@popoverinstall/cli 0.5.0 → 0.6.1

package/dist/snapshot.js

@@ -0,0 +1,828 @@
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { hostname } from "node:os";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import path from "node:path";
+import { MAX_CIPHERTEXT_BYTES, MAX_TRANSCRIPT_BYTES, SNAPSHOT_FORMAT_VERSION, claudeHome, collectPathRoots, defaultApiUrl, encodeProjectDirName, forkCodeLookupHash, loadCredentials, materializeTranscript, normalizeForkCode, normalizeRemote, openSnapshot, parseTranscript, popoverHome, randomForkCode, repoKeysOverlap, sanitizeTranscript, sealSnapshot, } from "@popoverinstall/shared";
+import { MIN_CLAUDE_VERSION, claudeVersion, versionAtLeast } from "./doctor.js";
+import { openInNewTerminal, claudeResumeCommand, writeLauncherScript } from "./terminal.js";
+import { bad, c, dim, info, ok, warn } from "./ui.js";
+/**
+ * `popover fork` — hand someone a conversation they can carry on.
+ *
+ * Not the ask-fork. `packages/shared/src/fork.ts` builds the ephemeral, read-only
+ * `claude -p --resume --fork-session` that answers one teammate's question on the owner's
+ * machine and is never persisted. This creates a durable copy of a conversation that leaves
+ * the machine and becomes someone else's own local session.
+ *
+ * The empirical basis for the transcript handling is docs/phase1-snapshot-spike.md.
+ */
+/**
+ * How long a staged fork survives before being swept.
+ *
+ * Short on purpose, and shorter than the code's own 24 hours. A staged fork is a decrypted
+ * conversation sitting in a file, which is the one moment in this feature where plaintext is
+ * at rest on a machine that did not author it. Staging exists only to bridge `open` and the
+ * confirmation that follows it, so an hour is already generous — and the code can simply be
+ * opened again.
+ */
+const STAGE_TTL_MS = 60 * 60 * 1000;
+export async function forkCommand(rest) {
+    const sub = rest[0] ?? "help";
+    const args = rest.slice(1);
+    switch (sub) {
+        case "create":
+            return create(args);
+        case "open":
+            return open(args);
+        case "launch":
+            return launch(args);
+        case "list":
+            return list();
+        case "revoke":
+            return revoke(args);
+        default:
+            if (sub !== "help")
+                bad(`Unknown fork command: ${sub}`);
+            forkUsage();
+            return sub === "help" ? 0 : 1;
+    }
+}
+function forkUsage() {
+    console.log(`
+${c.bold("popover fork")} — share a conversation, or open one you were sent
+
+  ${c.bold("popover fork create")}          Freeze this conversation and print a code (24h)
+  ${c.bold("popover fork open")} <code>     Fetch a fork and stage it
+  ${c.bold("popover fork launch")} <id>     Start the staged fork in a new window
+  ${c.bold("popover fork list")}            Codes you have handed out from this machine
+  ${c.bold("popover fork revoke")} <code>   Destroy a snapshot before it expires
+
+  Inside Claude Code, ${c.cyan("/popover:fork create")} and ${c.cyan("/popover:fork open <code>")} do the same
+  thing and know which session you are in.
+`);
+}
+// ---------------------------------------------------------------------------
+// create
+// ---------------------------------------------------------------------------
+async function create(args) {
+    const asJson = args.includes("--json");
+    const sessionId = flag(args, "--session") ??
+        process.env["CLAUDE_SESSION_ID"] ??
+        process.env["CLAUDE_CODE_SESSION_ID"];
+    if (!sessionId) {
+        return fail(asJson, "no_session", "There is no session here to fork.", [
+            "Run /popover:fork create inside Claude Code, which knows which session you are in,",
+            "or pass one explicitly with --session <id>.",
+        ]);
+    }
+    const credentials = loadCredentials();
+    if (!credentials) {
+        return fail(asJson, "not_signed_in", "This machine is not signed in.", [
+            "Run `popover login` first. Opening a fork needs no account; sharing one does.",
+        ]);
+    }
+    const transcriptPath = findTranscript(sessionId);
+    if (!transcriptPath) {
+        return fail(asJson, "no_transcript", "That session has no transcript on disk.", [
+            "A brand-new session may not have been written yet, and CLAUDE_CODE_SKIP_PROMPT_HISTORY",
+            "turns transcript writing off entirely. There is nothing to share either way.",
+        ]);
+    }
+    // The transcript is written asynchronously and lags the live conversation, so wait for it
+    // to stop moving. It can still miss a turn that is in flight; `lastTurnAt` below is what
+    // tells the sharer where the cut actually landed.
