@mnemonik/scanner 5.151.0 → 5.151.2

package/src/index.ts

@@ -1,446 +0,0 @@
-#!/usr/bin/env node
-
-import { readFile, writeFile, unlink, mkdir, stat, chmod } from 'fs/promises';
-import { existsSync } from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
-import { ScannerDaemon } from './daemon.js';
-import { installFileLogging } from './fileLog.js';
-import { runDoctor } from './doctor.js';
-import { pidIsScanner } from './pid.js';
-
-const DEFAULT_SERVER = 'https://api.mnemonik.dev';
-const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]']);
-
-/**
- * Reject plaintext http:// server URLs except when talking to a local
- * daemon on the same machine (localhost/127.0.0.1/[::1]) — e.g. during
- * development against a locally-run server. Everything else must be https://
- * since the scanner pushes full file content (see O2/O8b,
- * codebase-indexing-audit-2026-07-02.md §5) and a plaintext channel would
- * expose that content (and the API key) to network eavesdropping.
- * Extracted as a pure function so the guard is unit-testable without
- * spinning up the CLI.
- */
-export function validateServerUrl(url: string): { valid: boolean; error?: string } {
-  let parsed: URL;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return { valid: false, error: `[mnemonik] Invalid --server URL: "${url}"` };
-  }
-  if (parsed.protocol !== 'https:' && !LOCAL_HOSTS.has(parsed.hostname)) {
-    return {
-      valid: false,
-      error:
-        `[mnemonik] Refusing insecure server URL "${url}".\n` +
-        '  Only https:// is allowed for --server, except for localhost/127.0.0.1/[::1]\n' +
-        '  (used for local development). Scanned file content and your API key would\n' +
-        '  otherwise be sent in plaintext.',
-    };
-  }
-  return { valid: true };
-}
-const MNEMONIK_DIR = join(homedir(), '.mnemonik');
-const PID_FILE = join(MNEMONIK_DIR, 'daemon.pid');
-const LOG_FILE = join(MNEMONIK_DIR, 'scanner.log');
-const CONFIG_FILE = join(MNEMONIK_DIR, 'scanner.json');
-const MAX_LOG_SIZE = 5 * 1024 * 1024; // 5MB
-
-interface ScannerConfig {
-  roots: string[];
-  apiKey?: string;
-  server?: string;
-  refreshIntervalMs?: number;
-}
-
-interface CliArgs {
-  command: 'start' | 'stop' | 'status' | 'log' | 'doctor' | 'help';
-  key?: string;
-  server?: string;
-  roots?: string[];
-}
-
-function parseCliArgs(): CliArgs {
-  const args = process.argv.slice(2);
-  const command = (args[0] ?? 'help') as CliArgs['command'];
-
-  if (!['start', 'stop', 'status', 'log', 'doctor', 'help'].includes(command)) {
-    return { command: 'help' };
-  }
-
-  let key: string | undefined;
-  let server: string | undefined;
-  let roots: string[] | undefined;
-
-  for (let i = 1; i < args.length; i++) {
-    if (args[i] === '--key' && args[i + 1]) key = args[++i]!;
-    else if (args[i] === '--server' && args[i + 1]) server = args[++i]!;
-    else if (args[i] === '--roots' && args[i + 1]) {
-      roots = args[++i]!.split(',').map((r) => r.trim());
-    }
-  }
-
-  return { command, key, server, roots };
-}
-
-async function readConfig(): Promise<ScannerConfig | null> {
-  try {
-    const raw = await readFile(CONFIG_FILE, 'utf-8');
-    return JSON.parse(raw) as ScannerConfig;
-  } catch {
-    return null;
-  }
-}
-
-async function writeConfig(config: ScannerConfig): Promise<void> {
-  await mkdir(MNEMONIK_DIR, { recursive: true });
-  await writeFile(CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 0o600 });
-}
-
-async function checkConfigPermissions(): Promise<void> {
-  try {
-    const s = await stat(CONFIG_FILE);
-    // Check if group or other have read/write permissions
-    const mode = s.mode & 0o077;
-    if (mode !== 0) {
-      console.warn(
-        `[mnemonik] WARNING: ${CONFIG_FILE} has overly permissive permissions (${(s.mode & 0o777).toString(8)}).`
-      );
-      console.warn(`[mnemonik] Fixing to 0600 (owner read/write only).`);
-      await chmod(CONFIG_FILE, 0o600);
-    }
-  } catch {
-    // Config file doesn't exist yet
-  }
-}
-
-async function acquireLock(retried = false): Promise<boolean> {
-  try {
-    const { open: fsOpen } = await import('fs/promises');
-    const { constants } = await import('fs');
-    const fd = await fsOpen(
-      PID_FILE,
-      constants.O_CREAT | constants.O_EXCL | constants.O_WRONLY,
-      0o644
-    );
-    await fd.writeFile(String(process.pid));
-    await fd.close();
-    return true;
-  } catch (err: unknown) {
-    if ((err as NodeJS.ErrnoException).code !== 'EEXIST') return false;
-
-    const existing = await readFile(PID_FILE, 'utf-8').catch(() => null);
-    if (existing) {
-      const pid = parseInt(existing.trim(), 10);
-      try {
-        process.kill(pid, 0);
-        // Alive is not enough — after PID reuse the number can belong to an
-        // unrelated process. Only an actual scanner holds the lock.
