@anionex/dsh-turn-rewind 0.2.2 → 0.3.0

package/src/engine.ts

@@ -4,13 +4,7 @@ import { join, resolve } from 'node:path'
 import { lstat, realpath } from 'node:fs/promises'
 import { createDeadline } from './deadline.js'
 import { ChangeLedgerError, errorMessage } from './errors.js'
-import {
-  discoverRepository,
-  discoverRepositoryRoot,
-  ensureGitWorktreeIdentity,
-  resolveGitWorktreeRoot,
-  sameRepositoryFence,
-} from './git.js'
+import { ensureGitWorktreeIdentity, resolveGitWorktreeRoot } from './git.js'
 import {
   captureGitTurnCheckpoint,
   deleteGitCheckpoint,
@@ -34,6 +28,7 @@ import {
 } from './path-utils.js'
 import { captureSnapshotEntry, captureStableTree, diffTrees, entriesEqual } from './snapshot.js'
 import { LedgerStore, type GitCheckpointJournal } from './store.js'
+import { discoverWorkspace, discoverWorkspaceIdentity, sameWorkspaceFence } from './workspace.js'
 import {
   LEDGER_FORMAT_VERSION,
   type ChangeLedgerConfig,
@@ -50,6 +45,7 @@ import {
   type SnapshotEntry,
   type WorkspaceChange,
   type WorkspaceOverview,
+  type WorkspaceState,
   type WorkspacePurgeReport,
 } from './types.js'
 
@@ -109,12 +105,24 @@ export class ChangeLedgerEngine {
     return restoredOperations + await this.reconcileGitCheckpointJournals()
   }
 
-  private async acquireWorkspace(workspace: string, signal?: AbortSignal): Promise<() => Promise<void>> {
-    const identity = await ensureGitWorktreeIdentity(workspace, signal)
-    if (identity.root !== workspace) {
-      throw new ChangeLedgerError('GIT_ROOT_INVALID', `workspace moved while acquiring its lock: ${JSON.stringify(workspace)}`)
+  /**
+   * Acquire the exclusive lock for one workspace.
+   *
+   * A Git worktree also binds the shared per-worktree lock derived from its Git
+   * identity; an ordinary directory owns only the durable directory lock.
+   */
+  private async acquireWorkspace(
+    workspace: Pick<WorkspaceState, 'type' | 'root'>,
+    signal?: AbortSignal,
+  ): Promise<() => Promise<void>> {
+    if (workspace.type === 'directory') {
+      return this.store.acquire(workspace.root, undefined, undefined, signal)
+    }
+    const identity = await ensureGitWorktreeIdentity(workspace.root, signal)
+    if (identity.root !== workspace.root) {
+      throw new ChangeLedgerError('GIT_ROOT_INVALID', `workspace moved while acquiring its lock: ${JSON.stringify(workspace.root)}`)
     }
-    return this.store.acquire(workspace, identity.lockPath, {
+    return this.store.acquire(workspace.root, identity.lockPath, {
       commonDir: identity.commonDir,
       gitDir: identity.gitDir,
       worktreeId: identity.worktreeId,
@@ -126,7 +134,7 @@ export class ChangeLedgerEngine {
     for (const journal of await this.store.listGitCheckpointJournals()) {
       const workspace = await resolveGitWorktreeRoot(journal.commonDir, journal.worktreeId, journal.workspace)
       const activeJournal = workspace === journal.workspace ? journal : { ...journal, workspace }
-      const release = await this.acquireWorkspace(workspace)
+      const release = await this.acquireWorkspace({ type: 'git', root: workspace })
       try {
         const manifest = await this.tryReadManifest(workspace, journal.restorePointId)
         if (journal.action === 'publish') {
@@ -223,9 +231,9 @@ export class ChangeLedgerEngine {
     readonly signal?: AbortSignal
   }): Promise<RestorePointSummary> {
     await this.ready
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       const label = normalizeLabel(options.label)
       const manifest = await this.createLocked({
@@ -267,9 +275,9 @@ export class ChangeLedgerEngine {
         throw new ChangeLedgerError('INVALID_ARGUMENTS', 'turnStartSeq must be a non-negative safe integer')
       }
       try {
-        const source = await discoverRepository(options.cwd, signal)
+        const source = await discoverWorkspace(options.cwd, this.config, signal)
         await this.assertStorageSeparated(source.state.root)
-        const release = await this.acquireWorkspace(source.state.root, signal)
+        const release = await this.acquireWorkspace(source.state, signal)
         try {
           const existing = await waitWithSignal(this.store.listManifests(source.state.root, signal), signal)
           const duplicate = existing.find(manifest => manifest.kind === 'turn'
@@ -289,7 +297,9 @@ export class ChangeLedgerEngine {
 
