@coderook/cli 0.28.0 → 0.29.1

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.28.0",
+  "version": "0.29.1",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/cli.js

@@ -661,6 +661,16 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
         localPath: folder,
         changed: files.filter((file) => !file.deleted).map((file) => file.path),
         deleted: files.filter((file) => file.deleted).map((file) => file.path),
+        /*
+          Nothing is left out, and `changed` above is not the whole of it.
+    
+          `submit` sends whatever the rules allow — there is no per-file choosing
+          here — but it was passing the listed rows as the selection, and that list
+          stops at twenty thousand. A folder of twenty-one thousand files saved
+          twenty thousand of them and said "Saved v1" without mentioning the rest.
+          An empty exclusion list is how "all of it" is said.
+        */
+        excluded: [],
         message,
         /*
           A folder's name is the right default and the wrong answer for import,
@@ -708,11 +718,16 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
         try {
             const ahead = await (0, api_js_1.collisionCheck)(link.repositoryId, link.baseVersionId, files.filter((file) => !file.deleted).map((file) => file.path));
             if (ahead.collidingPaths.length) {
+                /*
+                  "1 of your file is" — the plural was on the wrong noun. It is one
+                  of *your files*, however many of them collided, so only the verb
+                  changes with the count.
+                */
+                const many = ahead.collidingPaths.length !== 1;
                 console.log(accent("Heads up") +
                     `  somebody has saved since you last caught up, and ` +
-                    `${ahead.collidingPaths.length} of your file` +
-                    `${ahead.collidingPaths.length === 1 ? "" : "s"} ` +
-                    `${ahead.collidingPaths.length === 1 ? "is" : "are"} among what they changed.`);
+                    `${ahead.collidingPaths.length} of your files ` +
+                    `${many ? "are" : "is"} among what they changed.`);
                 for (const path of ahead.collidingPaths.slice(0, 5)) {
                     console.log(dim(`  ${path}`));
                 }
@@ -867,7 +882,13 @@ The connection failed: ${text}`));
             ? `, ${result.alreadyStoredFiles} already on the account`
             : "") +
         (result.reusedFiles ? `, ${result.reusedFiles} unchanged` : "") +
-        ` · version holds ${bytes(result.sourceBytes)}`);
+        /*
+          "version holds" was the old fused vocabulary. `cbx submit` makes a
+          save; a save becomes a version when somebody names it, which is what
+          `cbx release` does. Saying "version" here promised something this
+          command does not do.
+        */
+        ` · the save holds ${bytes(result.sourceBytes)}`);
     return 0;
 }
 /**
@@ -1179,8 +1200,17 @@ trackName) {
  */
 async function suggestRules(folder, apply) {
     const rules = await (0, worktree_js_1.readRules)(folder);
-    const files = await (0, worktree_js_1.changedFiles)(folder, rules, null);
-    const suggestions = (0, detect_js_1.suggestExclusions)(await (0, worktree_js_1.fileSizes)(folder, files));
+    /*
+      Sizes for the whole folder, not for the listed rows.
+  
+      This used to measure `changedFiles`, which stops at twenty thousand — so
+      on the projects with the most to leave out, the sizes here were a fraction
+      of the truth and the biggest item could be missing from the list outright.
+      The scan carries a size for every file it walks past now, capped or not.
+    */
+    const listing = { listed: 0, total: 0, sizes: [] };
+    await (0, worktree_js_1.changedFiles)(folder, rules, null, "add-and-update", undefined, listing);
+    const suggestions = (0, detect_js_1.suggestExclusions)(listing.sizes);
     if (!suggestions.length) {
         console.log(dim("Nothing here looks like it should be left out."));
         return 0;
@@ -1599,11 +1629,14 @@ const SPECS = [
         name: "submit",
         aliases: ["publish", "push"],
         group: "Working with a folder",
-        summary: "send the changes as a new version",
+        summary: "send the changes as a new save",
         usage: 'submit [folder] -m "…"',
-        detail: "Sends everything that changed since the last version. If the folder is\n" +
+        detail: "Sends everything that changed since the last save. If the folder is\n" +
             "not linked to a project yet, one is created on your account, named\n" +
-            "after the folder and private to begin with.",
+            "after the folder and private to begin with.\n\n" +
+            "A save is not a version. Nobody outside the project can see one until\n" +
+            "it is named, which is what `cbx release` does — so submitting is as\n" +
+            "cheap and as private as you want it to be.",
         options: [
             { flags: "-m, --message <text>", description: "what changed, in a sentence" },
             { flags: "-n, --dry-run", description: "show what would be sent, send nothing" },

package/dist/cli/src/git_remote.js

@@ -1045,12 +1045,18 @@ async function doPush(requests, url) {
                 continue;
             }
             /*
-              Said before the work starts, not after. Each commit is a published
-              version and versions are not free to make, so somebody pushing years
+              Said before the work starts, not after. Each commit becomes a save on
+              the project and saves are not free to make, so somebody pushing years
               of history deserves the chance to stop and import a snapshot instead.