-        if (pidIsScanner(pid)) {
-          return false; // Process alive and is the scanner — lock is valid
-        }
-        // Live but foreign PID — treat as stale and reclaim below.
-      } catch {
-        // Holder is dead — remove stale lock and retry once
-      }
-    }
-    if (retried) return false;
-    await unlink(PID_FILE).catch(() => {});
-    return acquireLock(true);
-  }
-}
-
-async function releaseLock(): Promise<void> {
-  await unlink(PID_FILE).catch(() => {});
-}
-
-async function readPid(): Promise<number | null> {
-  try {
-    const raw = await readFile(PID_FILE, 'utf-8');
-    const pid = parseInt(raw.trim(), 10);
-    if (isNaN(pid)) return null;
-    // Check if process is actually alive
-    try {
-      process.kill(pid, 0);
-    } catch {
-      return null; // Stale PID
-    }
-    // Alive but foreign (PID reuse) is just as stale — never report it as
-    // the daemon, and never let handleStop() SIGTERM it.
-    if (!pidIsScanner(pid)) return null;
-    return pid;
-  } catch {
-    return null;
-  }
-}
-
-function printHelp(): void {
-  console.log(`
-mnemonik-scanner - Automatic codebase indexing daemon
-
-Usage:
-  mnemonik-scanner start [options]    Start the scanner daemon
-  mnemonik-scanner stop               Stop the running daemon
-  mnemonik-scanner status             Show daemon status
-  mnemonik-scanner log                Tail the scanner log file
-  mnemonik-scanner doctor             Check install health (drift detection)
-  mnemonik-scanner help               Show this help
-
-Options (for start):
-  --key <api-key>       API key (or set MNEMONIK_API_KEY env var)
-  --server <url>        Server URL (default: https://api.mnemonik.dev)
-  --roots <dirs>        Comma-separated directories to scan for projects
-
-Examples:
-  mnemonik-scanner start --key mnk_... --roots ~/Projects,~/work
-  mnemonik-scanner status
-  mnemonik-scanner stop
-
-Configuration is saved to ~/.mnemonik/scanner.json after first run.
-Subsequent starts use saved config (CLI args override).
-
-Environment variables:
-  MNEMONIK_API_KEY      API key (takes precedence over config file)
-`);
-}
-
-async function handleStart(cli: CliArgs): Promise<void> {
-  // Guardrail — this daemon is meant to run under the systemd user service
-  // (`systemctl --user start mnemonik-scanner`; see BUILD_AND_DEPLOY.md
-  // "Scanner daemon"). systemd sets INVOCATION_ID on processes it spawns. A
-  // manual foreground `start` attaches the daemon to the invoking shell: it
-  // dies when the shell exits and can spawn duplicate/stale daemons — the exact
-  // failure mode behind version skew and apparent "restart loops". If a unit
-  // exists but we were NOT launched by systemd, refuse (overridable).
-  if (!process.env.INVOCATION_ID && !process.env.MNEMONIK_SCANNER_FOREGROUND) {
-    const unitPath = join(homedir(), '.config/systemd/user/mnemonik-scanner.service');
-    if (existsSync(unitPath)) {
-      console.error(
-        '[mnemonik] A systemd unit already manages this scanner.\n' +
-          '  Start/restart it with:\n' +
-          '      systemctl --user restart mnemonik-scanner\n' +
-          '  Running `mnemonik-scanner start` by hand attaches the daemon to your shell — it\n' +
-          '  dies when the shell exits and can leave duplicate/stale daemons running (version\n' +
-          '  skew, apparent "restart loops"). To force a foreground run, set\n' +
-          '  MNEMONIK_SCANNER_FOREGROUND=1.'
