@mnemonik/cli 7.140.1 → 7.140.3

package/dist/installSession.js

@@ -876,7 +876,7 @@ import { humanReason, humanReport } from "./humanReason.js";
 import { devReadiness } from "./runtime/releaseSource.js";
 
 // packages/shared/dist/instructions.js
-var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({ cwd }) loads project context when cwd is the real absolute path of the project root; a placeholder or relative path fails. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
+var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({}) loads project context; installed hooks supply the project. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
 
 What I learn about you belongs in Companion; what I learn about this project belongs here.
 

package/dist/installation.js

@@ -885,6 +885,27 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/secretPatterns.js
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/protectedPaths.js
+var init_protectedPaths = __esm({
+  "packages/shared/dist/protectedPaths.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/projectIdentityFile.js
+var init_projectIdentityFile = __esm({
+  "packages/shared/dist/projectIdentityFile.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/hookTimeouts.js
 var init_hookTimeouts = __esm({
   "packages/shared/dist/hookTimeouts.js"() {
@@ -982,13 +1003,6 @@ var init_repositoryFingerprint = __esm({
   }
 });
 
-// packages/shared/dist/projectIdentityFile.js
-var init_projectIdentityFile = __esm({
-  "packages/shared/dist/projectIdentityFile.js"() {
-    "use strict";
-  }
-});
-
 // packages/shared/dist/repositoryRoot.js
 var init_repositoryRoot = __esm({
   "packages/shared/dist/repositoryRoot.js"() {
@@ -997,6 +1011,18 @@ var init_repositoryRoot = __esm({
   }
 });
 
+// packages/shared/dist/hookTrace.js
+var HOOK_TRACE_MAX_BYTES;
+var init_hookTrace = __esm({
+  "packages/shared/dist/hookTrace.js"() {
+    "use strict";
+    init_protectedPaths();
+    init_runtimeSigners();
+    init_secretPatterns();
+    HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+  }
+});
+
 // packages/shared/dist/runtimeReader.js
 var RuntimeError;
 var init_runtimeReader = __esm({
@@ -1068,10 +1094,12 @@ var init_hookRuntime = __esm({
     init_runtimeSigners();
     init_hookTimeouts();
     init_repositoryRoot();
+    init_hookTrace();
     init_runtimeReader();
     init_runtimeSigners();
     init_projectSetupHandoff();
     init_hookConversation();
+    init_hookTrace();
   }
 });
 
@@ -2657,7 +2685,7 @@ import { mkdir as mkdir2 } from "node:fs/promises";
 import { join as join5 } from "node:path";
 
 // packages/shared/dist/instructions.js
-var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({ cwd }) loads project context when cwd is the real absolute path of the project root; a placeholder or relative path fails. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
+var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({}) loads project context; installed hooks supply the project. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
 
 What I learn about you belongs in Companion; what I learn about this project belongs here.
 
@@ -2694,6 +2722,9 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
+init_secretPatterns();
+init_protectedPaths();
+init_projectIdentityFile();
 
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
@@ -6919,6 +6950,7 @@ var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
+init_secretPatterns();
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js
@@ -6934,6 +6966,7 @@ init_settingsIo();
 init_repositoryFingerprint();
 init_projectIdentityFile();
 init_repositoryRoot();
+init_protectedPaths();
 
 // packages/local-setup/dist/storage.js
 init_hookRuntime();

package/dist/launcher.js

@@ -885,6 +885,27 @@ var require_ignore = __commonJS({
   }
 });
 
+// packages/shared/dist/secretPatterns.js
+var init_secretPatterns = __esm({
+  "packages/shared/dist/secretPatterns.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/protectedPaths.js
+var init_protectedPaths = __esm({
+  "packages/shared/dist/protectedPaths.js"() {
+    "use strict";
+  }
+});
+
+// packages/shared/dist/projectIdentityFile.js
+var init_projectIdentityFile = __esm({
+  "packages/shared/dist/projectIdentityFile.js"() {
+    "use strict";
+  }
+});
+
 // packages/shared/dist/hookTimeouts.js
 var init_hookTimeouts = __esm({
   "packages/shared/dist/hookTimeouts.js"() {
@@ -982,13 +1003,6 @@ var init_repositoryFingerprint = __esm({
   }
 });
 
