@fnclaude/cli 1.1.0 → 2.0.0

package/src/prompts/load.ts

@@ -0,0 +1,100 @@
+/**
+ * Load prompt fragments from disk and inject them into the claude
+ * passthrough as `--append-system-prompt <combined>` (or merge into an
+ * existing one).
+ *
+ * Mirrors Go canonical src/prompts.go for the load + compose + inject
+ * pipeline. Selection logic (which fragments to load) lives in
+ * select.ts; this file just performs the IO + merge.
+ *
+ * Per specs.md §12:
+ *   - Fragments joined with double newline (`\n\n`)
+ *   - Missing fragment: deferred warning, skip, continue with others
+ *   - If --append-system-prompt is already in passthrough, append to its
+ *     value (don't replace) so user-provided content is preserved
+ *
+ * promptsDir is passed in — the resolver (caller) handles the directory
+ * search order ($FNC_PROMPTS_DIR → <exe-dir>/prompts → FHS share path).
+ */
+
+import { readFileSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+
+export interface LoadFragmentsResult {
+  content: string;
+  warnings: string[];
+}
+
+export function loadFragments(
+  names: readonly string[],
+  promptsDir: string,
+): LoadFragmentsResult {
+  const pieces: string[] = [];
+  const warnings: string[] = [];
+
+  for (const name of names) {
+    const path = join(promptsDir, name);
+    try {
+      const st = statSync(path);
+      if (!st.isFile()) {
+        warnings.push(`fnclaude: prompt fragment ${name} not a regular file at ${path}`);
+        continue;
+      }
+      pieces.push(readFileSync(path, 'utf8'));
+    } catch {
+      warnings.push(`fnclaude: prompt fragment ${name} missing from ${promptsDir}`);
+    }
+  }
+
+  return { content: pieces.join('\n\n'), warnings };
+}
+
+const FLAG = '--append-system-prompt';
+const FLAG_EQ = `${FLAG}=`;
+
+export function injectFragments(
+  passthrough: readonly string[],
+  content: string,
+): string[] {
+  if (content === '') return [...passthrough];
+
+  const out = [...passthrough];
+
+  // Find LAST occurrence of --append-system-prompt (in either form).
+  // Later one wins anyway in claude's parser, so we merge into it.
+  let lastFlagIdx = -1;
+  let lastFlagValIdx = -1; // -1 means inline (=val form)
+  for (let i = 0; i < out.length; i++) {
+    if (out[i] === FLAG) {
+      lastFlagIdx = i;
+      lastFlagValIdx = i + 1; // value is the next token
+    } else if (out[i]!.startsWith(FLAG_EQ)) {
+      lastFlagIdx = i;
+      lastFlagValIdx = -1;
+    }
+  }
+
+  if (lastFlagIdx >= 0) {
+    if (lastFlagValIdx === -1) {
+      // Inline form: --append-system-prompt=VAL
+      const tok = out[lastFlagIdx]!;
+      const existing = tok.slice(FLAG_EQ.length);
+      out[lastFlagIdx] = `${FLAG_EQ}${existing}\n\n${content}`;
+    } else if (lastFlagValIdx < out.length) {
+      out[lastFlagValIdx] = `${out[lastFlagValIdx]}\n\n${content}`;
+    } else {
+      // Bare --append-system-prompt at the end with no value: append.
+      out.push(content);
+    }
+    return out;
+  }
+
+  // No existing flag — splice before `--` if present, else push at end.
+  const sentinel = out.indexOf('--');
+  if (sentinel >= 0) {
+    out.splice(sentinel, 0, FLAG, content);
+  } else {
+    out.push(FLAG, content);
+  }
+  return out;
+}