           throwIfAborted(signal)
           let manifest: RestorePointManifest
-          if (this.config.turnCheckpointMode === 'legacy') {
+          // Git-native checkpoints live in the repository object database, so an
+          // ordinary directory always uses the ledger's own content-addressed store.
+          if (this.config.turnCheckpointMode === 'legacy' || source.state.type === 'directory') {
             manifest = await this.createLocked({
               cwd: source.state.root,
               kind: 'turn',
@@ -352,21 +362,21 @@ export class ChangeLedgerEngine {
     readonly signal?: AbortSignal
   }): Promise<void> {
     await waitWithSignal(this.ready, options.signal)
-    const workspace = await discoverRepositoryRoot(options.cwd, options.signal)
-    await this.assertStorageSeparated(workspace)
+    const workspace = await discoverWorkspaceIdentity(options.cwd, options.signal)
+    await this.assertStorageSeparated(workspace.root)
     const release = await this.acquireWorkspace(workspace, options.signal)
     try {
       throwIfAborted(options.signal)
-      const existing = (await this.store.listManifests(workspace, options.signal)).some(manifest =>
+      const existing = (await this.store.listManifests(workspace.root, options.signal)).some(manifest =>
         manifest.kind === 'turn'
         && manifest.sessionId === options.sessionId
         && manifest.turn === options.turn
         && manifest.turnStartSeq === options.turnStartSeq)
       if (existing) {
-        await this.store.deleteTurnCheckpointSkip(workspace, options.sessionId, options.turn, options.turnStartSeq)
+        await this.store.deleteTurnCheckpointSkip(workspace.root, options.sessionId, options.turn, options.turnStartSeq)
         return
       }
-      await this.store.writeTurnCheckpointSkip(workspace, {
+      await this.store.writeTurnCheckpointSkip(workspace.root, {
         version: 1,
         sessionId: options.sessionId,
         turn: options.turn,
@@ -388,12 +398,12 @@ export class ChangeLedgerEngine {
     readonly signal?: AbortSignal
   }): Promise<{ readonly reason: string } | undefined> {
     await this.ready
-    const workspace = await discoverRepositoryRoot(options.cwd, options.signal)
-    await this.assertStorageSeparated(workspace)
+    const workspace = await discoverWorkspaceIdentity(options.cwd, options.signal)
+    await this.assertStorageSeparated(workspace.root)
     const release = await this.acquireWorkspace(workspace, options.signal)
     try {
       const skip = await this.store.readTurnCheckpointSkip(
-        workspace,
+        workspace.root,
         options.sessionId,
         options.turn,
         options.turnStartSeq,
@@ -412,9 +422,9 @@ export class ChangeLedgerEngine {
     readonly signal?: AbortSignal
   }): Promise<RestorePointSummary | undefined> {
     await this.ready
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       const manifest = (await this.store.listManifests(source.state.root)).find(point =>
         point.kind === 'turn'
@@ -436,9 +446,9 @@ export class ChangeLedgerEngine {
     readonly signal?: AbortSignal
   }): Promise<RestorePointSummary[]> {
     await this.ready
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       const manifests = await this.store.listManifests(source.state.root)
       return manifests
@@ -458,9 +468,9 @@ export class ChangeLedgerEngine {
     readonly signal?: AbortSignal
   }): Promise<RestorePointInspection> {
     await this.ready
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       const manifest = await this.store.readManifest(source.state.root, options.restorePointId)
       if (manifest.version === 2) await verifyGitCheckpoint(manifest, options.signal)
@@ -472,15 +482,17 @@ export class ChangeLedgerEngine {
       })
       const currentEntries = manifest.version === 2 ? current.gitEntries : current.entries
       if (currentEntries === undefined) throw new ChangeLedgerError('STATE_CORRUPT', 'Git comparison entries are unavailable')
+      const currentState = current.source.state
+      assertWorkspaceIdentityCompatible(manifest.repository, currentState)
       return {
         restorePoint: summarize(manifest),
         currentTreeHash: current.treeHash,
-        currentRepository: current.source.state,
-        ...(current.source.state.head === undefined ? {} : { currentHead: current.source.state.head }),
-        ...(current.source.state.branch === undefined ? {} : { currentBranch: current.source.state.branch }),
-        ...(current.source.state.operation === undefined ? {} : { currentOperation: current.source.state.operation }),
-        headChanged: repositoryHeadChanged(manifest.repository, current.source.state),
-        operationChanged: manifest.repository.operation !== current.source.state.operation,
+        currentRepository: currentState,
+        ...(currentState.type === 'git' && currentState.head !== undefined ? { currentHead: currentState.head } : {}),
+        ...(currentState.type === 'git' && currentState.branch !== undefined ? { currentBranch: currentState.branch } : {}),
+        ...(currentState.type === 'git' && currentState.operation !== undefined ? { currentOperation: currentState.operation } : {}),
+        headChanged: repositoryHeadChanged(manifest.repository, currentState),
+        operationChanged: workspaceOperationChanged(manifest.repository, currentState),
         changes: diffTrees(manifest.entries, current.entries, manifest.entries, currentEntries),
       }
     } finally {
@@ -501,9 +513,9 @@ export class ChangeLedgerEngine {
   }): Promise<RestorePlan> {
     await this.ready
     this.expirePlans()
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       const manifest = await this.store.readManifest(source.state.root, options.restorePointId)
       if (manifest.version === 2) await verifyGitCheckpoint(manifest, options.signal)
@@ -518,8 +530,8 @@ export class ChangeLedgerEngine {
       if (options.expectedCurrentTreeHash !== undefined && options.expectedCurrentTreeHash !== current.treeHash) {
         throw new ChangeLedgerError('PLAN_STALE', 'workspace changed after inspection; inspect and plan again')
       }
-      if (options.expectedRepository !== undefined && !sameRepositoryFence(options.expectedRepository, current.source.state)) {
-        throw new ChangeLedgerError('PLAN_STALE_REPOSITORY', 'Git repository state changed after inspection; inspect and plan again')
+      if (options.expectedRepository !== undefined && !sameWorkspaceFence(options.expectedRepository, current.source.state)) {
+        throw workspaceStaleError(options.expectedRepository, current.source.state, 'inspection')
       }
       assertRepositoryCompatible(manifest, current.source.state, options.allowHeadChange === true)
       const changes = diffTrees(manifest.entries, current.entries, manifest.entries, currentEntries)
@@ -581,7 +593,7 @@ export class ChangeLedgerEngine {
 
