@bli-cockpit/cli 0.2.57 → 0.2.58

package/dist/repo-identity-git.js

@@ -0,0 +1,76 @@
+/**
+ * Every place this package shells out to `git`, plus the two ways a branch
+ * is read when git itself cannot be asked (a `.git` file's HEAD, for a
+ * linked worktree whose git process is unavailable). Sibling of
+ * `repo-identity.ts`, named in its header.
+ */
+import { execFile } from "node:child_process";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { describeError, isMissingFileFailure } from "./health-detail.js";
+const execFileAsync = promisify(execFile);
+export async function runGit(args, cwd) {
+    const { stdout } = await execFileAsync("git", args, {
+        cwd,
+        timeout: 2_000,
+        maxBuffer: 1024 * 1024,
+    });
+    return stdout;
+}
+export async function hasGitMarker(dir) {
+    return fs.stat(path.join(dir, ".git")).then((stat) => stat.isDirectory() || stat.isFile(), () => false);
+}
+export async function resolveGitBranchWithGit(repoRoot) {
+    const branch = await runGit(["rev-parse", "--abbrev-ref", "HEAD"], repoRoot).then((value) => value.trim(), () => "");
+    if (branch && branch !== "HEAD")
+        return branch;
+    const head = await runGit(["rev-parse", "--short=12", "HEAD"], repoRoot).then((value) => value.trim(), () => "");
+    return head ? `detached:${head}` : "unknown";
+}
+export async function resolveBranchFromHead(repoRoot) {
+    try {
+        const gitPath = path.join(repoRoot, ".git");
+        const stat = await fs.stat(gitPath);
+        const headPath = stat.isFile()
+            ? path.join(await resolveLinkedGitDir(gitPath), "HEAD")
+            : path.join(gitPath, "HEAD");
+        const head = (await fs.readFile(headPath, "utf8")).trim();
+        if (head.startsWith("ref: refs/heads/")) {
+            return head.slice("ref: refs/heads/".length);
+        }
+        return head ? `detached:${head.slice(0, 12)}` : "unknown";
+    }
+    catch (error) {
+        // Not a repo → quiet, that is an ordinary approved folder. A `.git` that
+        // exists and will not read → every session from this worktree is labelled
+        // branch `unknown` and, until BLI-3238, nothing said why.
+        if (!isMissingFileFailure(error)) {
+            console.error("[repo-identity] could not read HEAD, branch recorded as unknown", JSON.stringify({
+                reason: "git_head_unreadable",
+                ...describeError(error),
+            }));
+        }
+        return "unknown";
+    }
+}
+async function resolveLinkedGitDir(gitFile) {
+    const raw = await fs.readFile(gitFile, "utf8");
+    const match = raw.match(/^gitdir:\s*(.+)$/m);
+    if (!match)
+        return path.dirname(gitFile);
+    const gitDir = match[1].trim();
+    return path.isAbsolute(gitDir) ? gitDir : path.resolve(path.dirname(gitFile), gitDir);
+}
+export async function listLinkedWorktreePaths(repoRoot) {
+    const porcelain = await runGit(["worktree", "list", "--porcelain"], repoRoot).catch(() => "");
+    const paths = [];
+    for (const line of porcelain.split("\n")) {
+        if (line.startsWith("worktree ")) {
+            const value = line.slice("worktree ".length).trim();
+            if (value)
+                paths.push(value);
+        }
+    }
+    return paths;
+}

package/dist/repo-identity-linked-worktrees.js

@@ -0,0 +1,81 @@
+/**
+ * Adding a discovered repo's linked worktrees (Claude Code isolation
+ * worktrees, `git worktree add` checkouts) as first-class candidates.
+ * Sibling of `repo-identity.ts`, named in its header.
+ */
+import path from "node:path";
+import { containsPath, isCodexWorktreePath } from "./root-normalization.js";
+import { listLinkedWorktreePaths } from "./repo-identity-git.js";
+import { compareIdentity, resolveRepoWorktreeIdentity } from "./repo-identity.js";
+/**
+ * Directory discovery skips dot-dirs, so Claude Code's isolation worktrees
+ * (`<repo>/.claude/worktrees/<name>`) and any other linked worktree are never
+ * found by walking the filesystem. A session whose cwd sits inside one would
+ * otherwise satisfy `isPathWithin(cwd, parentRoot)` and attribute confidently
+ * to the PARENT with the wrong branch and worktree fingerprint. Enumerating
+ * `git worktree list --porcelain` for each discovered repo adds the linked
+ * worktrees as first-class candidates with their own branch/fingerprint; the
+ * deepest-root tie-break (attribution-core D6) then attributes nested-worktree
+ * sessions to the correct linked worktree. Benefits Codex sessions identically.
