@coderook/cli 0.29.3 → 0.29.4

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.29.3",
+  "version": "0.29.4",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/cli.js

@@ -645,7 +645,21 @@ Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
       file should be sent and the fix is to take the key out of it.
     */
     const pasted = await (0, worktree_js_1.detectPastedCredentials)(folder, files.map((file) => file.path));
-    const stillPasted = pasted.filter((finding) => !exposed.includes(finding.path));
+    const stillPasted = pasted.found.filter((finding) => !exposed.includes(finding.path));
+    /*
+      Said whether anything was found or not.
+  
+      The scan stops at twenty thousand files, and it used to stop in silence —
+      so a project of forty-seven thousand had twenty-seven thousand of them
+      never opened behind a clean run, and the terminal said nothing at all. A
+      check that quietly covers half of what it appears to cover is worse than
+      one that admits its limit, because the first is believed.
+    */
+    if (!pasted.reach.complete) {
+        console.log(dim(`Checked the first ${pasted.reach.scanned.toLocaleString()} of ` +
+            `${pasted.reach.of.toLocaleString()} files for pasted keys; the ` +
+            `rest were not opened.`));
+    }
     if (stillPasted.length) {
         console.log(red(`
 ${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s have credentials"} inside:`));

package/dist/desktop-app/src/main/detect.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.suggestExclusions = suggestExclusions;
+exports.suggestBulkDirectories = suggestBulkDirectories;
 exports.rulesFromSuggestions = rulesFromSuggestions;
 /**
  * Looking at a folder and saying what probably should not be uploaded.
@@ -39,6 +40,14 @@ const RULES = [
     { directory: ".next", reason: "Next.js build output", recommended: true },
     { directory: ".gradle", reason: "Gradle build state", recommended: true },
     { directory: ".terraform", reason: "Downloaded Terraform providers", recommended: true },
+    /*
+      Offered rather than recommended, and deliberately not in the starter
+      template: a Go project that vendors its dependencies often commits them on
+      purpose, so leaving them out by default would drop files the project is
+      meant to carry. Worth asking about, because it is usually most of the
+      files — 6,000 of 6,440 in the shape that found this.
+    */
+    { directory: "vendor", reason: "Vendored dependencies — often committed on purpose", recommended: false },
     /*
       Game engines, which is where the size actually is.
   
