@coderook/cli 0.25.3 → 0.26.0

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.25.3",
+  "version": "0.26.0",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/api.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.whoami = whoami;
 exports.projects = projects;
+exports.findPublicProject = findPublicProject;
 exports.findProject = findProject;
 exports.health = health;
 exports.mergeTracks = mergeTracks;
@@ -27,6 +28,14 @@ exports.runLogs = runLogs;
 exports.tokens = tokens;
 exports.revokeToken = revokeToken;
 exports.deleteProject = deleteProject;
+exports.projectLabels = projectLabels;
+exports.createProjectLabel = createProjectLabel;
+exports.deleteProjectLabel = deleteProjectLabel;
+exports.changeVersion = changeVersion;
+exports.reviewVersion = reviewVersion;
+exports.removeVersionContent = removeVersionContent;
+exports.versionAttachments = versionAttachments;
+exports.undoTo = undoTo;
 /** The small part of the API the command-line tool needs directly. */
 const identify_js_1 = require("../../desktop-app/src/main/identify.js");
 const config_js_1 = require("./config.js");
@@ -76,13 +85,77 @@ async function projects() {
         updatedAt: String(row.updatedAt ?? row.createdAt ?? ""),
     }));
 }
-/** Find a project by slug or display name, so either reads naturally. */
+/**
+ * One public project, by the two names that identify it.
+ *
+ * Reachable without an account, which is what public means. Only the lookup
+ * goes this way: once the project has been named, everything else is fetched
+ * through the ordinary repository routes, which already serve a public
+ * project to anybody who asks.
+ */
+async function findPublicProject(owner, slug) {
+    try {
+        const response = await fetch(`${(0, config_js_1.apiOrigin)()}/v1/public/projects/${encodeURIComponent(owner)}/${encodeURIComponent(slug)}`, { headers: { accept: "application/json", ...(0, identify_js_1.clientHeaders)() } });
+        if (!response.ok)
+            return null;
+        const row = (await response.json());
+        if (!row.id)
+            return null;
+        return {
+            id: String(row.id),
+            slug: String(row.slug ?? slug),
+            name: String(row.displayName || row.slug || slug),
+            visibility: String(row.visibility ?? "public"),
+            defaultBranch: String(row.defaultBranch || "main"),
+            versionCount: Number(row.versionCount ?? 0),
+            fileCount: Number(row.fileCount ?? 0),
+            storedBytes: Number(row.storedSize ?? 0),
+            updatedAt: String(row.updatedAt ?? row.createdAt ?? ""),
+        };
+    }
+    catch {
+        /* Offline, or no such project. Either way there is nothing to return. */
+        return null;
+    }
+}
+/**
+ * Find a project by slug or display name, so either reads naturally.
+ *
+ * Your own account first, then — for `owner/slug`, or a name that is not
+ * yours — the public listing.
+ *
+ * Without that second step the only projects reachable by name were your
+ * own, which made `cbx clone somebody/their-project` answer "No project named
+ * … on this account" and `git clone coderook://somebody/their-project` hand
+ * back an empty repository. Both are the instruction printed on every public
+ * project page, aimed at exactly the people who do not own the thing.
+ */
 async function findProject(reference) {
-    const wanted = reference.trim().toLowerCase();
-    const all = await projects();
-    return (all.find((project) => project.slug.toLowerCase() === wanted) ??
-        all.find((project) => project.name.toLowerCase() === wanted) ??
-        null);
+    const trimmed = reference.trim();
+    const slash = trimmed.lastIndexOf("/");
+    const owner = slash > 0 ? trimmed.slice(0, slash) : "";
+    const bare = (slash > 0 ? trimmed.slice(slash + 1) : trimmed).toLowerCase();
+    /*
+      An owner was named, so it is somebody's project rather than a name to
+      guess at. Yours is still checked first: naming yourself is allowed, and
+      the authenticated listing knows about private projects the public one
+      cannot see.
