@quolu/lattice 0.64.0 → 0.64.2

package/sensor/dist/mcp/server-instructions.js

@@ -18,79 +18,79 @@ exports.SERVER_INSTRUCTIONS_NO_ROOT_INDEX = exports.SERVER_INSTRUCTIONS = void 0
  * burn tokens. ADR 0049 / 0059 require the eight compatibility tools to remain
  * visible by default; provider identity is Lattice regardless of their names.
  */
-exports.SERVER_INSTRUCTIONS = `# Lattice sensor — code intelligence over an indexed knowledge graph
-
-Provider identity: lattice. The lattice_sensor_* names below are compatibility tool names served by Lattice's own bundled sensor; they do not call or require the independent Lattice sensor product.
-
-Lattice sensor is a SQLite knowledge graph of every symbol, edge, and file in
-the workspace — pre-computed structure you would otherwise re-derive by
-reading files (cached intelligence: thousands of parse/trace decisions you
-don't pay to re-reason each run). Reads are sub-millisecond; the index lags
-writes by ~1s through the file watcher. Reach for it BEFORE *and* while
-writing or editing code — not just for questions: one call returns the
-verbatim source PLUS who calls it and what it affects, so you edit with the
-blast radius in view. More accurate context, in far fewer tokens and
-round-trips than reading files yourself.
-
-## One tool: lattice_sensor_explore — use it instead of reading files
-
-There is a single tool, \`lattice_sensor_explore\`, and it is Read-equivalent. It
-takes either a natural-language question or a bag of symbol/file names and
-returns the **verbatim, line-numbered source** of the relevant symbols
-grouped by file — the same \`<n>\\t<line>\` shape \`Read\` gives you, safe to
-\`Edit\` from — PLUS the call path among them (including dynamic-dispatch hops
-like callbacks, React re-render, and JSX children that grep can't follow) and
-a blast-radius summary of what depends on them.
-
-Whether you're answering "how does X work" or implementing a change (fixing a
-bug, adding a feature), call \`lattice_sensor_explore\` before you Read. ONE call
-usually answers the whole question. Lattice sensor IS the pre-built search index —
-so running your own grep + read loop, or delegating the lookup to a separate
-file-reading sub-task/agent, repeats work lattice sensor already did and costs more
-for the same answer. A direct lattice sensor answer is typically one to a few
-calls; a grep/read exploration is dozens.
-
-## How to query
-
-- **Almost any question — "how does X work", architecture, a bug, "what/where is X", or surveying an area** → \`lattice_sensor_explore\` with a natural-language question or the relevant names. ONE capped call returns the verbatim source grouped by file; most often the ONLY call you need.
-- **"How does X reach/become Y? / the flow / the path from X to Y"** → \`lattice_sensor_explore\`, naming the symbols that span the flow (e.g. \`mutateElement renderScene\`) — it surfaces the call path among them, riding dynamic-dispatch hops, and returns their source.
-- **Reading or editing a file/symbol you can name** → put its name or file path in the \`lattice_sensor_explore\` query — it returns that current line-numbered source (safe to \`Edit\` from) with the call path and blast radius attached, so you don't Read it separately. For an overloaded name it returns every matching definition's body in one call.
-- **Need more?** Call \`lattice_sensor_explore\` again with more specific names — treat the source it returns as already Read.
-
-## Anti-patterns
-
-- **Trust lattice sensor's results — don't re-verify them with grep.** They come from a full AST parse; re-checking with grep is slower, less accurate, and wastes context.
-- **Don't grep or Read first** to find or understand indexed code — ONE \`lattice_sensor_explore\` returns the relevant symbols' source together in a single round-trip. Reach for raw \`Read\`/\`Grep\` only to confirm a specific detail lattice sensor didn't cover, or for what lattice sensor doesn't index (configs, docs).
-- **Don't reconstruct a flow by hand** — name the endpoints in one \`lattice_sensor_explore\` and it surfaces the path between them, dynamic-dispatch hops included.
-- **After editing, check the staleness banner.** When a tool response starts with "⚠️ Some files referenced below were edited since the last index sync…", the listed files are pending re-index — Read those specific files for accurate content. Every file NOT in that banner is fresh, so still trust lattice sensor. A different, rarer banner — "⚠️ LatticeSensor auto-sync is DISABLED…" — means live watching stopped entirely (the whole index is frozen, not just a few files); until it's resolved, Read files directly to confirm anything that may have changed.
