@coderook/cli 0.30.1 → 0.30.2

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, from Claude Code.",
-  "version": "0.30.1",
+  "version": "0.30.2",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cli/src/api.js

@@ -51,6 +51,21 @@ exports.collisionCheck = collisionCheck;
 /** The small part of the API the command-line tool needs directly. */
 const identify_js_1 = require("../../desktop-app/src/main/identify.js");
 const config_js_1 = require("./config.js");
+/**
+ * How long one request may go unanswered before it is treated as lost.
+ *
+ * Nothing here had a deadline, so a request the service never answered
+ * waited for ever. A real save of a 38,913-file project stopped dead on one
+ * open connection with no bytes moving in either direction and no CPU, and
+ * said nothing at all — there is no output to watch, because the client is
+ * inside `await fetch`.
+ *
+ * Three minutes is far longer than any of these calls takes and short enough
+ * that a save cannot sit silent all afternoon. A deadline that fires is an
+ * ordinary error, so it reaches whatever the caller does about errors rather
+ * than ending the run.
+ */
+const REQUEST_DEADLINE_MS = 180_000;
 async function call(route, options = {}) {
     const token = await (0, config_js_1.loadToken)();
     if (!token) {
@@ -66,6 +81,7 @@ async function call(route, options = {}) {
             ...(options.body ? { "content-type": "application/json" } : {}),
         },
         body: options.body ? JSON.stringify(options.body) : undefined,
+        signal: AbortSignal.timeout(REQUEST_DEADLINE_MS),
     });
     const text = await response.text();
     const body = text ? JSON.parse(text) : {};
@@ -99,6 +115,7 @@ async function send(route, method, bytes, contentType) {
             "content-length": String(bytes.byteLength),
         },
         body: bytes,
+        signal: AbortSignal.timeout(REQUEST_DEADLINE_MS),
     });
     const text = await response.text();
     const body = text ? JSON.parse(text) : {};
@@ -174,7 +191,10 @@ async function projects() {
  */
 async function findPublicProject(owner, slug) {
     try {
-        const response = await fetch(`${(0, config_js_1.apiOrigin)()}/v1/public/projects/${encodeURIComponent(owner)}/${encodeURIComponent(slug)}`, { headers: { accept: "application/json", ...(0, identify_js_1.clientHeaders)() } });
+        const response = await fetch(`${(0, config_js_1.apiOrigin)()}/v1/public/projects/${encodeURIComponent(owner)}/${encodeURIComponent(slug)}`, {
+            headers: { accept: "application/json", ...(0, identify_js_1.clientHeaders)() },
+            signal: AbortSignal.timeout(REQUEST_DEADLINE_MS),
+        });
         if (!response.ok)
             return null;
         const row = (await response.json());
@@ -240,6 +260,8 @@ async function findProject(reference) {
 async function health() {
     const response = await fetch(`${(0, config_js_1.apiOrigin)()}/health?t=${Date.now()}`, {
         headers: { "cache-control": "no-cache" },
+        /* A health check that hangs is the one call where waiting is absurd. */
+        signal: AbortSignal.timeout(15_000),
     });
     return (await response.json());
 }
@@ -350,6 +372,7 @@ async function fileTextAt(repositoryId, versionId, filePath, mostBytes = 2 * 102
             ...(0, identify_js_1.clientHeaders)(),
             range: `bytes=0-${mostBytes - 1}`,
         },
+        signal: AbortSignal.timeout(REQUEST_DEADLINE_MS),
     });
     if (!response.ok)
         return null;

package/dist/cli/src/runner.js

@@ -42,6 +42,11 @@ const progress_js_1 = require("./progress.js");
 const HEARTBEAT_MS = 30_000;
 /** How often log lines are sent up while a command is running. */
 const FLUSH_MS = 2_000;
+/**
+ * The same deadline the rest of the client uses, so nothing here can wait for
+ * ever on a request the service never answers.
