@coderook/cli 0.42.7 → 0.44.0

package/.claude-plugin/plugin.json

@@ -1,19 +1,19 @@
-{
-  "name": "coderook",
-  "displayName": "CodeRook",
-  "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
-  "version": "0.42.7",
-  "author": {
-    "name": "ACCA Gaming Productions",
-    "url": "https://coderook.com"
-  },
-  "homepage": "https://coderook.com/docs#assistants",
-  "license": "Apache-2.0",
-  "keywords": [
-    "coderook",
-    "versioning",
-    "snapshots",
-    "backup",
-    "git"
-  ]
-}
+{
+  "name": "coderook",
+  "displayName": "CodeRook",
+  "description": "Save, browse and restore whole-snapshot versions of a project on CodeRook, with cbx or plain git, from Claude Code.",
+  "version": "0.44.0",
+  "author": {
+    "name": "ACCA Gaming Productions",
+    "url": "https://coderook.com"
+  },
+  "homepage": "https://coderook.com/docs#assistants",
+  "license": "Apache-2.0",
+  "keywords": [
+    "coderook",
+    "versioning",
+    "snapshots",
+    "backup",
+    "git"
+  ]
+}

package/dist/cli/src/api.js

@@ -52,6 +52,7 @@ exports.tokens = tokens;
 exports.getPrivatePaths = getPrivatePaths;
 exports.putPrivatePaths = putPrivatePaths;
 exports.callApi = callApi;
+exports.callApiBytes = callApiBytes;
 exports.revokeToken = revokeToken;
 exports.deleteProject = deleteProject;
 exports.projectLabels = projectLabels;
@@ -851,6 +852,35 @@ async function putPrivatePaths(repositoryId, patterns) {
 async function callApi(route, options = {}) {
     return call(route, options);
 }
+/** A GET whose answer is bytes, not JSON (a draft's raw file). Errors still arrive as JSON. */
+async function callApiBytes(route) {
+    const token = await (0, config_js_1.loadToken)();
+    if (!token)
+        throw new Error("Not signed in. Run: cbx sign-in");
+    const response = await fetch(`${(0, config_js_1.apiOrigin)()}${route}`, {
+        headers: {
+            accept: "application/octet-stream, application/json",
+            authorization: `Bearer ${token}`,
+            "user-agent": "CodeRook-CLI/0.1",
+            ...(0, identify_js_1.clientHeaders)(),
+        },
+        signal: AbortSignal.timeout(REQUEST_DEADLINE_MS),
+    });
+    if (!response.ok) {
+        const text = await response.text();
+        let body = {};
+        try {
+            body = text ? JSON.parse(text) : {};
+        }
+        catch {
+            /* not JSON */
+        }
+        if (response.status === 401)
+            throw new Error("That token was not accepted. Run: cbx sign-in");
+        throw new ServiceError(body.error?.message ?? `${route} failed (${response.status})`, response.status, typeof body.error?.code === "string" ? body.error.code : null);
+    }
+    return new Uint8Array(await response.arrayBuffer());
+}
 async function revokeToken(tokenId) {
     await call(`/v1/account/tokens/${encodeURIComponent(tokenId)}`, {
         method: "DELETE",