package/src/prompts/select.ts

@@ -0,0 +1,43 @@
+/**
+ * Prompt-fragment selection (§5.5 / design.md §28, specs.md §12.2).
+ *
+ * Determines which of the 5 canonical fragment files should be injected
+ * via --append-system-prompt for the given launch context.
+ *
+ * Selection table:
+ *   agent-pitfall.md  — every interactive (non -p/--print) session
+ *   spawn.md          — every interactive session
+ *   noop-router.md    — noop fallback only
+ *   project-switch.md — non-noop interactive
+ *   restart.md        — non-noop interactive
+ *
+ * Print mode (-p / --print anywhere in passthrough): no fragments
+ * injected — claude is being driven non-interactively.
+ *
+ * Returns fragment FILE NAMES (not contents). Loading is a separate
+ * concern in `prompts/load.ts`.
+ */
+
+export interface SelectFragmentsArgs {
+  usedNoopFallback: boolean;
+  passthrough: readonly string[];
+}
+
+export function isInteractiveSession(passthrough: readonly string[]): boolean {
+  for (const tok of passthrough) {
+    if (tok === '-p' || tok === '--print') return false;
+  }
+  return true;
+}
+
+export function selectFragments(args: SelectFragmentsArgs): string[] {
+  if (!isInteractiveSession(args.passthrough)) return [];
+
+  const out: string[] = ['agent-pitfall.md', 'spawn.md'];
+  if (args.usedNoopFallback) {
+    out.push('noop-router.md');
+  } else {
+    out.push('project-switch.md', 'restart.md');
+  }
+  return out;
+}

package/src/repo/clone-exec.ts

@@ -0,0 +1,37 @@
+/**
+ * Execute a `gh repo clone` to materialize a needs-clone destination.
+ *
+ * Mkdirs the parent first, then delegates to the injected `ghClone`
+ * runner. Surfacing both as injected callbacks keeps this module
+ * unit-testable without any real gh subprocess or filesystem touching.
+ */
+
+import { dirname } from 'node:path';
+
+export type GhCloneResult = { ok: true } | { ok: false; error: string };
+
+export type GhCloneCall = (url: string, destination: string) => Promise<GhCloneResult>;
+
+export type Mkdirp = (path: string) => Promise<void>;
+
+export interface CloneRepoArgs {
+  url: string;
+  destination: string;
+  ghClone: GhCloneCall;
+  mkdirp: Mkdirp;
+}
+
+export type CloneRepoResult = { ok: true } | { ok: false; error: string };
+
+export async function cloneRepo(args: CloneRepoArgs): Promise<CloneRepoResult> {
+  const parent = dirname(args.destination);
+  try {
+    await args.mkdirp(parent);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { ok: false, error: `failed to create parent directory ${parent}: ${msg}` };
+  }
+  const r = await args.ghClone(args.url, args.destination);
+  if (!r.ok) return { ok: false, error: `gh repo clone failed: ${r.error}` };
+  return { ok: true };
+}

package/src/repo/clone.ts

@@ -0,0 +1,45 @@
+/**
+ * Pure preparation for `git clone` / `gh repo clone`: given a resolved
+ * RepoRef, compute (a) the URL to fetch from and (b) the on-disk path
+ * to clone into per the user's `cloneTemplate`. No filesystem, no
+ * network — the orchestrator runs these to plan a clone, then executes.
+ *
+ * Mirrors the bits of Go canonical's resolver.go that sit between
+ * parseRepoRef and the eventual `exec gh repo clone` — specifically
+ * the URL construction (resolver.go's `cloneURL`) and the
+ * template-driven destination path (resolver.go around the
+ * `expandCloneTemplate` call site).
+ */
+
+import { effectiveHost, hasResolvedOwner, type RepoRef } from './ref.ts';
+import { applyTemplate, cloneTemplateVars } from './template.ts';
+import { expandTilde } from '../path/resolve.ts';
+
+export function buildCloneUrl(ref: RepoRef): string {
+  if (!hasResolvedOwner(ref)) {
+    throw new Error(`buildCloneUrl: ref has no owner (original=${JSON.stringify(ref.original)})`);
+  }
+  if (ref.name === '') {
+    throw new Error(`buildCloneUrl: ref has empty name (original=${JSON.stringify(ref.original)})`);
+  }
+  return `https://${effectiveHost(ref)}/${ref.owner}/${ref.name}.git`;
+}
+
+export interface ComputeCloneDestinationArgs {
+  ref: RepoRef;
+  template: string;
+  hostAliases: Record<string, string>;
+  home: string;
+}
+
+export type ComputeCloneDestinationResult =
+  | { ok: true; path: string }
+  | { ok: false; error: string };
+
+export function computeCloneDestination(args: ComputeCloneDestinationArgs): ComputeCloneDestinationResult {
+  const { ref, template, hostAliases, home } = args;
+  const vars = cloneTemplateVars(ref.name, ref.owner, effectiveHost(ref), hostAliases);
+  const applied = applyTemplate(template, vars);
+  if (!applied.ok) return applied;
+  return { ok: true, path: expandTilde(applied.value, home) };
+}

