@erclx/canon 5.25.0 → 5.27.0

package/src/sandbox/tree.ts

@@ -1,3 +1,4 @@
+import { spawnSync } from 'node:child_process'
 import { randomBytes } from 'node:crypto'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
@@ -5,10 +6,11 @@ import { join } from 'node:path'
 /**
  * Mints a short per-run identifier the first time it is asked for and holds it
  * in `CANON_SANDBOX_RUN_ID` for the rest of this process, so a script that
- * spawns a child inheriting `process.env` — `run.sh` calling `manage-sandbox.sh`
- * and then `canon sandbox check` — resolves the same tree in every one of them.
- * A process that already carries the variable, inherited from such a parent,
- * reuses it rather than minting a new one.
+ * spawns a child inheriting `process.env` — `canon sandbox run` calling
+ * `canon sandbox` to provision and then `canon sandbox check` — resolves the same tree in every one
+ * of them, as do the hook and installer children provisioning spawns. A process
+ * that already carries the variable, inherited from such a parent, reuses it
+ * rather than minting a new one.
  *
  * Twin of `mint_sandbox_run_id` in `scripts/lib/sandbox-path.sh`.
  */
@@ -45,3 +47,96 @@ export function sandboxTree(): string {
 
   return join(base, 'canon', `sandbox-${mintSandboxRunId()}`)
 }
+
+/**
+ * Lexical rather than `realpath`, since the guard runs before the tree exists,
+ * so nothing here follows a symlink.
+ */
+export function normalizeSandboxPath(path: string): string {
+  if (path === '') return ''
+
+  const isAbsolute = path.startsWith('/')
+  const resolved: string[] = []
+  let climbed = ''
+
+  for (const segment of path.split('/')) {
+    if (segment === '' || segment === '.') continue
+    if (segment !== '..') resolved.push(segment)
+    else if (resolved.length > 0) resolved.pop()
+    else if (!isAbsolute) climbed += '../'
+  }
+
+  if (isAbsolute) return `/${resolved.join('/')}`
+
+  const relative = `${climbed}${resolved.join('/')}`.replace(/\/+$/, '')
+
+  return relative === '' ? '.' : relative
+}
+
+/** Whether `candidate` is `target` or a directory containing it. */
+function isAtOrAbove(candidate: string, target: string): boolean {
+  return candidate === target || target.startsWith(`${candidate}/`)
+}
+
+export interface SandboxRoots {
+  readonly home: string
+  readonly temp: string
+  readonly mainRoot: string
+}
+
+/**
+ * The roots the guard measures against. The repository test reads the main
+ * worktree rather than `PROJECT_ROOT`, since a linked worktree sits inside it.
+ */
+export function sandboxRoots(projectRoot: string): SandboxRoots {
+  const listing = spawnSync('git', ['worktree', 'list', '--porcelain'], {
+    cwd: projectRoot,
+    encoding: 'utf8',
+  })
+  const line = (listing.stdout ?? '')
+    .split('\n')
+    .find((l) => l.startsWith('worktree '))
+
+  return {
+    home: process.env.HOME || '/root',
+    temp: process.env.TMPDIR || '/tmp',
+    mainRoot: line === undefined ? projectRoot : line.slice('worktree '.length),
+  }
+}
+
+/**
+ * Returns the reason a location cannot hold the tree, or undefined when it can.
+ * Provisioning removes the tree before staging, so the test is an allowlist: a
+ * strict descendant of the home folder or the temp root, outside the main
+ * worktree in both directions.
+ */
+export function assertSandboxDirSafe(
+  raw: string,
+  roots: SandboxRoots,
+): string | undefined {
+  if (!raw.startsWith('/'))
+    return `CANON_SANDBOX_DIR must be an absolute path, got: ${raw || '<empty>'}`
+
+  if (raw.length > 4096)
+    return `Refusing the sandbox path. It is ${raw.length} characters, past the longest path any filesystem here accepts.`
+
+  const dir = normalizeSandboxPath(raw)
+  const home = normalizeSandboxPath(roots.home)
+  const temp = normalizeSandboxPath(roots.temp)
+  const mainRoot = normalizeSandboxPath(roots.mainRoot)
+  const resolution = dir === raw ? '' : ` It resolves to ${dir}.`
+
+  if (!isAtOrAbove(home, dir) && !isAtOrAbove(temp, dir))
+    return `Refusing ${raw} as the sandbox. Provisioning removes the tree first, so the path has to sit under ${home} or ${temp}.${resolution}`
+
+  if (dir === home || dir === temp)
+    return `Refusing ${raw} as the sandbox. Provisioning removes the tree first, so the path has to sit under ${dir} rather than be it.`
+
+  if (isAtOrAbove(dir, mainRoot))
+    return `Refusing ${raw} as the sandbox. Provisioning removes the tree first, and that path contains ${mainRoot}.${resolution}`
+
+  if (dir.startsWith(`${mainRoot}/`))
+    return `Sandbox at ${raw} sits inside ${mainRoot}, which puts the toolkit CLAUDE.md back on the session ancestor chain.${resolution} Point CANON_SANDBOX_DIR outside the repository.`
+
+  return undefined
+}