+ */
+export async function expandLinkedWorktrees(identities, maxWorktrees, allowedRoots) {
+    const byFingerprint = new Map(identities.map((identity) => [identity.worktree_fingerprint, identity]));
+    const seenRoots = new Set(identities.map((identity) => localPathKey(identity.repo_root)));
+    let maxWorktreesReached = identities.length > maxWorktrees;
+    for (const identity of identities.slice(0, maxWorktrees)) {
+        // One `git worktree list` from any worktree returns every worktree of that
+        // repo, so a single call per already-discovered repo covers its linked set.
+        for (const worktreePath of await listLinkedWorktreePaths(identity.repo_root)) {
+            const resolved = path.resolve(worktreePath);
+            const rootKey = localPathKey(resolved);
+            if (seenRoots.has(rootKey))
+                continue;
+            seenRoots.add(rootKey);
+            const linked = await resolveRepoWorktreeIdentity(resolved).catch(() => null);
+            if (!linked ||
+                byFingerprint.has(linked.worktree_fingerprint) ||
+                !isLinkedWorktreeWithinCollectionScope(linked, identities, allowedRoots)) {
+                continue;
+            }
+            if (byFingerprint.size >= maxWorktrees) {
+                maxWorktreesReached = true;
+                break;
+            }
+            byFingerprint.set(linked.worktree_fingerprint, linked);
+        }
+    }
+    const worktrees = [...byFingerprint.values()]
+        .sort(compareIdentity)
+        .slice(0, maxWorktrees);
+    const incompleteReasons = maxWorktreesReached
+        ? ["max_worktrees_reached"]
+        : [];
+    return {
+        worktrees,
+        complete: incompleteReasons.length === 0,
+        incomplete_reasons: incompleteReasons,
+        // Expansion asks git for its own worktree list; it never walks folders, so
+        // it has no unreadable directories of its own to report.
+        unreadable_dirs: [],
+        // Linked-worktree expansion is not scoped to one root; callers merge this
+        // into a result that already knows which roots were involved.
+        incomplete_roots: [],
+    };
+}
+function isLinkedWorktreeWithinCollectionScope(linked, discoveredFromApprovedRoots, allowedRoots) {
+    if (allowedRoots.some((root) => containsPath(root, linked.repo_root))) {
+        return true;
+    }
+    // Codex isolation worktrees live under ~/.codex/worktrees, outside the
+    // approved workspace parent. They remain in scope only when Git proves they
+    // belong to a clone discovered inside an approved root. Arbitrary sibling or
+    // personal linked worktrees do not inherit that consent.
+    if (!isCodexWorktreePath(linked.repo_root))
+        return false;
+    return discoveredFromApprovedRoots.some((identity) => identity.repo_fingerprint === linked.repo_fingerprint &&
+        allowedRoots.some((root) => containsPath(root, identity.repo_root)));
+}
+function localPathKey(value) {
+    const resolved = path.resolve(value);
+    return process.platform === "win32" ? resolved.toLowerCase() : resolved;
+}

package/dist/repo-identity.js

@@ -1,11 +1,9 @@
-import { execFile } from "node:child_process";
-import crypto from "node:crypto";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { promisify } from "node:util";
-import { containsPath, isCodexWorktreePath } from "./root-normalization.js";
-import { describeError, isMissingFileFailure } from "./health-detail.js";
-const execFileAsync = promisify(execFile);
+import { hasGitMarker, resolveGitBranchWithGit, resolveBranchFromHead, runGit } from "./repo-identity-git.js";
+import { repoFingerprintFromLocalRoot, repoFingerprintFromOrigin, repoLabelFromOrigin, normalizeGitOrigin, sha256, stableWorktreeFingerprint, stableWorktreeRoot, } from "./repo-identity-fingerprint.js";
+import { expandLinkedWorktrees } from "./repo-identity-linked-worktrees.js";
+export { canonicalizeCollectionRootPaths, collectionRootPathAliases, normalizeGitOrigin, repoFingerprintFromLocalRoot, repoFingerprintFromOrigin, repoLabelFromOrigin, stableWorktreeFingerprint, stableWorktreeRoot, } from "./repo-identity-fingerprint.js";
 const SKIPPED_DIR_NAMES = new Set([
     ".cache",
     ".git",
@@ -203,112 +201,6 @@ export async function discoverGitWorktreesInRootsWithStatus(roots, options = {})
         unreadable_dirs: unreadableDirs,
     };
 }
-/**
- * Canonicalizes existing collection roots through the filesystem so transcript
- * paths and consent roots use the same spelling (for example `/private/var`
- * versus the `/var` symlink on macOS). Missing roots remain resolved as typed.
