@event4u/agent-config 11.0.0 → 12.1.0

package/src/scripts/janitor.ts

@@ -24,22 +24,82 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 const _HERE = fileURLToPath(import.meta.url);
 const REPO_ROOT = path.join(path.dirname(_HERE), '..', '..');
 
-// TTL configuration per directory (days)
-const TTL_CONFIG: ReadonlyArray<{ dir: string; ttlDays: number; description: string }> = [
+// TTL configuration per directory (days).
+//
+// `owner` / `reviewBy` (road-to-inbox-harvest-2026-08-d-context-ledger Step
+// 4.1) put every TTL under the same discipline the two budget config files
+// carry: a retention number nobody owns and nobody revisits is a guess that
+// hardens into a fact. The falsifier is printed per run — see the reclaim
+// total in `main` — so a TTL that reclaims nothing over a review window is
+// removed rather than defended.
+const TTL_CONFIG: ReadonlyArray<{
+    dir: string;
+    ttlDays: number;
+    description: string;
+    owner: string;
+    reviewBy: string;
+}> = [
     {
         dir: 'agents/tmp.old',
         ttlDays: 30,
         description: 'Processed inbox archive (consumed agents/tmp/ files)',
+        owner: 'maintainer',
+        reviewBy: '2026-11-10',
     },
     {
         dir: 'agents/runtime/tmp',
         ttlDays: 7,
         description: 'Agent scratch / runtime tmp',
+        owner: 'maintainer',
+        reviewBy: '2026-11-10',
     },
     {
         dir: 'agents/runtime/council/responses',
         ttlDays: 7,
         description: 'Council response cache',
+        owner: 'maintainer',
+        reviewBy: '2026-11-10',
+    },
+    // ── Session-scoped runtime state (Step 4.1) ────────────────────────────
+    //
+    // These four directories accrete ONE entry per session behind a
+    // once-per-session latch, and nothing in the tree removed them: writers
+    // and readers existed, no reaper did. They are named INDIVIDUALLY rather
+    // than sweeping `agents/runtime/state` as a whole, and that is the
+    // load-bearing decision in this step.
+    //
+    // `agents/runtime/state` also holds the CUMULATIVE measurement streams —
+    // `audit/`, `injection-census.jsonl`, `tool-result-census.jsonl`,
+    // `ai-video-telemetry.jsonl`, the memory index — and a directory-level
+    // TTL would delete exactly the corpora this roadmap exists to build. A
+    // sweeper that eats the instrument's own data is worse than no sweeper.
+    {
+        dir: 'agents/runtime/state/session-eol',
+        ttlDays: 7,
+        description: 'Per-session end-of-life counters (one file per session)',
+        owner: 'maintainer',
+        reviewBy: '2026-11-10',
+    },
+    {
+        dir: 'agents/runtime/state/reread-guard',
+        ttlDays: 7,
+        description: 'Per-session re-read latch',
+        owner: 'maintainer',
+        reviewBy: '2026-11-10',
+    },
+    {
+        dir: 'agents/runtime/state/end-review-nudge',
+        ttlDays: 7,
+        description: 'Per-session end-review latch',
+        owner: 'maintainer',
+        reviewBy: '2026-11-10',
+    },
+    {
+        dir: 'agents/runtime/state/probe-throttle',
+        ttlDays: 7,
+        description: 'Per-session probe throttle latch',
+        owner: 'maintainer',
+        reviewBy: '2026-11-10',
     },
 ];
 
@@ -227,6 +287,21 @@ function report(apply: boolean): void {
         );
     } else if (apply && totalExpired > 0) {
         process.stdout.write(`Total deleted: ${totalExpired} file(s), ${_humanSize(totalSize)} freed.\n`);
+    } else {
+        // road-to-inbox-harvest-2026-08-d-context-ledger Step 4.2 — the TTL's
+        // own falsifier, and it only works if a ZERO is printed.
+        //
+        // Until now a run that reclaimed nothing printed no total at all, so
+        // "the sweeper ran and found nothing expired" and "the sweeper did not
+        // run" produced byte-identical output. That is the difference between
+        // evidence that a retention policy is unnecessary and no evidence at
+        // all — and the first is what removes a TTL entry rather than letting
+        // it harden into an unexamined default.
+        process.stdout.write(
+            `Total ${apply ? 'deleted' : 'reclaimable'}: 0 file(s), 0 B — nothing was past its TTL.\n` +
+                `A reclaim that stays at zero across a review window is the signal to drop the ` +
+                `TTL entry, not to keep it: see the owner / reviewBy fields on each entry.\n`,
+        );
     }
 }
 

