@coderook/cli 0.30.0 → 0.30.2

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.30.0",
+  "version": "0.30.2",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/api.js

@@ -51,6 +51,21 @@ exports.collisionCheck = collisionCheck;
 /** The small part of the API the command-line tool needs directly. */
 const identify_js_1 = require("../../desktop-app/src/main/identify.js");
 const config_js_1 = require("./config.js");
+/**
+ * How long one request may go unanswered before it is treated as lost.
+ *
+ * Nothing here had a deadline, so a request the service never answered
+ * waited for ever. A real save of a 38,913-file project stopped dead on one
+ * open connection with no bytes moving in either direction and no CPU, and
+ * said nothing at all — there is no output to watch, because the client is
+ * inside `await fetch`.
+ *
+ * Three minutes is far longer than any of these calls takes and short enough
+ * that a save cannot sit silent all afternoon. A deadline that fires is an
+ * ordinary error, so it reaches whatever the caller does about errors rather
+ * than ending the run.
+ */
+const REQUEST_DEADLINE_MS = 180_000;
 async function call(route, options = {}) {
     const token = await (0, config_js_1.loadToken)();
     if (!token) {
@@ -66,6 +81,7 @@ async function call(route, options = {}) {
             ...(options.body ? { "content-type": "application/json" } : {}),
         },
         body: options.body ? JSON.stringify(options.body) : undefined,
+        signal: AbortSignal.timeout(REQUEST_DEADLINE_MS),
     });
     const text = await response.text();
     const body = text ? JSON.parse(text) : {};
@@ -99,6 +115,7 @@ async function send(route, method, bytes, contentType) {
             "content-length": String(bytes.byteLength),
         },
         body: bytes,
+        signal: AbortSignal.timeout(REQUEST_DEADLINE_MS),
     });
     const text = await response.text();
     const body = text ? JSON.parse(text) : {};
@@ -174,7 +191,10 @@ async function projects() {
  */
 async function findPublicProject(owner, slug) {
     try {
-        const response = await fetch(`${(0, config_js_1.apiOrigin)()}/v1/public/projects/${encodeURIComponent(owner)}/${encodeURIComponent(slug)}`, { headers: { accept: "application/json", ...(0, identify_js_1.clientHeaders)() } });
+        const response = await fetch(`${(0, config_js_1.apiOrigin)()}/v1/public/projects/${encodeURIComponent(owner)}/${encodeURIComponent(slug)}`, {
+            headers: { accept: "application/json", ...(0, identify_js_1.clientHeaders)() },
+            signal: AbortSignal.timeout(REQUEST_DEADLINE_MS),
+        });
         if (!response.ok)
             return null;
         const row = (await response.json());
@@ -240,6 +260,8 @@ async function findProject(reference) {
 async function health() {
     const response = await fetch(`${(0, config_js_1.apiOrigin)()}/health?t=${Date.now()}`, {
         headers: { "cache-control": "no-cache" },
+        /* A health check that hangs is the one call where waiting is absurd. */
+        signal: AbortSignal.timeout(15_000),
     });
     return (await response.json());
 }
@@ -350,6 +372,7 @@ async function fileTextAt(repositoryId, versionId, filePath, mostBytes = 2 * 102
             ...(0, identify_js_1.clientHeaders)(),
             range: `bytes=0-${mostBytes - 1}`,
         },
+        signal: AbortSignal.timeout(REQUEST_DEADLINE_MS),
     });
     if (!response.ok)
         return null;

package/dist/cli/src/runner.js

@@ -42,6 +42,11 @@ const progress_js_1 = require("./progress.js");
 const HEARTBEAT_MS = 30_000;
 /** How often log lines are sent up while a command is running. */
 const FLUSH_MS = 2_000;
+/**
+ * The same deadline the rest of the client uses, so nothing here can wait for
+ * ever on a request the service never answers.
+ */
+const REQUEST_DEADLINE_MS = 180_000;
 async function call(route, options = {}) {
     const token = await (0, config_js_1.loadToken)();
     if (!token)
@@ -55,6 +60,7 @@ async function call(route, options = {}) {
             ...(options.body ? { "content-type": "application/json" } : {}),
         },
         body: options.body ? JSON.stringify(options.body) : undefined,
+        signal: AbortSignal.timeout(REQUEST_DEADLINE_MS),
     });
     const text = await response.text();
     const body = text ? JSON.parse(text) : {};
@@ -221,6 +227,7 @@ async function uploadArtifacts(repositoryId, runId, workspace, patterns, say) {
             const stored = await fetch(`${(0, config_js_1.apiOrigin)()}/v1/repositories/${repositoryId}` +
                 `/objects/${digest}?kind=chunk&role=chunk`, {
                 method: "PUT",
+                signal: AbortSignal.timeout(REQUEST_DEADLINE_MS),
                 headers: {
                     authorization: `Bearer ${token}`,
                     "content-type": "application/octet-stream",

package/dist/cli/src/transfer_command.js

@@ -71,7 +71,11 @@ async function readJson(url, token, forge) {
         headers.authorization =
             forge.kind === "gitlab" ? `Bearer ${token}` : `token ${token}`;
     }
-    const response = await fetch(url, { headers });
+    /* A forge that stops answering must not hold the import open for ever. */
+    const response = await fetch(url, {
+        headers,
+        signal: AbortSignal.timeout(60_000),
+    });
     if (!response.ok) {
         throw new Error(`${response.status} from ${new URL(url).pathname}`);
     }

package/dist/desktop-app/src/main/detect.js

@@ -60,24 +60,24 @@ const RULES = [
       project where the question "what should I leave out?" has the largest
       possible answer was the one the detector had nothing to say about.