-      );
-      process.exit(1);
-    }
-  }
-
-  const config = await readConfig();
-
-  // Resolve API key: env var > CLI > config
-  const apiKey = process.env.MNEMONIK_API_KEY || cli.key || config?.apiKey;
-  if (!apiKey) {
-    console.error(
-      '[mnemonik] Missing API key.\n' +
-        '  Use --key <api-key>, set MNEMONIK_API_KEY env var,\n' +
-        '  or run once with --key to save to config.'
-    );
-    process.exit(1);
-  }
-
-  const roots = cli.roots || config?.roots;
-  if (!roots || roots.length === 0) {
-    console.error(
-      '[mnemonik] No roots specified.\n' +
-        '  Use --roots ~/Projects,~/work to specify directories to scan.'
-    );
-    process.exit(1);
-  }
-
-  const server = cli.server || config?.server || DEFAULT_SERVER;
-  const serverUrlCheck = validateServerUrl(server);
-  if (!serverUrlCheck.valid) {
-    console.error(serverUrlCheck.error);
-    process.exit(1);
-  }
-
-  // Ensure directories exist
-  await mkdir(MNEMONIK_DIR, { recursive: true });
-
-  // Mirror all console output into scanner.log so `mnemonik-scanner log`
-  // reflects live activity regardless of supervisor. Under systemd, stdout is
-  // wired to the journal socket, not this file — without the tee the on-disk
-  // log goes stale and `log` shows nothing current. Install before any daemon
-  // output so the whole session is captured.
-  installFileLogging(LOG_FILE, MAX_LOG_SIZE);
-
-  // Save config for future runs (never save env var key to file)
-  const configToSave: ScannerConfig = {
-    roots,
-    server,
-    refreshIntervalMs: config?.refreshIntervalMs,
-  };
-  // Only save API key to config if it came from CLI (not env var)
-  if (cli.key) {
-    configToSave.apiKey = cli.key;
-  } else if (config?.apiKey && !process.env.MNEMONIK_API_KEY) {
-    configToSave.apiKey = config.apiKey;
-  }
-  await writeConfig(configToSave);
-  await checkConfigPermissions();
-
-  const locked = await acquireLock();
-  if (!locked) {
-    const pid = await readPid();
-    console.log(
-      `[mnemonik] Scanner daemon already running (PID ${pid}). Use 'mnemonik-scanner stop' first.`
-    );
-    process.exit(0);
-  }
-
-  const daemon = new ScannerDaemon({
-    serverUrl: server,
-    apiKey,
-    roots,
-    refreshIntervalMs: config?.refreshIntervalMs,
-  });
-
-  const shutdown = async () => {
-    console.log('\n[mnemonik] Shutting down...');
-    await daemon.stop();
-    await releaseLock();
-    process.exit(0);
-  };
-
-  process.on('SIGINT', shutdown);
-  process.on('SIGTERM', shutdown);
-  process.on('SIGHUP', shutdown); // Graceful restart — external tooling sends SIGHUP then relaunches
-
-  try {
-    await daemon.start();
-  } catch (err) {
-    console.error(`[mnemonik] ${(err as Error).message}`);
-    await releaseLock();
-    process.exit(1);
-  }
-}
-
-async function handleStop(): Promise<void> {
-  const pid = await readPid();
-  if (!pid) {
-    console.log('[mnemonik] Scanner daemon is not running.');
-    // Clean up stale PID file if it exists
-    await unlink(PID_FILE).catch(() => {});
-    return;
-  }
-
-  try {
-    process.kill(pid, 'SIGTERM');
-    console.log(`[mnemonik] Sent SIGTERM to daemon (PID ${pid}).`);
-
-    // Wait for process to exit (up to 5 seconds)
-    for (let i = 0; i < 50; i++) {
-      await new Promise((r) => setTimeout(r, 100));
-      try {
-        process.kill(pid, 0);
-      } catch {
-        console.log('[mnemonik] Daemon stopped.');
-        return;
-      }
-    }
-    console.warn('[mnemonik] Daemon did not exit within 5 seconds.');
-  } catch {
-    console.log('[mnemonik] Daemon process not found. Cleaning up PID file.');
-    await unlink(PID_FILE).catch(() => {});
-  }
-}
-
-async function handleStatus(): Promise<void> {
-  const pid = await readPid();
-  const config = await readConfig();
-
-  if (!pid) {