+      
+              "to publish as versions" is what this used to say, and it stopped
+              being true when commits and versions separated: a pushed commit is a
+              save that nobody outside the project can see. Publishing one is what
+              pushing a *tag* does, because a tag is a name and a named save is a
+              version.
             */
             const estimate = Math.round((commits.length * 11) / 60);
-            say(`  ${commits.length} commit${commits.length === 1 ? "" : "s"} to publish as version${commits.length === 1 ? "" : "s"}` +
+            say(`  ${commits.length} commit${commits.length === 1 ? "" : "s"} to send as save${commits.length === 1 ? "" : "s"}` +
                 (commits.length > 20 ? ` — roughly ${estimate} minute${estimate === 1 ? "" : "s"}` : ""));
             /*
               A push that continues a branch has to start from where the branch
@@ -1114,8 +1120,8 @@ async function doPush(requests, url) {
                     .slice(1);
                 if (parents.length > 1 && !warnedAboutMerges) {
                     warnedAboutMerges = true;
-                    say(`  note: merge commits are published as one version holding the ` +
-                        `merged tree.\n        The contents are exact; the branch shape is not kept.`);
+                    say(`  note: a merge commit arrives as one save holding the merged ` +
+                        `tree.\n        The contents are exact; the branch shape is not kept.`);
                 }
                 const changes = await applyCommit(catFile, scratch, previous, sha);
                 previous = sha;

package/dist/cli/src/publish.js

@@ -8,6 +8,7 @@ function uploadRequestFor(input) {
         localPath: input.localPath,
         // Both lists. See the note at the top of this file.
         include: [...input.changed, ...input.deleted],
+        ...(input.excluded === undefined ? {} : { excluded: input.excluded }),
         deletions: input.deleted,
         message: input.message,
         projectName: input.projectName,

package/dist/desktop-app/src/main/detect.js

@@ -39,6 +39,40 @@ const RULES = [
     { directory: ".next", reason: "Next.js build output", recommended: true },
     { directory: ".gradle", reason: "Gradle build state", recommended: true },
     { directory: ".terraform", reason: "Downloaded Terraform providers", recommended: true },
+    /*
+      Game engines, which is where the size actually is.
+  
+      A Unity project is mostly not the project: `Library/` alone is routinely
+      thousands of times the size of `Assets/`, and every byte of it is rebuilt
+      from `Assets/` and `Packages/` the next time the editor opens. Until these
+      existed a Unity folder produced no suggestions at all — the one shape of
+      project where the question "what should I leave out?" has the largest
+      possible answer was the one the detector had nothing to say about.
+    */
+    { directory: "Library", reason: "Unity's import cache — rebuilt when the project next opens", recommended: true },
+    { directory: "Temp", reason: "Unity's scratch folder for the running editor", recommended: true },
+    { directory: "MemoryCaptures", reason: "Unity memory snapshots — large, and not the project", recommended: true },
+    { directory: "Recordings", reason: "Unity recorder output", recommended: true },
+    { directory: "UserSettings", reason: "Your own editor layout — not part of the project", recommended: true },
+    { directory: "DerivedDataCache", reason: "Unreal's derived data cache — rebuilt on demand", recommended: true },
+    { directory: "Intermediate", reason: "Unreal build intermediates — rebuilt when you build", recommended: true },
+    { directory: "Binaries", reason: "Unreal compiled output — rebuilt when you build", recommended: true },
+    /*
+      Named like the work, and it is not: Unreal keeps logs, crash reports and
+      autosaves here. Offered rather than ticked, because a folder called
+      "Saved" is the one nobody should have excluded on our say-so.