+    await settle(transcriptPath);
+    const size = statSync(transcriptPath).size;
+    if (size > MAX_TRANSCRIPT_BYTES) {
+        return fail(asJson, "too_large", `That conversation is ${mb(size)} MB, over the ${mb(MAX_TRANSCRIPT_BYTES)} MB limit.`, ["Run /compact first, then fork the compacted session."]);
+    }
+    const parsed = parseTranscript(readFileSync(transcriptPath, "utf8"));
+    const { entries, dropped } = sanitizeTranscript(parsed);
+    if (entries.length === 0) {
+        return fail(asJson, "empty", "There is nothing in this conversation to share yet.", []);
+    }
+    // `defaultApiUrl()` rather than `credentials.api_url` directly, so POPOVER_API_URL points
+    // this at a preview deployment the same way it does `open` and `revoke`. It still falls
+    // back to the origin this machine signed in to. The device token comes from credentials
+    // either way — a preview shares the backing database, so the same token authenticates.
+    const apiUrl = defaultApiUrl();
+    const repo = readRepo(process.cwd());
+    const envelope = {
+        formatVersion: SNAPSHOT_FORMAT_VERSION,
+        createdAt: new Date().toISOString(),
+        entryCount: entries.length,
+        transcript: entries.map((e) => JSON.stringify(e)).join("\n") + "\n",
+        repoRemotes: repo.keys,
+        // Collected from the transcript, plus git's answer and this process's own, because the
+        // three can spell the same directory differently when a symlink is involved.
+        pathRoots: [
+            ...new Set([...collectPathRoots(entries), ...(repo.root ? [repo.root] : []), process.cwd()]),
+        ],
+        ...optional("lastTurnAt", lastTimestamp(entries)),
+        ...optional("claudeVersion", (await claudeVersion()) ?? undefined),
+        ...optional("sharedBy", await resolveSharerName(apiUrl, credentials)),
+        ...optional("title", readTitle(parsed)),
+        ...optional("repoName", repo.name),
+        ...optional("gitBranch", repo.branch),
+        ...optional("repoRoot", repo.root),
+        cwd: process.cwd(),
+    };
+    const code = randomForkCode();
+    const ciphertext = sealSnapshot(envelope, code);
+    if (ciphertext.length > MAX_CIPHERTEXT_BYTES) {
+        return fail(asJson, "too_large", "That conversation is too large to send even compressed.", ["Run /compact first, then fork the compacted session."]);
+    }
+    let created;
+    try {
+        const result = await storeCreate(apiUrl, credentials.device_token, forkCodeLookupHash(code), ciphertext);
+        if (!result.ok) {
+            if (result.status === 401 && result.ours) {
+                return fail(asJson, "not_signed_in", "This machine is no longer authorized.", [
+                    "It may have been revoked from the dashboard. Run `popover login` again.",
+                ]);
+            }
+            if (!result.ours) {
+                return fail(asJson, "blocked", `Something in front of ${apiUrl} refused the request (${result.status}).`, [
+                    "That answer did not come from popover. A protected preview deployment, an SSO",
+                    "proxy, or a captive portal will do this. Check the URL is reachable in a browser.",
+                ]);
+            }
+            if (result.status === 409) {
+                // 2^77 codes, so this is not luck: the same request arrived twice. Worth naming,
+                // because "409" on its own is impossible to act on.