package/src/secrets/marker.ts

@@ -1,9 +1,9 @@
-import { isMarked } from '@/exempt-marker'
+import { isMarked } from '@/sweep/exempt-marker'
 
 /**
  * The inline token exempting one line from the secret scan.
  *
- * Shaped on the `stub: true` precedent in `src/seed-marker.ts`, which answers
+ * Shaped on the `stub: true` precedent in `src/tooling/seed-marker.ts`, which answers
  * a check whose own comment records a false-positive class. The exemption
  * travels with the line it exempts rather than sitting in a path list away
  * from it, so a reader meeting a muted match finds the reason on the spot.

package/src/secrets/scan.ts

@@ -1,7 +1,7 @@
 import { readFile } from 'node:fs/promises'
 import { join } from 'node:path'
-import { isBinary } from '@/binary'
-import { listRepositoryFiles } from '@/git-files'
+import { isBinary } from '@/sweep/binary'
+import { listRepositoryFiles } from '@/git/files'
 import { isExempt } from '@/secrets/marker'
 import { matchLine } from '@/secrets/patterns'
 import { readShipEntries, selectShipped } from '@/secrets/shipped'

package/src/sessions/claim.ts

@@ -9,7 +9,7 @@ import {
   listWorktrees,
   type RefReport,
   type WorktreeEntry,
-} from '@/worktree'
+} from '@/git/worktree'
 
 export interface ClaimReport {
   readonly claimed: boolean

package/src/sessions/resolve.ts

@@ -1,6 +1,6 @@
 import { basename } from 'node:path'
 import { $ } from 'bun'
-import { gitEnv } from '@/git-env'
+import { gitEnv } from '@/git/env'
 import {
   type Confidence,
   liveness,

package/src/sessions/transfer/bundle.ts

@@ -10,7 +10,7 @@ import {
 } from 'node:fs'
 import { basename, dirname, isAbsolute, join, relative } from 'node:path'
 import { $ } from 'bun'
-import { gitEnv } from '@/git-env'
+import { gitEnv } from '@/git/env'
 import { recordDir, recordRoot, SCRATCH } from '@/record-root'
 import { remoteIdentity } from '@/records/backup'
 import {

package/src/shipped/references.ts

@@ -1,6 +1,6 @@
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
-import { isMarked } from '@/exempt-marker'
+import { isMarked } from '@/sweep/exempt-marker'
 
 /**
  * The corpora a target reader reaches, which is the `files` field less `src`.
@@ -113,7 +113,7 @@ const COMMIT_SHA = /(?<![0-9A-Za-z_@/#])([0-9a-f]{7,40})(?![0-9A-Za-z_])/g
  * one.
  *
  * The literal is hardcoded rather than read from `package.json` or
- * `git remote`, matching `src/github-format.ts` and `src/commands/repo.ts`,
+ * `git remote`, matching `src/feedback/github-format.ts` and `src/commands/repo.ts`,
  * which already hardcode it.
  *
  * Same word-boundary discipline as the two patterns above: a word character

package/src/slides/convert/export.ts

@@ -1,10 +1,4 @@
-import {
-  copyFileSync,
-  mkdirSync,
-  readdirSync,
-  readFileSync,
-  writeFileSync,
-} from 'node:fs'
+import { copyFileSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
 import { basename, join } from 'node:path'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 import JSZip from 'jszip'
@@ -42,6 +36,7 @@ import {
   type WalkedSlide,
   walkSlide,
 } from '@/slides/convert/walk'
+import { slideFiles } from '@/slides/decks'
 import { embedFonts, type FontNotice } from '@/slides/package/fonts'
 import {
   type EntranceSpec,
@@ -127,15 +122,6 @@ function refused(reason: ExportRefusal, message: string): ExportResult {
   return { status: 'refused', reason, message }
 }
 