-// packages/shared/dist/projectIdentityFile.js
-var init_projectIdentityFile = __esm({
-  "packages/shared/dist/projectIdentityFile.js"() {
-    "use strict";
-  }
-});
-
 // packages/shared/dist/repositoryRoot.js
 var init_repositoryRoot = __esm({
   "packages/shared/dist/repositoryRoot.js"() {
@@ -997,6 +1011,18 @@ var init_repositoryRoot = __esm({
   }
 });
 
+// packages/shared/dist/hookTrace.js
+var HOOK_TRACE_MAX_BYTES;
+var init_hookTrace = __esm({
+  "packages/shared/dist/hookTrace.js"() {
+    "use strict";
+    init_protectedPaths();
+    init_runtimeSigners();
+    init_secretPatterns();
+    HOOK_TRACE_MAX_BYTES = 2 * 1024 * 1024;
+  }
+});
+
 // packages/shared/dist/runtimeReader.js
 var RuntimeError;
 var init_runtimeReader = __esm({
@@ -1068,10 +1094,12 @@ var init_hookRuntime = __esm({
     init_runtimeSigners();
     init_hookTimeouts();
     init_repositoryRoot();
+    init_hookTrace();
     init_runtimeReader();
     init_runtimeSigners();
     init_projectSetupHandoff();
     init_hookConversation();
+    init_hookTrace();
   }
 });
 
@@ -2659,7 +2687,7 @@ import { homedir as homedir3 } from "node:os";
 import { basename as basename2, isAbsolute, join as join5, resolve as resolve2 } from "node:path";
 
 // packages/shared/dist/instructions.js
-var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({ cwd }) loads project context when cwd is the real absolute path of the project root; a placeholder or relative path fails. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
+var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({}) loads project context; installed hooks supply the project. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
 
 What I learn about you belongs in Companion; what I learn about this project belongs here.
 
@@ -2696,6 +2724,9 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
+init_secretPatterns();
+init_protectedPaths();
+init_projectIdentityFile();
 
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
@@ -6921,6 +6952,7 @@ var BUILT_IN_IGNORE_DIR_SET = new Set(BUILT_IN_IGNORE_DIRS);
 var import_ignore2 = __toESM(require_ignore(), 1);
 
 // packages/shared/dist/index.js
+init_secretPatterns();
 init_hookTimeouts();
 
 // packages/shared/dist/jitDeliveryAck.js
@@ -6936,6 +6968,7 @@ init_settingsIo();
 init_repositoryFingerprint();
 init_projectIdentityFile();
 init_repositoryRoot();
+init_protectedPaths();
 
 // packages/local-setup/dist/storage.js
 init_hookRuntime();

package/dist/preflight.js

@@ -877,7 +877,7 @@ import { homedir as homedir2 } from "node:os";
 import { join as join4 } from "node:path";
 
 // packages/shared/dist/instructions.js
-var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({ cwd }) loads project context when cwd is the real absolute path of the project root; a placeholder or relative path fails. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
+var INSTRUCTIONS_CONTENT = `Mnemonik provides persistent project memory: decisions, rationale, tasks, and policies across sessions. If no block begins "PROJECT_CONTEXT schemaVersion=", session_bootstrap({}) loads project context; installed hooks supply the project. With that block, context is loaded and no session_bootstrap call is needed. Code and docs show current artifacts, git shows changes, and memory carries the why; memory_search recalls rationale or intent, then Grep or Read verifies current source.
 
 What I learn about you belongs in Companion; what I learn about this project belongs here.
 
@@ -915,6 +915,96 @@ var MCP_INSTRUCTIONS = getMcpInstructions();
 // packages/shared/dist/codeScanner.js
 var import_ignore = __toESM(require_ignore(), 1);
 