package/src/scripts/lint_command_tiers.ts

@@ -1,20 +1,24 @@
 #!/usr/bin/env node
 /**
- * Lint slash-command frontmatter for the `tier:` key.
+ * Lint slash-command frontmatter for the `visibility:` key.
  *
  * Ported from the retired Python `src/scripts/lint_command_tiers.py` (ADR-200, Phase 4 /
- * Wave 4b). Mirrors the Python CLI contract exactly: same scan scope, file
- * ordering, finding messages, stdout/stderr split, and exit codes
- * (return-code bitwise-OR accumulation across the domain + per-root +
- * condensed-projection passes).
+ * Wave 4b). Keeps the Python CLI contract's shape: same scan scope, file
+ * ordering, stdout/stderr split, and exit codes (return-code bitwise-OR
+ * accumulation across the domain + per-root + condensed-projection passes).
  *
- * Hard-fails CI if any command lacks a `tier:` declaration or uses an unknown
- * tier value. The valid tier set is locked by
+ * The integer `tier:` alias this file was named for is GONE
+ * (road-to-tier-removal Phase 4): `visibility:` is now the sole command-surface
+ * classifier. The filename is retained because the gate id, its Taskfile entry,
+ * and the contract doc all key on it; only the checked key changed.
+ *
+ * Hard-fails CI if any command lacks a `visibility:` declaration or uses an
+ * unknown value. The valid set is locked by
  * docs/contracts/command-surface-tiers.md.
  *
  * Exit codes:
- *   0  every command declares a valid tier
- *   1  one or more commands missing or using an invalid tier
+ *   0  every command declares a valid visibility
+ *   1  one or more commands missing or using an invalid visibility
  */
 import fs from "node:fs";
 import path from "node:path";
@@ -79,20 +83,13 @@ function COMMANDS_DIRS(): string[] {
 }
 
 const DOMAINS_DIR = path.join(REPO, "src", "domains");
-// Consumer-facing projection — must also carry tier so .augment/commands/
-// (which symlinks to dist/agent-src/commands/) renders the tier filter.
+// Consumer-facing projection — must also carry visibility so .augment/commands/
+// (which symlinks to dist/agent-src/commands/) renders the surface filter.
 const COMMANDS_DIR_CONDENSED = path.join(REPO, "dist/agent-src", "commands");
 
-const VALID_TIERS: ReadonlySet<string> = new Set(["0", "1", "2"]);
-// ADR-092: `visibility:` is the named source of truth; `tier:` is the
-// back-compat integer alias. Both are validated; when both are present they
-// MUST agree per this mapping.
+// ADR-092 named `visibility:` the source of truth; road-to-tier-removal Phase 4
+// removed the integer `tier:` alias, so this set is the whole vocabulary.
 const VALID_VISIBILITIES: ReadonlySet<string> = new Set(["visible", "advanced", "internal"]);
-const TIER_TO_VISIBILITY: Readonly<Record<string, string>> = {
-  "0": "visible",
-  "1": "advanced",
-  "2": "internal",
-};
 
 export function parse_field(text: string, key: string): string | null {
   if (!text.startsWith("---\n")) {
@@ -116,15 +113,13 @@ export function parse_field(text: string, key: string): string | null {
   return null;
 }
 
-export function parse_tier(text: string): string | null {
-  return parse_field(text, "tier");
-}
-
 /**
  * Validate the visibility field (ADR-092). Returns an error string or null.
  *
- * Requires a present + valid visibility, and consistency with the tier alias
- * whenever both are declared.
+ * Requires a present + valid visibility. The tier↔visibility consistency clause
+ * is gone with the alias itself (road-to-tier-removal Phase 4) — a stray `tier:`
+ * key is now rejected by `command.schema.json` (`additionalProperties: false`),
+ * not reconciled here.
  */
 export function visibility_error(text: string): string | null {
   const vis = parse_field(text, "visibility");
@@ -134,10 +129,6 @@ export function visibility_error(text: string): string | null {
   if (!VALID_VISIBILITIES.has(vis)) {
     return `invalid visibility '${vis}'`;
   }
-  const tier = parse_field(text, "tier");
-  if (tier !== null && tier in TIER_TO_VISIBILITY && TIER_TO_VISIBILITY[tier] !== vis) {
-    return `visibility '${vis}' disagrees with tier '${tier}' (expected '${TIER_TO_VISIBILITY[tier]}')`;
-  }
   return null;
 }
 