- */
-export async function canonicalizeCollectionRootPaths(roots) {
-    const canonical = await Promise.all(roots.map(stableWorktreeRoot));
-    return [...new Set(canonical)];
-}
-/**
- * Returns the operator-entered resolved paths plus filesystem-canonical aliases.
- * Both are needed for absent child repos because the child itself cannot be
- * realpathed after deletion, while its transcript may retain either spelling.
- */
-export async function collectionRootPathAliases(roots) {
-    const resolved = roots.map((root) => path.resolve(root));
-    const canonical = await canonicalizeCollectionRootPaths(resolved);
-    return [...new Set([...resolved, ...canonical])];
-}
-/**
- * Directory discovery skips dot-dirs, so Claude Code's isolation worktrees
- * (`<repo>/.claude/worktrees/<name>`) and any other linked worktree are never
- * found by walking the filesystem. A session whose cwd sits inside one would
- * otherwise satisfy `isPathWithin(cwd, parentRoot)` and attribute confidently
- * to the PARENT with the wrong branch and worktree fingerprint. Enumerating
- * `git worktree list --porcelain` for each discovered repo adds the linked
- * worktrees as first-class candidates with their own branch/fingerprint; the
- * deepest-root tie-break (attribution-core D6) then attributes nested-worktree
- * sessions to the correct linked worktree. Benefits Codex sessions identically.
- */
-async function expandLinkedWorktrees(identities, maxWorktrees, allowedRoots) {
-    const byFingerprint = new Map(identities.map((identity) => [identity.worktree_fingerprint, identity]));
-    const seenRoots = new Set(identities.map((identity) => localPathKey(identity.repo_root)));
-    let maxWorktreesReached = identities.length > maxWorktrees;
-    for (const identity of identities.slice(0, maxWorktrees)) {
-        // One `git worktree list` from any worktree returns every worktree of that
-        // repo, so a single call per already-discovered repo covers its linked set.
-        for (const worktreePath of await listLinkedWorktreePaths(identity.repo_root)) {
-            const resolved = path.resolve(worktreePath);
-            const rootKey = localPathKey(resolved);
-            if (seenRoots.has(rootKey))
-                continue;
-            seenRoots.add(rootKey);
-            const linked = await resolveRepoWorktreeIdentity(resolved).catch(() => null);
-            if (!linked ||
-                byFingerprint.has(linked.worktree_fingerprint) ||
-                !isLinkedWorktreeWithinCollectionScope(linked, identities, allowedRoots)) {
-                continue;
-            }
-            if (byFingerprint.size >= maxWorktrees) {
-                maxWorktreesReached = true;
-                break;
-            }
-            byFingerprint.set(linked.worktree_fingerprint, linked);
-        }
-    }
-    const worktrees = [...byFingerprint.values()]
-        .sort(compareIdentity)
-        .slice(0, maxWorktrees);
-    const incompleteReasons = maxWorktreesReached
-        ? ["max_worktrees_reached"]
-        : [];
-    return {
-        worktrees,
-        complete: incompleteReasons.length === 0,
-        incomplete_reasons: incompleteReasons,
-        // Expansion asks git for its own worktree list; it never walks folders, so
-        // it has no unreadable directories of its own to report.
-        unreadable_dirs: [],
-        // Linked-worktree expansion is not scoped to one root; callers merge this
-        // into a result that already knows which roots were involved.