+// packages/shared/dist/projectIdentityFile.js
+import { lstat, readFile } from "node:fs/promises";
+import { join } from "node:path";
+var CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var isCanonicalUuid = (value) => typeof value === "string" && CANONICAL_UUID.test(value);
+var IDENTITY_KEYS = /* @__PURE__ */ new Set([
+  "schemaVersion",
+  "projectId",
+  "projectName",
+  "repositoryFingerprint"
+]);
+var FINGERPRINT_KEYS = /* @__PURE__ */ new Set(["algorithmVersion", "hash"]);
+function parseIdentityFile(text) {
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch (error) {
+    return { kind: "malformed", detail: `unparseable JSON: ${error.message}` };
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return { kind: "malformed", detail: "identity file must contain a JSON object" };
+  }
+  const record = value;
+  if (record.schemaVersion !== 1) {
+    return { kind: "unknown_version", version: record.schemaVersion };
+  }
+  const unknownKey = Object.keys(record).find((key) => !IDENTITY_KEYS.has(key));
+  if (unknownKey)
+    return { kind: "malformed", detail: `unknown key "${unknownKey}"` };
+  if (!isCanonicalUuid(record.projectId)) {
+    return { kind: "malformed", detail: '"projectId" must be a canonical RFC 4122 UUID string' };
+  }
+  if ("projectName" in record && typeof record.projectName !== "string") {
+    return { kind: "malformed", detail: '"projectName" must be a string when present' };
+  }
+  if ("repositoryFingerprint" in record && (!record.repositoryFingerprint || typeof record.repositoryFingerprint !== "object" || Array.isArray(record.repositoryFingerprint))) {
+    return { kind: "malformed", detail: '"repositoryFingerprint" must be an object when present' };
+  }
+  const fingerprint = record.repositoryFingerprint;
+  const unknownFingerprintKey = fingerprint ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key)) : void 0;
+  if (unknownFingerprintKey) {
+    return {
+      kind: "malformed",
+      detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`
+    };
+  }
+  if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== "string")) {
+    return {
+      kind: "malformed",
+      detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash'
+    };
+  }
+  const repositoryFingerprint = fingerprint ? { algorithmVersion: 1, hash: fingerprint.hash } : void 0;
+  return {
+    kind: "ok",
+    identity: {
+      schemaVersion: 1,
+      projectId: record.projectId,
+      ...record.projectName === void 0 ? {} : { projectName: record.projectName },
+      ...repositoryFingerprint ? { repositoryFingerprint } : {}
+    }
+  };
+}
+function isConfigurationOnly(text) {
+  try {
+    const value = JSON.parse(text);
+    return !!value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value) && (!("schemaVersion" in value) || value.schemaVersion === 1);
+  } catch {
+    return false;
+  }
+}
+async function readIdentityFile(dir, options = {}) {
+  const path = join(dir, ".mnemonik.json");
+  try {
+    const stat = await lstat(path);
+    if (stat.isSymbolicLink())
+      return { kind: "malformed", detail: "symlink" };
+    if (!stat.isFile())
+      return { kind: "malformed", detail: "identity path is not a regular file" };
+    const text = await readFile(path, "utf8");
+    if ((options.selectedRoot || options.configurationOnlyAbsent) && isConfigurationOnly(text))
+      return { kind: "absent" };
+    return parseIdentityFile(text);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      return { kind: "absent" };
+    return { kind: "malformed", detail: `cannot read identity file: ${error.message}` };
+  }
+}
+
 // node_modules/web-tree-sitter/web-tree-sitter.js
 var __defProp2 = Object.defineProperty;
 var __name = (target, value) => __defProp2(target, "name", { value, configurable: true });
@@ -4959,9 +5049,9 @@ var Query = class {
 };
 
 // packages/shared/dist/ast/grammars.js
-import { dirname, extname, join } from "node:path";
+import { dirname, extname, join as join2 } from "node:path";
 import { fileURLToPath } from "node:url";
-var WASM_DIR = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
+var WASM_DIR = join2(dirname(fileURLToPath(import.meta.url)), "..", "..", "wasm");
 
 // packages/shared/dist/ast/astChunker.js
 var MAX_AST_PARSE_BYTES = 2 * 1024 * 1024;
@@ -5147,96 +5237,8 @@ var REPOSITORY_PROVIDER_RULES = Object.freeze([
 ]);
 var controls = new RegExp("\\p{Cc}", "u");
 
