@mnemonik/cli 7.140.0 → 7.140.2

package/dist/project.js

@@ -885,6 +885,116 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/secretPatterns.js
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/protectedPaths.js
+var init_protectedPaths = __esm({
+  "packages/shared/dist/protectedPaths.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/projectIdentityFile.js
+import { lstat, readFile } from "node:fs/promises";
+import { join } from "node:path";
+function parseIdentityFile(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    return { kind: "malformed", detail: `unparseable JSON: ${error.message}` };
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { kind: "malformed", detail: "identity file must contain a JSON object" };
+  }
+  const record = value;
+  if (record.schemaVersion !== 1) {
+    return { kind: "unknown_version", version: record.schemaVersion };
+  }
+  const unknownKey = Object.keys(record).find((key) => !IDENTITY_KEYS.has(key));
+  if (unknownKey)
+    return { kind: "malformed", detail: `unknown key "${unknownKey}"` };
+  if (!isCanonicalUuid(record.projectId)) {
+    return { kind: "malformed", detail: '"projectId" must be a canonical RFC 4122 UUID string' };
+  }
+  if ("projectName" in record && typeof record.projectName !== "string") {
+    return { kind: "malformed", detail: '"projectName" must be a string when present' };
+  }
+  if ("repositoryFingerprint" in record && (!record.repositoryFingerprint || typeof record.repositoryFingerprint !== "object" || Array.isArray(record.repositoryFingerprint))) {
+    return { kind: "malformed", detail: '"repositoryFingerprint" must be an object when present' };
+  }
+  const fingerprint = record.repositoryFingerprint;
+  const unknownFingerprintKey = fingerprint ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key)) : void 0;
+  if (unknownFingerprintKey) {
+    return {
+      kind: "malformed",
+      detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`
+    };
+  }
+  if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== "string")) {
+    return {
+      kind: "malformed",
+      detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash'
+    };
+  }
+  const repositoryFingerprint2 = fingerprint ? { algorithmVersion: 1, hash: fingerprint.hash } : void 0;
+  return {
+    kind: "ok",
+    identity: {
+      schemaVersion: 1,
+      projectId: record.projectId,
+      ...record.projectName === void 0 ? {} : { projectName: record.projectName },
+      ...repositoryFingerprint2 ? { repositoryFingerprint: repositoryFingerprint2 } : {}
+    }
+  };
+}
+function isConfigurationOnly(text) {
+  try {
+    const value = JSON.parse(text);
+    return !!value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value) && (!("schemaVersion" in value) || value.schemaVersion === 1);
+  } catch {
+    return false;
+  }
+}
+async function readIdentityFile(dir, options = {}) {
+  const path = join(dir, ".mnemonik.json");
+  try {
+    const stat = await lstat(path);
+    if (stat.isSymbolicLink())
+      return { kind: "malformed", detail: "symlink" };
+    if (!stat.isFile())
+      return { kind: "malformed", detail: "identity path is not a regular file" };
+    const text = await readFile(path, "utf8");
+    if ((options.selectedRoot || options.configurationOnlyAbsent) && isConfigurationOnly(text))
+      return { kind: "absent" };
+    return parseIdentityFile(text);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { kind: "absent" };
+    return { kind: "malformed", detail: `cannot read identity file: ${error.message}` };
+  }
+}
+var CANONICAL_UUID, isCanonicalUuid, IDENTITY_KEYS, FINGERPRINT_KEYS;
+var init_projectIdentityFile = __esm({
+  "packages/shared/dist/projectIdentityFile.js"() {
+    "use strict";
+    CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+    isCanonicalUuid = (value) => typeof value === "string" && CANONICAL_UUID.test(value);