+    */
+    { directory: "Saved", reason: "Unreal logs and autosaves — check before excluding", recommended: false },
+    { directory: ".godot", reason: "Godot's import cache — rebuilt when the project next opens", recommended: true },
+    { directory: ".import", reason: "Godot's import cache — rebuilt when the project next opens", recommended: true },
+    { directory: "Logs", reason: "Editor logs", recommended: true },
+    { directory: "obj", reason: "Compiler intermediates — rebuilt when you build", recommended: true },
+    { directory: ".vs", reason: "Visual Studio's local cache", recommended: true },
+    /*
+      Offered, not ticked. JetBrains keeps run configurations in here that some
+      projects deliberately share, so this is a judgement rather than a fact.
+    */
+    { directory: ".idea", reason: "JetBrains editor state — check before excluding", recommended: false },
     /*
       A Chromium or Electron profile left in the project folder. Worth its own
       reason because the consequence is not only size: these hold lock files
@@ -59,6 +93,7 @@ const RULES = [
     { directory: "dist", reason: "Usually build output — check before excluding", recommended: false },
     { directory: "build", reason: "Usually build output — check before excluding", recommended: false },
     { directory: "out", reason: "Usually build output — check before excluding", recommended: false },
+    { directory: "bin", reason: "Usually build output — check before excluding", recommended: false },
     { extension: ".safetensors", reason: "Model weights — large, and usually downloadable", recommended: false },
     { extension: ".ckpt", reason: "Model weights — large, and usually downloadable", recommended: false },
     { extension: ".pt", reason: "Model weights — large, and usually downloadable", recommended: false },
@@ -86,13 +121,29 @@ function suggestExclusions(files) {
         const extension = node_path_1.default.extname(name).toLowerCase();
         for (const rule of RULES) {
             let pattern = null;
-            if (rule.directory && segments.slice(0, -1).includes(rule.directory)) {
-                pattern = `${rule.directory}/`;
+            if (rule.directory) {
+                /*
+                  Matched without regard to case, and written back with the case the
+                  folder actually has.
+        
+                  Every engine disagrees about capitals — Unity ships `Library` and
+                  `obj` in the same project, Unreal `Binaries`, Godot `.godot` — and
+                  an exact-name match meant the detector recognised whichever spelling
+                  happened to be written here and silently missed the rest. Emitting
+                  the observed name rather than the rule's own keeps the line that
+                  gets written matching the folder that is there.
+                */
+                const wanted = rule.directory.toLowerCase();
+                const found = segments
+                    .slice(0, -1)
+                    .find((segment) => segment.toLowerCase() === wanted);
+                if (found)
+                    pattern = `${found}/`;
             }
-            else if (rule.file && name === rule.file) {
+            if (!pattern && rule.file && name === rule.file) {
                 pattern = rule.file;
             }
-            else if (rule.extension && extension === rule.extension) {
+            if (!pattern && rule.extension && extension === rule.extension) {
                 pattern = `*${rule.extension}`;
             }
             if (!pattern)

package/dist/desktop-app/src/main/upload.js

@@ -354,7 +354,15 @@ class Uploader {
         */
         const everything = await (0, profile_js_1.timed)("survey the project", () => (0, worktree_js_1.surveyFiles)(request.localPath, rules));
         (0, profile_js_1.counted)("files surveyed", everything.length);
-        const ticked = new Set(request.include);
+        const unticked = new Set(request.excluded ?? []);
+        const ticked = request.excluded
+            ? new Set([
+                ...everything
+                    .map((file) => file.path)
+                    .filter((path) => !unticked.has(path)),
+                ...(request.deletions ?? []),
+            ])
+            : new Set(request.include);
         if (!ticked.size)
             throw new Error("Nothing is selected to upload");
         const prior = request.repositoryId
@@ -416,60 +424,98 @@ class Uploader {
         // 1. Measure and hash. This is what makes an unchanged file free.
         const declarations = [];
         let totalBytes = 0;
-        for (const [index, file] of sending.entries()) {
-            this.check();
-            const full = node_path_1.default.join(request.localPath, file.path);
-            let size;
-            try {
-                size = (await (0, promises_1.stat)(full)).size;
-            }
-            catch (error) {
-                // Unreadable now, though it was listed a moment ago. Skipping it
-                // would publish a version quietly missing a file the person chose.
