@coderook/cli 0.29.1 → 0.29.2

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.29.1",
+  "version": "0.29.2",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/cli.js

@@ -40,6 +40,7 @@ const download_js_1 = require("../../desktop-app/src/main/download.js");
 const faults_js_1 = require("../../desktop-app/src/main/faults.js");
 const version_commands_js_1 = require("./version_commands.js");
 const identify_js_1 = require("../../desktop-app/src/main/identify.js");
+const profile_js_1 = require("../../desktop-app/src/main/profile.js");
 const detect_js_1 = require("../../desktop-app/src/main/detect.js");
 const cbx_js_1 = require("../../desktop-app/src/main/cbx.js");
 const api_js_2 = require("./api.js");
@@ -889,6 +890,16 @@ The connection failed: ${text}`));
           command does not do.
         */
         ` · the save holds ${bytes(result.sourceBytes)}`);
+    /*
+      Where the time went, when asked for.
+  
+      The profiler has existed for a while and nothing ever printed it, so the
+      one question it answers — which stage is the save — still had to be
+      guessed at. Silent unless CODEROOK_PROFILE is set.
+    */
+    const profile = (0, profile_js_1.profileReport)();
+    if (profile)
+        console.log(profile);
     return 0;
 }
 /**

package/dist/desktop-app/src/main/download.js

@@ -473,75 +473,98 @@ class Downloader {
                 packed.set(id, group);
             }
             const restoredPacks = new Set();
+            /*
+              Fetched several at a time, and each pack fetched once.
+      
+              This was one request after another — a pack or a file, wait for it,
+              write it, ask for the next — while the sending side has had six lanes
+              for a long time. Measured across thirty project shapes, that made
+              restoring roughly six times slower than saving the same bytes: an
+              Unreal project of four hundred and ninety megabytes went up in ten
+              minutes and came back in sixty-one. A restore is mostly waiting on the
+              network, and waiting is the thing that overlaps.
+      
+              The work is planned before any of it runs, which also removes the
+              double-fetch guard the serial version needed: a pack appears once in
+              the list, so it can only be fetched once.
+            */
+            const jobs = [];
             for (const file of files) {
-                this.check();
+                const id = file.sealed ? undefined : file.pack?.objectId;
+                if (id) {
+                    if (restoredPacks.has(id))
+                        continue;
+                    restoredPacks.add(id);
+                    jobs.push({ kind: "pack", id });
+                }
+                else {
+                    jobs.push({ kind: "file", file });
+                }
+            }
+            /** Refused outright, wherever it appears — inside a pack or beside it. */
+            const safeParts = (where) => {
+                const parts = where.split("/").filter(Boolean);
+                if (parts.some((part) => part === ".." || part.includes("\0"))) {
+                    throw new Error(`That version contains an unsafe path: ${where}`);
+                }
+                return parts;
+            };
+            const told = { at: 0 };
+            const sayProgress = (where) => {
+                const now = Date.now();
+                if (now - told.at < 80)
+                    return;
+                told.at = now;
                 report({
                     files: written,
                     totalFiles: files.length,
                     bytes,
                     totalBytes,
-                    path: file.path,
+                    path: where,
                     percent: underway(bytes, totalBytes),
                 });
-                // A path that climbs out of the destination is refused outright.
-                const parts = file.path.split("/").filter(Boolean);
-                if (parts.some((part) => part === ".." || part.includes("\0"))) {
-                    throw new Error(`That version contains an unsafe path: ${file.path}`);
+            };
+            const restorePack = async (packId) => {
+                /*
+                  A solid pack is one compressed object containing many small files.
+        
+                  Asking the single-file route for every member made a large restore
+                  fetch and decompress the same pack thousands of times. The files
+                  listing already gives us the pack id and each member's exact window,
+                  so fetch the decoded pack once, verify it, and materialise every
+                  member before releasing the buffer.
+                */
+                const reply = await this.request(`/v1/repositories/${repositoryId}/objects/${packId}`);
+                const body = Buffer.from(await reply.arrayBuffer());
+                const packDigest = (0, node_crypto_1.createHash)("sha256").update(body).digest("hex");
+                const expectedPackDigest = reply.headers.get("x-coderook-sha256");
+                if (expectedPackDigest && packDigest !== expectedPackDigest) {
+                    throw new Error("A solid pack did not arrive intact");
                 }
-                const packId = file.sealed ? undefined : file.pack?.objectId;
-                if (packId && restoredPacks.has(packId))
-                    continue;
-                if (packId) {
-                    /*
-                      A solid pack is one compressed object containing many small files.
