@blastin-dev/clocktopus-cli 0.2.1 → 0.3.1

package/dist/src/lib/codex-config.js

@@ -2,51 +2,37 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, renameSync, statSync
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
-/**
- * Reads and edits Codex CLI's configuration on the user's behalf.
- *
- * Codex splits what Claude Code keeps in one file: telemetry goes in
- * `~/.codex/config.toml` under `[otel]`, hooks go in a separate
- * `~/.codex/hooks.json`. Both are edited here under the same two rules as
- * `claude-settings.ts` — never write over something we could not parse, and
- * only ever touch keys we put there — plus a third that TOML forces on us:
- *
- * **Splice, don't re-serialise.** A round trip through a TOML parser throws
- * away every comment and blank line in the file. `config.toml` is a file
- * people hand-write and annotate, so only the `[otel]` region is replaced
- * textually; everything else survives byte for byte. `writeCodexConfig`
- * re-parses the spliced result and refuses to write if anything outside
- * `[otel]` moved, which is what makes the textual approach safe.
- *
- * ## What Codex does with these, and why it matters here
- *
- * - `otel.exporter` is the **log** exporter, and Codex POSTs to the URL
- *   verbatim — it does not append `/v1/logs` the way the OTel SDK does. The
- *   path is therefore part of the configured endpoint, and
- *   `readCodexTelemetry` strips it back off to recover the receiver base.
- * - Codex will not run a `hooks.json` it has not been shown: the first
- *   session after this file changes prompts "Hooks need review" and
- *   persists the answer under `[hooks.state]`. Setup cannot do that for the
- *   user, so it tells them instead — see `setup.ts`.
- */
+// Reads and edits Codex CLI's configuration on the user's behalf.
+//
+// Codex splits what Claude Code keeps in one file: telemetry in
+// `~/.codex/config.toml` under `[otel]`, hooks in `~/.codex/hooks.json`. Both follow
+// the same two rules as `claude-settings.ts` — never write over something we could
+// not parse, only ever touch keys we put there — plus a third that TOML forces:
+//
+// Splice, don't re-serialise. A round trip through a TOML parser throws away every
+// comment and blank line, and `config.toml` is hand-written and annotated. Only the
+// `[otel]` region is replaced textually; `writeCodexConfig` re-parses the result and
+// refuses to write if anything outside `[otel]` moved, which is what makes that safe.
+//
+// Two Codex behaviours matter here:
+//
+// - `otel.exporter` is the *log* exporter, and Codex POSTs to the URL verbatim — it
+//   does not append `/v1/logs` the way the OTel SDK does. The path is part of the
+//   configured endpoint, and `readCodexTelemetry` strips it back off.
+// - Codex will not run a `hooks.json` it has not been shown: the first session after
+//   this file changes prompts "Hooks need review" and persists the answer under
+//   `[hooks.state]`. Setup cannot do that for the user, so it tells them — see
+//   `setup.ts`.
 export const CODEX_CONFIG_FILENAME = "config.toml";
 export const CODEX_HOOKS_FILENAME = "hooks.json";
-/**
- * The receiver path Codex's log exporter is pointed at.
- *
- * Load-bearing in both directions: written onto the endpoint because Codex
- * sends to the literal URL, and stripped when reading because the hook and
- * `/v1/verify` need the base.
- */
+// The receiver path Codex's log exporter is pointed at. Load-bearing both ways:
+// written onto the endpoint because Codex sends to the literal URL, and stripped when
+// reading because the hook and `/v1/verify` need the base.
 export const CODEX_LOGS_PATH = "/v1/logs";
-/**
- * Seconds Codex will wait for each hook.
- *
- * SessionEnd is 3 rather than 10 because Codex hard-clamps it to 3 and
- * prints `warning: clamping SessionEnd hook timeout to 3s` on every single
- * session start otherwise — a permanent warning about a value we chose is
- * worse than the shorter budget, and the hook's own request timeout is 4s.
- */
+// Seconds Codex will wait for each hook. SessionEnd is 3 rather than 10 because Codex
+// hard-clamps it to 3 and otherwise prints a warning on every session start — a
+// permanent warning about a value we chose is worse than the shorter budget, and the
+// hook's own request timeout is 4s.
 export const CODEX_HOOK_TIMEOUT_SECONDS = { SessionStart: 10, SessionEnd: 3 };
 const HOOK_EVENTS = ["SessionStart", "SessionEnd"];
 /** Exported so callers can tell "none approved" from "some approved". */
@@ -60,8 +46,8 @@ export class CodexConfigParseError extends Error {
     }
 }
 export function codexConfigDir() {
-    // Codex honours CODEX_HOME; following it means setup writes where that
-    // installation actually reads.