     try {
       await this.assertStorageSeparated(plan.workspace)
-      const release = await this.acquireWorkspace(plan.workspace, options.signal)
+      const release = await this.acquireWorkspace(plan.repository, options.signal)
       try {
         const manifest = await this.store.readManifest(plan.workspace, plan.restorePointId)
         if (manifest.version === 2) await verifyGitCheckpoint(manifest, options.signal)
@@ -721,9 +733,9 @@ export class ChangeLedgerEngine {
     if (options.confirmation !== `DELETE ${options.restorePointId}`) {
       throw new ChangeLedgerError('CONFIRMATION_MISMATCH', `confirmation must exactly equal "DELETE ${options.restorePointId}"`)
     }
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       const manifest = await this.store.readManifest(source.state.root, options.restorePointId)
       if (await this.store.isReferencedByRecovery(source.state.root, options.restorePointId)) {
@@ -740,9 +752,9 @@ export class ChangeLedgerEngine {
   /** List restore operations that were interrupted or require manual recovery. */
   async listRecovery(options: { readonly cwd: string; readonly signal?: AbortSignal }): Promise<RecoverySummary[]> {
     await this.ready
-    const source = await discoverRepository(options.cwd, options.signal)
+    const source = await discoverWorkspace(options.cwd, this.config, options.signal)
     await this.assertStorageSeparated(source.state.root)
-    const release = await this.acquireWorkspace(source.state.root, options.signal)
+    const release = await this.acquireWorkspace(source.state, options.signal)
     try {
       return (await this.store.listOperations(source.state.root))
         .filter((operation): operation is RestoreOperation & { state: 'interrupted' | 'recovery-required' } =>
@@ -842,10 +854,10 @@ export class ChangeLedgerEngine {
     let liveRepository = false
     let release: () => Promise<void>
     try {
-      const root = await discoverRepositoryRoot(workspace, signal)
-      if (root === workspace) {
-        await this.assertStorageSeparated(root)
-        release = await this.acquireWorkspace(root, signal)
+      const identity = await discoverWorkspaceIdentity(workspace, signal)
+      if (identity.root === workspace) {
+        await this.assertStorageSeparated(identity.root)
+        release = await this.acquireWorkspace(identity, signal)
         liveRepository = true
       } else {
         release = await this.store.acquireWorkspaceDir(workspaceDir, workspace, signal)
@@ -1129,11 +1141,13 @@ export function resolveConfig(config: ChangeLedgerConfig): ResolvedChangeLedgerC
 }
 