-        incomplete_roots: [],
-    };
-}
-function isLinkedWorktreeWithinCollectionScope(linked, discoveredFromApprovedRoots, allowedRoots) {
-    if (allowedRoots.some((root) => containsPath(root, linked.repo_root))) {
-        return true;
-    }
-    // Codex isolation worktrees live under ~/.codex/worktrees, outside the
-    // approved workspace parent. They remain in scope only when Git proves they
-    // belong to a clone discovered inside an approved root. Arbitrary sibling or
-    // personal linked worktrees do not inherit that consent.
-    if (!isCodexWorktreePath(linked.repo_root))
-        return false;
-    return discoveredFromApprovedRoots.some((identity) => identity.repo_fingerprint === linked.repo_fingerprint &&
-        allowedRoots.some((root) => containsPath(root, identity.repo_root)));
-}
-function localPathKey(value) {
-    const resolved = path.resolve(value);
-    return process.platform === "win32" ? resolved.toLowerCase() : resolved;
-}
-async function listLinkedWorktreePaths(repoRoot) {
-    const porcelain = await runGit(["worktree", "list", "--porcelain"], repoRoot).catch(() => "");
-    const paths = [];
-    for (const line of porcelain.split("\n")) {
-        if (line.startsWith("worktree ")) {
-            const value = line.slice("worktree ".length).trim();
-            if (value)
-                paths.push(value);
-        }
-    }
-    return paths;
-}
-async function hasGitMarker(dir) {
-    return fs.stat(path.join(dir, ".git")).then((stat) => stat.isDirectory() || stat.isFile(), () => false);
-}
 async function fallbackFilesystemIdentity(repoRoot) {
     const resolvedRoot = await stableWorktreeRoot(repoRoot);
     const repoLabel = path.basename(resolvedRoot) || "repo";
@@ -326,120 +218,11 @@ async function fallbackFilesystemIdentity(repoRoot) {
         worktree_is_primary: true,
     };
 }
-export async function stableWorktreeRoot(repoRoot) {
-    const resolvedRoot = path.resolve(repoRoot);
-    return fs.realpath(resolvedRoot).catch(() => resolvedRoot);
-}
-export function stableWorktreeFingerprint(repoRoot, pathApi = path) {
-    return `wt-${sha256(`worktree:${normalizeFingerprintPath(repoRoot, pathApi)}`).slice(0, 24)}`;
-}
-export function repoFingerprintFromLocalRoot(root, pathApi = path) {
-    return `repo-${sha256(`local:${normalizeFingerprintPath(root, pathApi)}`).slice(0, 24)}`;
-}
-export function repoFingerprintFromOrigin(origin) {
-    const normalizedOrigin = normalizeGitOrigin(origin);
-    return `repo-${sha256(`origin:${normalizedOrigin}`).slice(0, 24)}`;
-}
-async function resolveBranchFromHead(repoRoot) {
-    try {
-        const gitPath = path.join(repoRoot, ".git");
-        const stat = await fs.stat(gitPath);
-        const headPath = stat.isFile()
-            ? path.join(await resolveLinkedGitDir(gitPath), "HEAD")
-            : path.join(gitPath, "HEAD");
-        const head = (await fs.readFile(headPath, "utf8")).trim();
-        if (head.startsWith("ref: refs/heads/")) {
-            return head.slice("ref: refs/heads/".length);
-        }
-        return head ? `detached:${head.slice(0, 12)}` : "unknown";
-    }
-    catch (error) {
-        // Not a repo → quiet, that is an ordinary approved folder. A `.git` that
-        // exists and will not read → every session from this worktree is labelled
-        // branch `unknown` and, until BLI-3238, nothing said why.
-        if (!isMissingFileFailure(error)) {
-            console.error("[repo-identity] could not read HEAD, branch recorded as unknown", JSON.stringify({
-                reason: "git_head_unreadable",
-                ...describeError(error),
-            }));
-        }
-        return "unknown";
-    }
-}
-async function resolveLinkedGitDir(gitFile) {
-    const raw = await fs.readFile(gitFile, "utf8");
-    const match = raw.match(/^gitdir:\s*(.+)$/m);
-    if (!match)
-        return path.dirname(gitFile);
-    const gitDir = match[1].trim();
-    return path.isAbsolute(gitDir) ? gitDir : path.resolve(path.dirname(gitFile), gitDir);
-}
-export function normalizeGitOrigin(rawOrigin) {
-    const trimmed = rawOrigin.trim();
-    if (!trimmed)
-        return "";
-    const scpLike = trimmed.match(/^(?:[^@]+@)?([^:]+):(.+)$/);
-    if (scpLike && !trimmed.includes("://")) {
-        return normalizeOriginParts(scpLike[1] ?? "", scpLike[2] ?? "");
-    }
-    try {
-        const url = new URL(trimmed);
-        return normalizeOriginParts(url.hostname, url.pathname);
-    }
-    catch {
-        // Deliberately silent (BLI-3238). `new URL` is being used as the test for
-        // "is this origin URL-shaped?", and a plain path or an unusual remote form
-        // failing to parse IS the answer — the fallback below is the intended
-        // normalization for exactly that case, not a degradation.
