@coderook/cli 0.34.5 → 0.34.6

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.34.5",
+  "version": "0.34.6",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cbx/src/core/licences.js

@@ -21,6 +21,7 @@ exports.LICENCE_FILE = exports.DEFAULT_LICENCE = exports.LICENCES = void 0;
 exports.licenceById = licenceById;
 exports.licenceText = licenceText;
 exports.detectLicence = detectLicence;
+exports.existingLicence = existingLicence;
 exports.licenceNewProject = licenceNewProject;
 const promises_1 = require("node:fs/promises");
 const node_path_1 = __importDefault(require("node:path"));
@@ -281,6 +282,23 @@ function detectLicence(text) {
  *
  * Returns the licence written, or null when nothing was.
  */
+/*
+  The names a licence goes by, as a file or as a folder of them.
+
+  Only the exact name LICENSE was looked for, which missed nearly every way a
+  project actually carries its licence — LICENSE.md, LICENCE.txt, COPYING,
+  the LICENSE-MIT and LICENSE-APACHE pair, a licenses folder. Found by saving
+  a copy of Blender: its licences live in a folder called `license`, which on
+  Windows answers to "LICENSE" as well, so the check opened a directory and
+  the save failed. Had the folder been named anything else, the save would
+  have put an MIT licence beside Blender's GPL one.
+*/
+const LICENCE_NAME = /^(licen[cs]es?|copying|copyright|unlicen[cs]e)([-._ ].*)?$/i;
+/** The licence file or folder this folder already has, if any. */
+async function existingLicence(folder) {
+    const names = await (0, promises_1.readdir)(folder).catch(() => []);
+    return names.find((name) => LICENCE_NAME.test(name)) ?? null;
+}
 async function licenceNewProject(folder, holder, skip = false) {
     /*
       No name, no licence. A copyright line naming nobody is worse than the
@@ -289,10 +307,19 @@ async function licenceNewProject(folder, holder, skip = false) {
     */
     if (skip || !holder.trim())
         return null;
+    /* Any licence at all is somebody's decision, whatever it is called. */
+    if (await existingLicence(folder))
+        return null;
     const target = node_path_1.default.join(folder, exports.LICENCE_FILE);
-    const already = await (0, promises_1.readFile)(target, "utf8").catch(() => null);
-    if (already !== null)
+    /*
+      A nudge, never a reason to fail. A folder that cannot be written to is
+      saved without one, exactly as it would have been before this existed.
+    */
+    try {
+        await (0, promises_1.writeFile)(target, licenceText(exports.DEFAULT_LICENCE, holder.trim()), { encoding: "utf8", flag: "wx" });
+    }
+    catch {
         return null;
-    await (0, promises_1.writeFile)(target, licenceText(exports.DEFAULT_LICENCE, holder.trim()), "utf8");
+    }
     return exports.DEFAULT_LICENCE;
 }

package/dist/cbx/src/core/upload.js

@@ -932,6 +932,11 @@ class Uploader {
           objects are immutable and content-addressed, so a retry reuses them.
         */
         (0, faults_js_1.maybeFail)("submit:after-objects");
+        const counted = request.countLines
+            ? await (0, profile_js_1.timed)("count the changed lines", () => request.countLines()).catch(() => null)
+            : null;
+        const linesAdded = counted ? counted.added : request.linesAdded;
+        const linesRemoved = counted ? counted.removed : request.linesRemoved;
         const completed = await (0, profile_js_1.timed)("publish the version", () => this.call(`/v1/repositories/${repositoryId}/versions`, {
             method: "POST",
             contentType: "application/json",
@@ -950,10 +955,8 @@ class Uploader {
                 ...(request.allowIgnored ? { allowIgnored: true } : {}),
                 ...(this.trackedByGit.length ? { trackedByGit: this.trackedByGit } : {}),
                 ...(request.allowSecrets ? { allowSecrets: true } : {}),
-                ...(request.linesAdded === undefined ? {} : { linesAdded: request.linesAdded }),
-                ...(request.linesRemoved === undefined
-                    ? {}
-                    : { linesRemoved: request.linesRemoved }),
+                ...(linesAdded === undefined ? {} : { linesAdded }),
+                ...(linesRemoved === undefined ? {} : { linesRemoved }),
                 /*
                   Names this attempt so a retry after a lost connection is answered
                   with the version already made, rather than making a second one.
@@ -1155,6 +1158,22 @@ class Uploader {
           question rather than a transfer.
         */
         const inFlightByDigest = new Map();
+        /*
+          What the account already holds, asked once for the whole save.
+    
+          Asked per section, the answer changed under the save's feet. The plan
+          stores nothing, so every section of the plan heard the same answer; the
+          send stores as it goes and runs sections side by side, so a later
+          section holding a copy of a file an earlier one had just sent heard
+          "already held" and left it out of its pack. The pack's bytes, and so its
+          digest, were then not the pack the plan had priced, and the service
+          refused it as "a file that was not part of what it asked to send". A
+          copy of Blender 4.5 — 326 contents present more than once — failed this
+          way every time. One answer, taken before anything is sent, is the answer
+          the plan was given.
+        */
+        let heldOnce = null;
+        const heldAtStart = () => (heldOnce ??= (0, profile_js_1.timed)("ask what is already held", () => this.storedInBulk(repositoryId, everyDeclaration.map((one) => one.sha256))));
         const runSection = async (section) => {
             const declarations = section.files.map((file) => declarationByPath.get(file.path));
             /*
@@ -1214,7 +1233,7 @@ class Uploader {
             asking took longer than the transfer. The answer per digest is a boolean
             and an identifier, so the whole question fits in one request.
           */
-            const alreadyHeld = await (0, profile_js_1.timed)("ask what is already held", () => this.storedInBulk(repositoryId, declarations.map((one) => one.sha256)));
+            const alreadyHeld = await heldAtStart();
             /*
               The small files go first, packed together.
         