+    */
+    const all = await projects().catch(() => []);
+    const ownersMatch = (project) => project.slug.toLowerCase() === bare || project.name.toLowerCase() === bare;
+    if (!owner) {
+        const mine = all.find(ownersMatch);
+        if (mine)
+            return mine;
+        return null;
+    }
+    const me = await whoami().catch(() => null);
+    if (me && (me.username ?? "").toLowerCase() === owner.toLowerCase()) {
+        const mine = all.find(ownersMatch);
+        if (mine)
+            return mine;
+    }
+    return findPublicProject(owner, bare);
 }
 /** Whether the service is reachable, and what encodings it accepts. */
 async function health() {
@@ -177,6 +250,25 @@ async function versions(repositoryId) {
             ? row.parentVersionIds.map(String)
             : [],
         authorName: String(row.author?.displayName ?? ""),
+        name: row.name == null ? null : String(row.name),
+        /*
+          Falls back to the older field, so this keeps working against a service
+          that has not been updated yet rather than reporting everything private.
+        */
+        visibility: row.visibility ??
+            (row.public === false ? "private" : "public"),
+        state: String(row.state ?? "verified"),
+        pinned: row.pinned === true,
+        labels: Array.isArray(row.labels)
+            ? row.labels.map((one) => ({
+                id: String(one.id ?? ""),
+                name: String(one.name ?? ""),
+                colour: String(one.colour ?? "#888888"),
+                description: one.description == null ? null : String(one.description),
+            }))
+            : [],
+        removedAt: row.removedAt == null ? null : String(row.removedAt),
+        head: row.head === true,
     }));
 }
 /**
@@ -345,3 +437,61 @@ async function deleteProject(repositoryId) {
         method: "DELETE",
     });
 }
+async function projectLabels(repositoryId) {
+    const body = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/labels`);
+    return (body.labels ?? []).map((row) => ({
+        id: String(row.id ?? ""),
+        name: String(row.name ?? ""),
+        colour: String(row.colour ?? "#888888"),
+        description: row.description == null ? null : String(row.description),
+    }));
+}
+async function createProjectLabel(repositoryId, name, colour, description) {
+    const body = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/labels`, { method: "POST", body: { name, colour, ...(description ? { description } : {}) } });
+    return {
+        id: String(body.label?.id ?? ""),
+        name: String(body.label?.name ?? name),
+        colour: String(body.label?.colour ?? colour),
+        description: body.label?.description == null ? null : String(body.label.description),
+    };
+}
+async function deleteProjectLabel(repositoryId, labelId) {
+    await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/labels/${encodeURIComponent(labelId)}`, { method: "DELETE" });
+}
+/**
+ * Everything about a version, changed in one call.
+ *
+ * Deliberately one request rather than one per field. The service takes a
+ * patch, so a command that sets a name and a colour at once is one round trip
+ * and, more to the point, one thing that either happened or did not.
+ */
+async function changeVersion(repositoryId, versionId, patch) {
+    await call(`/v1/repositories/${encodeURIComponent(repositoryId)}` +
+        `/versions/${encodeURIComponent(versionId)}`, { method: "PATCH", body: patch });
+}
+/** Accept a held version, or turn it down with a reason. */
+async function reviewVersion(repositoryId, versionId, decision, note) {
+    const body = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}` +
+        `/versions/${encodeURIComponent(versionId)}/review`, { method: "POST", body: { decision, ...(note ? { note } : {}) } });
+    return { state: String(body.state ?? decision) };
+}
+/** Take a version's content down, leaving the version itself as a record. */
+async function removeVersionContent(repositoryId, versionId, reason) {
+    const query = reason ? `?reason=${encodeURIComponent(reason)}` : "";
+    await call(`/v1/repositories/${encodeURIComponent(repositoryId)}` +
+        `/versions/${encodeURIComponent(versionId)}/content${query}`, { method: "DELETE" });
+}
+async function versionAttachments(repositoryId, versionId) {
+    const body = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}` +
+        `/versions/${encodeURIComponent(versionId)}/attachments`);
+    return (body.attachments ?? []).map((row) => ({
+        id: String(row.id ?? ""),
+        name: String(row.name ?? ""),
+        sizeBytes: Number(row.sizeBytes ?? 0),
+        mediaType: String(row.mediaType ?? "application/octet-stream"),
+    }));
+}
+/** Put the project back on an earlier commit. */
+async function undoTo(repositoryId, to) {
+    return await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/undo`, { method: "POST", body: to ? { to } : {} });
+}

package/dist/cli/src/cli.js

@@ -37,6 +37,7 @@ const worktree_js_1 = require("../../desktop-app/src/main/worktree.js");
 const upload_js_1 = require("../../desktop-app/src/main/upload.js");
 const download_js_1 = require("../../desktop-app/src/main/download.js");
 const faults_js_1 = require("../../desktop-app/src/main/faults.js");
+const version_commands_js_1 = require("./version_commands.js");
 const identify_js_1 = require("../../desktop-app/src/main/identify.js");
 const detect_js_1 = require("../../desktop-app/src/main/detect.js");
 const cbx_js_1 = require("../../desktop-app/src/main/cbx.js");
@@ -637,6 +638,15 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
           would reject the publication and the import would be lossy.