 function summarize(manifest: RestorePointManifest): RestorePointSummary {
+  const workspace = manifest.repository
   return {
     format: manifest.version,
     id: manifest.id,
     kind: manifest.kind,
     workspace: manifest.workspace,
+    workspaceType: workspace.type,
     ...(manifest.sessionId === undefined ? {} : { sessionId: manifest.sessionId }),
     ...(manifest.label === undefined ? {} : { label: manifest.label }),
     ...(manifest.parentRestorePoint === undefined ? {} : { parentRestorePoint: manifest.parentRestorePoint }),
@@ -1146,22 +1160,34 @@ function summarize(manifest: RestorePointManifest): RestorePointSummary {
     totalBytes: manifest.totalBytes,
     restoreCount: manifest.restoreCount,
     ...(manifest.lastRestoredAt === undefined ? {} : { lastRestoredAt: manifest.lastRestoredAt }),
-    ...(manifest.repository.head === undefined ? {} : { head: manifest.repository.head }),
-    ...(manifest.repository.branch === undefined ? {} : { branch: manifest.repository.branch }),
-    ...(manifest.repository.operation === undefined ? {} : { operation: manifest.repository.operation }),
-    stagedPathCount: manifest.repository.stagedPaths.length,
+    ...(workspace.type === 'git' && workspace.head !== undefined ? { head: workspace.head } : {}),
+    ...(workspace.type === 'git' && workspace.branch !== undefined ? { branch: workspace.branch } : {}),
+    ...(workspace.type === 'git' && workspace.operation !== undefined ? { operation: workspace.operation } : {}),
+    stagedPathCount: workspace.type === 'git' ? workspace.stagedPaths.length : 0,
     ...(manifest.version === 2 ? { trust: manifest.git.trust } : {}),
   }
 }
 
+/** Reject a fence that now describes a different workspace or workspace mode. */
+function assertWorkspaceIdentityCompatible(before: WorkspaceState, after: WorkspaceState): void {
+  if (before.type !== after.type) {
+    throw new ChangeLedgerError('WORKSPACE_MODE_CHANGED', `workspace mode changed from ${before.type} to ${after.type}`)
+  }
+  if (before.root !== after.root) {
+    throw new ChangeLedgerError('WORKSPACE_CHANGED', 'restore point no longer belongs to this workspace root')
+  }
+  if (before.type === 'git' && after.type === 'git' && before.commonDir !== after.commonDir) {
+    throw new ChangeLedgerError('REPOSITORY_CHANGED', 'restore point no longer belongs to this Git worktree')
+  }
+}
+
 function assertRepositoryCompatible(
   manifest: RestorePointManifest,
   current: RestorePointManifest['repository'],
   allowHeadChange: boolean,
 ): void {
-  if (manifest.repository.root !== current.root || manifest.repository.commonDir !== current.commonDir) {
-    throw new ChangeLedgerError('REPOSITORY_CHANGED', 'restore point no longer belongs to this Git worktree')
-  }
+  assertWorkspaceIdentityCompatible(manifest.repository, current)
+  if (manifest.repository.type !== 'git' || current.type !== 'git') return
   if (manifest.repository.operation !== current.operation) {
     throw new ChangeLedgerError(
       'GIT_OPERATION_CHANGED',
@@ -1177,23 +1203,33 @@ function assertRepositoryCompatible(
 }
 
