@coderook/cli 0.29.3 → 0.29.5

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.29.3",
+  "version": "0.29.5",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/api.js

@@ -18,6 +18,8 @@ exports.cancelMerge = cancelMerge;
 exports.aiAccess = aiAccess;
 exports.setAiAccess = setAiAccess;
 exports.updateProject = updateProject;
+exports.compareVersions = compareVersions;
+exports.fileTextAt = fileTextAt;
 exports.versions = versions;
 exports.markRelease = markRelease;
 exports.issues = issues;
@@ -313,7 +315,50 @@ async function updateProject(repositoryId, change) {
         body: change,
     });
 }
-/** Every saved version of a project, newest first. */
+/**
+ * What changed between two saved versions.
+ *
+ * The service answers this from the stored trees, so an untouched folder deep
+ * in the project costs nothing: identical subtree ids short-circuit before
+ * either side is listed. That is why this asks the service rather than
+ * fetching both file lists and comparing them here — on a project of twenty
+ * thousand files the difference is one request against two very large ones.
+ */
+async function compareVersions(repositoryId, from, to) {
+    const body = await call(`/v1/repositories/${repositoryId}/compare` +
+        `?from=${encodeURIComponent(from)}&to=${encodeURIComponent(to)}`);
+    return body.changes ?? [];
+}
+/**
+ * One file's contents at one version, as text.
+ *
+ * Returns null for anything that is not text — a diff of a PNG is noise, and
+ * deciding that here keeps every caller from having to guess. The byte cap is
+ * the same reasoning: past it a file is data, and a line-by-line comparison of
+ * data is neither readable nor quick.
+ */
+async function fileTextAt(repositoryId, versionId, filePath, mostBytes = 2 * 1024 * 1024) {
+    const token = await (0, config_js_1.loadToken)();
+    if (!token)
+        throw new Error("Not signed in. Run: cbx sign-in");
+    const route = `${(0, config_js_1.apiOrigin)()}/v1/repositories/${repositoryId}` +
+        `/versions/${versionId}/file?path=${encodeURIComponent(filePath)}`;
+    const response = await fetch(route, {
+        headers: {
+            authorization: `Bearer ${token}`,
+            "user-agent": "CodeRook-CLI/0.1",
+            ...(0, identify_js_1.clientHeaders)(),
+            range: `bytes=0-${mostBytes - 1}`,
+        },
+    });
+    if (!response.ok)
+        return null;
+    const bytes = new Uint8Array(await response.arrayBuffer());
+    /* A NUL byte is the cheapest reliable sign that this is not text. */
+    if (bytes.includes(0))
+        return null;
+    return new TextDecoder("utf-8", { fatal: false }).decode(bytes);
+}
 async function versions(repositoryId) {
     const body = await call(`/v1/repositories/${encodeURIComponent(repositoryId)}/versions`);
     return (body.versions ?? []).map((row) => ({

package/dist/cli/src/cli.js

@@ -40,6 +40,7 @@ const download_js_1 = require("../../desktop-app/src/main/download.js");
 const faults_js_1 = require("../../desktop-app/src/main/faults.js");
 const version_commands_js_1 = require("./version_commands.js");
 const identify_js_1 = require("../../desktop-app/src/main/identify.js");
+const diff_command_js_1 = require("./diff_command.js");
 const profile_js_1 = require("../../desktop-app/src/main/profile.js");
 const detect_js_1 = require("../../desktop-app/src/main/detect.js");
 const cbx_js_1 = require("../../desktop-app/src/main/cbx.js");
@@ -645,7 +646,21 @@ Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
       file should be sent and the fix is to take the key out of it.
     */
     const pasted = await (0, worktree_js_1.detectPastedCredentials)(folder, files.map((file) => file.path));
-    const stillPasted = pasted.filter((finding) => !exposed.includes(finding.path));
+    const stillPasted = pasted.found.filter((finding) => !exposed.includes(finding.path));
+    /*
+      Said whether anything was found or not.
+  
+      The scan stops at twenty thousand files, and it used to stop in silence —
+      so a project of forty-seven thousand had twenty-seven thousand of them
+      never opened behind a clean run, and the terminal said nothing at all. A
+      check that quietly covers half of what it appears to cover is worse than
+      one that admits its limit, because the first is believed.