package/dist/cli/src/cli.js

@@ -739,7 +739,7 @@ async function commandImport(parsed) {
         flags: submitFlags,
     });
     if (code === 0 && plan.temporary) {
-        console.log(dim(`The working copy stays at ${plan.folder} until you remove it.
+        console.log(dim(`The working copy stays at ${plan.folder} until you remove it.
 ` +
             `Run ${accent("cbx get " + plan.name)} anywhere to fetch it fresh.`));
     }
@@ -1025,17 +1025,17 @@ async function commandSubmit(parsed) {
     */
     const shielded = (await (0, worktree_js_1.detectPrivateDirectories)(folder)).filter((finding) => [...sending].some((file) => file === finding.path || file.startsWith(`${finding.path}/`)));
     if (shielded.length && !hasFlag(parsed, "allow-private")) {
-        console.log(red(`
+        console.log(red(`
 ${shielded.length} folder${shielded.length === 1 ? "" : "s"} here belong${shielded.length === 1 ? "s" : ""} to a program, not to your project:`));
         for (const finding of shielded) {
             console.log(`  ${finding.path}  ${dim(`— ${finding.because}`)}`);
         }
-        console.log(`
+        console.log(`
 Nothing was sent. To leave them behind:`);
         for (const finding of shielded) {
             console.log(`  ${accent(`echo "${finding.rule}" >> .gitignore`)}`);
         }
-        console.error(`
+        console.error(`
 Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
         return 1;
     }
@@ -1084,7 +1084,7 @@ Or pass ${accent("--allow-private")} if they genuinely belong in the project.`);
             `rest were not opened.`));
     }
     if (stillPasted.length) {
-        console.log(red(`
+        console.log(red(`
 ${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s have credentials"} inside:`));
         for (const finding of stillPasted.slice(0, 20)) {
             console.log(`  ${finding.path}`);
@@ -1099,11 +1099,11 @@ ${stillPasted.length} file${stillPasted.length === 1 ? " has a credential" : "s
             console.log(dim(`  …and ${stillPasted.length - 20} more`));
         }
         if (!hasFlag(parsed, "allow-secrets")) {
-            console.error(`
+            console.error(`
 Nothing was sent. Move the key into an environment variable, and if` +
                 ` it has ever been published, replace it at the service that issued` +
                 ` it — a key that has leaked stays leaked.` +
-                `
+                `
 Pass ${accent("--allow-secrets")} if these are not real keys.`);
             return 1;
         }
@@ -1309,7 +1309,7 @@ Pass ${accent("--allow-secrets")} if these are not real keys.`);
                 continue;
             }
             if (failure?.kind === "interrupted") {
-                console.error(red(`
+                console.error(red(`
 The connection failed: ${text}`));
                 console.error(`Your work may already have been saved. Run the same command again —` +
                     ` it will not create a second version.`);
@@ -1566,7 +1566,7 @@ async function commandGet(parsed) {
                     `changed while the interrupted fetch was stopped:`));
                 for (const file of changedInTheGap.slice(0, 20))
                     console.error(`  ${file.path}`);
-                console.error(`
+                console.error(`
 Save them with ${accent("cbx submit")}, or finish the fetch and ` +
                     `discard them with ${accent("cbx get --replace")}.`);
                 return 1;
@@ -1849,8 +1849,8 @@ async function suggestRules(folder, apply) {
     const addition = (0, detect_js_1.rulesFromSuggestions)(recommended);
     const shared = rules.shared.trimEnd();
     await (0, worktree_js_1.writeRules)(folder, {
-        shared: shared ? `${shared}
-
+        shared: shared ? `${shared}
+
 ${addition}` : addition,
         local: rules.local,
     });
@@ -2055,7 +2055,7 @@ async function commandMerges(parsed) {
         const counts = merge.conflicts;
         console.log(`${accent(merge.reference)}  ${counts ? `${counts.unresolved} of ${counts.total} still to decide` : ""}  ${dim(new Date(merge.createdAt).toLocaleString())}`);
     }
-    console.log(dim(`
+    console.log(dim(`
 Run cbx merge <reference> to look at one.`));
     return 0;
 }
@@ -2158,7 +2158,7 @@ async function commandMerge(parsed) {
             console.log(dim(`  waiting on ${waiting.map((person) => person.displayName).join(", ")}`));
         }
     }
-    console.log(`
+    console.log(`
 ${accent(now.mergeTrack.reference)} · ` +
         /*
           The combined version is only counted once it can be built; until then
@@ -2177,7 +2177,7 @@ ${accent(now.mergeTrack.reference)} · ` +
             return 1;
         }
         const applied = await (0, api_js_1.applyMerge)(summary.id);
-        console.log(`
+        console.log(`
 Applied as ${accent(`v${applied.version.sequence}`)}.`);
         if (applied.closedIssues?.length) {
             console.log(`Closed ${applied.closedIssues.map((number) => `#${number}`).join(", ")}.`);
@@ -2187,13 +2187,13 @@ Applied as ${accent(`v${applied.version.sequence}`)}.`);
     }
     const stillOpen = now.conflicts.some((conflict) => !conflict.resolvedAt);
     if (!decision && stillOpen) {
-        console.log(dim(`
+        console.log(dim(`
 --mine keeps yours, --theirs keeps what was already saved,` +
-            ` --both keeps theirs and saves yours beside it, --drop removes the file.
+            ` --both keeps theirs and saves yours beside it, --drop removes the file.
 Add --path <file> for one file, then --apply when ready.`));
     }
     else if (now.provisional.ready) {
-        console.log(dim(`
+        console.log(dim(`
 Run cbx merge ${now.mergeTrack.reference} --apply to publish it.`));
     }
     return 0;
@@ -2786,9 +2786,9 @@ const SPECS = [
         name: "workspace",
         group: "Workspaces",
         summary: "edit, save and run a private project remotely without a checkout",
-        usage: "workspace | workspace <usage|open|list|show|read|files|search|diff|patch|save|run|logs|cancel|deploy|preview|handoff|close|recipe|assign|assignments|unassign|checkout|say|thread|mute|unmute> <project> [workspace] [job] | workspace push [folder]",
+        usage: "workspace | workspace <usage|open|list|show|read|files|search|diff|patch|put|starter|review|reviewers|save|run|logs|cancel|deploy|preview|handoff|close|recipe|assign|assignments|unassign|checkout|say|thread|mute|unmute> <project> [workspace] [job] | workspace put <project> <workspace> <path…> | workspace push [folder] | workspace watch [project] [workspace]",
         brief: "workspace <action> <project>",
-        detail: "Works on CodeRook's durable remote draft, never the current local folder. Use --data-file for structured edits or recipe configuration. Mutations need the reviewed --revision and a unique --key; reuse the same key and request when retrying. Recipes reference existing project workflows. Usage reads the shared workspace credits and separate PR allowance without a draft ID. Saving and deploying are separate operations. Run on its own at a terminal, it lists your open workspaces with their unread messages: choose one to see its changes and what is being discussed, and reply, save, run checks, hand it over or close it with one key. say and thread post to and read a workspace's discussion as JSON; a machine signed in to your account can name itself with --as (or CBX_NAME) so its messages and unread count are its own.",
+        detail: "Works on CodeRook's durable remote draft, never the current local folder. Use --data-file for structured edits or recipe configuration. Mutations need the reviewed --revision and a unique --key; reuse the same key and request when retrying. Recipes reference existing project workflows. Usage reads the shared workspace credits and separate PR allowance without a draft ID. put copies files from this folder into a draft: text as text, images, fonts and other binary files as bytes (up to 1 MiB each), a file that is gone here is removed there, and each file must still be the version the draft holds, so a teammate's edit is never overwritten. starter reads this folder (package.json scripts, Cargo.toml, go.mod, Python) and suggests one check recipe per package so drafts have something to run; --apply adds them, never replacing a recipe that exists. review shows who must OK a draft before it is saved or deployed; --ok or --changes -m gives your verdict on the current revision, and counts only from the reviewer's own sign-in or token, never a name given with --as. reviewers lists the project's rules, and an administrator sets them with --data-file. Saving and deploying are separate operations. Run on its own at a terminal, it lists your open workspaces with their unread messages: choose one to see its changes and what is being discussed, and reply, save, run checks, hand it over or close it with one key. say and thread post to and read a workspace's discussion as JSON; a machine signed in to your account can name itself with --as (or CBX_NAME) so its messages and unread count are its own. watch prints each new message, each message addressed to you (@your name, or the name given with --as) and each new saved version as it happens, until stopped; --json gives one JSON object per line for a program.",
         options: [
             { flags: "--data-file <path>", description: "read an operation's JSON from this local file" },
             { flags: "--name <name>", description: "name a new workspace" },
@@ -2813,8 +2813,14 @@ const SPECS = [
             { flags: "--unread", description: "thread: only messages this reader has not read" },
             { flags: "--peek", description: "thread: read without marking anything read" },
             { flags: "--after <time>", description: "thread: continue from the next page's time" },
+            { flags: "--root <folder>", description: "put/starter: the project folder (default: here)" },
+            { flags: "--apply", description: "starter: create the suggested workflows and recipes" },
+            { flags: "--ok", description: "review: approve the draft's current revision" },
+            { flags: "--changes", description: "review: ask for changes (say what with -m)" },
+            { flags: "--json", description: "watch: one JSON object per line; starter: the plan as JSON" },
+            { flags: "--interval <seconds>", description: "watch: how often to look (default 20, at least 5)" },
         ],
-        examples: ["cbx workspace open my-project --name \"Laptop work\" --key laptop-open-001", "cbx workspace list my-project", "cbx workspace assign my-project <draft> --name Laptop", "cbx workspace checkout my-project <draft>", "cbx workspace push --save -m \"Fix the export dialog\"", "cbx workspace", "cbx workspace say my-project <draft> -m \"Tests updated\" --as GrokBot", "cbx workspace thread my-project <draft> --unread"],
+        examples: ["cbx workspace open my-project --name \"Laptop work\" --key laptop-open-001", "cbx workspace list my-project", "cbx workspace assign my-project <draft> --name Laptop", "cbx workspace checkout my-project <draft>", "cbx workspace push --save -m \"Fix the export dialog\"", "cbx workspace", "cbx workspace say my-project <draft> -m \"Tests updated\" --as GrokBot", "cbx workspace thread my-project <draft> --unread", "cbx workspace watch my-project --as GrokBot --json", "cbx workspace put my-project <draft> website/app/page.tsx website/public/og.png", "cbx workspace starter my-project --apply", "cbx workspace review my-project <draft> --ok -m \"Matches the concept\""],
         run: workspace_command_js_1.commandWorkspace,
     },
     {

package/dist/cli/src/workspace_command.js

@@ -9,6 +9,10 @@ const api_js_1 = require("./api.js");
 const config_js_1 = require("./config.js");
 const workspace_machine_js_1 = require("./workspace_machine.js");
 const workspace_threads_js_1 = require("./workspace_threads.js");
+const workspace_put_js_1 = require("./workspace_put.js");
+const workspace_review_js_1 = require("./workspace_review.js");
+const workspace_starter_js_1 = require("./workspace_starter.js");
+const workspace_watch_js_1 = require("./workspace_watch.js");
 async function commandWorkspace(parsed) {
     const [operation, projectRef, workspace, runId] = parsed.positional;
     if (operation && workspace_machine_js_1.MACHINE_OPERATIONS.has(operation))
@@ -16,12 +20,29 @@ async function commandWorkspace(parsed) {
     /* On its own at a terminal: choose a workspace and see what is being discussed. Scripts get the usage line as before. */
     if (!operation && process.stdin.isTTY && process.stdout.isTTY)
         return (0, workspace_threads_js_1.interactiveWorkspaces)(parsed);
+    /* Every draft you can read when no project is named. */
+    if (operation === "watch")
+        return (0, workspace_watch_js_1.commandWorkspaceWatch)(parsed);
     if (!operation || !projectRef)
         throw new Error("Use cbx workspace <operation> <project> [workspace]. See cbx help workspace.");
     const project = await (0, api_js_1.findProject)(projectRef);
     if (!project)
         throw new Error(`No accessible project ${projectRef}`);
     const root = `/v1/repositories/${encodeURIComponent(project.id)}`;
+    if (operation === "starter")
+        return (0, workspace_starter_js_1.commandWorkspaceStarter)(parsed, root);
+    if (operation === "reviewers")
+        return (0, workspace_review_js_1.commandWorkspaceReviewers)(parsed, root);
+    if (operation === "review") {
+        if (!workspace)
+            throw new Error("Supply the workspace ID after the project");
+        return (0, workspace_review_js_1.commandWorkspaceReview)(parsed, root, workspace);
+    }
+    if (operation === "put") {
+        if (!workspace)
+            throw new Error("Supply the workspace ID after the project");
+        return (0, workspace_put_js_1.commandWorkspacePut)(parsed, root, workspace);
+    }
     if (workspace_threads_js_1.THREAD_OPERATIONS.has(operation)) {
         if (!workspace)
             throw new Error("Supply the workspace ID after the project");