+    IDENTITY_KEYS = /* @__PURE__ */ new Set([
+      "schemaVersion",
+      "projectId",
+      "projectName",
+      "repositoryFingerprint"
+    ]);
+    FINGERPRINT_KEYS = /* @__PURE__ */ new Set(["algorithmVersion", "hash"]);
+  }
+});
+
 // packages/shared/dist/hookTimeouts.js
 var init_hookTimeouts = __esm({
   "packages/shared/dist/hookTimeouts.js"() {
@@ -893,7 +1003,7 @@ var init_hookTimeouts = __esm({
 });
 
 // packages/shared/dist/runtimeSigners.js
-import { basename, dirname as dirname2, join as join2, resolve, sep, win32 } from "node:path";
+import { basename, dirname as dirname2, join as join3, resolve, sep, win32 } from "node:path";
 import { execFile, execFileSync } from "node:child_process";
 function windowsCommand(file) {
   const root = process.env.SystemRoot;
@@ -1122,102 +1232,8 @@ var init_repositoryFingerprint = __esm({
   }
 });
 
-// packages/shared/dist/projectIdentityFile.js
-import { lstat, readFile } from "node:fs/promises";
-import { join as join3 } from "node:path";
-function parseIdentityFile(text) {
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch (error) {
-    return { kind: "malformed", detail: `unparseable JSON: ${error.message}` };
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return { kind: "malformed", detail: "identity file must contain a JSON object" };
-  }
-  const record = value;
-  if (record.schemaVersion !== 1) {
-    return { kind: "unknown_version", version: record.schemaVersion };
-  }
-  const unknownKey = Object.keys(record).find((key) => !IDENTITY_KEYS.has(key));
-  if (unknownKey)
-    return { kind: "malformed", detail: `unknown key "${unknownKey}"` };
-  if (!isCanonicalUuid(record.projectId)) {
-    return { kind: "malformed", detail: '"projectId" must be a canonical RFC 4122 UUID string' };
-  }
-  if ("projectName" in record && typeof record.projectName !== "string") {
-    return { kind: "malformed", detail: '"projectName" must be a string when present' };
-  }
-  if ("repositoryFingerprint" in record && (!record.repositoryFingerprint || typeof record.repositoryFingerprint !== "object" || Array.isArray(record.repositoryFingerprint))) {
-    return { kind: "malformed", detail: '"repositoryFingerprint" must be an object when present' };
-  }
-  const fingerprint = record.repositoryFingerprint;
-  const unknownFingerprintKey = fingerprint ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key)) : void 0;
-  if (unknownFingerprintKey) {
-    return {
-      kind: "malformed",
-      detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`
-    };
-  }
-  if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== "string")) {
-    return {
-      kind: "malformed",
-      detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash'
-    };
-  }
-  const repositoryFingerprint2 = fingerprint ? { algorithmVersion: 1, hash: fingerprint.hash } : void 0;
-  return {
-    kind: "ok",
-    identity: {
-      schemaVersion: 1,
-      projectId: record.projectId,
-      ...record.projectName === void 0 ? {} : { projectName: record.projectName },
-      ...repositoryFingerprint2 ? { repositoryFingerprint: repositoryFingerprint2 } : {}
-    }
-  };
-}
-async function readIdentityFile(dir, options = {}) {
-  const path = join3(dir, ".mnemonik.json");
-  try {
-    const stat = await lstat(path);
-    if (stat.isSymbolicLink())
-      return { kind: "malformed", detail: "symlink" };
-    if (!stat.isFile())
-      return { kind: "malformed", detail: "identity path is not a regular file" };
-    const text = await readFile(path, "utf8");
-    if (options.selectedRoot) {
-      try {
-        const value = JSON.parse(text);
-        if (value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value) && (!("schemaVersion" in value) || value.schemaVersion === 1))
-          return { kind: "absent" };