+    */
+    if (!pasted.reach.complete) {
+        console.log(dim(`Checked the first ${pasted.reach.scanned.toLocaleString()} of ` +
+            `${pasted.reach.of.toLocaleString()} files for pasted keys; the ` +
+            `rest were not opened.`));
+    }
     if (stillPasted.length) {
         console.log(red(`
 ${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s have credentials"} inside:`));
@@ -1708,6 +1723,30 @@ const SPECS = [
         ],
         run: commandSubmit,
     },
+    {
+        name: "diff",
+        aliases: ["changes"],
+        group: "Working with a folder",
+        summary: "what changed, line by line",
+        usage: "diff [from] [to]",
+        detail: "With nothing after it, compares this folder against the version it is\n" +
+            "on. With one version, compares this folder against that one. With two,\n" +
+            "compares two saved versions — which the service answers from its own\n" +
+            "stored trees, so an untouched corner of a large project costs nothing.\n\n" +
+            "A version can be given as a number, as v12, or by the name it was\n" +
+            "released under.",
+        options: [
+            { flags: "--name-only", description: "list the files and not their lines" },
+            { flags: "--path <text>", description: "only paths containing this" },
+            {
+                flags: "--context <n>",
+                description: "lines of context around a change (default 3)",
+            },
+            { flags: "--project <name>", description: "which project" },
+        ],
+        examples: ["cbx diff", "cbx diff 12", "cbx diff 11 12 --name-only"],
+        run: diff_command_js_1.commandDiff,
+    },
     {
         name: "unlink",
         group: "Working with a folder",

package/dist/cli/src/diff_command.js

@@ -0,0 +1,218 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.commandDiff = commandDiff;
+/**
+ * What changed, from the terminal.
+ *
+ * This was the one central thing the command line could not do. The service
+ * has been able to compare two versions since the beginning — GET /compare
+ * answers it from the stored trees — and nothing called the route. Meanwhile
+ * the desktop application's diff shells out to `git diff`, so on a project
+ * that is not a git repository the feature is silently absent, which is an odd
+ * thing for a version host to depend on.
+ *
+ * So this reads the service's own answer and renders it. Two questions, which
+ * people mean at different times:
+ *
+ *   cbx diff            what have I changed since the version I am on
+ *   cbx diff 12         the same, against version 12
+ *   cbx diff 11 12      what changed between two saved versions
+ */
+const promises_1 = require("node:fs/promises");
+const node_path_1 = __importDefault(require("node:path"));
+const node_process_1 = __importDefault(require("node:process"));
+const api_js_1 = require("./api.js");
+const config_js_1 = require("./config.js");
+const project_commands_js_1 = require("./project_commands.js");
+const merge_diff_js_1 = require("../../desktop-app/src/shared/merge_diff.js");
+const worktree_js_1 = require("../../desktop-app/src/main/worktree.js");
+/*
+  Built rather than typed, so the escape character never sits literally in the
+  source. The other command files spell theirs out; this reads the same on a
+  terminal and survives being copied through a tool that eats control bytes.
+*/
+const ESC = String.fromCharCode(27);
+const paint = (code) => (value) => `${ESC}[${code}m${value}${ESC}[0m`;
+const dim = paint("2");
+const bold = paint("1");
+const red = paint("31");
+const green = paint("32");
+const accent = paint("33");
+/*
+  The line comparison builds a table of one side's lines against the other's,
+  which is exact and quadratic. On a conflicted file — what it was written for
+  — that is a few hundred kilobytes. On this repository's own eighteen-thousand
+  line runtime it would be gigabytes, so past this a file is reported as
+  changed without its lines. Saying so beats both wedging the terminal and
+  printing a heuristic diff that quietly invents a change.