+ */
+const REQUEST_DEADLINE_MS = 180_000;
 async function call(route, options = {}) {
     const token = await (0, config_js_1.loadToken)();
     if (!token)
@@ -55,6 +60,7 @@ async function call(route, options = {}) {
             ...(options.body ? { "content-type": "application/json" } : {}),
         },
         body: options.body ? JSON.stringify(options.body) : undefined,
+        signal: AbortSignal.timeout(REQUEST_DEADLINE_MS),
     });
     const text = await response.text();
     const body = text ? JSON.parse(text) : {};
@@ -221,6 +227,7 @@ async function uploadArtifacts(repositoryId, runId, workspace, patterns, say) {
             const stored = await fetch(`${(0, config_js_1.apiOrigin)()}/v1/repositories/${repositoryId}` +
                 `/objects/${digest}?kind=chunk&role=chunk`, {
                 method: "PUT",
+                signal: AbortSignal.timeout(REQUEST_DEADLINE_MS),
                 headers: {
                     authorization: `Bearer ${token}`,
                     "content-type": "application/octet-stream",

package/dist/cli/src/transfer_command.js

@@ -71,7 +71,11 @@ async function readJson(url, token, forge) {
         headers.authorization =
             forge.kind === "gitlab" ? `Bearer ${token}` : `token ${token}`;
     }
-    const response = await fetch(url, { headers });
+    /* A forge that stops answering must not hold the import open for ever. */
+    const response = await fetch(url, {
+        headers,
+        signal: AbortSignal.timeout(60_000),
+    });
     if (!response.ok) {
         throw new Error(`${response.status} from ${new URL(url).pathname}`);
     }

package/dist/desktop-app/src/main/detect.js

@@ -265,9 +265,16 @@ function suggestExclusions(files) {
       Merged in here rather than offered through a second channel, so everything
       that shows a suggestion keeps working unchanged. A folder already named by
       a rule above is dropped: it has a better reason than "no source in it".
+  
+      Matched on the folder, not on how the line is written. The rules emit an
+      anchored `/Library/` and this emits `Library/`, so comparing the patterns
+      as text found no overlap and a Unity project was offered its own import
+      cache twice over — once as "the editor rebuilds this" and once, below it,
+      as "37,000 files and no source in it".
     */
-    const already = new Set(named.map((one) => one.pattern));
-    const bulk = suggestBulkDirectories(files).filter((one) => !already.has(one.pattern));
+    const asFolder = (pattern) => pattern.replace(/^\/+|\/+$/g, "").toLowerCase();
+    const already = new Set(named.map((one) => asFolder(one.pattern)));
+    const bulk = suggestBulkDirectories(files).filter((one) => !already.has(asFolder(one.pattern)));
     return [...named, ...bulk].sort((left, right) => right.bytes - left.bytes);
 }
 /*

package/dist/desktop-app/src/main/rules.js

@@ -200,39 +200,7 @@ function decide(relativePath, isDirectory, layers) {
     }
     return found;
 }
-/**
- * Whether these layers exclude the path, negations included.
- *
- * An excluded directory takes everything under it, whatever a later negation
- * says. This is git's rule — "it is not possible to re-include a file if a
- * parent directory of that file is excluded" — and it is followed here for a
- * plain reason: the file is called .gitignore, git reads it too, and a rule
- * that means one thing to one reader and something else to the other is worse
- * than either behaviour on its own.
- *
- * It was the other way once, deliberately, on the reasoning that somebody
- * writing `!` meant it. What that produced was a project excluding a folder
- * and publishing two files out of it anyway, because an unrelated
- * `!.env.example` further down reached inside — git had ignored them, so
- * nothing else in the toolchain gave any sign. Being more permissive than git
- * is the dangerous direction to differ in: it uploads what somebody thought
- * they had excluded.
- */
-/**
- * The rule that settles this path, counting the directories above it.
- *
- * A directory rule is written about the directory — `/[Ll]ibrary/` matches
- * `Library`, not `Library/Artifacts/f1.dat` — so anything asking only about
- * the file finds no rule and calls it included. The upload has always walked
- * the ancestors; the filter screen asked about the file alone, and so showed
- * a Unity project's whole import cache as going up when the save would have
- * left every byte of it behind.
- *
- * Returned as the rule rather than a yes or no, because the screen names the
- * line responsible — "Library/ — 400 files" is the useful form, and a boolean
- * cannot say it.