-- **A file flagged "⚠ changed on disk after the last index sync" drifted from its index** (most common on projects queried via \`projectPath\`, which have no live watcher). LatticeSensor never serves a possibly-mis-sliced body from such a file — it either shows the file's full CURRENT source (trust it as a Read) or omits the source with this flag. When the source was omitted, Read that specific file; line numbers referencing it elsewhere in the response may be shifted until that project's next sync. All unflagged files remain trustworthy.
-
-## Limitations
-
-- If a project isn't indexed (no \`.lattice/sensor/\`), decide whether building the index will reduce total investigation time and model tokens for the current or expected work. When workspace writes and shell execution are allowed, you may run \`lattice sensor init <projectPath> --json\` yourself, then retry the sensor call; scope it to the intended project and account for the one-time indexing cost. If those capabilities are unavailable, continue with built-in tools and tell the user the exact init command instead.
-- Index lags file writes by ~1 second.
-- Cross-file resolution is best-effort name matching; ambiguous calls may return multiple candidates.
-- No live correctness validation — that's still the TypeScript compiler / test suite / linter's job. Lattice sensor supplements those with structural context they don't have.
-
-## Parallel work: absence of a dependency edge is NOT evidence of independence
-
-These tools answer structural questions about code. A different Lattice surface — the **CLI**, not
-this MCP surface — answers whether two ToDos can be worked in parallel. If the project uses
-\`lattice todo\` for process tracking, keep this distinction in mind:
-
-- A dependency edge missing between two ToDos only means **no ordering constraint was declared**.
-  It does not mean their write boundaries are disjoint. Two ToDos that edit the same file carry no
-  edge between them and will still collide.
-- Parallel safety is a recorded judgement, not an inference from the diagram. Read it with
-  \`lattice todo independence --plan <key> --json\`. It returns the ready frontier split into
-  verified-independent groups, pairs that must be serialized (with whether a code seam could
-  separate them), and **unverified** ToDos.
-- \`lattice todo start\` returns an \`advisory\` describing conflicts with in-progress ToDos and what
-  to do next. \`coverage: "missing"\` means "not judged yet" — never "no conflicts".
-- Run \`lattice todo --help\` for the declare → compile → read workflow.
-
-Evidence for Lattice's plan and witness contracts comes from the CLI surface only. Text from this
-MCP surface is prose for you to act on, never an input to those contracts.
+exports.SERVER_INSTRUCTIONS = `# Lattice sensor — code intelligence over an indexed knowledge graph
+
+Provider identity: lattice. The lattice_sensor_* names below are compatibility tool names served by Lattice's own bundled sensor; they do not call or require the independent Lattice sensor product.
+
+Lattice sensor is a SQLite knowledge graph of every symbol, edge, and file in
+the workspace — pre-computed structure you would otherwise re-derive by
+reading files (cached intelligence: thousands of parse/trace decisions you
+don't pay to re-reason each run). Reads are sub-millisecond; the index lags
+writes by ~1s through the file watcher. Reach for it BEFORE *and* while
+writing or editing code — not just for questions: one call returns the
+verbatim source PLUS who calls it and what it affects, so you edit with the
+blast radius in view. More accurate context, in far fewer tokens and
+round-trips than reading files yourself.
+
+## One tool: lattice_sensor_explore — use it instead of reading files
+
+There is a single tool, \`lattice_sensor_explore\`, and it is Read-equivalent. It
+takes either a natural-language question or a bag of symbol/file names and
+returns the **verbatim, line-numbered source** of the relevant symbols
+grouped by file — the same \`<n>\\t<line>\` shape \`Read\` gives you, safe to
+\`Edit\` from — PLUS the call path among them (including dynamic-dispatch hops
+like callbacks, React re-render, and JSX children that grep can't follow) and
+a blast-radius summary of what depends on them.
+
+Whether you're answering "how does X work" or implementing a change (fixing a