package/src/repo/gh-runner.ts

@@ -0,0 +1,68 @@
+/**
+ * Thin Bun.spawn wrappers around the `gh` CLI calls we need at the
+ * resolver boundary:
+ *
+ *   - `gh api <path> --jq <jq>` — used for owner lookups.
+ *   - `gh repo clone <url> <dest>` — used to materialize needs-clone refs.
+ *
+ * These spawn real processes; orchestration logic stays in
+ * `owner-lookup.ts` / `clone-exec.ts` and is unit-testable via the
+ * injected `GhApiCall` / `GhCloneCall` callbacks. Production wiring in
+ * `main.ts` plugs these runners into those orchestrators.
+ *
+ * On any spawn failure (gh missing, auth missing, network), we surface a
+ * structured error rather than throwing — the caller decides whether to
+ * keep walking the candidate list or fail the whole resolution.
+ */
+
+import type { GhApiResult } from './owner-lookup.ts';
+import type { GhCloneResult } from './clone-exec.ts';
+
+const GH_API_PATH_JQ: Record<string, string> = {
+  user: '.login',
+  '/user/orgs': '.[].login',
+};
+
+export async function runGhApi(path: string): Promise<GhApiResult> {
+  const jq = GH_API_PATH_JQ[path];
+  const args = jq !== undefined ? ['api', path, '--jq', jq] : ['api', path];
+  let proc: ReturnType<typeof Bun.spawn>;
+  try {
+    proc = Bun.spawn(['gh', ...args], {
+      stdin: 'ignore',
+      stdout: 'pipe',
+      stderr: 'pipe',
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { ok: false, status: -1, error: `failed to spawn gh: ${msg}` };
+  }
+  const [stdout, stderr] = await Promise.all([
+    new Response(proc.stdout).text(),
+    new Response(proc.stderr).text(),
+  ]);
+  const exitCode = await proc.exited;
+  if (exitCode !== 0) {
+    return { ok: false, status: exitCode, error: stderr.trim() };
+  }
+  return { ok: true, body: stdout };
+}
+
+export async function runGhClone(url: string, destination: string): Promise<GhCloneResult> {
+  let proc: ReturnType<typeof Bun.spawn>;
+  try {
+    proc = Bun.spawn(['gh', 'repo', 'clone', url, destination], {
+      stdin: 'ignore',
+      stdout: 'inherit',
+      stderr: 'inherit',
+    });
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return { ok: false, error: `failed to spawn gh: ${msg}` };
+  }
+  const exitCode = await proc.exited;
+  if (exitCode !== 0) {
+    return { ok: false, error: `gh exited ${exitCode}` };
+  }
+  return { ok: true };
+}

package/src/repo/host-aliases.ts

@@ -0,0 +1,58 @@
+/**
+ * Two-layer host-aliases LUT loader for {host-short} template substitution.
+ *
+ * Mirrors Go canonical's `src/host_aliases.go:25-95`. Both fnclaude (this
+ * file) and the claude-code-worktree-paths plugin (`src/host-aliases.ts`
+ * over there) read the same files so a single config feeds both tools.
+ *
+ * Real default file locations (see design.md §23):
+ *   system: /usr/share/fnrhombus/host-aliases.json
+ *   user:   ~/.local/share/fnrhombus/host-aliases.json
+ *
+ * Paths are injected here so tests can use temp files; callers wire in
+ * the real defaults.
+ *
+ * Robustness: missing file, malformed JSON, non-object root → that
+ * file's contribution is empty. Individual non-string values within an
+ * otherwise-valid object → drop that key only, keep the rest. The user
+ * file's keys win over system file's keys on conflict.
+ */
+
+import { readFileSync, statSync } from 'node:fs';
+
+export interface LoadHostAliasesArgs {
+  systemPath: string;
+  userPath: string;
+}
+
+export function loadHostAliases(args: LoadHostAliasesArgs): Record<string, string> {
+  const merged: Record<string, string> = {};
+  for (const v of Object.entries(readOneLayer(args.systemPath))) merged[v[0]] = v[1];
+  for (const v of Object.entries(readOneLayer(args.userPath))) merged[v[0]] = v[1];
+  return merged;
+}
+
+function readOneLayer(path: string): Record<string, string> {
+  let raw: string;
+  try {
+    const st = statSync(path);
+    if (!st.isFile()) return {};
+    raw = readFileSync(path, 'utf8');
+  } catch {
+    return {};
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {};
+  }
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    return {};
+  }
+  const out: Record<string, string> = {};
+  for (const [k, v] of Object.entries(parsed as Record<string, unknown>)) {
+    if (typeof v === 'string') out[k] = v;
+  }
+  return out;
+}

