@coderook/cli 0.3.0 → 0.4.0

package/dist/cli/src/cli.js

@@ -148,7 +148,13 @@ async function reconcile(folder, options = {}) {
         }
         return {
             link: known,
-            baseline: new Map(Object.entries(known.manifest)),
+            /*
+              The comparison is against what this folder actually holds, not what
+              the version holds. After a merge the two differ, and comparing
+              against the version would read a stale copy as a fresh edit and
+              push it back over the change that replaced it.
+            */
+            baseline: new Map(Object.entries(known.local ?? known.manifest)),
             behind,
         };
     }
@@ -161,6 +167,8 @@ async function reconcile(folder, options = {}) {
         slug: project.slug,
         sequence: latest.sequence,
         versionId: latest.id,
+        // Adopted whole, so the folder is taken to hold what the version holds.
+        local: Object.fromEntries(baseline),
         manifest: Object.fromEntries(baseline),
     };
     await (0, config_js_1.writeLink)(folder, fresh);
@@ -229,8 +237,26 @@ async function commandStatus(parsed) {
     console.log(link
         ? `Account holds ${accent(`v${link.sequence}`)} · ${Object.keys(link.manifest).length} files ${dim(`(${link.slug})`)}`
         : dim("Not on your account yet — submitting will create it."));
+    /*
+      A folder can have nothing to send and still not hold the whole version:
+      when the service merges somebody else's save into yours, their files
+      join the version without ever arriving here. Saying so is the difference
+      between "you are level" and "you are level with your own work".
+    */
+    const stale = link?.local
+        ? Object.entries(link.manifest).filter(([path, digest]) => link.local[path] !== digest)
+        : [];
+    if (stale.length) {
+        console.log(dim(`${stale.length} file${stale.length === 1 ? "" : "s"} in the saved version ` +
+            `${stale.length === 1 ? "is" : "are"} newer than the cop${stale.length === 1 ? "y" : "ies"} here ` +
+            `— run ${accent("coderook get")} to bring ${stale.length === 1 ? "it" : "them"} down.`));
+        for (const [path] of stale.slice(0, 10))
+            console.log(dim(`  behind  ${path}`));
+    }
     if (!files.length) {
-        console.log("Nothing to submit; this folder matches the saved version.");
+        console.log(stale.length
+            ? "Nothing to submit; your own work is all saved."
+            : "Nothing to submit; this folder matches the saved version.");
         return 0;
     }
     console.log(`\n${files.length} file${files.length === 1 ? "" : "s"} to submit:`);
@@ -248,7 +274,17 @@ async function commandSubmit(parsed) {
     const rules = await (0, worktree_js_1.readRules)(folder);
     const files = await (0, worktree_js_1.changedFiles)(folder, rules, baseline);
     if (!files.length) {
-        console.log("Nothing to submit; this folder matches the saved version.");
+        // Having nothing to send is not the same as holding the whole version:
+        // a merge can leave this folder with an older copy of somebody else's
+        // file. Saying so is what stops "nothing to do" from reading as "level".
+        const behindOn = link?.local
+            ? Object.entries(link.manifest).filter(([path, digest]) => link.local[path] !== digest).length
+            : 0;
+        console.log(behindOn
+            ? `Nothing to submit; your own work is all saved. ${behindOn} file` +
+                `${behindOn === 1 ? "" : "s"} here ${behindOn === 1 ? "is" : "are"} ` +
+                `behind the saved version — run ${accent("coderook get")}.`
+            : "Nothing to submit; this folder matches the saved version.");
         return 0;
     }
     /*
@@ -298,6 +334,12 @@ async function commandSubmit(parsed) {
               nothing rather than guessing, and publishes as it always did.
             */
             ...(link?.versionId ? { expectedHeadVersionId: link.versionId } : {}),
+            /*
+              What this folder believed the project held. It is how the service
+              tells a file this person deleted from one they never had, and
+              without it somebody else's work disappears at the next save.
+            */
+            ...(link ? { known: link.local ?? link.manifest ?? {} } : {}),
         }, (progress) => {