+    // Codex honours CODEX_HOME; following it means setup writes where that installation
+    // actually reads.
     return process.env.CODEX_HOME || join(homedir(), ".codex");
 }
 export function codexConfigPath() {
@@ -70,9 +56,6 @@ export function codexConfigPath() {
 export function codexHooksPath() {
     return join(codexConfigDir(), CODEX_HOOKS_FILENAME);
 }
-/* -------------------------------------------------------------------------
- * config.toml
- * ---------------------------------------------------------------------- */
 export function readCodexConfig(path = codexConfigPath()) {
     if (!existsSync(path)) {
         return { path, exists: false, modifiedAt: null, text: "", config: {} };
@@ -97,8 +80,8 @@ const OWNED_OTEL_KEYS = ["exporter", "log_user_prompt"];
 export function buildCodexOtel(input) {
     const endpoint = `${input.endpoint.replace(/\/$/, "")}${CODEX_LOGS_PATH}`;
     return {
-        // The receiver answers protobuf with an explicit 415, and only JSON
-        // actually works. Codex's default for this exporter is `binary`.
+        // The receiver answers protobuf with an explicit 415, and only JSON actually works.
+        // Codex's default for this exporter is `binary`.
         exporter: {
             "otlp-http": {
                 endpoint,
@@ -106,21 +89,15 @@ export function buildCodexOtel(input) {
                 headers: { Authorization: `Bearer ${input.token}` },
             },
         },
-        // Already the default, set explicitly anyway: the receiver never reads
-        // the `prompt` attribute, but not sending it at all is one fewer thing
-        // in flight. It does not cover tool output — Codex has a single log
-        // exporter and no switch for that, which is why the receiver's
+        // Already the default, set explicitly anyway. It does not cover tool output — Codex
+        // has a single log exporter and no switch for that, which is why the receiver's
         // allowlist, not this line, is what actually holds.
         log_user_prompt: false,
     };
 }
-/**
- * Replaces the `[otel]` region of a TOML document, preserving everything else.
- *
- * Returns the new text. Region detection is deliberately dumb — table
- * headers only — and `writeCodexConfig` verifies the result by re-parsing,
- * so a document this misreads is refused rather than mangled.
- */
+// Replaces the `[otel]` region of a TOML document, preserving everything else.
+// Region detection is deliberately dumb — table headers only — and `writeCodexConfig`
+// verifies by re-parsing, so a document this misreads is refused rather than mangled.
 export function spliceOtelSection(text, otel) {
     const rendered = otel && Object.keys(otel).length > 0
         ? stringifyToml({ otel }).trimEnd()
@@ -151,8 +128,8 @@ export function spliceOtelSection(text, otel) {
     const before = lines.slice(0, start);
     const after = lines.slice(end);
     const middle = rendered ? rendered.split("\n") : [];
-    // Drop the blank line that separated a removed section from what follows,
-    // so repeated add/remove cycles cannot pile up empty lines.
+    // Drop the blank line that separated a removed section from what follows, so repeated
+    // add/remove cycles cannot pile up empty lines.
     if (!rendered) {
         while (before.length > 0 && before[before.length - 1]?.trim() === "")
             before.pop();
@@ -161,15 +138,11 @@ export function spliceOtelSection(text, otel) {
     }
     return `${[...before, ...middle, ...after].join("\n").trimEnd()}\n`;
 }
-/**
- * Writes config.toml, keeping a one-deep backup and verifying the splice.
- *
- * The verification is the point: it re-parses what is about to be written
- * and compares every top-level key *except* `otel` against what was there
- * before. If the textual splice disturbed anything else — an exotic layout
- * the region scanner misread — the write is refused with the user's file
- * still intact.
- */
+// Writes config.toml, keeping a one-deep backup and verifying the splice.