- */
-function decidingRule(relativePath, isDirectory, layers) {
+function decidingRule(relativePath, isDirectory, layers, remembered) {
     /*
       Ancestors first, outermost in. The moment one is excluded the answer is
       settled and nothing below it can appeal.
@@ -240,7 +208,14 @@ function decidingRule(relativePath, isDirectory, layers) {
     const parts = relativePath.split("/");
     for (let depth = 1; depth < parts.length; depth += 1) {
         const ancestor = parts.slice(0, depth).join("/");
-        const above = decide(ancestor, true, layers);
+        let above;
+        if (remembered && remembered.has(ancestor)) {
+            above = remembered.get(ancestor) ?? null;
+        }
+        else {
+            above = decide(ancestor, true, layers);
+            remembered?.set(ancestor, above);
+        }
         if (above && !above.negated)
             return above;
     }
@@ -250,6 +225,29 @@ function excludes(relativePath, isDirectory, layers) {
     const rule = decidingRule(relativePath, isDirectory, layers);
     return Boolean(rule && !rule.negated);
 }
+/**
+ * Whether an anchored pattern could name anything inside this directory.
+ *
+ * Walked a segment at a time against the directory's own segments. A `**`
+ * makes everything below it possible and settles the question; a segment that
+ * simply does not match settles it the other way. Where the pattern runs out
+ * first it is left as possible, because this only ever needs to be certain
+ * when it says no.
+ */
+function couldDescendTo(pattern, directory) {
+    const wanted = pattern.replace(/^\/+/, "").replace(/\/+$/, "").split("/");
+    const here = directory.split("/").filter(Boolean);
+    for (let at = 0; at < here.length; at += 1) {
+        const part = wanted[at];
+        if (part === undefined)
+            return true;
+        if (part === "**")
+            return true;
+        if (!matcher(part).test(here[at]))
+            return false;
+    }
+    return true;
+}
 /**
  * Whether a negation could rescue something inside this directory.
  *
@@ -269,7 +267,22 @@ function negationReachesInto(relativePath, layers) {
             // A bare glob is matched against every segment, so it reaches anywhere.
             if (!rule.anchored && !rule.pattern.includes("/"))
                 return true;
-            // A wildcard that spans separators can descend to any depth.
+            // A ** used to end the question here, and that one line was the
+            // reason a scan read every directory in the project.
+            //
+            // The starter carries the negation that keeps Unity's meta files, and
+            // it is written with a ** in the middle, so `includes` said yes to
+            // it for every directory on disk. `Library/`, excluded and 45,000
+            // files deep, was descended into on every scan of every Unity
+            // project, because a rule about `Assets` might conceivably have
+            // reached in.
+            //
+            // It cannot: the pattern is anchored and its first segment is
+            // `[Aa]ssets`, which does not match `Library`. Comparing segment by
+            // segment answers that exactly, and stops only where a **
+            // genuinely makes the rest unknowable.
+            if (!couldDescendTo(`${prefix}${rule.pattern}`, relativePath))
+                continue;
             if (rule.pattern.includes("**"))
                 return true;
             const target = `${prefix}${rule.pattern.replace(/\/+$/, "")}`;

package/dist/desktop-app/src/main/upload.js

@@ -92,6 +92,15 @@ async function digestOf(full) {
         hash.update(chunk);
     return hash.digest("hex");
 }
+/**
+ * How long one request may go unanswered before it is treated as lost.
+ *
+ * Three minutes, which is far longer than any request this makes has taken
+ * and short enough that a save cannot sit silent all afternoon. What follows
+ * a deadline is a retry, not a failure, so the cost of it firing early on a
+ * genuinely slow call is one repeated request.
+ */
+const REQUEST_DEADLINE_MS = 180_000;
 class UploadCancelled extends Error {
     constructor() {
         super("Upload cancelled");
@@ -220,7 +229,24 @@ class Uploader {
                 ...(init.contentType ? { "content-type": init.contentType } : {}),
             },
             body: init.body,
-            signal: this.controller.signal,
+            /*
+              The upload's own cancellation, and a deadline.
+      
+              This carried only the cancel signal, so a request the service never
+              answered waited for ever: a real save of a 38,913-file project stopped
+              dead with one open connection, no bytes moving either way and no CPU,
+              and nothing anywhere said so. `worthRetrying` has always named "a
+              request that timed out" as the case worth repeating — there was simply
+              no way for one to time out, so the branch could not be reached.