-          
-                      Asking the single-file route for every member made a large restore
-                      fetch and decompress the same pack thousands of times. The files
-                      listing already gives us the pack id and each member's exact
-                      window, so fetch the decoded pack once, verify it, and materialise
-                      every member before releasing the bounded section-sized buffer.
-                    */
-                    const reply = await this.request(`/v1/repositories/${repositoryId}/objects/${packId}`);
-                    const body = Buffer.from(await reply.arrayBuffer());
-                    const packDigest = (0, node_crypto_1.createHash)("sha256").update(body).digest("hex");
-                    const expectedPackDigest = reply.headers.get("x-coderook-sha256");
-                    if (expectedPackDigest && packDigest !== expectedPackDigest) {
-                        throw new Error("A solid pack did not arrive intact");
+                for (const member of packed.get(packId) ?? []) {
+                    this.check();
+                    const memberParts = safeParts(member.path);
+                    const offset = member.pack.offset;
+                    const length = member.pack.length;
+                    if (offset < 0 || length < 0 || offset + length > body.byteLength) {
+                        throw new Error(`${member.path} points outside its solid pack`);
                     }
-                    for (const member of packed.get(packId) ?? []) {
-                        this.check();
-                        const memberParts = member.path.split("/").filter(Boolean);
-                        if (memberParts.some((part) => part === ".." || part.includes("\0"))) {
-                            throw new Error(`That version contains an unsafe path: ${member.path}`);
-                        }
-                        const offset = member.pack.offset;
-                        const length = member.pack.length;
-                        if (offset < 0 || length < 0 || offset + length > body.byteLength) {
-                            throw new Error(`${member.path} points outside its solid pack`);
-                        }
-                        const contents = body.subarray(offset, offset + length);
-                        const digest = (0, node_crypto_1.createHash)("sha256").update(contents).digest("hex");
-                        if (member.sha256 && digest !== member.sha256) {
-                            throw new Error(`${member.path} did not arrive intact`);
-                        }
-                        const full = node_path_1.default.join(staging, ...memberParts);
-                        await (0, promises_1.mkdir)(node_path_1.default.dirname(full), { recursive: true });
-                        await (0, promises_1.writeFile)(full, contents);
-                        manifest[member.path] = digest;
-                        written += 1;
-                        bytes += member.sourceSize;
-                        report({
-                            files: written,
-                            totalFiles: files.length,
-                            bytes,
-                            totalBytes,
-                            path: member.path,
-                            percent: underway(bytes, totalBytes),
-                        });
+                    const contents = body.subarray(offset, offset + length);
+                    const digest = (0, node_crypto_1.createHash)("sha256").update(contents).digest("hex");
+                    if (member.sha256 && digest !== member.sha256) {
+                        throw new Error(`${member.path} did not arrive intact`);
                     }
-                    restoredPacks.add(packId);
-                    continue;
+                    const full = node_path_1.default.join(staging, ...memberParts);
+                    await (0, promises_1.mkdir)(node_path_1.default.dirname(full), { recursive: true });
+                    await (0, promises_1.writeFile)(full, contents);
+                    manifest[member.path] = digest;
+                    written += 1;
+                    bytes += member.sourceSize;
+                    sayProgress(member.path);
                 }
+            };
+            const restoreFile = async (file) => {
+                const parts = safeParts(file.path);
                 const full = node_path_1.default.join(staging, ...parts);
                 await (0, promises_1.mkdir)(node_path_1.default.dirname(full), { recursive: true });
                 const digest = await this.fetchInto(repositoryId, versionId, file, full);
@@ -559,7 +582,46 @@ class Downloader {
                 manifest[file.path] = digest;
                 written += 1;
                 bytes += file.sourceSize;
-            }
+                sayProgress(file.path);
+            };
+            /*
+              Wide for the small, narrow for the large.