     */
-    { directory: "Library", reason: "Unity's import cache — rebuilt when the project next opens", recommended: true },
-    { directory: "Temp", reason: "Unity's scratch folder for the running editor", recommended: true },
-    { directory: "MemoryCaptures", reason: "Unity memory snapshots — large, and not the project", recommended: true },
-    { directory: "Recordings", reason: "Unity recorder output", recommended: true },
-    { directory: "UserSettings", reason: "Your own editor layout — not part of the project", recommended: true },
-    { directory: "DerivedDataCache", reason: "Unreal's derived data cache — rebuilt on demand", recommended: true },
-    { directory: "Intermediate", reason: "Unreal build intermediates — rebuilt when you build", recommended: true },
-    { directory: "Binaries", reason: "Unreal compiled output — rebuilt when you build", recommended: true },
+    { directory: "Library", atRoot: true, reason: "Unity's import cache — rebuilt when the project next opens", recommended: true },
+    { directory: "Temp", atRoot: true, reason: "Unity's scratch folder for the running editor", recommended: true },
+    { directory: "MemoryCaptures", atRoot: true, reason: "Unity memory snapshots — large, and not the project", recommended: true },
+    { directory: "Recordings", atRoot: true, reason: "Unity recorder output", recommended: true },
+    { directory: "UserSettings", atRoot: true, reason: "Your own editor layout — not part of the project", recommended: true },
+    { directory: "DerivedDataCache", atRoot: true, reason: "Unreal's derived data cache — rebuilt on demand", recommended: true },
+    { directory: "Intermediate", atRoot: true, reason: "Unreal build intermediates — rebuilt when you build", recommended: true },
+    { directory: "Binaries", atRoot: true, reason: "Unreal compiled output — rebuilt when you build", recommended: true },
     /*
       Named like the work, and it is not: Unreal keeps logs, crash reports and
       autosaves here. Offered rather than ticked, because a folder called
       "Saved" is the one nobody should have excluded on our say-so.
     */
-    { directory: "Saved", reason: "Unreal logs and autosaves — check before excluding", recommended: false },
-    { directory: ".godot", reason: "Godot's import cache — rebuilt when the project next opens", recommended: true },
-    { directory: ".import", reason: "Godot's import cache — rebuilt when the project next opens", recommended: true },
-    { directory: "Logs", reason: "Editor logs", recommended: true },
-    { directory: "obj", reason: "Compiler intermediates — rebuilt when you build", recommended: true },
+    { directory: "Saved", atRoot: true, reason: "Unreal logs and autosaves — check before excluding", recommended: false },
+    { directory: ".godot", atRoot: true, reason: "Godot's import cache — rebuilt when the project next opens", recommended: true },
+    { directory: ".import", atRoot: true, reason: "Godot's import cache — rebuilt when the project next opens", recommended: true },
+    { directory: "Logs", atRoot: true, reason: "Editor logs", recommended: true },
+    { directory: "obj", atRoot: true, reason: "Compiler intermediates — rebuilt when you build", recommended: true },
     { directory: ".vs", reason: "Visual Studio's local cache", recommended: true },
     /*
       Offered, not ticked. JetBrains keeps run configurations in here that some
@@ -104,7 +104,7 @@ const RULES = [
     { directory: "dist", reason: "Usually build output — check before excluding", recommended: false },
     { directory: "build", reason: "Usually build output — check before excluding", recommended: false },
     { directory: "out", reason: "Usually build output — check before excluding", recommended: false },
-    { directory: "bin", reason: "Usually build output — check before excluding", recommended: false },
+    { directory: "bin", atRoot: true, reason: "Usually build output — check before excluding", recommended: false },
     { extension: ".safetensors", reason: "Model weights — large, and usually downloadable", recommended: false },
     { extension: ".ckpt", reason: "Model weights — large, and usually downloadable", recommended: false },
     { extension: ".pt", reason: "Model weights — large, and usually downloadable", recommended: false },
@@ -222,11 +222,17 @@ function suggestExclusions(files) {
                   gets written matching the folder that is there.
                 */
                 const wanted = rule.directory.toLowerCase();
-                const found = segments
-                    .slice(0, -1)
-                    .find((segment) => segment.toLowerCase() === wanted);
+                /*
+                  At the root, where the rule is about the project's own output, and
+                  written anchored so it stays there. Unanchored, this offered to
+                  leave out `Assets/Props/obj` — a folder of 3D models — because a
+                  C# build also writes to a folder called obj. The file it proposed
+                  removing was the one the rules had just been fixed to protect.
+                */
+                const within = rule.atRoot ? segments.slice(0, 1) : segments.slice(0, -1);
+                const found = within.find((segment) => segment.toLowerCase() === wanted);
                 if (found)
-                    pattern = `${found}/`;
+                    pattern = rule.atRoot ? `/${found}/` : `${found}/`;
             }
             if (!pattern && rule.file && name === rule.file) {
                 pattern = rule.file;
@@ -259,9 +265,16 @@ function suggestExclusions(files) {
       Merged in here rather than offered through a second channel, so everything
       that shows a suggestion keeps working unchanged. A folder already named by
       a rule above is dropped: it has a better reason than "no source in it".
+  
+      Matched on the folder, not on how the line is written. The rules emit an
+      anchored `/Library/` and this emits `Library/`, so comparing the patterns
+      as text found no overlap and a Unity project was offered its own import
+      cache twice over — once as "the editor rebuilds this" and once, below it,
+      as "37,000 files and no source in it".
     */
-    const already = new Set(named.map((one) => one.pattern));
-    const bulk = suggestBulkDirectories(files).filter((one) => !already.has(one.pattern));
+    const asFolder = (pattern) => pattern.replace(/^\/+|\/+$/g, "").toLowerCase();
+    const already = new Set(named.map((one) => asFolder(one.pattern)));
+    const bulk = suggestBulkDirectories(files).filter((one) => !already.has(asFolder(one.pattern)));
     return [...named, ...bulk].sort((left, right) => right.bytes - left.bytes);
 }
 /*

package/dist/desktop-app/src/main/rules.js

@@ -132,17 +132,36 @@ function matcher(pattern) {
     }
     return expression;
 }
+/** A directory pattern with or without its trailing slash is the same rule. */
+function trailingSlashOff(pattern) {
+    let end = pattern.length;
+    while (end > 0 && pattern[end - 1] === "/")
+        end -= 1;
+    return pattern.slice(0, end);
+}
 function ruleMatches(relativePath, isDirectory, rule) {
     const expression = matcher(rule.pattern);
     if (rule.directoryOnly) {
-        if (rule.anchored || rule.pattern.includes("/")) {
-            return (expression.test(relativePath) ||
-                relativePath.startsWith(`${rule.pattern.replace(/\/+$/, "")}/`));
-        }
-        const segments = relativePath.split("/");
-        // A file inside an ignored directory is matched by its parent segments.