+*/
+const MOST_LINES_COMPARED = 4_000;
+/** How a change reads at a glance. */
+const MARK = {
+    added: green("+"),
+    removed: red("-"),
+    changed: accent("~"),
+};
+/** Print one file's lines, folded to the interesting parts. */
+function printHunks(before, after, context) {
+    const left = (0, merge_diff_js_1.linesOf)(before);
+    const right = (0, merge_diff_js_1.linesOf)(after);
+    if (left.length > MOST_LINES_COMPARED || right.length > MOST_LINES_COMPARED) {
+        console.log(dim(`    ${Math.max(left.length, right.length).toLocaleString()} lines — ` +
+            `too large to compare line by line`));
+        return;
+    }
+    for (const chunk of (0, merge_diff_js_1.foldUnchanged)((0, merge_diff_js_1.diffLines)(before, after), context)) {
+        if (chunk.kind === "gap") {
+            console.log(dim(`    ... ${chunk.skipped} unchanged`));
+            continue;
+        }
+        for (const line of chunk.lines) {
+            const at = String(line.candidateLine ?? line.targetLine ?? "").padStart(5);
+            if (line.side === "same")
+                console.log(dim(`${at}   ${line.text}`));
+            else if (line.side === "candidate")
+                console.log(`${dim(at)} ${green("+")} ${green(line.text)}`);
+            else
+                console.log(`${dim(at)} ${red("-")} ${red(line.text)}`);
+        }
+    }
+}
+/** Resolve `12`, `v12` or a version's name against the newest-first list. */
+function versionBy(list, reference) {
+    const bare = reference.replace(/^v/i, "");
+    if (/^[0-9]+$/.test(bare)) {
+        const found = list.find((one) => one.sequence === Number(bare));
+        return found ? { id: found.id, sequence: found.sequence } : null;
+    }
+    const named = list.find((one) => (one.name ?? "").toLowerCase() === reference.toLowerCase());
+    return named ? { id: named.id, sequence: named.sequence } : null;
+}
+/** Whether these bytes are something a line comparison can speak about. */
+function isText(value) {
+    return !value.includes(String.fromCharCode(0));
+}
+async function commandDiff(parsed) {
+    const nameOnly = parsed.flags.has("name-only");
+    const context = Number(parsed.flags.get("context") ?? 3) || 3;
+    const only = parsed.flags.get("path");
+    const named = parsed.flags.get("project");
+    const project = await (0, project_commands_js_1.resolveProject)(typeof named === "string" ? named : undefined);
+    if (!project)
+        return 1;
+    const list = await (0, api_js_1.versions)(project.id);
+    if (!list.length) {
+        console.log("Nothing saved yet, so there is nothing to compare.");
+        return 0;
+    }
+    const [first, second] = parsed.positional;
+    /*
+      Two saved versions, compared by the service. That is the whole point of
+      asking it rather than fetching both file lists: it walks the stored trees
+      and skips any subtree whose id has not moved, so an untouched corner of a
+      twenty-thousand-file project costs nothing.
+    */
+    if (first && second) {
+        const from = versionBy(list, first);
+        const to = versionBy(list, second);
+        if (!from || !to) {
+            console.error(red(`No such version: ${from ? second : first}`));
+            return 1;
+        }
+        const changes = (await (0, api_js_1.compareVersions)(project.id, from.id, to.id))
+            .filter((change) => !only || change.path.includes(String(only)))
+            .sort((left, right) => left.path.localeCompare(right.path));
+        console.log(`${bold(project.slug)} ${dim(`v${from.sequence} -> v${to.sequence}`)}`);
+        if (!changes.length) {
+            console.log("Nothing differs between them.");
+            return 0;
+        }
+        for (const change of changes) {
+            console.log(`${MARK[change.kind]} ${change.path}`);
+            if (nameOnly || change.kind !== "changed")
+                continue;
+            const [before, after] = await Promise.all([
+                (0, api_js_1.fileTextAt)(project.id, from.id, change.path),
+                (0, api_js_1.fileTextAt)(project.id, to.id, change.path),
+            ]);
+            if (before === null || after === null) {
+                console.log(dim("    not text"));
+                continue;
+            }
+            printHunks(before, after, context);
+        }
+        const many = changes.length === 1 ? "" : "s";
+        console.log(dim(`\n${changes.length} file${many} differ${many ? "" : "s"}`));
+        return 0;
+    }
+    /*
+      This folder against a saved version — the question somebody has open in
+      front of them, and the reason `cbx status` was never enough on its own: it
+      says which files changed and never what changed inside them.