+                return fail(asJson, "code_taken", "That code already exists on the server.", [
+                    "Nothing was overwritten. Run the command again for a new code.",
+                ]);
+            }
+            return fail(asJson, "server", `The server refused the snapshot (${result.status}).`, []);
+        }
+        created = { id: result.id, expires_at: result.expires_at };
+    }
+    catch (err) {
+        return fail(asJson, "unreachable", `Could not reach ${apiUrl}.`, [
+            err instanceof Error ? err.message : String(err),
+        ]);
+    }
+    recordCreated({
+        id: created.id,
+        code,
+        createdAt: envelope.createdAt,
+        expiresAt: created.expires_at,
+        repoName: repo.name,
+        entryCount: entries.length,
+    });
+    if (asJson) {
+        console.log(JSON.stringify({
+            ok: true,
+            code,
+            id: created.id,
+            expires_at: created.expires_at,
+            entry_count: entries.length,
+            dropped,
+            last_turn_at: envelope.lastTurnAt ?? null,
+            repo: repo.name ?? null,
+            open_command: `popover fork open ${code}`,
+            npx_command: `npx @popoverinstall/cli fork open ${code}`,
+        }));
+        return 0;
+    }
+    console.log("");
+    ok(`Forked ${entries.length} messages from this conversation.`);
+    console.log("");
+    console.log(`      ${c.bold(c.cyan(code))}`);
+    console.log("");
+    info("Send that to whoever should carry it on. They run:");
+    dim(`  popover fork open ${code}`);
+    dim(`  npx @popoverinstall/cli fork open ${code}    (if they have no popover yet)`);
+    console.log("");
+    dim("The code stops working in 24 hours. Their chat does not — once opened it is theirs.");
+    dim(`Frozen at your last completed turn (${friendlyTime(envelope.lastTurnAt ?? envelope.createdAt)}). Nothing you say from here is included.`);
+    console.log("");
+    warn("This sends the whole conversation, including everything your agent read into it.");
+    dim("Anyone you give the code to can pass it on. `popover fork revoke` destroys it.");
+    console.log("");
+    return 0;
+}
+// ---------------------------------------------------------------------------
+// open
+// ---------------------------------------------------------------------------
+async function open(args) {
+    const asJson = args.includes("--json");
+    const raw = args.find((a) => !a.startsWith("--"));
+    const code = raw ? normalizeForkCode(raw) : undefined;
+    if (!code) {
+        return fail(asJson, "bad_code", "That does not look like a fork code.", [
+            "A code is 16 characters in four groups, like PQRS-2345-BCDF-7892.",
+        ]);
+    }
+    const apiUrl = defaultApiUrl();
+    let payload;
+    try {
+        const result = await storeRedeem(apiUrl, forkCodeLookupHash(code));
+        if (!result.ok) {
+            if (result.status === 404) {
+                // Expired, revoked, never existed, mistyped — the server cannot tell these apart on
+                // purpose, and neither can we.
+                return fail(asJson, "not_found", "That code does not open anything.", [
+                    "It may have expired, been revoked, or been mistyped. Codes last 24 hours.",
+                ]);
+            }
+            return fail(asJson, "server", `The server refused the code (${result.status}).`, []);
+        }
+        payload = result.snapshot;
+    }
+    catch (err) {
+        return fail(asJson, "unreachable", `Could not reach ${apiUrl}.`, [
+            err instanceof Error ? err.message : String(err),
+        ]);
+    }
+    let envelope;
+    try {
+        envelope = openSnapshot(payload.ciphertext ?? "", code);
+    }
+    catch (err) {
+        return fail(asJson, "unreadable", err instanceof Error ? err.message : String(err), []);
+    }
+    const here = readRepo(process.cwd());
+    const repoMatch = matchRepo(envelope, here);
+    const targetCwd = repoMatch === "same" && here.root ? here.root : process.cwd();
+    const local = await claudeVersion();
+    const claudeProblem = !local
+        ? "Claude Code is not on your PATH, so there is nothing to open the fork in."
