@mattstack/rt-client 0.2.0 → 0.3.0

package/dist/index.js

@@ -1,9 +1,12 @@
 // src/transport.ts
 import { homedir } from "os";
 import { join } from "path";
-var DEFAULT_SOCK = join(homedir(), ".rt", "rt.sock");
+function defaultSock() {
+  return join(process.env.HOME ?? homedir(), ".mattstack", "rt", "rt.sock");
+}
+var DEFAULT_SOCK = defaultSock();
 async function rtCommand(cmd, payload, opts = {}) {
-  const sockPath = opts.sockPath ?? DEFAULT_SOCK;
+  const sockPath = opts.sockPath ?? defaultSock();
   try {
     const res = await fetch(`http://localhost/${cmd}`, {
       unix: sockPath,
@@ -41,7 +44,13 @@ var COMMAND_NAMES = [
   "project-mrs:read",
   "discussions:read",
   "mr:by-branch",
-  "secrets:forge-token"
+  "secrets:forge-token",
+  "secrets:read",
+  "events:emit",
+  "events:wait",
+  "events:list",
+  "runs:list",
+  "runs:get"
 ];
 // src/relay.ts
 var DEFAULT_WS_URL = "ws://127.0.0.1:9401/ws";
@@ -91,7 +100,7 @@ import { existsSync, readFileSync } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join2 } from "path";
 function defaultReposJsonPath() {
-  return join2(homedir2(), ".rt", "repos.json");
+  return join2(homedir2(), ".mattstack", "rt", "repos.json");
 }
 function repoNameForPath(repoPath, reposJsonPath) {
   const path = reposJsonPath ?? defaultReposJsonPath();
@@ -109,14 +118,1124 @@ function repoNameForPath(repoPath, reposJsonPath) {
     return null;
   }
 }
+// src/settings/resolve.ts
+import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
+
+// src/settings/paths.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { homedir as homedir3, hostname } from "os";
+import { join as join3 } from "path";
+function home() {
+  return process.env.HOME ?? homedir3();
+}
+function userSettingsPath() {
+  return join3(home(), ".mattstack", "user", "settings.user.jsonc");
+}
+function teamSettingsPath(team) {
+  return join3(teamsDir(), team, "mattstack", "settings.team.jsonc");
+}
+function machineSettingsPath() {
+  return join3(home(), ".mattstack", "user", "local", machineKey(), "settings.local.jsonc");
+}
+function teamsDir() {
+  return join3(home(), ".mattstack", "teams");
+}
+function machineKey() {
+  const override = join3(home(), ".mattstack", "machine-key");
+  try {
+    const v = readFileSync2(override, "utf8").trim();
+    if (isSafeMachineKeySegment(v))
+      return v;
+  } catch {}
+  const slug = hostname().toLowerCase().replace(/\.local$/, "").replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
+  return slug || "default";
+}
+function isSafeMachineKeySegment(v) {
+  return v.length > 0 && v !== "." && v !== ".." && !v.includes("/") && !v.includes("\\");
+}
+
+// src/settings/registry-defs.ts
+var ALL_SCOPES = ["user", "team", "machine"];
+var REGISTRY = [
+  {
+    key: "rt.roles",
+    type: "object",
+    scopes: ALL_SCOPES,
+    merge: "deep",
+    repoScoped: true,
+    migrated: true,
+    pathGuardFields: ["hook"],
+    description: "Per-repo dev-role definitions: port pools, env passthrough, and the dev-server hook command."
+  },
+  {
+    key: "rt.intercepts",
+    type: "array",
+    scopes: ALL_SCOPES,
+    merge: "replace",
+    repoScoped: true,
+    migrated: true,
+    description: "Per-repo endpoint intercept rules consumed by rt intercept install."
+  },
+  {
+    key: "rt.worktrees",
+    type: "object",
+    scopes: ALL_SCOPES,
+    default: { onDeck: 0 },
+    merge: "deep",
+    repoScoped: true,
+    migrated: true,
+    description: "Per-repo worktree pool config (onDeck size, ready steps, name pool); root/branchFormat/ready computed-or-empty in the reader."
+  },
+  {
+    key: "rt.repoIdentityOverrides",
+    type: "object",
+    scopes: ["machine"],
+    merge: "replace",
+    migrated: true,
+    description: "Map of observed remote URL to pinned repo identity, for forks/multi-remote repos on this machine."
+  },
+  {
+    key: "rt.repoRoots",
+    type: "array",
+    scopes: ["machine"],
+    default: [],
+    merge: "replace",
+    migrated: true,
+    description: 'Directories rt scans for git repos (rt cd, run-outside-a-repo pickers). Entries may start with "~/" or use "${home}". One level deep, plus worktree-pool parent folders one level deeper.'
+  },
+  {
+    key: "rt.notifications",
+    type: "object",
+    scopes: ["user"],
+    merge: "deep",
+    migrated: true,
+    description: "Desktop notification preferences (which events notify, sound on/off)."
+  },
+  {
+    key: "rt.cron",
+    type: "object",
+    scopes: ["machine"],
+    merge: "deep",
+    migrated: true,
+    description: "Scheduled rt job definitions and their cron expressions. Restart the daemon to apply changes."