package/dist/cli/src/workspace_machine.js

@@ -36,6 +36,7 @@ const api_js_1 = require("./api.js");
 const config_js_1 = require("./config.js");
 const machine_js_1 = require("./machine.js");
 const colour_js_1 = require("./colour.js");
+const workspace_put_js_1 = require("./workspace_put.js");
 const RECORD = node_path_1.default.join(".coderook", "workspace.json");
 /* The draft's own limit per text file (backend remote_workspaces.ts MAX_EDIT_BYTES). */
 const MAX_FILE = 1024 * 1024;
@@ -45,7 +46,6 @@ const MAX_FILE = 1024 * 1024;
   well under the cap.
 */
 const MAX_REQUEST = 2 * 1024 * 1024;
-const MAX_BATCH = 1536 * 1024;
 const encodedSize = (change) => Buffer.byteLength(JSON.stringify(change));
 /** One draft text file in full, from the line-paged read (2,000 lines a request). */
 async function readWhole(draft, filePath, read = (route) => (0, api_js_1.callApi)(route)) {
@@ -179,14 +179,14 @@ async function checkout(found, draft, workspaceId, into) {
                 if (change.after.content === null && change.after.reason?.startsWith("page byte limit")) {
                     change.after.content = await readWhole(draft, change.path);
                 }
-                if (change.after.content === null) {
-                    throw new Error(`The draft's copy of ${change.path} could not be read as text (${change.after.reason ?? "unreadable"}).`);
-                }
-                if (sha(change.after.content) !== change.after.sha256) {
+                /* Not text (an image, a font, an archive): its exact bytes, from the draft's raw read. */
+                const body = change.after.content ??
+                    (await (0, api_js_1.callApiBytes)(`${draft}/raw?path=${encodeURIComponent(change.path)}`));
+                if (sha(body) !== change.after.sha256) {
                     throw new Error(`The draft's copy of ${change.path} did not arrive exactly; nothing was overwritten past it. Try again.`);
                 }
                 await (0, promises_1.mkdir)(node_path_1.default.dirname(target), { recursive: true });
-                await (0, promises_1.writeFile)(target, change.after.content);
+                await (0, promises_1.writeFile)(target, body);
                 manifest[change.path] = change.after.sha256;
             }
             edited += 1;
@@ -216,6 +216,8 @@ async function push(parsed, where) {
     const rules = await (0, worktree_js_1.readRules)(folder);
     const found = await (0, worktree_js_1.changedFiles)(folder, rules, new Map(Object.entries(record.files)), "synchronize");
     const changes = [];
+    const sent = new Map();
+    const sizes = new Map();
     const refused = [];
     for (const file of found) {
         if (file.path === RECORD.replaceAll("\\", "/") || file.path.startsWith(".coderook/"))
@@ -225,11 +227,14 @@ async function push(parsed, where) {
             continue;
         }
         const bytes = await (0, promises_1.readFile)(node_path_1.default.join(folder, ...file.path.split("/")));
-        if (bytes.length > MAX_FILE || bytes.includes(0)) {
+        if (bytes.length > MAX_FILE) {
             refused.push(file.path);
             continue;
         }
-        const change = { path: file.path, content: bytes.toString("utf8"), expectedSha256: record.files[file.path] ?? null };
+        /* Text as text; images, fonts and other binary files as base64. */
+        const change = { path: file.path, ...(0, workspace_put_js_1.encodeFile)(bytes), expectedSha256: record.files[file.path] ?? null };
+        sent.set(file.path, sha(bytes));
+        sizes.set(file.path, bytes.length);
         /* Under 1 MiB but so full of escapes that it cannot travel in one request. */
         if (encodedSize(change) > MAX_REQUEST - 64 * 1024) {
             refused.push(file.path);
@@ -238,7 +243,7 @@ async function push(parsed, where) {
         changes.push(change);
     }
     if (refused.length) {
-        console.error((0, colour_js_1.red)(`${refused.length} file${refused.length === 1 ? " is" : "s are"} binary or over 1 MiB, which a draft cannot take:`));
+        console.error((0, colour_js_1.red)(`${refused.length} file${refused.length === 1 ? " is" : "s are"} over 1 MiB, which a draft cannot take:`));
         for (const one of refused.slice(0, 20))
             console.error(`  ${one}`);
         console.error((0, colour_js_1.dim)("Nothing was sent. Leave them out, or save them with a normal upload from a linked folder."));
@@ -256,18 +261,7 @@ async function push(parsed, where) {
     }
     // In batches the draft accepts, each against the revision the last one made.
     let revision = record.revision;
-    for (let start = 0; start < changes.length;) {
-        const batch = [];
-        let bytes = 0;
-        while (start < changes.length) {
-            const next = changes[start];
-            const size = encodedSize(next);
-            if (batch.length && bytes + size > MAX_BATCH)
-                break;
-            batch.push(next);
-            bytes += size;
-            start += 1;
-        }
+    for (const batch of (0, workspace_put_js_1.batches)(changes, sizes)) {
         const result = await (0, api_js_1.callApi)(`${draft}/changes`, {
             method: "POST",
             body: { expectedRevision: revision, operationKey: key("push"), changes: batch },
@@ -277,7 +271,7 @@ async function push(parsed, where) {
             if (one.remove)
                 delete record.files[one.path];
             else
-                record.files[one.path] = sha(one.content);
+                record.files[one.path] = sent.get(one.path);
         }
         record.revision = revision;
         await writeRecord(folder, record);