package/src/repo/owner-lookup.ts

@@ -0,0 +1,71 @@
+/**
+ * Cross-org bare-name owner resolution (design.md §17).
+ *
+ * Given a bare repo name with no owner, ask the gh CLI:
+ *   1. `gh api user` → authenticated user's login
+ *   2. `gh api /user/orgs` → comma/newline-separated org logins
+ *   3. For each candidate (user first, then orgs in API order),
+ *      `gh api repos/<owner>/<name>` → 200 means we found it.
+ * First match wins.
+ *
+ * The gh subprocess is injected as `ghApi` so unit tests can stub it
+ * without spawning anything. The real spawner lives in `gh-runner.ts`.
+ *
+ * Failures:
+ *   - `gh api user` errors AND we have no other candidates → 'gh-failed'.
+ *   - `gh api /user/orgs` errors → continue with user-only candidates.
+ *   - No candidate's repo exists → 'not-found'.
+ */
+
+export type GhApiResult =
+  | { ok: true; body: string }
+  | { ok: false; status: number; error: string };
+
+export type GhApiCall = (path: string) => Promise<GhApiResult>;
+
+export interface FindOwnerArgs {
+  name: string;
+  ghApi: GhApiCall;
+}
+
+export type FindOwnerResult =
+  | { ok: true; owner: string }
+  | { ok: false; reason: 'gh-failed' | 'not-found' };
+
+export async function findOwner(args: FindOwnerArgs): Promise<FindOwnerResult> {
+  const candidates: string[] = [];
+
+  const userR = await args.ghApi('user');
+  if (userR.ok) {
+    const login = parseLoginBody(userR.body);
+    if (login !== '') candidates.push(login);
+  }
+
+  const orgsR = await args.ghApi('/user/orgs');
+  if (orgsR.ok) {
+    candidates.push(...parseOrgsBody(orgsR.body));
+  }
+
+  if (candidates.length === 0) return { ok: false, reason: 'gh-failed' };
+
+  for (const owner of candidates) {
+    const r = await args.ghApi(`repos/${owner}/${args.name}`);
+    if (r.ok) return { ok: true, owner };
+  }
+
+  return { ok: false, reason: 'not-found' };
+}
+
+function parseLoginBody(body: string): string {
+  // `gh api user --jq .login` returns the login as a single line (with
+  // trailing newline). We don't pass --jq here, but the gh-runner uses it,
+  // so the body is the bare login. Be defensive about whitespace.
+  return body.trim();
+}
+
+function parseOrgsBody(body: string): string[] {
+  return body
+    .split('\n')
+    .map((s) => s.replace(/\r$/, '').trim())
+    .filter((s) => s !== '');
+}