+  },
+  {
+    key: "rt.repoTracking",
+    type: "object",
+    scopes: ["machine"],
+    merge: "deep",
+    migrated: true,
+    description: "Which repos rt tracks for background sync and status polling."
+  },
+  {
+    key: "rt.runsPruneDays",
+    type: "number",
+    scopes: ["machine"],
+    default: 30,
+    merge: "replace",
+    migrated: true,
+    description: "Age floor in days for pruning finished pipeline run directories under ~/.mattstack/runs (default 30)."
+  },
+  {
+    key: "rt.runaway",
+    type: "object",
+    scopes: ["machine"],
+    merge: "deep",
+    migrated: true,
+    description: "Thresholds for the runaway-process guard that kills stuck dev servers. Restart the daemon to apply changes."
+  },
+  {
+    key: "rt.workspacePrefs",
+    type: "object",
+    scopes: ["machine"],
+    merge: "deep",
+    migrated: true,
+    description: "Per-machine editor/terminal preferences applied when opening a worktree."
+  },
+  {
+    key: "rt.homeSnapshot",
+    type: "object",
+    scopes: ["machine"],
+    default: { enabled: true, debounceSec: 20, pushDelaySec: 60, janitorThresholdHours: 6, janitorIntervalMin: 30 },
+    merge: "deep",
+    migrated: true,
+    description: "Home-repo snapshot daemon config: enabled, debounce/push delays, and the janitor threshold/interval for zones left dirty too long."
+  },
+  {
+    key: "rt.sync",
+    type: "object",
+    scopes: ALL_SCOPES,
+    merge: "deep",
+    repoScoped: true,
+    migrated: true,
+    description: "Branch sync behavior: fast-forward rules and stale-branch handling."
+  },
+  {
+    key: "rt.branchNaming",
+    type: "object",
+    scopes: ALL_SCOPES,
+    merge: "deep",
+    repoScoped: true,
+    migrated: true,
+    description: "Branch-naming templates. rt itself has no readers of this key yet — the VS Code extension still reads repos/<repo>/branch-naming.json by repo name, which stays authoritative until the extension ports over. Setting this key stores a value nothing consumes."
+  },
+  {
+    key: "rt.variations",
+    type: "object",
+    scopes: ALL_SCOPES,
+    merge: "deep",
+    repoScoped: true,
+    migrated: true,
+    description: "Named parameter sets rt run can pick between for a command."
+  },
+  {
+    key: "rt.presets",
+    type: "object",
+    scopes: ALL_SCOPES,
+    merge: "deep",
+    repoScoped: true,
+    migrated: true,
+    description: "Saved argument presets for frequently repeated rt commands, keyed by name."
+  },
+  {
+    key: "rt.dopplerTemplate",
+    type: "array",
+    scopes: ALL_SCOPES,
+    merge: "replace",
+    repoScoped: true,
+    migrated: true,
+    description: "Template used to generate a repo's Doppler secrets config."
+  },
+  {
+    key: "rt.worktreeApp",
+    type: "object",
+    scopes: ["machine"],
+    merge: "deep",
+    migrated: true,
+    description: "Machine-local worktree feature toggle (enabled, killProcesses); ownership-latch port of ~/.mattstack/rt/worktrees.json, store wins per field. A distinct key from rt.worktrees (the per-repo pool config above) on purpose — same file family, unrelated shape and scope."
+  },
+  {
+    key: "rt.sdmEnrichment",
+    type: "object",
+    scopes: ["team"],
+    merge: "replace",
+    migrated: true,
+    description: "Team-declared StrongDM resource enrichment (resource name -> label/tier/db/reasonSuggestion); team-ONLY by design, enrichment names employer resources and must never be settable in a user or machine store. Ownership-latch port of ~/.mattstack/rt/sdm/enrichment.jsonc, store wins wholesale (a name-keyed map, not a field-bag)."
+  },
+  {
+    key: "rt.logRetentionDays",
+    type: "number",
+    scopes: ["machine", "user"],
+    default: 14,
+    merge: "replace",
+    migrated: true,
+    description: "Age floor in days for the log janitor pruning every surface's rotated log files under ~/.mattstack/rt/logs (default 14). A fresh key, not an ownership-latch port, so a default is fine here."
+  },
+  {
+    key: "rt.hooks",
+    type: "object",
+    scopes: ALL_SCOPES,
+    merge: "deep",
+    repoScoped: true,
+    migrated: false,
+    legacyFile: "repos/<repo>/hooks.json",
+    description: "User-defined lifecycle hooks rt runs around commands (pre/post command scripts)."
+  },
+  {
+    key: "mattstack.integrations",
+    type: "object",
+    scopes: ["team"],
+    merge: "deep",
+    description: "Team-wide external integration config (forge/slack/linear/switchboard) the installer provisions; client secrets never live here."
+  },
+  {
+    key: "mattstack.tracking",
+    type: "object",
+    scopes: ["team"],
+    merge: "deep",
+    description: 'Team-declared repo tracking intent, identity-keyed; the daemon layers it under machine-scoped rt.repoTracking, which wins per repo whenever it names that repo at all — including an explicit local {mode:"off"} entry, the way to opt a repo out of team-declared tracking.'