+    */
+    const link = await (0, config_js_1.readLink)(node_process_1.default.cwd());
+    if (!link) {
+        console.error(red("This folder is not linked to a project, so there is no local side."));
+        return 1;
+    }
+    const against = first
+        ? versionBy(list, first)
+        : { id: link.baseVersionId ?? list[0].id, sequence: link.sequence };
+    if (!against) {
+        console.error(red(`No such version: ${first}`));
+        return 1;
+    }
+    const folder = node_process_1.default.cwd();
+    const rules = await (0, worktree_js_1.readRules)(folder);
+    /*
+      Which files differ is decided here, from digests, before anything is
+      fetched.
+  
+      The first version of this compared contents, which meant downloading every
+      file in the project to find out which ones had moved — on this repository
+      that is eleven hundred requests to report a handful of edits. `changedFiles`
+      already answers the question locally and keeps a digest cache while it does
+      it, so the service is asked only for the files that actually differ.
+    */
+    const saved = link.manifest ?? {};
+    const changed = (await (0, worktree_js_1.changedFiles)(folder, rules, new Map(Object.entries(saved)), "synchronize"))
+        .filter((one) => !only || one.path.includes(String(only)))
+        .sort((left, right) => left.path.localeCompare(right.path));
+    console.log(`${bold(node_path_1.default.basename(folder))} ${dim(`this folder -> v${against.sequence}`)}`);
+    let differing = 0;
+    for (const one of changed) {
+        const wasSaved = Object.prototype.hasOwnProperty.call(saved, one.path);
+        const kind = one.deleted
+            ? "removed"
+            : wasSaved
+                ? "changed"
+                : "added";
+        differing += 1;
+        console.log(`${MARK[kind]} ${one.path}`);
+        if (nameOnly || kind !== "changed")
+            continue;
+        if (one.binary) {
+            console.log(dim("    not text"));
+            continue;
+        }
+        const [before, after] = await Promise.all([
+            (0, api_js_1.fileTextAt)(project.id, against.id, one.path),
+            (0, promises_1.readFile)(node_path_1.default.join(folder, one.path), "utf8").catch(() => null),
+        ]);
+        if (before === null || after === null || !isText(after)) {
+            console.log(dim("    not text"));
+            continue;
+        }
+        printHunks(before, after, context);
+    }
+    if (!differing) {
+        console.log("This folder matches the saved version.");
+        return 0;
+    }
+    const many = differing === 1 ? "" : "s";
+    console.log(dim(`\n${differing} file${many} differ${many ? "" : "s"}`));
+    return 0;
+}

package/dist/desktop-app/src/main/detect.js

@@ -3,7 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.STARTER_TOPUP_HEADING = exports.SUGGESTED_HEADING = void 0;
 exports.suggestExclusions = suggestExclusions;
+exports.suggestBulkDirectories = suggestBulkDirectories;
 exports.rulesFromSuggestions = rulesFromSuggestions;
 /**
  * Looking at a folder and saying what probably should not be uploaded.
@@ -39,6 +41,14 @@ const RULES = [
     { directory: ".next", reason: "Next.js build output", recommended: true },
     { directory: ".gradle", reason: "Gradle build state", recommended: true },
     { directory: ".terraform", reason: "Downloaded Terraform providers", recommended: true },
+    /*
+      Offered rather than recommended, and deliberately not in the starter
+      template: a Go project that vendors its dependencies often commits them on
+      purpose, so leaving them out by default would drop files the project is
+      meant to carry. Worth asking about, because it is usually most of the
+      files — 6,000 of 6,440 in the shape that found this.
+    */
+    { directory: "vendor", reason: "Vendored dependencies — often committed on purpose", recommended: false },
     /*
       Game engines, which is where the size actually is.