-/** Every `.html` file directly in the folder, in filename order. */
-export function slideFiles(sourceDir: string): string[] {
-  return readdirSync(sourceDir, { withFileTypes: true })
-    .filter((entry) => entry.isFile() && entry.name.endsWith('.html'))
-    .map((entry) => entry.name)
-    .sort((a, b) => a.localeCompare(b, undefined, { numeric: true }))
-    .map((name) => join(sourceDir, name))
-}
-
 /** A picture whose bytes the post-write pass replaces or whose corners it rounds. */
 interface Patch {
   readonly slide: number

package/src/slides/decks.ts

@@ -0,0 +1,110 @@
+import { existsSync, readdirSync, statSync } from 'node:fs'
+import { join, relative, resolve } from 'node:path'
+import { creationRel, recordDir } from '@/record-root'
+import { readDeck } from '@/slides/convert/deck'
+
+/**
+ * A deck is a folder under the record root's `slides/`, holding its `.html`
+ * slides, an optional `deck.json`, and its assets. `layouts/` beside the decks
+ * holds the project's shared layouts and is never a deck itself.
+ */
+export const SLIDES_FOLDER = 'slides'
+
+export const LAYOUTS_FOLDER = 'layouts'
+
+export interface Deck {
+  readonly name: string
+  /** From `deck.json`, falling back to the folder name as the export does. */
+  readonly title: string
+  readonly slides: number
+  /** Relative to the project root. */
+  readonly path: string
+}
+
+export type DeckRefusal = 'no-decks' | 'ambiguous' | 'no-deck'
+
+export type DeckResolution =
+  | { readonly status: 'resolved'; readonly dir: string }
+  | {
+      readonly status: 'refused'
+      readonly reason: DeckRefusal
+      readonly message: string
+    }
+
+/** Every `.html` file directly in the folder, in filename order. */
+export function slideFiles(dir: string): string[] {
+  return readdirSync(dir, { withFileTypes: true })
+    .filter((entry) => entry.isFile() && entry.name.endsWith('.html'))
+    .map((entry) => entry.name)
+    .sort((a, b) => a.localeCompare(b, undefined, { numeric: true }))
+    .map((name) => join(dir, name))
+}
+
+export function listDecks(root: string): Deck[] {
+  const dir = recordDir(root, SLIDES_FOLDER)
+  if (!isDirectory(dir)) return []
+
+  return readdirSync(dir, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory() && entry.name !== LAYOUTS_FOLDER)
+    .map((entry) => entry.name)
+    .sort((a, b) => a.localeCompare(b))
+    .flatMap((name) => {
+      const deckDir = join(dir, name)
+      const slides = slideFiles(deckDir).length
+      if (slides === 0) return []
+      const read = readDeck(deckDir)
+      const title = read.status === 'read' ? read.deck.title : name
+      return [{ name, title, slides, path: relative(root, deckDir) }]
+    })
+}
+
+/**
+ * The folder `render` reads. A deck name wins over a folder of the same name
+ * relative to the root, and no name at all takes the only deck there is.
+ */
+export function resolveDeck(
+  root: string,
+  target: string | undefined,
+): DeckResolution {
+  const decks = listDecks(root)
+  const at = creationRel(root, SLIDES_FOLDER)
+
+  if (target === undefined) {
+    const [only, ...rest] = decks
+    if (only === undefined) {
+      return refuse('no-decks', `No deck under ${at}/. Draw one there first.`)
+    }
+    if (rest.length > 0) {
+      return refuse(
+        'ambiguous',
+        `${decks.length} decks under ${at}/, name one: ${names(decks)}`,
+      )
+    }
+    return { status: 'resolved', dir: join(root, only.path) }
+  }
+
+  const named = decks.find((deck) => deck.name === target)
+  if (named) return { status: 'resolved', dir: join(root, named.path) }
+
+  const folder = resolve(root, target)
+  if (isDirectory(folder)) return { status: 'resolved', dir: folder }
+
+  return refuse(
+    'no-deck',
+    decks.length === 0
+      ? `${target} is neither a deck under ${at}/ nor a folder`
+      : `${target} is neither a deck nor a folder. Decks: ${names(decks)}`,
+  )
+}
+
+function names(decks: readonly Deck[]): string {
+  return decks.map((deck) => deck.name).join(', ')
+}
+
+function refuse(reason: DeckRefusal, message: string): DeckResolution {
+  return { status: 'refused', reason, message }
+}
+
+function isDirectory(path: string): boolean {
+  return existsSync(path) && statSync(path).isDirectory()
+}