 function repositoryHeadChanged(
-  before: RestorePointManifest['repository'],
-  after: RestorePointManifest['repository'],
+  before: WorkspaceState,
+  after: WorkspaceState,
 ): boolean {
+  if (before.type !== 'git' || after.type !== 'git') return false
   return before.head !== after.head || before.branch !== after.branch
 }
 
+function workspaceOperationChanged(before: WorkspaceState, after: WorkspaceState): boolean {
+  if (before.type !== 'git' || after.type !== 'git') return false
+  return before.operation !== after.operation
+}
+
 function assertPlanRepositoryFresh(
-  planned: RestorePointManifest['repository'],
-  current: RestorePointManifest['repository'],
+  planned: WorkspaceState,
+  current: WorkspaceState,
 ): void {
-  if (planned.root !== current.root
-    || planned.commonDir !== current.commonDir
-    || planned.head !== current.head
-    || planned.branch !== current.branch
-    || planned.operation !== current.operation) {
-    throw new ChangeLedgerError('PLAN_STALE_REPOSITORY', 'Git repository state changed after restore planning; inspect and plan again')
+  if (!sameWorkspaceFence(planned, current)) {
+    throw workspaceStaleError(planned, current, 'restore planning')
+  }
+}
+
+/** Stable stale-plan error for the workspace mode that actually drifted. */
+function workspaceStaleError(before: WorkspaceState, after: WorkspaceState, phase: string): ChangeLedgerError {
+  if (before.type === 'git' && after.type === 'git') {
+    return new ChangeLedgerError('PLAN_STALE_REPOSITORY', `Git repository state changed after ${phase}; inspect and plan again`)
   }
+  return new ChangeLedgerError('PLAN_STALE_WORKSPACE', `workspace state changed after ${phase}; inspect and plan again`)
 }
 
 function assertJournalMatchesManifest(journal: GitCheckpointJournal, manifest: RestorePointManifest): asserts manifest is RestorePointManifestV2 {

package/src/git.ts

@@ -4,13 +4,13 @@ import { link, lstat, mkdir, open, readFile, realpath, unlink } from 'node:fs/pr
 import { dirname, isAbsolute, join, resolve } from 'node:path'
 import { ChangeLedgerError, errorMessage } from './errors.js'
 import { canonicalDirectory, isNodeError, syncDirectory, validateRelativePath } from './path-utils.js'
-import type { RepositoryState } from './types.js'
+import type { GitWorkspaceState } from './types.js'
 
 const GIT_MAX_BUFFER = 32 * 1024 * 1024
 
 /** Repository discovery result plus the eligible path inventory. */
 export interface RepositorySnapshotSource {
-  readonly state: RepositoryState
+  readonly state: GitWorkspaceState
   readonly paths: readonly string[]
 }
 
@@ -63,6 +63,7 @@ export async function discoverRepository(cwd: string, signal?: AbortSignal): Pro
 
   return {
     state: {
+      type: 'git',
       root,
       commonDir,
       ...(head === undefined ? {} : { head }),
@@ -74,6 +75,46 @@ export async function discoverRepository(cwd: string, signal?: AbortSignal): Pro
   }
 }
 