-        const scope = isDirectory ? segments : segments.slice(0, -1);
-        return scope.some((segment) => expression.test(segment));
+        /*
+          A rule written `dir/` speaks about directories and about nothing else.
+          Everything under an excluded directory goes too, but that is git
+          declining to look inside it rather than the pattern reaching down, and
+          the difference shows the moment a later rule re-includes the directory:
+          `build/` then `!build/` leaves `build/keep.txt` travelling, which is the
+          escape hatch people are told to use. It shows again in reverse, which is
+          how this was found — asking `!Library/PackageCache/a.package/` about a
+          file let the whole cache out of a folder only meant to be opened.
+    
+          So the pattern answers only for directories, and a file's ancestors are
+          asked separately, outermost in, by `decidingRule`.
+        */
+        if (!isDirectory)
+            return false;
+        const bare = trailingSlashOff(rule.pattern);
+        if (rule.anchored || bare.includes("/"))
+            return expression.test(relativePath);
+        const own = relativePath.split("/").pop() ?? relativePath;
+        return expression.test(own);
     }
     if (rule.anchored || rule.pattern.includes("/")) {
         return expression.test(relativePath);
@@ -181,39 +200,7 @@ function decide(relativePath, isDirectory, layers) {
     }
     return found;
 }
-/**
- * Whether these layers exclude the path, negations included.
- *
- * An excluded directory takes everything under it, whatever a later negation
- * says. This is git's rule — "it is not possible to re-include a file if a
- * parent directory of that file is excluded" — and it is followed here for a
- * plain reason: the file is called .gitignore, git reads it too, and a rule
- * that means one thing to one reader and something else to the other is worse
- * than either behaviour on its own.
- *
- * It was the other way once, deliberately, on the reasoning that somebody
- * writing `!` meant it. What that produced was a project excluding a folder
- * and publishing two files out of it anyway, because an unrelated
- * `!.env.example` further down reached inside — git had ignored them, so
- * nothing else in the toolchain gave any sign. Being more permissive than git
- * is the dangerous direction to differ in: it uploads what somebody thought
- * they had excluded.
- */
-/**
- * The rule that settles this path, counting the directories above it.
- *
- * A directory rule is written about the directory — `/[Ll]ibrary/` matches
- * `Library`, not `Library/Artifacts/f1.dat` — so anything asking only about
- * the file finds no rule and calls it included. The upload has always walked
- * the ancestors; the filter screen asked about the file alone, and so showed
- * a Unity project's whole import cache as going up when the save would have
- * left every byte of it behind.
- *
- * Returned as the rule rather than a yes or no, because the screen names the
- * line responsible — "Library/ — 400 files" is the useful form, and a boolean
- * cannot say it.
- */
-function decidingRule(relativePath, isDirectory, layers) {
+function decidingRule(relativePath, isDirectory, layers, remembered) {
     /*
       Ancestors first, outermost in. The moment one is excluded the answer is
       settled and nothing below it can appeal.
@@ -221,7 +208,14 @@ function decidingRule(relativePath, isDirectory, layers) {
     const parts = relativePath.split("/");
     for (let depth = 1; depth < parts.length; depth += 1) {
         const ancestor = parts.slice(0, depth).join("/");
-        const above = decide(ancestor, true, layers);
+        let above;
+        if (remembered && remembered.has(ancestor)) {
+            above = remembered.get(ancestor) ?? null;
+        }
+        else {
+            above = decide(ancestor, true, layers);
+            remembered?.set(ancestor, above);
+        }
         if (above && !above.negated)
             return above;
     }
@@ -231,6 +225,29 @@ function excludes(relativePath, isDirectory, layers) {
     const rule = decidingRule(relativePath, isDirectory, layers);
     return Boolean(rule && !rule.negated);
 }
+/**
+ * Whether an anchored pattern could name anything inside this directory.
+ *
+ * Walked a segment at a time against the directory's own segments. A `**`
+ * makes everything below it possible and settles the question; a segment that
+ * simply does not match settles it the other way. Where the pattern runs out
+ * first it is left as possible, because this only ever needs to be certain
+ * when it says no.
+ */
+function couldDescendTo(pattern, directory) {
+    const wanted = pattern.replace(/^\/+/, "").replace(/\/+$/, "").split("/");
+    const here = directory.split("/").filter(Boolean);
+    for (let at = 0; at < here.length; at += 1) {
+        const part = wanted[at];
+        if (part === undefined)
+            return true;
+        if (part === "**")
+            return true;
+        if (!matcher(part).test(here[at]))
+            return false;
+    }
+    return true;
+}
 /**
  * Whether a negation could rescue something inside this directory.
  *
@@ -250,7 +267,22 @@ function negationReachesInto(relativePath, layers) {
             // A bare glob is matched against every segment, so it reaches anywhere.
             if (!rule.anchored && !rule.pattern.includes("/"))
                 return true;
-            // A wildcard that spans separators can descend to any depth.
+            // A ** used to end the question here, and that one line was the
+            // reason a scan read every directory in the project.
+            //
+            // The starter carries the negation that keeps Unity's meta files, and
+            // it is written with a ** in the middle, so `includes` said yes to
+            // it for every directory on disk. `Library/`, excluded and 45,000
+            // files deep, was descended into on every scan of every Unity
+            // project, because a rule about `Assets` might conceivably have
+            // reached in.