package/src/repo/ref.ts

@@ -0,0 +1,146 @@
+/**
+ * Parse user-typed repo references into structured RepoRef values.
+ *
+ * Ports Go canonical `parseRepoRef` (src/repo_ref.go) and friends:
+ * everything is pure-string transformation. No filesystem, no network,
+ * no gh CLI. The existence-on-GitHub check and the on-disk clone
+ * happen later in the orchestrator (§3.4 follow-up).
+ *
+ * Supported input forms (with optional "+workspace" suffix on any of them):
+ *
+ *   <name>                                    → ref{name}
+ *   <name>@<owner>                            → ref{name, owner}
+ *   <owner>/<name>                            → ref{owner, name}
+ *   gh:<owner>/<name>                         → ref{owner, name, host="github.com"}
+ *   https://<host>/<owner>/<name>[.git]       → ref{host, owner, name}
+ *   http://...                                → same
+ *   git@<host>:<owner>/<name>[.git]           → ref{host, owner, name}
+ *   ssh://[user@]<host>/<owner>/<name>[.git]  → ref{host, owner, name}
+ *
+ * Inputs starting with `/`, `~/`, or bare `~` are NOT repo refs — the
+ * caller short-circuits before this function.
+ */
+
+export interface RepoRef {
+  host: string;
+  owner: string;
+  name: string;
+  workspace: string;
+  original: string;
+}
+
+export interface ParseRepoRefOk {
+  ok: true;
+  ref: RepoRef;
+}
+
+export interface ParseRepoRefErr {
+  ok: false;
+  error: string;
+}
+
+export type ParseRepoRefResult = ParseRepoRefOk | ParseRepoRefErr;
+
+const URL_RE = /^(?:(?:https?|ssh):\/\/(?:[^@/]+@)?)([^:/]+)\/([^/]+)\/([^/]+?)(?:\.git)?\/?$/;
+const SCP_RE = /^git@([^:]+):([^/]+)\/([^/]+?)(?:\.git)?\/?$/;
+
+function makeRef(original: string): RepoRef {
+  return { host: '', owner: '', name: '', workspace: '', original };
+}
+
+export function parseRepoRef(input: string): ParseRepoRefResult {
+  if (input === '') {
+    return { ok: false, error: 'empty repo reference' };
+  }
+  const ref = makeRef(input);
+
+  // Split off workspace suffix first.
+  let body = input;
+  const plusIdx = body.indexOf('+');
+  if (plusIdx >= 0) {
+    ref.workspace = body.slice(plusIdx + 1);
+    body = body.slice(0, plusIdx);
+    if (ref.workspace === '') {
+      return { ok: false, error: `empty workspace after \`+\` in ${JSON.stringify(input)}` };
+    }
+  }
+
+  // URL forms.
+  const urlMatch = URL_RE.exec(body);
+  if (urlMatch) {
+    ref.host = urlMatch[1]!;
+    ref.owner = urlMatch[2]!;
+    ref.name = urlMatch[3]!;
+    return { ok: true, ref };
+  }
+  const scpMatch = SCP_RE.exec(body);
+  if (scpMatch) {
+    ref.host = scpMatch[1]!;
+    ref.owner = scpMatch[2]!;
+    ref.name = scpMatch[3]!;
+    return { ok: true, ref };
+  }
+
+  // gh:owner/name shorthand.
+  if (body.startsWith('gh:')) {
+    const rest = body.slice(3);
+    const slashIdx = rest.indexOf('/');
+    if (slashIdx > 0 && slashIdx < rest.length - 1) {
+      const owner = rest.slice(0, slashIdx);
+      const name = rest.slice(slashIdx + 1);
+      if (/[/@:]/.test(owner) || /[/@:]/.test(name)) {
+        return { ok: false, error: `invalid gh: form: ${JSON.stringify(input)}` };
+      }
+      ref.host = 'github.com';
+      ref.owner = owner;
+      ref.name = name;
+      return { ok: true, ref };
+    }
+    return { ok: false, error: `gh: form requires owner/name, got ${JSON.stringify(input)}` };
+  }
+
+  // owner/name (single slash, no scheme).
+  const slashIdx = body.indexOf('/');
+  if (slashIdx > 0) {
+    if (body.indexOf('/', slashIdx + 1) >= 0) {
+      return { ok: false, error: `ambiguous form ${JSON.stringify(input)} (multiple slashes)` };
+    }
+    const owner = body.slice(0, slashIdx);
+    const name = body.slice(slashIdx + 1);
+    if (/[@:]/.test(owner) || /[@:]/.test(name) || owner === '' || name === '') {
+      return { ok: false, error: `invalid owner/name form: ${JSON.stringify(input)}` };
+    }
+    ref.owner = owner;
+    ref.name = name;
+    return { ok: true, ref };
+  }
+
+  // name@owner (Tom local-convention).
+  const atIdx = body.indexOf('@');
+  if (atIdx > 0) {
+    const name = body.slice(0, atIdx);
+    const owner = body.slice(atIdx + 1);
+    if (/[@:/]/.test(owner) || /[@:/]/.test(name) || owner === '' || name === '') {
+      return { ok: false, error: `invalid name@owner form: ${JSON.stringify(input)}` };
+    }
+    ref.name = name;
+    ref.owner = owner;
+    return { ok: true, ref };
+  }
+
+  // Bare name — but reject if it contains URL-like special chars (defense
+  // in depth, the above branches should have caught these).
+  if (/[/@:]/.test(body)) {
+    return { ok: false, error: `unparseable repo reference: ${JSON.stringify(input)}` };
+  }
+  ref.name = body;
+  return { ok: true, ref };
+}
+
+export function hasResolvedOwner(ref: RepoRef): boolean {
+  return ref.owner !== '';
+}
+
+export function effectiveHost(ref: RepoRef): string {
+  return ref.host !== '' ? ref.host : 'github.com';
+}