             line(`  ${String(progress.percent).padStart(3)}%  ${progress.stage.padEnd(7)} ` +
                 `${progress.files}/${progress.totalFiles}  ${progress.path.slice(-48)}`);
@@ -306,6 +348,21 @@ async function commandSubmit(parsed) {
     catch (error) {
         done(line);
         const code = error.code;
+        const text = error instanceof Error ? error.message : String(error);
+        /*
+          A connection that fails part way through says nothing about whether
+          the work was done. It may well have been — the service records the
+          attempt, so running the same command again is answered with the
+          version it already made rather than a second one. Saying so is the
+          difference between a person retrying and a person wondering.
+        */
+        if (!code && /fetch failed|ECONNRESET|socket hang up|network|ETIMEDOUT/i.test(text)) {
+            console.error(red(`
+The connection failed: ${text}`));
+            console.error(`Your work may already have been saved. Run the same command again —` +
+                ` it will not create a second version.`);
+            return 1;
+        }
         if (code === "merge_required" || code === "track_moved") {
             /*
               Somebody else saved to this project first. Everything that did not
@@ -344,8 +401,14 @@ async function commandSubmit(parsed) {
         sequence: result.sequence,
         // What this folder is now working from, so the next submit can say so.
         versionId: result.versionId,
+        local: result.local,
         manifest: result.manifest,
     });
+    if (result.repeated) {
+        console.log(`Already saved as ${accent(`v${result.sequence}`)} by an earlier attempt;` +
+            ` nothing was sent again.`);
+        return 0;
+    }
     console.log(`Saved ${accent(`v${result.sequence}`)} · sent ${bytes(result.sentBytes)} in ` +
         `${result.sentFiles} file${result.sentFiles === 1 ? "" : "s"}` +
         (result.reusedFiles ? `, ${result.reusedFiles} already stored` : "") +
@@ -359,7 +422,8 @@ async function commandGet(parsed) {
         console.error(red("This folder is not linked to a project on your account."));
         return 1;
     }
-    return fetchInto(link.repositoryId, folder, link.slug);
+    // Only what this folder received may be removed by catching up.
+    return fetchInto(link.repositoryId, folder, link.slug, link.local ?? null);
 }
 async function commandClone(parsed) {
     const reference = parsed.positional[0];
@@ -379,7 +443,14 @@ async function commandClone(parsed) {
     const destination = node_path_1.default.resolve(parsed.positional[1] ?? project.slug);
     return fetchInto(project.id, destination, project.slug);
 }
-async function fetchInto(repositoryId, destination, slug) {
+async function fetchInto(repositoryId, destination, slug, 
+/*
+  What this folder received before, so a file the project has since dropped
+  is removed. Absent — a clone, or a folder whose record was lost — nothing
+  is removed, because "missing from the version" cannot then be told from
+  "never came from the version at all".
+*/
+held) {
     const downloader = new download_js_1.Downloader(config_js_1.credentials);
     const latest = (await downloader.versions(repositoryId))[0];
     if (!latest) {
@@ -390,7 +461,10 @@ async function fetchInto(repositoryId, destination, slug) {
     const result = await downloader.run(repositoryId, latest.id, destination, (progress) => {
         line(`  ${String(progress.percent).padStart(3)}%  ${progress.files}/${progress.totalFiles}` +
             `  ${progress.path.slice(-48)}`);
-    });
+    }, 
+    // What this folder received last time, so a file the project has since
+    // dropped is removed while everything untracked is left alone.
+    held);
     done(line);
     // Fetching is how a folder catches up, so this is what moves its base.
     await (0, config_js_1.writeLink)(destination, {
@@ -398,6 +472,9 @@ async function fetchInto(repositoryId, destination, slug) {
         slug,
         sequence: latest.sequence,
         versionId: latest.id,
+        // Fetching writes every file, so the folder now holds what the
+        // version holds and the two agree again.
+        local: result.manifest,
         manifest: result.manifest,
     });
     console.log(`${accent(`v${latest.sequence}`)} · ${result.files} files · ${bytes(result.bytes)} into ${destination}`);