+            //
+            // It cannot: the pattern is anchored and its first segment is
+            // `[Aa]ssets`, which does not match `Library`. Comparing segment by
+            // segment answers that exactly, and stops only where a **
+            // genuinely makes the rest unknowable.
+            if (!couldDescendTo(`${prefix}${rule.pattern}`, relativePath))
+                continue;
             if (rule.pattern.includes("**"))
                 return true;
             const target = `${prefix}${rule.pattern.replace(/\/+$/, "")}`;

package/dist/desktop-app/src/main/upload.js

@@ -92,6 +92,15 @@ async function digestOf(full) {
         hash.update(chunk);
     return hash.digest("hex");
 }
+/**
+ * How long one request may go unanswered before it is treated as lost.
+ *
+ * Three minutes, which is far longer than any request this makes has taken
+ * and short enough that a save cannot sit silent all afternoon. What follows
+ * a deadline is a retry, not a failure, so the cost of it firing early on a
+ * genuinely slow call is one repeated request.
+ */
+const REQUEST_DEADLINE_MS = 180_000;
 class UploadCancelled extends Error {
     constructor() {
         super("Upload cancelled");
@@ -220,7 +229,24 @@ class Uploader {
                 ...(init.contentType ? { "content-type": init.contentType } : {}),
             },
             body: init.body,
-            signal: this.controller.signal,
+            /*
+              The upload's own cancellation, and a deadline.
+      
+              This carried only the cancel signal, so a request the service never
+              answered waited for ever: a real save of a 38,913-file project stopped
+              dead with one open connection, no bytes moving either way and no CPU,
+              and nothing anywhere said so. `worthRetrying` has always named "a
+              request that timed out" as the case worth repeating — there was simply
+              no way for one to time out, so the branch could not be reached.
+      
+              Generous on purpose. The service legitimately spends tens of seconds
+              on a large batch, and a deadline tight enough to cut that short would
+              turn slow saves into failing ones.
+            */
+            signal: AbortSignal.any([
+                this.controller.signal,
+                AbortSignal.timeout(REQUEST_DEADLINE_MS),
+            ]),
         });
         const text = await response.text();
         this.telemetry.request(route.split("?")[0] ?? route, init.body, new TextEncoder().encode(text).byteLength, performance.now() - started);

package/dist/desktop-app/src/main/worktree.js

@@ -3,13 +3,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOCAL_EXCLUDE_FILE = exports.IGNORE_FILE = exports.STARTER_IGNORE = exports.CODEROOK_TAIL = exports.CODEROOK_TAIL_HEADING = exports.KEPT_ANYWAY = exports.KEPT_ANYWAY_HEADING = exports.ALSO_LEFT_OUT = exports.ALSO_LEFT_OUT_HEADING = exports.STARTER_MARKER = exports.EVALUATION_FILE_LIMIT = void 0;
+exports.IGNORE_HEADING = exports.KEEP_HEADING = exports.LOCAL_EXCLUDE_FILE = exports.IGNORE_FILE = exports.STARTER_IGNORE = exports.CODEROOK_TAIL = exports.CODEROOK_TAIL_HEADING = exports.KEPT_ANYWAY = exports.KEPT_ANYWAY_HEADING = exports.ALSO_LEFT_OUT = exports.ALSO_LEFT_OUT_HEADING = exports.STARTER_MARKER = exports.EVALUATION_FILE_LIMIT = void 0;
 exports.starterAuthored = starterAuthored;
 exports.missingStarterRules = missingStarterRules;
 exports.missingEngineRules = missingEngineRules;
 exports.isRepository = isRepository;
 exports.migrateRetiredRules = migrateRetiredRules;
 exports.starterFor = starterFor;
+exports.moveRule = moveRule;
 exports.readRules = readRules;
 exports.writeRules = writeRules;
 exports.collectLayers = collectLayers;
@@ -20,6 +21,8 @@ exports.surveyFiles = surveyFiles;
 exports.totalSize = totalSize;
 exports.fileDiff = fileDiff;
 exports.projectTree = projectTree;
+exports.treeFrom = treeFrom;
+exports.walkProject = walkProject;
 exports.evaluateRules = evaluateRules;
 exports.detectPrivateDirectories = detectPrivateDirectories;
 exports.detectPastedCredentials = detectPastedCredentials;
@@ -38,6 +41,8 @@ const ignore_templates_js_1 = require("./ignore_templates.js");
 const rules_js_1 = require("./rules.js");
 const secret_patterns_js_1 = require("./secret_patterns.js");
 const run = (0, node_util_1.promisify)(node_child_process_1.execFile);
+/* A code point, so nothing between here and disk can eat the escape. */
+const NEWLINE = String.fromCharCode(10);
 /** Past this the evaluation reports truncated rather than walking forever. */
 exports.EVALUATION_FILE_LIMIT = 300_000;
 async function git(root, ...args) {
@@ -359,9 +364,14 @@ const EXTRA_TEMPLATES = {
 /.creator/`,
     },
 };
-async function starterFor(root) {
+async function starterFor(root, chosen) {
+    /*
+      What somebody said it is beats what the folder looks like.
+      `none` is a real answer — "this is not any of those" — and gets the plain
+      starter rather than being read as "no answer given".
+    */
     const entries = await (0, promises_1.readdir)(root).catch(() => []);
-    const keys = (0, detect_js_1.templatesFor)(entries);
+    const keys = chosen ? (chosen === "none" ? [] : [chosen]) : (0, detect_js_1.templatesFor)(entries);
     if (!keys.length)
         return exports.STARTER_IGNORE;
     const parts = [exports.STARTER_MARKER];
@@ -377,6 +387,106 @@ async function starterFor(root) {
     parts.push("", exports.CODEROOK_TAIL_HEADING, exports.CODEROOK_TAIL);
     return `${parts.join("\n")}\n`;
 }
+/**
+ * Move one path onto the ignore list, or onto the keep list.
+ *
+ * Both are the same act — writing a line into the project's own rules — which
+ * is why they are one function. Keeping means a `!` rule, and a `!` rule only
+ * means anything if it comes after whatever would have taken the file, so the
+ * line goes at the end under its own heading.