package/dist/cli/src/workspace_put.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.encodeFile = encodeFile;
+exports.projectPath = projectPath;
+exports.batches = batches;
+exports.editKey = editKey;
+exports.commandWorkspacePut = commandWorkspacePut;
+/**
+ * cbx workspace put <project> <workspace> <path…>
+ *
+ * Copies files from this computer into a draft: the step every teammate and
+ * assistant otherwise scripts by hand (read the file, look up the hash the
+ * draft holds, build the JSON, keep under the request limits).
+ *
+ * - Text goes as content; anything else (images, fonts, archives, anything
+ *   with a NUL byte or invalid UTF-8) goes as contentBase64.
+ * - A path that no longer exists here is removed from the draft.
+ * - Each change carries the hash the draft holds for that path, so a file a
+ *   teammate changed meanwhile is refused instead of overwritten.
+ * - Large sets are split into several edits (32 files or 1 MiB each), and
+ *   each edit's key is derived from what it sends, so running the same
+ *   command again after a dropped connection does not apply anything twice.
+ */
+const node_crypto_1 = require("node:crypto");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const api_js_1 = require("./api.js");
+const MAX_FILES = 32;
+const MAX_BYTES = 1024 * 1024;
+/* A request may be 2 MiB; escaping and base64 make the JSON larger than the bytes, so keep well under. */
+const MAX_JSON = 1536 * 1024;
+/** UTF-8 text with no NUL byte travels as text; every other file as base64. */
+function encodeFile(bytes) {
+    if (!bytes.includes(0)) {
+        try {
+            return { content: new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(bytes) };
+        }
+        catch {
+            /* not UTF-8: fall through to base64 */
+        }
+    }
+    return { contentBase64: Buffer.from(bytes).toString("base64") };
+}
+/** A project-relative path with forward slashes, refusing anything outside the root. */
+function projectPath(root, given) {
+    const full = (0, node_path_1.isAbsolute)(given) ? given : (0, node_path_1.resolve)(root, given);
+    const rel = (0, node_path_1.relative)(root, full);
+    if (!rel || rel.startsWith("..") || (0, node_path_1.isAbsolute)(rel))
+        throw new Error(`${given} is outside ${root}; run from the project folder or pass --root`);
+    return rel.split(node_path_1.sep).join("/");
+}
+/**
+ * Groups changes into edits the service accepts: at most 32 files, 1 MiB of
+ * file content and 1.5 MiB of JSON each. `sizes` gives each path's bytes on disk.
+ */
+function batches(changes, sizes) {
+    const out = [];
+    let current = [];
+    let bytes = 0;
+    let json = 0;
+    for (const change of changes) {
+        const size = sizes.get(change.path) ?? 0;
+        const encoded = Buffer.byteLength(JSON.stringify(change));
+        if (current.length && (current.length >= MAX_FILES || bytes + size > MAX_BYTES || json + encoded > MAX_JSON)) {
+            out.push(current);
+            current = [];
+            bytes = 0;
+            json = 0;
+        }
+        current.push(change);
+        bytes += size;
+        json += encoded;
+    }
+    if (current.length)
+        out.push(current);
+    return out;
+}
+/** A key that is the same whenever the same edit is sent to the same revision. */
+function editKey(revision, changes) {
+    const hash = (0, node_crypto_1.createHash)("sha256").update(JSON.stringify([revision, changes])).digest("hex");
+    return `put-${revision}-${hash.slice(0, 40)}`;
+}
+async function commandWorkspacePut(parsed, root, workspace) {
+    const paths = parsed.positional.slice(3);
+    if (!paths.length)
+        throw new Error("Name the files to put: cbx workspace put <project> <workspace> <path…>");
+    const folder = (0, node_path_1.resolve)(String(parsed.flags.get("root") ?? process.cwd()));
+    const draft = `${root}/workspaces/${encodeURIComponent(workspace)}`;
+    const wanted = [...new Set(paths.map((p) => projectPath(folder, p)))];
+    /* The hashes the draft holds now; the listing pages 500 at a time, so stop once every wanted path is found. */
+    const held = new Map();
+    for (let offset = 0; offset !== null && held.size < wanted.length;) {
+        const page = await (0, api_js_1.callApi)(`${draft}/files?offset=${offset}`);
+        for (const f of page.files)
+            if (wanted.includes(f.path))
+                held.set(f.path, f.sha256);
+        offset = page.nextOffset;
+    }
+    const changes = [];
+    const unchanged = [];
+    const sizes = new Map();
+    for (const path of wanted) {
+        const local = (0, node_path_1.join)(folder, ...path.split("/"));
+        const exists = await (0, promises_1.stat)(local).then((s) => s.isFile(), () => false);
+        if (!exists) {
+            const sha = held.get(path);
+            if (!sha)
+                throw new Error(`${path} is neither here nor in the draft`);
+            changes.push({ path, remove: true, expectedSha256: sha });
+            continue;
+        }
+        const bytes = await (0, promises_1.readFile)(local);
+        if (bytes.length > MAX_BYTES)
+            throw new Error(`${path} is ${bytes.length} bytes; a draft takes files up to 1 MiB. Save larger files with cbx submit.`);
+        /* Already what the draft holds: nothing to send, so running put twice changes nothing. */
+        if ((0, node_crypto_1.createHash)("sha256").update(bytes).digest("hex") === held.get(path)) {
+            unchanged.push(path);
+            continue;
+        }
+        sizes.set(path, bytes.length);
+        changes.push({ path, ...encodeFile(bytes), expectedSha256: held.get(path) ?? null });
+    }
+    if (!changes.length) {
+        console.log(JSON.stringify({ workspace, written: [], removed: [], binary: [], unchanged }, null, 2));
+        return 0;
+    }
+    let revision = parsed.flags.has("revision")
+        ? Number(parsed.flags.get("revision"))
+        : (await (0, api_js_1.callApi)(draft)).workspace.revision;
+    const written = [];
+    const removed = [];
+    const binary = [];
+    for (const batch of batches(changes, sizes)) {
+        const out = await (0, api_js_1.callApi)(`${draft}/changes`, {
+            method: "POST",
+            body: { expectedRevision: revision, operationKey: editKey(revision, batch), changes: batch },
+        });
+        revision = out.workspace.revision;
+        for (const c of batch) {
+            if ("remove" in c)
+                removed.push(c.path);
+            else
+                written.push(c.path);
+            if ("contentBase64" in c)
+                binary.push(c.path);
+        }
+    }
+    console.log(JSON.stringify({ workspace, revision, written, removed, binary, unchanged }, null, 2));
+    return 0;
+}

