@mnemonik/cli 7.140.0 → 7.140.2

package/dist/preflight.js

@@ -915,6 +915,96 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
 
+// packages/shared/dist/projectIdentityFile.js
+import { lstat, readFile } from "node:fs/promises";
+import { join } from "node:path";
+var CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var isCanonicalUuid = (value) => typeof value === "string" && CANONICAL_UUID.test(value);
+var IDENTITY_KEYS = /* @__PURE__ */ new Set([
+  "schemaVersion",
+  "projectId",
+  "projectName",
+  "repositoryFingerprint"
+]);
+var FINGERPRINT_KEYS = /* @__PURE__ */ new Set(["algorithmVersion", "hash"]);
+function parseIdentityFile(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    return { kind: "malformed", detail: `unparseable JSON: ${error.message}` };
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { kind: "malformed", detail: "identity file must contain a JSON object" };
+  }
+  const record = value;
+  if (record.schemaVersion !== 1) {
+    return { kind: "unknown_version", version: record.schemaVersion };
+  }
+  const unknownKey = Object.keys(record).find((key) => !IDENTITY_KEYS.has(key));
+  if (unknownKey)
+    return { kind: "malformed", detail: `unknown key "${unknownKey}"` };
+  if (!isCanonicalUuid(record.projectId)) {
+    return { kind: "malformed", detail: '"projectId" must be a canonical RFC 4122 UUID string' };
+  }
+  if ("projectName" in record && typeof record.projectName !== "string") {
+    return { kind: "malformed", detail: '"projectName" must be a string when present' };
+  }
+  if ("repositoryFingerprint" in record && (!record.repositoryFingerprint || typeof record.repositoryFingerprint !== "object" || Array.isArray(record.repositoryFingerprint))) {
+    return { kind: "malformed", detail: '"repositoryFingerprint" must be an object when present' };
+  }
+  const fingerprint = record.repositoryFingerprint;
+  const unknownFingerprintKey = fingerprint ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key)) : void 0;
+  if (unknownFingerprintKey) {
+    return {
+      kind: "malformed",
+      detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`
+    };
+  }
+  if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== "string")) {
+    return {
+      kind: "malformed",
+      detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash'
+    };
+  }
+  const repositoryFingerprint = fingerprint ? { algorithmVersion: 1, hash: fingerprint.hash } : void 0;
+  return {
+    kind: "ok",
+    identity: {
+      schemaVersion: 1,
+      projectId: record.projectId,
+      ...record.projectName === void 0 ? {} : { projectName: record.projectName },
+      ...repositoryFingerprint ? { repositoryFingerprint } : {}
+    }
+  };
+}
+function isConfigurationOnly(text) {
+  try {
+    const value = JSON.parse(text);
+    return !!value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value) && (!("schemaVersion" in value) || value.schemaVersion === 1);
+  } catch {
+    return false;
+  }
+}
+async function readIdentityFile(dir, options = {}) {
+  const path = join(dir, ".mnemonik.json");
+  try {
+    const stat = await lstat(path);
+    if (stat.isSymbolicLink())
+      return { kind: "malformed", detail: "symlink" };
+    if (!stat.isFile())
+      return { kind: "malformed", detail: "identity path is not a regular file" };
+    const text = await readFile(path, "utf8");
+    if ((options.selectedRoot || options.configurationOnlyAbsent) && isConfigurationOnly(text))
+      return { kind: "absent" };
+    return parseIdentityFile(text);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { kind: "absent" };
+    return { kind: "malformed", detail: `cannot read identity file: ${error.message}` };
+  }
+}
+
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -4959,9 +5049,9 @@ var Query = class {
 };
 
 // packages/shared/dist/ast/grammars.js
-import { dirname, extname, join } from "node:path";
+import { dirname, extname, join as join2 } from "node:path";
 import { fileURLToPath } from "node:url";
-var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
+var WASM_DIR = join2(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
 // packages/shared/dist/ast/astChunker.js
 var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
@@ -5147,96 +5237,8 @@ var REPOSITORY_PROVIDER_RULES = Object.freeze([
 ]);
 var controls = new RegExp("\\p{Cc}", "u");
 