+        : !versionAtLeast(local, MIN_CLAUDE_VERSION)
+            ? `Claude Code ${local} is older than ${MIN_CLAUDE_VERSION.join(".")}, which popover needs.`
+            : undefined;
+    const stageId = randomUUID();
+    sweepStages();
+    writeFileSync(stagePath(stageId), `${JSON.stringify({
+        stagedAt: new Date().toISOString(),
+        snapshotId: payload.id,
+        targetCwd,
+        gitBranch: here.branch ?? null,
+        repoMatch,
+        envelope,
+    })}\n`, { mode: 0o600 });
+    const skew = envelope.claudeVersion && local && majorMinor(envelope.claudeVersion) !== majorMinor(local)
+        ? `Made on Claude Code ${envelope.claudeVersion}; you are on ${local}.`
+        : undefined;
+    if (asJson) {
+        console.log(JSON.stringify({
+            ok: true,
+            stage_id: stageId,
+            shared_by: envelope.sharedBy ?? null,
+            title: envelope.title ?? null,
+            repo: envelope.repoName ?? null,
+            git_branch: envelope.gitBranch ?? null,
+            entry_count: envelope.entryCount,
+            frozen_at: envelope.lastTurnAt ?? envelope.createdAt,
+            repo_match: repoMatch,
+            target_cwd: targetCwd,
+            version_skew: skew ?? null,
+            claude_problem: claudeProblem ?? null,
+            launch_command: `popover fork launch ${stageId}`,
+        }));
+        return claudeProblem ? 1 : 0;
+    }
+    console.log("");
+    ok(`Fork ready${envelope.sharedBy ? ` from ${envelope.sharedBy}` : ""}.`);
+    if (envelope.title)
+        info(envelope.title);
+    info(`${envelope.entryCount} messages, frozen ${friendlyTime(envelope.lastTurnAt ?? envelope.createdAt)}` +
+        (envelope.repoName ? ` in ${envelope.repoName}` : ""));
+    if (repoMatch === "different") {
+        console.log("");
+        warn(`This came from ${envelope.repoName ?? "another repo"}, and you are in ${here.name ?? "a different one"}.`);
+        dim("The conversation will refer to files you may not have. You can still open it.");
+    }
+    else if (repoMatch === "unknown") {
+        console.log("");
+        warn("You are not in a git repository, so file paths in it may not resolve here.");
+    }
+    if (skew)
+        dim(skew);
+    if (claudeProblem) {
+        console.log("");
+        bad(claudeProblem);
+        return 1;
+    }
+    console.log("");
+    info("Open it in a new window with:");
+    dim(`  popover fork launch ${stageId}`);
+    dim(`  popover fork launch ${stageId} --here    (in this terminal instead)`);
+    console.log("");
+    return 0;
+}
+// ---------------------------------------------------------------------------
+// launch
+// ---------------------------------------------------------------------------
+async function launch(args) {
+    const asJson = args.includes("--json");
+    const here = args.includes("--here");
+    const stageId = args.find((a) => !a.startsWith("--"));
+    if (!stageId || !existsSync(stagePath(stageId))) {
+        return fail(asJson, "no_stage", "There is no staged fork with that id.", [
+            "Run `popover fork open <code>` first. Staged forks are cleared after 24 hours.",
+        ]);
+    }
+    const staged = JSON.parse(readFileSync(stagePath(stageId), "utf8"));
+    const envelope = staged.envelope;
+    // Before writing this run's launcher, not after: sweeping afterwards would race the
+    // terminal that has just been asked to read it.
+    sweepStages();
+    // A fresh id every time, and never the sharer's. Claude Code resolves `--resume <id>`
+    // across every project on the machine, and refuses outright when two of them hold the
+    // same id — so a reused id would strand the recipient, and reusing the *sharer's* id
+    // would collide with their live session if they ever opened their own fork.