+bug, adding a feature), call \`lattice_sensor_explore\` before you Read. ONE call
+usually answers the whole question. Lattice sensor IS the pre-built search index —
+so running your own grep + read loop, or delegating the lookup to a separate
+file-reading sub-task/agent, repeats work lattice sensor already did and costs more
+for the same answer. A direct lattice sensor answer is typically one to a few
+calls; a grep/read exploration is dozens.
+
+## How to query
+
+- **Almost any question — "how does X work", architecture, a bug, "what/where is X", or surveying an area** → \`lattice_sensor_explore\` with a natural-language question or the relevant names. ONE capped call returns the verbatim source grouped by file; most often the ONLY call you need.
+- **"How does X reach/become Y? / the flow / the path from X to Y"** → \`lattice_sensor_explore\`, naming the symbols that span the flow (e.g. \`mutateElement renderScene\`) — it surfaces the call path among them, riding dynamic-dispatch hops, and returns their source.
+- **Reading or editing a file/symbol you can name** → put its name or file path in the \`lattice_sensor_explore\` query — it returns that current line-numbered source (safe to \`Edit\` from) with the call path and blast radius attached, so you don't Read it separately. For an overloaded name it returns every matching definition's body in one call.
+- **Need more?** Call \`lattice_sensor_explore\` again with more specific names — treat the source it returns as already Read.
+
+## Anti-patterns
+
+- **Trust lattice sensor's results — don't re-verify them with grep.** They come from a full AST parse; re-checking with grep is slower, less accurate, and wastes context.
+- **Don't grep or Read first** to find or understand indexed code — ONE \`lattice_sensor_explore\` returns the relevant symbols' source together in a single round-trip. Reach for raw \`Read\`/\`Grep\` only to confirm a specific detail lattice sensor didn't cover, or for what lattice sensor doesn't index (configs, docs).
+- **Don't reconstruct a flow by hand** — name the endpoints in one \`lattice_sensor_explore\` and it surfaces the path between them, dynamic-dispatch hops included.
+- **After editing, check the staleness banner.** When a tool response starts with "⚠️ Some files referenced below were edited since the last index sync…", the listed files are pending re-index — Read those specific files for accurate content. Every file NOT in that banner is fresh, so still trust lattice sensor. A different, rarer banner — "⚠️ LatticeSensor auto-sync is DISABLED…" — means live watching stopped entirely (the whole index is frozen, not just a few files); until it's resolved, Read files directly to confirm anything that may have changed.
+- **A file flagged "⚠ changed on disk after the last index sync" drifted from its index** (most common on projects queried via \`projectPath\`, which have no live watcher). LatticeSensor never serves a possibly-mis-sliced body from such a file — it either shows the file's full CURRENT source (trust it as a Read) or omits the source with this flag. When the source was omitted, Read that specific file; line numbers referencing it elsewhere in the response may be shifted until that project's next sync. All unflagged files remain trustworthy.
+
+## Limitations
+
+- If a project isn't indexed (no \`.lattice/sensor/\`), decide whether building the index will reduce total investigation time and model tokens for the current or expected work. When workspace writes and shell execution are allowed, you may run \`lattice sensor init <projectPath> --json\` yourself, then retry the sensor call; scope it to the intended project and account for the one-time indexing cost. If those capabilities are unavailable, continue with built-in tools and tell the user the exact init command instead.
+- Index lags file writes by ~1 second.
+- Cross-file resolution is best-effort name matching; ambiguous calls may return multiple candidates.
+- No live correctness validation — that's still the TypeScript compiler / test suite / linter's job. Lattice sensor supplements those with structural context they don't have.
+
+## Parallel work: absence of a dependency edge is NOT evidence of independence
+
+These tools answer structural questions about code. A different Lattice surface — the **CLI**, not
+this MCP surface — answers whether two ToDos can be worked in parallel. If the project uses
+\`lattice todo\` for process tracking, keep this distinction in mind:
+