@@ -153,12 +144,6 @@ function stripChar(s: string, ch: string): string {
   return s.slice(start, end);
 }
 
-// Mirror Python's `print(sorted(set))` list repr: ['0', '1', ...].
-function sortedTiersRepr(): string {
-  const items = [...VALID_TIERS].sort();
-  return `[${items.map((s) => `'${s}'`).join(", ")}]`;
-}
-
 // Mirror Python's `print(sorted(VALID_VISIBILITIES))` list repr.
 function sortedVisibilitiesRepr(): string {
   const items = [...VALID_VISIBILITIES].sort();
@@ -184,43 +169,27 @@ export function lint(commands_dir: string, quiet = false): number {
     return 1;
   }
 
-  const missing: string[] = [];
-  const invalid: Array<[string, string]> = [];
   const vis_errors: Array<[string, string]> = [];
 
   for (const cmd of commands) {
     const rel = relPosix(cmd, commands_dir);
     const text = fs.readFileSync(cmd, "utf-8");
-    const tier = parse_tier(text);
-    if (tier === null) {
-      missing.push(rel);
-    } else if (!VALID_TIERS.has(tier)) {
-      invalid.push([rel, tier]);
-    }
     const ve = visibility_error(text);
     if (ve !== null) {
       vis_errors.push([rel, ve]);
     }
   }
 
-  if (missing.length > 0 || invalid.length > 0 || vis_errors.length > 0) {
+  if (vis_errors.length > 0) {
     process.stderr.write(
-      `❌  lint_command_tiers: ${missing.length} missing tier, ` +
-        `${invalid.length} invalid tier, ${vis_errors.length} visibility ` +
+      `❌  lint_command_tiers: ${vis_errors.length} visibility ` +
         `(of ${commands.length} commands)\n`,
     );
-    for (const name of missing) {
-      process.stderr.write(`    missing tier: ${name}\n`);
-    }
-    for (const [name, tier] of invalid) {
-      process.stderr.write(`    invalid tier '${tier}': ${name}\n`);
-    }
     for (const [name, err] of vis_errors) {
       process.stderr.write(`    ${err}: ${name}\n`);
     }
     process.stderr.write(
-      `    valid tiers: ${sortedTiersRepr()}; ` +
-        `valid visibility: ${sortedVisibilitiesRepr()}\n`,
+      `    valid visibility: ${sortedVisibilitiesRepr()}\n`,
     );
     process.stderr.write(
       "    contract: docs/contracts/command-surface-tiers.md (ADR-092)\n",
@@ -231,7 +200,7 @@ export function lint(commands_dir: string, quiet = false): number {
   if (!quiet) {
     process.stdout.write(
       `✅  lint_command_tiers: ${commands.length} commands, ` +
-        "all tier + visibility values valid\n",
+        "all visibility values valid\n",
     );
   }
   return 0;
@@ -246,35 +215,20 @@ export function lint_domain_sources(quiet = false): number {
     );
     return 1;
   }
-  const missing: string[] = [];
-  const invalid: Array<[string, string]> = [];
   const vis_errors: Array<[string, string]> = [];
   for (const c of commands) {
     const rel = relPosix(c, REPO);
     const text = fs.readFileSync(c, "utf-8");
-    const t = parse_tier(text);
-    if (t === null) {
-      missing.push(rel);
-    } else if (!VALID_TIERS.has(t)) {
-      invalid.push([rel, t]);
-    }
     const ve = visibility_error(text);
     if (ve !== null) {
       vis_errors.push([rel, ve]);
     }
   }
-  if (missing.length > 0 || invalid.length > 0 || vis_errors.length > 0) {
+  if (vis_errors.length > 0) {
     process.stderr.write(
-      `❌  lint_command_tiers: ${missing.length} missing tier, ` +
-        `${invalid.length} invalid tier, ${vis_errors.length} visibility ` +
+      `❌  lint_command_tiers: ${vis_errors.length} visibility ` +
         `(of ${commands.length} domain commands)\n`,
     );
-    for (const name of missing) {
-      process.stderr.write(`    missing tier: ${name}\n`);
-    }
-    for (const [name, tier] of invalid) {
-      process.stderr.write(`    invalid tier '${tier}': ${name}\n`);
-    }
     for (const [name, err] of vis_errors) {
       process.stderr.write(`    ${err}: ${name}\n`);
     }
@@ -283,7 +237,7 @@ export function lint_domain_sources(quiet = false): number {
   if (!quiet) {
     process.stdout.write(
       `✅  lint_command_tiers: ${commands.length} domain commands, ` +
-        "all tier + visibility values valid\n",
+        "all visibility values valid\n",
     );
   }
   return 0;
@@ -354,7 +308,7 @@ export function main(): number {
   }
   // The condensed projection is the consumer-facing tree (via the
   // .augment/commands → dist/agent-src/commands symlink). It must also
-  // carry tier so the surface stays uniform.
+  // carry visibility so the surface stays uniform.
   if (_isDir(COMMANDS_DIR_CONDENSED)) {
     rc |= lint(COMMANDS_DIR_CONDENSED, QUIET);
   }