@@ -160,15 +169,96 @@ function suggestExclusions(files) {
             break;
         }
     }
-    return [...totals.entries()]
-        .map(([pattern, held]) => ({
+    const named = [...totals.entries()].map(([pattern, held]) => ({
         pattern,
         reason: held.rule.reason,
         bytes: held.bytes,
         files: held.files,
         recommended: held.rule.recommended,
-    }))
-        .sort((left, right) => right.bytes - left.bytes);
+    }));
+    /*
+      Merged in here rather than offered through a second channel, so everything
+      that shows a suggestion keeps working unchanged. A folder already named by
+      a rule above is dropped: it has a better reason than "no source in it".
+    */
+    const already = new Set(named.map((one) => one.pattern));
+    const bulk = suggestBulkDirectories(files).filter((one) => !already.has(one.pattern));
+    return [...named, ...bulk].sort((left, right) => right.bytes - left.bytes);
+}
+/*
+  Extensions that mean somebody wrote this by hand. Deliberately short: the
+  question below is only "is there any source in here at all", and a longer
+  list would answer yes for a folder holding one stray script.
+*/
+const SOURCE_EXTENSIONS = new Set([
+    ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".rb", ".go", ".rs",
+    ".java", ".kt", ".swift", ".c", ".h", ".cc", ".cpp", ".hpp", ".cs", ".php",
+    ".lua", ".sh", ".ps1", ".sql", ".css", ".scss", ".html", ".vue", ".svelte",
+    ".md", ".toml", ".yaml", ".yml", ".gradle", ".cmake",
+]);
+/** How many files a folder must hold before it is worth asking about. */
+const BULK_FILES = 2_000;
+/**
+ * And how much of the upload it must be.
+ *
+ * Set high on purpose. At half, a game's 4,000-file `assets/` folder in a
+ * 6,500-file project was flagged as "no source in it" — which is true and
+ * beside the point, because the art is the work. The folders this is for are
+ * not borderline: `work/` here is 98% of the upload and a Unity `Library/`
+ * is 96%.
+ */
+const BULK_SHARE = 0.7;
+/** Above this share of hand-written files it is source, not output. */
+const BULK_SOURCE_SHARE = 0.1;
+/**
+ * One enormous folder that no list of names could have known about.
+ *
+ * Every rule above recognises a folder by its name, which works for the dozen
+ * things every project has and not at all for the one a person invented. This
+ * repository's own `work/` is 63,210 of the 64,554 files it would otherwise
+ * send — scratch output from a test harness, named nothing in particular, and
+ * invisible to every rule in this file.
+ *
+ * So this asks about shape instead of name: one folder that is most of the
+ * upload and holds no source in it. Never recommended, because the same shape
+ * is also what a genuine dataset looks like, and a project whose work really
+ * is fifty thousand data files should be asked once and then believed.
+ */
+function suggestBulkDirectories(files) {
+    if (files.length < BULK_FILES)
+        return [];
+    const tally = new Map();
+    for (const entry of files) {
+        const normalised = entry.path.split("\\").join("/");
+        const top = normalised.includes("/") ? normalised.slice(0, normalised.indexOf("/")) : "";
+        /* A file at the root belongs to no folder, so it cannot be one of these. */
+        if (!top)
+            continue;
+        const held = tally.get(top) ?? { bytes: 0, files: 0, source: 0 };
+        held.bytes += entry.size;
+        held.files += 1;
+        if (SOURCE_EXTENSIONS.has(node_path_1.default.extname(normalised).toLowerCase()))
+            held.source += 1;
+        tally.set(top, held);
+    }
+    const found = [];
+    for (const [top, held] of tally) {
+        if (held.files < BULK_FILES)
+            continue;
+        if (held.files / files.length < BULK_SHARE)
+            continue;
+        if (held.source / held.files >= BULK_SOURCE_SHARE)
+            continue;
+        found.push({
+            pattern: `${top}/`,
+            reason: `${held.files.toLocaleString()} of ${files.length.toLocaleString()} files, ` +
+                `and no source in it — generated?`,
+            bytes: held.bytes,
+            files: held.files,
+            recommended: false,
+        });
+    }
+    return found.sort((left, right) => right.bytes - left.bytes);
 }
 /**
  * The suggestions a person accepted, as lines for the rules file.

package/dist/desktop-app/src/main/worktree.js

@@ -3,7 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOCAL_EXCLUDE_FILE = exports.IGNORE_FILE = exports.STARTER_IGNORE = exports.EVALUATION_FILE_LIMIT = void 0;
+exports.LOCAL_EXCLUDE_FILE = exports.IGNORE_FILE = exports.STARTER_IGNORE = exports.STARTER_MARKER = exports.EVALUATION_FILE_LIMIT = void 0;
+exports.starterAuthored = starterAuthored;
+exports.missingStarterRules = missingStarterRules;
 exports.isRepository = isRepository;
 exports.migrateRetiredRules = migrateRetiredRules;
 exports.readRules = readRules;
@@ -54,7 +56,10 @@ async function git(root, ...args) {
  * file would produce an incomplete project that looked backed up, so likely
  * secrets are warned about instead (docs/UPLOAD_POLICY.md).
  */
-exports.STARTER_IGNORE = `# Dependencies and generated output
+exports.STARTER_MARKER = "# CodeRook starter rules — edit freely below";
+exports.STARTER_IGNORE = `${exports.STARTER_MARKER}
+
+# Dependencies and generated output
 node_modules/
 dist/
 build/
@@ -96,7 +101,6 @@ models/**
 *.pth
 