package/src/slides/package/fonts.ts

@@ -152,9 +152,13 @@ export function eotOf(bytes: Uint8Array): EotResult {
     }
     const strings = names(font, name)
     const padding = Buffer.alloc(2)
-    // RootStringCheckSum, EUDCCodePage, Padding6, SignatureSize, EUDCFlags,
-    // and EUDCFontSize, all zero for a face with no root string or EUDC data.
+    // RootStringCheckSum, then EUDCCodePage, Padding6, SignatureSize,
+    // EUDCFlags, and EUDCFontSize, zero for a face with no EUDC data. The
+    // checksum is the root string's byte sum XOR 0x50475342, so an empty root
+    // string still writes the constant, and PowerPoint refuses to install a
+    // face whose checksum is zero as tampered with.
     const tail = Buffer.alloc(20)
+    tail.writeUInt32LE(0x50475342, 0)
     const eot = Buffer.concat([
       header(font, os2.offset, head.offset),
       padding,

package/src/standards/audit.ts

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs'
 import { basename, join } from 'node:path'
 import { $ } from 'bun'
-import { gitEnv } from '@/git-env'
-import { resolveBaseRef } from '@/git-files'
+import { gitEnv } from '@/git/env'
+import { resolveBaseRef } from '@/git/files'
 import { INDEX_FILE, standardsSourceDir } from '@/standards/read'
 
 /** Returned when a standard new to this branch states no success criterion under either heading `CRITERION_HEADING` accepts, the gating check. */

package/src/standards/read.ts

@@ -1,6 +1,6 @@
 import { existsSync, readdirSync, readFileSync } from 'node:fs'
 import { basename, join } from 'node:path'
-import { stripFrontmatter } from '@/frontmatter'
+import { stripFrontmatter } from '@/markdown/frontmatter'
 import { PROJECT_ROOT } from '@/project-root'
 
 export const INDEX_FILE = 'index.md'

package/src/sync/check.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs'
 import { basename, join, sep } from 'node:path'
 import { execa } from 'execa'
-import { gitEnv } from '@/git-env'
+import { gitEnv } from '@/git/env'
 import { createDesignAdapter, DESIGN_INSTALL_DIR } from '@/design/adapter'
 import { createGovAdapter, rulesSourceDir } from '@/gov/adapter'
 import { successorResolver } from '@/gov/renames'
@@ -29,7 +29,7 @@ import {
   stampedCommit,
   type StampDomain,
 } from '@/sync/stamp'
-import { isDirectory } from '@/target'
+import { isDirectory } from '@/targets/validate'
 import {
   isWholeStack,
   loadManifest,

package/src/sync/engine.ts

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync } from 'node:fs'
 import { rm } from 'node:fs/promises'
 import { isAbsolute, relative, resolve } from 'node:path'
-import { copyPreservingMode } from '@/copy'
+import { copyPreservingMode } from '@/sync/copy'
 import { checkoutMismatchWarning } from '@/project-root'
 import { findInstalledOrigin, readHistoryIndex } from '@/sync/history'
 import {
@@ -16,7 +16,7 @@ import {
   toStampKey,
   writeStamp,
 } from '@/sync/stamp'
-import { isDirectory } from '@/target'
+import { isDirectory } from '@/targets/validate'
 import {
   intro,
   isNonInteractive,

package/src/sync/git.ts

@@ -1,6 +1,6 @@
 import { basename } from 'node:path'
 import { execa } from 'execa'
-import { gitEnv } from '@/git-env'
+import { gitEnv } from '@/git/env'
 import type { SyncDomain } from '@/sync/target'
 import { pipeOutput } from '@/ui'
 

package/src/sync/history.ts

@@ -2,7 +2,7 @@ import { createHash } from 'node:crypto'
 import { readFileSync } from 'node:fs'
 import { sep } from 'node:path'
 import { execaSync } from 'execa'
-import { gitEnv } from '@/git-env'
+import { gitEnv } from '@/git/env'
 