+ *
+ * Lifted out of the window's event handler so it can be tested. It could not
+ * be before, which is how a folder came to be written as a rule that also
+ * matched a file of the same name.
+ */
+async function moveRule(root, file, keep) {
+    /*
+      The rules travel with the project. A .gitignore that excluded itself would
+      never reach the website, the command line, or another machine.
+    */
+    if (file === exports.IGNORE_FILE) {
+        throw new Error("The ignore rules have to travel with the project");
+    }
+    const rules = await readRules(root);
+    /*
+      A folder is written as a folder rule.
+  
+      The path arrives without a trailing slash, and writing it as-is makes a
+      rule that also matches a *file* of that name — not what anybody meant by
+      excluding a directory, and a disagreement with what the command line
+      prints for the same folder. Any slash already there is taken off first, so
+      a caller passing a rule rather than a path cannot produce `name//`.
+    */
+    const bare = file.replace(/\/+$/, "");
+    const directory = await (0, promises_1.stat)(node_path_1.default.join(root, bare))
+        .then((entry) => entry.isDirectory())
+        .catch(() => file.endsWith("/"));
+    const target = directory ? `${bare}/` : bare;
+    const line = keep ? `!${target}` : target;
+    /* Saying it twice changes nothing and makes the file harder to read. */
+    const already = ruleLines(rules.shared).some((one) => one === line);
+    if (already)
+        return rules;
+    const heading = keep ? exports.KEEP_HEADING : exports.IGNORE_HEADING;
+    let body = rules.shared.replace(/\s*$/, "");
+    /*
+      A keep inside an excluded folder needs the folder opened first.
+  
+      Rules cannot re-include a file whose directory is excluded — nothing ever
+      looks inside a directory it has already decided to skip, so `!Library/x`
+      under `Library/` does precisely nothing. That is most of what this button
+      is for: rescuing one file out of a cache.
+  
+      The way through is the documented one. `Library/` becomes `Library/**`,
+      which leaves the directory itself includable, and every directory on the
+      way down to the file is named back in. Written here rather than asked of
+      the person, because the alternative is a button that looks like it worked.
+    */
+    if (keep) {
+        /*
+          Which rule is in the way is a question for the matcher, not for string
+          comparison. The line is `/[Ll]ibrary/` — a pattern — and no amount of
+          comparing it against `Library/PackageCache/...` will ever match, which
+          is exactly how the first version of this wrote a negation that did
+          nothing at all.
+        */
+        const parts = target.split("/");
+        for (let depth = 1; depth < parts.length; depth += 1) {
+            const ancestor = parts.slice(0, depth).join("/");
+            const layers = [{ base: "", rules: (0, rules_js_1.parseRules)(body) }];
+            const blocking = (0, rules_js_1.decide)(ancestor, true, layers);
+            if (!blocking || blocking.negated || !blocking.directoryOnly)
+                continue;
+            /*
+              Replaced line by line rather than by pattern. The thing being found
+              is itself a pattern — `/[Ll]ibrary/` — so building a regular
+              expression out of it means escaping a string that is mostly regular
+              expression already, for no gain over comparing the text.
+            */
+            const was = (blocking.anchored ? "/" : "") + blocking.pattern + "/";
+            const opened = (blocking.anchored ? "/" : "") + blocking.pattern + "/**";
+            body = body
+                .split(NEWLINE)
+                .map((one) => (one.trim() === was ? opened : one))
+                .join(NEWLINE);
+            /* Then name every directory between it and the file back in. */
+            for (let at = depth; at < parts.length - 1; at += 1) {
+                const open = "!" + parts.slice(0, at + 1).join("/") + "/";
+                if (!ruleLines(body).includes(open))
+                    body += NEWLINE + open;
+            }
+        }
+    }
+    const shared = body.includes(heading)
+        ? body + NEWLINE + line + NEWLINE
+        : body + NEWLINE + NEWLINE + heading + NEWLINE + line + NEWLINE;
+    const next = { ...rules, shared };
+    await writeRules(root, next);
+    return next;
+}
+/** The two headings a move writes under, so a person can find their own edits. */
+exports.KEEP_HEADING = "# Always include";
+exports.IGNORE_HEADING = "# Left out from the filter screen";
 async function readRules(root) {
     const shared = await readIfPresent(node_path_1.default.join(root, exports.IGNORE_FILE));
     const local = await readIfPresent(node_path_1.default.join(root, exports.LOCAL_EXCLUDE_FILE));
@@ -763,56 +873,85 @@ async function surveyFiles(root, rules,
 onFound) {
     const layers = await collectLayers(root, rules);
     const found = [];
-    const pending = [root];
-    while (pending.length) {
-        const directory = pending.pop();
-        let entries;
-        try {
-            entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
-        }
-        catch {
-            continue;
-        }
-        for (const entry of entries) {
-            const full = node_path_1.default.join(directory, entry.name);
-            if (entry.isSymbolicLink())
-                continue;
-            if ((0, rules_js_1.isUncounted)(entry.name))
-                continue;
-            const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
-            if (entry.isDirectory()) {
-                if ((0, rules_js_1.excludes)(relative, true, layers) &&
-                    !(0, rules_js_1.negationReachesInto)(relative, layers)) {
+    /*
+      A level at a time, eight in flight.
+  
+      Asking the disk for one thing and waiting for the answer before asking
+      for the next is most of what this cost: the same walk with eight lanes
+      open is about four times quicker, and a ninth buys nothing. The order the
+      answers arrive in does not matter because the list is sorted at the end.
