, let the hub mirror it (nothing is deleted).\n' +
+      '  Repo-owned — keep committing it, and unlink the hub.\n\n'
+  );
+
+  const goHub =
+    assumeYes || !process.stdin.isTTY
+      ? assumeYes
+      : await promptYesNo('  Make this project hub-owned? [Y/n] ', true);
+
+  if (!goHub) {
+    process.stdout.write(
+      '[design link] left as-is. Run `maude design adopt` to hand .design/ to the hub, or `maude design unlink` to keep it in git.\n'
+    );
+    return;
+  }
+
+  const res = adoptToHub(cwd);
+  process.stdout.write(
+    `[design link] hub-owned: .gitignore ${res.action}, ${res.untracked} file(s) untracked (still on disk, staged as deletions — commit when ready).\n`
+  );
+  warnSyncthing(st);
+}
+
+/**
+ * Syncthing does not read `.gitignore`.
+ *
+ * So a hub-owned project inside a synced tree rides two transports with
+ * different conflict rules — the same double-ownership one layer down, through
+ * a door the ignore cannot close.
+ */
+function warnSyncthing(st) {
+  if (!st.syncthingRoot) return;
+  process.stdout.write(
+    `\n  NOTE: this repo is inside a Syncthing folder (${st.syncthingRoot}).\n` +
+      '  Syncthing ignores .gitignore, so it will keep syncing .design/ alongside the hub.\n' +
+      `  Add this line to ${st.syncthingRoot}/.stignore to stop that:\n\n      ${st.stignoreLine}\n\n`
+  );
+}
+
+/** `maude design detach` — B back to A. */
+export async function runDetach({ args, cwd = process.cwd() }) {
+  const tail = args.slice(args.indexOf('detach') + 1);
+  const { flags } = parseArgs(tail, { booleans: ['yes', 'keep-token'] });
+  const designConfigPath = resolve(cwd, DESIGN_CONFIG_PATH);
+
+  if (!existsSync(designConfigPath)) {
+    process.stderr.write(`maude design detach: no ${DESIGN_CONFIG_PATH} in ${cwd}.\n`);
+    process.exit(1);
+  }
+  const cfg = readDesignConfig(designConfigPath);
+  const linked = !!cfg.linkedHub;
+  const st = ownershipState(cwd, { linked });
+
+  if (!linked && st.mode === 'repo-owned' && !st.ignored) {
+    process.stdout.write('[design detach] already repo-owned — nothing to do.\n');
+    return;
+  }
+
+  const ok =
+    flags.yes || !process.stdin.isTTY
+      ? true
+      : await promptYesNo('  Take .design/ back into this repo and stop syncing it? [Y/n] ', true);
+  if (!ok) return;
+
+  // Unlink first: the mirror is a FULL copy, so there is nothing to fetch and
+  // no window where the folder belongs to neither owner.
+  if (linked) {
+    const url = cfg.linkedHub.url;
+    cfg.linkedHub = undefined;
+    writeDesignConfig(designConfigPath, cfg);
+    if (!flags['keep-token']) removeHub(url);
+    process.stdout.write(`[design detach] unlinked from ${url}.\n`);
+  }
+  const res = detachToRepo(cwd);
+  process.stdout.write(
+    `[design detach] repo-owned: .gitignore ${res.action}. Every file is already on disk — commit .design/ when you are ready:\n\n      git add .design && git commit -m "take the design folder back into the repo"\n\n`
+  );
+}
+
 // ---------------------------------------------------------------- status
 
 export async function runStatus({ args, cwd = process.cwd() }) {
@@ -264,6 +434,9 @@ export async function runStatus({ args, cwd = process.cwd() }) {
     // Task 8 — the running sync agent writes `.design/_sync.json` with the live
     // offline/online state, queued-op count, last sync, and conflict log.
     sync: sync ?? { agent: 'idle', detail: 'no _sync.json — sync agent not running' },
+    // DDR-228 — which of the two ownership modes this project is in, or
+    // `hybrid` for a project linked before the model existed.