         */
         ...(hasFlag(parsed, "allow-ignored") ? { allowIgnored: true } : {}),
+        /*
+          The same answer, told to the service.
+    
+          The check above is the one that asks a person, and it is the better
+          place to ask — it is where the files are. But it is also the part an
+          old build or a patched one does not run, so the service asks again and
+          refuses unless this says the question was put and answered.
+        */
+        ...(hasFlag(parsed, "allow-secrets") ? { allowSecrets: true } : {}),
         ...(link ? { known: link.local ?? link.manifest ?? {} } : {}),
     });
     let result;
@@ -925,7 +935,11 @@ async function commandClone(parsed) {
     }
     const project = await (0, api_js_2.findProject)(reference);
     if (!project) {
-        console.error(red(`No project named ${reference} on this account.`));
+        console.error(red(`No project named ${reference}.` +
+            (reference.includes("/")
+                ? " Check the owner and the name, and that it is public."
+                : " It is not on your account — for somebody else's, name them" +
+                    " too: cbx clone <owner>/<project>.")));
         return 1;
     }
     if (!project.versionCount) {
@@ -1792,6 +1806,161 @@ const SPECS = [
         usage: "releases [project]",
         run: service_commands_js_1.commandReleases,
     },
+    {
+        /*
+          The half that hiding never covered.
+    
+          Hiding a bad push stops strangers reading it and leaves the project
+          standing on it, so the next person to pull still lands on the mistake.
+          This moves the project.
+        */
+        name: "undo",
+        group: "Your projects",
+        summary: "put the project back on an earlier save",
+        usage: "undo [n] [project]",
+        detail: "Goes back one save unless you name another to go back to.\n\n" +
+            "Nothing is deleted and nothing is renumbered — the saves that get\n" +
+            "passed over stay in the history, and the next save carries on from\n" +
+            "wherever the project now stands.",
+        examples: ["cbx undo", "cbx undo 41"],
+        run: version_commands_js_1.commandUndo,
+    },
+    {
+        /*
+          The decision that separates a working history from a published one.
+    
+          Every save is a commit and most of them are nobody else's business. This
+          is where one becomes a version — the thing the public side of a project
+          actually offers.
+        */
+        name: "promote",
+        group: "Your projects",
+        summary: "turn a commit into a version people can fetch",
+        usage: "promote [n] [project]",
+        detail: "Shows the last ten commits and asks which one. Give a number to skip\n" +
+            "the list.\n\n" +
+            "A version is a commit with a name on it. Until a project promotes its\n" +
+            "first one its public page shows everything, as it always did.",
+        options: [
+            { flags: "--name <text>", description: "what to call it" },
+            { flags: "--notes <text>", description: "what changed" },
+        ],
+        examples: [
+            "cbx promote",
+            "cbx promote 41 --name v2.1",
+            'cbx promote --name "Client build" --notes "Fixes the export dialog"',
+        ],
+        run: version_commands_js_1.commandPromote,
+    },
+    {
+        /*
+          One command for everything a version can be, because the service takes
+          one patch. Three separate commands would be three requests, and three
+          chances for a person to end up with a version that is named but not
+          pinned because the second one failed.
+        */
+        /*
+          Not called "version".
+    
+          `cbx version` has printed the version number since the first release,
+          and quietly changing that when arguments follow is the kind of thing
+          that works until somebody scripts it. This marks a save — pins it,
+          hides it, labels it — which is what it does anyway.