package/src/repo/repo-settings.ts

@@ -0,0 +1,99 @@
+/**
+ * Four-tier repoSettings loader. Reads the `repoSettings` block from each
+ * tier's settings.json and shallow-merges per field.
+ *
+ * Precedence (lowest to highest — later wins):
+ *   1. User      — ~/.claude/settings.json
+ *   2. Project   — <projectRoot>/.claude/settings.json
+ *   3. Local     — <projectRoot>/.claude/settings.local.json
+ *   4. Managed   — platform-specific (org policy; can't be overridden)
+ *
+ * The `projectRoot` for resolution-time settings is the shell cwd at
+ * fnclaude startup (per specs.md §18.7), which is evaluated BEFORE path
+ * resolution runs — that's why we can read project-tier settings without
+ * having resolved the launch cwd yet.
+ *
+ * Paths are passed in (not hardcoded) so tests can use temp files. Caller
+ * wires in the real defaults; managedPath may be omitted on platforms
+ * where the managed-settings file is irrelevant.
+ *
+ * Mirrors Go canonical `src/repo_settings.go:51-89`.
+ *
+ * Robustness — every failure mode degrades silently to "this tier
+ * contributes nothing":
+ *   - missing file, malformed JSON, non-object root
+ *   - `repoSettings` field is missing OR not an object
+ *   - individual field value is not a string (drop that field only,
+ *     keep the rest from that tier)
+ *
+ * Only the four known fields are extracted. Unknown fields under
+ * `repoSettings` are ignored. fnclaude itself only acts on
+ * `cloneTemplate`; the other three are read for completeness (the
+ * claude-code-worktree-paths plugin reads them).
+ */
+
+import { readFileSync, statSync } from 'node:fs';
+
+export interface RepoSettings {
+  cloneTemplate: string;
+  worktreeTemplate: string;
+  branchTemplate: string;
+  gateEnvVar: string;
+}
+
+export interface LoadRepoSettingsArgs {
+  userPath: string;
+  projectPath: string;
+  localPath: string;
+  managedPath?: string;
+}
+
+const KNOWN_FIELDS: ReadonlyArray<keyof RepoSettings> = [
+  'cloneTemplate',
+  'worktreeTemplate',
+  'branchTemplate',
+  'gateEnvVar',
+];
+
+function emptySettings(): RepoSettings {
+  return { cloneTemplate: '', worktreeTemplate: '', branchTemplate: '', gateEnvVar: '' };
+}
+
+export function loadRepoSettings(args: LoadRepoSettingsArgs): RepoSettings {
+  const merged = emptySettings();
+  const tiers = [args.userPath, args.projectPath, args.localPath, args.managedPath];
+  for (const path of tiers) {
+    if (path === undefined) continue;
+    const tier = readTier(path);
+    for (const field of KNOWN_FIELDS) {
+      const v = tier[field];
+      if (typeof v === 'string') merged[field] = v;
+    }
+  }
+  return merged;
+}
+
+function readTier(path: string): Partial<Record<keyof RepoSettings, unknown>> {
+  let raw: string;
+  try {
+    const st = statSync(path);
+    if (!st.isFile()) return {};
+    raw = readFileSync(path, 'utf8');
+  } catch {
+    return {};
+  }
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return {};
+  }
+  if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    return {};
+  }
+  const repoSettings = (parsed as Record<string, unknown>).repoSettings;
+  if (repoSettings === null || typeof repoSettings !== 'object' || Array.isArray(repoSettings)) {
+    return {};
+  }
+  return repoSettings as Record<string, unknown>;
+}