-// packages/shared/dist/projectIdentityFile.js
-import { lstat, readFile } from "node:fs/promises";
-import { join as join2 } from "node:path";
-var CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-var isCanonicalUuid = (value) => typeof value === "string" && CANONICAL_UUID.test(value);
-var IDENTITY_KEYS = /* @__PURE__ */ new Set([
-  "schemaVersion",
-  "projectId",
-  "projectName",
-  "repositoryFingerprint"
-]);
-var FINGERPRINT_KEYS = /* @__PURE__ */ new Set(["algorithmVersion", "hash"]);
-function parseIdentityFile(text) {
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch (error) {
-    return { kind: "malformed", detail: `unparseable JSON: ${error.message}` };
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return { kind: "malformed", detail: "identity file must contain a JSON object" };
-  }
-  const record = value;
-  if (record.schemaVersion !== 1) {
-    return { kind: "unknown_version", version: record.schemaVersion };
-  }
-  const unknownKey = Object.keys(record).find((key) => !IDENTITY_KEYS.has(key));
-  if (unknownKey)
-    return { kind: "malformed", detail: `unknown key "${unknownKey}"` };
-  if (!isCanonicalUuid(record.projectId)) {
-    return { kind: "malformed", detail: '"projectId" must be a canonical RFC 4122 UUID string' };
-  }
-  if ("projectName" in record && typeof record.projectName !== "string") {
-    return { kind: "malformed", detail: '"projectName" must be a string when present' };
-  }
-  if ("repositoryFingerprint" in record && (!record.repositoryFingerprint || typeof record.repositoryFingerprint !== "object" || Array.isArray(record.repositoryFingerprint))) {
-    return { kind: "malformed", detail: '"repositoryFingerprint" must be an object when present' };
-  }
-  const fingerprint = record.repositoryFingerprint;
-  const unknownFingerprintKey = fingerprint ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key)) : void 0;
-  if (unknownFingerprintKey) {
-    return {
-      kind: "malformed",
-      detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`
-    };
-  }
-  if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== "string")) {
-    return {
-      kind: "malformed",
-      detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash'
-    };
-  }
-  const repositoryFingerprint = fingerprint ? { algorithmVersion: 1, hash: fingerprint.hash } : void 0;
-  return {
-    kind: "ok",
-    identity: {
-      schemaVersion: 1,
-      projectId: record.projectId,
-      ...record.projectName === void 0 ? {} : { projectName: record.projectName },
-      ...repositoryFingerprint ? { repositoryFingerprint } : {}
-    }
-  };
-}
-async function readIdentityFile(dir, options = {}) {
-  const path = join2(dir, ".mnemonik.json");
-  try {
-    const stat = await lstat(path);
-    if (stat.isSymbolicLink())
-      return { kind: "malformed", detail: "symlink" };
-    if (!stat.isFile())
-      return { kind: "malformed", detail: "identity path is not a regular file" };
-    const text = await readFile(path, "utf8");
-    if (options.selectedRoot) {
-      try {
-        const value = JSON.parse(text);
-        if (value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value) && (!("schemaVersion" in value) || value.schemaVersion === 1))
-          return { kind: "absent" };
-      } catch {
-      }
-    }
-    return parseIdentityFile(text);
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return { kind: "absent" };
-    return { kind: "malformed", detail: `cannot read identity file: ${error.message}` };
-  }
-}
-
 // packages/shared/dist/repositoryRoot.js
-import { lstat as lstat2, readFile as readFile2 } from "node:fs/promises";
+import { lstat as lstat2, readFile as readFile2, realpath } from "node:fs/promises";
 import { execFile } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname as dirname2, join as join3, resolve } from "node:path";
@@ -5298,7 +5300,7 @@ async function confirmedBoundaryAt(path) {
 async function boundariesBetween(cwd, root) {
   const boundaries = [];
   let directory = cwd;
-  while (directory !== root) {
+  while (!samePath(directory, root)) {
     const boundary = await confirmedBoundaryAt(directory);
     if (boundary)
       boundaries.push(boundary);
@@ -5321,37 +5323,31 @@ async function containingRepository(root) {
     directory = parent;
   }
 }
-async function canonicalBoundaryRoot(boundary) {
-  if (boundary.kind === "directory")
-    return boundary.path;