+//
+// The verification is the point: it re-parses what is about to be written and compares
+// every top-level key except `otel` against what was there before. If the splice
+// disturbed anything else, the write is refused with the user's file still intact.
 export function writeCodexConfig(input) {
     const path = input.path ?? codexConfigPath();
     let nextConfig;
@@ -197,9 +170,8 @@ export function writeCodexConfig(input) {
         backupPath = `${path}.clocktopus-backup`;
         copyFileSync(path, backupPath);
     }
-    // Rename rather than write in place: a crash midway leaves either the old
-    // file or the new one, never a truncated config Codex would refuse to
-    // start with.
+    // Rename rather than write in place: a crash midway leaves either the old file or the
+    // new one, never a truncated config Codex would refuse to start with.
     const temporaryPath = `${path}.clocktopus-tmp`;
     writeFileSync(temporaryPath, input.nextText, {
         encoding: "utf8",
@@ -310,9 +282,8 @@ export function applyCodexHooks(file, input) {
     const existing = asTable(file.hooks);
     const hooks = { ...existing };
     for (const event of HOOK_EVENTS) {
-        // Remove-then-append rather than append: re-running setup must not
-        // leave two hooks firing per session, which would double every
-        // SessionStart POST.
+        // Remove-then-append rather than append: re-running setup must not leave two hooks
+        // firing per session, which would double every SessionStart POST.
         hooks[event] = [
             ...withoutOurHooks(asGroups(existing[event])),
             {
@@ -321,21 +292,18 @@ export function applyCodexHooks(file, input) {
                         type: "command",
                         command: input.hookCommand,
                         timeout: CODEX_HOOK_TIMEOUT_SECONDS[event],
-                        // No `async` key, deliberately. Codex 0.147 *skips* an async
-                        // SessionStart hook outright — costing every session its
-                        // repository context, with only a startup warning to say so —
-                        // and every version so far still runs an async SessionEnd
-                        // synchronously and warns about it once per session. `agent
-                        // hook` backgrounds itself instead, which is correct on all of
-                        // them and quiet on all of them.
+                        // No `async` key, deliberately. Codex 0.147 *skips* an async SessionStart outright —
+                        // costing every session its repository context — and every version so far still runs
+                        // an async SessionEnd synchronously and warns once per session. `agent hook`
+                        // backgrounds itself instead, which is correct and quiet on all of them.
                     },
                 ],
             },
         ];
     }
     return {
-        // Codex shows this string when it asks the user to trust the file, so
-        // it is the one chance to say where it came from.
+        // Codex shows this string when it asks the user to trust the file, so it is the one
+        // chance to say where it came from.
         description: typeof file.description === "string" && file.description
             ? file.description
             : "Clocktopus agent telemetry",
@@ -379,27 +347,20 @@ export function writeCodexHooks(file, path = codexHooksPath()) {
     renameSync(temporaryPath, path);
     return { backupPath };
 }
-/**
- * Which of our hooks Codex has been shown and told to run.
- *
- * Trust is recorded **per hook entry**, not per file:
- *
- * ```toml
- * [hooks.state."/home/you/.codex/hooks.json:session_end:0:0"]
- * trusted_hash = "sha256:…"
- * ```
- *
- * The key is `<path>:<event>:<group index>:<hook index>`, with the event in
- * snake_case. Per-entry granularity is why this reports each event rather
- * than a single boolean: partial trust is a real state, and the one that
- * matters. A machine whose `SessionEnd` is trusted and whose `SessionStart`
- * is not records spend with no repository attached to it — which is exactly
- * what an `async: true` SessionStart used to produce on Codex 0.147, since
- * the hook was skipped before it could ever be offered for approval.
- *
- * The hash is Codex's own and is not recomputed here; changing `hooks.json`
- * invalidates it and Codex re-prompts, which is the behaviour we want.
- */
+// Which of our hooks Codex has been shown and told to run.
+//
+// Trust is recorded per hook *entry*, not per file, keyed
+// `<path>:<event>:<group index>:<hook index>` with the event in snake_case:
+//
+//   [hooks.state."/home/you/.codex/hooks.json:session_end:0:0"]
+//   trusted_hash = "sha256:…"
+//
+// Per-entry granularity is why this reports each event rather than a single boolean:
+// partial trust is a real state, and the one that matters. A machine whose SessionEnd
+// is trusted and whose SessionStart is not records spend with no repository attached.