+      
+              Six lanes turned an hour-long restore of many small files into a
+              minute, and made a restore of a few very large ones eight times
+              slower: each large file is already fetched in pieces, so six at once
+              is six times the outstanding requests against the same line, and they
+              all finish later than they would have one after another.
+      
+              Split by what the job is: a pack or a small file is one request and
+              belongs in the wide lane; a large file is a stream of its own and
+              belongs in the narrow one. Both run at once, so a project holding
+              both kinds keeps the line busy without either starving the other.
+              The sending side splits its work the same way — see the note beside
+              BATCH_LANES in upload.ts.
+            */
+            const HEAVY_BYTES = 8 * 1024 * 1024;
+            const light = jobs.filter((job) => job.kind === "pack" || job.file.sourceSize < HEAVY_BYTES);
+            const heavy = jobs.filter((job) => job.kind === "file" && job.file.sourceSize >= HEAVY_BYTES);
+            const drain = async (queue, lanes) => {
+                let next = 0;
+                const lane = async () => {
+                    for (;;) {
+                        const at = next;
+                        next += 1;
+                        if (at >= queue.length)
+                            return;
+                        this.check();
+                        const job = queue[at];
+                        if (job.kind === "pack")
+                            await restorePack(job.id);
+                        else
+                            await restoreFile(job.file);
+                    }
+                };
+                await Promise.all(Array.from({ length: Math.min(lanes, queue.length) }, () => lane()));
+            };
+            await Promise.all([drain(light, 6), drain(heavy, 2)]);
             /*
               Everything has arrived and verified, so it can go into place. Each
               file is renamed over its destination individually: a rename within

package/dist/desktop-app/src/main/rules.js

@@ -65,6 +65,42 @@ function globToSource(pattern) {
             index += 1;
             continue;
         }
+        if (character === "[") {
+            /*
+              A character class, which every engine's published ignore file is
+              written in: `/[Ll]ibrary/`, `/[Bb]uild/`, `/[Oo]bj/`. Without this
+              they were escaped into literals and matched a directory genuinely
+              called "[Ll]ibrary" — so pasting the official Unity template, or
+              applying the one this application ships, excluded nothing at all and
+              said nothing about it.
+      
+              A `]` straight after the bracket, or after a leading negation, is a
+              literal `]` rather than the end of the class — which is how git and
+              the shell both read it.
+            */
+            let end = index + 1;
+            if (pattern[end] === "!" || pattern[end] === "^")
+                end += 1;
+            if (pattern[end] === "]")
+                end += 1;
+            while (end < pattern.length && pattern[end] !== "]")
+                end += 1;
+            if (end < pattern.length) {
+                const inside = pattern.slice(index + 1, end);
+                const negated = inside.startsWith("!") || inside.startsWith("^");
+                const members = (negated ? inside.slice(1) : inside).replace(/[\\\^\]]/g, "\\$&");
+                /*
+                  A class never spans directories, so a negated one excludes the
+                  separator too — otherwise `[!a]` would match a slash and a pattern
+                  for one segment would quietly reach into the next.
+                */
+                source += negated ? `[^/${members}]` : `[${members}]`;
+                index = end;
+                continue;
+            }
+            source += "\\[";
+            continue;
+        }
         if (character === "*") {
             if (pattern[index + 1] === "*") {
                 source += ".*";

package/dist/desktop-app/src/main/upload.js

@@ -119,6 +119,20 @@ class Uploader {
     planning = false;
     plannedObjects = new Map();
     plannedQuote = null;
+    /*
+      Digests worked out while planning, so sending does not work them out again.
+  
+      A save runs the whole pipeline twice: the plan walks, reads, hashes and
+      prices every file to produce a quote, then the send does all of it over.
+      Measured on a twenty-one thousand file project, that was 42,142 hashes for
+      21,071 files — the count in the profile is exactly double, which is how
+      the duplication was finally noticed.
+  
+      Keyed by path and guarded by size and modification time, so a file edited
+      while somebody reads the plan is hashed again rather than published under
+      the digest it used to have.
+    */
+    plannedDigests = new Map();
     planningCreatedRepositoryId = null;
     /** Attached to every object write after the server admits the exact plan. */
     activeQuoteId = null;
@@ -352,7 +366,27 @@ class Uploader {
           truncated version of it would propose deleting everything the walk did
           not reach.