+- A dependency edge missing between two ToDos only means **no ordering constraint was declared**.
+  It does not mean their write boundaries are disjoint. Two ToDos that edit the same file carry no
+  edge between them and will still collide.
+- Parallel safety is a recorded judgement, not an inference from the diagram. Read it with
+  \`lattice todo independence --plan <key> --json\`. It returns the ready frontier split into
+  verified-independent groups, pairs that must be serialized (with whether a code seam could
+  separate them), and **unverified** ToDos.
+- \`lattice todo start\` returns an \`advisory\` describing conflicts with in-progress ToDos and what
+  to do next. \`coverage: "missing"\` means "not judged yet" — never "no conflicts".
+- Run \`lattice todo --help\` for the declare → compile → read workflow.
+
+Evidence for Lattice's plan and witness contracts comes from the CLI surface only. Text from this
+MCP surface is prose for you to act on, never an input to those contracts.
 `;
 /**
  * Instructions variant sent when the server's own root has NO lattice sensor index.
@@ -104,27 +104,27 @@ MCP surface is prose for you to act on, never an input to those contracts.
  * project playbook ({@link SERVER_INSTRUCTIONS}) is sent instead when the root
  * IS indexed, so the common case stays tight.
  */
-exports.SERVER_INSTRUCTIONS_NO_ROOT_INDEX = `# Lattice sensor — available (per-project; pass projectPath)
-
-Provider identity: lattice. The lattice_sensor_* names below are compatibility tool names served by Lattice's own bundled sensor; they do not call or require the independent Lattice sensor product.
-
-Lattice sensor is a SQLite knowledge graph of a codebase's symbols, edges, and
-files: one \`lattice_sensor_explore\` call returns the verbatim, line-numbered source
-of the relevant symbols PLUS the call paths between them and a blast-radius
-summary — replacing a grep + Read loop with one round-trip.
-
-This server started somewhere with no \`.lattice/sensor/\` of its own, so there is no
-default project — but the tools are available and work **per project**:
-
-- To query a project that HAS a \`.lattice/sensor/\` index (e.g. a service inside a
-  monorepo, or a second repo), pass its path as \`projectPath\` to
-  \`lattice_sensor_explore\` (and any other lattice sensor tool). Lattice sensor resolves the
-  nearest \`.lattice/sensor/\` at or above that path and answers from it — for as many
-  projects as you like in one session.
-- For a project with no \`.lattice/sensor/\`, decide whether the expected reduction in
-  repeated Read/Grep work justifies the one-time indexing cost. When workspace writes
-  and shell execution are allowed, you may run \`lattice sensor init <projectPath> --json\`
-  yourself and then retry with that \`projectPath\`; otherwise use built-in tools and
-  tell the user the exact init command. A new index is picked up live, with no restart.
+exports.SERVER_INSTRUCTIONS_NO_ROOT_INDEX = `# Lattice sensor — available (per-project; pass projectPath)
+
+Provider identity: lattice. The lattice_sensor_* names below are compatibility tool names served by Lattice's own bundled sensor; they do not call or require the independent Lattice sensor product.
+
+Lattice sensor is a SQLite knowledge graph of a codebase's symbols, edges, and
+files: one \`lattice_sensor_explore\` call returns the verbatim, line-numbered source
+of the relevant symbols PLUS the call paths between them and a blast-radius
+summary — replacing a grep + Read loop with one round-trip.
+
+This server started somewhere with no \`.lattice/sensor/\` of its own, so there is no
+default project — but the tools are available and work **per project**:
+
+- To query a project that HAS a \`.lattice/sensor/\` index (e.g. a service inside a
+  monorepo, or a second repo), pass its path as \`projectPath\` to
+  \`lattice_sensor_explore\` (and any other lattice sensor tool). Lattice sensor resolves the
+  nearest \`.lattice/sensor/\` at or above that path and answers from it — for as many
+  projects as you like in one session.
+- For a project with no \`.lattice/sensor/\`, decide whether the expected reduction in
+  repeated Read/Grep work justifies the one-time indexing cost. When workspace writes
+  and shell execution are allowed, you may run \`lattice sensor init <projectPath> --json\`
+  yourself and then retry with that \`projectPath\`; otherwise use built-in tools and
+  tell the user the exact init command. A new index is picked up live, with no restart.
 `;
 //# sourceMappingURL=server-instructions.js.map

