@coderook/cli 0.22.2 → 0.23.0

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.22.1",
+  "version": "0.23.0",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/cli.js

@@ -17,6 +17,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
  */
 const promises_1 = require("node:readline/promises");
 const node_os_1 = __importDefault(require("node:os"));
+const promises_2 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
 const node_process_1 = __importDefault(require("node:process"));
 const api_js_1 = require("./api.js");
@@ -37,6 +38,7 @@ const identify_js_1 = require("../../desktop-app/src/main/identify.js");
 const detect_js_1 = require("../../desktop-app/src/main/detect.js");
 const cbx_js_1 = require("../../desktop-app/src/main/cbx.js");
 const api_js_2 = require("./api.js");
+const import_command_js_1 = require("./import_command.js");
 const runner_js_1 = require("./runner.js");
 const config_js_1 = require("./config.js");
 /*
@@ -313,6 +315,103 @@ async function commandStatus(parsed) {
         console.log(dim(`  …and ${files.length - 50} more`));
     return 0;
 }
+/**
+ * Bring an existing repository in from another host.
+ *
+ * Snapshot only, and it says so. The files arrive, the history does not —
+ * see `import_command.ts` for why that is a limit rather than an omission.
+ * Everything after the fetch is the ordinary save path, so an import
+ * produces exactly the Version that saving the same folder would.
+ */
+async function commandImport(parsed) {
+    const url = parsed.positional[0];
+    if (!url) {
+        console.error(red("Nothing to import from."));
+        console.error("Give the address of a repository, for example:");
+        console.error(`  ${accent("coderook import https://github.com/owner/project")}`);
+        return 1;
+    }
+    if (!(0, import_command_js_1.looksLikeRepositoryUrl)(url)) {
+        console.error(red(`${url} does not look like a repository address.`));
+        console.error("Expected something like https://github.com/owner/project or\n" +
+            "git@github.com:owner/project.git");
+        return 1;
+    }
+    if (!(await (0, import_command_js_1.gitAvailable)())) {
+        console.error(red("Import needs git on this machine, and it was not found."));
+        console.error("Git is used to fetch the files once; nothing about your project\n" +
+            "afterwards depends on it.");
+        return 1;
+    }
+    const destination = parsed.positional[1] ?? null;
+    let plan;
+    try {
+        plan = await (0, import_command_js_1.fetchSnapshot)(url, destination, (line) => console.log(dim(line)));
+    }
+    catch (error) {
+        console.error(red("Could not fetch that repository."));
+        const detail = error instanceof Error ? error.message : String(error);
+        /*
+          git puts the useful sentence last and a stack of its own noise first.
+          A private repository with no credentials is by far the most common
+          failure, so it is named rather than left to be inferred.
+        */
+        console.error(detail.split("\n").filter(Boolean).slice(-3).join("\n"));
+        if (/authentication|denied|not found|could not read/i.test(detail)) {
+            console.error("\nIf it is private, sign in to it with git first — CodeRook uses\n" +
+                "the credentials git already has and never asks for a token.");
+        }
+        return 1;
+    }
+    const { files, bytes } = await (0, import_command_js_1.measure)(plan.folder);
+    if (!files) {
+        console.error(red("That repository has no files in it."));
+        if (plan.temporary)
+            await (0, promises_2.rm)(node_path_1.default.dirname(plan.folder), { recursive: true, force: true });
+        return 1;
+    }
+    console.log(`Fetched ${files} file${files === 1 ? "" : "s"}, ${(0, import_command_js_1.humanBytes)(bytes)}, ` +
+        `into ${plan.folder}`);
+    /*
+      Said before the upload rather than after it fails. The window is a share
+      of the plan allowance per week, so a large import is a thing somebody
+      should know about while they can still choose a smaller repository.
+    */
+    if (bytes > 1024 ** 3) {
+        console.log(dim("This is a large import. Uploads are limited to a share of your\n" +
+            "allowance each week, so a project this size may need more than one\n" +
+            "sitting; the save resumes rather than starting over."));
+    }
+    console.log(dim("History is not imported — this becomes the first version."));
+    /*
+      Hand the fetched folder to the ordinary save path. --allow-ignored is set
+      because git tracks files committed before the rule that excludes them,
+      and dropping those would make the import quietly lossy.