-                vanished.push(file.path);
-                readFailures.set(file.path, error instanceof Error ? error.message : String(error));
-                continue;
-            }
-            report({
-                stage: "hash",
-                files: index,
-                totalFiles: sending.length,
-                bytes: totalBytes,
-                totalBytes: 0,
-                path: file.path,
-                percent: Math.round((index / sending.length) * 20),
-                bytesPerSecond: 0,
-            });
-            /*
-              Hashing is the first thing that opens the file, and opening is what
-              fails on a file another program holds — a database in use, a browser
-              profile's LOCK, an antivirus mid-scan. On Windows those still answer
-              stat() perfectly well, so the check three lines above lets them
-              through and the read below was the one that actually broke.
-      
-              It was unguarded, so the person got a raw "EBUSY: resource busy or
-              locked" naming a path they never chose to think about, instead of the
-              sentence this code already writes for exactly this situation. The
-              outcome was always going to be a refusal; what was missing was it
-              being legible.
-            */
-            let digest;
-            try {
-                digest = await (0, profile_js_1.timed)("hash files", () => digestOf(full));
+        /*
+          Hashed several at a time, and reported by how many are done.
+    
+          Each file here is an open, a read and a close, and on Windows every open
+          is also an antivirus scan — so this stage is waiting, not computing.
+          Taken strictly one after another, a folder of twenty thousand small
+          files spent a quarter of an hour in a step that moves no data at all,
+          and the bar sat on 0% for the first thousand of them because it only
+          ever spanned a fifth of itself across the whole stage.
+    
+          Overlapping the waits collapses them into one wait. The results are
+          written into their own slots rather than pushed, because which disk read
+          finishes first must not decide the order of a version's file list.
+        */
+        const HASH_LANES = 8;
+        const measured = new Array(sending.length).fill(null);
+        let hashed = 0;
+        let cursor = 0;
+        /** Throttled: twenty thousand sends is its own cost, and nobody reads them. */
+        let told = 0;
+        const lane = async () => {
+            for (;;) {
+                const index = cursor;
+                cursor += 1;
+                if (index >= sending.length)
+                    return;
+                const file = sending[index];
+                this.check();
+                const full = node_path_1.default.join(request.localPath, file.path);
+                let size;
+                try {
+                    size = (await (0, promises_1.stat)(full)).size;
+                }
+                catch (error) {
+                    // Unreadable now, though it was listed a moment ago. Skipping it
+                    // would publish a version quietly missing a file the person chose.
+                    vanished.push(file.path);
+                    readFailures.set(file.path, error instanceof Error ? error.message : String(error));
+                    hashed += 1;
+                    continue;
+                }
+                /*
+                  Hashing is the first thing that opens the file, and opening is what
+                  fails on a file another program holds — a database in use, a browser
+                  profile's LOCK, an antivirus mid-scan. On Windows those still answer
+                  stat() perfectly well, so the check above lets them through and the
+                  read below is the one that actually breaks.
+        
+                  It was unguarded, so the person got a raw "EBUSY: resource busy or
+                  locked" naming a path they never chose to think about, instead of
+                  the sentence this code already writes for exactly this situation.