+//
+// The hash is Codex's own and is not recomputed here; changing `hooks.json`
+// invalidates it and Codex re-prompts, which is the behaviour we want.
 export function readCodexHookTrust(path = codexConfigPath()) {
     let config;
     try {
@@ -414,18 +375,15 @@ export function readCodexHookTrust(path = codexConfigPath()) {
     for (const [key, value] of Object.entries(state)) {
         if (!key.startsWith(prefix))
             continue;
-        // `enabled` is optional and version-dependent: Codex 0.147 wrote
-        // `enabled = true` next to the hash, 0.148 persists `trusted_hash`
-        // alone (its `HookStateToml` has no such field) and leaves any older
-        // key untouched. Requiring it read a freshly approved 0.148 install as
-        // pending forever. Absent means approved; only an explicit `false`
-        // — a hook the user disabled — counts as untrusted.
+        // `enabled` is optional and version-dependent: 0.147 wrote `enabled = true` next to
+        // the hash, 0.148 persists `trusted_hash` alone. Requiring it read a freshly approved
+        // 0.148 install as pending forever. Absent means approved; only an explicit `false`
+        // counts as untrusted.
         const entry = asTable(value);
         if (entry.enabled === false || typeof entry.trusted_hash !== "string")
             continue;
-        // `<path>:<event>:<group>:<index>` — the event is the segment after the
-        // path, which may itself contain colons on no sane platform but is
-        // sliced by prefix length rather than split, just in case.
+        // `<path>:<event>:<group>:<index>` — sliced by prefix length rather than split, since
+        // a path could in principle contain a colon.
         const event = key.slice(prefix.length).split(":")[0];
         const match = HOOK_EVENTS.find((candidate) => toSnakeCase(candidate) === event);
         if (match)

package/dist/src/lib/declared-commits.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Arguments for reading the session's slice of the reflog, or `null` when the
+ * session's start was never recorded.
+ *
+ * A null return means *declare nothing*, deliberately. Without a lower bound the
+ * reflog would hand back the checkout's entire history; the time-window rule already
+ * covers a session that cannot declare, and over-declaring is the one mistake it
+ * cannot undo — a `declared` link outranks the window and is permanent.
+ */
+export declare function buildReflogArgs(input: {
+    /** ISO timestamp recorded at SessionStart. */
+    startedAt?: string;
+    /** Upper bound, for the sweep: a session that died hours ago owns nothing since. */
+    until?: string;
+}): string[] | null;
+/**
+ * The commits created in this checkout, newest first, from `buildReflogArgs` output.
+ *
+ * Three actions always author a commit here and are kept: `commit` (with its
+ * `(initial)`, `(amend)` and `(merge)` variants), `revert` and `cherry-pick`.
+ * `checkout` and `reset` move HEAD without writing anything.
+ *
+ * **`merge` and `pull` are excluded even though a clean merge does author a commit**,
+ * because nothing in the reflog separates one you made from one you fast-forwarded
+ * onto. Parent count looks like it would and does not — a plain `git pull` on a
+ * repository that merges its pull requests lands on a two-parent commit somebody else
+ * wrote:
+ *
+ *     parents=14c3726 6d88961 | pull: Fast-forward
+ *
+ * A conflicted merge is still caught, since resolving one ends in `commit (merge)`.
+ * A clean one falls to the time-window rule.
+ *
+ * `rebase (pick)` is excluded for the matching reason: replaying a branch would
+ * declare every commit on it, including work authored long before the session. The
+ * cost is that a session which commits and then rebases declares the pre-rebase SHA,
+ * which was never pushed and simply joins to nothing.
+ *
+ * Every exclusion here is recoverable and every wrong inclusion is not: a `declared`
+ * link outranks the time window and is permanent.
+ */
+export declare function parseReflogCommits(output: string | undefined): string[];
+//# sourceMappingURL=declared-commits.d.ts.map

package/dist/src/lib/declared-commits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared-commits.d.ts","sourceRoot":"","sources":["../../../src/lib/declared-commits.ts"],"names":[],"mappings":"AAoBA;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE;IACrC,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,EAAE,GAAG,IAAI,CA2BlB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAyBvE"}

package/dist/src/lib/declared-commits.js

@@ -0,0 +1,114 @@
+// Resolving the commits a session actually created.
+//
+// The obvious answer, `git rev-list before..head`, answers a different question:
+// "what is reachable from here that was not reachable from there". Merged and pulled
+// history is reachable, so it gets declared — one real session claimed 105 commits
+// reaching two months back (BLA-595) — and a mid-session switch to a *pre-existing*
+// branch makes the session's own earlier commits unreachable, so they vanish.