-      } catch {
-      }
-    }
-    return parseIdentityFile(text);
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return { kind: "absent" };
-    return { kind: "malformed", detail: `cannot read identity file: ${error.message}` };
-  }
-}
-var CANONICAL_UUID, isCanonicalUuid, IDENTITY_KEYS, FINGERPRINT_KEYS;
-var init_projectIdentityFile = __esm({
-  "packages/shared/dist/projectIdentityFile.js"() {
-    "use strict";
-    CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-    isCanonicalUuid = (value) => typeof value === "string" && CANONICAL_UUID.test(value);
-    IDENTITY_KEYS = /* @__PURE__ */ new Set([
-      "schemaVersion",
-      "projectId",
-      "projectName",
-      "repositoryFingerprint"
-    ]);
-    FINGERPRINT_KEYS = /* @__PURE__ */ new Set(["algorithmVersion", "hash"]);
-  }
-});
-
 // packages/shared/dist/repositoryRoot.js
-import { lstat as lstat2, readFile as readFile2 } from "node:fs/promises";
+import { lstat as lstat2, readFile as readFile2, realpath } from "node:fs/promises";
 import { execFile as execFile2 } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname as dirname3, join as join4, resolve as resolve2 } from "node:path";
@@ -1268,7 +1284,7 @@ async function confirmedBoundaryAt(path) {
 async function boundariesBetween(cwd, root) {
   const boundaries = [];
   let directory = cwd;
-  while (directory !== root) {
+  while (!samePath(directory, root)) {
     const boundary = await confirmedBoundaryAt(directory);
     if (boundary)
       boundaries.push(boundary);
@@ -1291,37 +1307,31 @@ async function containingRepository(root) {
     directory = parent;
   }
 }
-async function canonicalBoundaryRoot(boundary) {
-  if (boundary.kind === "directory")
-    return boundary.path;
-  const pointer = /^gitdir:\s*(.+)\s*$/im.exec(await readFile2(join4(boundary.path, ".git"), "utf8"))?.[1];
-  if (!pointer)
-    return boundary.path;
-  const gitDir = resolve2(boundary.path, pointer);
-  try {
-    const commonDir = resolve2(gitDir, (await readFile2(join4(gitDir, "commondir"), "utf8")).trim());
-    return dirname3(commonDir);
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return boundary.path;
-    throw error;
-  }
+async function canonicalPath(path) {
+  const absolute = resolve2(path);
+  return realpath(absolute).catch(() => absolute);
+}
+function samePath(left, right) {
+  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }
 async function resolveRepositoryRoot(cwd) {
-  const absoluteCwd = resolve2(cwd);
+  const absoluteCwd = await canonicalPath(cwd);
   try {
     const { stdout } = await runGit(absoluteCwd, [
       "rev-parse",
       "--show-toplevel",
+      "--git-dir",
       "--git-common-dir"
     ]);
-    const [rootLine, commonLine, ...extra] = stdout.trim().split(/\r?\n/);
-    if (!rootLine || !commonLine || extra.length) {
+    const [rootLine, gitDirLine, commonLine, ...extra] = stdout.trim().split(/\r?\n/);
+    if (!rootLine || !gitDirLine || !commonLine || extra.length) {
       return { kind: "git_unavailable", detail: "git rev-parse returned an unexpected response" };
     }
-    const root = resolve2(rootLine);
-    const commonDir = resolve2(root, commonLine);
-    const isLinkedWorktree = commonDir !== join4(root, ".git");
+    const fromGit = (line) => canonicalPath(resolve2(absoluteCwd, line));
+    const root = await fromGit(rootLine);
+    const gitDir = await fromGit(gitDirLine);
+    const commonDir = await fromGit(commonLine);
+    const isLinkedWorktree = !samePath(gitDir, commonDir);
     const nested = await boundariesBetween(absoluteCwd, root);
     if (!isLinkedWorktree && await containingRepository(root)) {
       const boundary = await boundaryAt(root);
@@ -1343,14 +1353,41 @@ async function resolveRepositoryRoot(cwd) {
     return { kind: "git_unavailable", detail: failure.message };
   }
 }
