@coderook/cli 0.42.6 → 0.42.7

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "coderook",
   "displayName": "CodeRook",
   "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.42.6",
+  "version": "0.42.7",
   "author": {
     "name": "ACCA Gaming Productions",
     "url": "https://coderook.com"

package/dist/cbx/src/core/upload.js

@@ -1938,9 +1938,63 @@ class Uploader {
             return priorByDigest.get(declaration.sha256) ?? null;
         };
         const keptAsItWas = (declaration) => storedAs(declaration) !== null;
-        const declarations = hashed.declarations.filter((one) => !keptAsItWas(one));
+        /*
+          A copy left stale by somebody else's save is not an edit.
+    
+          Both callers select everything, so a file nobody touched here is still
+          "selected". When the version this save starts from holds a newer copy,
+          merged in from somebody else, the untouched old bytes on this disk
+          differ from it, and they were sent as though they were a change: the
+          second unrelated save after a colleague's edit put their file back to
+          what it was (state-matrix R1, reproduced 2026-11-06: v4 reverted v2).
+    
+          What the file IS decides it, not where it sits: bytes identical to what
+          this folder last received (request.known) are not this person's work.
+          The version's own copy is kept, and the folder's record still says it
+          received the old bytes, so the file shows as behind until fetched. A
+          file the version no longer holds at all was removed by somebody else,
+          and an untouched copy here does not bring it back.
+        */
+        const received = request.known ?? null;
+        const staleHere = new Set();
+        if (received && prior.size) {
+            for (const one of hashed.declarations) {
+                if (received[one.path] !== one.sha256)
+                    continue;
+                const now = prior.get(one.path);
+                if (now && now.sha256 === one.sha256)
+                    continue;
+                staleHere.add(one.path);
+            }
+        }
+        const declarations = hashed.declarations.filter((one) => !staleHere.has(one.path) && !keptAsItWas(one));
         let totalBytes = hashed.totalBytes;
         for (const one of hashed.declarations) {
+            if (!staleHere.has(one.path))
+                continue;
+            totalBytes -= one.size;
+            const now = prior.get(one.path);
+            if (!now) {
+                ticked.delete(one.path);
+                continue;
+            }
+            reused.push({
+                path: one.path,
+                sourceSize: now.sourceSize,
+                storedSize: now.storedSize,
+                mediaType: now.mediaType,
+                added: 0,
+                removed: 0,
+                included: true,
+                deleted: false,
+                binary: false,
+                lines: 0,
+            });
+        }
+        (0, profile_js_1.counted)("stale copies kept as the version has them", staleHere.size);
+        for (const one of hashed.declarations) {
+            if (staleHere.has(one.path))
+                continue;
             const held = storedAs(one);
             if (!held)
                 continue;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coderook/cli",
-  "version": "0.42.6",
+  "version": "0.42.7",
   "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
   "license": "Apache-2.0",
   "homepage": "https://coderook.com",