+      
+              Generous on purpose. The service legitimately spends tens of seconds
+              on a large batch, and a deadline tight enough to cut that short would
+              turn slow saves into failing ones.
+            */
+            signal: AbortSignal.any([
+                this.controller.signal,
+                AbortSignal.timeout(REQUEST_DEADLINE_MS),
+            ]),
         });
         const text = await response.text();
         this.telemetry.request(route.split("?")[0] ?? route, init.body, new TextEncoder().encode(text).byteLength, performance.now() - started);

package/dist/desktop-app/src/main/worktree.js

@@ -21,6 +21,8 @@ exports.surveyFiles = surveyFiles;
 exports.totalSize = totalSize;
 exports.fileDiff = fileDiff;
 exports.projectTree = projectTree;
+exports.treeFrom = treeFrom;
+exports.walkProject = walkProject;
 exports.evaluateRules = evaluateRules;
 exports.detectPrivateDirectories = detectPrivateDirectories;
 exports.detectPastedCredentials = detectPastedCredentials;
@@ -871,56 +873,85 @@ async function surveyFiles(root, rules,
 onFound) {
     const layers = await collectLayers(root, rules);
     const found = [];
-    const pending = [root];
-    while (pending.length) {
-        const directory = pending.pop();
-        let entries;
-        try {
-            entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
-        }
-        catch {
-            continue;
-        }
-        for (const entry of entries) {
-            const full = node_path_1.default.join(directory, entry.name);
-            if (entry.isSymbolicLink())
-                continue;
-            if ((0, rules_js_1.isUncounted)(entry.name))
-                continue;
-            const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
-            if (entry.isDirectory()) {
-                if ((0, rules_js_1.excludes)(relative, true, layers) &&
-                    !(0, rules_js_1.negationReachesInto)(relative, layers)) {
+    /*
+      A level at a time, eight in flight.
+  
+      Asking the disk for one thing and waiting for the answer before asking
+      for the next is most of what this cost: the same walk with eight lanes
+      open is about four times quicker, and a ninth buys nothing. The order the
+      answers arrive in does not matter because the list is sorted at the end.
+    */
+    let level = [root];
+    while (level.length) {
+        const next = [];
+        let at = 0;
+        const lane = async () => {
+            while (at < level.length) {
+                const directory = level[at];
+                at += 1;
+                let entries;
+                try {
+                    entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
+                }
+                catch {
                     continue;
                 }
-                pending.push(full);
-                continue;
-            }
-            if (!entry.isFile())
-                continue;
-            if ((0, rules_js_1.excludes)(relative, false, layers))
-                continue;
-            try {
-                found.push({ path: relative, size: (await (0, promises_1.stat)(full)).size });
-                if (onFound && found.length % 500 === 0)
-                    onFound(found.length);
-            }
-            catch {
-                /* Gone or unreadable since the walk began; the upload reports it. */
+                const here = [];
+                for (const entry of entries) {
+                    const full = node_path_1.default.join(directory, entry.name);
+                    if (entry.isSymbolicLink())
+                        continue;
+                    if ((0, rules_js_1.isUncounted)(entry.name))
+                        continue;
+                    const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
+                    if (entry.isDirectory()) {
+                        if ((0, rules_js_1.excludes)(relative, true, layers) &&
+                            !(0, rules_js_1.negationReachesInto)(relative, layers)) {
+                            continue;
+                        }
+                        next.push(full);
+                        continue;
+                    }
+                    if (!entry.isFile())
+                        continue;
+                    if ((0, rules_js_1.excludes)(relative, false, layers))
+                        continue;
+                    here.push({ full, relative });
+                }
+                for (let from = 0; from < here.length; from += WALK_LANES) {
+                    const sized = await Promise.all(here.slice(from, from + WALK_LANES).map(async (one) => {
+                        try {
+                            return { path: one.relative, size: (await (0, promises_1.stat)(one.full)).size };
+                        }
+                        catch {
+                            /* Gone or unreadable since the walk began; the upload says so. */
+                            return null;
+                        }
+                    }));
+                    for (const one of sized) {
+                        if (!one)
+                            continue;
+                        found.push(one);
+                        if (onFound && found.length % 500 === 0)
+                            onFound(found.length);
+                    }
+                }
             }
-        }
+        };