package/dist/cli/src/workspace_review.js

@@ -0,0 +1,99 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeReviewer = describeReviewer;
+exports.commandWorkspaceReview = commandWorkspaceReview;
+exports.commandWorkspaceReviewers = commandWorkspaceReviewers;
+/**
+ * cbx workspace review <project> <workspace> --ok [-m "…"] | --changes -m "…"
+ * cbx workspace reviewers <project> [--data-file rules.json]
+ *
+ * The CLI side of the review gate (backend workspace_reviews.ts). A review
+ * counts only from the reviewer's own sign-in or token, so --as is refused
+ * here before the service refuses it, with the reason.
+ */
+const promises_1 = require("node:fs/promises");
+const api_js_1 = require("./api.js");
+const colour_js_1 = require("./colour.js");
+const flag = (parsed, ...names) => {
+    for (const name of names) {
+        const value = parsed.flags.get(name);
+        if (typeof value === "string")
+            return value;
+    }
+    return undefined;
+};
+/** One line per reviewer: a word for where it stands, never only a colour. */
+function describeReviewer(s, revision) {
+    const when = [s.beforeSave && "save", s.beforeDeploy && "deploy"].filter(Boolean).join(" + ");
+    if (!s.applies)
+        return `${(0, colour_js_1.dim)("not needed")}  ${s.label} ${(0, colour_js_1.dim)(`(no changes in its paths)`)}`;
+    const word = s.state === "ok"
+        ? (0, colour_js_1.green)("OK        ")
+        : s.state === "changes"
+            ? (0, colour_js_1.red)("changes   ")
+            : s.state === "outdated"
+                ? "outdated  "
+                : (0, colour_js_1.dim)("waiting   ");
+    const detail = s.state === "outdated"
+        ? `OK was for revision ${s.revision}, draft is at ${revision}`
+        : s.state === "changes" || (s.state === "ok" && s.note)
+            ? s.note
+            : "";
+    return `${word}${(0, colour_js_1.bold)(s.label)} ${(0, colour_js_1.dim)(`before ${when}`)}${detail ? `  ${detail}` : ""}`;
+}
+async function commandWorkspaceReview(parsed, root, workspace) {
+    if (parsed.flags.has("as") || process.env.CBX_NAME)
+        throw new Error("A review counts only from the reviewer's own sign-in or token; run it without --as or CBX_NAME.");
+    const ok = parsed.flags.has("ok");
+    const changes = parsed.flags.has("changes");
+    const draft = `${root}/workspaces/${encodeURIComponent(workspace)}`;
+    if (ok === changes) {
+        /* Neither: show where the draft stands. */
+        const shown = await (0, api_js_1.callApi)(draft);
+        const review = shown.review ?? [];
+        if (parsed.flags.has("json"))
+            console.log(JSON.stringify({ revision: shown.workspace.revision, review }, null, 2));
+        else if (!review.length)
+            console.log("This project names no reviewers. An administrator sets them with cbx workspace reviewers.");
+        else
+            for (const s of review)
+                console.log(describeReviewer(s, shown.workspace.revision));
+        return 0;
+    }
+    const note = flag(parsed, "m", "message") ?? "";
+    if (changes && !note.trim())
+        throw new Error('Say what needs to change: --changes -m "…"');
+    const revision = parsed.flags.has("revision")
+        ? Number(parsed.flags.get("revision"))
+        : (await (0, api_js_1.callApi)(draft)).workspace.revision;
+    const out = await (0, api_js_1.callApi)(`${draft}/reviews`, {
+        method: "POST",
+        body: { verdict: ok ? "ok" : "changes", note, expectedRevision: revision },
+    });
+    if (parsed.flags.has("json"))
+        console.log(JSON.stringify(out, null, 2));
+    else {
+        console.log(`${ok ? (0, colour_js_1.green)("OK") : (0, colour_js_1.red)("Changes asked")} on revision ${revision}.`);
+        for (const s of out.review)
+            console.log(`  ${describeReviewer(s, revision)}`);
+    }
+    return 0;
+}
+async function commandWorkspaceReviewers(parsed, root) {
+    const source = flag(parsed, "data-file");
+    const rules = source
+        ? (await (0, api_js_1.callApi)(`${root}/workspace-review-rules`, {
+            method: "PUT",
+            body: { rules: JSON.parse(await (0, promises_1.readFile)(source, "utf8")) },
+        })).rules
+        : (await (0, api_js_1.callApi)(`${root}/workspace-review-rules`)).rules;
+    if (parsed.flags.has("json") || source)
+        console.log(JSON.stringify({ rules }, null, 2));
+    else if (!rules.length)
+        console.log(`No reviewers. Set them from a JSON list with ${(0, colour_js_1.accent)("cbx workspace reviewers <project> --data-file rules.json")}:\n` +
+            (0, colour_js_1.dim)('  [{"reviewer":"token:<id>","label":"UX Bot","paths":["website/"],"beforeSave":true,"beforeDeploy":false,"ownerMayOverride":false}]'));
+    else
+        for (const r of rules)
+            console.log(`${(0, colour_js_1.bold)(r.label)} ${(0, colour_js_1.dim)(r.reviewer)}  ${r.paths.length ? r.paths.join(", ") : "every path"}  ${(0, colour_js_1.dim)(`before ${[r.beforeSave && "save", r.beforeDeploy && "deploy"].filter(Boolean).join(" + ")}${r.ownerMayOverride ? "; owner may go ahead without" : ""}`)}`);
+    return 0;
+}

package/dist/cli/src/workspace_starter.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectStarters = detectStarters;
+exports.commandWorkspaceStarter = commandWorkspaceStarter;
+/**
+ * cbx workspace starter <project> [--apply] [--root folder]
+ *
+ * A draft can run checks only through recipes, and a recipe needs a workflow
+ * with a command behind it. A new project has neither, so the first person or
+ * assistant to open a draft finds "An administrator must configure this named
+ * workspace recipe first" and nothing to run.
+ *
+ * This reads the project folder and proposes one check recipe per package it
+ * recognises (Node by its lockfile, Python, Rust, Go), shows the plan, and with
+ * --apply creates the workflows and recipes. It never replaces a recipe or a
+ * workflow that already exists, and it never makes deploy recipes: those carry
+ * credentials and targets, which only the project's owner can choose.
+ */
+const node_fs_1 = require("node:fs");
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const api_js_1 = require("./api.js");
+const colour_js_1 = require("./colour.js");
+const SKIP = new Set(["node_modules", ".git", ".coderook", ".rook", "dist", "build", "target", ".venv", "venv", "vendor", ".next"]);
+const slug = (directory) => (directory.split("/").pop() || "project").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "project";
+function nodeStarter(directory, seen) {
+    const at = (name) => (directory ? `${directory}/${name}` : name);
+    let scripts = {};
+    try {
+        scripts = JSON.parse(seen.get(at("package.json")) ?? "{}").scripts ?? {};
+    }
+    catch {
+        return null;
+    }
+    const has = (name) => typeof scripts[name] === "string" && !/no test specified/.test(String(scripts[name]));
+    /* Fastest first, so a draft hears about a type error before waiting on the tests. */
+    const steps = ["check", "typecheck", "lint", "build", "test"].filter(has);
+    if (!steps.length)
+        return null;
+    const [install, run] = seen.has(at("pnpm-lock.yaml"))
+        ? ["corepack enable && pnpm install --frozen-lockfile", "pnpm run"]
+        : seen.has(at("yarn.lock"))
+            ? ["corepack enable && yarn install --immutable", "yarn run"]
+            : seen.has(at("package-lock.json"))
+                ? ["npm ci", "npm run"]
+                : ["npm install", "npm run"];
+    return {
+        recipe: `${slug(directory)}-check`,
+        workflow: `Draft check · ${directory || "project"}`,
+        directory,
+        command: [install, ...steps.map((s) => `${run} ${s}`)].join(" && "),
+        because: `package.json scripts: ${steps.join(", ")}`,
+    };
+}
+/** The starters a folder's files suggest, one per recognised package. */
+function detectStarters(seen) {
+    const directories = new Set();
+    for (const path of seen.keys()) {
+        const cut = path.lastIndexOf("/");
+        directories.add(cut === -1 ? "" : path.slice(0, cut));
+    }
+    const out = [];
+    for (const directory of [...directories].sort()) {
+        const at = (name) => (directory ? `${directory}/${name}` : name);
+        const node = seen.has(at("package.json")) ? nodeStarter(directory, seen) : null;
+        if (node)
+            out.push(node);
+        else if (seen.has(at("Cargo.toml")))
+            out.push({ recipe: `${slug(directory)}-check`, workflow: `Draft check · ${directory || "project"}`, directory, command: "cargo test", because: "Cargo.toml" });
+        else if (seen.has(at("go.mod")))
+            out.push({ recipe: `${slug(directory)}-check`, workflow: `Draft check · ${directory || "project"}`, directory, command: "go vet ./... && go test ./...", because: "go.mod" });
+        else if (seen.has(at("pyproject.toml")) || seen.has(at("requirements.txt"))) {
+            const install = seen.has(at("requirements.txt")) ? "python -m pip install -r requirements.txt" : "python -m pip install -e .";
+            out.push({ recipe: `${slug(directory)}-check`, workflow: `Draft check · ${directory || "project"}`, directory, command: `${install} && python -m pytest`, because: seen.has(at("pyproject.toml")) ? "pyproject.toml" : "requirements.txt" });
+        }
+    }
+    /* Two folders with the same last name ("app/web", "site/web") keep apart by their full path. */
+    const names = new Map();
+    for (const s of out)
+        names.set(s.recipe, (names.get(s.recipe) ?? 0) + 1);
+    for (const s of out)
+        if ((names.get(s.recipe) ?? 0) > 1)
+            s.recipe = `${s.directory.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "project"}-check`;
+    return out;
+}
+const MARKERS = new Set(["package.json", "package-lock.json", "pnpm-lock.yaml", "yarn.lock", "Cargo.toml", "go.mod", "pyproject.toml", "requirements.txt"]);
+/** The marker files in a folder, two levels deep, skipping dependencies and build output. */
+async function scan(root) {
+    const seen = new Map();
+    const walk = async (rel, depth) => {
+        const entries = await (0, promises_1.readdir)((0, node_path_1.join)(root, ...rel.split("/").filter(Boolean)), { withFileTypes: true }).catch(() => []);
+        for (const entry of entries) {
+            const path = rel ? `${rel}/${entry.name}` : entry.name;
+            if (entry.isDirectory()) {
+                if (depth < 2 && !SKIP.has(entry.name) && !entry.name.startsWith("."))
+                    await walk(path, depth + 1);
+            }
+            else if (MARKERS.has(entry.name)) {
+                seen.set(path, entry.name === "package.json" ? await (0, promises_1.readFile)((0, node_path_1.join)(root, ...path.split("/")), "utf8") : "");
+            }
+        }
+    };
+    await walk("", 0);
+    return seen;
+}
+async function commandWorkspaceStarter(parsed, root) {
+    const folder = (0, node_path_1.resolve)(String(parsed.flags.get("root") ?? process.cwd()));
+    if (!(0, node_fs_1.existsSync)(folder))
+        throw new Error(`${folder} does not exist`);
+    const starters = detectStarters(await scan(folder));
+    const existing = await (0, api_js_1.callApi)(`${root}/workspace-recipes`);
+    const taken = new Set((existing.recipes ?? []).map((r) => r.name));
+    const fresh = starters.filter((s) => !taken.has(s.recipe));
+    const json = parsed.flags.has("json");
+    if (!starters.length) {
+        if (json)
+            console.log(JSON.stringify({ starters: [] }));
+        else
+            console.log("No package.json scripts, Cargo.toml, go.mod or Python project found here. Pass --root with the project folder.");
+        return 0;
+    }
+    if (!parsed.flags.has("apply")) {
+        if (json)
+            console.log(JSON.stringify({ starters, existing: [...taken] }, null, 2));
+        else {
+            for (const s of starters) {
+                const kept = taken.has(s.recipe);
+                console.log(`${kept ? (0, colour_js_1.dim)("exists ") : (0, colour_js_1.green)("new    ")} ${(0, colour_js_1.bold)(s.recipe)}  ${(0, colour_js_1.dim)(`in ${s.directory || "."}`)}`);
+                if (!kept)
+                    console.log(`         ${s.command}\n         ${(0, colour_js_1.dim)(s.because)}`);
+            }
+            console.log(fresh.length
+                ? (0, colour_js_1.dim)(`\nNothing was created. Add ${fresh.length === 1 ? "it" : "them"} with `) + (0, colour_js_1.accent)("--apply") + (0, colour_js_1.dim)("; drafts then run them with cbx workspace run <project> <draft> --recipe <name>.")
+                : (0, colour_js_1.dim)("\nEvery suggested recipe already exists."));
+        }
+        return 0;
+    }
+    const project = root.split("/").pop();
+    const known = new Map((await (0, api_js_1.workflows)(decodeURIComponent(project))).map((w) => [w.name, w.id]));
+    const made = [];
+    for (const s of fresh) {
+        /* A workflow of the same name is reused as it is, never rewritten. */
+        let workflowId = known.get(s.workflow);
+        if (!workflowId) {
+            const created = await (0, api_js_1.callApi)(`${root}/workflows`, {
+                method: "POST",
+                body: { name: s.workflow, trigger: "manual", command: s.command, workingDirectory: s.directory || null, runsOn: "hosted" },
+            });
+            workflowId = created.id;
+        }
+        await (0, api_js_1.callApi)(`${root}/workspace-recipes/${encodeURIComponent(s.recipe)}`, {
+            method: "PUT",
+            body: { kind: "check", workflowId, includePaths: s.directory ? [`${s.directory}/`] : [] },
+        });
+        made.push(s.recipe);
+    }
+    if (json)
+        console.log(JSON.stringify({ created: made, existing: [...taken] }, null, 2));
+    else if (made.length)
+        console.log(`${(0, colour_js_1.green)("Added")} ${made.join(", ")}. Run one on a draft with ${(0, colour_js_1.accent)("cbx workspace run <project> <draft> --recipe <name>")}.`);
+    else
+        console.log("Every suggested recipe already exists; nothing was changed.");
+    return 0;
+}