-    console.log('Status: not running');
-    if (config?.roots) {
-      console.log(`Configured roots: ${config.roots.join(', ')}`);
-    }
-    console.log(`\nStart with: mnemonik-scanner start`);
-    return;
-  }
-
-  console.log(`Status: running (PID ${pid})`);
-  if (config?.roots) {
-    console.log(`Roots: ${config.roots.join(', ')}`);
-  }
-  if (config?.server) {
-    console.log(`Server: ${config.server}`);
-  }
-
-  // Check for old per-project daemons
-  try {
-    const { readdir: readdirAsync } = await import('fs/promises');
-    const oldDaemonsDir = join(MNEMONIK_DIR, 'daemons');
-    const oldPidFiles = await readdirAsync(oldDaemonsDir).catch(() => []);
-    const staleOldDaemons: string[] = [];
-    for (const f of oldPidFiles) {
-      if (!f.endsWith('.pid')) continue;
-      const content = await readFile(join(oldDaemonsDir, f), 'utf-8').catch(() => null);
-      if (content) {
-        const oldPid = parseInt(content.trim(), 10);
-        try {
-          process.kill(oldPid, 0);
-          // Same PID-reuse guard as readPid(): only report genuinely live
-          // scanner processes, not whatever now occupies a recycled PID.
-          if (pidIsScanner(oldPid)) {
-            staleOldDaemons.push(`${f} (PID ${oldPid})`);
-          }
-        } catch {
-          // Dead process, just a stale file
-        }
-      }
-    }
-    if (staleOldDaemons.length > 0) {
-      console.log(`\nLegacy per-project daemons still running:`);
-      for (const d of staleOldDaemons) {
-        console.log(`  ${d}`);
-      }
-      console.log('  Consider stopping these — the global daemon handles all projects.');
-    }
-  } catch {
-    // Old daemons dir doesn't exist
-  }
-}
-
-async function handleLog(): Promise<void> {
-  try {
-    const content = await readFile(LOG_FILE, 'utf-8');
-    // Show last 50 lines
-    const lines = content.split('\n');
-    const tail = lines.slice(-50).join('\n');
-    console.log(tail);
-  } catch {
-    console.log('[mnemonik] No log file found at', LOG_FILE);
-  }
-}
-
-async function main(): Promise<void> {
-  const cli = parseCliArgs();
-
-  switch (cli.command) {
-    case 'start':
-      await handleStart(cli);
-      break;
-    case 'stop':
-      await handleStop();
-      break;
-    case 'status':
-      await handleStatus();
-      break;
-    case 'log':
-      await handleLog();
-      break;
-    case 'doctor':
-      await runDoctor();
-      break;
-    case 'help':
-    default:
-      printHelp();
-      break;
-  }
-}
-
-main();

package/src/pid.ts

@@ -1,37 +0,0 @@
-import { execFileSync } from 'child_process';
-import { readFileSync } from 'fs';
-
-/**
- * PID-reuse guard shared by the CLI lock paths (index.ts) and doctor.
- *
- * `process.kill(pid, 0)` only proves that *some* process is alive at that
- * PID, not that it is ours. After a reboot or plain PID recycling the number
- * in daemon.pid can belong to an unrelated process — SIGTERMing it from
- * `stop`, or refusing to `start` because of it, would be wrong. So a live PID
- * only counts as the scanner when its command line matches the daemon's
- * signature (same pattern doctor uses to find daemon processes via `ps`).
- */
-const SCANNER_CMD_PATTERN = /(mnemonik-scanner|scanner\/dist\/index\.js)/;
-
-function processCmdline(pid: number): string | null {
-  // Linux: /proc/<pid>/cmdline is NUL-separated argv — cheap and exact.
-  try {
-    return readFileSync(`/proc/${pid}/cmdline`, 'utf-8').replace(/\0/g, ' ');
-  } catch {
-    // /proc unavailable (macOS) or unreadable — fall back to ps below.
-  }
-  try {
-    return execFileSync('ps', ['-o', 'args=', '-p', String(pid)], {
-      encoding: 'utf-8',
-      stdio: ['ignore', 'pipe', 'ignore'],
-      timeout: 5000,
-    }).trim();
-  } catch {
-    return null; // No such process, or ps unavailable — cannot confirm identity.