+/**
+ * Discover the owning Git worktree, or return undefined when `cwd` is not
+ * inside any repository. Every other discovery failure still throws, so a
+ * broken repository never silently degrades into an ordinary directory.
+ * @param cwd - candidate working directory.
+ * @param signal - optional caller cancellation.
+ * @returns the snapshot source, or undefined outside every repository.
+ */
+export async function discoverRepositoryOptional(cwd: string, signal?: AbortSignal): Promise<RepositorySnapshotSource | undefined> {
+  try {
+    return await discoverRepository(cwd, signal)
+  } catch (error) {
+    if (isNotRepositoryError(error)) return undefined
+    throw error
+  }
+}
+
+/** Resolve the Git worktree root, or undefined when `cwd` is outside every repository. */
+export async function discoverRepositoryRootOptional(cwd: string, signal?: AbortSignal): Promise<string | undefined> {
+  try {
+    return await discoverRepositoryRoot(cwd, signal)
+  } catch (error) {
+    if (isNotRepositoryError(error)) return undefined
+    throw error
+  }
+}
+
+/**
+ * Whether one discovery failure is Git's plain "not a git repository" verdict.
+ *
+ * `gitEnvironment` pins the C locale, so the message text is stable and this
+ * three-way check (code, exit status, message) cannot swallow a real failure.
+ */
+function isNotRepositoryError(error: unknown): boolean {
+  return error instanceof ChangeLedgerError
+    && error.code === 'GIT_COMMAND_FAILED'
+    && gitExitCode(error.cause) === 128
+    && error.message.includes('not a git repository')
+}
+
 /** Resolve the canonical Git worktree root owning `cwd` without inventorying its files. */
 export async function discoverRepositoryRoot(cwd: string, signal?: AbortSignal): Promise<string> {
   const canonicalCwd = await canonicalDirectory(cwd)
@@ -131,7 +172,7 @@ export async function resolveGitWorktreeRoot(
 }
 
 /** Return true when two repository fences refer to the same checkout state. */
-export function sameRepositoryFence(left: RepositoryState, right: RepositoryState): boolean {
+export function sameRepositoryFence(left: GitWorkspaceState, right: GitWorkspaceState): boolean {
   return left.root === right.root
     && left.commonDir === right.commonDir
     && left.head === right.head
@@ -302,6 +343,10 @@ function gitEnvironment(extra: NodeJS.ProcessEnv | undefined): NodeJS.ProcessEnv
     ...extra,
     GIT_OPTIONAL_LOCKS: '0',
     GIT_TERMINAL_PROMPT: '0',
+    // Git's diagnostics are matched for the "not a git repository" verdict that
+    // selects ordinary-directory mode; pin the C locale so that stays stable.
+    LC_ALL: 'C',
+    LANG: 'C',
   }
 }
 
@@ -495,6 +540,6 @@ async function publishIdentityFile(path: string, value: string, repairMalformed:
 }
 
 /** Return the Git metadata directory for diagnostics. */
-export function gitMetadataParent(state: RepositoryState): string {
+export function gitMetadataParent(state: GitWorkspaceState): string {
   return dirname(state.commonDir)
 }

package/src/rewind-host.ts

@@ -3,7 +3,7 @@ import type { Context } from '@deepseek-ai/cordis'
 import { createDeadline } from './deadline.js'
 import { ChangeLedgerError, errorMessage } from './errors.js'
 import type { ChangeLedgerEngine } from './engine.js'
-import { discoverRepositoryRoot } from './git.js'
+import { discoverWorkspaceRoot } from './workspace.js'
 