-  const pointer = /^gitdir:\s*(.+)\s*$/im.exec(await readFile2(join3(boundary.path, ".git"), "utf8"))?.[1];
-  if (!pointer)
-    return boundary.path;
-  const gitDir = resolve(boundary.path, pointer);
-  try {
-    const commonDir = resolve(gitDir, (await readFile2(join3(gitDir, "commondir"), "utf8")).trim());
-    return dirname2(commonDir);
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return boundary.path;
-    throw error;
-  }
+async function canonicalPath(path) {
+  const absolute = resolve(path);
+  return realpath(absolute).catch(() => absolute);
+}
+function samePath(left, right) {
+  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }
 async function resolveRepositoryRoot(cwd) {
-  const absoluteCwd = resolve(cwd);
+  const absoluteCwd = await canonicalPath(cwd);
   try {
     const { stdout } = await runGit(absoluteCwd, [
       "rev-parse",
       "--show-toplevel",
+      "--git-dir",
       "--git-common-dir"
     ]);
-    const [rootLine, commonLine, ...extra] = stdout.trim().split(/\r?\n/);
-    if (!rootLine || !commonLine || extra.length) {
+    const [rootLine, gitDirLine, commonLine, ...extra] = stdout.trim().split(/\r?\n/);
+    if (!rootLine || !gitDirLine || !commonLine || extra.length) {
       return { kind: "git_unavailable", detail: "git rev-parse returned an unexpected response" };
     }
-    const root = resolve(rootLine);
-    const commonDir = resolve(root, commonLine);
-    const isLinkedWorktree = commonDir !== join3(root, ".git");
+    const fromGit = (line) => canonicalPath(resolve(absoluteCwd, line));
+    const root = await fromGit(rootLine);
+    const gitDir = await fromGit(gitDirLine);
+    const commonDir = await fromGit(commonLine);
+    const isLinkedWorktree = !samePath(gitDir, commonDir);
     const nested = await boundariesBetween(absoluteCwd, root);
     if (!isLinkedWorktree && await containingRepository(root)) {
       const boundary = await boundaryAt(root);
@@ -5373,14 +5369,41 @@ async function resolveRepositoryRoot(cwd) {
     return { kind: "git_unavailable", detail: failure.message };
   }
 }
+async function linkedWorktreeCommonDir(dir) {
+  try {
+    if (!(await lstat2(join3(dir, ".git"))).isFile())
+      return void 0;
+    const pointer = /^gitdir:\s*(.+?)\s*$/im.exec(await readFile2(join3(dir, ".git"), "utf8"))?.[1];
+    if (!pointer)
+      return void 0;
+    const gitDir = resolve(dir, pointer);
+    const common = (await readFile2(join3(gitDir, "commondir"), "utf8")).trim();
+    return common ? await canonicalPath(resolve(gitDir, common)) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function mainCheckout(worktreeTop, commonDir) {
+  try {
+    const { stdout } = await runGit(worktreeTop, ["worktree", "list", "--porcelain"]);
+    const first = stdout.split(/\r?\n\r?\n/)[0] ?? "";
+    const path = /^worktree (.+)$/m.exec(first)?.[1];
+    if (path) {
+      const main = await canonicalPath(resolve(worktreeTop, path));
+      return /^bare$/m.test(first) ? dirname2(main) : main;
+    }
+  } catch {
+  }
+  return dirname2(commonDir);
+}
 async function readPlainIdentity(start2) {
-  const home = resolve(homedir());
+  const home = await canonicalPath(homedir());
   let directory = start2;
   while (true) {
-    const result = await readIdentityFile(directory);
+    const result = await readIdentityFile(directory, { configurationOnlyAbsent: true });
     if (result.kind !== "absent")
       return { root: directory, result };
-    if (directory === home)
+    if (samePath(directory, home))
       break;
     const parent = dirname2(directory);
     if (parent === directory)
@@ -5389,58 +5412,72 @@ async function readPlainIdentity(start2) {
   }
   return { root: start2, result: { kind: "absent" } };
 }
+async function nearestIdentity(start2) {
+  const home = await canonicalPath(homedir());
+  let directory = start2;
+  while (true) {
+    const commonDir = await linkedWorktreeCommonDir(directory);
+    if (commonDir)
+      return { worktreeTop: directory, commonDir };
+    const result = await readIdentityFile(directory, { configurationOnlyAbsent: true });
+    if (result.kind !== "absent")
+      return { root: directory, result };
+    if (samePath(directory, home))
+      return void 0;
+    const parent = dirname2(directory);
+    if (parent === directory)
+      return void 0;
+    directory = parent;
+  }
+}
+async function resolveNearestProjectIdentity(cwd) {
+  const start2 = await canonicalPath(cwd);
+  const resolved = await resolveRepositoryRoot(start2);