   
@@ -160,15 +170,96 @@ function suggestExclusions(files) {
             break;
         }
     }
-    return [...totals.entries()]
-        .map(([pattern, held]) => ({
+    const named = [...totals.entries()].map(([pattern, held]) => ({
         pattern,
         reason: held.rule.reason,
         bytes: held.bytes,
         files: held.files,
         recommended: held.rule.recommended,
-    }))
-        .sort((left, right) => right.bytes - left.bytes);
+    }));
+    /*
+      Merged in here rather than offered through a second channel, so everything
+      that shows a suggestion keeps working unchanged. A folder already named by
+      a rule above is dropped: it has a better reason than "no source in it".
+    */
+    const already = new Set(named.map((one) => one.pattern));
+    const bulk = suggestBulkDirectories(files).filter((one) => !already.has(one.pattern));
+    return [...named, ...bulk].sort((left, right) => right.bytes - left.bytes);
+}
+/*
+  Extensions that mean somebody wrote this by hand. Deliberately short: the
+  question below is only "is there any source in here at all", and a longer
+  list would answer yes for a folder holding one stray script.
+*/
+const SOURCE_EXTENSIONS = new Set([
+    ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".rb", ".go", ".rs",
+    ".java", ".kt", ".swift", ".c", ".h", ".cc", ".cpp", ".hpp", ".cs", ".php",
+    ".lua", ".sh", ".ps1", ".sql", ".css", ".scss", ".html", ".vue", ".svelte",
+    ".md", ".toml", ".yaml", ".yml", ".gradle", ".cmake",
+]);
+/** How many files a folder must hold before it is worth asking about. */
+const BULK_FILES = 2_000;
+/**
+ * And how much of the upload it must be.
+ *
+ * Set high on purpose. At half, a game's 4,000-file `assets/` folder in a
+ * 6,500-file project was flagged as "no source in it" — which is true and
+ * beside the point, because the art is the work. The folders this is for are
+ * not borderline: `work/` here is 98% of the upload and a Unity `Library/`
+ * is 96%.
+ */
+const BULK_SHARE = 0.7;
+/** Above this share of hand-written files it is source, not output. */
+const BULK_SOURCE_SHARE = 0.1;
+/**
+ * One enormous folder that no list of names could have known about.
+ *
+ * Every rule above recognises a folder by its name, which works for the dozen
+ * things every project has and not at all for the one a person invented. This
+ * repository's own `work/` is 63,210 of the 64,554 files it would otherwise
+ * send — scratch output from a test harness, named nothing in particular, and
+ * invisible to every rule in this file.
+ *
+ * So this asks about shape instead of name: one folder that is most of the
+ * upload and holds no source in it. Never recommended, because the same shape
+ * is also what a genuine dataset looks like, and a project whose work really
+ * is fifty thousand data files should be asked once and then believed.
+ */
+function suggestBulkDirectories(files) {
+    if (files.length < BULK_FILES)
+        return [];
+    const tally = new Map();
+    for (const entry of files) {
+        const normalised = entry.path.split("\\").join("/");
+        const top = normalised.includes("/") ? normalised.slice(0, normalised.indexOf("/")) : "";
+        /* A file at the root belongs to no folder, so it cannot be one of these. */
+        if (!top)
+            continue;
+        const held = tally.get(top) ?? { bytes: 0, files: 0, source: 0 };
+        held.bytes += entry.size;
+        held.files += 1;
+        if (SOURCE_EXTENSIONS.has(node_path_1.default.extname(normalised).toLowerCase()))
+            held.source += 1;
+        tally.set(top, held);
+    }
+    const found = [];
+    for (const [top, held] of tally) {
+        if (held.files < BULK_FILES)
+            continue;
+        if (held.files / files.length < BULK_SHARE)
+            continue;
+        if (held.source / held.files >= BULK_SOURCE_SHARE)
+            continue;
+        found.push({
+            pattern: `${top}/`,
+            reason: `${held.files.toLocaleString()} of ${files.length.toLocaleString()} files, ` +
+                `and no source in it — generated?`,
+            bytes: held.bytes,
+            files: held.files,
+            recommended: false,
+        });
+    }
+    return found.sort((left, right) => right.bytes - left.bytes);
 }
 /**
  * The suggestions a person accepted, as lines for the rules file.
@@ -177,12 +268,19 @@ function suggestExclusions(files) {
  * looking: the detector proposes, this records a decision, and the two are
  * only connected by somebody choosing.