 interface SessionEventLike {
   readonly type: string
@@ -223,7 +223,7 @@ export class TurnCheckpointCoordinator {
       this.skips.delete(key)
       const capture = (async () => {
         try {
-          const workspace = await discoverRepositoryRoot(cwd, captureSignal)
+          const workspace = await discoverWorkspaceRoot(cwd, captureSignal)
           await this.serializeWorkspace(workspace, captureSignal, async () => {
             try {
               await this.engine.createTurnCheckpoint({
@@ -455,11 +455,20 @@ export function createRewindHttpHandler(
       if (request.method === 'POST') {
         const body = objectBody(await readBody(request))
         const mode = body.mode
-        if (mode !== 'code' && mode !== 'both') {
-          throw new ChangeLedgerError('INVALID_ARGUMENTS', 'mode must be "code" or "both"')
+        if (mode !== 'code' && mode !== 'both' && mode !== 'messages') {
+          throw new ChangeLedgerError('INVALID_ARGUMENTS', 'mode must be "code", "both", or "messages"')
         }
         const sessionId = requiredText(body.sessionId, 'sessionId')
         const messageSeq = nonNegativeInteger(body.messageSeq, 'messageSeq')
+        // Messages-only rewind never reads or writes project files, so it needs
+        // neither a checkpoint nor an exclusive workspace: it resolves the turn
+        // boundary straight from the Session log and forks there.
+        if (mode === 'messages') {
+          const target = messageTarget(await readSession(ctx, sessionId), messageSeq)
+          const fork = await createConversationRestart(ctx, sessionId, target)
+          json(response, 200, { status: 'completed', mode, sessionId: fork.sessionId })
+          return
+        }
         const checkpointId = requiredText(body.checkpointId, 'checkpointId')
         const checkpoint = await checkpointForRequest(ctx, engine, sessionId, messageSeq, checkpointId)
         const activeSessionIds = await sharedWorkspaceSessions(ctx.agents, checkpoint.cwd)
@@ -608,7 +617,7 @@ async function checkpointForRequest(
 async function createConversationRestart(
   ctx: ConversationRestartContext,
   sourceId: string,
-  checkpoint: MessageCheckpoint,
+  checkpoint: MessageTarget,
 ): Promise<{ readonly sessionId: string }> {
   const source = await readSession(ctx, sourceId)
   const current = messageTarget(source, checkpoint.messageSeq)
@@ -724,16 +733,16 @@ async function sharedWorkspaceSessions(
 ): Promise<readonly string[]> {
   const listed = agents?.list() ?? []
   if (listed.length === 0) return []
-  const root = await discoverRepositoryRoot(cwd)
+  const root = await discoverWorkspaceRoot(cwd)
   const shared: string[] = []
   for (const agent of listed) {
     if (agent.status !== 'running') continue
     const session = agent.session
     if (session.header.cwd === undefined) continue
     try {
-      if (await discoverRepositoryRoot(session.header.cwd) === root) shared.push(session.id)
+      if (await discoverWorkspaceRoot(session.header.cwd) === root) shared.push(session.id)
     } catch {
-      // A live Session whose cwd is not a valid Git worktree cannot share this worktree.
+      // A live Session whose cwd cannot be resolved cannot share this workspace.
     }
   }
   return shared.sort()

package/src/snapshot.ts

@@ -2,9 +2,9 @@ import { createHash } from 'node:crypto'
 import { constants, type BigIntStats } from 'node:fs'
 import { lstat, open, readlink } from 'node:fs/promises'
 import { ChangeLedgerError } from './errors.js'
-import { discoverRepository, sameRepositoryFence, type RepositorySnapshotSource } from './git.js'
 import { isNodeError, resolveWorkspacePath } from './path-utils.js'
 import type { LedgerStore } from './store.js'
+import { discoverWorkspace, sameWorkspaceFence, type WorkspaceSnapshotSource } from './workspace.js'
 import type {
   ResolvedChangeLedgerConfig,
   SnapshotEntry,
@@ -15,7 +15,7 @@ const COMPARISON_READ_BUDGET_BYTES = 128 * 1024 * 1024
 
 /** One captured tree, optionally persisted into the blob store. */
 export interface CapturedTree {
-  readonly source: RepositorySnapshotSource
+  readonly source: WorkspaceSnapshotSource
   readonly entries: Readonly<Record<string, SnapshotEntry>>
   readonly gitEntries?: Readonly<Record<string, SnapshotEntry>>
   readonly treeHash: string
@@ -32,7 +32,7 @@ export async function captureTree(options: {
   readonly signal?: AbortSignal
 }): Promise<CapturedTree> {
   throwIfAborted(options.signal)
-  const source = await discoverRepository(options.cwd, options.signal)
+  const source = await discoverWorkspace(options.cwd, options.config, options.signal)
   if (source.paths.length > options.config.maxFiles) {
     throw new ChangeLedgerError(
       'TOO_MANY_FILES',
@@ -41,7 +41,9 @@ export async function captureTree(options: {
   }
 