+        await Promise.all(Array.from({ length: Math.min(WALK_LANES, level.length) }, () => lane()));
+        level = next;
     }
     return found.sort((left, right) => left.path.localeCompare(right.path));
 }
 async function totalSize(root, files) {
     let total = 0;
-    for (const file of files) {
-        try {
-            total += (await (0, promises_1.stat)(node_path_1.default.join(root, file.path))).size;
-        }
-        catch {
-            /* deleted since the scan; it contributes nothing */
-        }
+    /* Same reason as the walk: these are all waiting, so let them wait together. */
+    for (let from = 0; from < files.length; from += WALK_LANES) {
+        const sizes = await Promise.all(files.slice(from, from + WALK_LANES).map((file) => (0, promises_1.stat)(node_path_1.default.join(root, file.path)).then((info) => info.size, 
+        /* deleted since the scan; it contributes nothing */
+        () => 0)));
+        for (const size of sizes)
+            total += size;
     }
     return total;
 }
@@ -1018,71 +1049,168 @@ async function fileDiff(root, file, ignoreWhitespace = false) {
  * than by writing glob patterns. Sizes are rolled up, because the only way
  * to decide whether to keep a folder is to know what it costs.
  */
-async function projectTree(root, limit = exports.EVALUATION_FILE_LIMIT) {
-    let seen = 0;
-    const walk = async (directory, relative) => {
+/**
+ * The folder as a tree, built from one walk rather than another descent.
+ *
+ * It used to recurse the disk itself, in step with an evaluation doing the
+ * same descent alongside it — two serial passes over a folder that on a real
+ * Unity project holds 47,387 files. Now both are worked out from a single
+ * concurrent walk, so the filter screen reads the disk once.
+ */
+async function projectTree(root, limitOrWalked = exports.EVALUATION_FILE_LIMIT) {
+    const walked = typeof limitOrWalked === "number"
+        ? await walkProject(root, { limit: limitOrWalked })
+        : limitOrWalked;
+    return treeFrom(walked);
+}
+/** Fold the walk into nodes, carrying sizes and counts up as it goes. */
+function treeFrom(walked) {
+    const root = {
+        path: "",
+        name: ".",
+        directory: true,
+        size: 0,
+        files: 0,
+        children: [],
+        ...(walked.truncated ? { truncated: true } : {}),
+    };
+    const folders = new Map([["", root]]);
+    const folderAt = (relative) => {
+        const held = folders.get(relative);
+        if (held)
+            return held;
+        const cut = relative.lastIndexOf("/");
+        const parent = folderAt(cut < 0 ? "" : relative.slice(0, cut));
         const node = {
             path: relative,
-            name: relative ? relative.slice(relative.lastIndexOf("/") + 1) : ".",
+            name: relative.slice(cut + 1),
             directory: true,
             size: 0,
             files: 0,
             children: [],
         };
-        let entries;
-        try {
-            entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
-        }
-        catch {
-            return node;
-        }
-        for (const entry of entries) {
-            if (entry.isSymbolicLink())
-                continue;
-            if ((0, rules_js_1.isUncounted)(entry.name))
-                continue;
-            const full = node_path_1.default.join(directory, entry.name);
-            const childPath = relative ? `${relative}/${entry.name}` : entry.name;
-            if (entry.isDirectory()) {
-                const child = await walk(full, childPath);
-                node.children.push(child);
-                node.size += child.size;
-                node.files += child.files;
-                continue;
-            }
-            if (!entry.isFile())
-                continue;
-            seen += 1;
-            if (seen > limit) {
-                node.truncated = true;
-                break;
-            }
-            let size = 0;
-            try {
-                size = (await (0, promises_1.stat)(full)).size;
-            }
-            catch {
-                continue;
-            }
-            node.children.push({
-                path: childPath,
-                name: entry.name,
-                directory: false,
-                size,
-                files: 1,
-            });
-            node.size += size;
-            node.files += 1;
+        parent.children.push(node);
+        folders.set(relative, node);
+        return node;
+    };
+    /* Empty folders are folders, and a tree that hides them is a different
+       folder from the one on disk. */
+    for (const directory of walked.directories)
+        folderAt(directory);
+    for (const file of walked.files) {
+        const cut = file.path.lastIndexOf("/");
+        const parent = folderAt(cut < 0 ? "" : file.path.slice(0, cut));
+        parent.children.push({
+            path: file.path,
+            name: file.path.slice(cut + 1),
+            directory: false,
+            size: file.size,
+            files: 1,
+        });
+        /* Up the chain, so a folder can be judged without opening it. */
+        for (let at = parent; at;) {
+            at.size += file.size;
+            at.files += 1;
+            const cutAt = at.path.lastIndexOf("/");
+            at = at.path === "" ? undefined : folders.get(cutAt < 0 ? "" : at.path.slice(0, cutAt));
         }
-        // Folders first, then files, each alphabetically — the familiar order.