+    */
+    const submitFlags = new Map(parsed.flags);
+    submitFlags.set("allow-ignored", true);
+    /*
+      Name the project after the repository, not after wherever the files were
+      put. Without this an import into a temporary folder produces a project
+      called something like `tmp-4f21`, and the name is the thing somebody
+      types afterwards to fetch it.
+    */
+    if (!submitFlags.has("name"))
+        submitFlags.set("name", plan.name);
+    if (!submitFlags.has("m") && !submitFlags.has("message")) {
+        submitFlags.set("message", `Imported from ${url}`);
+    }
+    const code = await commandSubmit({
+        positional: [plan.folder],
+        flags: submitFlags,
+    });
+    if (code === 0 && plan.temporary) {
+        console.log(dim(`The working copy stays at ${plan.folder} until you remove it.
+` +
+            `Run ${accent("coderook get " + plan.name)} anywhere to fetch it fresh.`));
+    }
+    return code;
+}
 async function commandSubmit(parsed) {
     const folder = folderFor(parsed);
     const message = flagText(parsed, "m", "message") ?? "";
@@ -340,7 +439,22 @@ async function commandSubmit(parsed) {
         await (0, api_js_2.whoami)()
             .then((account) => account.displayName || account.username || "")
             .catch(() => ""), hasFlag(parsed, "no-licence"));
-    const rules = await (0, worktree_js_1.readRules)(folder);
+    /*
+      Import sends what it fetched, filtering nothing.
+  
+      The ignore rules exist to keep build output and local mess out of a
+      working folder, and applying them to a fresh clone gets the wrong answer
+      twice over: a clone holds exactly the files the source repository tracked
+      and nothing else, so there is no mess to exclude — while a repository
+      that tracks something its own `.gitignore` now names (which git does,
+      for anything committed before the rule) would have those files dropped.
+      Dropping them makes an import quietly lossy, which is worse than
+      refusing to import at all.
+    */
+    const importing = hasFlag(parsed, "allow-ignored");
+    const rules = importing
+        ? { shared: "", local: "" }
+        : await (0, worktree_js_1.readRules)(folder);
     const files = await (0, worktree_js_1.changedFiles)(folder, rules, baseline);
     /*
       An upgraded folder with no materialisation record and something that
@@ -404,17 +518,17 @@ async function commandSubmit(parsed) {
     */
     const shielded = (await (0, worktree_js_1.detectPrivateDirectories)(folder)).filter((finding) => [...sending].some((file) => file === finding.path || file.startsWith(`${finding.path}/`)));
     if (shielded.length && !hasFlag(parsed, "allow-private")) {
-        console.log(red(`
+        console.log(red(`
 ${shielded.length} folder${shielded.length === 1 ? "" : "s"} here belong${shielded.length === 1 ? "s" : ""} to a program, not to your project:`));
         for (const finding of shielded) {
             console.log(`  ${finding.path}  ${dim(`— ${finding.because}`)}`);
         }
-        console.log(`
+        console.log(`
 Nothing was sent. To leave them behind:`);
         for (const finding of shielded) {
             console.log(`  ${accent(`echo "${finding.rule}" >> .gitignore`)}`);
         }
-        console.error(`
+        console.error(`
 Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
         return 1;
     }
@@ -449,7 +563,7 @@ Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
     const pasted = await (0, worktree_js_1.detectPastedCredentials)(folder, files.map((file) => file.path));
     const stillPasted = pasted.filter((finding) => !exposed.includes(finding.path));
     if (stillPasted.length) {
-        console.log(red(`
+        console.log(red(`
 ${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s have credentials"} inside:`));
         for (const finding of stillPasted.slice(0, 20)) {
             console.log(`  ${finding.path}`);
@@ -464,11 +578,11 @@ ${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s
             console.log(dim(`  …and ${stillPasted.length - 20} more`));
         }
         if (!hasFlag(parsed, "allow-secrets")) {
-            console.error(`
+            console.error(`
 Nothing was sent. Move the key into an environment variable, and if` +
                 ` it has ever been published, replace it at the service that issued` +
                 ` it — a key that has leaked stays leaked.` +
-                `
+                `
 Pass ${accent("--allow-secrets")} if these are not real keys.`);
             return 1;
         }
@@ -490,13 +604,27 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
         include: files.map((file) => file.path),
         deletions: files.filter((file) => file.deleted).map((file) => file.path),
         message,
-        projectName: link?.slug ?? node_path_1.default.basename(folder),
+        /*
+          A folder's name is the right default and the wrong answer for import,
+          where the folder is somewhere temporary and the project should carry
+          the name it had at the place it came from. An existing link always
+          wins: renaming somebody's project because they passed a flag would be
+          a surprise, and the flag exists for projects that do not exist yet.