package/dist/cli/src/workspace_threads.js

@@ -31,6 +31,7 @@ const node_readline_1 = __importDefault(require("node:readline"));
 const api_js_1 = require("./api.js");
 const colour_js_1 = require("./colour.js");
 const config_js_1 = require("./config.js");
+const workspace_watch_js_1 = require("./workspace_watch.js");
 exports.THREAD_OPERATIONS = new Set(["say", "thread", "mute", "unmute"]);
 /** The name this machine posts and reads as, if it gave one. */
 function authorName(parsed) {
@@ -100,14 +101,68 @@ async function unreadReminder(command, parsed) {
         const waiting = found?.workspaces.filter((w) => w.unread > 0) ?? [];
         if (!waiting.length)
             return;
+        /*
+          Messages addressed to this reader come first, with who sent them and
+          how to answer: a teammate or an assistant asked by name should not have
+          to find that in a count. Each is shown once; the count follows.
+        */
+        const addressed = await Promise.race([
+            addressedTo(parsed, waiting.slice(0, 3)),
+            new Promise((resolve) => setTimeout(() => resolve([]), 1500).unref()),
+        ]);
+        for (const one of addressed.slice(0, 2)) {
+            console.log(`\n${(0, colour_js_1.accent)("●")} ${(0, colour_js_1.bold)("For you")} ${(0, colour_js_1.dim)("in")} ${one.workspace.name} ${(0, colour_js_1.dim)("from")} ${one.from}: ${one.snippet}` +
+                `\n  ${(0, colour_js_1.dim)(`cbx workspace thread ${one.workspace.project} ${one.workspace.id} --unread`)}`);
+        }
         const total = waiting.reduce((n, w) => n + w.unread, 0);
         const where = waiting.length === 1 ? `in ${waiting[0].name}` : `in ${waiting.length} workspaces`;
-        console.log(`\n${(0, colour_js_1.accent)("●")} ${(0, colour_js_1.bold)(`${total} new message${total === 1 ? "" : "s"}`)} ${(0, colour_js_1.dim)(where)} ${(0, colour_js_1.dim)("· cbx workspace")}`);
+        console.log(`${addressed.length ? "" : "\n"}${(0, colour_js_1.accent)("●")} ${(0, colour_js_1.bold)(`${total} new message${total === 1 ? "" : "s"}`)} ${(0, colour_js_1.dim)(where)} ${(0, colour_js_1.dim)("· cbx workspace")}`);
     }
     catch {
         /* A reminder is never worth an error. */
     }
 }
+/**
+ * Unread messages that name this reader (@name), not yet shown on this
+ * machine. A machine answers to the name it runs as; a person to their
+ * username and display name, read once a day and kept beside the config.
+ */
+async function addressedTo(parsed, waiting) {
+    const as = authorName(parsed);
+    const names = as ? [as] : await cachedReaderNames();
+    if (!names.length)
+        return [];
+    const shownFile = node_path_1.default.join((0, config_js_1.configDirectory)(), "mentions-shown.json");
+    const shown = new Set(await (0, promises_1.readFile)(shownFile, "utf8").then((t) => JSON.parse(t)).catch(() => []));
+    const out = [];
+    for (const workspace of waiting) {
+        const thread = await (0, api_js_1.callApi)(`/v1/repositories/${encodeURIComponent(workspace.projectId)}/workspaces/${encodeURIComponent(workspace.id)}/messages${join(asQuery(as), "unread=true", "peek=true")}`);
+        for (const message of thread.messages) {
+            if (message.kind !== "message" || message.author.mine || shown.has(message.id) || !(0, workspace_watch_js_1.mentions)(message.body, names))
+                continue;
+            shown.add(message.id);
+            const text = message.body.replace(/\s+/g, " ").trim();
+            out.push({ workspace, from: (0, workspace_watch_js_1.authorLabel)(message.author), snippet: text.length > 140 ? `${text.slice(0, 139)}…` : text });
+        }
+    }
+    if (out.length)
+        await (0, promises_1.writeFile)(shownFile, JSON.stringify([...shown].slice(-500))).catch(() => undefined);
+    return out;
+}
+async function cachedReaderNames() {
+    const file = node_path_1.default.join((0, config_js_1.configDirectory)(), "reader-names.json");
+    try {
+        const kept = JSON.parse(await (0, promises_1.readFile)(file, "utf8"));
+        if (Date.now() - kept.at < 86_400_000)
+            return kept.names;
+    }
+    catch {
+        /* Not read yet on this machine. */
+    }
+    const names = await (0, workspace_watch_js_1.readerNames)();
+    await (0, promises_1.writeFile)(file, JSON.stringify({ at: Date.now(), names })).catch(() => undefined);
+    return names;
+}
 /* ----------------------------------------------------------- the picker */
 const when = (iso) => {
     const date = new Date(iso);