+  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: start2 } : resolved;
+  const nested = repository.kind === "git" ? repository.nested : [];
+  let found = await nearestIdentity(start2);
+  if (found && "worktreeTop" in found) {
+    found = await readPlainIdentity(await mainCheckout(found.worktreeTop, found.commonDir));
+  }
+  if (found) {
+    return shapedIdentity(found, await projectFolderRepository(found.root, repository), nested);
+  }
+  return { ...withBase(repository, repository.root, nested), kind: "absent" };
+}
+async function resolveNamedProjectIdentity(cwd, options) {
+  const start2 = await canonicalPath(cwd);
+  const resolved = await resolveRepositoryRoot(start2);
+  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: start2 } : resolved;
+  const commonDir = await linkedWorktreeCommonDir(start2);
+  const root = commonDir ? await mainCheckout(start2, commonDir) : start2;
+  return shapedIdentity({ root, result: await readIdentityFile(root, options) }, await projectFolderRepository(root, repository), repository.kind === "git" ? repository.nested : []);
+}
+function shapedIdentity(found, repository, nested) {
+  const base = withBase(repository, found.root, nested);
+  if (found.result.kind === "ok")
+    return { ...base, ...found.result };
+  if (found.result.kind === "unknown_version")
+    return { ...base, ...found.result, path: found.root };
+  if (found.result.kind === "malformed")
+    return { ...base, ...found.result, path: found.root };
+  return { ...base, kind: "absent" };
+}
+async function projectFolderRepository(projectRoot, known) {
+  if (known.kind === "git" && samePath(known.root, projectRoot))
+    return known;
+  const repository = await resolveRepositoryRoot(projectRoot);
+  if (repository.kind === "git" && samePath(repository.root, projectRoot))
+    return repository;
+  return { kind: "plain", root: projectRoot };
+}
 function withBase(repository, root, nested) {
   return { root, repository, nested };
 }
 async function resolveProjectIdentity(cwd, options = {}) {
-  const resolved = await resolveRepositoryRoot(cwd);
-  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: resolve(cwd) } : resolved;
-  if (repository.kind === "plain") {
-    const { root, result } = options.selectedRoot ? { root: repository.root, result: await readIdentityFile(repository.root, options) } : await readPlainIdentity(repository.root);
-    const base2 = withBase(repository, root, []);
-    if (result.kind === "ok")
-      return { ...base2, ...result };
-    if (result.kind === "unknown_version")
-      return { ...base2, ...result, path: root };
-    if (result.kind === "malformed")
-      return { ...base2, ...result, path: root };
-    return { ...base2, kind: "absent" };
-  }
-  const ownRoot = repository.isLinkedWorktree ? dirname2(repository.commonDir) : repository.root;
-  const outer = repository.isLinkedWorktree ? void 0 : await containingRepository(repository.root);
-  const own = await readIdentityFile(ownRoot, options);
-  if (!outer || options.selectedRoot || own.kind === "ok") {
-    const base2 = withBase(repository, ownRoot, repository.nested);
-    if (own.kind === "ok")
-      return { ...base2, ...own };
-    if (own.kind === "unknown_version")
-      return { ...base2, ...own, path: ownRoot };
-    if (own.kind === "malformed")
-      return { ...base2, ...own, path: ownRoot };
-    return { ...base2, kind: "absent" };
-  }
-  const nested = repository.nested;
-  const parentRoot = await canonicalBoundaryRoot(outer);
-  const parent = await readIdentityFile(parentRoot);
-  const base = withBase(repository, parentRoot, nested);
-  if (own.kind === "unknown_version")
-    return { ...base, ...own, path: ownRoot };
-  if (own.kind === "malformed")
-    return { ...base, ...own, path: ownRoot };
-  if (parent.kind === "unknown_version")
-    return { ...base, ...parent, path: parentRoot };
-  if (parent.kind === "malformed")
-    return { ...base, ...parent, path: parentRoot };
-  if (!options.allowNestedInherit) {
-    return {
-      ...base,
-      kind: "nested",
-      ...parent.kind === "ok" ? { parentIdentity: parent.identity } : {}
-    };
+  if (options.selectedRoot || options.namedRoot) {
+    return resolveNamedProjectIdentity(cwd, { selectedRoot: options.selectedRoot });
   }
-  if (parent.kind === "ok")
-    return { ...base, kind: "ok", identity: parent.identity };
-  return { ...base, kind: "absent" };
+  return resolveNearestProjectIdentity(cwd);
 }
 