+                */
+                let digest;
+                try {
+                    digest = await (0, profile_js_1.timed)("hash files", () => digestOf(full));
+                }
+                catch (error) {
+                    vanished.push(file.path);
+                    readFailures.set(file.path, error instanceof Error ? error.message : String(error));
+                    hashed += 1;
+                    continue;
+                }
+                measured[index] = {
+                    path: file.path,
+                    full,
+                    size,
+                    sha256: digest,
+                    mediaType: mediaTypeOf(file.path),
+                };
+                hashed += 1;
+                const now = Date.now();
+                if (now - told > 80 || hashed === sending.length) {
+                    told = now;
+                    report({
+                        stage: "hash",
+                        files: hashed,
+                        totalFiles: sending.length,
+                        bytes: 0,
+                        totalBytes: 0,
+                        path: file.path,
+                        percent: Math.round((hashed / sending.length) * 20),
+                        bytesPerSecond: 0,
+                    });
+                }
             }
-            catch (error) {
-                vanished.push(file.path);
-                readFailures.set(file.path, error instanceof Error ? error.message : String(error));
+        };
+        await Promise.all(Array.from({ length: Math.min(HASH_LANES, sending.length) }, () => lane()));
+        for (const one of measured) {
+            if (!one)
                 continue;
-            }
-            declarations.push({
-                path: file.path,
-                full,
-                size,
-                sha256: digest,
-                mediaType: mediaTypeOf(file.path),
-            });
-            totalBytes += size;
+            declarations.push(one);
+            totalBytes += one.size;
         }
         /*
           A deletion-only save has no file to hash or upload, but it is still a
@@ -1052,7 +1098,16 @@ class Uploader {
             totalFiles: declarations.length,
             bytes: sentBytes,
             totalBytes,
-            path: "Recording the version",
+            /*
+              A save, not a version.
+      
+              Sending produces a commit; it becomes a version when somebody names
+              it, which happens later and on purpose. This line said "Recording the
+              version" while doing neither — it was the last wording left over from
+              before the two were separate, and it sat on the one screen a person
+              watches to the end.
+            */
+            path: "Writing down what was sent",
             percent: 96,
             bytesPerSecond: rate(),
         });

package/dist/desktop-app/src/main/worktree.js

@@ -14,7 +14,6 @@ exports.branchName = branchName;
 exports.changedFiles = changedFiles;
 exports.surveyFiles = surveyFiles;
 exports.totalSize = totalSize;
-exports.fileSizes = fileSizes;
 exports.fileDiff = fileDiff;
 exports.projectTree = projectTree;
 exports.evaluateRules = evaluateRules;
@@ -55,49 +54,49 @@ async function git(root, ...args) {
  * file would produce an incomplete project that looked backed up, so likely
  * secrets are warned about instead (docs/UPLOAD_POLICY.md).
  */
-exports.STARTER_IGNORE = `# Dependencies and generated output
-node_modules/
-dist/
-build/
-out/
-.next/
-target/
-__pycache__/
-.venv/
-venv/
-*.log
-
-# Large model weights
-models/**
-*.safetensors
-*.ckpt
-*.pt
-*.pth
-
-# Caches and local state
-.venv/
-.pytest_cache/
-.mypy_cache/
-.ruff_cache/
-.cache/
-*.pyc
-
-# A browser or Electron profile that has been left in the project folder.
-# These hold files another program keeps open — a LOCK that cannot be read
-# while it runs will stop a save outright — and nothing in them is the work.
-IndexedDB/
-Local Storage/
-Session Storage/
-Service Worker/
-Network/
-GPUCache/
-Code Cache/
-blob_storage/
-Local State
-Preferences
-
-# Archives of the project, inside the project
-*.cbx
+exports.STARTER_IGNORE = `# Dependencies and generated output
+node_modules/
+dist/
+build/
+out/
+.next/
+target/
+__pycache__/
+.venv/
+venv/
+*.log
+
+# Large model weights
+models/**
+*.safetensors
+*.ckpt
+*.pt
+*.pth
+
+# Caches and local state
+.venv/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.cache/
+*.pyc
+
+# A browser or Electron profile that has been left in the project folder.
+# These hold files another program keeps open — a LOCK that cannot be read
+# while it runs will stop a save outright — and nothing in them is the work.
+IndexedDB/
+Local Storage/
+Session Storage/
+Service Worker/
+Network/
+GPUCache/
+Code Cache/
+blob_storage/
+Local State
+Preferences
+
+# Archives of the project, inside the project
+*.cbx
 `;
 /** The shared rules file, committed with the project. */
 exports.IGNORE_FILE = ".gitignore";
@@ -318,19 +317,69 @@ async function measure(full, size, known) {
  * upload when no version has ever been saved. The filter rules decide what
  * is a candidate; the baseline decides what is new.