+async function linkedWorktreeCommonDir(dir) {
+  try {
+    if (!(await lstat2(join4(dir, ".git"))).isFile())
+      return void 0;
+    const pointer = /^gitdir:\s*(.+?)\s*$/im.exec(await readFile2(join4(dir, ".git"), "utf8"))?.[1];
+    if (!pointer)
+      return void 0;
+    const gitDir = resolve2(dir, pointer);
+    const common = (await readFile2(join4(gitDir, "commondir"), "utf8")).trim();
+    return common ? await canonicalPath(resolve2(gitDir, common)) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function mainCheckout(worktreeTop, commonDir) {
+  try {
+    const { stdout } = await runGit(worktreeTop, ["worktree", "list", "--porcelain"]);
+    const first = stdout.split(/\r?\n\r?\n/)[0] ?? "";
+    const path = /^worktree (.+)$/m.exec(first)?.[1];
+    if (path) {
+      const main = await canonicalPath(resolve2(worktreeTop, path));
+      return /^bare$/m.test(first) ? dirname3(main) : main;
+    }
+  } catch {
+  }
+  return dirname3(commonDir);
+}
 async function readPlainIdentity(start2) {
-  const home = resolve2(homedir());
+  const home = await canonicalPath(homedir());
   let directory = start2;
   while (true) {
-    const result = await readIdentityFile(directory);
+    const result = await readIdentityFile(directory, { configurationOnlyAbsent: true });
     if (result.kind !== "absent")
       return { root: directory, result };
-    if (directory === home)
+    if (samePath(directory, home))
       break;
     const parent = dirname3(directory);
     if (parent === directory)
@@ -1359,58 +1396,72 @@ async function readPlainIdentity(start2) {
   }
   return { root: start2, result: { kind: "absent" } };
 }
+async function nearestIdentity(start2) {
+  const home = await canonicalPath(homedir());
+  let directory = start2;
+  while (true) {
+    const commonDir = await linkedWorktreeCommonDir(directory);
+    if (commonDir)
+      return { worktreeTop: directory, commonDir };
+    const result = await readIdentityFile(directory, { configurationOnlyAbsent: true });
+    if (result.kind !== "absent")
+      return { root: directory, result };
+    if (samePath(directory, home))
+      return void 0;
+    const parent = dirname3(directory);
+    if (parent === directory)
+      return void 0;
+    directory = parent;
+  }
+}
+async function resolveNearestProjectIdentity(cwd) {
+  const start2 = await canonicalPath(cwd);
+  const resolved = await resolveRepositoryRoot(start2);
+  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: start2 } : resolved;
+  const nested = repository.kind === "git" ? repository.nested : [];
+  let found = await nearestIdentity(start2);
+  if (found && "worktreeTop" in found) {
+    found = await readPlainIdentity(await mainCheckout(found.worktreeTop, found.commonDir));
+  }
+  if (found) {
+    return shapedIdentity(found, await projectFolderRepository(found.root, repository), nested);
+  }
+  return { ...withBase(repository, repository.root, nested), kind: "absent" };
+}
+async function resolveNamedProjectIdentity(cwd, options) {
+  const start2 = await canonicalPath(cwd);
+  const resolved = await resolveRepositoryRoot(start2);
+  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: start2 } : resolved;
+  const commonDir = await linkedWorktreeCommonDir(start2);
+  const root = commonDir ? await mainCheckout(start2, commonDir) : start2;
+  return shapedIdentity({ root, result: await readIdentityFile(root, options) }, await projectFolderRepository(root, repository), repository.kind === "git" ? repository.nested : []);
+}
+function shapedIdentity(found, repository, nested) {
+  const base = withBase(repository, found.root, nested);
+  if (found.result.kind === "ok")
+    return { ...base, ...found.result };
+  if (found.result.kind === "unknown_version")
+    return { ...base, ...found.result, path: found.root };
+  if (found.result.kind === "malformed")