+        */
+        projectName: link?.slug ?? flagText(parsed, "name") ?? node_path_1.default.basename(folder),
         repositoryId: link?.repositoryId ?? null,
         // Every current CLI publish states its ancestry. A brand-new project is
         // explicitly based on an empty Track; a linked folder names the immutable
         // Version it was last reconciled with.
         baseVersionId: link?.baseVersionId ?? null,
         track: flagText(parsed, "track") ?? (await (0, track_commands_js_1.trackFor)(folder)),
+        /*
+          Only import sets this. Git keeps tracking files committed before the
+          rule that excludes them, so a faithful import carries paths the
+          project's own ignore rules now refuse; without the override the server
+          would reject the publication and the import would be lossy.
+        */
+        ...(hasFlag(parsed, "allow-ignored") ? { allowIgnored: true } : {}),
         ...(link?.baseVersionId
             ? { expectedHeadVersionId: link.baseVersionId }
             : {}),
@@ -542,7 +670,7 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
           difference between a person retrying and a person wondering.
         */
         if (!code && /fetch failed|ECONNRESET|socket hang up|network|ETIMEDOUT/i.test(text)) {
-            console.error(red(`
+            console.error(red(`
 The connection failed: ${text}`));
             console.error(`Your work may already have been saved. Run the same command again —` +
                 ` it will not create a second version.`);
@@ -724,7 +852,7 @@ async function commandGet(parsed) {
                     `changed while the interrupted fetch was stopped:`));
                 for (const file of changedInTheGap.slice(0, 20))
                     console.error(`  ${file.path}`);
-                console.error(`
+                console.error(`
 Save them with ${accent("coderook submit")}, or finish the fetch and ` +
                     `discard them with ${accent("coderook get --replace")}.`);
                 return 1;
@@ -877,8 +1005,8 @@ async function suggestRules(folder, apply) {
     const addition = (0, detect_js_1.rulesFromSuggestions)(recommended);
     const shared = rules.shared.trimEnd();
     await (0, worktree_js_1.writeRules)(folder, {
-        shared: shared ? `${shared}
-
+        shared: shared ? `${shared}
+
 ${addition}` : addition,
         local: rules.local,
     });
@@ -1005,7 +1133,7 @@ async function commandMerges(parsed) {
         const counts = merge.conflicts;
         console.log(`${accent(merge.reference)}  ${counts ? `${counts.unresolved} of ${counts.total} still to decide` : ""}  ${dim(new Date(merge.createdAt).toLocaleString())}`);
     }
-    console.log(dim(`
+    console.log(dim(`
 Run coderook merge <reference> to look at one.`));
     return 0;
 }
@@ -1071,7 +1199,7 @@ async function commandMerge(parsed) {
         }
     }
     const now = await (0, api_js_1.mergeTrack)(summary.id);
-    console.log(`
+    console.log(`
 ${accent(now.mergeTrack.reference)} · ${now.provisional.fileCount} files · ` +
         (now.provisional.ready
             ? "ready to apply"
@@ -1086,19 +1214,19 @@ ${accent(now.mergeTrack.reference)} · ${now.provisional.fileCount} files · ` +
             return 1;
         }
         const applied = await (0, api_js_1.applyMerge)(summary.id);
-        console.log(`
+        console.log(`
 Applied as ${accent(`v${applied.version.sequence}`)}.`);
         console.log(dim("Run coderook get to bring it down to this folder."));
         return 0;
     }
     if (!decision) {
-        console.log(dim(`
+        console.log(dim(`
 --mine keeps yours, --theirs keeps what was already saved,` +
-            ` --drop removes the file.
+            ` --drop removes the file.
