@coderook/cli 0.29.2 → 0.29.4

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.29.2",
+  "version": "0.29.4",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/cli.js

@@ -194,6 +194,23 @@ async function reconcile(folder, options = {}) {
     const project = link
         ? (await (0, api_js_2.projects)()).find((candidate) => candidate.id === link.repositoryId)
         : await (0, api_js_2.findProject)(reference);
+    /*
+      A link that has outlived the project it points at.
+  
+      The list above is everything this account can reach — owned, shared with
+      them, and through their organisation — so a linked project missing from it
+      is gone or no longer theirs. Left alone, the next call that used the
+      remembered id failed with "Repository not found", which names neither the
+      folder nor anything to do about it; the soak suite hit exactly this and it
+      took a debugger to work out which folder was complaining.
+    */
+    if (link && !project) {
+        throw new Error(`This folder is linked to a project that is no longer on your account.\n` +
+            `  ${folder}\n` +
+            `It may have been deleted, or your access to it withdrawn.\n` +
+            `Detach the folder with ${accent("cbx unlink")} — the files here are ` +
+            `untouched, and submitting afterwards starts a new project from them.`);
+    }
     if (!project?.versionCount) {
         // Nothing saved on the account, so everything here is outstanding.
         return { link: link ?? null, baseline: null, behind: null };
@@ -303,6 +320,19 @@ async function commandProjects() {
     }
     return 0;
 }
+async function commandUnlink(parsed) {
+    const folder = folderFor(parsed);
+    const link = await (0, config_js_1.readLink)(folder);
+    if (!(await (0, config_js_1.forgetLink)(folder))) {
+        console.log("This folder was not linked to a project.");
+        return 0;
+    }
+    console.log(`Detached ${bold(node_path_1.default.basename(folder))}` +
+        (link?.slug ? dim(` from ${link.slug}`) : "") +
+        ".");
+    console.log(dim("Nothing was deleted. Submitting from here now starts a new project."));
+    return 0;
+}
 async function commandStatus(parsed) {
     const folder = folderFor(parsed);
     let link;
@@ -615,7 +645,21 @@ Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
       file should be sent and the fix is to take the key out of it.
     */
     const pasted = await (0, worktree_js_1.detectPastedCredentials)(folder, files.map((file) => file.path));
-    const stillPasted = pasted.filter((finding) => !exposed.includes(finding.path));
+    const stillPasted = pasted.found.filter((finding) => !exposed.includes(finding.path));
+    /*
+      Said whether anything was found or not.
+  
+      The scan stops at twenty thousand files, and it used to stop in silence —
+      so a project of forty-seven thousand had twenty-seven thousand of them
+      never opened behind a clean run, and the terminal said nothing at all. A
+      check that quietly covers half of what it appears to cover is worse than
+      one that admits its limit, because the first is believed.
+    */
+    if (!pasted.reach.complete) {
+        console.log(dim(`Checked the first ${pasted.reach.scanned.toLocaleString()} of ` +
+            `${pasted.reach.of.toLocaleString()} files for pasted keys; the ` +
+            `rest were not opened.`));
+    }
     if (stillPasted.length) {
         console.log(red(`
 ${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s have credentials"} inside:`));
@@ -1678,6 +1722,20 @@ const SPECS = [
         ],
         run: commandSubmit,
     },
+    {
+        name: "unlink",
+        group: "Working with a folder",
+        summary: "detach this folder from its project",
+        usage: "unlink [folder]",
+        detail: "Forgets which project this folder belongs to. Nothing is deleted:\n" +
+            "the files here are untouched and the project stays on your account.\n\n" +
+            "Mostly useful when a folder points at a project that is gone — one\n" +
+            "that was deleted, or shared with you and since withdrawn — because\n" +
+            "until the folder forgets it, every command asks about a project that\n" +
+            "is no longer there.",
+        examples: ["cbx unlink", "cbx unlink ./old-copy"],
+        run: commandUnlink,
+    },
     {
         name: "import",
         group: "Getting started",