+    ownership: ownershipState(cwd, { linked: true }),
   };
 
   if (flags.json) {
@@ -271,6 +444,18 @@ export async function runStatus({ args, cwd = process.cwd() }) {
     return;
   }
 
+  // The legacy-hybrid notice. Persistent rather than one-shot on purpose: it
+  // describes a state that is still true every time you look, and the answer
+  // is a decision only the person can make.
+  if (payload.ownership.mode === 'hybrid') {
+    process.stdout.write(
+      `\n  ⚠ legacy hybrid — this project is linked to a hub AND still commits .design/ (${payload.ownership.trackedCount} file(s)).\n` +
+        '    Two owners, different merge rules: a git pull and a sync pass can each undo the other.\n' +
+        '    Pick one:  `maude design adopt <url> --token <hex>`  (hub-owned, nothing deleted)\n' +
+        '               `maude design detach`                     (repo-owned, stops syncing)\n\n'
+    );
+  }
+
   const uptimeS = Math.round((probe.uptimeMs ?? 0) / 1000);
   // DDR-102 — per-doc rollup (old payloads without `docs` render unchanged).
   const docsLine = sync?.docs

package/cli/lib/design-ownership.mjs

@@ -0,0 +1,330 @@
+// Two ownership modes for `.design/`, and nothing between them — DDR-228,
+// Sync v2 Increment 4.5.
+//
+//   Mode A — repo-owned.  The folder is committed. Your git is the truth,
+//                         collaboration is `git pull`, Maude is not involved.
+//   Mode B — hub-owned.   The folder is GITIGNORED and mirrored by the hub.
+//                         The hub's own history plus object storage is the
+//                         truth, collaboration is live, and the local copy is
+//                         a full working mirror rather than the original.
+//
+// The hybrid — linked AND committed — is the state this module exists to end.
+// It looks harmless and is not: two systems own the same bytes with different
+// merge rules, so a `git pull` and a sync pass can each undo the other, and
+// which one wins depends on timing. Worse, it reads as extra safety ("it's in
+// git AND in the cloud") right up until the two disagree.
+//
+// Transitions are one-shot, explicit, and confirmed. They are NOT a sync mode:
+//
+//   adopt  (A → B)  push what is here, then ignore + untrack it.
+//   detach (B → A)  stop syncing, un-ignore, and let the person commit.
+//
+// ── What this module deliberately does not touch ────────────────────────────
+//
+// DDR-115's runtime-state lists govern what syncs INSIDE `.design/`, and the
+// design-runtime `.gitignore` block (`gitignore-block.mjs`) governs which of
+// those per-machine files git should skip. Both remain exactly as they are.
+// This is a FIFTH, different concern: whether the design root as a WHOLE is
+// the repo's business at all. Conflating them would mean a mode switch
+// silently rewriting the taxonomy.
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, lstatSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+
+/**
+ * Write `.gitignore` only when it is a REGULAR FILE, and atomically.
+ *
+ * Git can carry a symlink named `.gitignore`, and a clone of a repo somebody
+ * else influences is exactly the surface this module runs against. Following
+ * one turns a mode switch into an arbitrary-path overwrite. Temp + rename
+ * also means a crash mid-write cannot leave a repo with half an ignore file.
+ */
+function writeGitignoreSafely(path, contents) {
+  if (existsSync(path) && !lstatSync(path).isFile()) {
+    throw new Error(`${path} is not a regular file — refusing to write through it`);
+  }
+  const tmp = `${path}.maude-${process.pid}.tmp`;
+  writeFileSync(tmp, contents, 'utf8');
+  renameSync(tmp, path);
+}
+
+/** The marker pair around the whole-folder ignore, so it can be removed exactly. */
+export const OWNERSHIP_BEGIN = '# maude:hub-owned:begin';
+export const OWNERSHIP_END = '# maude:hub-owned:end';
+
+/**
+ * The block that makes a design root hub-owned.