         */
-        const everything = await (0, profile_js_1.timed)("survey the project", () => (0, worktree_js_1.surveyFiles)(request.localPath, rules));
+        const everything = await (0, profile_js_1.timed)("survey the project", () => (0, worktree_js_1.surveyFiles)(request.localPath, rules, (found) => 
+        /*
+          The walk is the first minute of a large save and said nothing at
+          all, so the panel could only show 0%. A running count of what has
+          been seen is not a fraction of anything — it is the evidence that
+          the thing is working.
+        */
+        report({
+            stage: "plan",
+            files: found,
+            totalFiles: 0,
+            bytes: 0,
+            totalBytes: 0,
+            path: "Looking through the folder",
+            /*
+              Between the key check and the reading, and it holds its own place
+              on the bar rather than dropping back to nought between them.
+            */
+            percent: 6,
+            bytesPerSecond: 0,
+        })));
         (0, profile_js_1.counted)("files surveyed", everything.length);
         const unticked = new Set(request.excluded ?? []);
         const ticked = request.excluded
@@ -454,8 +488,11 @@ class Uploader {
                 this.check();
                 const full = node_path_1.default.join(request.localPath, file.path);
                 let size;
+                let mtimeMs;
                 try {
-                    size = (await (0, promises_1.stat)(full)).size;
+                    const info = await (0, promises_1.stat)(full);
+                    size = info.size;
+                    mtimeMs = info.mtimeMs;
                 }
                 catch (error) {
                     // Unreadable now, though it was listed a moment ago. Skipping it
@@ -476,6 +513,28 @@ class Uploader {
                   locked" naming a path they never chose to think about, instead of
                   the sentence this code already writes for exactly this situation.
                 */
+                /*
+                  Read only when the file has actually moved.
+        
+                  Size and modification time are the same test the changes list uses,
+                  and a match there means the digest already taken still describes the
+                  bytes. Reading is what costs; deciding not to read is free.
+                */
+                const remembered = this.plannedDigests.get(file.path) ??
+                    request.knownDigests?.get(file.path);
+                if (remembered &&
+                    remembered.size === size &&
+                    remembered.mtimeMs === mtimeMs) {
+                    measured[index] = {
+                        path: file.path,
+                        full,
+                        size,
+                        sha256: remembered.sha256,
+                        mediaType: mediaTypeOf(file.path),
+                    };
+                    hashed += 1;
+                    continue;
+                }
                 let digest;
                 try {
                     digest = await (0, profile_js_1.timed)("hash files", () => digestOf(full));
@@ -486,6 +545,7 @@ class Uploader {
                     hashed += 1;
                     continue;
                 }
+                this.plannedDigests.set(file.path, { size, mtimeMs, sha256: digest });
                 measured[index] = {
                     path: file.path,
                     full,
@@ -504,7 +564,12 @@ class Uploader {
                         bytes: 0,
                         totalBytes: 0,
                         path: file.path,
-                        percent: Math.round((hashed / sending.length) * 20),
+                        /*
+                          Reading is the stretch from just past the walk to a fifth of
+                          the way through. Starting it at nought put the bar behind where
+                          it had already been and it went backwards between stages.
+                        */
+                        percent: 8 + Math.round((hashed / sending.length) * 12),
                         bytesPerSecond: 0,
                     });
                 }
@@ -702,11 +767,78 @@ class Uploader {
         const heavy = sections.filter((one) => smallShare(one) < 0.5);
         (0, profile_js_1.counted)("sections batched", batchy.length);
         (0, profile_js_1.counted)("sections heavy", heavy.length);
+        /*
+          How many files the whole save has finished, across every section.
+    
+          The sections are an implementation detail of not holding thirty
+          gigabytes in memory at once, and they were leaking into what a person
+          reads: the count ran up to twenty-one thousand while reading, then reset
+          to "0 of 4,000" for each section and counted up again, over and over. It
+          looked like the save was starting over, repeatedly.
+    
+          One denominator for the whole save. Sections still say which one is in
+          flight, in words, where that belongs.
+        */
+        const sectionProgress = new Map();
+        /*
+          What has already been shown, so the number never goes backwards.