 /** Blob SHA to the newest commit whose post-image for that path held it. */
 export type PathHistory = ReadonlyMap<string, string>

package/src/sync/reverse.ts

@@ -1,7 +1,7 @@
 import { existsSync, statSync } from 'node:fs'
 import { join } from 'node:path'
 import { execaSync } from 'execa'
-import { gitEnv } from '@/git-env'
+import { gitEnv } from '@/git/env'
 import {
   findInstalledOrigin,
   type HistoryIndex,

package/src/sync/seeds-report.ts

@@ -1,7 +1,7 @@
 import { readFileSync } from 'node:fs'
 import { relative } from 'node:path'
 import { planSeeds, type Seed } from '@/claude/seeds'
-import { rewritesOnInstall, stripSeedMarker } from '@/seed-marker'
+import { rewritesOnInstall, stripSeedMarker } from '@/tooling/seed-marker'
 import { findInstalledOrigin, readHistoryIndex } from '@/sync/history'
 
 /**

package/src/sync/target.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs'
 import { join } from 'node:path'
 import { DESIGN_INSTALL_DIR } from '@/design/adapter'
-import { isDirectory } from '@/target'
+import { isDirectory } from '@/targets/validate'
 
 export const SYNC_DOMAINS = ['governance', 'design', 'claude'] as const
 

package/src/sync/workflow.ts

@@ -11,7 +11,7 @@ import {
   syncBranchName,
 } from '@/sync/git'
 import { domainPaths, SYNC_DOMAINS } from '@/sync/target'
-import { isDirectory } from '@/target'
+import { isDirectory } from '@/targets/validate'
 import {
   intro,
   logError,

package/src/targets/pulls.ts

@@ -1,6 +1,6 @@
 import { execa } from 'execa'
-import { gitEnv } from '@/git-env'
-import { isDirectory } from '@/target'
+import { gitEnv } from '@/git/env'
+import { isDirectory } from '@/targets/validate'
 
 const GH_TIMEOUT_MS = 30_000
 

package/src/targets/sweep.ts

@@ -1,7 +1,7 @@
 import { readdirSync } from 'node:fs'
 import { join, resolve } from 'node:path'
 import { $ } from 'bun'
-import { gitEnv } from '@/git-env'
+import { gitEnv } from '@/git/env'
 import {
   claudeCanonStampPath,
   isLegacyStamped,
@@ -9,7 +9,7 @@ import {
   retiredNameStampPath,
   stampPath,
 } from '@/sync/stamp'
-import { isDirectory } from '@/target'
+import { isDirectory } from '@/targets/validate'
 
 /**
  * Folders a walk never descends into.

package/src/tasks/answers.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs'
 import { readFile } from 'node:fs/promises'
 import { isAbsolute, relative, resolve } from 'node:path'
-import { isUnder } from '@/paths'
+import { isUnder } from '@/tasks/paths'
 import { recordDir, recordDirs } from '@/record-root'
 import {
   hasStagedBatches,

package/src/tasks/archive.ts

@@ -2,7 +2,7 @@ import { existsSync } from 'node:fs'
 import { mkdir, readdir, readFile, rename, writeFile } from 'node:fs/promises'
 import { basename, dirname, join, relative, resolve, sep } from 'node:path'
 import { regenOne } from '@/indexes/regen'
-import { isUnder } from '@/paths'
+import { isUnder } from '@/tasks/paths'
 import { recordDir, recordDirs } from '@/record-root'
 
 const TASKS = 'tasks'

package/src/tasks/reach.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs'
 import { readdir, readFile } from 'node:fs/promises'
 import { basename, join } from 'node:path'
-import { listChangedFiles, resolveBaseRef } from '@/git-files'
+import { listChangedFiles, resolveBaseRef } from '@/git/files'
 import { recordDir } from '@/record-root'
 import { splitPlanSections } from '@/records/validate'
 import { type AnswersRefused, resolvePlanReference } from '@/tasks/answers'

package/src/tasks/trunk.ts

@@ -1,5 +1,5 @@
 import { execa } from 'execa'
-import { gitEnv } from '@/git-env'
+import { gitEnv } from '@/git/env'
 