-// packages/shared/dist/projectIdentityFile.js
-import { lstat, readFile } from "node:fs/promises";
-import { join as join2 } from "node:path";
-var CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
-var isCanonicalUuid = (value) => typeof value === "string" && CANONICAL_UUID.test(value);
-var IDENTITY_KEYS = /* @__PURE__ */ new Set([
-  "schemaVersion",
-  "projectId",
-  "projectName",
-  "repositoryFingerprint"
-]);
-var FINGERPRINT_KEYS = /* @__PURE__ */ new Set(["algorithmVersion", "hash"]);
-function parseIdentityFile(text) {
-  let value;
-  try {
-    value = JSON.parse(text);
-  } catch (error) {
-    return { kind: "malformed", detail: `unparseable JSON: ${error.message}` };
-  }
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    return { kind: "malformed", detail: "identity file must contain a JSON object" };
-  }
-  const record = value;
-  if (record.schemaVersion !== 1) {
-    return { kind: "unknown_version", version: record.schemaVersion };
-  }
-  const unknownKey = Object.keys(record).find((key) => !IDENTITY_KEYS.has(key));
-  if (unknownKey)
-    return { kind: "malformed", detail: `unknown key "${unknownKey}"` };
-  if (!isCanonicalUuid(record.projectId)) {
-    return { kind: "malformed", detail: '"projectId" must be a canonical RFC 4122 UUID string' };
-  }
-  if ("projectName" in record && typeof record.projectName !== "string") {
-    return { kind: "malformed", detail: '"projectName" must be a string when present' };
-  }
-  if ("repositoryFingerprint" in record && (!record.repositoryFingerprint || typeof record.repositoryFingerprint !== "object" || Array.isArray(record.repositoryFingerprint))) {
-    return { kind: "malformed", detail: '"repositoryFingerprint" must be an object when present' };
-  }
-  const fingerprint = record.repositoryFingerprint;
-  const unknownFingerprintKey = fingerprint ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key)) : void 0;
-  if (unknownFingerprintKey) {
-    return {
-      kind: "malformed",
-      detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`
-    };
-  }
-  if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== "string")) {
-    return {
-      kind: "malformed",
-      detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash'
-    };
-  }
-  const repositoryFingerprint = fingerprint ? { algorithmVersion: 1, hash: fingerprint.hash } : void 0;
-  return {
-    kind: "ok",
-    identity: {
-      schemaVersion: 1,
-      projectId: record.projectId,
-      ...record.projectName === void 0 ? {} : { projectName: record.projectName },
-      ...repositoryFingerprint ? { repositoryFingerprint } : {}
-    }
-  };
-}
-async function readIdentityFile(dir, options = {}) {
-  const path = join2(dir, ".mnemonik.json");
-  try {
-    const stat = await lstat(path);
-    if (stat.isSymbolicLink())
-      return { kind: "malformed", detail: "symlink" };
-    if (!stat.isFile())
-      return { kind: "malformed", detail: "identity path is not a regular file" };
-    const text = await readFile(path, "utf8");
-    if (options.selectedRoot) {
-      try {
-        const value = JSON.parse(text);
-        if (value && typeof value === "object" && !Array.isArray(value) && !("projectId" in value) && (!("schemaVersion" in value) || value.schemaVersion === 1))
-          return { kind: "absent" };
-      } catch {
-      }
-    }
-    return parseIdentityFile(text);
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return { kind: "absent" };
-    return { kind: "malformed", detail: `cannot read identity file: ${error.message}` };
-  }
-}
-
 // packages/shared/dist/repositoryRoot.js
-import { lstat as lstat2, readFile as readFile2 } from "node:fs/promises";
+import { lstat as lstat2, readFile as readFile2, realpath } from "node:fs/promises";
 import { execFile } from "node:child_process";
 import { homedir } from "node:os";
 import { dirname as dirname2, join as join3, resolve } from "node:path";
@@ -5298,7 +5300,7 @@ async function confirmedBoundaryAt(path) {
 async function boundariesBetween(cwd, root) {
   const boundaries = [];
   let directory = cwd;
-  while (directory !== root) {
+  while (!samePath(directory, root)) {
     const boundary = await confirmedBoundaryAt(directory);
     if (boundary)
       boundaries.push(boundary);
@@ -5321,37 +5323,31 @@ async function containingRepository(root) {
     directory = parent;
   }
 }
-async function canonicalBoundaryRoot(boundary) {
-  if (boundary.kind === "directory")
-    return boundary.path;