  */
+/**
+ * The one heading under which accepted suggestions are recorded.
+ *
+ * Exported because three places wrote three different sentences for the same
+ * idea, and a .gitignore could end up carrying all of them. The tick screen
+ * keeps its own CHOSEN_HEADING: that block is a different statement, and it is
+ * rewritten wholesale where this one is added to.
+ */
+exports.SUGGESTED_HEADING = "# Suggested for this folder, and accepted.";
+/** And the one under which the starter rules are brought up to date. */
+exports.STARTER_TOPUP_HEADING = "# Added when the starter rules were brought up to date.";
 function rulesFromSuggestions(accepted) {
     if (!accepted.length)
         return "";
-    return [
-        "# Suggested when this folder was added, and accepted.",
-        ...accepted.map((one) => one.pattern),
-        "",
-    ].join("\n");
+    return [exports.SUGGESTED_HEADING, ...accepted.map((one) => one.pattern), ""].join("\n");
 }

package/dist/desktop-app/src/main/worktree.js

@@ -3,7 +3,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOCAL_EXCLUDE_FILE = exports.IGNORE_FILE = exports.STARTER_IGNORE = exports.EVALUATION_FILE_LIMIT = void 0;
+exports.LOCAL_EXCLUDE_FILE = exports.IGNORE_FILE = exports.STARTER_IGNORE = exports.STARTER_MARKER = exports.EVALUATION_FILE_LIMIT = void 0;
+exports.starterAuthored = starterAuthored;
+exports.missingStarterRules = missingStarterRules;
 exports.isRepository = isRepository;
 exports.migrateRetiredRules = migrateRetiredRules;
 exports.readRules = readRules;
@@ -54,7 +56,10 @@ async function git(root, ...args) {
  * file would produce an incomplete project that looked backed up, so likely
  * secrets are warned about instead (docs/UPLOAD_POLICY.md).
  */
-exports.STARTER_IGNORE = `# Dependencies and generated output
+exports.STARTER_MARKER = "# CodeRook starter rules — edit freely below";
+exports.STARTER_IGNORE = `${exports.STARTER_MARKER}
+
+# Dependencies and generated output
 node_modules/
 dist/
 build/
@@ -96,7 +101,6 @@ models/**
 *.pth
 
 # Caches and local state
-.venv/
 .pytest_cache/
 .mypy_cache/
 .ruff_cache/
@@ -120,6 +124,63 @@ Preferences
 # Archives of the project, inside the project
 *.cbx
 `;
+/**
+ * Lines only this application writes, used to recognise its own handiwork.
+ *
+ * `*.cbx` is the strongest of them: a CodeRook bundle inside the project is a
+ * CodeRook idea and nothing else puts that line in a .gitignore. The browser
+ * profile names are the next best, because they are an unusual thing for a
+ * person to think of and they arrive together.
+ */
+const STARTER_FINGERPRINT = [
+    "IndexedDB/",
+    "Local Storage/",
+    "GPUCache/",
+    "Code Cache/",
+    "blob_storage/",
+    "Local State",
+    "Preferences",
+];
+/** Every rule in a block of text, without comments or blank lines. */
+function ruleLines(text) {
+    return text
+        .split(/\r?\n/)
+        .map((line) => line.trim())
+        .filter((line) => line.length > 0 && !line.startsWith("#"));
+}
+/**
+ * Whether this .gitignore was written by CodeRook rather than by a person.
+ *
+ * It matters because the starter template grows: engine caches were added to
+ * it long after the first folders were set up, and those folders can never
+ * benefit — a project with any .gitignore uses that file and nothing else. A
+ * Unity project set up before the Unity rules existed therefore went on
+ * sending its whole import cache for good, 45,342 files of it, with the
+ * improved template sitting unused in this same file.
+ *
+ * Newly written starters carry STARTER_MARKER, so this is exact for anything
+ * written from now on. The fingerprint is for the ones already on disk.
+ */
+function starterAuthored(text) {
+    if (text.includes(exports.STARTER_MARKER))
+        return true;
+    const lines = new Set(ruleLines(text));
+    if (!lines.has("*.cbx"))
+        return false;
+    const seen = STARTER_FINGERPRINT.filter((one) => lines.has(one)).length;
+    return seen >= 3;
+}
+/**
+ * The starter rules this file is missing, in template order.