+    
+          Two pipelines run sections at once and each reports its own share, which
+          I have now twice failed to combine into a figure that only rises — the
+          count kept dropping to zero at section boundaries and reading as though
+          the save had restarted. Whatever the accounting does, the panel must not
+          be told a smaller number than it was told a moment ago: going backwards
+          is the specific thing a person notices, and it is never information.
+        */
+        let shown = 0;
+        const forward = (count) => {
+            if (count > shown)
+                shown = count;
+            return shown;
+        };
         const runSection = async (section) => {
             const declarations = section.files.map((file) => declarationByPath.get(file.path));
+            /*
+              This section's share of the one number the panel shows.
+      
+              Two pipelines run at once, so no section can report on its own behalf
+              without the count lurching between them. Each records how far it has
+              got and the sum is what is shown, which is the only figure that is
+              true while both are moving.
+            */
+            const advance = (done) => {
+                /*
+                  Only ever upward.
+        
+                  The workers share one iterator, so the indices arrive out of order —
+                  a worker holding file 5 reports after one holding file 200. Writing
+                  each straight in let a later, lower number undo a higher one, and
+                  the count sat still or fell back to zero at every section boundary,
+                  which is the exact stutter this was meant to remove.
+                */
+                const held = sectionProgress.get(section.index) ?? 0;
+                if (done > held)
+                    sectionProgress.set(section.index, done);
+                else if (!sectionProgress.has(section.index)) {
+                    sectionProgress.set(section.index, 0);
+                }
+                let sum = 0;
+                for (const each of sectionProgress.values())
+                    sum += each;
+                return forward(sum);
+            };
             report({
                 stage: "upload",
-                files: 0,
+                /*
+                  The count so far, not zero.
+        
+                  This line announces a new section, and it was reporting nought files
+                  done — so every section boundary threw the number back to the start
+                  and the bar with it. Four of the five reports in this stage were
+                  changed to carry the running total and this one, the only one a
+                  person is guaranteed to see, was missed.
+                */
+                files: advance(0),
                 totalFiles: allDeclarations.length,
                 bytes: progressBytes(),
                 totalBytes,
@@ -861,8 +993,8 @@ class Uploader {
                             transferred += exactWireBytes;
                         report({
                             stage: "upload",
-                            files: 0,
-                            totalFiles: declarations.length,
+                            files: advance(0),
+                            totalFiles: allDeclarations.length,
                             bytes: progressBytes(),
                             totalBytes,
                             path: taking[taking.length - 1].declaration.path,
@@ -914,8 +1046,8 @@ class Uploader {
                     this.check();
                     report({
                         stage: "upload",
-                        files: index,
-                        totalFiles: declarations.length,
+                        files: advance(index),
+                        totalFiles: allDeclarations.length,
                         bytes: sentBytes,
                         totalBytes,
                         path: declaration.path,
@@ -949,8 +1081,8 @@ class Uploader {
                             inFlight.set(index, offset);
                             report({
                                 stage: "upload",
-                                files: index,
-                                totalFiles: declarations.length,
+                                files: advance(index),
+                                totalFiles: allDeclarations.length,
                                 bytes: progressBytes(),
                                 totalBytes,
                                 path: declaration.path,
@@ -1023,8 +1155,8 @@ class Uploader {
                             : await this.putMultipart(repositoryId, declaration, (offset) => {
                                 report({
                                     stage: "upload",
-                                    files: index,
-                                    totalFiles: declarations.length,
+                                    files: advance(index),
+                                    totalFiles: allDeclarations.length,
                                     bytes: progressBytes(),
                                     totalBytes,
                                     path: declaration.path,
@@ -1047,6 +1179,8 @@ class Uploader {
                 }
             };
             await Promise.all(Array.from({ length: Math.min(UPLOAD_LANES, declarations.length) }, () => runWorker()));
+            /* Finished, so its whole share counts — the per-file reports stop one short. */
+            advance(declarations.length);
         };
         const pipeline = async (queue) => {
             for (const section of queue) {
@@ -1066,7 +1200,7 @@ class Uploader {
                 percent: 96,
                 bytesPerSecond: 0,
             });
-            this.plannedQuote = await this.call(`/v1/repositories/${repositoryId}/uploads/preflight`, {
+            this.plannedQuote = await (0, profile_js_1.timed)("ask the service to price it", () => this.call(`/v1/repositories/${repositoryId}/uploads/preflight`, {
                 method: "POST",
                 contentType: "application/json",
                 body: JSON.stringify({
@@ -1074,7 +1208,7 @@ class Uploader {
                     excludedBytes: 0,
                     objects: [...this.plannedObjects.values()],
                 }),
-            });
+            }));
             return {
                 repositoryId,
                 versionId: "",
@@ -1201,7 +1335,7 @@ class Uploader {
           objects are immutable and content-addressed, so a retry reuses them.