+//
+// The reflog answers the right question. It records HEAD movements in this checkout,
+// tagged with what caused them, so a `pull` or a `merge` is one entry rather than one
+// per commit it brought along, and a branch switch is irrelevant to what was authored.
+// It is also per-worktree (`.git/worktrees/<name>/logs/HEAD`), so parallel agents in
+// separate worktrees observe disjoint histories and cannot both claim a commit.
+//
+// Two agents in one worktree share a reflog and remain genuinely indistinguishable.
+// That is a real limit, not an oversight.
+/** Ceiling on what one session may declare. */
+const MAX_DECLARED_COMMITS = 200;
+/**
+ * Arguments for reading the session's slice of the reflog, or `null` when the
+ * session's start was never recorded.
+ *
+ * A null return means *declare nothing*, deliberately. Without a lower bound the
+ * reflog would hand back the checkout's entire history; the time-window rule already
+ * covers a session that cannot declare, and over-declaring is the one mistake it
+ * cannot undo — a `declared` link outranks the window and is permanent.
+ */
+export function buildReflogArgs(input) {
+    // No grace before `startedAt`, deliberately. Both timestamps come from the same
+    // machine clock, so there is no skew to absorb, and SessionStart fires before the
+    // agent can act, so nothing it wrote can predate the stamp. A backward grace could
+    // therefore only admit a commit made *before* the session — the `wip` a developer
+    // makes just before launching an agent — as `declared`, which outranks the time
+    // window and is permanent. `--prune` cannot undo it either: that cuts at an hour.
+    const since = asIso(input.startedAt);
+    if (!since)
+        return null;
+    const args = [
+        "reflog",
+        "show",
+        "HEAD",
+        "--format=%H %gs",
+        `--since=${since}`,
+    ];
+    const until = asIso(input.until);
+    if (until)
+        args.push(`--until=${until}`);
+    // A working tree containing a file called `HEAD` makes git refuse the whole read —
+    // "ambiguous argument 'HEAD': both revision and filename" — which `git()` swallows,
+    // so the session would silently declare nothing.
+    args.push("--");
+    return args;
+}
+/**
+ * The commits created in this checkout, newest first, from `buildReflogArgs` output.
+ *
+ * Three actions always author a commit here and are kept: `commit` (with its
+ * `(initial)`, `(amend)` and `(merge)` variants), `revert` and `cherry-pick`.
+ * `checkout` and `reset` move HEAD without writing anything.
+ *
+ * **`merge` and `pull` are excluded even though a clean merge does author a commit**,
+ * because nothing in the reflog separates one you made from one you fast-forwarded
+ * onto. Parent count looks like it would and does not — a plain `git pull` on a
+ * repository that merges its pull requests lands on a two-parent commit somebody else
+ * wrote:
+ *
+ *     parents=14c3726 6d88961 | pull: Fast-forward
+ *
+ * A conflicted merge is still caught, since resolving one ends in `commit (merge)`.
+ * A clean one falls to the time-window rule.
+ *
+ * `rebase (pick)` is excluded for the matching reason: replaying a branch would
+ * declare every commit on it, including work authored long before the session. The
+ * cost is that a session which commits and then rebases declares the pre-rebase SHA,
+ * which was never pushed and simply joins to nothing.
+ *
+ * Every exclusion here is recoverable and every wrong inclusion is not: a `declared`
+ * link outranks the time window and is permanent.
+ */
+export function parseReflogCommits(output) {
+    if (!output?.trim())
+        return [];
+    const shas = [];
+    const seen = new Set();
+    for (const line of output.split("\n")) {
+        // The SHA can contain no spaces, so the first one ends it; the subject keeps its
+        // own.