package/sensor/package.json

@@ -1,56 +1,56 @@
-{
-  "name": "@quolu/lattice-sensor",
-  "version": "0.7.3-lattice.1",
-  "private": true,
-  "description": "Lattice-owned local structural sensor.",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/kitepon/Lattice.git"
-  },
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "files": [
-    "dist",
-    "README.md"
-  ],
-  "scripts": {
-    "build": "npm run clean && tsc && npm run copy-assets",
-    "copy-assets": "node -e \"const fs=require('fs');fs.mkdirSync('dist/db',{recursive:true});fs.copyFileSync('src/db/schema.sql','dist/db/schema.sql');fs.mkdirSync('dist/extraction/wasm',{recursive:true});fs.readdirSync('src/extraction/wasm').filter(f=>f.endsWith('.wasm')).forEach(f=>fs.copyFileSync('src/extraction/wasm/'+f,'dist/extraction/wasm/'+f))\"",
-    "dev": "tsc --watch",
-    "build:kernel": "bash scripts/build-kernel.sh",
-    "test": "vitest run --maxWorkers=4 --minWorkers=1",
-    "test:watch": "vitest",
-    "test:eval": "vitest run __tests__/evaluation/",
-    "eval": "npm run build && npx tsx __tests__/evaluation/runner.ts",
-    "clean": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true})\""
-  },
-  "keywords": [
-    "code-intelligence",
-    "knowledge-graph",
-    "static-analysis"
-  ],
-  "author": "",
-  "license": "MIT",
-  "dependencies": {
-    "@clack/prompts": "^1.3.0",
-    "commander": "^14.0.2",
-    "fast-string-width": "^3.0.2",
-    "fast-wrap-ansi": "^0.2.0",
-    "ignore": "^7.0.5",
-    "jsonc-parser": "^3.3.1",
-    "picomatch": "^4.0.4",
-    "sisteransi": "^1.0.5",
-    "tree-sitter-wasms": "^0.1.11",
-    "web-tree-sitter": "^0.25.3"
-  },
-  "devDependencies": {
-    "@types/better-sqlite3": "^7.6.0",
-    "@types/node": "^20.19.30",
-    "@types/picomatch": "^4.0.2",
-    "typescript": "^5.0.0",
-    "vitest": "^2.1.9"
-  },
-  "engines": {
-    "node": ">=20.0.0 <25.0.0 || >=26.0.0"
-  }
-}
+{
+  "name": "@quolu/lattice-sensor",
+  "version": "0.7.3-lattice.1",
+  "private": true,
+  "description": "Lattice-owned local structural sensor.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kitepon/Lattice.git"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "npm run clean && tsc && npm run copy-assets",
+    "copy-assets": "node -e \"const fs=require('fs');fs.mkdirSync('dist/db',{recursive:true});fs.copyFileSync('src/db/schema.sql','dist/db/schema.sql');fs.mkdirSync('dist/extraction/wasm',{recursive:true});fs.readdirSync('src/extraction/wasm').filter(f=>f.endsWith('.wasm')).forEach(f=>fs.copyFileSync('src/extraction/wasm/'+f,'dist/extraction/wasm/'+f))\"",
+    "dev": "tsc --watch",
+    "build:kernel": "bash scripts/build-kernel.sh",
+    "test": "vitest run --maxWorkers=4 --minWorkers=1",
+    "test:watch": "vitest",
+    "test:eval": "vitest run __tests__/evaluation/",
+    "eval": "npm run build && npx tsx __tests__/evaluation/runner.ts",
+    "clean": "node -e \"const fs=require('fs');fs.rmSync('dist',{recursive:true,force:true})\""
+  },
+  "keywords": [
+    "code-intelligence",
+    "knowledge-graph",
+    "static-analysis"
+  ],
+  "author": "",
+  "license": "MIT",
+  "dependencies": {
+    "@clack/prompts": "^1.3.0",
+    "commander": "^14.0.2",
+    "fast-string-width": "^3.0.2",
+    "fast-wrap-ansi": "^0.2.0",
+    "ignore": "^7.0.5",
+    "jsonc-parser": "^3.3.1",
+    "picomatch": "^4.0.4",
+    "sisteransi": "^1.0.5",
+    "tree-sitter-wasms": "^0.1.11",
+    "web-tree-sitter": "^0.25.3"
+  },
+  "devDependencies": {
+    "@types/better-sqlite3": "^7.6.0",
+    "@types/node": "^20.19.30",
+    "@types/picomatch": "^4.0.2",
+    "typescript": "^5.0.0",
+    "vitest": "^2.1.9"
+  },
+  "engines": {
+    "node": ">=20.0.0 <25.0.0 || >=26.0.0"
+  }
+}

package/src/cli-help.mjs

@@ -86,6 +86,7 @@ Read commands:
   phase status --plan <key>
 
 Write commands:
+  repair-eol --json  # Git checkoutでCRLF化された既存storeをcanonical LFへ戻し、EOL保護を追加する
   dashboard adopt --json  # 衝突したproject_idの配信元rootを現在repoへ明示的に移す
   dashboard remove <project_id> --json  # 登録簿から1件外す（対象repoの外からも叩ける）
   note --plan <key> [--task <id>] (--message <text>|--input <file>)
@@ -251,6 +252,7 @@ const SUBCOMMAND_USAGE = Object.freeze({
   'todo seam-profile': 'todo seam-profile --plan <key> --file <path> [--json]',
   'todo seam-proposal': 'todo seam-proposal [--plan <key>] [--json] | compile --plan <key>',
   'todo verify': 'todo verify [--plan <key>] [--json]',
+  'todo repair-eol': 'todo repair-eol --json',
   'todo snapshot': 'todo snapshot --rebuild --plan <key>',
   'todo gantt': 'todo gantt serve --port <port> [--scope live|all]  # 動的表示のみ。静的HTML生成は廃止',
   'todo gantt serve': 'todo gantt serve --port <0..65535> [--scope live|all]  # loopback動的viewer',