-  }
-}
-
-export function pidIsScanner(pid: number): boolean {
-  const cmdline = processCmdline(pid);
-  return cmdline !== null && SCANNER_CMD_PATTERN.test(cmdline);
-}

package/src/watcher.ts

@@ -1,219 +0,0 @@
-import { watch, type FSWatcher } from 'fs';
-import { join, relative } from 'path';
-import { readdir, stat } from 'fs/promises';
-import { isGitBoundary } from '@mnemonik/shared';
-
-const SKIP_DIRS = new Set([
-  'node_modules',
-  '.git',
-  'dist',
-  'build',
-  '.next',
-  '.nuxt',
-  '.output',
-  '__pycache__',
-  '.venv',
-  'venv',
-  '.tox',
-  'target',
-  '.cache',
-  'coverage',
-  '.turbo',
-  '.vercel',
-  '.svelte-kit',
-]);
-
-export type ChangeHandler = (changedFiles: string[]) => void;
-export type ErrorHandler = (err: Error) => void;
-
-export class FileWatcher {
-  // Keyed by directory so a watcher can be closed and re-attached when the
-  // directory is deleted and recreated at the same path.
-  private watchers = new Map<string, FSWatcher>();
-  private watchedDirs = new Set<string>();
-  // Inode per watched directory: a delete+recreate faster than the delete
-  // event's stat() presents as "directory exists and is already watched",
-  // but the live watcher is bound to the OLD inode and is inert. Comparing
-  // inodes at event time detects the swap so the subtree can re-attach.
-  private watchedDirInodes = new Map<string, number>();
-  private pendingFiles = new Set<string>();
-  private flushTimer: ReturnType<typeof setTimeout> | null = null;
-  private debounceMs: number;
-  private onError: ErrorHandler | undefined;
-
-  constructor(
-    private rootPath: string,
-    private onChange: ChangeHandler,
-    debounceMs = 500,
-    onError?: ErrorHandler
-  ) {
-    this.debounceMs = debounceMs;
-    this.onError = onError;
-  }
-
-  async start(): Promise<void> {
-    await this.watchDir(this.rootPath);
-    console.log(`[scanner] Watching ${this.rootPath} for changes`);
-  }
-
-  stop(): void {
-    for (const w of this.watchers.values()) {
-      w.close();
-    }
-    this.watchers.clear();
-    this.watchedDirs.clear();
-    this.watchedDirInodes.clear();
-    if (this.flushTimer) {
-      clearTimeout(this.flushTimer);
-      this.flushTimer = null;
-    }
-    this.pendingFiles.clear();
-  }
-
-  private scheduleFlush(): void {
-    if (this.flushTimer) clearTimeout(this.flushTimer);
-    this.flushTimer = setTimeout(() => {
-      this.flushTimer = null;
-      if (this.pendingFiles.size === 0) return;
-      const batch = [...this.pendingFiles];
-      this.pendingFiles.clear();
-      this.onChange(batch);
-    }, this.debounceMs);
-  }
-
-  private async watchDir(dir: string): Promise<void> {
-    const dirName = dir.split('/').pop() ?? '';
-    if (SKIP_DIRS.has(dirName)) return;
-    // Dedup guard — the change callback re-enters watchDir for new
-    // subdirectories, and a rapid create/rename burst can resolve the same
-    // path twice before the first watch is registered.
-    if (this.watchedDirs.has(dir)) return;
-    this.watchedDirs.add(dir);
-
-    try {
-      // Record the inode BEFORE attaching so watchNewDir can distinguish a
-      // benign event on this directory from a recreate-at-same-path.
-      this.watchedDirInodes.set(dir, (await stat(dir)).ino);
-      const watcher = watch(dir, { persistent: true }, (event, filename) => {
-        if (!filename) return;
-        const fullPath = join(dir, filename);
-        const relPath = relative(this.rootPath, fullPath);
-        this.pendingFiles.add(relPath);
-        this.scheduleFlush();
-        // fs.watch is non-recursive: the initial recursion below only covers
-        // directories that existed at start(). When this event is a newly
-        // created directory, attach a watcher to it too — otherwise the
-        // subtree is a permanent blind spot until restart. Fire-and-forget;
-        // watchNewDir no-ops for plain files, skip dirs, git boundaries, and
-        // already-watched paths.