+  },
+  {
+    key: "mattstack.appPath",
+    type: "string",
+    scopes: ["machine"],
+    merge: "replace",
+    description: "Absolute path to the installed mattstack.app bundle, written by the app at launch so rt stops hardcoding ~/Applications."
+  },
+  {
+    key: "claude.marketplaces",
+    type: "array",
+    scopes: ["user", "team"],
+    merge: "replace",
+    description: "Claude Code plugin marketplaces to replay on restore, in add order."
+  },
+  {
+    key: "claude.plugins",
+    type: "array",
+    scopes: ["user", "team"],
+    merge: "replace",
+    description: "Claude Code plugins to replay on restore, in install order."
+  },
+  {
+    key: "deck.apps",
+    type: "object",
+    scopes: ["user"],
+    merge: "deep",
+    description: "Per-app deck publish state (published flag, publicFollowsOverride); password hashes and session secrets stay out of this store."
+  },
+  {
+    key: "deck.access",
+    type: "object",
+    scopes: ["user"],
+    merge: "deep",
+    description: "deck's access-control roster, migrated from access.json."
+  },
+  {
+    key: "deck.platform",
+    type: "object",
+    scopes: ["machine"],
+    merge: "deep",
+    description: "deck's platform-level machine config: public domain and legacy URL prefixes; Cloudflare secrets stay out of this store."
+  },
+  {
+    key: "board.gitlabHost",
+    type: "string",
+    scopes: ["team"],
+    merge: "replace",
+    description: "GitLab host the board polls for MRs, shared by the whole team."
+  },
+  {
+    key: "board.projects",
+    type: "array",
+    scopes: ["team"],
+    merge: "replace",
+    description: "GitLab projects the board tracks, shared by the whole team."
+  },
+  {
+    key: "board.members",
+    type: "array",
+    scopes: ["team"],
+    merge: "replace",
+    description: "The board's full member roster, including hidden-by-default entries."
+  },
+  {
+    key: "board.title",
+    type: "string",
+    scopes: ["team"],
+    merge: "replace",
+    description: "Display title shown in the board's UI."
+  },
+  {
+    key: "board.botUsernames",
+    type: "array",
+    scopes: ["team"],
+    merge: "replace",
+    description: "GitLab usernames the board treats as bots, excluded from human MR attribution."
+  },
+  {
+    key: "board.ticketPrefixes",
+    type: "array",
+    scopes: ["team"],
+    merge: "replace",
+    description: "Ticket key prefixes (e.g. RT, MAT) the board links out to Linear from an MR title."
+  },
+  {
+    key: "board.slack",
+    type: "object",
+    scopes: ["team"],
+    merge: "deep",
+    description: "The board's Slack posting config (app id, client id, channel, callback port); client secrets stay out of this store."
+  },
+  {
+    key: "board.doctorSkill",
+    type: "string",
+    scopes: ["team"],
+    merge: "replace",
+    description: "Default doctor skill for repairing a stuck MR; a repo's skills.jsonc doctor slot overrides it when present."
+  },
+  {
+    key: "board.triage.doctorSkill",
+    type: "string",
+    scopes: ["team"],
+    merge: "replace",
+    description: "Doctor skill the board's own API-tier triage sweep runs on your MRs; deliberately never resolved through a repo's skills.jsonc manifest. A sibling flat key of board.triage, not a field inside it — the board reader assembles the two independently."
+  },
+  {
+    key: "board.staleAfterDays",
+    type: "number",
+    scopes: ["user"],
+    merge: "replace",
+    description: "Days of MR inactivity before the board flags it stale, for this developer."
+  },
+  {
+    key: "board.workspaces",
+    type: "object",
+    scopes: ["user"],
+    merge: "deep",
+    description: "Herdr workspace names the board's review/respond/doctor panes launch into, per developer."
+  },
+  {
+    key: "board.defaultMember",
+    type: "string",
+    scopes: ["user"],
+    merge: "replace",
+    description: "Which board member identity this developer's local board runs as by default."
+  },
+  {
+    key: "board.hiddenMembers",
+    type: "array",
+    scopes: ["user"],
+    merge: "replace",
+    description: "Usernames this developer hides from the team roster's board.members list; overlays the team truth without editing it."
+  },
+  {
+    key: "board.triage",
+    type: "object",
+    scopes: ["user"],
+    merge: "deep",
+    description: "This developer's triage user-intent flags (which triage sweeps run automatically); a sibling flat key of board.triage.doctorSkill, not its container — the board reader assembles the two independently."
+  },
+  {
+    key: "board.claudeCommand",
+    type: "string",
+    scopes: ["machine"],
+    merge: "replace",
+    description: "Local command used to launch Claude Code for the board's review/respond/doctor panes."
+  },
+  {
+    key: "board.cwds",
+    type: "object",
+    scopes: ["machine"],
+    merge: "deep",
+    description: "Local working directories the board's review/respond/doctor panes launch from."
+  },
+  {
+    key: "board.rtRepos",
+    type: "array",
+    scopes: ["machine"],
+    merge: "replace",
+    description: "rt-registered repo names the board resolves MRs against on this machine."
+  },
+  {
+    key: "board.triageMaxConcurrent",
+    type: "number",
+    scopes: ["machine"],
+    merge: "replace",
+    description: "Max concurrent triage panes the board launches on this machine."