 Add --path <file> for one file, then --apply when ready.`));
     }
     else if (now.provisional.ready) {
-        console.log(dim(`
+        console.log(dim(`
 Run coderook merge ${now.mergeTrack.reference} --apply to publish it.`));
     }
     return 0;
@@ -1275,6 +1403,10 @@ const SPECS = [
         options: [
             { flags: "-m, --message <text>", description: "what changed, in a sentence" },
             { flags: "-n, --dry-run", description: "show what would be sent, send nothing" },
+            {
+                flags: "--name <name>",
+                description: "name a new project this, instead of after the folder",
+            },
             {
                 flags: "--allow-secrets",
                 description: "send files that look like credentials, and files with keys inside",
@@ -1294,6 +1426,38 @@ const SPECS = [
         ],
         run: commandSubmit,
     },
+    {
+        name: "import",
+        group: "Getting started",
+        summary: "bring a project in from another host",
+        usage: "import <address> [folder]",
+        detail: "Fetches a repository from GitHub, GitLab or anywhere else git can\n" +
+            "reach, and saves it as the first version of a CodeRook project.\n\n" +
+            "The files come across; the history does not. Every past commit would\n" +
+            "have to be published as its own version, which on a large project\n" +
+            "takes days — so this takes an honest snapshot rather than leaving a\n" +
+            "half-finished import behind. What arrives is the current state of the\n" +
+            "default branch.\n\n" +
+            "A public repository needs nothing. A private one uses the credentials\n" +
+            "git already has on this machine; CodeRook never asks for, stores or\n" +
+            "forwards a token.\n\n" +
+            "Files that the project's own ignore rules exclude are sent anyway,\n" +
+            "because git keeps tracking anything committed before the rule that\n" +
+            "excludes it, and leaving them out would lose files the source has.",
+        options: [
+            { flags: "-m, --message <text>", description: "the first version's message" },
+            { flags: "--track <name>", description: "save onto this line" },
+            {
+                flags: "--no-licence",
+                description: "do not add a licence to the new project",
+            },
+        ],
+        examples: [
+            "coderook import https://github.com/owner/project",
+            "coderook import git@github.com:owner/project.git ./project",
+        ],
+        run: commandImport,
+    },
     {
         /*
           Where the next save goes, which is a property of this folder rather

package/dist/cli/src/import_command.js

@@ -0,0 +1,150 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.projectNameFromUrl = projectNameFromUrl;
+exports.looksLikeRepositoryUrl = looksLikeRepositoryUrl;
+exports.gitAvailable = gitAvailable;
+exports.fetchSnapshot = fetchSnapshot;
+exports.measure = measure;
+exports.humanBytes = humanBytes;
+const node_child_process_1 = require("node:child_process");
+const promises_1 = require("node:fs/promises");
+const node_os_1 = require("node:os");
+const node_path_1 = __importDefault(require("node:path"));
+const node_util_1 = require("node:util");
+const run = (0, node_util_1.promisify)(node_child_process_1.execFile);
+/**
+ * The repository's own name, from the last path segment.
+ *
+ * Deliberately not the host: an address with no path at all is not a
+ * repository, and naming somebody's project `github.com` because the URL was
+ * incomplete is the sort of thing they would only notice later.
+ */
+function projectNameFromUrl(url) {
+    const trimmed = url.trim().replace(/\/+$/, "");
+    /* Drop the scheme and authority so only path segments remain. */
+    const withoutScheme = trimmed.replace(/^[a-z][a-z0-9+.-]*:\/\//i, "");
+    const afterHost = /^[^/]*:/.test(withoutScheme)
+        ? /* scp-style git@host:owner/name */
+            withoutScheme.slice(withoutScheme.indexOf(":") + 1)
+        : withoutScheme.slice(withoutScheme.indexOf("/") + 1);
+    const hasPath = withoutScheme.includes("/") || /^[^/]*:/.test(withoutScheme);
+    if (!hasPath)
+        return "imported-project";
+    const tail = afterHost.split("/").filter(Boolean).pop() ?? "";
+    const name = tail.replace(/\.git$/i, "").trim();
+    return name || "imported-project";
+}
+/**
+ * Refuse anything that is not a repository location.
+ *
+ * `git clone` will happily treat a local path as a source, and a URL typed
+ * with a scheme this does not expect is more likely a mistake than an
+ * intention. Being narrow here keeps the command from doing something
+ * surprising with an argument that was meant for something else.