package/src/scripts/lint_originality.ts

@@ -20,6 +20,8 @@
  *
  * Modes:
  *   (no args)          full pairwise audit → agents/reports/originality.{json,md}
+ *   --base <ref>       the revision the change set is measured against; defines
+ *                      what counts as ESTABLISHED scaffold (see below)
  *   --changed <f...>   CI path: each changed file vs the whole same-class corpus
  *                      AND vs the other changed files of its class
  *
@@ -41,7 +43,7 @@
  *      it drifts as commands/skills are added or removed. Re-run the full audit
  *      after any large corpus change; do not treat 40 % as invariant.
  *   2. Adversarial batch masking. In `--changed` mode the boilerplate set is
- *      computed from the corpus MINUS the change set, so a batch of ≥ _dfFloor
+ *      derived from the ESTABLISHED corpus, so a batch of ≥ _dfFloor
  *      near-identical re-skins submitted together cannot classify its own shared
  *      shingles as boilerplate (see `_changed`). The full-audit sweep (no
  *      "changed" notion) does NOT have this guard — a batch of ≥ floor identical
@@ -51,8 +53,35 @@
  *      computes the PR's changed corpus files and runs `--changed` on them
  *      (empty changed set reports INCONCLUSIVE, never a pass).
  *
+ *      HOW "established" is resolved, and why it changed (2026-08-14):
+ *      With `--base <ref>` the established corpus is the class corpus AS IT
+ *      EXISTS AT THAT REVISION — content read from git, not from the worktree.
+ *      Without it, the older approximation applies: on-disk corpus MINUS the
+ *      change set.
+ *
+ *      That approximation has a degeneracy the base-ref form does not. When a
+ *      change set covers (nearly) the whole class — a mechanical edit such as
+ *      dropping one frontmatter key from every command — "corpus minus change
+ *      set" is EMPTY, no shingle clears the DF floor, nothing is scaffold, and
+ *      the class's shared skeleton is scored as authored overlap. Measured on
+ *      road-to-tier-removal Phase 4: the full audit reported worst 40 % / 0
+ *      failures, while `--changed` over the same 200 unmodified-in-substance
+ *      files reported 67.9 % and 3 failures — byte-identical on the base
+ *      revision's own content, so the delta was entirely the masking collapse.
+ *
+ *      The base-ref form does NOT weaken the guard, and it is worth being
+ *      precise about why rather than claiming more. Both forms close the
+ *      re-skin-batch axis, for different reasons: the old one excludes the
+ *      change set outright, the new one relies on those files' shared shingles
+ *      being absent from the base content (a NEW file contributes nothing at
+ *      all; a REWRITTEN file contributes only its OLD text). Either way a
+ *      batch cannot promote its own new shingles to scaffold. What changes is
+ *      only the degenerate case: an established corpus that is empty because
+ *      the change set swallowed it.
+ *
  * Exit 0 clean/warn · 1 fail · 2 usage.
  */
+import { spawnSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
@@ -176,7 +205,11 @@ function _templateShingles(spec: ClassSpec): Set<string> {
 }
 
 function _load(abs: string, cls: ArtifactClass, tmpl: Set<string>): Artifact {
-    const text = fs.readFileSync(abs, 'utf-8');
+    return _loadText(fs.readFileSync(abs, 'utf-8'), abs, cls, tmpl);
+}
+
+/** `_load` over supplied text — used to load a file's content at a base ref. */
+function _loadText(text: string, abs: string, cls: ArtifactClass, tmpl: Set<string>): Artifact {
     const raw = shingles(text, K);
     // Subtract shared scaffold — a shingle also present in the class template
     // is boilerplate, not authored content.
@@ -332,14 +365,41 @@ function _writeReport(byClass: Map<ArtifactClass, Artifact[]>, pairs: Pair[], di
 