package/dist/cli/src/workspace_watch.js

@@ -0,0 +1,159 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mentions = mentions;
+exports.freshEvents = freshEvents;
+exports.freshSaves = freshSaves;
+exports.authorLabel = authorLabel;
+exports.describe = describe;
+exports.readerNames = readerNames;
+exports.commandWorkspaceWatch = commandWorkspaceWatch;
+/**
+ * cbx workspace watch [project] [workspace]
+ *
+ * What a person or an assistant working on drafts needs to hear about, as it
+ * happens: new messages in the threads it can read, messages addressed to it
+ * (@mentions), and new saved versions. One line per event until stopped,
+ * plain text at a terminal or JSON lines with --json for a program to read.
+ *
+ * Built so neither a teammate nor an assistant has to write its own poller.
+ * It reads with peek, so watching never marks anything read: the reader still
+ * sees the thread as unread when it opens it.
+ */
+const api_js_1 = require("./api.js");
+const colour_js_1 = require("./colour.js");
+const workspace_threads_js_1 = require("./workspace_threads.js");
+const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/**
+ * Whether a message names this reader as @name, as a whole word (the same
+ * rule the bell uses). A reader can answer to several names: the one a
+ * machine runs as, or a person's username and display name.
+ */
+function mentions(body, names) {
+    const list = (typeof names === "string" ? [names] : names ?? [])
+        .map((name) => name?.trim())
+        .filter((name) => Boolean(name));
+    return list.some((name) => new RegExp(`(^|[^\\p{L}\\p{N}_])@${escapeRegExp(name)}(?![\\p{L}\\p{N}_-])`, "iu").test(body));
+}
+/** The events in one look that have not been reported, oldest first; updates state. */
+function freshEvents(state, draft, messages, names) {
+    const out = [];
+    for (const m of [...messages].sort((a, b) => a.createdAt.localeCompare(b.createdAt))) {
+        if (state.seen.has(m.id))
+            continue;
+        state.seen.add(m.id);
+        if (Date.parse(m.createdAt) < state.since || m.author.mine)
+            continue;
+        const where = { project: draft.project, projectId: draft.projectId, workspace: draft.id, workspaceName: draft.name, id: m.id, at: m.createdAt };
+        if (m.kind === "event")
+            out.push({ type: "event", ...where, body: m.body });
+        else
+            out.push({ type: mentions(m.body, names) ? "mention" : "message", ...where, author: m.author, body: m.body });
+    }
+    return out;
+}
+/** New saved versions since the last look; the first look only records where things stand. */
+function freshSaves(state, project, versions) {
+    const numbers = versions
+        .map((v) => ({ sequence: Number(v.sequence), message: v.message ?? "" }))
+        .filter((v) => Number.isFinite(v.sequence));
+    const top = numbers.reduce((max, v) => Math.max(max, v.sequence), 0);
+    const before = state.newest.get(project.id);
+    state.newest.set(project.id, Math.max(before ?? 0, top));
+    if (before === undefined)
+        return [];
+    return numbers
+        .filter((v) => v.sequence > before)
+        .sort((a, b) => a.sequence - b.sequence)
+        .map((v) => ({ type: "save", project: project.name, projectId: project.id, sequence: v.sequence, message: v.message }));
+}
+const flat = (text, most) => {
+    const one = text.replace(/\s+/g, " ").trim();
+    return one.length > most ? `${one.slice(0, most - 1)}…` : one;
+};
+/** Who wrote it, and how sure the service is: a person on the site, a machine on its own token, or a typed name. */
+function authorLabel(author) {
+    if (author.kind === "person")
+        return `${author.label} (site)`;
+    if (author.kind === "token")
+        return `${author.label} (own token)`;
+    return `${author.label} (named, not verified)`;
+}
+function describe(event) {
+    if (event.type === "save")
+        return `${(0, colour_js_1.accent)("save")}     ${event.project} v${event.sequence}  ${flat(event.message, 160)}`;
+    if (event.type === "event")
+        return `${(0, colour_js_1.dim)("event")}    ${event.workspaceName}  ${flat(event.body, 160)}`;
+    const label = event.type === "mention" ? (0, colour_js_1.bold)("for you ") : "message ";
+    return `${label} ${event.workspaceName}  ${authorLabel(event.author)}: ${flat(event.body, 200)}  ${(0, colour_js_1.dim)(event.workspace)}`;
+}
+/** The names a person signed in here answers to; empty when that cannot be read. */
+async function readerNames() {
+    try {
+        const me = (await (0, api_js_1.whoami)());
+        return [me.username, me.displayName].filter((name) => Boolean(name?.trim()));
+    }
+    catch {
+        return [];
+    }
+}
+const wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+async function commandWorkspaceWatch(parsed) {
+    const [, projectRef, workspaceId] = parsed.positional;
+    const name = (0, workspace_threads_js_1.authorName)(parsed);
+    const json = parsed.flags.has("json");
+    const every = Math.max(5, Number(parsed.flags.get("interval") ?? 20) || 20) * 1000;
+    const project = projectRef ? await (0, api_js_1.findProject)(projectRef) : null;
+    if (projectRef && !project)
+        throw new Error(`No accessible project ${projectRef}`);
+    const as = name ? `as=${encodeURIComponent(name)}` : "";
+    /* A machine answers to the name it runs as; a person to their own username and display name. */
+    const names = name ? [name] : await readerNames();
+    const state = {
+        seen: new Set(),
+        newest: new Map(),
+        since: parsed.flags.has("unread") ? 0 : Date.now() - 60_000,
+    };
+    const emit = (event) => console.log(json ? JSON.stringify(event) : describe(event));
+    if (!json && process.stdout.isTTY)
+        console.error((0, colour_js_1.dim)(`Watching ${workspaceId ? "one draft" : project ? project.name : "every draft you can read"}` +
+            `${names.length ? `, messages for @${names[0]} first` : ""}. Stop with Ctrl+C.`));
+    let stopped = false;
+    process.once("SIGINT", () => {
+        stopped = true;
+    });
+    let failures = 0;
+    while (!stopped) {
+        try {
+            const listed = await (0, api_js_1.callApi)(`/v1/account/workspace-threads${as ? `?${as}` : ""}`);
+            const drafts = (listed.workspaces ?? []).filter((w) => (!project || w.projectId === project.id) && (!workspaceId || w.id === workspaceId || w.id.startsWith(workspaceId)));
+            for (const draft of drafts) {
+                if (!draft.unread)
+                    continue;
+                const query = [as, "unread=true", "peek=true"].filter(Boolean).join("&");
+                const thread = await (0, api_js_1.callApi)(`/v1/repositories/${encodeURIComponent(draft.projectId)}/workspaces/${encodeURIComponent(draft.id)}/messages?${query}`);
+                const events = freshEvents(state, draft, thread.messages ?? [], names);
+                /* Messages addressed to this reader first: they are the ones it is being asked to act on. */
+                for (const event of [...events.filter((e) => e.type === "mention"), ...events.filter((e) => e.type !== "mention")])
+                    emit(event);
+            }
+            const projects = project
+                ? [{ id: project.id, name: project.name }]
+                : [...new Map(drafts.map((d) => [d.projectId, { id: d.projectId, name: d.project }])).values()];
+            for (const one of projects) {
+                const versions = await (0, api_js_1.callApi)(`/v1/repositories/${encodeURIComponent(one.id)}/versions`);
+                for (const event of freshSaves(state, one, versions.versions ?? []))
+                    emit(event);
+            }
+            failures = 0;
+        }
+        catch (error) {
+            failures += 1;
+            console.error(`watch: ${error instanceof Error ? error.message : String(error)}${failures > 1 ? ` (${failures} in a row)` : ""}`);
+        }
+        /* Backs off while the service is unreachable, up to five minutes, and returns to the interval on success. */
+        const pause = Math.min(300_000, every * 2 ** Math.min(failures, 4));
+        for (let left = pause; left > 0 && !stopped; left -= 500)
+            await wait(Math.min(500, left));
+    }
+    return 0;
+}