 # Caches and local state
-.venv/
 .pytest_cache/
 .mypy_cache/
 .ruff_cache/
@@ -120,6 +124,63 @@ Preferences
 # Archives of the project, inside the project
 *.cbx
 `;
+/**
+ * Lines only this application writes, used to recognise its own handiwork.
+ *
+ * `*.cbx` is the strongest of them: a CodeRook bundle inside the project is a
+ * CodeRook idea and nothing else puts that line in a .gitignore. The browser
+ * profile names are the next best, because they are an unusual thing for a
+ * person to think of and they arrive together.
+ */
+const STARTER_FINGERPRINT = [
+    "IndexedDB/",
+    "Local Storage/",
+    "GPUCache/",
+    "Code Cache/",
+    "blob_storage/",
+    "Local State",
+    "Preferences",
+];
+/** Every rule in a block of text, without comments or blank lines. */
+function ruleLines(text) {
+    return text
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0 && !line.startsWith("#"));
+}
+/**
+ * Whether this .gitignore was written by CodeRook rather than by a person.
+ *
+ * It matters because the starter template grows: engine caches were added to
+ * it long after the first folders were set up, and those folders can never
+ * benefit — a project with any .gitignore uses that file and nothing else. A
+ * Unity project set up before the Unity rules existed therefore went on
+ * sending its whole import cache for good, 45,342 files of it, with the
+ * improved template sitting unused in this same file.
+ *
+ * Newly written starters carry STARTER_MARKER, so this is exact for anything
+ * written from now on. The fingerprint is for the ones already on disk.
+ */
+function starterAuthored(text) {
+    if (text.includes(exports.STARTER_MARKER))
+        return true;
+    const lines = new Set(ruleLines(text));
+    if (!lines.has("*.cbx"))
+        return false;
+    const seen = STARTER_FINGERPRINT.filter((one) => lines.has(one)).length;
+    return seen >= 3;
+}
+/**
+ * The starter rules this file is missing, in template order.
+ *
+ * Only ever offered, never applied on its own: a person may have deleted a
+ * line on purpose, and re-adding it silently would be this application
+ * overruling them in their own file.
+ */
+function missingStarterRules(text) {
+    const present = new Set(ruleLines(text));
+    return ruleLines(exports.STARTER_IGNORE).filter((line) => !present.has(line));
+}
 /** The shared rules file, committed with the project. */
 exports.IGNORE_FILE = ".gitignore";
 /** Personal exclusions, which must never reach a collaborator. */
@@ -1103,7 +1164,17 @@ onScanned) {
         }
     };
     await Promise.all(Array.from({ length: Math.min(LANES, wanted.length) }, () => lane()));
-    return found;
+    /*
+      `stop` is also set by the findings ceiling, which is a different statement
+      from running out of budget — forty findings is plenty to act on, and the
+      files after it are very likely more of the same. Only a bound on the
+      reading makes the scan incomplete in a way worth saying out loud.
+    */
+    const spent = read >= MOST_SCANNED_FILES || bytes >= MOST_SCANNED_BYTES;
+    return {
+        found,
+        reach: { scanned: read, of: wanted.length, complete: !spent },
+    };
 }
 async function uploadConcerns(root, include, 
 /** Passed through so the one slow part of this can say it is working. */
@@ -1124,7 +1195,8 @@ onScanned) {
           is two warnings for one problem, and the first one is the actionable
           one.
         */
-        pasted: pasted.filter((finding) => !secrets.includes(finding.path)),
+        pasted: pasted.found.filter((finding) => !secrets.includes(finding.path)),
+        reach: pasted.reach,
     };
 }
 /** Files the flow must ask about before the first upload. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.29.3",
+  "version": "0.29.4",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",