package/src/hooks-cli.mjs

@@ -1090,7 +1090,6 @@ export async function runHooksCli({
   }
   const [command, , host] = argv;
   if (platform === 'win32') {
-    if (command === 'status') return status(host, env, stdout, source, platform, testHooks);
     return failure(stdout, 'HOST_PLATFORM_UNSUPPORTED', 'native Windows hooks are unsupported');
   }
   if (command === 'install') return mutate(host, env, stdout, false, source, platform, testHooks);

package/src/project-cli.mjs

@@ -325,7 +325,14 @@ async function resolveProjectState({ cwd, cliVersion, diagnoseStructureArtifacts
     if (error?.code === 'STRUCTURE_ARTIFACT_INVALID') throw error;
     const reason = error instanceof TodoStoreError
       ? `${error.code}:${error.detail?.reason ?? error.message}` : 'store_validation_failed';
-    return invalid(reason);
+    const nextAction = error instanceof TodoStoreError
+      && error.detail?.next_action === 'lattice todo repair-eol --json'
+      ? { command: error.detail.next_action, reason: `${reason}:${error.detail.ref}` }
+      : null;
+    return {
+      exitCode: 1, repoRoot, store: null, todo: null,
+      result: invalidStatus({ cliVersion, repoRoot, reason, nextAction }),
+    };
   }
 }
 

package/src/todo-cli.mjs

@@ -177,6 +177,7 @@ import {
 } from './todo-note-store.mjs';
 import { readTodoParallelCandidatesForStatus } from './todo-parallel-candidates.mjs';
 import { commitTodoStoreMutation } from './todo-store-git-transaction.mjs';
+import { repairTodoStoreWorktreeEol } from './todo-store-worktree-eol.mjs';
 
 const CLI_ERROR_SCHEMA = 'lattice.cli_error.v2';
 const DEFAULT_GANTT_SCOPE = 'live';
@@ -254,7 +255,7 @@ function internalFailure(stderr, error) {
 
 const TODO_COMMAND_NAMES = Object.freeze([
   'status', 'show', 'note', 'bindings', 'independence', 'structure', 'seam-profile', 'seam-proposal',
-  'verify', 'snapshot', 'gantt', 'dashboard', 'phase', 'migrate', 'start', 'block',
+  'verify', 'repair-eol', 'snapshot', 'gantt', 'dashboard', 'phase', 'migrate', 'start', 'block',
   'unblock', 'done', 'reopen', 'evidence', 'split', 'revise', 'revise-phase', 'revise-set',
 ]);
 
@@ -3579,6 +3580,20 @@ async function rebuildSnapshot({ repoRoot, planKey }) {
   return result;
 }
 
+async function repairStoreEol({ repoRoot }) {
+  const repair = await repairTodoStoreWorktreeEol({ repoRoot });
+  const store = await readTodoStore({ repoRoot });
+  const result = {
+    schema: 'lattice.todo_eol_repair_result.v1',
+    project_id: store.project_id,
+    ...repair,
+    repaired_count: repair.repaired_refs.length,
+    result_digest: '',
+  };
+  result.result_digest = todoSelfDigest(result, 'result_digest');
+  return result;
+}
+
 /**
  * `lattice todo` namespace. Exact position, order, and argument count are part of
  * the public contract; usage failures never use a JSON envelope.
@@ -3633,7 +3648,10 @@ export async function runTodoCli({ argv, cwd, stdout, stderr, env = process.env
 
   const automatedStructureRealize = parseAutomatedStructureRealizeArgs(argv);
   let action = null;
-  if ((argv.length === 1 && argv[0] === 'status')
+  if (argv.length === 2 && argv[0] === 'repair-eol' && argv[1] === '--json') {
+    // 壊れたstoreを読めない時の入口なので、dashboard所有権pre-hookを通さない。
+    action = (repoRoot) => repairStoreEol({ repoRoot });
+  } else if ((argv.length === 1 && argv[0] === 'status')
     || (argv.length === 2 && argv[0] === 'status' && argv[1] === '--json')) {
     action = (repoRoot) => status({ repoRoot });
   } else if (argv.length === 3 && argv[0] === 'dashboard'