+  },
+  {
+    key: "board.switchboardUrl",
+    type: "string",
+    scopes: ["machine"],
+    merge: "replace",
+    description: "Local switchboard URL the board's POST /peer/join writer targets."
+  },
+  {
+    key: "gitq.workSlots",
+    type: "object",
+    scopes: ["machine"],
+    merge: "deep",
+    description: "gitq's local work-slot config: on-disk location and the max slot count."
+  },
+  {
+    key: "gitq.forges",
+    type: "object",
+    scopes: ["user"],
+    merge: "deep",
+    description: "gitq's host-keyed forge config, tokenEnv names only — never a live token."
+  },
+  {
+    key: "gitq.board",
+    type: "object",
+    scopes: ["machine"],
+    merge: "deep",
+    description: "gitq checkout-board config: tracked repos, local port, and the herdr workspace it launches into."
+  }
+];
+
+// src/settings/registry-machinery.ts
+var BY_KEY = new Map(REGISTRY.map((def) => [def.key, def]));
+function getDef(key) {
+  return BY_KEY.get(key);
+}
+function allDefs() {
+  return [...REGISTRY];
+}
+function isMigrated(def) {
+  return def.migrated !== false;
+}
+var PATH_LIKE = /^[/~]/;
+function typeOf(value) {
+  if (value === null)
+    return "null";
+  if (Array.isArray(value))
+    return "array";
+  return typeof value;
+}
+function validateValue(def, value) {
+  const typeCheck = checkType(def.type, value);
+  if (!typeCheck.ok)
+    return typeCheck;
+  if (def.pathGuardFields && def.pathGuardFields.length > 0) {
+    const violation = findPathGuardViolation(value, def.pathGuardFields);
+    if (violation) {
+      return {
+        ok: false,
+        reason: `field "${violation.field}" looks like a path literal ("${violation.value}"); path literals are only legal in the machine store`
+      };
+    }
+  }
+  return { ok: true };
+}
+function checkType(type, value) {
+  switch (type) {
+    case "string":
+      return typeof value === "string" ? { ok: true } : { ok: false, reason: `expected string, got ${typeOf(value)}` };
+    case "number":
+      return typeof value === "number" ? { ok: true } : { ok: false, reason: `expected number, got ${typeOf(value)}` };
+    case "boolean":
+      return typeof value === "boolean" ? { ok: true } : { ok: false, reason: `expected boolean, got ${typeOf(value)}` };
+    case "array":
+      return Array.isArray(value) ? { ok: true } : { ok: false, reason: `expected array, got ${typeOf(value)}` };
+    case "object":
+      return value !== null && typeof value === "object" && !Array.isArray(value) ? { ok: true } : { ok: false, reason: `expected object, got ${typeOf(value)}` };
+  }
+}
+function findPathGuardViolation(value, guardFields) {
+  if (Array.isArray(value)) {
+    for (const item of value) {
+      const hit = findPathGuardViolation(item, guardFields);
+      if (hit)
+        return hit;
+    }
+    return null;
+  }
+  if (value !== null && typeof value === "object") {
+    for (const [field, fieldValue] of Object.entries(value)) {
+      if (guardFields.includes(field) && typeof fieldValue === "string" && PATH_LIKE.test(fieldValue)) {
+        return { field, value: fieldValue };
+      }
+      const hit = findPathGuardViolation(fieldValue, guardFields);
+      if (hit)
+        return hit;
+    }
+  }
+  return null;
+}
+
+// src/settings/stores.ts
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync3, statSync } from "fs";
+import { parse } from "jsonc-parser";
+import { join as join4 } from "path";
+var EMPTY_STORE = (file, exists) => ({
+  global: {},
+  repos: {},
+  file,
+  exists
+});
+function readStore(file) {
+  if (!existsSync2(file))
+    return EMPTY_STORE(file, false);
+  let raw;
+  try {
+    raw = readFileSync3(file, "utf8");
+  } catch (err) {
+    console.warn(`rt: failed to read settings store ${file}, ignoring: ${err.message}`);
+    return EMPTY_STORE(file, true);
+  }
+  if (raw.trim() === "")
+    return EMPTY_STORE(file, true);
+  const errors = [];
+  const root = parse(raw, errors, { allowTrailingComma: true });
+  if (errors.length > 0 || root === undefined || typeof root !== "object" || Array.isArray(root)) {
+    console.warn(`rt: malformed settings store ${file}, ignoring (treating as empty)`);
+    return EMPTY_STORE(file, true);
+  }
+  const { repos, ...global } = root;
+  const reposIsValid = repos !== undefined && typeof repos === "object" && repos !== null && !Array.isArray(repos);
+  if (repos !== undefined && !reposIsValid) {
+    console.warn(`rt: malformed "repos" section in settings store ${file}, ignoring repo sections (global keys still apply)`);
+  }
+  const reposValid = reposIsValid ? repos : {};
+  return { global, repos: reposValid, file, exists: true };
+}
+function listTeams() {
+  const dir = teamsDir();