+        */
+        name: "mark",
+        aliases: ["set"],
+        group: "Your projects",
+        summary: "name, hide, pin or label one save",
+        usage: "mark [n] [project]",
+        detail: "Changes the newest version unless you name another.\n" +
+            "Everything you ask for happens in one request, so it either all\n" +
+            "lands or none of it does.",
+        options: [
+            { flags: "--name <text>", description: "give it a code name" },
+            { flags: "--unname", description: "take the name off again" },
+            { flags: "--notes <text>", description: "what changed" },
+            { flags: "--hide", description: "nobody outside the project can read it" },
+            { flags: "--show", description: "anybody can read it" },
+            {
+                flags: "--visibility <who>",
+                description: "private, unlisted (link only) or public",
+            },
+            { flags: "--pin", description: "keep it at the top of the list" },
+            { flags: "--unpin", description: "put it back in order" },
+            { flags: "--labels <a,b>", description: "the labels it should wear" },
+            { flags: "--clear-labels", description: "take them all off" },
+        ],
+        examples: [
+            "cbx mark --name v2.1 --pin",
+            "cbx mark 41 --visibility unlisted",
+            'cbx mark 41 --labels "shipped,client work"',
+        ],
+        run: version_commands_js_1.commandVersion,
+    },
+    {
+        name: "labels",
+        group: "Your projects",
+        summary: "the labels this project puts on versions",
+        usage: "labels [list|add|remove] [name] [colour]",
+        detail: "A label is a name and a colour. Put as many on a version as you like —\n" +
+            "how you group and colour your own history is yours to decide.",
+        examples: [
+            "cbx labels",
+            "cbx labels add shipped green",
+            "cbx labels add urgent #e0574a",
+            "cbx labels remove shipped",
+        ],
+        run: version_commands_js_1.commandLabels,
+    },
+    {
+        name: "held",
+        aliases: ["waiting"],
+        group: "Your projects",
+        summary: "versions waiting for somebody to approve them",
+        usage: "held [project]",
+        detail: "A project can be set to hold pushes from anyone below admin until an\n" +
+            "admin accepts them. Those versions are real and stored — they are just\n" +
+            "not the current version, and not on the public page.",
+        run: version_commands_js_1.commandHeld,
+    },
+    {
+        name: "review",
+        group: "Your projects",
+        summary: "accept a held version, or turn it down",
+        usage: "review <n> --approve | --decline",
+        options: [
+            {
+                flags: "--approve",
+                description: "accept it; it becomes the current version",
+            },
+            { flags: "--decline", description: "turn it down" },
+            { flags: "--note <text>", description: "why" },
+        ],
+        examples: [
+            "cbx review 41 --approve",
+            'cbx review 41 --decline --note "wrong branch"',
+        ],
+        run: version_commands_js_1.commandReview,
+    },
+    {
+        /*
+          Named for what it does rather than "delete", because it does not delete
+          the version. The files go; the version stays in the history as a gap
+          saying what was removed and by whom.
+        */
+        name: "take-down",
+        group: "Your projects",
+        summary: "remove a version's files, for something published by mistake",
+        usage: "take-down <n> --yes",
+        detail: "The files go and do not come back. The version stays in the history as\n" +
+            "a gap saying what was removed and by whom, so nothing is quietly\n" +
+            "rewritten.",
+        options: [
+            { flags: "--yes", description: "confirm; without it nothing happens" },
+            { flags: "--reason <text>", description: "recorded against the gap" },
+        ],
+        run: version_commands_js_1.commandTakeDown,
+    },
     {
         /*
           A release is a version with a name on it, so this names one rather than

package/dist/cli/src/git_history.js

@@ -51,14 +51,20 @@ function parseRemoteUrl(url) {
         }
     }
     rest = rest.replace(/^\/+/, "").replace(/\/+$/, "");
-    // An owner segment is accepted and ignored: a token already says who this
-    // is, and silently pushing to a different account than the URL named would
-    // be a worse outcome than not supporting the form at all.
+    /*
+      The owner is carried, and what it is used for differs by direction.
+      Fetching honours it, because `coderook://somebody/their-project` is the
+      line printed on every public project page and it has to reach their
+      project rather than look for that name on yours. Pushing still ignores
+      it: the token says who you are, and quietly publishing to an account the
+      URL named instead would be the worse mistake of the two.
+    */
     const parts = rest.split("/").filter(Boolean);
     const slug = parts[parts.length - 1] ?? "";
+    const owner = parts.length > 1 ? parts[parts.length - 2] : "";
     if (!slug)
         throw new Error(`Not a CodeRook remote URL: ${url}`);
-    return { slug };
+    return { owner, slug };
 }
 /**
  * Pull the git commit id back out of a version message, if it carries one.