+ */
+function looksLikeRepositoryUrl(url) {
+    const value = url.trim();
+    if (/^(https?|git|ssh):\/\//i.test(value))
+        return true;
+    /* scp-style: git@host:owner/name.git */
+    if (/^[A-Za-z0-9._-]+@[A-Za-z0-9.-]+:[^\s]+$/.test(value))
+        return true;
+    return false;
+}
+async function exists(target) {
+    try {
+        await (0, promises_1.access)(target);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function isEmptyDirectory(target) {
+    try {
+        const entries = await (0, promises_1.readdir)(target);
+        return entries.length === 0;
+    }
+    catch {
+        return true;
+    }
+}
+async function gitAvailable() {
+    try {
+        await run("git", ["--version"], { windowsHide: true });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Shallow-clone into a working folder and strip the Git metadata.
+ *
+ * Returns where the files landed. The caller publishes from there with the
+ * ordinary save path, so an import produces exactly the Version an ordinary
+ * save of the same files would.
+ */
+async function fetchSnapshot(url, into, log = () => { }) {
+    const name = projectNameFromUrl(url);
+    let folder;
+    let temporary = false;
+    if (into) {
+        folder = node_path_1.default.resolve(into);
+        if ((await exists(folder)) && !(await isEmptyDirectory(folder))) {
+            throw new Error(`${folder} already has files in it. Import needs an empty folder, ` +
+                `so that nothing here is overwritten by what arrives.`);
+        }
+    }
+    else {
+        const base = await (0, promises_1.mkdtemp)(node_path_1.default.join((0, node_os_1.tmpdir)(), "coderook-import-"));
+        folder = node_path_1.default.join(base, name);
+        temporary = true;
+    }
+    log(`Fetching ${url}`);
+    /*
+      --depth 1 for the reason in the header. --single-branch keeps it to the
+      default branch: an import takes a snapshot of one line of work, and
+      fetching every branch's tip would cost time to produce content this
+      command then discards.
+    */
+    await run("git", ["clone", "--depth", "1", "--single-branch", url, folder], { windowsHide: true, maxBuffer: 32 * 1024 * 1024 });
+    const gitDirectory = node_path_1.default.join(folder, ".git");
+    if (await exists(gitDirectory)) {
+        await (0, promises_1.rm)(gitDirectory, { recursive: true, force: true });
+    }
+    return { folder, name, temporary };
+}
+/** Total bytes and file count of the fetched tree, for the summary line. */
+async function measure(folder) {
+    let files = 0;
+    let bytes = 0;
+    const walk = async (directory) => {
+        for (const entry of await (0, promises_1.readdir)(directory, { withFileTypes: true })) {
+            const full = node_path_1.default.join(directory, entry.name);
+            if (entry.isDirectory()) {
+                await walk(full);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            files += 1;
+            bytes += (await (0, promises_1.stat)(full)).size;
+        }
+    };
+    await walk(folder);
+    return { files, bytes };
+}
+function humanBytes(value) {
+    const units = ["B", "KB", "MB", "GB", "TB"];
+    let size = value;
+    let unit = 0;
+    while (size >= 1024 && unit < units.length - 1) {
+        size /= 1024;
+        unit += 1;
+    }
+    return `${unit === 0 ? size : size.toFixed(size < 10 ? 2 : 1)} ${units[unit]}`;
+}

package/dist/desktop-app/src/main/upload.js

@@ -327,7 +327,16 @@ class Uploader {
         // A version is a snapshot, not a delta, so it has to name every file in
         // the project — not merely the ones being sent this time. Anything
         // unchanged keeps the object the previous version already pointed at.
-        const rules = await (0, worktree_js_1.readRules)(request.localPath);
+        /*
+          An import filters nothing. The rules keep local mess out of a working
+          folder, but an imported tree is exactly what the source repository
+          tracked — there is no mess in it, and anything the source tracked in
+          spite of its own rules (which git does, for files committed before the
+          rule) would otherwise be dropped without being mentioned.
+        */
+        const rules = request.allowIgnored
+            ? { shared: "", local: "" }
+            : await (0, worktree_js_1.readRules)(request.localPath);
         /*
           Surveyed, not listed.
     
@@ -1152,6 +1161,7 @@ class Uploader {
                     ? {}
                     : { expectedHeadVersionId: request.expectedHeadVersionId }),
                 ...(request.track ? { track: request.track } : {}),
+                ...(request.allowIgnored ? { allowIgnored: true } : {}),
                 /*
                   Names this attempt so a retry after a lost connection is answered
                   with the version already made, rather than making a second one.