 // packages/shared/dist/apiOrigin.js

package/dist/project/eligibility.js

@@ -885,6 +885,27 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/secretPatterns.js
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/protectedPaths.js
+var init_protectedPaths = __esm({
+  "packages/shared/dist/protectedPaths.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/projectIdentityFile.js
+var init_projectIdentityFile = __esm({
+  "packages/shared/dist/projectIdentityFile.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/hookTimeouts.js
 var init_hookTimeouts = __esm({
   "packages/shared/dist/hookTimeouts.js"() {
@@ -982,13 +1003,6 @@ var init_repositoryFingerprint = __esm({
   }
 });
 
-// packages/shared/dist/projectIdentityFile.js
-var init_projectIdentityFile = __esm({
-  "packages/shared/dist/projectIdentityFile.js"() {
-    "use strict";
-  }
-});
-
 // packages/shared/dist/repositoryRoot.js
 var init_repositoryRoot = __esm({
   "packages/shared/dist/repositoryRoot.js"() {
@@ -997,6 +1011,18 @@ var init_repositoryRoot = __esm({
   }
 });
 
+// packages/shared/dist/hookTrace.js
+var HOOK_TRACE_MAX_BYTES;
+var init_hookTrace = __esm({
+  "packages/shared/dist/hookTrace.js"() {
+    "use strict";
+    init_protectedPaths();
+    init_runtimeSigners();
+    init_secretPatterns();
+    HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+  }
+});
+
 // packages/shared/dist/runtimeReader.js
 var RuntimeError;
 var init_runtimeReader = __esm({
@@ -1068,10 +1094,12 @@ var init_hookRuntime = __esm({
     init_runtimeSigners();
     init_hookTimeouts();
     init_repositoryRoot();
+    init_hookTrace();
     init_runtimeReader();
     init_runtimeSigners();
     init_projectSetupHandoff();
     init_hookConversation();
+    init_hookTrace();
   }
 });
 
@@ -2695,6 +2723,9 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
+init_secretPatterns();
+init_protectedPaths();
+init_projectIdentityFile();
 
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
@@ -6920,6 +6951,7 @@ var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
+init_secretPatterns();
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js
@@ -6935,6 +6967,7 @@ init_settingsIo();
 init_repositoryFingerprint();
 init_projectIdentityFile();
 init_repositoryRoot();
+init_protectedPaths();
 
 // packages/local-setup/dist/storage.js
 init_hookRuntime();

package/dist/project/records.js

@@ -885,6 +885,27 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/secretPatterns.js
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/protectedPaths.js
+var init_protectedPaths = __esm({
+  "packages/shared/dist/protectedPaths.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/projectIdentityFile.js
+var init_projectIdentityFile = __esm({
+  "packages/shared/dist/projectIdentityFile.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/hookTimeouts.js
 var init_hookTimeouts = __esm({
   "packages/shared/dist/hookTimeouts.js"() {
@@ -982,13 +1003,6 @@ var init_repositoryFingerprint = __esm({
   }
 });
 
-// packages/shared/dist/projectIdentityFile.js
-var init_projectIdentityFile = __esm({
-  "packages/shared/dist/projectIdentityFile.js"() {
-    "use strict";
-  }
-});
-
 // packages/shared/dist/repositoryRoot.js
 var init_repositoryRoot = __esm({
   "packages/shared/dist/repositoryRoot.js"() {
@@ -997,6 +1011,18 @@ var init_repositoryRoot = __esm({
   }
 });
 