-        void this.watchNewDir(fullPath, event);
-      });
-
-      watcher.on('error', (err) => {
-        console.warn(`[scanner] Watcher error for ${dir}:`, err.message);
-        if (dir === this.rootPath && this.onError) {
-          this.onError(err);
-        }
-      });
-
-      this.watchers.set(dir, watcher);
-
-      const entries = await readdir(dir, { withFileTypes: true });
-      for (const entry of entries) {
-        if (entry.isDirectory() && !SKIP_DIRS.has(entry.name)) {
-          const child = join(dir, entry.name);
-          // Nested-git-boundary rule (see @mnemonik/shared isGitBoundary):
-          // linked worktrees / nested clones are other repositories — don't
-          // watch their subtrees as part of this project.
-          if (await isGitBoundary(child)) continue;
-          await this.watchDir(child);
-        }
-      }
-    } catch (err) {
-      // Watch registration failed. Never fatal for the subtree's parent, but
-      // the *reason* matters: inotify/fd limit exhaustion means silently
-      // growing blind spots, while permission-denied is a benign property of
-      // the directory itself. Drop the bookkeeping (and any watcher that did
-      // attach before the failure) so a later retry can re-enter cleanly.
-      this.watchedDirs.delete(dir);
-      this.watchedDirInodes.delete(dir);
-      const stale = this.watchers.get(dir);
-      if (stale) {
-        stale.close();
-        this.watchers.delete(dir);
-      }
-      const code = (err as NodeJS.ErrnoException).code;
-      if (code === 'ENOSPC' || code === 'EMFILE' || code === 'ENFILE') {
-        console.warn(
-          `[scanner] Watch limit reached (${code}) — subtree unwatched: ${dir}. ` +
-            'Raise fs.inotify.max_user_watches or trim scanner roots.'
-        );
-        // Surface to the daemon only for the root — losing the root means the
-        // whole project is blind; a subtree gap must not tear the project down
-        // (the daemon's onError removes the project entirely).
-        if (dir === this.rootPath && this.onError) {
-          this.onError(err as Error);
-        }
-      } else {
-        // Permission denied or inaccessible directory
-        console.warn(`[scanner] Cannot watch ${dir}: ${(err as Error).message}`);
-      }
-    }
-  }
-
-  /**
-   * Attach a watcher to a directory created after start(). Called from the
-   * per-directory change callback with every event path; stats the path and
-   * only recurses when it is a genuinely new, watchable directory.
-   */
-  private async watchNewDir(fullPath: string, eventType: string): Promise<void> {
-    try {
-      // Stat before the dedup check: a delete event arrives with the same
-      // path as the original create, and the stale watchedDirs entry must
-      // not short-circuit the vanish detection below.
-      const s = await stat(fullPath);
-      if (!s.isDirectory()) return;
-      if (this.watchedDirs.has(fullPath)) {
-        // Already watched — but a delete+recreate faster than this stat
-        // presents exactly like this, with the live watcher bound to the
-        // OLD (dead) inode and inert. A 'rename' event means the entry's
-        // identity changed (created / deleted / moved), so re-attach
-        // unconditionally — comparing inodes is NOT sufficient there
-        // because ext4 routinely hands the freed inode straight back to
-        // the recreated directory. 'change' events are attrib noise (a
-        // write inside the child bumps its mtime, which fires on the
-        // parent), so the cheap inode check keeps those churn-free.
-        if (eventType !== 'rename' && this.watchedDirInodes.get(fullPath) === s.ino) return;
-        this.unwatchSubtree(fullPath);
-      }
-      if (await isGitBoundary(fullPath)) return;
-      await this.watchDir(fullPath);
-    } catch {
-      // Path vanished between event and stat. If it (or anything under it)
-      // was a watched directory, drop the bookkeeping and close the dead
-      // watchers — otherwise the dedup guards in watchDir/watchNewDir block
-      // re-attachment forever when the path is recreated (build-output
-      // wipes, codegen, rm -rf && mkdir).
-      this.unwatchSubtree(fullPath);
-    }
-  }
-
-  /**
-   * Forget a deleted directory and everything watched beneath it. fs.watch
-   * emits no per-descendant events on a recursive delete, so the whole
-   * prefix must be purged here for a recreate to re-watch the full subtree.
-   */
-  private unwatchSubtree(root: string): void {
-    const prefix = root + '/';
-    for (const dir of this.watchedDirs) {
-      if (dir !== root && !dir.startsWith(prefix)) continue;
-      this.watchedDirs.delete(dir);
-      this.watchedDirInodes.delete(dir);
-      const w = this.watchers.get(dir);
-      if (w) {
-        w.close();
-        this.watchers.delete(dir);
-      }
-    }
-  }
-}