package/dist/cli/src/git_remote.js

@@ -36,6 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.AlreadyReported = void 0;
 exports.main = main;
 /**
  * `git push coderook` — a git remote helper.
@@ -110,6 +111,20 @@ const version_js_1 = require("./version.js");
 const publish_js_1 = require("./publish.js");
 const git_history_js_1 = require("./git_history.js");
 const api_js_1 = require("./api.js");
+/** A fetch that cannot be served. Carried out so the process can exit non-zero. */
+class ImportFailed extends Error {
+}
+/**
+ * A failure this code has already explained.
+ *
+ * The entry point prints whatever reaches it, which is right for a surprise
+ * and wrong for a refusal that has just been set out in full — the person
+ * would read the same paragraph twice, the second time with a program name
+ * in front of it.
+ */
+class AlreadyReported extends Error {
+}
+exports.AlreadyReported = AlreadyReported;
 /** Everything the helper writes for a person goes to stderr; stdout is protocol. */
 function say(text) {
     node_process_1.default.stderr.write(`${text}\n`);
@@ -489,12 +504,19 @@ async function recordPushedCommits(marks) {
  * unchanged across a thousand versions is downloaded and sent to git once.
  */
 async function doImport(refs, url) {
-    const { slug } = (0, git_history_js_1.parseRemoteUrl)(url);
-    const project = await (0, api_js_1.findProject)(slug);
+    const { owner, slug } = (0, git_history_js_1.parseRemoteUrl)(url);
+    const project = await (0, api_js_1.findProject)(owner ? `${owner}/${slug}` : slug);
     if (!project) {
-        say(`No CodeRook project called "${slug}", or you cannot read it.`);
+        say(`No CodeRook project called "${owner ? `${owner}/${slug}` : slug}",` +
+            " or you cannot read it.");
+        /*
+          `done` closes the stream cleanly, but git reads "no refs" as "an empty
+          repository" and reports success — so a clone of something that is not
+          there made an empty folder and exited zero. Saying so on the way out is
+          what turns that into a failure the person can see.
+        */
         send("done");
-        return;
+        throw new ImportFailed(`No CodeRook project called "${owner ? `${owner}/${slug}` : slug}", or you cannot read it.`);
     }
     const repositoryId = project.id;
     const state = await remoteState(repositoryId);
@@ -693,7 +715,34 @@ async function doImport(refs, url) {
     }
 }
 async function doPush(requests, url) {
-    const { slug } = (0, git_history_js_1.parseRemoteUrl)(url);
+    /*
+      A push never goes to the account named in the URL — it goes to the one the
+      token belongs to. Publishing somebody's work to a different account on
+      their behalf would be the worse mistake of the two.
+  
+      But it is not enough to ignore the name, now that fetching honours it.
+      The same URL would then read from one account and write to another: a
+      push to `coderook://somebody/their-project` quietly made a private
+      project of that name on your own account and reported success, while git
+      printed "To coderook://somebody/their-project". Saying no is the honest
+      answer, and it leaves the person a working one.
+    */
+    const { owner, slug } = (0, git_history_js_1.parseRemoteUrl)(url);
+    if (owner) {
+        const me = await (0, api_js_1.whoami)().catch(() => null);
+        const mine = (me?.username ?? "").toLowerCase();
+        if (mine && owner.toLowerCase() !== mine) {
+            say(`This remote names ${owner}, and you are signed in as ${mine}.` +
+                ` A push goes to your own account, so it would land somewhere the` +
+                ` URL does not name.`);
+            say(`To publish your own copy: git remote set-url origin coderook://${mine}/${slug}`);
+            for (const request of requests) {
+                send(`error ${request.dst} this remote belongs to ${owner}, not to ${mine}`);
+            }
+            send("");
+            return;
+        }
+    }
     const marks = await readMarks();
     /*
       Re-read the project before every ref, not once before the batch.
@@ -1056,6 +1105,40 @@ async function doPush(requests, url) {
 `);
                         throw error;
                     }
+                    if (failure?.kind === "credentials") {
+                        /*
+                          The one refusal a push cannot answer. `cbx submit` can ask and
+                          be told yes; git has nowhere to put that question, so the way
+                          through is to take the key out — which is the better answer
+                          anyway.