+ *
+ * A trailing `/` so it matches the directory and everything under it, and an
+ * explicit un-ignore of nothing — the block is deliberately one rule. A
+ * cleverer block (ignore the folder but keep `config.json`) is the hybrid
+ * wearing a disguise: `config.json` names the hub, so a committed one is how
+ * a teammate discovers the project, and that is `maude design link`'s job.
+ */
+export function buildOwnershipBlock(designRel = '.design') {
+  const rel = designRel.replace(/^\.\//, '').replace(/\/+$/, '');
+  return [
+    OWNERSHIP_BEGIN,
+    '# This project is hub-owned: the design folder is mirrored by your Maude hub,',
+    '# not by git. Run `maude design detach` to take it back into the repo.',
+    `/${rel}/`,
+    OWNERSHIP_END,
+    '',
+  ].join('\n');
+}
+
+/**
+ * The marker pair, matched as WHOLE LINES and only when well-formed.
+ *
+ * A substring test was not enough, and the gap had teeth: a `.gitignore` is a
+ * committed file in a shared repo, which DDR-054 says peers can write. Put a
+ * BEGIN marker near the top, an END marker at the bottom, and the victim's
+ * real rules in between — `.env`, `*.pem`, `secrets/` — and the "update the
+ * existing block" path would replace the whole span with our five lines. Every
+ * one of those rules gone, staged, and on a cloud-managed repo mirrored
+ * onward. So: line-anchored, exactly one pair, BEGIN before END, or this is
+ * not our block and we do not touch it.
+ *
+ * @returns {{ ok: true, start: number, end: number } | { ok: false, reason: string }}
+ */
+export function findOwnershipBlock(contents) {
+  if (typeof contents !== 'string') return { ok: false, reason: 'absent' };
+  const lines = contents.split('\n');
+  const begins = [];
+  const ends = [];
+  lines.forEach((line, i) => {
+    if (line.trim() === OWNERSHIP_BEGIN) begins.push(i);
+    if (line.trim() === OWNERSHIP_END) ends.push(i);
+  });
+  if (begins.length === 0 && ends.length === 0) return { ok: false, reason: 'absent' };
+  if (begins.length !== 1 || ends.length !== 1) return { ok: false, reason: 'malformed' };
+  if (ends[0] < begins[0]) return { ok: false, reason: 'malformed' };
+  // A well-formed block is OURS, and ours has a fixed SHAPE: comment lines,
+  // plus exactly one rule, and that rule is an anchored directory path. A line
+  // count is not enough — a hostile block wrapping four of the victim's real
+  // rules is the same length as the one we write.
+  const inner = lines.slice(begins[0] + 1, ends[0]).filter((l) => l.trim().length > 0);
+  const rules = inner.filter((l) => !l.trim().startsWith('#'));
+  if (rules.length !== 1 || !/^\/[^/].*\/$/.test(rules[0].trim())) {
+    return { ok: false, reason: 'malformed' };
+  }
+  return { ok: true, start: begins[0], end: ends[0] };
+}
+
+/** Is this repo already declared hub-owned, by a block we recognise? */
+export function isHubOwned(gitignoreContents) {
+  return findOwnershipBlock(gitignoreContents).ok === true;
+}
+
+/**
+ * Add the block, idempotently. Returns `{ contents, action }`.
+ *
+ * Appended at the END on purpose: gitignore is last-match-wins, so a rule that
+ * has to hold cannot sit above a broader pattern that would re-include the
+ * path. This is the same reasoning the store-layout note in CLAUDE.md records
+ * for `.kgai/`, and it was learned the same way.
+ */
+export function applyOwnershipBlock(contents, designRel = '.design') {
+  const block = buildOwnershipBlock(designRel);
+  const found = findOwnershipBlock(contents);
+  if (found.ok) {
+    const lines = contents.split('\n');
+    const replaced = [
+      ...lines.slice(0, found.start),
+      ...block.split('\n').slice(0, -1),
+      ...lines.slice(found.end + 1),
+    ];
+    return { contents: replaced.join('\n'), action: 'updated' };
+  }
+  if (found.reason === 'malformed') {
+    // REFUSE, never rewrite. Markers we did not write are somebody else's
+    // content, and guessing at its extent is how a rewrite eats real rules.