+    }
+    // Folders first, then files, each alphabetically — the familiar order.
+    for (const node of folders.values()) {
         node.children.sort((left, right) => left.directory === right.directory
             ? left.name.localeCompare(right.name)
             : left.directory
                 ? -1
                 : 1);
-        return node;
-    };
-    return walk(root, "");
+    }
+    return root;
+}
+/**
+ * Every file under a folder, with its size, walked eight at a time.
+ *
+ * The filter screen used to walk the same folder twice over, once to build
+ * the tree and once to apply the rules, and both walks asked the disk for one
+ * thing at a time. On a 47,387-file Unity project that is 47,387 serial stat
+ * calls, and a stat is almost entirely waiting: the same walk with eight in
+ * flight is 2,483ms down to 638ms, and more lanes than eight buy nothing.
+ *
+ * So there is one walk, it is concurrent, and the tree and the evaluation are
+ * both worked out from what it returns rather than from the disk.
+ */
+const WALK_LANES = 8;
+async function walkProject(root, options = {}) {
+    const limit = options.limit ?? exports.EVALUATION_FILE_LIMIT;
+    const files = [];
+    const directories = [];
+    let truncated = false;
+    let stopped = false;
+    /* Breadth-first, a level at a time, so the lanes always have work. */
+    let level = [root];
+    while (level.length && !stopped) {
+        const next = [];
+        let at = 0;
+        const lane = async () => {
+            while (at < level.length) {
+                if (stopped)
+                    return;
+                const directory = level[at];
+                at += 1;
+                if (options.shouldStop?.()) {
+                    stopped = true;
+                    return;
+                }
+                let entries;
+                try {
+                    entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
+                }
+                catch {
+                    continue;
+                }
+                const here = [];
+                for (const entry of entries) {
+                    if (entry.isSymbolicLink())
+                        continue;
+                    if ((0, rules_js_1.isUncounted)(entry.name))
+                        continue;
+                    const full = node_path_1.default.join(directory, entry.name);
+                    if (entry.isDirectory()) {
+                        next.push(full);
+                        directories.push(relativeTo(root, full));
+                        continue;
+                    }
+                    if (entry.isFile())
+                        here.push(full);
+                }
+                for (let from = 0; from < here.length; from += WALK_LANES) {
+                    const sized = await Promise.all(here.slice(from, from + WALK_LANES).map(async (full) => {
+                        try {
+                            return { full, size: (await (0, promises_1.stat)(full)).size };
+                        }
+                        catch {
+                            return null;
+                        }
+                    }));
+                    for (const one of sized) {
+                        if (!one)
+                            continue;
+                        if (files.length >= limit) {
+                            truncated = true;
+                            stopped = true;
+                            return;
+                        }
+                        files.push({ path: relativeTo(root, one.full), size: one.size });
+                    }
+                }
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(WALK_LANES, level.length) }, () => lane()));
+        level = next;
+    }
+    return { files, directories, truncated };
+}
+/** A path under the root, written the way the rules are. */
+function relativeTo(root, full) {
+    return node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
 }
 /**
  * Measure what the supplied rules would upload, skip and force-keep.