         */
         (0, faults_js_1.maybeFail)("submit:after-objects");
-        const completed = await this.call(`/v1/repositories/${repositoryId}/versions`, {
+        const completed = await (0, profile_js_1.timed)("publish the version", () => this.call(`/v1/repositories/${repositoryId}/versions`, {
             method: "POST",
             contentType: "application/json",
             body: JSON.stringify({
@@ -1266,7 +1400,7 @@ class Uploader {
                     executable: false,
                 })),
             }),
-        });
+        }));
         /*
           A clean stale-base save may contain a server-side merge. The candidate
           manifest built above is then not the Version that landed: it lacks the

package/dist/desktop-app/src/main/worktree.js

@@ -66,6 +66,28 @@ __pycache__/
 venv/
 *.log
 
+# What a game engine rebuilds for itself. These are the largest thing in a
+# folder by a wide margin — a Unity project's Library is routinely thousands
+# of times the size of its Assets — and every byte comes back the next time
+# the editor opens. Left out of this list for a long time, which meant a
+# folder with no rules of its own sent its whole cache and nobody was told.
+/[Ll]ibrary/
+/[Tt]emp/
+/[Ll]ogs/
+/[Uu]ser[Ss]ettings/
+/[Mm]emoryCaptures/
+Intermediate/
+DerivedDataCache/
+Binaries/
+.godot/
+.import/
+
+# Compiler and editor output, which the next build writes again.
+obj/
+.vs/
+.gradle/
+DerivedData/
+
 # Large model weights
 models/**
 *.safetensors
@@ -497,6 +519,7 @@ outcome) {
     }
     if (outcome) {
         outcome.listed = files.length;
+        outcome.truncated = files.length >= limit;
         /*
           Deletions are rows the walk never saw, so they are added to both sides
           rather than left out of the total — otherwise a synchronize scan could
@@ -520,7 +543,17 @@ outcome) {
  * content at all. That is what makes it affordable to run over everything
  * before deciding anything.
  */
-async function surveyFiles(root, rules) {
+async function surveyFiles(root, rules, 
+/*
+  Told how many have been found, every so often.
+
+  This walk is the first thing a save does and it can take a minute on a
+  large folder — during which the only honest thing the progress panel
+  could say was 0%, because nothing had told it otherwise. A count of what
+  has been seen is not a fraction of anything, but it moves, and it is the
+  difference between waiting and wondering whether it has hung.
+*/
+onFound) {
     const layers = await collectLayers(root, rules);
     const found = [];
     const pending = [root];
@@ -554,6 +587,8 @@ async function surveyFiles(root, rules) {
                 continue;
             try {
                 found.push({ path: relative, size: (await (0, promises_1.stat)(full)).size });
+                if (onFound && found.length % 500 === 0)
+                    onFound(found.length);
             }
             catch {
                 /* Gone or unreadable since the walk began; the upload reports it. */
@@ -1004,46 +1039,80 @@ const MOST_FINDINGS = 40;
  * already leave behind is not being published, and raising it would train
  * people to dismiss the question that matters.
  */
-async function detectPastedCredentials(root, include) {
+async function detectPastedCredentials(root, include, 
+/*
+  Told how many have been looked at, every so often.
+
+  This reads up to twenty thousand files before a save begins, and it did so
+  one after another with nothing reported — on Windows, where every open is
+  also an antivirus scan, that is a quarter of an hour in which the panel
+  could only show the words "Working out what to send" and no number at all.
+  The same silence the read stage used to have, in a different module.