+ *
+ * Only ever offered, never applied on its own: a person may have deleted a
+ * line on purpose, and re-adding it silently would be this application
+ * overruling them in their own file.
+ */
+function missingStarterRules(text) {
+    const present = new Set(ruleLines(text));
+    return ruleLines(exports.STARTER_IGNORE).filter((line) => !present.has(line));
+}
 /** The shared rules file, committed with the project. */
 exports.IGNORE_FILE = ".gitignore";
 /** Personal exclusions, which must never reach a collaborator. */
@@ -1103,7 +1164,17 @@ onScanned) {
         }
     };
     await Promise.all(Array.from({ length: Math.min(LANES, wanted.length) }, () => lane()));
-    return found;
+    /*
+      `stop` is also set by the findings ceiling, which is a different statement
+      from running out of budget — forty findings is plenty to act on, and the
+      files after it are very likely more of the same. Only a bound on the
+      reading makes the scan incomplete in a way worth saying out loud.
+    */
+    const spent = read >= MOST_SCANNED_FILES || bytes >= MOST_SCANNED_BYTES;
+    return {
+        found,
+        reach: { scanned: read, of: wanted.length, complete: !spent },
+    };
 }
 async function uploadConcerns(root, include, 
 /** Passed through so the one slow part of this can say it is working. */
@@ -1124,7 +1195,8 @@ onScanned) {
           is two warnings for one problem, and the first one is the actionable
           one.
         */
-        pasted: pasted.filter((finding) => !secrets.includes(finding.path)),
+        pasted: pasted.found.filter((finding) => !secrets.includes(finding.path)),
+        reach: pasted.reach,
     };
 }
 /** Files the flow must ask about before the first upload. */

package/dist/desktop-app/src/shared/merge_diff.js

@@ -0,0 +1,191 @@
+"use strict";
+/**
+ * Showing what two people actually did to the same file.
+ *
+ * The merge screen used to offer four buttons — keep yours, keep theirs, keep
+ * both, remove it — above nothing at all. You were asked which side wins for
+ * a file you could not look at, which is not a decision so much as a guess,
+ * and the safe guess ("keep both") leaves the project holding two copies of
+ * everything anybody ever disagreed about.
+ *
+ * So the two sides are laid out line by line. Nothing here is a merge
+ * algorithm: the service already tried that and put the file on a Track
+ * precisely because the automatic answer was wrong. This is for reading.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.linesOf = linesOf;
+exports.diffLines = diffLines;
+exports.foldUnchanged = foldUnchanged;
+exports.conflictDraft = conflictDraft;
+exports.hasConflictMarkers = hasConflictMarkers;
+/**
+ * The lines two texts share, longest run first.
+ *
+ * A plain longest-common-subsequence table. Both sides of a conflicted file
+ * are one file's worth of lines, so the quadratic table is a few hundred
+ * kilobytes at worst — and the alternative, a heuristic diff, sometimes
+ * reports a change where there is none, which on this screen would mean
+ * showing somebody a disagreement that does not exist.
+ */
+function commonRuns(left, right) {
+    const table = Array.from({ length: left.length + 1 }, () => new Array(right.length + 1).fill(0));
+    for (let a = left.length - 1; a >= 0; a -= 1) {
+        for (let b = right.length - 1; b >= 0; b -= 1) {
+            table[a][b] =
+                left[a] === right[b]
+                    ? table[a + 1][b + 1] + 1
+                    : Math.max(table[a + 1][b], table[a][b + 1]);
+        }
+    }
+    return table;
+}
+/** Split into lines without inventing a trailing empty one. */
+function linesOf(text) {
+    if (text === "")
+        return [];
+    const lines = text.replace(/\r\n/g, "\n").split("\n");
+    if (lines.length > 1 && lines[lines.length - 1] === "")
+        lines.pop();
+    return lines;
+}
+/**
+ * How the saved file and the uploaded file differ, in order.
+ *
+ * `target` is what the project already held and `candidate` is what was
+ * uploaded, named the way the service names them rather than "old" and "new"
+ * — neither side is older, which is the whole reason there is a decision to
+ * make.