+    */
+    let level = [root];
+    while (level.length) {
+        const next = [];
+        let at = 0;
+        const lane = async () => {
+            while (at < level.length) {
+                const directory = level[at];
+                at += 1;
+                let entries;
+                try {
+                    entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
+                }
+                catch {
                     continue;
                 }
-                pending.push(full);
-                continue;
-            }
-            if (!entry.isFile())
-                continue;
-            if ((0, rules_js_1.excludes)(relative, false, layers))
-                continue;
-            try {
-                found.push({ path: relative, size: (await (0, promises_1.stat)(full)).size });
-                if (onFound && found.length % 500 === 0)
-                    onFound(found.length);
-            }
-            catch {
-                /* Gone or unreadable since the walk began; the upload reports it. */
+                const here = [];
+                for (const entry of entries) {
+                    const full = node_path_1.default.join(directory, entry.name);
+                    if (entry.isSymbolicLink())
+                        continue;
+                    if ((0, rules_js_1.isUncounted)(entry.name))
+                        continue;
+                    const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
+                    if (entry.isDirectory()) {
+                        if ((0, rules_js_1.excludes)(relative, true, layers) &&
+                            !(0, rules_js_1.negationReachesInto)(relative, layers)) {
+                            continue;
+                        }
+                        next.push(full);
+                        continue;
+                    }
+                    if (!entry.isFile())
+                        continue;
+                    if ((0, rules_js_1.excludes)(relative, false, layers))
+                        continue;
+                    here.push({ full, relative });
+                }
+                for (let from = 0; from < here.length; from += WALK_LANES) {
+                    const sized = await Promise.all(here.slice(from, from + WALK_LANES).map(async (one) => {
+                        try {
+                            return { path: one.relative, size: (await (0, promises_1.stat)(one.full)).size };
+                        }
+                        catch {
+                            /* Gone or unreadable since the walk began; the upload says so. */
+                            return null;
+                        }
+                    }));
+                    for (const one of sized) {
+                        if (!one)
+                            continue;
+                        found.push(one);
+                        if (onFound && found.length % 500 === 0)
+                            onFound(found.length);
+                    }
+                }
             }
-        }
+        };
+        await Promise.all(Array.from({ length: Math.min(WALK_LANES, level.length) }, () => lane()));
+        level = next;
     }
     return found.sort((left, right) => left.path.localeCompare(right.path));
 }
 async function totalSize(root, files) {
     let total = 0;
-    for (const file of files) {
-        try {
-            total += (await (0, promises_1.stat)(node_path_1.default.join(root, file.path))).size;
-        }
-        catch {
-            /* deleted since the scan; it contributes nothing */
-        }
+    /* Same reason as the walk: these are all waiting, so let them wait together. */
+    for (let from = 0; from < files.length; from += WALK_LANES) {
+        const sizes = await Promise.all(files.slice(from, from + WALK_LANES).map((file) => (0, promises_1.stat)(node_path_1.default.join(root, file.path)).then((info) => info.size, 
+        /* deleted since the scan; it contributes nothing */
+        () => 0)));
+        for (const size of sizes)
+            total += size;
     }
     return total;
 }
@@ -910,71 +1049,168 @@ async function fileDiff(root, file, ignoreWhitespace = false) {
  * than by writing glob patterns. Sizes are rolled up, because the only way
  * to decide whether to keep a folder is to know what it costs.
  */
-async function projectTree(root, limit = exports.EVALUATION_FILE_LIMIT) {
-    let seen = 0;
-    const walk = async (directory, relative) => {
+/**
+ * The folder as a tree, built from one walk rather than another descent.
+ *
+ * It used to recurse the disk itself, in step with an evaluation doing the
+ * same descent alongside it — two serial passes over a folder that on a real
+ * Unity project holds 47,387 files. Now both are worked out from a single
+ * concurrent walk, so the filter screen reads the disk once.
+ */
+async function projectTree(root, limitOrWalked = exports.EVALUATION_FILE_LIMIT) {
+    const walked = typeof limitOrWalked === "number"
+        ? await walkProject(root, { limit: limitOrWalked })
+        : limitOrWalked;
+    return treeFrom(walked);
+}
+/** Fold the walk into nodes, carrying sizes and counts up as it goes. */
+function treeFrom(walked) {
+    const root = {
+        path: "",
+        name: ".",
+        directory: true,
+        size: 0,
+        files: 0,
+        children: [],
+        ...(walked.truncated ? { truncated: true } : {}),
+    };
+    const folders = new Map([["", root]]);
+    const folderAt = (relative) => {
+        const held = folders.get(relative);
+        if (held)
+            return held;
+        const cut = relative.lastIndexOf("/");
+        const parent = folderAt(cut < 0 ? "" : relative.slice(0, cut));
         const node = {
             path: relative,
-            name: relative ? relative.slice(relative.lastIndexOf("/") + 1) : ".",
+            name: relative.slice(cut + 1),
             directory: true,
             size: 0,
             files: 0,
             children: [],
         };
-        let entries;
-        try {
-            entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
-        }
-        catch {
-            return node;
-        }
-        for (const entry of entries) {
-            if (entry.isSymbolicLink())
-                continue;
-            if ((0, rules_js_1.isUncounted)(entry.name))
-                continue;
-            const full = node_path_1.default.join(directory, entry.name);
-            const childPath = relative ? `${relative}/${entry.name}` : entry.name;
-            if (entry.isDirectory()) {
-                const child = await walk(full, childPath);
-                node.children.push(child);
-                node.size += child.size;
-                node.files += child.files;
-                continue;
-            }
-            if (!entry.isFile())
-                continue;
-            seen += 1;
-            if (seen > limit) {
-                node.truncated = true;
-                break;
-            }
-            let size = 0;
-            try {
-                size = (await (0, promises_1.stat)(full)).size;
-            }
-            catch {
-                continue;
-            }
-            node.children.push({
-                path: childPath,
-                name: entry.name,
-                directory: false,
-                size,
-                files: 1,
-            });
-            node.size += size;
-            node.files += 1;
+        parent.children.push(node);
+        folders.set(relative, node);
+        return node;
+    };
+    /* Empty folders are folders, and a tree that hides them is a different
+       folder from the one on disk. */
+    for (const directory of walked.directories)
+        folderAt(directory);
+    for (const file of walked.files) {
+        const cut = file.path.lastIndexOf("/");
+        const parent = folderAt(cut < 0 ? "" : file.path.slice(0, cut));
+        parent.children.push({
+            path: file.path,
+            name: file.path.slice(cut + 1),
+            directory: false,
+            size: file.size,
+            files: 1,
+        });
+        /* Up the chain, so a folder can be judged without opening it. */
+        for (let at = parent; at;) {
+            at.size += file.size;
+            at.files += 1;
+            const cutAt = at.path.lastIndexOf("/");
+            at = at.path === "" ? undefined : folders.get(cutAt < 0 ? "" : at.path.slice(0, cutAt));
         }
-        // Folders first, then files, each alphabetically — the familiar order.