+  if (!existsSync2(dir))
+    return [];
+  let entries;
+  try {
+    entries = readdirSync(dir, { withFileTypes: true });
+  } catch (err) {
+    console.warn(`rt: failed to list teams in ${dir}, treating as no teams: ${err.message}`);
+    return [];
+  }
+  const teams = [];
+  for (const entry of entries) {
+    try {
+      const isDir = entry.isDirectory() || entry.isSymbolicLink() && statSync(join4(dir, entry.name)).isDirectory();
+      if (!isDir)
+        continue;
+      if (existsSync2(teamSettingsPath(entry.name)))
+        teams.push(entry.name);
+    } catch (err) {
+      console.warn(`rt: skipping unreadable teams entry ${join4(dir, entry.name)}: ${err.message}`);
+    }
+  }
+  return teams;
+}
+
+// src/settings/resolve.ts
+var SCOPE_ORDER = [
+  "default",
+  "team",
+  "user",
+  "team.repo",
+  "user.repo",
+  "machine",
+  "machine.repo"
+];
+var VAR_RE = /\$\{([^}]*)\}/g;
+var TEAM_VAR_RE = /^team:(.+)$/;
+function expandVariables(value, ctx) {
+  if (typeof value === "string")
+    return expandString(value, ctx);
+  if (Array.isArray(value))
+    return value.map((item) => expandVariables(item, ctx));
+  if (isPlainObject(value)) {
+    const out = {};
+    for (const [k, v] of Object.entries(value))
+      out[k] = expandVariables(v, ctx);
+    return out;
+  }
+  return value;
+}
+function expandString(input, ctx) {
+  return input.replace(VAR_RE, (match, name) => {
+    if (name === "home")
+      return ctx.home;
+    if (name === "repoRoot")
+      return required(ctx.repoRoot, "repoRoot", "a repo path");
+    if (name === "worktree")
+      return required(ctx.worktree, "worktree", "a worktree path");
+    const team = TEAM_VAR_RE.exec(name);
+    if (team)
+      return teamPath(ctx.teamsDir, team[1]);
+    return match;
+  });
+}
+function teamPath(teamsDir2, name) {
+  if (name.includes("/") || name.includes("\\") || name.includes("..")) {
+    throw new Error(`rt: cannot expand \${team:${name}} — a team name must be a single directory segment (no "/", "\\" or "..")`);
+  }
+  return join5(teamsDir2, name);
+}
+function required(value, name, needs) {
+  if (value === undefined || value === "") {
+    throw new Error(`rt: cannot expand \${${name}} — this setting was resolved without ${needs}`);
+  }
+  return value;
+}
+function readStores() {
+  return {
+    user: readStore(userSettingsPath()),
+    machine: readStore(machineSettingsPath()),
+    teams: [...listTeams()].sort().map((team) => readStore(teamSettingsPath(team)))
+  };
+}
+function collectSlots(def, stores, opts) {
+  const slots = [];
+  const identity = opts.repoIdentity ?? null;
+  const useRepo = def.repoScoped === true && typeof identity === "string" && identity !== "";
+  const repoSection = (store) => useRepo ? store.repos[identity] : undefined;
+  const push = (scope, file, section) => {
+    const value = section?.[def.key];
+    if (value === undefined)
+      slots.push({ scope, file, present: false });
+    else
+      slots.push({ scope, file, present: true, value });
+  };
+  const pushTeams = (scope, section) => {
+    if (stores.teams.length === 0) {
+      slots.push({ scope, file: null, present: false });
+      return;
+    }
+    for (const store of stores.teams)
+      push(scope, store.file, section(store));
+  };
+  slots.push(def.default === undefined ? { scope: "default", file: null, present: false } : { scope: "default", file: null, present: true, value: structuredClone(def.default) });
+  pushTeams("team", (store) => store.global);
+  push("user", stores.user.file, stores.user.global);
+  if (useRepo)
+    pushTeams("team.repo", repoSection);
+  if (useRepo)
+    push("user.repo", stores.user.file, repoSection(stores.user));
+  push("machine", stores.machine.file, stores.machine.global);
+  if (useRepo)
+    push("machine.repo", stores.machine.file, repoSection(stores.machine));
+  return slots;
+}
+var TEAM_LOCKED_SCOPES = ["default", "team", "team.repo"];
+function baseScope(scope) {
+  if (scope === "team" || scope === "team.repo")
+    return "team";
+  if (scope === "user" || scope === "user.repo")
+    return "user";
+  if (scope === "machine" || scope === "machine.repo")
+    return "machine";
+  return null;
+}
+function validateForScope(def, scope, value) {
+  const shared = scope === "team" || scope === "user" || scope === "team.repo" || scope === "user.repo";
+  return validateValue(shared ? def : { ...def, pathGuardFields: undefined }, value);
+}
+function resolveDef(def, stores, opts) {
+  const slots = collectSlots(def, stores, opts);
+  const rows = [];
+  const invalid = [];
+  const applied = [];
+  for (const slot of slots) {
+    const row = { scope: slot.scope, file: slot.file, present: slot.present };