package/dist/cli/src/config.js

@@ -11,6 +11,7 @@ exports.loadToken = loadToken;
 exports.clearToken = clearToken;
 exports.keyFor = keyFor;
 exports.readLink = readLink;
+exports.forgetLink = forgetLink;
 exports.writeLink = writeLink;
 /**
  * Where the command-line tool keeps its credential and its project links.
@@ -151,6 +152,24 @@ async function readLink(localPath) {
         baseVersionId: link.baseVersionId ?? link.versionId,
     };
 }
+/**
+ * Forget which project a folder belongs to.
+ *
+ * Both keys, because a folder linked by an older build is recorded under the
+ * old one and leaving that behind would mean the folder was still linked
+ * afterwards — which is the one thing this is for.
+ */
+async function forgetLink(localPath) {
+    const links = await readLinks();
+    const had = links[keyFor(localPath)] !== undefined ||
+        links[legacyKeyFor(localPath)] !== undefined;
+    if (!had)
+        return false;
+    delete links[keyFor(localPath)];
+    delete links[legacyKeyFor(localPath)];
+    await writePrivate(linksFile(), JSON.stringify(links, null, 2));
+    return true;
+}
 async function writeLink(localPath, link) {
     const links = await readLinks();
     // A folder recorded under the old key moves to the new one rather than

package/dist/desktop-app/src/main/detect.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.suggestExclusions = suggestExclusions;
+exports.suggestBulkDirectories = suggestBulkDirectories;
 exports.rulesFromSuggestions = rulesFromSuggestions;
 /**
  * Looking at a folder and saying what probably should not be uploaded.
@@ -39,6 +40,14 @@ const RULES = [
     { directory: ".next", reason: "Next.js build output", recommended: true },
     { directory: ".gradle", reason: "Gradle build state", recommended: true },
     { directory: ".terraform", reason: "Downloaded Terraform providers", recommended: true },
+    /*
+      Offered rather than recommended, and deliberately not in the starter
+      template: a Go project that vendors its dependencies often commits them on
+      purpose, so leaving them out by default would drop files the project is
+      meant to carry. Worth asking about, because it is usually most of the
+      files — 6,000 of 6,440 in the shape that found this.
+    */
+    { directory: "vendor", reason: "Vendored dependencies — often committed on purpose", recommended: false },
     /*
       Game engines, which is where the size actually is.
   
@@ -160,15 +169,96 @@ function suggestExclusions(files) {
             break;
         }
     }
-    return [...totals.entries()]
-        .map(([pattern, held]) => ({
+    const named = [...totals.entries()].map(([pattern, held]) => ({
         pattern,
         reason: held.rule.reason,
         bytes: held.bytes,
         files: held.files,
         recommended: held.rule.recommended,
-    }))
-        .sort((left, right) => right.bytes - left.bytes);
+    }));
+    /*
+      Merged in here rather than offered through a second channel, so everything
+      that shows a suggestion keeps working unchanged. A folder already named by
+      a rule above is dropped: it has a better reason than "no source in it".
+    */
+    const already = new Set(named.map((one) => one.pattern));
+    const bulk = suggestBulkDirectories(files).filter((one) => !already.has(one.pattern));
+    return [...named, ...bulk].sort((left, right) => right.bytes - left.bytes);
+}
+/*
+  Extensions that mean somebody wrote this by hand. Deliberately short: the
+  question below is only "is there any source in here at all", and a longer
+  list would answer yes for a folder holding one stray script.
+*/
+const SOURCE_EXTENSIONS = new Set([
+    ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".rb", ".go", ".rs",
+    ".java", ".kt", ".swift", ".c", ".h", ".cc", ".cpp", ".hpp", ".cs", ".php",
+    ".lua", ".sh", ".ps1", ".sql", ".css", ".scss", ".html", ".vue", ".svelte",
+    ".md", ".toml", ".yaml", ".yml", ".gradle", ".cmake",
+]);
+/** How many files a folder must hold before it is worth asking about. */
+const BULK_FILES = 2_000;
+/**
+ * And how much of the upload it must be.
+ *
+ * Set high on purpose. At half, a game's 4,000-file `assets/` folder in a
+ * 6,500-file project was flagged as "no source in it" — which is true and
+ * beside the point, because the art is the work. The folders this is for are
+ * not borderline: `work/` here is 98% of the upload and a Unity `Library/`
+ * is 96%.
+ */
+const BULK_SHARE = 0.7;
+/** Above this share of hand-written files it is source, not output. */
+const BULK_SOURCE_SHARE = 0.1;
+/**
+ * One enormous folder that no list of names could have known about.
+ *
+ * Every rule above recognises a folder by its name, which works for the dozen
+ * things every project has and not at all for the one a person invented. This
+ * repository's own `work/` is 63,210 of the 64,554 files it would otherwise
+ * send — scratch output from a test harness, named nothing in particular, and
+ * invisible to every rule in this file.
+ *
+ * So this asks about shape instead of name: one folder that is most of the
+ * upload and holds no source in it. Never recommended, because the same shape
+ * is also what a genuine dataset looks like, and a project whose work really
+ * is fifty thousand data files should be asked once and then believed.
+ */
+function suggestBulkDirectories(files) {
+    if (files.length < BULK_FILES)
+        return [];
+    const tally = new Map();
+    for (const entry of files) {
+        const normalised = entry.path.split("\\").join("/");
+        const top = normalised.includes("/") ? normalised.slice(0, normalised.indexOf("/")) : "";
+        /* A file at the root belongs to no folder, so it cannot be one of these. */
+        if (!top)
+            continue;
+        const held = tally.get(top) ?? { bytes: 0, files: 0, source: 0 };
+        held.bytes += entry.size;
+        held.files += 1;
+        if (SOURCE_EXTENSIONS.has(node_path_1.default.extname(normalised).toLowerCase()))
+            held.source += 1;
+        tally.set(top, held);
+    }
+    const found = [];
+    for (const [top, held] of tally) {
+        if (held.files < BULK_FILES)
+            continue;
+        if (held.files / files.length < BULK_SHARE)
+            continue;
+        if (held.source / held.files >= BULK_SOURCE_SHARE)
+            continue;
+        found.push({
+            pattern: `${top}/`,
+            reason: `${held.files.toLocaleString()} of ${files.length.toLocaleString()} files, ` +
+                `and no source in it — generated?`,
+            bytes: held.bytes,
+            files: held.files,
+            recommended: false,
+        });
+    }
+    return found.sort((left, right) => right.bytes - left.bytes);
 }
 /**
  * The suggestions a person accepted, as lines for the rules file.