+    }
+    // Folders first, then files, each alphabetically — the familiar order.
+    for (const node of folders.values()) {
         node.children.sort((left, right) => left.directory === right.directory
             ? left.name.localeCompare(right.name)
             : left.directory
                 ? -1
                 : 1);
-        return node;
-    };
-    return walk(root, "");
+    }
+    return root;
+}
+/**
+ * Every file under a folder, with its size, walked eight at a time.
+ *
+ * The filter screen used to walk the same folder twice over, once to build
+ * the tree and once to apply the rules, and both walks asked the disk for one
+ * thing at a time. On a 47,387-file Unity project that is 47,387 serial stat
+ * calls, and a stat is almost entirely waiting: the same walk with eight in
+ * flight is 2,483ms down to 638ms, and more lanes than eight buy nothing.
+ *
+ * So there is one walk, it is concurrent, and the tree and the evaluation are
+ * both worked out from what it returns rather than from the disk.
+ */
+const WALK_LANES = 8;
+async function walkProject(root, options = {}) {
+    const limit = options.limit ?? exports.EVALUATION_FILE_LIMIT;
+    const files = [];
+    const directories = [];
+    let truncated = false;
+    let stopped = false;
+    /* Breadth-first, a level at a time, so the lanes always have work. */
+    let level = [root];
+    while (level.length && !stopped) {
+        const next = [];
+        let at = 0;
+        const lane = async () => {
+            while (at < level.length) {
+                if (stopped)
+                    return;
+                const directory = level[at];
+                at += 1;
+                if (options.shouldStop?.()) {
+                    stopped = true;
+                    return;
+                }
+                let entries;
+                try {
+                    entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
+                }
+                catch {
+                    continue;
+                }
+                const here = [];
+                for (const entry of entries) {
+                    if (entry.isSymbolicLink())
+                        continue;
+                    if ((0, rules_js_1.isUncounted)(entry.name))
+                        continue;
+                    const full = node_path_1.default.join(directory, entry.name);
+                    if (entry.isDirectory()) {
+                        next.push(full);
+                        directories.push(relativeTo(root, full));
+                        continue;
+                    }
+                    if (entry.isFile())
+                        here.push(full);
+                }
+                for (let from = 0; from < here.length; from += WALK_LANES) {
+                    const sized = await Promise.all(here.slice(from, from + WALK_LANES).map(async (full) => {
+                        try {
+                            return { full, size: (await (0, promises_1.stat)(full)).size };
+                        }
+                        catch {
+                            return null;
+                        }
+                    }));
+                    for (const one of sized) {
+                        if (!one)
+                            continue;
+                        if (files.length >= limit) {
+                            truncated = true;
+                            stopped = true;
+                            return;
+                        }
+                        files.push({ path: relativeTo(root, one.full), size: one.size });
+                    }
+                }
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(WALK_LANES, level.length) }, () => lane()));
+        level = next;
+    }
+    return { files, directories, truncated };
+}
+/** A path under the root, written the way the rules are. */
+function relativeTo(root, full) {
+    return node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
 }
 /**
  * Measure what the supplied rules would upload, skip and force-keep.
@@ -984,7 +1220,6 @@ async function projectTree(root, limit = exports.EVALUATION_FILE_LIMIT) {
  */
 async function evaluateRules(root, rules, options = {}) {
     const layers = await collectLayers(root, rules);
-    const limit = options.limit ?? exports.EVALUATION_FILE_LIMIT;
     const impactBytes = new Map();
     const impactFiles = new Map();
     const excluded = [];
@@ -994,89 +1229,65 @@ async function evaluateRules(root, rules, options = {}) {
     let skippedBytes = 0;
     let keptFiles = 0;
     let keptBytes = 0;
-    let seen = 0;
-    let truncated = false;
-    const pending = [root];
-    while (pending.length) {
-        if (options.shouldStop?.())
-            return emptyEvaluation(true);
-        const directory = pending.pop();
-        let entries;
-        try {
-            entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
-        }
-        catch {
-            continue;
-        }
-        for (const entry of entries) {
-            if (options.shouldStop?.())
-                return emptyEvaluation(true);
-            const full = node_path_1.default.join(directory, entry.name);
-            if (entry.isSymbolicLink())
-                continue;
-            if ((0, rules_js_1.isUncounted)(entry.name))
-                continue;
-            if (entry.isDirectory()) {
-                pending.push(full);
-                continue;
-            }
-            if (!entry.isFile())
-                continue;
-            seen += 1;
-            if (seen > limit) {
-                truncated = true;
-                pending.length = 0;
-                break;
-            }
-            let size;
-            try {
-                size = (await (0, promises_1.stat)(full)).size;
-            }
-            catch {
-                continue;
-            }
-            const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
-            // The last rule to speak wins, across every .gitignore that governs
-            // this path. A `!` rule brings the file back and is worth reporting,
-            // because it is how "always include" is expressed.
-            /*
-              The directories above it count. Asking `decide` about the file alone
-              is what made this screen report a Unity project's whole Library as
-              going up: `/[Ll]ibrary/` speaks about the directory, so no rule
-              matched the file and every one of them looked included — while the
-              save, which has always walked the ancestors, left them all behind.