+    let sessionId = randomUUID();
+    for (let attempt = 0; sessionIdExists(sessionId); attempt += 1) {
+        if (attempt > 8) {
+            return fail(asJson, "collision", "Could not find an unused session id.", []);
+        }
+        sessionId = randomUUID();
+    }
+    const projectDir = path.join(claudeHome(), "projects", encodeProjectDirName(staged.targetCwd));
+    mkdirSync(projectDir, { recursive: true });
+    const transcriptPath = path.join(projectDir, `${sessionId}.jsonl`);
+    writeFileSync(transcriptPath, materializeTranscript(parseTranscript(envelope.transcript), {
+        sessionId,
+        cwd: staged.targetCwd,
+        ...optional("gitBranch", staged.gitBranch ?? undefined),
+        fromRoots: envelope.pathRoots,
+        toRoot: staged.targetCwd,
+    }));
+    const name = envelope.sharedBy
+        ? `fork-from-${envelope.sharedBy.split(/\s+/)[0]?.toLowerCase().replace(/[^a-z0-9-]/g, "") || "teammate"}`
+        : "fork";
+    const options = {
+        cwd: staged.targetCwd,
+        sessionId,
+        name,
+        banner: [
+            `popover — a fork${envelope.sharedBy ? ` from ${envelope.sharedBy}` : ""}`,
+            `${envelope.entryCount} messages, frozen ${friendlyTime(envelope.lastTurnAt ?? envelope.createdAt)}.`,
+            "This is your own copy. Nothing you do here reaches the person who shared it.",
+        ],
+    };
+    const command = claudeResumeCommand(options, process.env).join(" ");
+    if (here) {
+        rmSync(stagePath(stageId), { force: true });
+        if (asJson) {
+            console.log(JSON.stringify({ ok: true, session_id: sessionId, command, opened: false }));
+            return 0;
+        }
+        ok("Fork written. Start it with:");
+        console.log("");
+        console.log(`      ${c.bold(c.cyan(command))}`);
+        console.log("");
+        dim(`in ${staged.targetCwd}`);
+        return 0;
+    }
+    const script = writeLauncherScript(forksDir(), options, process.platform, process.env);
+    const outcome = openInNewTerminal(script);
+    rmSync(stagePath(stageId), { force: true });
+    if (asJson) {
+        console.log(JSON.stringify({
+            ok: true,
+            session_id: sessionId,
+            command,
+            cwd: staged.targetCwd,
+            opened: outcome.ok,
+            via: outcome.via ?? null,
+            reason: outcome.reason ?? null,
+        }));
+        return 0;
+    }
+    console.log("");
+    if (outcome.ok) {
+        ok(`Opened the fork in ${outcome.via}.`);
+        dim(`If the window did not appear, run: ${command}`);
+    }
+    else {
+        // Not an error. Over SSH or in a container there is no window to open, and the command
+        // is the whole answer.
+        warn(`Could not open a new window (${outcome.reason}).`);
+        console.log("");
+        info(`Run this in ${staged.targetCwd}:`);
+        console.log("");
+        console.log(`      ${c.bold(c.cyan(command))}`);
+    }
+    console.log("");
+    return 0;
+}
+/**
+ * Kept on this machine rather than asked of the server.
+ *
+ * The server holds no readable record of what a snapshot is — no repo, no title, no code —
+ * which is the point of the design, so there is nothing there to list. It also means a
+ * `--json` roster of your own forks can never become a way to enumerate anyone else's.
+ */
+function list() {
+    const records = readCreated();
+    if (records.length === 0) {
+        info("You have not shared any forks from this machine.");
+        dim("Run /popover:fork create inside Claude Code to share one.");
+        return 0;
+    }
+    console.log("");
+    for (const r of records.slice(-20)) {
+        const expired = Date.parse(r.expiresAt) < Date.now();
+        const state = r.revokedAt ? c.dim("revoked") : expired ? c.dim("expired") : c.green("live");
+        console.log(`  ${c.bold(r.code)}  ${state.padEnd(18)} ${c.dim(`${r.entryCount} messages${r.repoName ? `, ${r.repoName}` : ""}, ${friendlyTime(r.createdAt)}`)}`);
+    }
+    console.log("");
+    dim("A live code can still be opened by anyone holding it. `popover fork revoke <code>`");
+    dim("destroys the snapshot — but not a copy someone has already opened.");
+    console.log("");
+    return 0;
+}
+async function revoke(args) {
+    const raw = args.find((a) => !a.startsWith("--"));
+    const code = raw ? normalizeForkCode(raw) : undefined;
+    if (!code) {
+        bad("That does not look like a fork code.");
+        dim("A code is 16 characters in four groups, like PQRS-2345-BCDF-7892.");
+        return 1;
+    }
+    const apiUrl = defaultApiUrl();
+    let opens = null;
+    try {
+        const result = await storeRevoke(apiUrl, forkCodeLookupHash(code));
+        if (!result.ok) {
+            bad(`The server refused the request (${result.status}).`);
+            return 1;
+        }
+        opens = result.opens;
+    }
+    catch (err) {
+        bad(`Could not reach ${apiUrl}: ${err instanceof Error ? err.message : String(err)}`);
+        return 1;
+    }
+    markRevoked(code);
+    ok("That code opens nothing now, and the snapshot is destroyed.");
+    if (opens && opens > 0) {
+        // Said plainly rather than left to be discovered. Revoking cannot reach a copy that is
+        // already on someone else's machine, and implying otherwise would be worse than useless.