  */
+/**
+ * The same files, ordered so that a cap spends itself across the folder.
+ *
+ * Taken in walk order, a cap is handed to whichever directory the walk
+ * reached first — and the directory a person cares about is rarely that one.
+ * Round-robin by directory means the first row of every directory is chosen
+ * before the second row of any, so a folder of forty-five thousand cache
+ * files cannot bury the eight hundred beside it that are the work.
+ */
+function spreadAcrossDirectories(found) {
+    const byDirectory = new Map();
+    for (const one of found) {
+        const at = one.relative.slice(0, one.relative.lastIndexOf("/") + 1);
+        const held = byDirectory.get(at);
+        if (held)
+            held.push(one);
+        else
+            byDirectory.set(at, [one]);
+    }
+    const queues = [...byDirectory.values()];
+    const deepest = queues.reduce((most, queue) => Math.max(most, queue.length), 0);
+    const spread = [];
+    for (let round = 0; round < deepest; round++) {
+        for (const queue of queues) {
+            const one = queue[round];
+            if (one)
+                spread.push(one);
+        }
+    }
+    return spread;
+}
 async function changedFiles(root, rules, baseline = null, mode = "add-and-update", 
 /*
   Digests already taken, and what the files looked like when they were.
   Read and written in place, so the caller keeps whatever this learns and
   the next scan does not read the same unchanged gigabyte again.
 */
-stats) {
+stats, 
+/** Filled with how much of the folder the cap allowed through. */
+outcome) {
     const layers = await collectLayers(root, rules);
     const files = [];
     const present = new Set();
     const pending = [root];
-    while (pending.length && files.length < LISTED_FILE_LIMIT) {
-        const directory = pending.pop();
+    /** Everything the rules would send, including what the cap keeps out. */
+    const found = [];
+    const limit = outcome?.limit ?? LISTED_FILE_LIMIT;
+    /*
+      Walk the whole folder first, and decide what to read afterwards.
+  
+      These used to be one pass: walk until twenty thousand rows had been
+      collected, then stop where it stood. That made the cap decide the shape of
+      the answer — the walk was depth first, so the first directory it descended
+      into took the entire allowance. In a Unity project that is `Library/`,
+      forty-five thousand files of import cache, and `Assets/` — the actual game
+      — appeared in the list nowhere at all.
+  
+      Walking is cheap: a readdir and a stat, no file is opened. Reading is what
+      costs, so reading is what the cap should govern, and it can only be spent
+      well once the whole folder is known.
+    */
+    for (let next = 0; next < pending.length; next++) {
+        const directory = pending[next];
         let entries;
         try {
             entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
@@ -338,6 +387,7 @@ stats) {
         catch {
             continue;
         }
+        const wanted = [];
         for (const entry of entries) {
             const full = node_path_1.default.join(directory, entry.name);
             if (entry.isSymbolicLink())
@@ -359,43 +409,75 @@ stats) {
                 continue;
             if ((0, rules_js_1.excludes)(relative, false, layers))
                 continue;
-            let size;
-            let mtimeMs;
+            wanted.push({ full, relative });
+        }
+        /*
+          Sized a directory at a time rather than a file at a time. One `stat` is
+          a syscall's round trip, and forty-seven thousand of them taken strictly
+          one after another is most of the scan; asked for together they overlap.
+        */
+        const sized = await Promise.all(wanted.map(async (one) => {
             try {
-                const info = await (0, promises_1.stat)(full);
-                size = info.size;
-                mtimeMs = info.mtimeMs;
+                const info = await (0, promises_1.stat)(one.full);
+                return { ...one, size: info.size, mtimeMs: info.mtimeMs };
             }
             catch {
-                continue;
+                /* Gone or unreadable since the walk began; the upload reports it. */
+                return null;
             }
-            present.add(relative);
-            const measured = await measure(full, size, {
-                mtimeMs,
-                cached: stats?.get(relative),
-                recorded: baseline?.has(relative) ?? false,
-            });
+        }));
+        for (const one of sized) {
+            if (!one)
+                continue;
             /*
-              Remembered whether or not it changed: the next scan wants to skip
-              reading this file again, and that is just as true of one that was
-              edited a moment ago as of one that never moves.