package/dist/desktop-app/src/main/download.js

@@ -585,43 +585,75 @@ class Downloader {
                 sayProgress(file.path);
             };
             /*
-              Wide for the small, narrow for the large.
+              Bounded by bytes in flight, not by how many files are open.
       
               Six lanes turned an hour-long restore of many small files into a
-              minute, and made a restore of a few very large ones eight times
-              slower: each large file is already fetched in pieces, so six at once
-              is six times the outstanding requests against the same line, and they
-              all finish later than they would have one after another.
+              minute, and made a restore of three very large ones eight times
+              slower — 93 seconds became 802. Splitting the queue by file size
+              fixed that shape and cost another: a project of forty-megabyte video
+              files had its six big ones running two at a time while the small ones
+              finished and left the line idle, and its fetch went from 54 seconds
+              to 151.
       
-              Split by what the job is: a pack or a small file is one request and
-              belongs in the wide lane; a large file is a stream of its own and
-              belongs in the narrow one. Both run at once, so a project holding
-              both kinds keeps the line busy without either starving the other.
-              The sending side splits its work the same way — see the note beside
-              BATCH_LANES in upload.ts.
+              Neither is really about file count. A file is fetched a piece at a
+              time, so each job holds exactly one request open whatever its size —
+              what six large files at once actually costs is six streams' worth of
+              bytes being buffered, hashed and written against one line. So that is
+              what is bounded: lanes take work while the bytes already in flight
+              leave room for it. Forty-megabyte files then run five or six at a
+              time and hundred-megabyte ones run two, without a threshold having to
+              guess which project this is.
             */
-            const HEAVY_BYTES = 8 * 1024 * 1024;
-            const light = jobs.filter((job) => job.kind === "pack" || job.file.sourceSize < HEAVY_BYTES);
-            const heavy = jobs.filter((job) => job.kind === "file" && job.file.sourceSize >= HEAVY_BYTES);
-            const drain = async (queue, lanes) => {
-                let next = 0;
-                const lane = async () => {
-                    for (;;) {
-                        const at = next;
-                        next += 1;
-                        if (at >= queue.length)
-                            return;
-                        this.check();
-                        const job = queue[at];
+            const LANES = 6;
+            const BYTES_IN_FLIGHT = 200 * 1024 * 1024;
+            const sizeOf = (job) => job.kind === "pack" ? 0 : job.file.sourceSize;
+            let next = 0;
+            let flying = 0;
+            /*
+              Every waiting lane, not the most recent one. A single slot would let a
+              second waiter overwrite the first, and the first would then never be
+              woken — a restore that stops with lanes idle and work left.
+            */
+            const waiting = [];
+            const wakeAll = () => {
+                while (waiting.length)
+                    waiting.pop()();
+            };
+            const roomFor = async (size) => {
+                /*
+                  One job always proceeds, however large. A file bigger than the whole
+                  budget would otherwise wait for room that can never appear.
+                */
+                while (flying > 0 && flying + size > BYTES_IN_FLIGHT) {
+                    await new Promise((resolve) => {
+                        waiting.push(resolve);
+                    });
+                }
+            };
+            const lane = async () => {
+                for (;;) {
+                    const at = next;
+                    next += 1;
+                    if (at >= jobs.length)
+                        return;
+                    this.check();
+                    const job = jobs[at];
+                    const size = sizeOf(job);