+    if (!slot.present) {
+      rows.push(row);
+      continue;
+    }
+    row.value = slot.value;
+    if (def.teamLocked && !TEAM_LOCKED_SCOPES.includes(slot.scope)) {
+      row.shadowed = "teamLocked";
+      rows.push(row);
+      continue;
+    }
+    const base = baseScope(slot.scope);
+    if (base !== null && !def.scopes.includes(base)) {
+      const reason = `not settable in the ${base} store (allowed: ${def.scopes.join(", ")})`;
+      row.invalid = reason;
+      invalid.push({ scope: slot.scope, file: slot.file, reason });
+      rows.push(row);
+      continue;
+    }
+    if (slot.scope !== "default") {
+      const check = validateForScope(def, slot.scope, slot.value);
+      if (!check.ok) {
+        row.invalid = check.reason;
+        invalid.push({ scope: slot.scope, file: slot.file, reason: check.reason });
+        rows.push(row);
+        continue;
+      }
+    }
+    rows.push(row);
+    applied.push({ scope: slot.scope, file: slot.file, value: slot.value });
+  }
+  const merged = mergeApplied(def, applied);
+  return { value: merged.value, provenance: merged.provenance, invalid, rows };
+}
+function mergeApplied(def, applied) {
+  if (applied.length === 0)
+    return { value: undefined, provenance: [] };
+  if (def.merge === "deep" && def.type === "object") {
+    const objectLayers = applied.filter((layer) => isPlainObject(layer.value));
+    if (objectLayers.length > 0) {
+      const { value, contributors } = deepMerge(objectLayers.map((layer) => layer.value));
+      return {
+        value,
+        provenance: contributors.map((i) => {
+          const layer = objectLayers[i];
+          return { scope: layer.scope, file: layer.file };
+        })
+      };
+    }
+  }
+  const winner = applied[applied.length - 1];
+  return { value: winner.value, provenance: [{ scope: winner.scope, file: winner.file }] };
+}
+var PATH_SEP = "\x00";
+function deepMerge(layers) {
+  const owner = new Map;
+  let acc = {};
+  layers.forEach((layer, index) => {
+    acc = overlay(acc, layer, owner, index, "");
+  });
+  const contributors = [...new Set(owner.values())].sort((a, b) => a - b);
+  return { value: acc, contributors };
+}
+function overlay(base, over, owner, index, prefix) {
+  const out = { ...base };
+  for (const [key, value] of Object.entries(over)) {
+    const path = prefix === "" ? key : `${prefix}${PATH_SEP}${key}`;
+    const current = out[key];
+    if (isPlainObject(value) && isPlainObject(current)) {
+      out[key] = overlay(current, value, owner, index, path);
+      continue;
+    }
+    out[key] = value;
+    clearOwners(owner, path);
+    registerLeaves(value, path, owner, index);
+  }
+  return out;
+}
+function clearOwners(owner, path) {
+  owner.delete(path);
+  const under = `${path}${PATH_SEP}`;
+  for (const existing of [...owner.keys()]) {
+    if (existing.startsWith(under))
+      owner.delete(existing);
+  }
+}
+function registerLeaves(value, path, owner, index) {
+  if (isPlainObject(value)) {
+    const entries = Object.entries(value);
+    if (entries.length > 0) {
+      for (const [key, child] of entries) {
+        registerLeaves(child, `${path}${PATH_SEP}${key}`, owner, index);
+      }
+      return;
+    }
+  }
+  owner.set(path, index);
+}
+function isPlainObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function unknownKey(key) {
+  return new Error(`rt: unknown setting "${key}" — not in the settings registry (see \`rt settings list\`)`);
+}
+function expandCtxFrom(opts) {
+  return {
+    repoRoot: opts.expandCtx?.repoRoot,
+    worktree: opts.expandCtx?.worktree,
+    home: process.env.HOME ?? homedir4(),
+    teamsDir: teamsDir()
+  };
+}
+function warnInvalid(key, entry) {
+  console.warn(`rt: ignoring "${key}" from the ${entry.scope} scope (${entry.file ?? "no file"}): ${entry.reason}`);
+}
+function getSetting(key, opts = {}) {
+  const def = getDef(key);
+  if (!def)
+    throw unknownKey(key);
+  const resolution = resolveDef(def, readStores(), opts);
+  for (const entry of resolution.invalid)
+    warnInvalid(key, entry);
+  const shouldExpand = opts.expand ?? true;
+  const value = shouldExpand && resolution.value !== undefined ? expandVariables(resolution.value, expandCtxFrom(opts)) : resolution.value;
+  return { value, provenance: resolution.provenance };
+}
+function listSettings(opts = {}) {
+  const stores = readStores();
+  const ctx = expandCtxFrom(opts);
+  const shouldExpand = opts.expand ?? true;
+  const out = [];
+  for (const def of allDefs()) {
+    const resolution = resolveDef(def, stores, opts);
+    for (const entry of resolution.invalid)
+      warnInvalid(def.key, entry);
+    const listed = {
+      key: def.key,