-  const pointer = /^gitdir:\s*(.+)\s*$/im.exec(await readFile2(join3(boundary.path, ".git"), "utf8"))?.[1];
-  if (!pointer)
-    return boundary.path;
-  const gitDir = resolve(boundary.path, pointer);
-  try {
-    const commonDir = resolve(gitDir, (await readFile2(join3(gitDir, "commondir"), "utf8")).trim());
-    return dirname2(commonDir);
-  } catch (error) {
-    if (error.code === "ENOENT")
-      return boundary.path;
-    throw error;
-  }
+async function canonicalPath(path) {
+  const absolute = resolve(path);
+  return realpath(absolute).catch(() => absolute);
+}
+function samePath(left, right) {
+  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
 }
 async function resolveRepositoryRoot(cwd) {
-  const absoluteCwd = resolve(cwd);
+  const absoluteCwd = await canonicalPath(cwd);
   try {
     const { stdout } = await runGit(absoluteCwd, [
       "rev-parse",
       "--show-toplevel",
+      "--git-dir",
       "--git-common-dir"
     ]);
-    const [rootLine, commonLine, ...extra] = stdout.trim().split(/\r?\n/);
-    if (!rootLine || !commonLine || extra.length) {
+    const [rootLine, gitDirLine, commonLine, ...extra] = stdout.trim().split(/\r?\n/);
+    if (!rootLine || !gitDirLine || !commonLine || extra.length) {
       return { kind: "git_unavailable", detail: "git rev-parse returned an unexpected response" };
     }
-    const root = resolve(rootLine);
-    const commonDir = resolve(root, commonLine);
-    const isLinkedWorktree = commonDir !== join3(root, ".git");
+    const fromGit = (line) => canonicalPath(resolve(absoluteCwd, line));
+    const root = await fromGit(rootLine);
+    const gitDir = await fromGit(gitDirLine);
+    const commonDir = await fromGit(commonLine);
+    const isLinkedWorktree = !samePath(gitDir, commonDir);
     const nested = await boundariesBetween(absoluteCwd, root);
     if (!isLinkedWorktree && await containingRepository(root)) {
       const boundary = await boundaryAt(root);
@@ -5373,14 +5369,41 @@ async function resolveRepositoryRoot(cwd) {
     return { kind: "git_unavailable", detail: failure.message };
   }
 }
+async function linkedWorktreeCommonDir(dir) {
+  try {
+    if (!(await lstat2(join3(dir, ".git"))).isFile())
+      return void 0;
+    const pointer = /^gitdir:\s*(.+?)\s*$/im.exec(await readFile2(join3(dir, ".git"), "utf8"))?.[1];
+    if (!pointer)
+      return void 0;
+    const gitDir = resolve(dir, pointer);
+    const common = (await readFile2(join3(gitDir, "commondir"), "utf8")).trim();
+    return common ? await canonicalPath(resolve(gitDir, common)) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function mainCheckout(worktreeTop, commonDir) {
+  try {
+    const { stdout } = await runGit(worktreeTop, ["worktree", "list", "--porcelain"]);
+    const first = stdout.split(/\r?\n\r?\n/)[0] ?? "";
+    const path = /^worktree (.+)$/m.exec(first)?.[1];
+    if (path) {
+      const main = await canonicalPath(resolve(worktreeTop, path));
+      return /^bare$/m.test(first) ? dirname2(main) : main;
+    }
+  } catch {
+  }
+  return dirname2(commonDir);
+}
 async function readPlainIdentity(start2) {
-  const home = resolve(homedir());
+  const home = await canonicalPath(homedir());
   let directory = start2;
   while (true) {
-    const result = await readIdentityFile(directory);
+    const result = await readIdentityFile(directory, { configurationOnlyAbsent: true });
     if (result.kind !== "absent")
       return { root: directory, result };
-    if (directory === home)
+    if (samePath(directory, home))
       break;
     const parent = dirname2(directory);
     if (parent === directory)
@@ -5389,58 +5412,72 @@ async function readPlainIdentity(start2) {
   }
   return { root: start2, result: { kind: "absent" } };
 }
+async function nearestIdentity(start2) {
+  const home = await canonicalPath(homedir());
+  let directory = start2;
+  while (true) {
+    const commonDir = await linkedWorktreeCommonDir(directory);
+    if (commonDir)
+      return { worktreeTop: directory, commonDir };
+    const result = await readIdentityFile(directory, { configurationOnlyAbsent: true });
+    if (result.kind !== "absent")
+      return { root: directory, result };
+    if (samePath(directory, home))
+      return void 0;
+    const parent = dirname2(directory);
+    if (parent === directory)
+      return void 0;
+    directory = parent;
+  }
+}
+async function resolveNearestProjectIdentity(cwd) {
+  const start2 = await canonicalPath(cwd);
+  const resolved = await resolveRepositoryRoot(start2);