+                    await roomFor(size);
+                    flying += size;
+                    try {
                         if (job.kind === "pack")
                             await restorePack(job.id);
                         else
                             await restoreFile(job.file);
                     }
-                };
-                await Promise.all(Array.from({ length: Math.min(lanes, queue.length) }, () => lane()));
+                    finally {
+                        flying -= size;
+                        wakeAll();
+                    }
+                }
             };
-            await Promise.all([drain(light, 6), drain(heavy, 2)]);
+            await Promise.all(Array.from({ length: Math.min(LANES, jobs.length) }, () => lane()));
             /*
               Everything has arrived and verified, so it can go into place. Each
               file is renamed over its destination individually: a rename within

package/dist/desktop-app/src/main/upload.js

@@ -132,6 +132,8 @@ class Uploader {
       while somebody reads the plan is hashed again rather than published under
       the digest it used to have.
     */
+    /** Whether this save has already said that packing was refused. */
+    packRefusalSaid = false;
     plannedDigests = new Map();
     planningCreatedRepositoryId = null;
     /** Attached to every object write after the server admits the exact plan. */
@@ -272,6 +274,7 @@ class Uploader {
      */
     async plan(request, report) {
         this.planning = true;
+        this.packRefusalSaid = false;
         this.activeQuoteId = null;
         this.plannedQuote = null;
         this.planningCreatedRepositoryId = null;
@@ -968,12 +971,23 @@ class Uploader {
                                     batched.set(digest, one);
                             }
                         }
-                        catch {
+                        catch (reason) {
                             /*
                               A refusal here is never fatal: everything in the pack is simply
                               left for the ordinary path below, which sends it one at a time.
                               An older deployment without this route lands here every time.
+                  
+                              Said once per save, not once per pack. It used to be swallowed
+                              outright, and when the service began refusing packs for a reason
+                              that also broke the fallback, the only thing anybody saw was the
+                              fallback's complaint about an arbitrary file — which described
+                              neither what went wrong nor where. One line naming the first
+                              refusal is what makes the next one an hour shorter to find.
                             */
+                            if (!this.packRefusalSaid) {
+                                this.packRefusalSaid = true;
+                                console.warn(`Packing was refused; sending these files individually. ${String(reason).slice(0, 300)}`);
+                            }
                         }
                         /*
                           Only what actually landed. Counting the whole pack meant a batch the

package/dist/desktop-app/src/main/worktree.js

@@ -3,7 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOCAL_EXCLUDE_FILE = exports.IGNORE_FILE = exports.STARTER_IGNORE = exports.EVALUATION_FILE_LIMIT = void 0;
+exports.LOCAL_EXCLUDE_FILE = exports.IGNORE_FILE = exports.STARTER_IGNORE = exports.STARTER_MARKER = exports.EVALUATION_FILE_LIMIT = void 0;
+exports.starterAuthored = starterAuthored;
+exports.missingStarterRules = missingStarterRules;
 exports.isRepository = isRepository;
 exports.migrateRetiredRules = migrateRetiredRules;
 exports.readRules = readRules;
@@ -54,7 +56,10 @@ async function git(root, ...args) {
  * file would produce an incomplete project that looked backed up, so likely
  * secrets are warned about instead (docs/UPLOAD_POLICY.md).
  */
-exports.STARTER_IGNORE = `# Dependencies and generated output
+exports.STARTER_MARKER = "# CodeRook starter rules — edit freely below";
+exports.STARTER_IGNORE = `${exports.STARTER_MARKER}
+
+# Dependencies and generated output
 node_modules/
 dist/
 build/
@@ -96,7 +101,6 @@ models/**
 *.pth
 