 // --- changed mode ------------------------------------------------------------
 
-function _changed(files: string[]): { pairs: Pair[]; fails: number } {
-    // The boilerplate DF set is derived from the ESTABLISHED corpus only — the
-    // change set under review is excluded. Without this, a batch of ≥ _dfFloor
-    // near-identical re-skins submitted together would lift its OWN shared
-    // shingles over the floor, be reclassified as boilerplate, subtracted from
-    // every copy, and score 0 against each other — the gate blinds itself on
-    // exactly the attack it exists to catch. "What is scaffold" must be defined
-    // by the corpus as it stands, never by the diff proposing to change it.
+/**
+ * A corpus file's content at `ref`, or null when the file does not exist there.
+ *
+ * Null is the load-bearing case: a file absent at the base revision is NEW in
+ * this change set, so it contributes nothing to the scaffold definition. That is
+ * what keeps a batch of re-skinned newcomers from masking itself.
+ *
+ * A git failure is indistinguishable from "absent" at this layer, and both
+ * resolve the same conservative way — the file is excluded from scaffold, which
+ * can only make the gate stricter, never blinder.
+ */
+function _textAtRef(ref: string, relpath: string): string | null {
+    const r = spawnSync('git', ['show', `${ref}:${relpath}`], {
+        cwd: ROOT,
+        encoding: 'utf-8',
+        maxBuffer: 32 * 1024 * 1024,
+    });
+    if (r.status !== 0 || typeof r.stdout !== 'string') return null;
+    return r.stdout;
+}
+
+function _changed(files: string[], base: string | null = null): { pairs: Pair[]; fails: number } {
+    // The boilerplate DF set is derived from the ESTABLISHED corpus only.
+    // Without this, a batch of ≥ _dfFloor near-identical re-skins submitted
+    // together would lift its OWN shared shingles over the floor, be
+    // reclassified as boilerplate, subtracted from every copy, and score 0
+    // against each other — the gate blinds itself on exactly the attack it
+    // exists to catch. "What is scaffold" must be defined by the corpus as it
+    // stands, never by the diff proposing to change it.
+    //
+    // `--base` makes "as it stands" literal: scaffold comes from the class
+    // corpus AT THAT REVISION. Without it we fall back to the older
+    // approximation (on-disk minus the change set), which is equivalent for a
+    // small change set but degenerates to an EMPTY established corpus when the
+    // change set covers the class — see the § 2 note in the module header.
     const changedRel = new Set(files.map((f) => _rel(path.resolve(ROOT, f))));
 
     // Build the corpus in RAW (template-subtracted, pre-DF) form per class so we
@@ -351,8 +411,18 @@ function _changed(files: string[]): { pairs: Pair[]; fails: number } {
         const tmpl = _templateShingles(spec);
         templateCache.set(spec.name, tmpl);
         const arts = spec.files().map((f) => _load(f, spec.name, tmpl));
-        // Established corpus = on-disk arts minus the change set.
-        const boiler = _boilerplateSet(arts.filter((a) => !changedRel.has(a.relpath)));
+        // Established corpus: at `base` when given (a file absent there is NEW
+        // and contributes no scaffold), else on-disk arts minus the change set.
+        const established =
+            base === null
+                ? arts.filter((a) => !changedRel.has(a.relpath))
+                : arts
+                      .map((a) => {
+                          const text = _textAtRef(base, a.relpath);
+                          return text === null ? null : _loadText(text, path.resolve(ROOT, a.relpath), spec.name, tmpl);
+                      })
+                      .filter((a): a is Artifact => a !== null);
+        const boiler = _boilerplateSet(established);
         for (const a of arts) _subtract(a, boiler);
         byClass.set(spec.name, arts);
         boilerByClass.set(spec.name, boiler);
@@ -404,13 +474,30 @@ export function main(argv?: string[]): number {
     }
     let quiet = false;
     let changedFiles: string[] | null = null;
+    let base: string | null = null;
     for (let i = 0; i < args.length; i++) {
         const a = args[i] as string;
         if (a === '--quiet') { quiet = true; }
+        else if (a === '--base') {
+            // `--changed` swallows the rest of argv, so `--base` must precede it.
+            const v = args[i + 1];
+            if (v === undefined || v.startsWith('-')) {
+                process.stderr.write(`--base needs a git ref\n${_usage()}`);
+                return 2;
+            }
+            base = v;
+            i += 1;
+        }
         else if (a === '--changed') { changedFiles = args.slice(i + 1).filter((x) => !x.startsWith('-')); break; }
         else if (a.startsWith('-')) { process.stderr.write(`unrecognized argument: ${a}\n${_usage()}`); return 2; }
         else { process.stderr.write(`unexpected argument: ${a} (did you mean --changed ${a}?)\n${_usage()}`); return 2; }
     }
+    if (base !== null && changedFiles === null) {
+        // Silently ignoring it would let a workflow think the base-anchored
+        // scaffold was in effect when the full audit does not use one at all.
+        process.stderr.write(`--base is only meaningful with --changed\n${_usage()}`);
+        return 2;
+    }
 