 const GIT_TIMEOUT_MS = 10_000
 

package/src/teach/nav.ts

@@ -7,7 +7,7 @@ import {
 } from '@/design/components'
 import { buildDesignCss } from '@/design/css'
 import { FAVICON_COLORS, faviconLink, renderFavicon } from '@/design/favicon'
-import { stripFrontmatter } from '@/frontmatter'
+import { stripFrontmatter } from '@/markdown/frontmatter'
 import { parseFrontmatter, readField } from '@/indexes/frontmatter'
 import { PROJECT_ROOT } from '@/project-root'
 import { compileScript } from '@/teach/browser/compile'

package/src/tooling/inject.ts

@@ -2,8 +2,8 @@ import { existsSync } from 'node:fs'
 import { copyFile, mkdir, readFile, writeFile } from 'node:fs/promises'
 import { dirname, join, relative } from 'node:path'
 import { $ } from 'bun'
-import { copyPreservingMode } from '@/copy'
-import { rewritesOnInstall, stripSeedMarker } from '@/seed-marker'
+import { copyPreservingMode } from '@/sync/copy'
+import { rewritesOnInstall, stripSeedMarker } from '@/tooling/seed-marker'
 import { resolveSurfacePath } from '@/surface-root'
 import { mergeSections, pruneSections } from '@/tooling/gitignore'
 import {

package/src/tooling/subfolder.ts

@@ -1,6 +1,6 @@
 import { existsSync, readdirSync, realpathSync } from 'node:fs'
 import { basename, join, relative } from 'node:path'
-import { gitEnv } from '@/git-env'
+import { gitEnv } from '@/git/env'
 import { isWholeStack, type Manifest, seedFiles } from '@/tooling/manifest'
 
 /**

package/src/web/readme-citations.ts

@@ -1,4 +1,4 @@
-import { isMarked } from '@/exempt-marker'
+import { isMarked } from '@/sweep/exempt-marker'
 
 export const README_PARAPHRASE_MARKER = 'canon-allow-readme-paraphrase'
 
@@ -34,7 +34,7 @@ const QUOTED_PHRASE = /"([^"]+)"/g
  * retired `README.md:<n>` form, reported rather than accepted so the fragile
  * convention this replaces cannot come back on a later edit.
  *
- * Modeled on `clientCommandCitationsIn` in `src/client-commands.ts`, including
+ * Modeled on `clientCommandCitationsIn` in `src/gate/client-commands.ts`, including
  * its use of `isMarked` for the exemption.
  */
 export function readmeCitationsIn(

package/src/worktrees/bare-flag.ts

@@ -1,6 +1,6 @@
 import { basename } from 'node:path'
 import { execa } from 'execa'
-import { gitEnv } from '@/git-env'
+import { gitEnv } from '@/git/env'
 
 /** Why a run wrote nothing. The three are different states a caller can tell apart. */
 export type BareFlagSkip =

package/src/worktrees/reclaim.ts

@@ -1,7 +1,7 @@
 import { $ } from 'bun'
 import { execa } from 'execa'
 import { existsSync } from 'node:fs'
-import { gitEnv } from '@/git-env'
+import { gitEnv } from '@/git/env'
 import {
   repositoryOf,
   type ResolvedSession,
@@ -12,7 +12,7 @@ import {
   currentWorktreeRoot,
   listWorktrees,
   type WorktreeEntry,
-} from '@/worktree'
+} from '@/git/worktree'
 
 const GH_TIMEOUT_MS = 30_000
 

package/src/worktrees/remove.ts

@@ -1,5 +1,5 @@
 import { $ } from 'bun'
-import { gitEnv } from '@/git-env'
+import { gitEnv } from '@/git/env'
 import type { WorktreeVerdict } from '@/worktrees/reclaim'
 
 /** Which half of the removal a failure landed on, so a reader repairs the right one. */

package/standards/architecture.md

@@ -54,6 +54,7 @@ Use `## Overview`, `## Key technical decisions` with one named H3 per decision,
 
 - Rewrite a decision a later one changed rather than appending the change beside it. A reader should find the design that stands in one place, with the alternative that lost stated once.
 - Hold only what is open under `## Risks / open questions`. An entry leaves the section in the change that settles it, becoming a decision here when it fills a slot and moving to the domain context entry it constrains when it does not.
+- Carry an optional `reviewed: YYYY-MM-DD` frontmatter field naming the day someone last read the record whole for drift. Whoever finishes that review sets it as the review's last edit, and `canon records stale canonical` reads it to count the releases shipped since. A record with no field reads as never reviewed.
 
 ## Verification anchors