 # Caches and local state
-.venv/
 .pytest_cache/
 .mypy_cache/
 .ruff_cache/
@@ -120,6 +124,63 @@ Preferences
 # Archives of the project, inside the project
 *.cbx
 `;
+/**
+ * Lines only this application writes, used to recognise its own handiwork.
+ *
+ * `*.cbx` is the strongest of them: a CodeRook bundle inside the project is a
+ * CodeRook idea and nothing else puts that line in a .gitignore. The browser
+ * profile names are the next best, because they are an unusual thing for a
+ * person to think of and they arrive together.
+ */
+const STARTER_FINGERPRINT = [
+    "IndexedDB/",
+    "Local Storage/",
+    "GPUCache/",
+    "Code Cache/",
+    "blob_storage/",
+    "Local State",
+    "Preferences",
+];
+/** Every rule in a block of text, without comments or blank lines. */
+function ruleLines(text) {
+    return text
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0 && !line.startsWith("#"));
+}
+/**
+ * Whether this .gitignore was written by CodeRook rather than by a person.
+ *
+ * It matters because the starter template grows: engine caches were added to
+ * it long after the first folders were set up, and those folders can never
+ * benefit — a project with any .gitignore uses that file and nothing else. A
+ * Unity project set up before the Unity rules existed therefore went on
+ * sending its whole import cache for good, 45,342 files of it, with the
+ * improved template sitting unused in this same file.
+ *
+ * Newly written starters carry STARTER_MARKER, so this is exact for anything
+ * written from now on. The fingerprint is for the ones already on disk.
+ */
+function starterAuthored(text) {
+    if (text.includes(exports.STARTER_MARKER))
+        return true;
+    const lines = new Set(ruleLines(text));
+    if (!lines.has("*.cbx"))
+        return false;
+    const seen = STARTER_FINGERPRINT.filter((one) => lines.has(one)).length;
+    return seen >= 3;
+}
+/**
+ * The starter rules this file is missing, in template order.
+ *
+ * Only ever offered, never applied on its own: a person may have deleted a
+ * line on purpose, and re-adding it silently would be this application
+ * overruling them in their own file.
+ */
+function missingStarterRules(text) {
+    const present = new Set(ruleLines(text));
+    return ruleLines(exports.STARTER_IGNORE).filter((line) => !present.has(line));
+}
 /** The shared rules file, committed with the project. */
 exports.IGNORE_FILE = ".gitignore";
 /** Personal exclusions, which must never reach a collaborator. */
@@ -1103,7 +1164,17 @@ onScanned) {
         }
     };
     await Promise.all(Array.from({ length: Math.min(LANES, wanted.length) }, () => lane()));
-    return found;
+    /*
+      `stop` is also set by the findings ceiling, which is a different statement
+      from running out of budget — forty findings is plenty to act on, and the
+      files after it are very likely more of the same. Only a bound on the
+      reading makes the scan incomplete in a way worth saying out loud.
+    */
+    const spent = read >= MOST_SCANNED_FILES || bytes >= MOST_SCANNED_BYTES;
+    return {
+        found,
+        reach: { scanned: read, of: wanted.length, complete: !spent },
+    };
 }
 async function uploadConcerns(root, include, 
 /** Passed through so the one slow part of this can say it is working. */
@@ -1124,7 +1195,8 @@ onScanned) {
           is two warnings for one problem, and the first one is the actionable
           one.
         */
-        pasted: pasted.filter((finding) => !secrets.includes(finding.path)),
+        pasted: pasted.found.filter((finding) => !secrets.includes(finding.path)),
+        reach: pasted.reach,
     };
 }
 /** Files the flow must ask about before the first upload. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.29.2",
+  "version": "0.29.4",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",