package/dist/cbx/src/core/worktree.js

@@ -33,6 +33,7 @@ exports.detectPrivateDirectories = detectPrivateDirectories;
 exports.detectPastedCredentials = detectPastedCredentials;
 exports.uploadConcerns = uploadConcerns;
 exports.isCredentialByName = isCredentialByName;
+exports.holdsOnlyCertificates = holdsOnlyCertificates;
 exports.detectSecrets = detectSecrets;
 /** Reading a project folder: changed files, diffs, and rule measurement. */
 const node_child_process_1 = require("node:child_process");
@@ -1737,6 +1738,13 @@ onScanned) {
     const wanted = include.filter((relative) => (0, secret_patterns_js_1.worthReading)(relative.slice(relative.lastIndexOf("/") + 1)));
     let cursor = 0;
     let stop = false;
+    /*
+      Every file looked at, read or passed over for its size. Reporting only
+      those read left the count short of its own total: a refused save of
+      Blender stopped on "3700 of 3747 files", which reads as a scan that gave
+      up rather than one that finished.
+    */
+    let looked = 0;
     const lane = async () => {
         for (;;) {
             if (stop)
@@ -1745,6 +1753,9 @@ onScanned) {
             cursor += 1;
             if (at >= wanted.length)
                 return;
+            looked += 1;
+            if (onScanned && looked % 50 === 0)
+                onScanned(looked, wanted.length);
             if (found.length >= MOST_FINDINGS) {
                 stop = true;
                 return;
@@ -1768,8 +1779,6 @@ onScanned) {
             }
             read += 1;
             bytes += contents.byteLength;
-            if (onScanned && read % 50 === 0)
-                onScanned(read, wanted.length);
             if (!(0, secret_patterns_js_1.looksLikeText)(contents))
                 continue;
             const credentials = (0, secret_patterns_js_1.findCredentials)(contents.toString("utf8"));
@@ -1778,6 +1787,8 @@ onScanned) {
         }
     };
     await Promise.all(Array.from({ length: Math.min(LANES, wanted.length) }, () => lane()));
+    if (onScanned && wanted.length)
+        onScanned(looked, wanted.length);
     /*
       `stop` is also set by the findings ceiling, which is a different statement
       from running out of budget — forty findings is plenty to act on, and the
@@ -1847,6 +1858,38 @@ function isCredentialByName(relativePath) {
         SECRET_SUFFIXES.some((suffix) => name.endsWith(suffix)) ||
         parts.slice(0, -1).includes("secrets"));
 }
+/*
+  A `.pem` is a container, not a kind of file.
+
+  It holds a private key as readily as a certificate, and the name cannot
+  tell the two apart — so every one was refused. That refused Blender: its
+  bundled Python carries `certifi/cacert.pem` twice, Mozilla's list of the
+  certificate authorities a program should trust, which ships inside every
+  pip there is and is public by design. A certificate is the half of a key
+  pair that exists to be handed out.
+
+  So a `.pem` is opened and judged by its blocks. Only certificates (and
+  revocation lists) clear it; a private key anywhere in it, a block of any
+  other kind, no blocks at all, or a file too large or unreadable to look
+  at all leave it a credential, as before.
+*/
+const CERTIFICATE_BUNDLE_LIMIT = 4 * 1024 * 1024;
+async function holdsOnlyCertificates(full) {
+    try {
+        const info = await (0, promises_1.stat)(full);
+        if (info.size > CERTIFICATE_BUNDLE_LIMIT)
+            return false;
+        const text = await (0, promises_1.readFile)(full, "latin1");
+        if (/PRIVATE KEY/i.test(text))
+            return false;
+        const blocks = text.match(/-----BEGIN [A-Z0-9 ]+-----/g) ?? [];
+        return (blocks.length > 0 &&
+            blocks.every((block) => /^-----BEGIN (TRUSTED |X509 )?(CERTIFICATE|CRL)-----$/.test(block)));
+    }
+    catch {
+        return false;
+    }
+}
 async function detectSecrets(root) {
     const found = [];
     let seen = 0;
@@ -1896,8 +1939,12 @@ async function detectSecrets(root) {
                       that templates are not credentials.
                     */
                     const relative = node_path_1.default.relative(root, full).split(node_path_1.default.sep).join("/");
-                    if (isCredentialByName(relative))
-                        found.push(relative);
+                    if (!isCredentialByName(relative))
+                        continue;
+                    if (entry.name.toLowerCase().endsWith(".pem") && (await holdsOnlyCertificates(full))) {
+                        continue;
+                    }
+                    found.push(relative);
                 }
             }
         };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.34.5",
+  "version": "0.34.6",
   "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
   "license": "Apache-2.0",
   "homepage": "https://coderook.com",