+      value: resolution.value,
+      provenance: resolution.provenance,
+      migrated: isMigrated(def)
+    };
+    if (resolution.invalid.length > 0)
+      listed.invalid = resolution.invalid;
+    if (shouldExpand && resolution.value !== undefined) {
+      try {
+        listed.value = expandVariables(resolution.value, ctx);
+      } catch (err) {
+        listed.expandError = err.message;
+        console.warn(`rt: showing "${def.key}" unexpanded — ${listed.expandError}`);
+      }
+    }
+    out.push(listed);
+  }
+  out.push(...listUnregistered(stores, opts));
+  return out;
+}
+function listUnregistered(stores, opts) {
+  const identity = opts.repoIdentity ?? null;
+  const found = new Map;
+  const scan = (scope, file, section) => {
+    for (const [key, value] of Object.entries(section ?? {})) {
+      if (getDef(key))
+        continue;
+      found.set(key, { scope, file, value });
+    }
+  };
+  const repoSection = (store) => typeof identity === "string" && identity !== "" ? store.repos[identity] : undefined;
+  for (const store of stores.teams)
+    scan("team", store.file, store.global);
+  scan("user", stores.user.file, stores.user.global);
+  for (const store of stores.teams)
+    scan("team.repo", store.file, repoSection(store));
+  scan("user.repo", stores.user.file, repoSection(stores.user));
+  scan("machine", stores.machine.file, stores.machine.global);
+  scan("machine.repo", stores.machine.file, repoSection(stores.machine));
+  return [...found.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([key, hit]) => {
+    console.warn(`rt: unregistered setting "${key}" in ${hit.file} — ignoring it (this rt may be older than the store)`);
+    return {
+      key,
+      value: hit.value,
+      provenance: [{ scope: hit.scope, file: hit.file }],
+      migrated: false,
+      unregistered: true
+    };
+  });
+}
+function explainSetting(key, opts = {}) {
+  const def = getDef(key);
+  if (!def)
+    throw unknownKey(key);
+  return resolveDef(def, readStores(), opts).rows;
+}
+// src/settings/write.ts
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync4, renameSync, unlinkSync, writeFileSync } from "fs";
+import { applyEdits, modify, parseTree } from "jsonc-parser";
+import { randomBytes } from "crypto";
+import { dirname } from "path";
+var FORMAT = { tabSize: 2, insertSpaces: true, eol: `
+` };
+function refuse(message) {
+  throw new Error(`rt: ${message}`);
+}
+function setSetting(key, value, scope, opts = {}) {
+  const def = getDef(key);
+  if (!def) {
+    refuse(`unknown setting "${key}" — not in the settings registry (see \`rt settings list\`)`);
+  }
+  if (!isMigrated(def)) {
+    refuse(migratedFalseMessage(key, def));
+  }
+  if (!def.scopes.includes(scope)) {
+    refuse(`"${key}" cannot be set in the ${scope} store (allowed: ${def.scopes.join(", ")})`);
+  }
+  if (opts.repoIdentity !== undefined && def.repoScoped !== true) {
+    refuse(`"${key}" is not repo-scoped — omit the repo identity`);
+  }
+  const guardedDef = scope === "machine" ? { ...def, pathGuardFields: undefined } : def;
+  const check = validateValue(guardedDef, value);
+  if (!check.ok) {
+    refuse(`refusing to set "${key}": ${check.reason} — use \${team:<name>} or \${repoRoot} instead`);
+  }
+  const storePath = resolveStorePath(scope, opts);
+  const jsonPath = opts.repoIdentity !== undefined ? ["repos", opts.repoIdentity, key] : [key];
+  writeIntoStore(storePath, jsonPath, value, scope !== "team");
+  console.error(`rt: wrote "${key}" to the local ${scope} store (${storePath}) — this is local only until you commit and push it.`);
+}
+function migratedFalseMessage(key, def) {
+  const legacyPart = def.legacyFile ? ` — it is still read from ${def.legacyFile}` : "";
+  return `"${key}" is not writable through the settings resolver yet${legacyPart}`;
+}
+function resolveStorePath(scope, opts) {
+  if (scope === "user")
+    return userSettingsPath();
+  if (scope === "machine")
+    return machineSettingsPath();
+  if (opts.team !== undefined) {
+    const path = teamSettingsPath(opts.team);
+    if (!existsSync3(path)) {
+      refuse(`team store for "${opts.team}" does not exist (${path}) — clone/seed it before writing to it`);
+    }
+    return path;
+  }
+  const teams = listTeams();
+  if (teams.length === 0) {
+    refuse(`no local team store found — clone a team under ~/.mattstack/teams/<name> or pass opts.team`);
+  }
+  if (teams.length > 1) {
+    refuse(`multiple local team stores found (${teams.join(", ")}) — pass opts.team to choose one`);
+  }
+  return teamSettingsPath(teams[0]);
+}
+function seedHeader() {
+  return `// rt settings — created by \`rt settings set\`. JSONC: comments and trailing commas are fine.