     // Asserted for BOTH modes, and before either: `--changed` compares each
     // candidate against the same corpus, so a dead root there reports "no
@@ -434,7 +521,7 @@ export function main(argv?: string[]): number {
     }
 
     if (changedFiles !== null) {
-        const { pairs, fails } = _changed(changedFiles);
+        const { pairs, fails } = _changed(changedFiles, base);
         if (pairs.length > 0) {
             const stream = fails > 0 ? process.stderr : process.stdout;
             stream.write(`lint_originality: ${pairs.length} overlap(s) ≥ WARN ${WARN}% (${fails} ≥ FAIL ${FAIL}%):\n`);
@@ -466,7 +553,7 @@ export function main(argv?: string[]): number {
 }
 
 function _usage(): string {
-    return 'usage: lint_originality [--quiet] [--changed <file...>]\n';
+    return 'usage: lint_originality [--quiet] [--base <ref>] [--changed <file...>]\n';
 }
 
 function _isCliEntry(): boolean {

package/src/scripts/lint_plan_risk_register.ts

@@ -39,6 +39,7 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 
 import { parse as parseYaml } from 'yaml';
 
+import { workspaceIdentity } from './_lib/git_common_dir.js';
 import { gitEnv } from './_lib/git_env.js';
 import { splitMarkdownRow } from './_lib/md_table.js';
 import { assertScanned, DeadScopeError } from './_lib/scan_scope.js';
@@ -505,12 +506,26 @@ interface HistoryEntry {
     date: string; // %cs — YYYY-MM-DD
 }
 
+/**
+ * Repo root containing `dir`, or `null` outside a repository.
+ *
+ * Census rows R5–R7. The three call sites below each spawned
+ * `rev-parse --show-toplevel` through `_git` — already `GIT_DIR`-safe via
+ * `gitEnv()`, so this migration is behaviour-identical by construction and
+ * exists to remove the third, fourth and fifth re-derivation of one question,
+ * not to fix a defect. The resolver reads files instead of spawning, so the
+ * three checks also stop costing three subprocesses.
+ */
+function _repoRootOf(dir: string): string | null {
+    const root = workspaceIdentity(dir).repoRoot;
+    return root.resolved ? root.value : null;
+}
+
 /** Newest-first commit history of a file; empty for untracked / non-repo paths. */
 export function fileHistory(absPath: string): HistoryEntry[] {
     const dir = path.dirname(absPath);
-    const top = _git(dir, ['rev-parse', '--show-toplevel']);
-    if (top === null) return [];
-    const root = top.trim();
+    const root = _repoRootOf(dir);
+    if (root === null) return [];
     // Normalize separators: git pathspecs use `/` on every platform, so a raw
     // Windows `path.relative()` result matches nothing and would silently yield
     // an empty history — which the grandfather clause reads as "no baseline".
@@ -540,9 +555,8 @@ export function fileHistory(absPath: string): HistoryEntry[] {
  */
 export function hasUncommittedChanges(absPath: string): boolean {
     const dir = path.dirname(absPath);
-    const top = _git(dir, ['rev-parse', '--show-toplevel']);
-    if (top === null) return false;
-    const root = top.trim();
+    const root = _repoRootOf(dir);
+    if (root === null) return false;
     const rel = path.relative(root, absPath).split(path.sep).join('/');
     const out = _git(root, ['status', '--porcelain', '--', rel]);
     if (out === null) return false;
@@ -551,9 +565,8 @@ export function hasUncommittedChanges(absPath: string): boolean {
 
 function _blobAt(absPath: string, sha: string): string | null {
     const dir = path.dirname(absPath);
-    const top = _git(dir, ['rev-parse', '--show-toplevel']);
-    if (top === null) return null;
-    const root = top.trim();
+    const root = _repoRootOf(dir);
+    if (root === null) return null;
     const rel = path.relative(root, absPath).split(path.sep).join('/');
     return _git(root, ['show', `${sha}:${rel}`]);
 }