+    return { ...base, ...found.result, path: found.root };
+  return { ...base, kind: "absent" };
+}
+async function projectFolderRepository(projectRoot, known) {
+  if (known.kind === "git" && samePath(known.root, projectRoot))
+    return known;
+  const repository = await resolveRepositoryRoot(projectRoot);
+  if (repository.kind === "git" && samePath(repository.root, projectRoot))
+    return repository;
+  return { kind: "plain", root: projectRoot };
+}
 function withBase(repository, root, nested) {
   return { root, repository, nested };
 }
 async function resolveProjectIdentity(cwd, options = {}) {
-  const resolved = await resolveRepositoryRoot(cwd);
-  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: resolve2(cwd) } : resolved;
-  if (repository.kind === "plain") {
-    const { root, result } = options.selectedRoot ? { root: repository.root, result: await readIdentityFile(repository.root, options) } : await readPlainIdentity(repository.root);
-    const base2 = withBase(repository, root, []);
-    if (result.kind === "ok")
-      return { ...base2, ...result };
-    if (result.kind === "unknown_version")
-      return { ...base2, ...result, path: root };
-    if (result.kind === "malformed")
-      return { ...base2, ...result, path: root };
-    return { ...base2, kind: "absent" };
-  }
-  const ownRoot = repository.isLinkedWorktree ? dirname3(repository.commonDir) : repository.root;
-  const outer = repository.isLinkedWorktree ? void 0 : await containingRepository(repository.root);
-  const own = await readIdentityFile(ownRoot, options);
-  if (!outer || options.selectedRoot || own.kind === "ok") {
-    const base2 = withBase(repository, ownRoot, repository.nested);
-    if (own.kind === "ok")
-      return { ...base2, ...own };
-    if (own.kind === "unknown_version")
-      return { ...base2, ...own, path: ownRoot };
-    if (own.kind === "malformed")
-      return { ...base2, ...own, path: ownRoot };
-    return { ...base2, kind: "absent" };
-  }
-  const nested = repository.nested;
-  const parentRoot = await canonicalBoundaryRoot(outer);
-  const parent = await readIdentityFile(parentRoot);
-  const base = withBase(repository, parentRoot, nested);
-  if (own.kind === "unknown_version")
-    return { ...base, ...own, path: ownRoot };
-  if (own.kind === "malformed")
-    return { ...base, ...own, path: ownRoot };
-  if (parent.kind === "unknown_version")
-    return { ...base, ...parent, path: parentRoot };
-  if (parent.kind === "malformed")
-    return { ...base, ...parent, path: parentRoot };
-  if (!options.allowNestedInherit) {
-    return {
-      ...base,
-      kind: "nested",
-      ...parent.kind === "ok" ? { parentIdentity: parent.identity } : {}
-    };
+  if (options.selectedRoot || options.namedRoot) {
+    return resolveNamedProjectIdentity(cwd, { selectedRoot: options.selectedRoot });
   }
-  if (parent.kind === "ok")
-    return { ...base, kind: "ok", identity: parent.identity };
-  return { ...base, kind: "absent" };
+  return resolveNearestProjectIdentity(cwd);
 }
 var GIT_TIMEOUT_MS, GIT_ENV_KEYS;
 var init_repositoryRoot = __esm({
@@ -1431,6 +1482,18 @@ var init_repositoryRoot = __esm({
   }
 });
 
+// packages/shared/dist/hookTrace.js
+var HOOK_TRACE_MAX_BYTES;
+var init_hookTrace = __esm({
+  "packages/shared/dist/hookTrace.js"() {
+    "use strict";
+    init_protectedPaths();
+    init_runtimeSigners();
+    init_secretPatterns();
+    HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+  }
+});
+
 // packages/shared/dist/runtimeReader.js
 var RuntimeError;
 var init_runtimeReader = __esm({
@@ -1502,10 +1565,12 @@ var init_hookRuntime = __esm({
     init_runtimeSigners();
     init_hookTimeouts();
     init_repositoryRoot();
+    init_hookTrace();
     init_runtimeReader();
     init_runtimeSigners();
     init_projectSetupHandoff();
     init_hookConversation();