package/dist/cli/src/config.js

@@ -9,6 +9,7 @@ exports.configDirectory = configDirectory;
 exports.storeToken = storeToken;
 exports.loadToken = loadToken;
 exports.clearToken = clearToken;
+exports.keyFor = keyFor;
 exports.readLink = readLink;
 exports.writeLink = writeLink;
 /**
@@ -19,6 +20,7 @@ exports.writeLink = writeLink;
  * location follows each platform's convention rather than scattering dot
  * directories about.
  */
+const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
 const node_os_1 = require("node:os");
 const node_path_1 = __importDefault(require("node:path"));
@@ -75,9 +77,33 @@ exports.credentials = {
     origin: apiOrigin,
     token: loadToken,
 };
+/**
+ * One name for one folder, whatever route was taken to reach it.
+ *
+ * A folder can be addressed as `C:\project`, through a junction, through a
+ * symlink, or through a mapped drive, and every one of those is a different
+ * string. Keying on the string gives the same folder four independent
+ * connections, four independent records of what it holds, and four chances
+ * for one to overwrite another's work. Resolving to the real path first is
+ * what makes them one workspace.
+ *
+ * A path that does not exist yet — a clone destination — cannot be resolved,
+ * so it falls back to the plain form. It becomes resolvable the moment the
+ * folder is created, which is before anything is ever recorded against it.
+ */
 function keyFor(localPath) {
-    return node_path_1.default.resolve(localPath).toLowerCase();
+    const absolute = node_path_1.default.resolve(localPath);
+    try {
+        // Windows returns an extended-length path here; the prefix is an
+        // addressing detail, not part of the identity, so it comes back off.
+        return node_fs_1.realpathSync.native(absolute).replace(/^\\\\\?\\/, "").toLowerCase();
+    }
+    catch {
+        return absolute.toLowerCase();
+    }
 }
+/** How the key used to be worked out, so existing links keep working. */
+const legacyKeyFor = (localPath) => node_path_1.default.resolve(localPath).toLowerCase();
 async function readLinks() {
     try {
         return JSON.parse(await (0, promises_1.readFile)(linksFile(), "utf8"));
@@ -87,10 +113,14 @@ async function readLinks() {
     }
 }
 async function readLink(localPath) {
-    return (await readLinks())[keyFor(localPath)] ?? null;
+    const links = await readLinks();
+    return links[keyFor(localPath)] ?? links[legacyKeyFor(localPath)] ?? null;
 }
 async function writeLink(localPath, link) {
     const links = await readLinks();
+    // A folder recorded under the old key moves to the new one rather than
+    // being left behind as a second connection to the same place.
+    delete links[legacyKeyFor(localPath)];
     links[keyFor(localPath)] = link;
     await writePrivate(linksFile(), JSON.stringify(links, null, 2));
 }