@@ -1092,7 +1220,6 @@ async function projectTree(root, limit = exports.EVALUATION_FILE_LIMIT) {
  */
 async function evaluateRules(root, rules, options = {}) {
     const layers = await collectLayers(root, rules);
-    const limit = options.limit ?? exports.EVALUATION_FILE_LIMIT;
     const impactBytes = new Map();
     const impactFiles = new Map();
     const excluded = [];
@@ -1102,89 +1229,65 @@ async function evaluateRules(root, rules, options = {}) {
     let skippedBytes = 0;
     let keptFiles = 0;
     let keptBytes = 0;
-    let seen = 0;
-    let truncated = false;
-    const pending = [root];
-    while (pending.length) {
-        if (options.shouldStop?.())
-            return emptyEvaluation(true);
-        const directory = pending.pop();
-        let entries;
-        try {
-            entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
-        }
-        catch {
-            continue;
-        }
-        for (const entry of entries) {
-            if (options.shouldStop?.())
-                return emptyEvaluation(true);
-            const full = node_path_1.default.join(directory, entry.name);
-            if (entry.isSymbolicLink())
-                continue;
-            if ((0, rules_js_1.isUncounted)(entry.name))
-                continue;
-            if (entry.isDirectory()) {
-                pending.push(full);
-                continue;
-            }
-            if (!entry.isFile())
-                continue;
-            seen += 1;
-            if (seen > limit) {
-                truncated = true;
-                pending.length = 0;
-                break;
-            }
-            let size;
-            try {
-                size = (await (0, promises_1.stat)(full)).size;
-            }
-            catch {
-                continue;
-            }
-            const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
-            // The last rule to speak wins, across every .gitignore that governs
-            // this path. A `!` rule brings the file back and is worth reporting,
-            // because it is how "always include" is expressed.
-            /*
-              The directories above it count. Asking `decide` about the file alone
-              is what made this screen report a Unity project's whole Library as
-              going up: `/[Ll]ibrary/` speaks about the directory, so no rule
-              matched the file and every one of them looked included — while the
-              save, which has always walked the ancestors, left them all behind.
-            */
-            const rule = (0, rules_js_1.decidingRule)(relative, false, layers);
-            if (rule?.negated) {
-                keptFiles += 1;
-                keptBytes += size;
-                uploadFiles += 1;
-                uploadBytes += size;
-                excluded.push({
-                    path: relative,
-                    bytes: size,
-                    rule: `!${rule.pattern}`,
-                    forceKept: true,
-                });
-                continue;
-            }
-            if (rule) {
-                skippedFiles += 1;
-                skippedBytes += size;
-                impactBytes.set(rule.pattern, (impactBytes.get(rule.pattern) ?? 0) + size);
-                impactFiles.set(rule.pattern, (impactFiles.get(rule.pattern) ?? 0) + 1);
-                excluded.push({
-                    path: relative,
-                    bytes: size,
-                    rule: rule.pattern,
-                    forceKept: false,
-                });
-                continue;
-            }
+    const walked = options.walked ?? (await walkProject(root, options));
+    if (options.shouldStop?.())
+        return emptyEvaluation(true);
+    const truncated = walked.truncated;
+    /* Kept for this evaluation only, so no edit to the rules can outlive it. */
+    const folderAnswers = new Map();
+    for (const file of walked.files) {
+        const { path: relative, size } = file;
+        // The last rule to speak wins, across every .gitignore that governs
+        // this path. A `!` rule brings the file back and is worth reporting,
+        // because it is how "always include" is expressed.
+        /*
+          The directories above it count. Asking `decide` about the file alone
+          is what made this screen report a Unity project's whole Library as
+          going up: `/[Ll]ibrary/` speaks about the directory, so no rule
+          matched the file and every one of them looked included — while the
+          save, which has always walked the ancestors, left them all behind.
+        */
+        const rule = (0, rules_js_1.decidingRule)(relative, false, layers, folderAnswers);
+        if (rule?.negated) {
+            keptFiles += 1;
+            keptBytes += size;
             uploadFiles += 1;
             uploadBytes += size;
+            excluded.push({
+                path: relative,
+                bytes: size,
+                rule: `!${rule.pattern}`,
+                forceKept: true,
+            });
+            continue;
+        }
+        if (rule) {
+            skippedFiles += 1;
+            skippedBytes += size;
+            impactBytes.set(rule.pattern, (impactBytes.get(rule.pattern) ?? 0) + size);
+            impactFiles.set(rule.pattern, (impactFiles.get(rule.pattern) ?? 0) + 1);
+            excluded.push({
+                path: relative,
+                bytes: size,
+                rule: rule.pattern,
+                forceKept: false,
+            });
+            continue;
         }
+        uploadFiles += 1;
+        uploadBytes += size;
     }
+    /*
+      Sorted, and all of it.