+    return { contents, action: 'refused-malformed' };
+  }
+  const base = contents.length === 0 || contents.endsWith('\n') ? contents : `${contents}\n`;
+  return { contents: `${base}${base.length > 0 ? '\n' : ''}${block}`, action: 'added' };
+}
+
+/** Remove the block, idempotently. Returns `{ contents, action }`. */
+export function removeOwnershipBlock(contents) {
+  const found = findOwnershipBlock(contents);
+  if (!found.ok) {
+    return { contents, action: found.reason === 'malformed' ? 'refused-malformed' : 'absent' };
+  }
+  const lines = contents.split('\n');
+  const kept = [...lines.slice(0, found.start), ...lines.slice(found.end + 1)];
+  return { contents: kept.join('\n').replace(/\n{3,}/g, '\n\n'), action: 'removed' };
+}
+
+/**
+ * Is `dir` inside a git work tree at all?
+ *
+ * A design root outside a repo is perfectly ordinary — Maude does not require
+ * git — and in that case the whole ownership question is moot: there is no
+ * second owner to be in conflict with, so every transition here is a no-op
+ * rather than an error.
+ */
+export function isGitRepo(dir) {
+  try {
+    const out = execFileSync('git', ['rev-parse', '--is-inside-work-tree'], {
+      cwd: dir,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    return out.trim() === 'true';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Which paths under `designRel` git currently TRACKS.
+ *
+ * `git rm --cached` on an untracked path exits non-zero, and a mode switch
+ * that fails halfway is worse than one that refuses — so the caller asks first
+ * and acts on the answer. Empty list on any git failure: a repo git cannot
+ * read is one this must not start mutating.
+ */
+export function trackedDesignPaths(repoRoot, designRel = '.design') {
+  try {
+    const out = execFileSync('git', ['ls-files', '-z', '--', designRel], {
+      cwd: repoRoot,
+      encoding: 'utf8',
+      stdio: ['ignore', 'pipe', 'ignore'],
+    });
+    return out.split('\0').filter((p) => p.length > 0);
+  } catch {
+    return [];
+  }
+}
+
+/**
+ * Is this design root inside a Syncthing-managed folder?
+ *
+ * Syncthing does not read `.gitignore`, so a hub-owned project inside a synced
+ * tree rides TWO transports with different conflict rules — the exact
+ * double-ownership this module exists to prevent, arriving through a door
+ * gitignore cannot close. `~/git` is such a tree, so this is the maintainer's
+ * own setup, not a hypothetical.
+ */
+export function syncthingFolderRoot(startDir) {
+  let cur = resolve(startDir);
+  for (;;) {
+    if (existsSync(join(cur, '.stfolder'))) return cur;
+    const up = dirname(cur);
+    if (up === cur) return null;
+    cur = up;
+  }
+}
+
+/** The `.stignore` line that keeps Syncthing out of a hub-owned design root. */
+export function stignoreLineFor(repoRoot, designRel, syncthingRoot) {
+  const abs = join(resolve(repoRoot), designRel);
+  const rel = abs.slice(resolve(syncthingRoot).length + 1);
+  return `/${rel.split('\\').join('/')}`;
+}
+
+/**
+ * Everything a caller needs to describe the current state without changing it.
+ *
+ * Read-only by design: both the CLI and the desktop dialog ask this first, so
+ * the two surfaces cannot disagree about what mode a project is in.
+ */
+export function ownershipState(repoRoot, { designRel = '.design', linked = false } = {}) {
+  const gitignorePath = resolve(repoRoot, '.gitignore');
+  const contents = existsSync(gitignorePath) ? readFileSync(gitignorePath, 'utf8') : '';
+  const ignored = isHubOwned(contents);
+  const tracked = trackedDesignPaths(repoRoot, designRel);
+  const stRoot = syncthingFolderRoot(repoRoot);
+  const git = isGitRepo(repoRoot);
+
+  // The hybrid is precisely: linked, and git still carries the folder. With no
+  // repo there is no second owner, so a linked project is simply hub-owned.