+                        */
+                        send(`error ${request.dst} this commit carries a credential`);
+                        say(`
+  ${failure.message}
+`);
+                        /*
+                          Deleting the file in a later commit does not help, and saying
+                          "take it out and commit again" sends people in circles: a push
+                          publishes every commit as its own version, so the commit that
+                          introduced the key still carries it however many commits follow.
+                          The history has to lose it.
+                        */
+                        say(`  A later commit that deletes it is not enough — every commit` +
+                            ` being pushed
+  becomes a version, and the one that added` +
+                            ` the key still carries it.
+` +
+                            `  Rewrite it out (git rebase -i, or git commit --amend if it` +
+                            ` is the last one),
+  or publish this deliberately with` +
+                            ` cbx submit --allow-secrets.
+`);
+                        /*
+                          Reported already, and in more detail than the wrapper can. The
+                          marker stops the bin printing the same paragraph a second time.
+                        */
+                        throw new AlreadyReported(failure.message);
+                    }
                     if (failure?.kind === "conflict") {
                         send(`error ${request.dst} somebody published to "${branch}" while this push was running`);
                         say(`
@@ -1124,6 +1207,12 @@ async function main(argv) {
     (0, identify_js_1.declareClient)("cli", version_js_1.VERSION);
     const pending = [];
     const importing = [];
+    /*
+      Whether a fetch asked for something that is not there. Git reads "no
+      refs" as "an empty repository" and reports success, so without this a
+      clone of a project you cannot see left an empty folder and exited zero.
+    */
+    let unservable = false;
     for await (const line of lines()) {
         const command = line.trim();
         if (command === "capabilities") {
@@ -1144,8 +1233,35 @@ async function main(argv) {
         }
         if (command === "list" || command === "list for-push") {
             try {
-                const { slug } = (0, git_history_js_1.parseRemoteUrl)(url);
-                const project = await (0, api_js_1.findProject)(slug);
+                const { owner, slug } = (0, git_history_js_1.parseRemoteUrl)(url);
+                const named = owner ? `${owner}/${slug}` : slug;
+                const project = await (0, api_js_1.findProject)(named);
+                /*
+                  A fetch of something that is not there has to say so here.
+        
+                  Git asks `list` first and only asks to import the refs it is
+                  offered, so a project nobody can read never reaches the import at
+                  all — it is simply a listing with nothing in it, which git reports
+                  as an empty repository and calls a success. Refusing at this point
+                  is the only place the answer can still be "no".
+        
+                  `list for-push` is exempt: pushing to a name that does not exist
+                  yet is how a project gets created.
+                */
+                if (command === "list" && !project) {
+                    say(`No CodeRook project called "${named}", or you cannot read it.`);
+                    unservable = true;
+                    /*
+                      The listing is deliberately left unterminated.
+          
+                      An empty but well-formed list is a valid answer meaning "an empty
+                      repository", and git takes it as one: it reports success, leaves
+                      a folder with nothing but .git in it, and ignores whatever the
+                      helper exits with. Ending the conversation instead is the only
+                      answer git reads as a failure.
+                    */
+                    break;
+                }
                 if (command === "list for-push") {
                     const known = await remoteRefs(project?.id ?? null);
                     for (const [ref, sha] of known)
@@ -1228,10 +1344,18 @@ async function main(argv) {
                     await doImport(batch, url);
                 }
                 catch (error) {
-                    say(`Import failed: ${error instanceof Error ? error.message : String(error)}`);
-                    // `done` regardless, so fast-import closes cleanly instead of git
-                    // waiting on a stream that will never end.
-                    send("done");
+                    /*
+                      A project that could not be found has already said so and closed
+                      the stream. Anything else has not, and fast-import would wait on
+                      a stream that never ends.
+                    */
+                    if (error instanceof ImportFailed) {
+                        unservable = true;
+                    }
+                    else {
+                        say(`Import failed: ${error instanceof Error ? error.message : String(error)}`);
+                        send("done");
+                    }
                 }
                 continue;
             }
@@ -1254,5 +1378,5 @@ async function main(argv) {
             continue;
         }
     }
-    return 0;
+    return unservable ? 1 : 0;
 }