package/src/todo-store-worktree-eol.mjs

@@ -0,0 +1,191 @@
+import { randomBytes } from 'node:crypto';
+import {
+  lstat, readFile, readdir, rename, rm, writeFile,
+} from 'node:fs/promises';
+import path from 'node:path';
+
+import { gitCatFileBatch, gitSpawnSync } from './git-process.mjs';
+import { TodoStoreError } from './todo-store.mjs';
+
+const STORE_REF = '.lattice/todo';
+const ATTRIBUTES_REF = '.lattice/.gitattributes';
+const EOL_PROTECTION = '# Lattice store artifacts are canonical JSON+LF bytes; EOL conversion corrupts the store.\n* -text\n';
+const INDEX_REFRESH_BATCH_SIZE = 40;
+
+function fail(reason, detail = {}) {
+  throw new TodoStoreError('STORE_EOL_REPAIR_UNSAFE', reason, undefined, detail);
+}
+
+async function regularFileState(absolute, ref) {
+  let stats;
+  try { stats = await lstat(absolute); } catch (error) {
+    if (error?.code === 'ENOENT') return null;
+    fail('artifact_unreadable', { ref, message: error.message });
+  }
+  if (stats.isSymbolicLink() || !stats.isFile()) fail('unsafe_artifact_path', { ref });
+  return stats;
+}
+
+async function assertSafeDirectoryChain(repoRoot, relative) {
+  let absolute = repoRoot;
+  let ref = '';
+  for (const segment of relative.replaceAll('\\', '/').split('/')) {
+    ref = path.posix.join(ref, segment);
+    absolute = path.join(absolute, segment);
+    let stats;
+    try { stats = await lstat(absolute); } catch (error) {
+      fail(error?.code === 'ENOENT' ? 'store_missing' : 'store_unreadable', {
+        ref, message: error.message,
+      });
+    }
+    if (stats.isSymbolicLink() || !stats.isDirectory()) fail('unsafe_artifact_path', { ref });
+  }
+  return absolute;
+}
+
+async function safeRegularFileState(repoRoot, ref) {
+  await assertSafeDirectoryChain(repoRoot, path.posix.dirname(ref));
+  return regularFileState(path.join(repoRoot, ref), ref);
+}
+
+async function collectArtifactRefs(repoRoot, relative = STORE_REF) {
+  const absolute = await assertSafeDirectoryChain(repoRoot, relative);
+  let entries;
+  try { entries = await readdir(absolute, { withFileTypes: true }); } catch (error) {
+    fail(error?.code === 'ENOENT' ? 'store_missing' : 'store_unreadable', {
+      ref: relative, message: error.message,
+    });
+  }
+  const refs = [];
+  for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
+    const ref = path.posix.join(relative.replaceAll('\\', '/'), entry.name);
+    if (entry.isSymbolicLink()) fail('unsafe_artifact_path', { ref });
+    if (entry.isDirectory()) refs.push(...await collectArtifactRefs(repoRoot, ref));
+    else if (entry.isFile() && /\.(?:json|jsonl)$/u.test(entry.name)) refs.push(ref);
+    else if (!entry.isFile()) fail('unsafe_artifact_path', { ref });
+  }
+  return refs;
+}
+
+function normalizePureCrlf(bytes, ref) {
+  if (!bytes.includes(13)) return null;
+  const normalized = [];
+  for (let index = 0; index < bytes.length; index += 1) {
+    const byte = bytes[index];
+    if (byte !== 13) {
+      normalized.push(byte);
+      continue;
+    }
+    if (bytes[index + 1] !== 10) fail('artifact_not_pure_crlf_conversion', { ref });
+  }
+  return Buffer.from(normalized);
+}
+
+async function atomicReplace({ repoRoot, ref, absolute, sourceBytes, bytes, mode }) {
+  await safeRegularFileState(repoRoot, ref);
+  const currentBytes = await readFile(absolute);
+  if (!currentBytes.equals(sourceBytes)) fail('artifact_changed_during_repair', { ref });
+  const temporary = `${absolute}.eol-repair-${process.pid}-${randomBytes(6).toString('hex')}.tmp`;
+  try {
+    await writeFile(temporary, bytes, { flag: 'wx', mode: mode & 0o777 });
+    await rename(temporary, absolute);
+  } catch (error) {
+    try { await rm(temporary, { force: true }); } catch { /* noop */ }