+        const separator = line.indexOf(" ");
+        if (separator === -1)
+            continue;
+        const sha = line.slice(0, separator).trim();
+        const subject = line.slice(separator + 1).trim();
+        if (!/^[0-9a-f]{7,64}$/i.test(sha))
+            continue;
+        if (!/^(commit|revert|cherry-pick)\b/.test(subject))
+            continue;
+        if (seen.has(sha))
+            continue;
+        seen.add(sha);
+        shas.push(sha);
+        if (shas.length === MAX_DECLARED_COMMITS)
+            break;
+    }
+    return shas;
+}
+function asIso(value) {
+    return asDate(value)?.toISOString() ?? null;
+}
+function asDate(value) {
+    if (!value)
+        return null;
+    const at = new Date(value);
+    return Number.isNaN(at.getTime()) ? null : at;
+}

package/dist/src/lib/declared-commits.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=declared-commits.test.d.ts.map

package/dist/src/lib/declared-commits.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"declared-commits.test.d.ts","sourceRoot":"","sources":["../../../src/lib/declared-commits.test.ts"],"names":[],"mappings":""}

package/dist/src/lib/declared-commits.test.js

@@ -0,0 +1,129 @@
+import { describe, expect, it } from "vitest";
+import { buildReflogArgs, parseReflogCommits } from "./declared-commits.js";
+const STARTED_AT = "2026-08-20T05:35:45.728Z";
+const SHA = "418a320a048f839f2200106fbcffbb6f7683d135";
+const reflog = (...lines) => lines.join("\n");
+describe("buildReflogArgs", () => {
+    it("bounds the read at the session start exactly", () => {
+        expect(buildReflogArgs({ startedAt: STARTED_AT })).toContain(`--since=${STARTED_AT}`);
+    });
+    /**
+     * No backward grace. Both stamps come from one machine clock, and SessionStart fires
+     * before the agent can act, so a grace could only admit a commit made *before* the
+     * session — as `declared`, which outranks the time window and is permanent.
+     */
+    it("admits nothing committed before the session started", () => {
+        const args = buildReflogArgs({ startedAt: STARTED_AT });
+        const since = args
+            .find((arg) => arg.startsWith("--since="))
+            .replace("--since=", "");
+        expect(new Date(since).getTime()).toBe(new Date(STARTED_AT).getTime());
+    });
+    /** The sweep runs hours late; a session that died owns nothing committed since. */
+    it("takes an upper bound, for the sweep", () => {
+        const args = buildReflogArgs({
+            startedAt: STARTED_AT,
+            until: "2026-08-20T11:56:30.103Z",
+        });
+        expect(args).toContain("--until=2026-08-20T11:56:30.103Z");
+    });
+    /**
+     * A working tree with a file called `HEAD` otherwise makes git refuse the read
+     * outright — "ambiguous argument 'HEAD': both revision and filename".
+     */
+    it("separates the revision from any path of the same name", () => {
+        expect(buildReflogArgs({ startedAt: STARTED_AT }).at(-1)).toBe("--");
+    });
+    it("omits the upper bound for a live SessionEnd", () => {
+        const args = buildReflogArgs({ startedAt: STARTED_AT });
+        expect(args.some((arg) => arg.startsWith("--until="))).toBe(false);
+    });
+    /**
+     * Declaring nothing is the deliberate answer. Without a lower bound the reflog is
+     * the checkout's entire history, and a `declared` link outranks the time window, so
+     * over-declaring is the one mistake that cannot be undone later.
+     */
+    it("refuses to read at all when the session start was never recorded", () => {
+        expect(buildReflogArgs({})).toBeNull();
+        expect(buildReflogArgs({ startedAt: "not a date" })).toBeNull();
+    });
+});
+describe("parseReflogCommits", () => {
+    it("takes the commits this checkout authored", () => {
+        const shas = parseReflogCommits(reflog(`${SHA} commit: fix(bla-597): read the reflog`, "cd72bebc2ce64099f27f28e251be57cb53189328 commit (merge): merge the release branch"));
+        expect(shas).toEqual([SHA, "cd72bebc2ce64099f27f28e251be57cb53189328"]);
+    });
+    it("takes a revert and a cherry-pick, which always author here", () => {
+        const shas = parseReflogCommits(reflog('aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa revert: Revert "feat: c2"', "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb cherry-pick: feat: c3"));
+        expect(shas).toHaveLength(2);
+    });
+    /**
+     * Parent count looks like it would separate a merge you made from one you
+     * fast-forwarded onto, and does not: a plain `git pull` on a repository that merges
+     * its pull requests lands on a two-parent commit somebody else wrote. So merges are
+     * excluded, and a conflicted one is still caught as `commit (merge)`.
+     */
+    it("ignores a clean merge rather than risk claiming a pulled one", () => {
+        const shas = parseReflogCommits(reflog("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa merge side: Merge made by the 'ort' strategy.", "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb pull: Fast-forward"));
+        expect(shas).toEqual([]);
+    });
+    /**
+     * The whole point. A pull or a merge is one reflog entry however much history it
+     * brings — the range that replaced this declared 118 commits for one such merge.