+    init_hookTrace();
   }
 });
 
@@ -3135,6 +3200,9 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
+init_secretPatterns();
+init_protectedPaths();
+init_projectIdentityFile();
 
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
@@ -7180,9 +7248,9 @@ var Query = class {
 };
 
 // packages/shared/dist/ast/grammars.js
-import { dirname, extname, join } from "node:path";
+import { dirname, extname, join as join2 } from "node:path";
 import { fileURLToPath } from "node:url";
-var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
+var WASM_DIR = join2(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
 // packages/shared/dist/ast/astChunker.js
 var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
@@ -7360,6 +7428,7 @@ var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
+init_secretPatterns();
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js
@@ -7375,9 +7444,10 @@ init_settingsIo();
 init_repositoryFingerprint();
 init_projectIdentityFile();
 init_repositoryRoot();
+init_protectedPaths();
 
 // packages/local-setup/dist/index.js
-import { realpath, unlink as unlink2 } from "node:fs/promises";
+import { realpath as realpath2, unlink as unlink2 } from "node:fs/promises";
 import { basename as basename2, dirname as dirname5, join as join7 } from "node:path";
 
 // packages/local-setup/dist/contracts.js
@@ -7677,13 +7747,13 @@ function createProjectSetupExecutor(deps) {
     let resolution = await deps.resolver.resolveProjectIdentity(options.cwd, options);
     if (resolution.kind !== "ok" && resolution.kind !== "absent")
       return actionRequired(resolution.kind);
-    const root = await realpath(resolution.root);
+    const root = await realpath2(resolution.root);
     const path = recordPath(root, deps.stateDir);
     return withLock(path, deps.waitMs ?? 6e4, async (assertOwned) => {
       const fresh = await deps.resolver.resolveProjectIdentity(options.cwd, options);
       if (fresh.kind !== "ok" && fresh.kind !== "absent")
         return actionRequired(fresh.kind);
-      if (await realpath(fresh.root) !== root)
+      if (await realpath2(fresh.root) !== root)
         return actionRequired("identity_changed");
       resolution = fresh;
       const file = join7(root, ".mnemonik.json");
@@ -7940,7 +8010,7 @@ function createProjectSetupExecutor(deps) {
   };
 }
 async function cancelProjectSetup(folder, stateDir, waitMs = 6e4) {
-  const root = await realpath(folder);
+  const root = await realpath2(folder);
   const path = recordPath(root, stateDir);
   return withLock(path, waitMs, async (assertOwned) => {
     const saved = await readBytes(path);
@@ -8021,8 +8091,12 @@ function answerCommands(actions, root, details = {}) {
     return [];
   });
 }
+async function projectFolderFor(folder, resolver) {
+  const resolution = await resolver.resolveProjectIdentity(folder);
+  return resolution.kind === "absent" || resolution.kind === "git_unavailable" ? folder : resolution.root;
+}
 async function ensureProjectRoot(root, executor) {
-  return executor.ensureProject({ cwd: root, allowCreate: true, allowNestedInherit: false });
+  return executor.ensureProject({ cwd: root, allowCreate: true, namedRoot: true });
 }
 var refusalReasons = {
   filesystem_root: "Mnemonik does not index a whole disk.",
@@ -8039,8 +8113,6 @@ var refusalReasons = {
   deleted: "Its project was deleted.",
   fingerprint_mismatch: "Its Git remote does not match the repository this project was set up with.",
   confirmation_required: "Mnemonik has not seen this folder on this machine before.",
-  nested: "It sits inside another project.",
-  conflict: "It holds project files that disagree.",
   invalid_identity: "Its project file cannot be read.",
   malformed: "Its project file cannot be read.",
   unknown_version: "Its project file was written by a newer version of Mnemonik.",
@@ -8078,8 +8150,6 @@ var refusalSteps = {