+        warn(`It had already been opened ${opens === 1 ? "once" : `${opens} times`}.`);
+        dim("Those copies are local to whoever opened them and cannot be recalled.");
+    }
+    return 0;
+}
+/**
+ * Who a fork says it came from.
+ *
+ * `credentials.display_name` cannot be it on its own: `popover login` writes that field as
+ * the empty string and nothing ever fills it in, so every fork would arrive from nobody.
+ * The real name lives in `profiles`, and the snapshot is sealed on this machine before it is
+ * sent, so the server can never add it afterwards — it has to be resolved first.
+ *
+ * `/api/device/session` is the daemon's existing token exchange and already authenticates
+ * exactly this machine, so the name is carried there rather than on a route of its own.
+ * Failure is not an error: a fork from an unnamed teammate is worth far more than no fork,
+ * so this falls back to the credentials copy, then to the hostname, then to nothing at all,
+ * and never delays a create by more than a moment.
+ */
+async function resolveSharerName(apiUrl, credentials) {
+    if (localStoreDir())
+        return credentials.display_name || undefined;
+    try {
+        const res = await fetch(`${apiUrl}/api/device/session`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ device_token: credentials.device_token }),
+            signal: AbortSignal.timeout(4000),
+        });
+        if (res.ok) {
+            const body = (await res.json());
+            if (body.display_name)
+                return body.display_name;
+        }
+    }
+    catch {
+        /* offline, slow, or an older backend that does not return a name */
+    }
+    return credentials.display_name || hostname() || undefined;
+}
+/**
+ * Test seam: keep snapshots in a directory instead of on the server.
+ *
+ * The same idea as `POPOVER_AGENTS_JSON` in the daemon — the one thing a test cannot
+ * provide is stubbed, and everything else runs for real. It lets `npm run smoke` drive a
+ * genuine create → open → launch round trip, including the sealing, the sanitizing, and
+ * the materialized transcript, with no network and no account. The crypto is never stubbed:
+ * what lands in the directory is the same sealed payload the server would hold.
+ */
+function localStoreDir() {
+    return process.env["POPOVER_FORK_LOCAL_DIR"];
+}
+function localStorePath(dir, codeHash) {
+    return path.join(dir, `${codeHash}.json`);
+}
+async function storeCreate(apiUrl, deviceToken, codeHash, ciphertext) {
+    const dir = localStoreDir();
+    if (dir) {
+        mkdirSync(dir, { recursive: true });
+        const record = {
+            id: randomUUID(),
+            ciphertext,
+            byte_size: ciphertext.length,
+            created_at: new Date().toISOString(),
+            expires_at: new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString(),
+            opens: 0,
+        };
+        writeFileSync(localStorePath(dir, codeHash), JSON.stringify(record), { mode: 0o600 });
+        return { ok: true, id: record.id, expires_at: record.expires_at };
+    }
+    const res = await fetch(`${apiUrl}/api/fork/create`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            device_token: deviceToken,
+            code_hash: codeHash,
+            ciphertext,
+            byte_size: ciphertext.length,
+        }),
+    });
+    if (!res.ok)
+        return { ok: false, status: res.status, ours: await isOurs(res) };
+    const body = (await res.json());
+    return { ok: true, id: body.id, expires_at: body.expires_at };
+}
+/**
+ * Did our API refuse this, or did something in front of it?
+ *
+ * A 401 from the route means the device token is no longer good, and the fix is
+ * `popover login`. A 401 from an auth wall between the client and the app — a protected
+ * Vercel preview, an SSO proxy, a captive portal — means nothing of the sort, and sending
+ * someone to re-authenticate popover over it wastes their time on the wrong problem.
+ * Our routes always answer with a JSON `error` string; a wall answers with something else.