+     */
+    it("ignores history that merely arrived in the checkout", () => {
+        const shas = parseReflogCommits(reflog("4257246e3860ef8d834e4e4efbb7ed0da648ad23 pull: Fast-forward", "9f0ae840a64bae586d8e816124278ee0212ad0cc merge develop: Merge made by the 'ort' strategy.", "64d934042b0568a7acded2b059148dbc8f36ac83 checkout: moving from develop to a-branch", "6f59f8ad63a21000406480c17e766ea0706dff70 reset: moving to HEAD~1"));
+        expect(shas).toEqual([]);
+    });
+    /**
+     * A rebase writes new objects, but replaying a branch would declare work authored
+     * long before the session. Excluded; the pushed SHAs fall to the time-window rule.
+     */
+    it("ignores rebase replays", () => {
+        const shas = parseReflogCommits(reflog("64d934042b0568a7acded2b059148dbc8f36ac83 rebase (start): checkout develop", "cd72bebc2ce64099f27f28e251be57cb53189328 rebase (pick): fix(bla-595): bound the range", "cd72bebc2ce64099f27f28e251be57cb53189328 rebase (finish): returning to a-branch"));
+        expect(shas).toEqual([]);
+    });
+    it("keeps an amend, whose old and new SHAs are both reflog commits", () => {
+        const shas = parseReflogCommits(reflog("aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa commit (amend): fix(bla-597): reworded", "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb commit: fix(bla-597): original"));
+        // Only the amended SHA is ever pushed; the original simply joins to nothing.
+        expect(shas).toHaveLength(2);
+    });
+    it("keeps an initial commit", () => {
+        expect(parseReflogCommits(`${SHA} commit (initial): base`)).toEqual([SHA]);
+    });
+    it("survives a subject containing the field separator", () => {
+        const shas = parseReflogCommits(`${SHA} commit: fix(bla-597): read HEAD, then the reflog`);
+        expect(shas).toEqual([SHA]);
+    });
+    it("does not repeat a SHA HEAD returned to", () => {
+        const shas = parseReflogCommits(reflog(`${SHA} commit: one`, `${SHA} commit (amend): one, reworded`));
+        expect(shas).toEqual([SHA]);
+    });
+    it("returns nothing for an empty or unreadable reflog", () => {
+        expect(parseReflogCommits("")).toEqual([]);
+        expect(parseReflogCommits(undefined)).toEqual([]);
+        expect(parseReflogCommits("not a reflog line")).toEqual([]);
+    });
+    it("caps what one session may declare", () => {
+        const lines = Array.from({ length: 250 }, (_, i) => `${i.toString(16).padStart(40, "0")} commit: commit ${i}`);
+        expect(parseReflogCommits(reflog(...lines))).toHaveLength(200);
+    });
+});
+/**
+ * The sweep's upper bound is the state file's mtime, which is only a record of "last
+ * activity" on a host that rewrites the file as the session goes. Everywhere else the
+ * file is written once at SessionStart, so `until` equals `startedAt` and the window
+ * collapses onto a point — which is why `sweptCommits` refuses to read it at all for
+ * those hosts rather than relying on this shape.
+ */
+describe("the window a sweep would ask for", () => {
+    it("collapses to a point when until is the session start", () => {
+        const args = buildReflogArgs({
+            startedAt: STARTED_AT,
+            until: STARTED_AT,
+        });
+        const since = args.find((a) => a.startsWith("--since=")).slice(8);
+        const until = args.find((a) => a.startsWith("--until=")).slice(8);
+        expect(new Date(since).getTime()).toBe(new Date(until).getTime());
+    });
+});

package/dist/src/lib/git-remotes.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Parses `git remote -v` into a deduplicated URL list, `origin` first.
+ *
+ * Order is load-bearing in one narrow way: the first entry is what a receiver older
+ * than BLA-598 reads as the only remote, so keeping `origin` there preserves the
+ * previous behaviour exactly.
+ */
+export declare function parseGitRemotes(output: string | undefined): string[];
+//# sourceMappingURL=git-remotes.d.ts.map

package/dist/src/lib/git-remotes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-remotes.d.ts","sourceRoot":"","sources":["../../../src/lib/git-remotes.ts"],"names":[],"mappings":"AAWA;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAkCpE"}