package/package.json

@@ -1,51 +1,51 @@
-{
-  "name": "@coderook/cli",
-  "version": "0.22.2",
-  "description": "CodeRook from the command line, on any operating system",
-  "license": "SEE LICENSE IN LICENSE.txt",
-  "homepage": "https://coderook.com",
-  "bugs": {
-    "url": "https://coderook.com/contact"
-  },
-  "keywords": [
-    "coderook",
-    "versioning",
-    "backup",
-    "cbx"
-  ],
-  "engines": {
-    "node": ">=20.11.0"
-  },
-  "bin": {
-    "coderook": "dist/cli/src/cli.js"
-  },
-  "files": [
-    ".claude-plugin",
-    "dist",
-    "skills"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "check": "tsc -p tsconfig.json --noEmit",
-    "test": "tsc -p tsconfig.json && node --test --experimental-strip-types test/*.test.ts",
-    "start": "node dist/cli/src/cli.js",
-    "prepublishOnly": "npm run sync:plugin && npm run build",
-    "test:e2e": "node test/e2e.mjs",
-    "test:matrix": "node test/state-matrix.mjs",
-    "test:attempt": "node test/attempt-identity.mjs",
-    "test:get": "node test/get-safety.mjs",
-    "test:live": "node test/e2e.mjs --allow-production && node test/state-matrix.mjs --allow-production && node test/get-safety.mjs --allow-production && node test/get-protects-edits.mjs --allow-production && node test/upgrade-migration.mjs --allow-production && node test/fault-get.mjs --allow-production && node test/version-floor.mjs --allow-production && node test/fault-submit.mjs --allow-production && node test/race-attempts.mjs --allow-production && node test/attempt-identity.mjs --allow-production",
-    "test:getedits": "node test/get-protects-edits.mjs",
-    "test:upgrade": "node test/upgrade-migration.mjs",
-    "test:faultget": "node test/fault-get.mjs",
-    "test:floor": "node test/version-floor.mjs",
-    "test:faultsubmit": "node test/fault-submit.mjs",
-    "test:race": "node test/race-attempts.mjs",
-    "test:runner": "node test/runner-live.mjs",
-    "sync:plugin": "node scripts/sync-plugin-version.mjs"
-  },
-  "devDependencies": {
-    "@types/node": "24.10.1",
-    "typescript": "5.9.3"
-  }
-}
+{
+  "name": "@coderook/cli",
+  "version": "0.23.0",
+  "description": "CodeRook from the command line, on any operating system",
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "homepage": "https://coderook.com",
+  "bugs": {
+    "url": "https://coderook.com/contact"
+  },
+  "keywords": [
+    "coderook",
+    "versioning",
+    "backup",
+    "cbx"
+  ],
+  "engines": {
+    "node": ">=20.11.0"
+  },
+  "bin": {
+    "coderook": "dist/cli/src/cli.js"
+  },
+  "files": [
+    ".claude-plugin",
+    "dist",
+    "skills"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "test": "tsc -p tsconfig.json && node --test --experimental-strip-types test/*.test.ts",
+    "start": "node dist/cli/src/cli.js",
+    "prepublishOnly": "npm run sync:plugin && npm run build",
+    "test:e2e": "node test/e2e.mjs",
+    "test:matrix": "node test/state-matrix.mjs",
+    "test:attempt": "node test/attempt-identity.mjs",
+    "test:get": "node test/get-safety.mjs",
+    "test:live": "node test/e2e.mjs --allow-production && node test/state-matrix.mjs --allow-production && node test/get-safety.mjs --allow-production && node test/get-protects-edits.mjs --allow-production && node test/upgrade-migration.mjs --allow-production && node test/fault-get.mjs --allow-production && node test/version-floor.mjs --allow-production && node test/fault-submit.mjs --allow-production && node test/race-attempts.mjs --allow-production && node test/attempt-identity.mjs --allow-production",
+    "test:getedits": "node test/get-protects-edits.mjs",
+    "test:upgrade": "node test/upgrade-migration.mjs",
+    "test:faultget": "node test/fault-get.mjs",
+    "test:floor": "node test/version-floor.mjs",
+    "test:faultsubmit": "node test/fault-submit.mjs",
+    "test:race": "node test/race-attempts.mjs",
+    "test:runner": "node test/runner-live.mjs",
+    "sync:plugin": "node scripts/sync-plugin-version.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "24.10.1",
+    "typescript": "5.9.3"
+  }
+}