+// packages/shared/dist/hookTrace.js
+var HOOK_TRACE_MAX_BYTES;
+var init_hookTrace = __esm({
+  "packages/shared/dist/hookTrace.js"() {
+    "use strict";
+    init_protectedPaths();
+    init_runtimeSigners();
+    init_secretPatterns();
+    HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+  }
+});
+
 // packages/shared/dist/runtimeReader.js
 var RuntimeError;
 var init_runtimeReader = __esm({
@@ -1068,10 +1094,12 @@ var init_hookRuntime = __esm({
     init_runtimeSigners();
     init_hookTimeouts();
     init_repositoryRoot();
+    init_hookTrace();
     init_runtimeReader();
     init_runtimeSigners();
     init_projectSetupHandoff();
     init_hookConversation();
+    init_hookTrace();
   }
 });
 
@@ -2695,6 +2723,9 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
+init_secretPatterns();
+init_protectedPaths();
+init_projectIdentityFile();
 
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
@@ -6920,6 +6951,7 @@ var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
+init_secretPatterns();
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js
@@ -6935,6 +6967,7 @@ init_settingsIo();
 init_repositoryFingerprint();
 init_projectIdentityFile();
 init_repositoryRoot();
+init_protectedPaths();
 
 // packages/local-setup/dist/storage.js
 init_hookRuntime();

package/dist/project.d.ts

@@ -3,8 +3,15 @@ import type { createCredentialAdapter } from '@mnemonik/credentials';
 import { type ExecutorDependencies, type EnsureOptions, type Owner, type SetupResult } from '@mnemonik/local-setup';
 import { resolveProjectIdentity, type ProjectIdentityResolution, type RepositoryFingerprint } from '@mnemonik/shared';
 import type { Output } from './output.js';
+import { type CliIssueContext } from './transport/server.js';
 export interface ProjectExecutor {
-    resolveProjectIdentity(cwd: string): Promise<ProjectIdentityResolution>;
+    /**
+     * Which project the folder is in, by the nearest `.mnemonik.json`; with
+     * `namedRoot`, exactly the folder a person named for init, link or setup.
+     */
+    resolveProjectIdentity(cwd: string, options?: {
+        namedRoot?: boolean;
+    }): Promise<ProjectIdentityResolution>;
     ensureProject(options: EnsureOptions): Promise<SetupResult>;
     stage(options: EnsureOptions): Promise<SetupResult>;
     apply(options: EnsureOptions): Promise<SetupResult>;
@@ -23,6 +30,14 @@ export declare function answerCommands(actions: readonly string[], root: string,
     action: string;
     command: string;
 }>;
+/**
+ * The folder Mnemonik connects when a person names `folder`: the project it is
+ * in (the nearest `.mnemonik.json`; a linked worktree's main checkout), or
+ * exactly the folder named when it is in none. A subfolder belongs to its
+ * project, so naming one connects that project's folder, never a new project.
+ */
+export declare function projectFolderFor(folder: string, resolver: Pick<ProjectExecutor, 'resolveProjectIdentity'>): Promise<string>;
+/** Set up exactly `root`, a folder projectFolderFor chose. */
 export declare function ensureProjectRoot(root: string, executor: ProjectExecutor): Promise<SetupResult>;
 /** Does Mnemonik have plain words for this state? */
 export declare const hasRefusalWords: (reason: string) => boolean;
@@ -57,6 +72,24 @@ export interface RealProjectRuntimeOptions {
     deadline?: number;
 }
 export declare function repositoryFingerprint(root: string): Promise<RepositoryFingerprint | null>;
+/**
+ * What the CLI tells the server about a folder it is setting up: the device
+ * binding, the folder's identity file, and a Git fingerprint only when the
+ * folder is the top of its own repository (the hooks' rule). A plain subfolder
+ * of a repository would otherwise send the enclosing repository's remote and
+ * be taken for that repository's project.
+ */
+export declare function rootIssueContext(root: string, dependencies: {
+    hmacRootBinding(version: 1, root: string): Promise<{
+        version: 1;
+        hmac: string;
+    }>;
+    resolveIdentity: typeof resolveProjectIdentity;
+    fingerprint?: typeof repositoryFingerprint;
+}): Promise<{
+    evidence: Pick<CliIssueContext, 'deviceRootContext' | 'repositoryFingerprint'>;
+    context: CliIssueContext;
+}>;
 export declare function createRealProjectRuntime(options?: RealProjectRuntimeOptions): Promise<{
     transport: {
         issueSetupRequest(input: import("@mnemonik/local-setup").Evidence & {