+  const mode = !git
+    ? linked
+      ? 'hub-owned'
+      : 'repo-owned'
+    : !linked
+      ? 'repo-owned'
+      : ignored && tracked.length === 0
+        ? 'hub-owned'
+        : 'hybrid';
+
+  return {
+    mode,
+    git,
+    ignored,
+    trackedCount: tracked.length,
+    tracked,
+    syncthingRoot: stRoot,
+    ...(stRoot ? { stignoreLine: stignoreLineFor(repoRoot, designRel, stRoot) } : {}),
+  };
+}
+
+/**
+ * A → B. Ignore the folder and stop tracking it. Returns what changed.
+ *
+ * The working tree is NOT touched — `--cached` removes the index entry and
+ * leaves every byte on disk. That is the whole safety property: if this is the
+ * wrong call, `maude design detach` puts it back with nothing lost, because
+ * nothing was ever deleted.
+ *
+ * Staging is explicit and narrow (the removals plus `.gitignore`), never
+ * `git add -A`: this runs in whatever state the person's tree happens to be
+ * in, and a mode switch that sweeps up their unrelated work is a mode switch
+ * nobody will trust again.
+ */
+export function adoptToHub(repoRoot, { designRel = '.design', dryRun = false } = {}) {
+  if (!isGitRepo(repoRoot)) return { action: 'no-git', untracked: 0, tracked: [], dryRun };
+  const gitignorePath = resolve(repoRoot, '.gitignore');
+  const before = existsSync(gitignorePath) ? readFileSync(gitignorePath, 'utf8') : '';
+  const { contents, action } = applyOwnershipBlock(before, designRel);
+  const tracked = trackedDesignPaths(repoRoot, designRel);
+
+  if (dryRun) return { action, untracked: tracked.length, tracked, dryRun: true };
+  // A `.gitignore` carrying markers we did not write is not ours to edit, and
+  // untracking the design root against one would be acting on a state we
+  // could not read. Refuse the whole transition, not just the write.
+  if (action === 'refused-malformed') {
+    return { action, untracked: 0, tracked, dryRun: false };
+  }
+
+  writeGitignoreSafely(gitignorePath, contents);
+  if (tracked.length > 0) {
+    // `-r --cached` in one call; `--ignore-unmatch` so a concurrent removal
+    // between the listing and here is not a failed mode switch.
+    execFileSync('git', ['rm', '-r', '--cached', '--quiet', '--ignore-unmatch', '--', designRel], {
+      cwd: repoRoot,
+      stdio: ['ignore', 'ignore', 'pipe'],
+    });
+  }
+  execFileSync('git', ['add', '--', '.gitignore'], {
+    cwd: repoRoot,
+    stdio: ['ignore', 'ignore', 'pipe'],
+  });
+  return { action, untracked: tracked.length, tracked, dryRun: false };
+}
+
+/**
+ * B → A. Un-ignore the folder so the person can commit it again.
+ *
+ * Deliberately does NOT commit, and does not `git add` the design root: what
+ * to commit and when is theirs. The bytes are already on disk in full — the
+ * mirror is a complete copy, not a cache — so there is nothing to fetch and
+ * nothing that can be lost by waiting.
+ */
+export function detachToRepo(repoRoot, { dryRun = false } = {}) {
+  if (!isGitRepo(repoRoot)) return { action: 'no-git', dryRun };
+  const gitignorePath = resolve(repoRoot, '.gitignore');
+  if (!existsSync(gitignorePath)) return { action: 'absent', dryRun };
+  const before = readFileSync(gitignorePath, 'utf8');
+  const { contents, action } = removeOwnershipBlock(before);
+  if (dryRun || action === 'absent' || action === 'refused-malformed') return { action, dryRun };
+  writeGitignoreSafely(gitignorePath, contents);
+  execFileSync('git', ['add', '--', '.gitignore'], {
+    cwd: repoRoot,
+    stdio: ['ignore', 'ignore', 'pipe'],
+  });
+  return { action, dryRun: false };
+}