-            */
-            const rule = (0, rules_js_1.decidingRule)(relative, false, layers);
-            if (rule?.negated) {
-                keptFiles += 1;
-                keptBytes += size;
-                uploadFiles += 1;
-                uploadBytes += size;
-                excluded.push({
-                    path: relative,
-                    bytes: size,
-                    rule: `!${rule.pattern}`,
-                    forceKept: true,
-                });
-                continue;
-            }
-            if (rule) {
-                skippedFiles += 1;
-                skippedBytes += size;
-                impactBytes.set(rule.pattern, (impactBytes.get(rule.pattern) ?? 0) + size);
-                impactFiles.set(rule.pattern, (impactFiles.get(rule.pattern) ?? 0) + 1);
-                excluded.push({
-                    path: relative,
-                    bytes: size,
-                    rule: rule.pattern,
-                    forceKept: false,
-                });
-                continue;
-            }
+    const walked = options.walked ?? (await walkProject(root, options));
+    if (options.shouldStop?.())
+        return emptyEvaluation(true);
+    const truncated = walked.truncated;
+    /* Kept for this evaluation only, so no edit to the rules can outlive it. */
+    const folderAnswers = new Map();
+    for (const file of walked.files) {
+        const { path: relative, size } = file;
+        // The last rule to speak wins, across every .gitignore that governs
+        // this path. A `!` rule brings the file back and is worth reporting,
+        // because it is how "always include" is expressed.
+        /*
+          The directories above it count. Asking `decide` about the file alone
+          is what made this screen report a Unity project's whole Library as
+          going up: `/[Ll]ibrary/` speaks about the directory, so no rule
+          matched the file and every one of them looked included — while the
+          save, which has always walked the ancestors, left them all behind.
+        */
+        const rule = (0, rules_js_1.decidingRule)(relative, false, layers, folderAnswers);
+        if (rule?.negated) {
+            keptFiles += 1;
+            keptBytes += size;
             uploadFiles += 1;
             uploadBytes += size;
+            excluded.push({
+                path: relative,
+                bytes: size,
+                rule: `!${rule.pattern}`,
+                forceKept: true,
+            });
+            continue;
+        }
+        if (rule) {
+            skippedFiles += 1;
+            skippedBytes += size;
+            impactBytes.set(rule.pattern, (impactBytes.get(rule.pattern) ?? 0) + size);
+            impactFiles.set(rule.pattern, (impactFiles.get(rule.pattern) ?? 0) + 1);
+            excluded.push({
+                path: relative,
+                bytes: size,
+                rule: rule.pattern,
+                forceKept: false,
+            });
+            continue;
         }
+        uploadFiles += 1;
+        uploadBytes += size;
     }
+    /*
+      Sorted, and all of it.
+  
+      This used to hand back the four hundred largest, which was right for a
+      flat list somebody scrolls and wrong for what reads it now: the screen
+      folds these into folders, so a Unity project's Library — 45,739 files —
+      was drawn from four hundred of them and labelled "395 files" beside a
+      header that said 45,739. The grouping happens here, in this process, and
+      only the folded tree crosses to the window, so keeping all of them costs
+      an array nobody sends.
+    */
     excluded.sort((left, right) => right.bytes - left.bytes);
     const impacts = [...impactBytes.entries()]
         .map(([pattern, bytes]) => ({
@@ -1093,7 +1304,7 @@ async function evaluateRules(root, rules, options = {}) {
         keptFiles,
         keptBytes,
         impacts,
-        excluded: excluded.slice(0, 400),
+        excluded,
         truncated,
     };
 }
@@ -1388,39 +1599,60 @@ function isCredentialByName(relativePath) {
 }
 async function detectSecrets(root) {
     const found = [];
-    const pending = [root];
     let seen = 0;
-    while (pending.length && found.length < 50) {
-        const directory = pending.pop();
-        let entries;
-        try {
-            entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
-        }
-        catch {
-            continue;
-        }
-        for (const entry of entries) {
-            if (seen > 40_000)
-                return found;
-            const full = node_path_1.default.join(directory, entry.name);
-            if ((0, rules_js_1.isUncounted)(entry.name))
-                continue;
-            if (entry.isDirectory()) {
-                if (entry.name !== "node_modules")
-                    pending.push(full);
-                continue;
+    let enough = false;
+    /*
+      Every directory, eight at a time. This reads names and nothing else, so
+      it is pure waiting, and it was waiting one directory at a time over all
+      two and a half thousand of them on a real project.
+  
+      It still looks everywhere the rules do not. A credential inside a folder
+      that is currently ignored is one rule edit away from being sent, and this
+      is the check that is supposed to notice before that happens.
+    */
+    let level = [root];
+    while (level.length && !enough) {
+        const next = [];
+        let at = 0;
+        const lane = async () => {
+            while (at < level.length && !enough) {
+                const directory = level[at];
+                at += 1;
+                let entries;
+                try {
+                    entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
+                }
+                catch {
+                    continue;
+                }
+                for (const entry of entries) {
+                    if (found.length >= 50 || seen > 40_000) {
+                        enough = true;
+                        return;
+                    }
+                    const full = node_path_1.default.join(directory, entry.name);
+                    if ((0, rules_js_1.isUncounted)(entry.name))
+                        continue;
+                    if (entry.isDirectory()) {
+                        if (entry.name !== "node_modules")
+                            next.push(full);
+                        continue;
+                    }
+                    seen += 1;
+                    /*
+                      Asked of the one function rather than repeated here. These were
+                      two copies of the same rule, which is how `.env.example` came to
+                      be refused by the command line long after the service had learned
+                      that templates are not credentials.
+                    */
+                    const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
+                    if (isCredentialByName(relative))
+                        found.push(relative);
+                }
             }
-            seen += 1;
-            /*
-              Asked of the one function rather than repeated here. These were two
-              copies of the same rule, which is how `.env.example` came to be
-              refused by the command line long after the service had learned that
-              templates are not credentials.
-            */
-            const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
-            if (isCredentialByName(relative))
-                found.push(relative);
-        }
+        };
+        await Promise.all(Array.from({ length: Math.min(WALK_LANES, level.length) }, () => lane()));
+        level = next;
     }
     return found;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.30.0",
+  "version": "0.30.2",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",