+ */
+function diffLines(target, candidate) {
+    const left = linesOf(target);
+    const right = linesOf(candidate);
+    const table = commonRuns(left, right);
+    const out = [];
+    let a = 0;
+    let b = 0;
+    while (a < left.length && b < right.length) {
+        if (left[a] === right[b]) {
+            out.push({
+                side: "same",
+                targetLine: a + 1,
+                candidateLine: b + 1,
+                text: left[a],
+            });
+            a += 1;
+            b += 1;
+        }
+        else if (table[a + 1][b] >= table[a][b + 1]) {
+            out.push({ side: "target", targetLine: a + 1, candidateLine: null, text: left[a] });
+            a += 1;
+        }
+        else {
+            out.push({
+                side: "candidate",
+                targetLine: null,
+                candidateLine: b + 1,
+                text: right[b],
+            });
+            b += 1;
+        }
+    }
+    while (a < left.length) {
+        out.push({ side: "target", targetLine: a + 1, candidateLine: null, text: left[a] });
+        a += 1;
+    }
+    while (b < right.length) {
+        out.push({
+            side: "candidate",
+            targetLine: null,
+            candidateLine: b + 1,
+            text: right[b],
+        });
+        b += 1;
+    }
+    return out;
+}
+function foldUnchanged(lines, context = 3) {
+    const interesting = new Set();
+    lines.forEach((line, index) => {
+        if (line.side === "same")
+            return;
+        for (let at = Math.max(0, index - context); at <= Math.min(lines.length - 1, index + context); at += 1) {
+            interesting.add(at);
+        }
+    });
+    /*
+      A file with no differences at all is still worth showing — a conflict can
+      be about two people creating the same path with identical content, or
+      about a file one side deleted, and folding the whole thing away would
+      leave the screen empty with no explanation.
+    */
+    if (!interesting.size)
+        return [{ kind: "lines", lines }];
+    const chunks = [];
+    let run = [];
+    let skipped = 0;
+    for (let index = 0; index < lines.length; index += 1) {
+        if (interesting.has(index)) {
+            if (skipped) {
+                chunks.push({ kind: "gap", skipped });
+                skipped = 0;
+            }
+            run.push(lines[index]);
+        }
+        else {
+            if (run.length) {
+                chunks.push({ kind: "lines", lines: run });
+                run = [];
+            }
+            skipped += 1;
+        }
+    }
+    if (run.length)
+        chunks.push({ kind: "lines", lines: run });
+    if (skipped)
+        chunks.push({ kind: "gap", skipped });
+    return chunks;
+}
+/**
+ * A starting point for somebody who wants to edit rather than choose.
+ *
+ * Both sides, marked the way every merge tool has marked them since RCS, so
+ * the text is immediately familiar and every editor already highlights it.
+ * Agreed lines appear once; the rest are stacked with the markers between
+ * them, and it is the person's job to delete the markers along with whatever
+ * they decided against.
+ */
+function conflictDraft(target, candidate, labels = {
+    target: "saved on the project",
+    candidate: "your upload",
+}) {
+    const out = [];
+    let held = { target: [], candidate: [] };
+    const flush = () => {
+        if (!held.target.length && !held.candidate.length)
+            return;
+        out.push(`<<<<<<< ${labels.target}`);
+        out.push(...held.target);
+        out.push("=======");
+        out.push(...held.candidate);
+        out.push(`>>>>>>> ${labels.candidate}`);
+        held = { target: [], candidate: [] };
+    };
+    for (const line of diffLines(target, candidate)) {
+        if (line.side === "same") {
+            flush();
+            out.push(line.text);
+        }
+        else if (line.side === "target") {
+            held.target.push(line.text);
+        }
+        else {
+            held.candidate.push(line.text);
+        }
+    }
+    flush();
+    return out.join("\n");
+}
+/** Whether any conflict marker is still in the text somebody is about to send. */
+function hasConflictMarkers(text) {
+    return /^(?:<{7}|={7}|>{7})(?:\s|$)/m.test(text);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.29.3",
+  "version": "0.29.5",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",