package/dist/desktop-app/src/main/download.js

@@ -15,6 +15,27 @@ exports.Downloader = exports.DownloadCancelled = void 0;
 const node_crypto_1 = require("node:crypto");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
+/**
+ * Remove the directories a deletion just emptied, up to but never including
+ * the project folder itself. Left alone they accumulate as empty husks of
+ * directories the project no longer has; removed too eagerly they would take
+ * a directory holding ignored files with them, so this stops at the first
+ * one that still has something in it.
+ */
+async function pruneEmpty(root, removed) {
+    let directory = node_path_1.default.dirname(removed);
+    while (directory.startsWith(root) && directory !== root) {
+        try {
+            if ((await (0, promises_1.readdir)(directory)).length)
+                return;
+            await (0, promises_1.rm)(directory, { recursive: false, force: true });
+        }
+        catch {
+            return;
+        }
+        directory = node_path_1.default.dirname(directory);
+    }
+}
 class DownloadCancelled extends Error {
     constructor() {
         super("Download cancelled");
@@ -81,11 +102,20 @@ class Downloader {
         }));
     }
     /**
-     * Write a version into `destination`. Files land in a staging directory
-     * and are moved into place only once every one has arrived and verified,
-     * so a failed download never leaves a half-project behind.
+     * Write a version into `destination`.
+     *
+     * Files land in a staging directory and are put in place only once every
+     * one has arrived and verified, so a failed download never leaves a
+     * half-project behind.
+     *
+     * What is put in place is the version's files, one at a time — not the
+     * whole directory. Replacing the directory wholesale also removes
+     * everything the version deliberately does not contain: the dependencies,
+     * the local credentials, the unfinished work and the git repository
+     * itself. A file the version no longer holds is removed only when this
+     * folder is known to have received it, which `held` supplies.
      */
-    async run(repositoryId, versionId, destination, report) {
+    async run(repositoryId, versionId, destination, report, held) {
         const files = await this.files(repositoryId, versionId);
         if (!files.length)
             throw new Error("That version has no files");
@@ -125,9 +155,36 @@ class Downloader {
                 written += 1;
                 bytes += body.length;
             }
-            await (0, promises_1.mkdir)(node_path_1.default.dirname(destination), { recursive: true });
-            await (0, promises_1.rm)(destination, { recursive: true, force: true });
-            await (0, promises_1.rename)(staging, destination);
+            /*
+              Everything has arrived and verified, so it can go into place. Each
+              file is renamed over its destination individually: a rename within
+              one volume is atomic, so no file is ever seen half-written, and
+              anything the version does not mention is left exactly as it is.
+            */
+            await (0, promises_1.mkdir)(destination, { recursive: true });
+            for (const file of files) {
+                const parts = file.path.split("/").filter(Boolean);
+                const target = node_path_1.default.join(destination, ...parts);
+                await (0, promises_1.mkdir)(node_path_1.default.dirname(target), { recursive: true });
+                await (0, promises_1.rm)(target, { recursive: true, force: true });
+                await (0, promises_1.rename)(node_path_1.default.join(staging, ...parts), target);
+            }
+            /*
+              A file this folder received but the version no longer holds is gone
+              deliberately, so it goes. One it never received is not this fetch's
+              to remove — and without a record of what it received, nothing is
+              removed at all, which is the safe reading of an unknown folder.
+            */
+            for (const path_ of Object.keys(held ?? {})) {
+                if (manifest[path_] !== undefined)
+                    continue;
+                const parts = path_.split("/").filter(Boolean);
+                if (parts.some((part) => part === ".." || part.includes("\0")))
+                    continue;
+                await (0, promises_1.rm)(node_path_1.default.join(destination, ...parts), { force: true });
+                await pruneEmpty(destination, node_path_1.default.join(destination, ...parts));
+            }
+            await (0, promises_1.rm)(staging, { recursive: true, force: true });
             report({
                 files: written,
                 totalFiles: files.length,

package/dist/desktop-app/src/main/publish_name.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.publishAttemptName = publishAttemptName;
+/**
+ * A name for one publishing attempt, derived from what is being published.
+ *
+ * It has to be the same across retries of the same attempt and different for
+ * a genuinely new one — and it cannot be kept on disk, because the crash it
+ * exists to survive is exactly the kind that loses whatever was written just
+ * before it. Deriving it from the content solves both: the same files
+ * against the same head produce the same name, and anything else does not.
+ *
+ * Kept apart from the uploader because it depends on nothing, which is what
+ * lets it be tested without a network, a filesystem or an account.
+ */
+const node_crypto_1 = require("node:crypto");
+function publishAttemptName(input) {
+    const shape = [
+        input.repositoryId ?? "new",
+        input.expectedHeadVersionId ?? "none",
+        input.message,
+        // Sorted, so the order the scanner happened to walk the folder in
+        // cannot make the same attempt look like a different one.
+        ...[...input.files].map((file) => `${file.path}:${file.objectId}`).sort(),
+    ].join("\n");
+    return (0, node_crypto_1.createHash)("sha256").update(shape).digest("hex").slice(0, 40);
+}

package/dist/desktop-app/src/main/rules.js

@@ -52,6 +52,19 @@ function globToSource(pattern) {
     let source = "";
     for (let index = 0; index < pattern.length; index += 1) {
         const character = pattern[index];
+        if (character === "\\" && index + 1 < pattern.length) {
+            /*
+              A backslash means the next character is a character, not syntax.
+              It is how a file genuinely called `#notes.txt` or `important!.md`
+              is written, and how a space is kept at the end of a name. Patterns
+              use forward slashes throughout, so a backslash is never a separator
+              here and always an escape.
+            */
+            const literal = pattern[index + 1];
+            source += literal.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            index += 1;
+            continue;
+        }
         if (character === "*") {
             if (pattern[index + 1] === "*") {
                 source += ".*";