+{}
+`;
+}
+function assertEditableJsonc(file, content) {
+  const errors = [];
+  const tree = parseTree(content, errors, { allowTrailingComma: true });
+  const malformed = errors.length > 0 || tree === undefined || tree.type !== "object" || findDuplicateKey(tree) !== undefined;
+  if (malformed) {
+    refuse(`fix the JSONC syntax error in ${file} first — refusing to edit a malformed store`);
+  }
+}
+function findDuplicateKey(node) {
+  if (node.type === "object" && node.children) {
+    const seen = new Set;
+    for (const property of node.children) {
+      const keyNode = property.children?.[0];
+      if (keyNode !== undefined && typeof keyNode.value === "string") {
+        if (seen.has(keyNode.value))
+          return keyNode.value;
+        seen.add(keyNode.value);
+      }
+      const valueNode = property.children?.[1];
+      if (valueNode !== undefined) {
+        const nested = findDuplicateKey(valueNode);
+        if (nested !== undefined)
+          return nested;
+      }
+    }
+    return;
+  }
+  if (node.type === "array" && node.children) {
+    for (const child of node.children) {
+      const nested = findDuplicateKey(child);
+      if (nested !== undefined)
+        return nested;
+    }
+  }
+  return;
+}
+function writeIntoStore(storePath, jsonPath, value, createIfMissing) {
+  let content;
+  if (existsSync3(storePath)) {
+    content = readFileSync4(storePath, "utf8");
+    if (content.trim() === "") {
+      content = seedHeader();
+    } else {
+      assertEditableJsonc(storePath, content);
+    }
+  } else {
+    if (!createIfMissing) {
+      refuse(`store file ${storePath} does not exist`);
+    }
+    mkdirSync(dirname(storePath), { recursive: true });
+    content = seedHeader();
+  }
+  const edits = modify(content, jsonPath, value, { formattingOptions: FORMAT });
+  const next = applyEdits(content, edits);
+  const finalText = next.endsWith(`
+`) ? next : `${next}
+`;
+  const tmp = `${storePath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tmp, finalText);
+    renameSync(tmp, storePath);
+  } catch (err) {
+    try {
+      unlinkSync(tmp);
+    } catch {}
+    throw err;
+  }
+}
+// src/settings/exec.ts
+async function runCapture(argv, opts = {}) {
+  const captureStderr = opts.stderr === "pipe";
+  let proc;
+  try {
+    proc = Bun.spawn(argv, {
+      cwd: opts.cwd,
+      env: opts.env ?? { ...process.env },
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: captureStderr ? "pipe" : "ignore"
+    });
+  } catch {
+    return { stdout: "", stderr: "", exitCode: -1 };
+  }
+  const timer = setTimeout(() => {
+    try {
+      proc.kill();
+    } catch {}
+  }, opts.timeoutMs ?? 1e4);
+  try {
+    const stdoutPromise = new Response(proc.stdout).text();
+    const stderrPromise = captureStderr ? new Response(proc.stderr).text() : Promise.resolve("");
+    const [stdout, stderr] = await Promise.all([stdoutPromise, stderrPromise]);
+    const exitCode = await proc.exited;
+    return { stdout, stderr, exitCode };
+  } catch {
+    return { stdout: "", stderr: "", exitCode: -1 };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/settings/identity.ts
+var URL_RE = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\/(?:[^@/]+@)?([^/]+)\/(.+)$/;
+var SCP_RE = /^(?:[^@/\s]+@)?([^:/\s]+):(.+)$/;
+function normalizeRemote(remote) {
+  const trimmed = remote.trim();
+  if (!trimmed)
+    return null;
+  let host;
+  let path;
+  const urlMatch = URL_RE.exec(trimmed);
+  if (urlMatch) {
+    host = urlMatch[1];
+    path = urlMatch[2];
+  } else if (!trimmed.startsWith("/") && !trimmed.startsWith("~")) {
+    const scpMatch = SCP_RE.exec(trimmed);
+    if (scpMatch) {
+      host = scpMatch[1];
+      path = scpMatch[2];
+    }
+  }
+  if (!host || !path)
+    return null;
+  const normalizedPath = path.replace(/\.git$/, "").replace(/^\/+/, "").replace(/\/+$/, "");
+  if (!normalizedPath)
+    return null;
+  return `${host.toLowerCase()}/${normalizedPath}`;
+}
+function identityFromRemote(remote) {
+  const store = readStore(machineSettingsPath());
+  const overrides = store.global["rt.repoIdentityOverrides"];
+  if (overrides !== null && typeof overrides === "object" && !Array.isArray(overrides)) {
+    const hit = overrides[remote];
+    if (typeof hit === "string")
+      return hit;
+  }
+  return normalizeRemote(remote);
+}
+var memo = new Map;
+async function deriveRepoIdentity(repoPath) {
+  const cached = memo.get(repoPath);
+  if (cached)
+    return cached;
+  const result = await (async () => {
+    const spawned = await runCapture(["git", "-C", repoPath, "config", "--get", "remote.origin.url"]);
+    if (spawned.exitCode !== 0)
+      return null;
+    const remote = spawned.stdout.trim();
+    if (!remote)
+      return null;
+    return identityFromRemote(remote);
+  })();
+  if (result !== null)
+    memo.set(repoPath, Promise.resolve(result));
+  return result;
+}
+function clearIdentityMemo() {
+  memo.clear();
+}
 export {
+  validateValue,
   subscribe,
+  setSetting,
   rtCommand,
   resolveForgeToken,
   repoNameForPath,
+  readStore,
   readProjectMRs,
   readMrsByBranch,
   readDiscussions,
+  normalizeRemote,
+  listTeams,
+  listSettings,
+  isMigrated,
+  identityFromRemote,
+  getSetting,
+  getDef,
+  explainSetting,
+  expandVariables,
+  deriveRepoIdentity,
+  clearIdentityMemo,
+  allDefs,
+  SCOPE_ORDER,
+  REGISTRY,
   DEFAULT_WS_URL,
   DEFAULT_SOCK,
   COMMAND_NAMES