+ */
+async function isOurs(res) {
+    try {
+        const body = await res.json();
+        return (typeof body === "object" &&
+            body !== null &&
+            typeof body.error === "string");
+    }
+    catch {
+        return false;
+    }
+}
+async function storeRedeem(apiUrl, codeHash) {
+    const dir = localStoreDir();
+    if (dir) {
+        const file = localStorePath(dir, codeHash);
+        if (!existsSync(file))
+            return { ok: false, status: 404 };
+        const record = JSON.parse(readFileSync(file, "utf8"));
+        if (!record.ciphertext || record.revoked_at || Date.parse(record.expires_at) < Date.now()) {
+            return { ok: false, status: 404 };
+        }
+        record.opens += 1;
+        writeFileSync(file, JSON.stringify(record), { mode: 0o600 });
+        return { ok: true, snapshot: record };
+    }
+    const res = await fetch(`${apiUrl}/api/fork/redeem`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ code_hash: codeHash }),
+    });
+    if (!res.ok)
+        return { ok: false, status: res.status };
+    return { ok: true, snapshot: (await res.json()) };
+}
+async function storeRevoke(apiUrl, codeHash) {
+    const dir = localStoreDir();
+    if (dir) {
+        const file = localStorePath(dir, codeHash);
+        if (!existsSync(file))
+            return { ok: true, opens: null };
+        const record = JSON.parse(readFileSync(file, "utf8"));
+        record.ciphertext = null;
+        record.revoked_at = new Date().toISOString();
+        writeFileSync(file, JSON.stringify(record), { mode: 0o600 });
+        return { ok: true, opens: record.opens };
+    }
+    const res = await fetch(`${apiUrl}/api/fork/revoke`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ code_hash: codeHash }),
+    });
+    if (!res.ok)
+        return { ok: false, status: res.status };
+    return { ok: true, opens: (await res.json()).opens };
+}
+// ---------------------------------------------------------------------------
+// Transcript and repo helpers
+// ---------------------------------------------------------------------------
+/**
+ * Find a session's transcript by scanning the project directories.
+ *
+ * Deliberately not by recomputing the directory name: Claude Code truncates and hashes it
+ * past 200 characters, and that hash is not reproducible here. The id is unique, so a scan
+ * is both simpler and correct.
+ */
+function findTranscript(sessionId) {
+    const root = path.join(claudeHome(), "projects");
+    if (!existsSync(root))
+        return null;
+    for (const dir of readdirSync(root)) {
+        const candidate = path.join(root, dir, `${sessionId}.jsonl`);
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+function sessionIdExists(sessionId) {
+    return findTranscript(sessionId) !== null;
+}
+/** Wait for the transcript to stop being written, so the fork includes the latest turn. */
+async function settle(file, budgetMs = 2000) {
+    let previous = -1;
+    const deadline = Date.now() + budgetMs;
+    while (Date.now() < deadline) {
+        const { size } = statSync(file);
+        if (size === previous)
+            return;
+        previous = size;
+        await sleep(150);
+    }
+}
+function lastTimestamp(entries) {
+    for (let i = entries.length - 1; i >= 0; i -= 1) {
+        const ts = entries[i]?.["timestamp"];
+        if (typeof ts === "string")
+            return ts;
+    }
+    return undefined;
+}
+/** The session's own title, if Claude Code has generated or been given one. */
+function readTitle(entries) {
+    for (let i = entries.length - 1; i >= 0; i -= 1) {
+        const entry = entries[i];
+        if (entry["type"] === "custom-title" && typeof entry["customTitle"] === "string") {
+            return entry["customTitle"];
+        }
+        if (entry["type"] === "ai-title" && typeof entry["aiTitle"] === "string") {
+            return entry["aiTitle"];
+        }
+    }
+    return undefined;
+}
+/**
+ * Identify the repository, using the same normalization the roster uses so that "same repo"
+ * means the same thing here as it does everywhere else in popover — including a fork of an
+ * upstream, which shares a key with it.
+ */
+function readRepo(cwd) {
+    const git = (args) => {
+        try {
+            return execFileSync("git", ["-C", cwd, ...args], {
+                encoding: "utf8",
+                timeout: 2000,
+                windowsHide: true,
+                stdio: ["ignore", "pipe", "ignore"],
+            }).trim();
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const root = git(["rev-parse", "--show-toplevel"]) || undefined;
+    if (!root)
+        return { keys: [] };
+    const keys = [];
+    for (const line of (git(["remote", "-v"]) ?? "").split("\n")) {
+        const url = line.split(/\s+/)[1];
+        const key = url ? normalizeRemote(url) : null;
+        if (key && !keys.includes(key))
+            keys.push(key);
+    }
+    return {
+        root,
+        name: path.basename(root),
+        branch: git(["rev-parse", "--abbrev-ref", "HEAD"]) || undefined,
+        keys,
+    };
+}
+function matchRepo(envelope, here) {
+    if (!here.root)
+        return "unknown";
+    if (envelope.repoRemotes.length === 0 || here.keys.length === 0) {
+        // No shared remote on one side or the other. Fall back to the directory name, which is
+        // a weak signal but better than warning someone about a repo that is plainly the same.