+    fail('artifact_write_failed', { ref: path.basename(absolute), message: error.message });
+  }
+}
+
+async function prepareProtection(repoRoot) {
+  const absolute = path.join(repoRoot, ATTRIBUTES_REF);
+  const stats = await safeRegularFileState(repoRoot, ATTRIBUTES_REF);
+  if (stats === null) return { absolute, create: true };
+  const text = await readFile(absolute, 'utf8');
+  if (!text.split(/\r?\n/u).includes('* -text')) {
+    fail('eol_protection_conflict', { ref: ATTRIBUTES_REF, required_rule: '* -text' });
+  }
+  return { absolute, create: false };
+}
+
+function refreshGitIndex(repoRoot, refs) {
+  for (let offset = 0; offset < refs.length; offset += INDEX_REFRESH_BATCH_SIZE) {
+    const batch = refs.slice(offset, offset + INDEX_REFRESH_BATCH_SIZE);
+    const refresh = gitSpawnSync(['add', '--refresh', '--', ...batch], {
+      cwd: repoRoot, stdio: 'ignore',
+    });
+    // git add --refresh は内容をstageせずstat cacheだけを更新する。対象pathは下のdiff-filesで検証する。
+    if (refresh.error || refresh.signal || ![0, 1].includes(refresh.status)) {
+      fail('git_index_refresh_failed', { refs: batch, status: refresh.status ?? null });
+    }
+    const verified = gitSpawnSync(['diff-files', '--quiet', '--', ...batch], {
+      cwd: repoRoot, stdio: 'ignore',
+    });
+    if (verified.error || verified.signal || verified.status !== 0) {
+      fail('git_index_refresh_failed', { refs: batch, status: verified.status ?? null });
+    }
+  }
+}
+
+/**
+ * Gitのcheckoutがcanonical LF artifactをCRLFへ変換した既存storeだけを修復する。
+ * JSONの意味・順序・空白には触れず、CRLF除去後にcanonical byte列へ完全一致するfileだけを書く。
+ */
+export async function repairTodoStoreWorktreeEol({ repoRoot }) {
+  const protection = await prepareProtection(repoRoot);
+  const refs = await collectArtifactRefs(repoRoot);
+  const converted = [];
+  for (const ref of refs) {
+    const absolute = path.join(repoRoot, ref);
+    const stats = await safeRegularFileState(repoRoot, ref);
+    const bytes = await readFile(absolute);
+    const normalized = normalizePureCrlf(bytes, ref);
+    if (normalized === null) continue;
+    converted.push({
+      ref, absolute, sourceBytes: bytes, bytes: normalized, mode: stats.mode,
+    });
+  }
+
+  let headArtifacts = [];
+  let indexArtifacts = [];
+  if (converted.length > 0) {
+    const maxBodyBytes = Math.max(...converted.map(({ bytes }) => bytes.length));
+    try {
+      headArtifacts = gitCatFileBatch(converted.map(({ ref }) => `HEAD:${ref}`), {
+        cwd: repoRoot, maxBodyBytes,
+      });
+    } catch (error) {
+      fail('git_head_artifacts_unreadable', { message: error.message });
+    }
+    try {
+      indexArtifacts = gitCatFileBatch(converted.map(({ ref }) => `:${ref}`), {
+        cwd: repoRoot, maxBodyBytes,
+      });
+    } catch (error) {
+      fail('git_index_artifacts_unreadable', { message: error.message });
+    }
+  }
+  for (const [index, artifact] of converted.entries()) {
+    const head = headArtifacts[index];
+    if (head?.type !== 'blob' || !head.bytes.equals(artifact.bytes)) {
+      fail('artifact_not_pure_checkout_conversion', { ref: artifact.ref });
+    }
+    const staged = indexArtifacts[index];
+    if (staged?.type !== 'blob' || !staged.bytes.equals(head.bytes)) {
+      fail('artifact_staged_change_present', { ref: artifact.ref });
+    }
+  }
+
+  for (const artifact of converted) {
+    await atomicReplace({ repoRoot, ...artifact });
+  }
+  refreshGitIndex(repoRoot, converted.map(({ ref }) => ref));
+  if (protection.create) {
+    await assertSafeDirectoryChain(repoRoot, path.posix.dirname(ATTRIBUTES_REF));
+    await writeFile(protection.absolute, EOL_PROTECTION, { flag: 'wx' });
+  }
+
+  return {
+    repaired_refs: converted.map(({ ref }) => ref),
+    protection_ref: ATTRIBUTES_REF,
+    protection_created: protection.create,
+  };
+}