   const entries: Record<string, SnapshotEntry> = Object.create(null) as Record<string, SnapshotEntry>
-  const gitObjectFormat = options.gitObjectFormat
+  // Git-object capture only applies to a Git worktree; an ordinary directory
+  // always stores its own content-addressed blobs.
+  const gitObjectFormat = source.state.type === 'git' ? options.gitObjectFormat : undefined
   const gitCapture = gitObjectFormat === undefined
     ? undefined
     : {
@@ -135,8 +137,8 @@ export async function captureStableTree(options: {
     })
     const second = await captureTree(options)
     if (first.treeHash === second.treeHash
-      && sameRepositoryFence(first.source.state, second.source.state)
-      && arraysEqual(first.source.state.stagedPaths, second.source.state.stagedPaths)
+      && sameWorkspaceFence(first.source.state, second.source.state)
+      && sameStagedPaths(first.source, second.source)
       && arraysEqual(first.source.paths, second.source.paths)) {
       return second
     }
@@ -144,6 +146,12 @@ export async function captureStableTree(options: {
   throw new ChangeLedgerError('WORKSPACE_CHANGED_DURING_CAPTURE', 'workspace did not remain stable across repeated full-tree captures')
 }
 
+/** Whether two captures observed the same index state; ordinary directories have none. */
+function sameStagedPaths(left: WorkspaceSnapshotSource, right: WorkspaceSnapshotSource): boolean {
+  if (left.state.type !== 'git' || right.state.type !== 'git') return true
+  return arraysEqual(left.state.stagedPaths, right.state.stagedPaths)
+}
+
 /** Compute stable path-level differences between two captured trees. */
 export function diffTrees(
   before: Readonly<Record<string, SnapshotEntry>>,

package/src/types.ts

@@ -34,7 +34,8 @@ export interface SymlinkSnapshotEntry {
 export type SnapshotEntry = FileSnapshotEntry | SymlinkSnapshotEntry
 
 /** Git facts that fence a restore point to the repository state it observed. */
-export interface RepositoryState {
+export interface GitWorkspaceState {
+  readonly type: 'git'
   readonly root: string
   readonly commonDir: string
   readonly head?: string
@@ -43,6 +44,18 @@ export interface RepositoryState {
   readonly stagedPaths: readonly string[]
 }
 
+/** Identity of an ordinary directory workspace captured without Git. */
+export interface DirectoryWorkspaceState {
+  readonly type: 'directory'
+  readonly root: string
+}
+
+/** Workspace facts that fence a restore point to the state it observed. */
+export type WorkspaceState = GitWorkspaceState | DirectoryWorkspaceState
+
+/** @deprecated Use `WorkspaceState`; the durable manifest field keeps its original name. */
+export type RepositoryState = WorkspaceState
+
 /** Why a restore point exists. */
 export type RestorePointKind = 'user' | 'rescue' | 'turn'
 
@@ -89,8 +102,10 @@ export interface GitCheckpointMetadata {
 }
 
 /** Automatic turn checkpoint whose content is stored in the repository object database. */
-export interface RestorePointManifestV2 extends Omit<RestorePointManifestV1, 'version' | 'treeHash'> {
+export interface RestorePointManifestV2 extends Omit<RestorePointManifestV1, 'version' | 'treeHash' | 'repository'> {
   readonly version: typeof GIT_CHECKPOINT_FORMAT_VERSION
+  /** Git-native checkpoints only exist for a Git worktree. */
+  readonly repository: GitWorkspaceState
   /** Deterministic sidecar identity; Git tree integrity is verified separately. */
   readonly treeHash: string
   readonly git: GitCheckpointMetadata
@@ -126,6 +141,7 @@ export interface RestorePointSummary {
   readonly id: RestorePointId
   readonly kind: RestorePointKind
   readonly workspace: string
+  readonly workspaceType: WorkspaceState['type']
   readonly sessionId?: string
   readonly label?: string
   readonly parentRestorePoint?: RestorePointId