package/package.json

@@ -1,68 +1,68 @@
-{
-  "name": "@coderook/cli",
-  "version": "0.42.7",
-  "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
-  "license": "Apache-2.0",
-  "homepage": "https://coderook.com",
-  "bugs": {
-    "url": "https://github.com/AlexC1991/cbx/issues"
-  },
-  "keywords": [
-    "coderook",
-    "cbx",
-    "version-control",
-    "vcs",
-    "versioning",
-    "project-hosting",
-    "backup",
-    "snapshots",
-    "large-files",
-    "gamedev"
-  ],
-  "engines": {
-    "node": ">=22.15.0"
-  },
-  "bin": {
-    "cbx": "dist/cli/src/cli.js",
-    "coderook": "dist/cli/src/cli.js",
-    "git-remote-coderook": "dist/cli/src/git_remote_bin.js"
-  },
-  "files": [
-    ".claude-plugin",
-    "dist",
-    "skills",
-    "NOTICE"
-  ],
-  "scripts": {
-    "build": "tsc -p tsconfig.json && node scripts/copy-cbx-licence.mjs",
-    "check": "tsc -p tsconfig.json --noEmit",
-    "test": "tsc -p tsconfig.json && node --test --experimental-strip-types test/*.test.ts",
-    "start": "node dist/cli/src/cli.js",
-    "prepublishOnly": "npm run sync:plugin && npm run build",
-    "test:e2e": "node test/e2e.mjs",
-    "test:matrix": "node test/state-matrix.mjs",
-    "test:attempt": "node test/attempt-identity.mjs",
-    "test:get": "node test/get-safety.mjs",
-    "test:live": "node test/e2e.mjs --allow-production && node test/state-matrix.mjs --allow-production && node test/get-safety.mjs --allow-production && node test/get-track.mjs --allow-production && node test/get-protects-edits.mjs --allow-production && node test/upgrade-migration.mjs --allow-production && node test/fault-get.mjs --allow-production && node test/version-floor.mjs --allow-production && node test/fault-submit.mjs --allow-production && node test/race-attempts.mjs --allow-production && node test/attempt-identity.mjs --allow-production",
-    "test:getedits": "node test/get-protects-edits.mjs",
-    "test:upgrade": "node test/upgrade-migration.mjs",
-    "test:faultget": "node test/fault-get.mjs",
-    "test:floor": "node test/version-floor.mjs",
-    "test:faultsubmit": "node test/fault-submit.mjs",
-    "test:race": "node test/race-attempts.mjs",
-    "test:runner": "node test/runner-live.mjs",
-    "sync:plugin": "node scripts/sync-plugin-version.mjs",
-    "test:track": "node test/get-track.mjs",
-    "package:remote": "node ../scripts/package-cli-release.mjs",
-    "publish:remote": "node ../scripts/publish-cli-release.mjs"
-  },
-  "devDependencies": {
-    "@types/node": "24.10.1",
-    "typescript": "5.9.3"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/AlexC1991/cbx.git",
-    "directory": "cli"
-  }
-}
+{
+  "name": "@coderook/cli",
+  "version": "0.44.0",
+  "description": "The command line for CodeRook (coderook.com): version control and project hosting for projects of any size. Every save is a compressed snapshot, private or public, never used to train AI.",
+  "license": "Apache-2.0",
+  "homepage": "https://coderook.com",
+  "bugs": {
+    "url": "https://github.com/AlexC1991/cbx/issues"
+  },
+  "keywords": [
+    "coderook",
+    "cbx",
+    "version-control",
+    "vcs",
+    "versioning",
+    "project-hosting",
+    "backup",
+    "snapshots",
+    "large-files",
+    "gamedev"
+  ],
+  "engines": {
+    "node": ">=22.15.0"
+  },
+  "bin": {
+    "cbx": "dist/cli/src/cli.js",
+    "coderook": "dist/cli/src/cli.js",
+    "git-remote-coderook": "dist/cli/src/git_remote_bin.js"
+  },
+  "files": [
+    ".claude-plugin",
+    "dist",
+    "skills",
+    "NOTICE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json && node scripts/copy-cbx-licence.mjs",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "test": "tsc -p tsconfig.json && node --test --experimental-strip-types test/*.test.ts",
+    "start": "node dist/cli/src/cli.js",
+    "prepublishOnly": "npm run sync:plugin && npm run build",
+    "test:e2e": "node test/e2e.mjs",
+    "test:matrix": "node test/state-matrix.mjs",
+    "test:attempt": "node test/attempt-identity.mjs",
+    "test:get": "node test/get-safety.mjs",
+    "test:live": "node test/e2e.mjs --allow-production && node test/state-matrix.mjs --allow-production && node test/get-safety.mjs --allow-production && node test/get-track.mjs --allow-production && node test/get-protects-edits.mjs --allow-production && node test/upgrade-migration.mjs --allow-production && node test/fault-get.mjs --allow-production && node test/version-floor.mjs --allow-production && node test/fault-submit.mjs --allow-production && node test/race-attempts.mjs --allow-production && node test/attempt-identity.mjs --allow-production",
+    "test:getedits": "node test/get-protects-edits.mjs",
+    "test:upgrade": "node test/upgrade-migration.mjs",
+    "test:faultget": "node test/fault-get.mjs",
+    "test:floor": "node test/version-floor.mjs",
+    "test:faultsubmit": "node test/fault-submit.mjs",
+    "test:race": "node test/race-attempts.mjs",
+    "test:runner": "node test/runner-live.mjs",
+    "sync:plugin": "node scripts/sync-plugin-version.mjs",
+    "test:track": "node test/get-track.mjs",
+    "package:remote": "node ../scripts/package-cli-release.mjs",
+    "publish:remote": "node ../scripts/publish-cli-release.mjs"
+  },
+  "devDependencies": {
+    "@types/node": "24.10.1",
+    "typescript": "5.9.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AlexC1991/cbx.git",
+    "directory": "cli"
+  }
+}