+*/
+onScanned) {
     const found = [];
     let read = 0;
     let bytes = 0;
-    for (const relative of include) {
-        if (found.length >= MOST_FINDINGS)
-            break;
-        if (read >= MOST_SCANNED_FILES || bytes >= MOST_SCANNED_BYTES)
-            break;
-        const name = relative.slice(relative.lastIndexOf("/") + 1);
-        if (!(0, secret_patterns_js_1.worthReading)(name))
-            continue;
-        const full = node_path_1.default.join(root, relative.split("/").join(node_path_1.default.sep));
-        let contents;
-        try {
-            const info = await (0, promises_1.stat)(full);
-            if (!info.isFile() || info.size > MOST_FILE_BYTES)
+    /*
+      Read several at a time. This is waiting on the disk, not computing, so
+      overlapping the waits collapses them into one wait — the same change the
+      hashing stage needed, for the same reason.
+    */
+    const LANES = 8;
+    const wanted = include.filter((relative) => (0, secret_patterns_js_1.worthReading)(relative.slice(relative.lastIndexOf("/") + 1)));
+    let cursor = 0;
+    let stop = false;
+    const lane = async () => {
+        for (;;) {
+            if (stop)
+                return;
+            const at = cursor;
+            cursor += 1;
+            if (at >= wanted.length)
+                return;
+            if (found.length >= MOST_FINDINGS) {
+                stop = true;
+                return;
+            }
+            if (read >= MOST_SCANNED_FILES || bytes >= MOST_SCANNED_BYTES) {
+                stop = true;
+                return;
+            }
+            const relative = wanted[at];
+            const full = node_path_1.default.join(root, relative.split("/").join(node_path_1.default.sep));
+            let contents;
+            try {
+                const info = await (0, promises_1.stat)(full);
+                if (!info.isFile() || info.size > MOST_FILE_BYTES)
+                    continue;
+                contents = await (0, promises_1.readFile)(full);
+            }
+            catch {
+                /* Unreadable is the scan's problem, not something to report as clean. */
                 continue;
-            contents = await (0, promises_1.readFile)(full);
-        }
-        catch {
-            /* Unreadable is the scan's problem, not something to report as clean. */
-            continue;
+            }
+            read += 1;
+            bytes += contents.byteLength;
+            if (onScanned && read % 50 === 0)
+                onScanned(read, wanted.length);
+            if (!(0, secret_patterns_js_1.looksLikeText)(contents))
+                continue;
+            const credentials = (0, secret_patterns_js_1.findCredentials)(contents.toString("utf8"));
+            if (credentials.length)
+                found.push({ path: relative, found: credentials });
         }
-        read += 1;
-        bytes += contents.byteLength;
-        if (!(0, secret_patterns_js_1.looksLikeText)(contents))
-            continue;
-        const credentials = (0, secret_patterns_js_1.findCredentials)(contents.toString("utf8"));
-        if (credentials.length)
-            found.push({ path: relative, found: credentials });
-    }
+    };
+    await Promise.all(Array.from({ length: Math.min(LANES, wanted.length) }, () => lane()));
     return found;
 }
-async function uploadConcerns(root, include) {
+async function uploadConcerns(root, include, 
+/** Passed through so the one slow part of this can say it is working. */
+onScanned) {
     const chosen = new Set(include);
     const [named, folders, pasted] = await Promise.all([
         detectSecrets(root),
         detectPrivateDirectories(root),
-        detectPastedCredentials(root, include),
+        detectPastedCredentials(root, include, onScanned),
     ]);
     const secrets = named.filter((file) => chosen.has(file));
     return {

package/package.json

@@ -1,54 +1,54 @@
-{
-  "name": "@coderook/cli",
-  "version": "0.29.1",
-  "description": "CodeRook from the command line, on any operating system",
-  "license": "SEE LICENSE IN LICENSE.txt",
-  "homepage": "https://coderook.com",
-  "bugs": {