   identity_too_large: FRESH_FILE,
   fingerprint_mismatch: "Run mnemonik project link <project id> --confirm-mismatch in that folder to connect it anyway.",
   confirmation_required: "Run mnemonik project setup in that folder to confirm it.",
-  nested: "Run mnemonik project setup in that folder and choose which project it belongs to.",
-  conflict: "Run mnemonik project setup in that folder and choose which project it belongs to.",
   identity_changed: AGAIN,
   operation_context_changed: "Run mnemonik project setup --cancel in that folder, then run the command again.",
   rollback_in_progress: "Wait for it to finish, then run the command again.",
@@ -8116,7 +8186,7 @@ var connectedProjectsMessage = (roots) => roots.length === 1 ? `  \u2713 Connect
 var projectExecutor = (dependencies) => {
   const executor = createProjectSetupExecutor(dependencies);
   return {
-    resolveProjectIdentity: (cwd) => dependencies.resolver.resolveProjectIdentity(cwd, { allowNestedInherit: false }),
+    resolveProjectIdentity: (cwd, options) => dependencies.resolver.resolveProjectIdentity(cwd, options),
     ...executor
   };
 };
@@ -8159,6 +8229,28 @@ async function repositoryFingerprint(root) {
     hash: selected.fingerprint.hash
   } : null;
 }
+async function rootIssueContext(root, dependencies) {
+  const [binding, resolution] = await Promise.all([
+    dependencies.hmacRootBinding(1, root),
+    // The root is already chosen: read its own identity file, not a parent's.
+    dependencies.resolveIdentity(root, { namedRoot: true })
+  ]);
+  const fingerprint = resolution.kind !== "git_unavailable" && resolution.repository.kind === "git" ? await (dependencies.fingerprint ?? repositoryFingerprint)(root) : null;
+  const evidence = {
+    deviceRootContext: {
+      algorithmVersion: binding.version,
+      hash: Buffer.from(binding.hmac, "base64url").toString("hex")
+    },
+    repositoryFingerprint: fingerprint
+  };
+  const context = {
+    ...evidence,
+    rootKind: resolution.kind !== "git_unavailable" && resolution.repository.kind === "plain" ? "selected_non_git" : resolution.kind === "git_unavailable" ? "ineligible" : "git",
+    identityState: resolution.kind === "ok" ? "valid" : resolution.kind === "absent" ? "absent" : "invalid",
+    ...resolution.kind === "ok" ? { projectId: resolution.identity.projectId } : {}
+  };
+  return { evidence, context };
+}
 async function createRealProjectRuntime(options = {}) {
   const resolveIdentity = (cwd, resolverOptions) => resolveProjectIdentity(cwd, { ...resolverOptions, selectedRoot: options.selectedRoots });
   const credentials = options.credentials ?? createCliCredentials(options.stateDir ? { stateDir: options.stateDir } : {});
@@ -8185,24 +8277,10 @@ async function createRealProjectRuntime(options = {}) {
   });
   const account = await transport.accountContext();
   const bindContext = async (root) => {
-    const [binding, fingerprint, resolution] = await Promise.all([
-      credentials.hmacRootBinding(1, root),
-      repositoryFingerprint(root),
-      resolveIdentity(root, { allowNestedInherit: false })
-    ]);
-    const evidence = {
-      deviceRootContext: {
-        algorithmVersion: binding.version,
-        hash: Buffer.from(binding.hmac, "base64url").toString("hex")
-      },
-      repositoryFingerprint: fingerprint
-    };
-    const context = {
-      ...evidence,
-      rootKind: resolution.kind !== "git_unavailable" && resolution.repository.kind === "plain" ? "selected_non_git" : resolution.kind === "git_unavailable" ? "ineligible" : "git",
-      identityState: resolution.kind === "ok" ? "valid" : resolution.kind === "absent" ? "absent" : "invalid",
-      ...resolution.kind === "ok" ? { projectId: resolution.identity.projectId } : {}
-    };
+    const { evidence, context } = await rootIssueContext(root, {