package/dist/desktop-app/src/main/upload.js

@@ -17,6 +17,7 @@ const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
 const worktree_js_1 = require("./worktree.js");
+const publish_name_js_1 = require("./publish_name.js");
 /** Above this the API insists on a multipart session. */
 const DIRECT_LIMIT = 95 * 1024 * 1024;
 const PART_SIZE = 32 * 1024 * 1024;
@@ -123,7 +124,39 @@ class Uploader {
         // Ticked files are sent; everything else the project still has keeps the
         // copy already stored, and a file that is new but unticked is left out.
         const sending = everything.filter((file) => ticked.has(file.path));
-        const reused = everything.filter((file) => !ticked.has(file.path) && prior.has(file.path));
+        const onDiskNow = new Set(everything.map((file) => file.path));
+        /*
+          Everything the version already holds is kept, except what this
+          workspace deliberately removed.
+    
+          "Deliberately removed" means the workspace had the file and it is now
+          gone. A file it never had — because somebody else added it while this
+          person was working — is not theirs to delete, and must survive their
+          next save. Reading this from the disk scan alone is what silently lost
+          other people's files.
+        */
+        const knew = request.known ? new Set(Object.keys(request.known)) : null;
+        const reused = [...prior.entries()]
+            .filter(([path]) => {
+            if (ticked.has(path))
+                return false;
+            if (onDiskNow.has(path))
+                return true;
+            // Missing here. Only a deletion if this workspace ever had it.
+            return knew ? !knew.has(path) : true;
+        })
+            .map(([path, held]) => ({
+            path,
+            sourceSize: held.sourceSize,
+            storedSize: held.storedSize,
+            mediaType: held.mediaType,
+            added: 0,
+            removed: 0,
+            included: true,
+            deleted: false,
+            binary: false,
+            lines: 0,
+        }));
         /*
           A ticked path that the rescan cannot see is either a deletion or a file
           that has gone since the changes list was drawn. Deletions are meant to
@@ -300,6 +333,16 @@ class Uploader {
                 ...(request.expectedHeadVersionId === undefined
                     ? {}
                     : { expectedHeadVersionId: request.expectedHeadVersionId }),
+                /*
+                  Names this attempt so a retry after a lost connection is answered
+                  with the version already made, rather than making a second one.
+                */
+                idempotencyKey: (0, publish_name_js_1.publishAttemptName)({
+                    repositoryId,
+                    expectedHeadVersionId: request.expectedHeadVersionId,
+                    message: request.message,
+                    files: contents,
+                }),
                 sourceSize: sourceBytes,
                 storedSize: storedBytes,
                 files: contents.map((item) => ({
@@ -327,6 +370,7 @@ class Uploader {
             versionId: completed.version.id,
             sequence: completed.version.sequence,
             ...(completed.mergeTrack ? { mergeTrack: completed.mergeTrack } : {}),
+            ...(completed.repeated ? { repeated: true } : {}),
             sourceBytes,
             storedBytes,
             sentBytes,
@@ -335,6 +379,20 @@ class Uploader {
             // A file that kept its old object records the digest of *that* copy,
             // not of the file on disk, so an unticked edit is still pending next
             // time rather than looking as though it had been saved.
+            /*
+              What this folder holds after the save. A file that was sent holds
+              the bytes that were sent. Anything else keeps whatever digest was
+              recorded before: an unticked edit therefore stays pending rather
+              than looking saved, and a copy left stale by somebody else's merge
+              stays recognisably stale rather than looking like a new edit.
+            */
+            local: Object.fromEntries(everything.flatMap((file) => {
+                const sent = declarations.find((one) => one.path === file.path);
+                if (sent)
+                    return [[file.path, sent.sha256]];
+                const before = request.known?.[file.path] ?? prior.get(file.path)?.sha256;
+                return before ? [[file.path, before]] : [];
+            })),
             manifest: {
                 ...Object.fromEntries(reused.map((file) => [file.path, prior.get(file.path).sha256])),
                 ...Object.fromEntries(declarations.map((declaration) => [declaration.path, declaration.sha256])),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",
@@ -27,7 +27,11 @@
     "check": "tsc -p tsconfig.json --noEmit",
     "test": "tsc -p tsconfig.json && node --test --experimental-strip-types test/*.test.ts",
     "start": "node dist/cli/src/cli.js",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "test:e2e": "node test/e2e.mjs",
+    "test:matrix": "node test/state-matrix.mjs",
+    "test:attempt": "node test/attempt-identity.mjs",
+    "test:get": "node test/get-safety.mjs"
   },
   "devDependencies": {
     "@types/node": "24.10.1",