-    "url": "https://coderook.com/contact"
-  },
-  "keywords": [
-    "coderook",
-    "versioning",
-    "backup",
-    "cbx"
-  ],
-  "engines": {
-    "node": ">=20.11.0"
-  },
-  "bin": {
-    "cbx": "dist/cli/src/cli.js",
-    "coderook": "dist/cli/src/cli.js",
-    "git-remote-coderook": "dist/cli/src/git_remote_bin.js"
-  },
-  "files": [
-    ".claude-plugin",
-    "dist",
-    "skills"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json",
-    "check": "tsc -p tsconfig.json --noEmit",
-    "test": "tsc -p tsconfig.json && node --test --experimental-strip-types test/*.test.ts",
-    "start": "node dist/cli/src/cli.js",
-    "prepublishOnly": "npm run sync:plugin && npm run build",
-    "test:e2e": "node test/e2e.mjs",
-    "test:matrix": "node test/state-matrix.mjs",
-    "test:attempt": "node test/attempt-identity.mjs",
-    "test:get": "node test/get-safety.mjs",
-    "test:live": "node test/e2e.mjs --allow-production && node test/state-matrix.mjs --allow-production && node test/get-safety.mjs --allow-production && node test/get-track.mjs --allow-production && node test/get-protects-edits.mjs --allow-production && node test/upgrade-migration.mjs --allow-production && node test/fault-get.mjs --allow-production && node test/version-floor.mjs --allow-production && node test/fault-submit.mjs --allow-production && node test/race-attempts.mjs --allow-production && node test/attempt-identity.mjs --allow-production",
-    "test:getedits": "node test/get-protects-edits.mjs",
-    "test:upgrade": "node test/upgrade-migration.mjs",
-    "test:faultget": "node test/fault-get.mjs",
-    "test:floor": "node test/version-floor.mjs",
-    "test:faultsubmit": "node test/fault-submit.mjs",
-    "test:race": "node test/race-attempts.mjs",
-    "test:runner": "node test/runner-live.mjs",
-    "sync:plugin": "node scripts/sync-plugin-version.mjs",
-    "test:track": "node test/get-track.mjs"
-  },
-  "devDependencies": {
-    "@types/node": "24.10.1",
-    "typescript": "5.9.3"
-  }
-}
+{
+  "name": "@coderook/cli",
+  "version": "0.29.2",
+  "description": "CodeRook from the command line, on any operating system",
+  "license": "SEE LICENSE IN LICENSE.txt",
+  "homepage": "https://coderook.com",
+  "bugs": {
+    "url": "https://coderook.com/contact"
+  },
+  "keywords": [
+    "coderook",
+    "versioning",
+    "backup",
+    "cbx"
+  ],
+  "engines": {
+    "node": ">=20.11.0"
+  },
+  "bin": {
+    "cbx": "dist/cli/src/cli.js",
+    "coderook": "dist/cli/src/cli.js",
+    "git-remote-coderook": "dist/cli/src/git_remote_bin.js"
+  },
+  "files": [
+    ".claude-plugin",
+    "dist",
+    "skills"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "test": "tsc -p tsconfig.json && node --test --experimental-strip-types test/*.test.ts",
+    "start": "node dist/cli/src/cli.js",
+    "prepublishOnly": "npm run sync:plugin && npm run build",
+    "test:e2e": "node test/e2e.mjs",
+    "test:matrix": "node test/state-matrix.mjs",
+    "test:attempt": "node test/attempt-identity.mjs",
+    "test:get": "node test/get-safety.mjs",
+    "test:live": "node test/e2e.mjs --allow-production && node test/state-matrix.mjs --allow-production && node test/get-safety.mjs --allow-production && node test/get-track.mjs --allow-production && node test/get-protects-edits.mjs --allow-production && node test/upgrade-migration.mjs --allow-production && node test/fault-get.mjs --allow-production && node test/version-floor.mjs --allow-production && node test/fault-submit.mjs --allow-production && node test/race-attempts.mjs --allow-production && node test/attempt-identity.mjs --allow-production",
+    "test:getedits": "node test/get-protects-edits.mjs",
+    "test:upgrade": "node test/upgrade-migration.mjs",
+    "test:faultget": "node test/fault-get.mjs",
+    "test:floor": "node test/version-floor.mjs",
+    "test:faultsubmit": "node test/fault-submit.mjs",
+    "test:race": "node test/race-attempts.mjs",
+    "test:runner": "node test/runner-live.mjs",
+    "sync:plugin": "node scripts/sync-plugin-version.mjs",
+    "test:track": "node test/get-track.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "24.10.1",
+    "typescript": "5.9.3"
+  }
+}