+      hmacRootBinding: (version, path) => credentials.hmacRootBinding(version, path),
+      resolveIdentity
+    });
     contexts.set(contextKey(evidence), context);
     return evidence;
   };
@@ -8351,9 +8429,10 @@ async function finishRequired(deps, input, root, reason, owner, state, allowedAc
 }
 async function statusCommand(input, deps) {
   const cwd = input.path ?? deps.cwd;
-  const resolution = await (deps.resolver?.resolveProjectIdentity ?? resolveProjectIdentity)(cwd, {
-    allowNestedInherit: false
-  });
+  const resolution = await (deps.resolver?.resolveProjectIdentity ?? resolveProjectIdentity)(
+    cwd,
+    {}
+  );
   const root = "root" in resolution ? resolution.root : cwd;
   const projectId = resolution.kind === "ok" ? resolution.identity.projectId : null;
   const currentHash = await identityHash(root);
@@ -8395,7 +8474,7 @@ async function statusCommand(input, deps) {
 }
 async function cancelCommand(input, deps) {
   const cwd = input.path ?? deps.cwd;
-  const resolution = await (deps.executor ?? deps.resolver ?? { resolveProjectIdentity }).resolveProjectIdentity(cwd, { allowNestedInherit: false });
+  const resolution = await (deps.executor ?? deps.resolver ?? { resolveProjectIdentity }).resolveProjectIdentity(cwd, { namedRoot: input.path !== void 0 });
   const result = await cancelProjectSetup(
     "root" in resolution ? resolution.root : cwd,
     deps.stateDir
@@ -8428,29 +8507,11 @@ async function runProjectCommandInner(input, deps, prompts) {
       allowedActions: ["choose_personal_or_team_owner", "cancel"]
     });
   const cwd = input.path ?? deps.cwd;
-  const resolution = await executor.resolveProjectIdentity(cwd);
-  if (resolution.kind === "nested" || resolution.kind === "conflict") {
-    const identityLocation = join8(resolution.root, ".mnemonik.json");
-    if (!input.json) {
-      deps.output.line(`Root: ${resolution.root}`);
-      deps.output.line(`Identity: ${identityLocation}`);
-    }
-    return finishRequired(
-      deps,
-      input,
-      resolution.root,
-      resolution.kind,
-      owner,
-      resolution.kind,
-      [
-        "use_parent_identity",
-        "initialize_nested_separately",
-        "select_main_or_worktree_identity",
-        "cancel"
-      ],
-      { identityLocation }
-    );
-  }
+  const named = input.path !== void 0;
+  const resolution = await executor.resolveProjectIdentity(
+    cwd,
+    named ? { namedRoot: true } : void 0
+  );
   const decision = await evaluateRoot(resolution, { cwd, home: deps.home });
   if (!decision.allowed) {
     if (!input.json)
@@ -8467,7 +8528,7 @@ async function runProjectCommandInner(input, deps, prompts) {
     cwd,
     owner,
     allowCreate: input.command !== "link",
-    allowNestedInherit: false
+    ...named ? { namedRoot: true } : {}
   };
   if (input.command === "setup") {
     if ((input.nonInteractive || input.json) && !input.apply) {
@@ -8686,8 +8747,7 @@ async function ensureProjectForAgent(options) {
   }
   const result = await executor.ensureProject({
     cwd: options.cwd,
-    allowCreate: true,
-    allowNestedInherit: false
+    allowCreate: true
   });
   options.output.json(result);
   return result.status === "ACTION_REQUIRED" || result.status === "project_setup_required" ? 3 : 0;
@@ -8696,8 +8756,7 @@ async function rollbackProjectIdentity(options) {
   if (!options.executor) return 3;
   const result = await options.executor.rollback({
     cwd: options.cwd,
-    allowCreate: false,
-    allowNestedInherit: false
+    allowCreate: false
   });
   options.output.json(result);
   return result.status === "rolled_back" ? 0 : 3;
@@ -8712,8 +8771,10 @@ export {
   folderRefusalMessage,
   hasRefusalWords,
   projectExecutor,
+  projectFolderFor,
   projectLimitMessage,
   repositoryFingerprint,
   rollbackProjectIdentity,
+  rootIssueContext,
   runProjectCommand
 };