+              Recorded as present for every file the walk saw, capped or not.
+      
+              Synchronize mode calls anything in the last version that is missing
+              from this set a deletion. Filling it only for the rows that fitted
+              meant a folder past the cap proposed deleting every file the cap had
+              kept out — files sitting right there on disk.
             */
-            if (measured.hash)
-                stats?.set(relative, { size, mtimeMs, sha256: measured.hash });
-            const saved = baseline?.get(relative);
-            if (saved && measured.hash && saved === measured.hash)
-                continue;
-            files.push({
-                path: relative,
-                // Against a saved version the true line delta needs the old copy;
-                // until a version exists to fetch, a changed file counts as rewritten.
-                added: measured.lines,
-                removed: 0,
-                included: true,
-                binary: measured.binary,
-            });
+            present.add(one.relative);
+            outcome?.sizes.push({ path: one.relative, size: one.size });
+            found.push(one);
         }
     }
+    /*
+      Read in an order that gives every directory a share, and stop at the cap.
+  
+      An unchanged file costs a digest and produces no row, so this runs until
+      the list is full rather than over a fixed slice — a folder where nothing
+      has changed still has to be walked through to find that out.
+    */
+    for (const one of spreadAcrossDirectories(found)) {
+        if (files.length >= limit)
+            break;
+        const { full, relative, size, mtimeMs } = one;
+        const measured = await measure(full, size, {
+            mtimeMs,
+            cached: stats?.get(relative),
+            recorded: baseline?.has(relative) ?? false,
+        });
+        /*
+          Remembered whether or not it changed: the next scan wants to skip
+          reading this file again, and that is just as true of one that was
+          edited a moment ago as of one that never moves.
+        */
+        if (measured.hash)
+            stats?.set(relative, { size, mtimeMs, sha256: measured.hash });
+        const saved = baseline?.get(relative);
+        if (saved && measured.hash && saved === measured.hash)
+            continue;
+        files.push({
+            path: relative,
+            // Against a saved version the true line delta needs the old copy;
+            // until a version exists to fetch, a changed file counts as rewritten.
+            added: measured.lines,
+            removed: 0,
+            included: true,
+            binary: measured.binary,
+        });
+    }
     // A file that was in the last version and is gone now is only a change in
     // synchronize mode. The safe default adds and updates, and leaves the
     // saved copy of a missing file alone (docs/UPLOAD_POLICY.md).
@@ -413,6 +495,15 @@ stats) {
             });
         }
     }
+    if (outcome) {
+        outcome.listed = files.length;
+        /*
+          Deletions are rows the walk never saw, so they are added to both sides
+          rather than left out of the total — otherwise a synchronize scan could
+          report listing more files than the folder was found to hold.
+        */
+        outcome.total = Math.max(found.length, files.length);
+    }
     return files.sort((left, right) => left.path.localeCompare(right.path));
 }
 /** The size on disk of everything the rules would upload. */
@@ -483,29 +574,6 @@ async function totalSize(root, files) {
     }
     return total;
 }
-/**
- * The same walk, keeping each file's size rather than only the sum.
- *
- * Used where something has to reason about which files are large — the
- * exclusion suggestions, whose whole value is saying which folder is costing
- * the upload its time. Separate from totalSize so that the common path still
- * carries nothing it does not need.
- */
-async function fileSizes(root, files) {
-    const sized = [];
-    for (const file of files) {
-        try {
-            sized.push({
-                path: file.path,
-                size: (await (0, promises_1.stat)(node_path_1.default.join(root, file.path))).size,
-            });
-        }
-        catch {
-            /* deleted since the scan; it cannot be measured and does not count */
-        }
-    }
-    return sized;
-}
 /** The unified diff for one file, including files git does not track yet. */
 async function fileDiff(root, file, ignoreWhitespace = false) {
     const output = await git(root, "diff", "--no-ext-diff", "--unified=3", ...(ignoreWhitespace ? ["--ignore-all-space"] : []), "--", file);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.28.0",
+  "version": "0.29.1",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",