+        return envelope.repoName && envelope.repoName === here.name ? "same" : "unknown";
+    }
+    return repoKeysOverlap(envelope.repoRemotes, here.keys) ? "same" : "different";
+}
+// ---------------------------------------------------------------------------
+// Local state
+// ---------------------------------------------------------------------------
+function forksDir() {
+    const dir = path.join(popoverHome(), "forks");
+    mkdirSync(dir, { recursive: true });
+    return dir;
+}
+function stagePath(stageId) {
+    // Guard the path: the id reaches here from a command line and must not escape the dir.
+    return path.join(forksDir(), `stage-${stageId.replace(/[^a-zA-Z0-9-]/g, "")}.json`);
+}
+/**
+ * Clear out anything `open` and `launch` left behind.
+ *
+ * Two kinds of leftovers, for two different reasons. A stage file is a decrypted
+ * conversation and must not linger. A launcher script cannot be deleted the moment it is
+ * spawned — the terminal may not have read it yet — so it is cleaned up on the next run
+ * instead.
+ */
+function sweepStages() {
+    for (const file of readdirSync(forksDir())) {
+        if (!file.startsWith("stage-") && !file.startsWith("open-fork-"))
+            continue;
+        const full = path.join(forksDir(), file);
+        try {
+            if (Date.now() - statSync(full).mtimeMs > STAGE_TTL_MS)
+                rmSync(full, { force: true });
+        }
+        catch {
+            /* a file that vanished under us needs no cleanup */
+        }
+    }
+}
+function createdPath() {
+    return path.join(forksDir(), "created.jsonl");
+}
+function recordCreated(record) {
+    try {
+        appendFileSync(createdPath(), `${JSON.stringify(record)}\n`, { mode: 0o600 });
+    }
+    catch {
+        /* the record is a convenience; failing to write it must not lose the code */
+    }
+}
+function readCreated() {
+    try {
+        return readFileSync(createdPath(), "utf8")
+            .split("\n")
+            .filter((l) => l.trim().startsWith("{"))
+            .map((l) => JSON.parse(l));
+    }
+    catch {
+        return [];
+    }
+}
+function markRevoked(code) {
+    const records = readCreated().map((r) => r.code === code ? { ...r, revokedAt: new Date().toISOString() } : r);
+    try {
+        writeFileSync(createdPath(), records.map((r) => `${JSON.stringify(r)}\n`).join(""), {
+            mode: 0o600,
+        });
+    }
+    catch {
+        /* best effort */
+    }
+}
+// ---------------------------------------------------------------------------
+// Small helpers
+// ---------------------------------------------------------------------------
+function flag(args, name) {
+    const idx = args.indexOf(name);
+    return idx === -1 ? undefined : args[idx + 1];
+}
+/** Only set a key when there is a value, so `exactOptionalPropertyTypes` stays satisfied. */
+function optional(key, value) {
+    return value === undefined ? {} : { [key]: value };
+}
+function fail(asJson, code, message, hints) {
+    if (asJson) {
+        console.log(JSON.stringify({ ok: false, error: code, message, hints }));
+        return 1;
+    }
+    bad(message);
+    for (const hint of hints)
+        dim(hint);
+    return 1;
+}
+function mb(bytes) {
+    return (bytes / (1024 * 1024)).toFixed(1);
+}
+function majorMinor(version) {
+    return version.split(".").slice(0, 2).join(".");
+}
+function friendlyTime(iso) {
+    const when = Date.parse(iso);
+    if (Number.isNaN(when))
+        return iso;
+    const minutes = Math.round((Date.now() - when) / 60000);
+    if (minutes < 1)
+        return "just now";
+    if (minutes < 60)
+        return `${minutes}m ago`;
+    if (minutes < 60 * 24)
+        return `${Math.round(minutes / 60)}h ago`;
+    return new Date(when).toLocaleDateString();
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=snapshot.js.map