+  
+      This used to hand back the four hundred largest, which was right for a
+      flat list somebody scrolls and wrong for what reads it now: the screen
+      folds these into folders, so a Unity project's Library — 45,739 files —
+      was drawn from four hundred of them and labelled "395 files" beside a
+      header that said 45,739. The grouping happens here, in this process, and
+      only the folded tree crosses to the window, so keeping all of them costs
+      an array nobody sends.
+    */
     excluded.sort((left, right) => right.bytes - left.bytes);
     const impacts = [...impactBytes.entries()]
         .map(([pattern, bytes]) => ({
@@ -1201,7 +1304,7 @@ async function evaluateRules(root, rules, options = {}) {
         keptFiles,
         keptBytes,
         impacts,
-        excluded: excluded.slice(0, 400),
+        excluded,
         truncated,
     };
 }
@@ -1496,39 +1599,60 @@ function isCredentialByName(relativePath) {
 }
 async function detectSecrets(root) {
     const found = [];
-    const pending = [root];
     let seen = 0;
-    while (pending.length && found.length < 50) {
-        const directory = pending.pop();
-        let entries;
-        try {
-            entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
-        }
-        catch {
-            continue;
-        }
-        for (const entry of entries) {
-            if (seen > 40_000)
-                return found;
-            const full = node_path_1.default.join(directory, entry.name);
-            if ((0, rules_js_1.isUncounted)(entry.name))
-                continue;
-            if (entry.isDirectory()) {
-                if (entry.name !== "node_modules")
-                    pending.push(full);
-                continue;
+    let enough = false;
+    /*
+      Every directory, eight at a time. This reads names and nothing else, so
+      it is pure waiting, and it was waiting one directory at a time over all
+      two and a half thousand of them on a real project.
+  
+      It still looks everywhere the rules do not. A credential inside a folder
+      that is currently ignored is one rule edit away from being sent, and this
+      is the check that is supposed to notice before that happens.
+    */
+    let level = [root];
+    while (level.length && !enough) {
+        const next = [];
+        let at = 0;
+        const lane = async () => {
+            while (at < level.length && !enough) {
+                const directory = level[at];
+                at += 1;
+                let entries;
+                try {
+                    entries = await (0, promises_1.readdir)(directory, { withFileTypes: true });
+                }
+                catch {
+                    continue;
+                }
+                for (const entry of entries) {
+                    if (found.length >= 50 || seen > 40_000) {
+                        enough = true;
+                        return;
+                    }
+                    const full = node_path_1.default.join(directory, entry.name);
+                    if ((0, rules_js_1.isUncounted)(entry.name))
+                        continue;
+                    if (entry.isDirectory()) {
+                        if (entry.name !== "node_modules")
+                            next.push(full);
+                        continue;
+                    }
+                    seen += 1;
+                    /*
+                      Asked of the one function rather than repeated here. These were
+                      two copies of the same rule, which is how `.env.example` came to
+                      be refused by the command line long after the service had learned
+                      that templates are not credentials.
+                    */
+                    const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
+                    if (isCredentialByName(relative))
+                        found.push(relative);
+                }
             }
-            seen += 1;
-            /*
-              Asked of the one function rather than repeated here. These were two
-              copies of the same rule, which is how `.env.example` came to be
-              refused by the command line long after the service had learned that
-              templates are not credentials.
-            */
-            const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
-            if (isCredentialByName(relative))
-                found.push(relative);
-        }
+        };
+        await Promise.all(Array.from({ length: Math.min(WALK_LANES, level.length) }, () => lane()));
+        level = next;
     }
     return found;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.30.1",
+  "version": "0.30.2",
   "description": "CodeRook from the command line, on any operating system",
   "license": "SEE LICENSE IN LICENSE.txt",
   "homepage": "https://coderook.com",