+  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: start2 } : resolved;
+  const nested = repository.kind === "git" ? repository.nested : [];
+  let found = await nearestIdentity(start2);
+  if (found && "worktreeTop" in found) {
+    found = await readPlainIdentity(await mainCheckout(found.worktreeTop, found.commonDir));
+  }
+  if (found) {
+    return shapedIdentity(found, await projectFolderRepository(found.root, repository), nested);
+  }
+  return { ...withBase(repository, repository.root, nested), kind: "absent" };
+}
+async function resolveNamedProjectIdentity(cwd, options) {
+  const start2 = await canonicalPath(cwd);
+  const resolved = await resolveRepositoryRoot(start2);
+  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: start2 } : resolved;
+  const commonDir = await linkedWorktreeCommonDir(start2);
+  const root = commonDir ? await mainCheckout(start2, commonDir) : start2;
+  return shapedIdentity({ root, result: await readIdentityFile(root, options) }, await projectFolderRepository(root, repository), repository.kind === "git" ? repository.nested : []);
+}
+function shapedIdentity(found, repository, nested) {
+  const base = withBase(repository, found.root, nested);
+  if (found.result.kind === "ok")
+    return { ...base, ...found.result };
+  if (found.result.kind === "unknown_version")
+    return { ...base, ...found.result, path: found.root };
+  if (found.result.kind === "malformed")
+    return { ...base, ...found.result, path: found.root };
+  return { ...base, kind: "absent" };
+}
+async function projectFolderRepository(projectRoot, known) {
+  if (known.kind === "git" && samePath(known.root, projectRoot))
+    return known;
+  const repository = await resolveRepositoryRoot(projectRoot);
+  if (repository.kind === "git" && samePath(repository.root, projectRoot))
+    return repository;
+  return { kind: "plain", root: projectRoot };
+}
 function withBase(repository, root, nested) {
   return { root, repository, nested };
 }
 async function resolveProjectIdentity(cwd, options = {}) {
-  const resolved = await resolveRepositoryRoot(cwd);
-  const repository = resolved.kind === "git_unavailable" ? { kind: "plain", root: resolve(cwd) } : resolved;
-  if (repository.kind === "plain") {
-    const { root, result } = options.selectedRoot ? { root: repository.root, result: await readIdentityFile(repository.root, options) } : await readPlainIdentity(repository.root);
-    const base2 = withBase(repository, root, []);
-    if (result.kind === "ok")
-      return { ...base2, ...result };
-    if (result.kind === "unknown_version")
-      return { ...base2, ...result, path: root };
-    if (result.kind === "malformed")
-      return { ...base2, ...result, path: root };
-    return { ...base2, kind: "absent" };
-  }
-  const ownRoot = repository.isLinkedWorktree ? dirname2(repository.commonDir) : repository.root;
-  const outer = repository.isLinkedWorktree ? void 0 : await containingRepository(repository.root);
-  const own = await readIdentityFile(ownRoot, options);
-  if (!outer || options.selectedRoot || own.kind === "ok") {
-    const base2 = withBase(repository, ownRoot, repository.nested);
-    if (own.kind === "ok")
-      return { ...base2, ...own };
-    if (own.kind === "unknown_version")
-      return { ...base2, ...own, path: ownRoot };
-    if (own.kind === "malformed")
-      return { ...base2, ...own, path: ownRoot };
-    return { ...base2, kind: "absent" };
-  }
-  const nested = repository.nested;
-  const parentRoot = await canonicalBoundaryRoot(outer);
-  const parent = await readIdentityFile(parentRoot);
-  const base = withBase(repository, parentRoot, nested);
-  if (own.kind === "unknown_version")
-    return { ...base, ...own, path: ownRoot };
-  if (own.kind === "malformed")
-    return { ...base, ...own, path: ownRoot };
-  if (parent.kind === "unknown_version")
-    return { ...base, ...parent, path: parentRoot };
-  if (parent.kind === "malformed")
-    return { ...base, ...parent, path: parentRoot };
-  if (!options.allowNestedInherit) {
-    return {
-      ...base,
-      kind: "nested",
-      ...parent.kind === "ok" ? { parentIdentity: parent.identity } : {}
-    };
+  if (options.selectedRoot || options.namedRoot) {
+    return resolveNamedProjectIdentity(cwd, { selectedRoot: options.selectedRoot });
   }
-  if (parent.kind === "ok")
-    return { ...base, kind: "ok", identity: parent.identity };
-  return { ...base, kind: "absent" };
+  return resolveNearestProjectIdentity(cwd);
 }
 
 // packages/shared/dist/apiOrigin.js