-        return trimmed
-            .replace(/\.git$/i, "")
-            .replace(/^\/+|\/+$/g, "")
-            .toLowerCase();
-    }
-}
-export function repoLabelFromOrigin(origin) {
-    const segments = origin.split("/").filter(Boolean);
-    return segments.at(-1) ?? origin;
-}
-function normalizeOriginParts(host, repoPath) {
-    return [
-        host.trim().toLowerCase(),
-        repoPath
-            .trim()
-            .replace(/\.git$/i, "")
-            .replace(/^\/+|\/+$/g, "")
-            .toLowerCase(),
-    ]
-        .filter(Boolean)
-        .join("/");
-}
 function shouldSkipDirectory(name) {
     return name.startsWith(".") || SKIPPED_DIR_NAMES.has(name);
 }
-function compareIdentity(a, b) {
+export function compareIdentity(a, b) {
     return (a.repo_label.localeCompare(b.repo_label) ||
         Number(b.worktree_is_primary) - Number(a.worktree_is_primary) ||
         a.worktree_label.localeCompare(b.worktree_label));
-}
-async function resolveGitBranchWithGit(repoRoot) {
-    const branch = await runGit(["rev-parse", "--abbrev-ref", "HEAD"], repoRoot).then((value) => value.trim(), () => "");
-    if (branch && branch !== "HEAD")
-        return branch;
-    const head = await runGit(["rev-parse", "--short=12", "HEAD"], repoRoot).then((value) => value.trim(), () => "");
-    return head ? `detached:${head}` : "unknown";
-}
-async function runGit(args, cwd) {
-    const { stdout } = await execFileAsync("git", args, {
-        cwd,
-        timeout: 2_000,
-        maxBuffer: 1024 * 1024,
-    });
-    return stdout;
-}
-function normalizeFingerprintPath(repoRoot, pathApi = path) {
-    const resolved = pathApi.resolve(repoRoot);
-    return pathApi.sep === "\\" ? resolved.toLowerCase() : resolved;
-}
-function sha256(value) {
-    return crypto.createHash("sha256").update(value, "utf8").digest("hex");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bli-cockpit/cli",
-  "version": "0.2.57",
+  "version": "0.2.58",
   "private": false,
   "type": "module",
   "bin": {
@@ -18,17 +18,17 @@
     "node": ">=20"
   },
   "scripts": {
-    "prebuild": "npm run build --workspace=@bli-cockpit/local-collector",
+    "prebuild": "node ../../scripts/build-workspace-dep.mjs @bli-cockpit/local-collector",
     "build": "node ../../scripts/build-public-cli.mjs",
     "prepack": "npm run build",
-    "pretypecheck": "npm run build",
+    "pretypecheck": "node ../../scripts/build-workspace-dep.mjs @bli-cockpit/cli",
     "typecheck": "node -e \"await import('./dist/commands/public-root.js')\"",
-    "pretest": "npm run build",
+    "pretest": "node ../../scripts/build-workspace-dep.mjs @bli-cockpit/cli",
     "test": "node dist/cli.js --help && node ../../scripts/assert-public-cli-routing.mjs && node ../../scripts/assert-public-cli-runtime-files.mjs && node ../../scripts/assert-public-cli-no-fleet-posts.mjs && node ../../scripts/assert-public-package-pack.mjs --workspace=@bli-cockpit/cli"
   },
   "dependencies": {
-    "@bli-cockpit/memory-mcp": "0.1.5",
-    "@bli-cockpit/mcp": "0.1.0",
+    "@bli-cockpit/memory-mcp": "0.1.6",
+    "@bli-cockpit/mcp": "0.1.1",
     "@bli-cockpit/telemetry-core": "0.1.28"
   }
 }