@searls/turbocommit 0.15.2 → 0.16.0

package/README.md

@@ -25,8 +25,14 @@ turbocommit registers hooks with the harnesses you use:
 
 - **PreToolUse** tentatively claims the paths supplied to editing tools while
   recovery finishes, promotes the claim only when the tool may proceed, and
-  snapshots the repository before shell commands.
-- **PostToolUse** attributes paths that became dirty during a shell command.
+  snapshots the repository before shell commands and MCP tool calls.
+- **PostToolUse** attributes paths that became dirty during a shell command or
+  MCP tool call, so files a tool rewrites without naming them (an Xcode project
+  file, for example) belong to the session that changed them. A shell command
+  that names a path inside another enabled checkout (absolute, `~`-relative, or
+  relative to a directory the command mentions) is snapshotted in that checkout
+  too, so a pin bump made with `sed` in a sibling repository is attributed and
+  committed there.
   Concurrent commands in one session share ownership. Commands from different
   sessions retain hashed overlap evidence instead of claiming each other's
   paths. Once every involved turn stops and no shell remains active in that
@@ -59,8 +65,8 @@ turbocommit registers hooks with the harnesses you use:
 A session that starts in an enabled repository can commit changes in other
 enabled local checkouts during the same turn. Turbocommit discovers each
 checkout from explicit file paths supplied to Claude Code tools, Codex
-`apply_patch`, and path-bearing MCP tools. Shell commands alone do not discover
-additional repositories.
+`apply_patch`, and path-bearing MCP tools, and from paths named in shell
+commands that resolve inside another enabled checkout.
 
 Each touched checkout:
 

package/lib/install.js

@@ -11,11 +11,11 @@ const HOOK_DEFS = {
     hooks: [{ type: 'command', command: 'turbocommit hook pre-tool-use --harness claude' }]
   },
   PostToolUse: {
-    matcher: 'Bash',
+    matcher: 'Bash|mcp__.*',
     hooks: [{ type: 'command', command: 'turbocommit hook post-tool-use --harness claude' }]
   },
   PostToolUseFailure: {
-    matcher: 'Bash',
+    matcher: 'Bash|mcp__.*',
     hooks: [{ type: 'command', command: 'turbocommit hook post-tool-use --harness claude' }]
   },
   SessionStart: {
@@ -35,7 +35,7 @@ const CODEX_HOOK_DEFS = {
     hooks: [{ type: 'command', command: 'turbocommit hook pre-tool-use --harness codex' }]
   },
   PostToolUse: {
-    matcher: 'Bash',
+    matcher: 'Bash|mcp__.*',
     hooks: [{ type: 'command', command: 'turbocommit hook post-tool-use --harness codex' }]
   },
   SessionStart: {

package/lib/run.js

@@ -21,7 +21,8 @@ const {
   hasActiveBashSnapshot,
   acquireBashOverlapRecoveryLock,
   fingerprintTrackedPath,
-  claimedPathsBySessions
+  claimedPathsBySessions,
+  trackedShellCheckouts
 } = require('./track')
 const { redact, buildRedactions } = require('./redact')
 const { handleSessionEnd, getAncestors, savePending, collectPending, cleanupConsumed, cleanupStale, readWatermark, saveWatermark, resolveParentCommit } = require('./session')
@@ -128,6 +129,7 @@ function run (input, opts = {}) {
   if (config.enabled !== true) return
   const recoveryDeadline = opts.recoveryDeadline ?? recoveryDeadlineFromWait(opts.recoveryWaitMs ?? 5000)
 
+  const checkouts = hookInput.sessionId ? trackedShellCheckouts(root, hookInput.sessionId) : []
   if (hookInput.sessionId) {
     const finalized = finalizeBashSnapshots(root, hookInput.sessionId, Date.now(), remainingRecoveryWait(recoveryDeadline))
     if (finalized == null) return
@@ -139,6 +141,9 @@ function run (input, opts = {}) {
   } finally {
     const recoveryConfig = opts.deferPush ? { ...config, push: false } : config
     recoverBashOverlaps(root, hookInput, recoveryConfig, remainingRecoveryWait(recoveryDeadline))
+    for (const checkout of checkouts) {
+      recoverBashOverlaps(checkout, hookInput, undefined, remainingRecoveryWait(recoveryDeadline))
+    }
   }
 }
 

package/lib/session.js

@@ -328,11 +328,10 @@ function trackingMayDescribeModifications (file) {
   } catch {
     return true
   }
+  const { describesModification } = require('./track')
   return lines.some(line => {
     try {
-      const entry = JSON.parse(line)
-      return entry.tool !== 'Bash' ||
-        (entry.phase === 'post' && Array.isArray(entry.files) && entry.files.length > 0)
+      return describesModification(JSON.parse(line))
     } catch {
       return true
     }

package/lib/shell.js

@@ -0,0 +1,70 @@
+const fs = require('fs')
+const os = require('os')
+const path = require('path')
+const { canonicalRoot, gitRootForPath } = require('./git')
+const { activeConfig } = require('./config')
+
+/**
+ * Enabled checkouts other than the anchor that a shell command names.
+ *
+ * A command can `cd` anywhere before it edits, so every word that resolves to
+ * an existing path is probed for the repository containing it. Relative words
+ * are resolved against the command's working directory and against every
+ * absolute directory the command mentions, which is how a loop such as
+ * `cd ~/code && for r in app/Core lib/Core; do ...` reaches each checkout.
+ */
+function shellCheckouts (command, cwd, anchor) {
+  if (typeof command !== 'string' || !command) return []
+  const anchorRoot = canonicalRoot(anchor)
+  const words = shellWords(command)
+  const bases = [cwd, ...words.filter(word => path.isAbsolute(word) && isDirectory(word))]
+
+  const candidates = new Set()
+  for (const word of words) {
+    const resolved = path.isAbsolute(word)
+      ? [word]
+      : bases.map(base => path.resolve(base, word))
+    for (const candidate of resolved) {
+      if (!fs.existsSync(candidate)) continue
+      const canonical = canonicalRoot(candidate)
+      if (isInside(canonical, anchorRoot) || canonical.startsWith('/dev/')) continue
+      candidates.add(isDirectory(canonical) ? canonical : path.dirname(canonical))
+    }
+  }
+
+  const rootsByDir = new Map()
+  const checkouts = []
+  for (const dir of candidates) {
+    if (!rootsByDir.has(dir)) rootsByDir.set(dir, gitRootForPath(dir))
+    const root = rootsByDir.get(dir)
+    if (!root || root === anchorRoot || checkouts.includes(root)) continue
+    if (activeConfig(root).config.enabled !== true) continue
+    checkouts.push(root)
+  }
+  return checkouts
+}
+
+function shellWords (command) {
+  const home = os.homedir()
+  return command.split(/[\s;|&()<>`"'=]+/).flatMap(word => {
+    word = word.replace(/[,:.]+$/, '')
+    if (word === '~' || word.startsWith('~/')) word = home + word.slice(1)
+    if (!word || word.startsWith('-') || word.length > 1024) return []
+    if (/[$*?{}[\]\\]/.test(word)) return []
+    return [word]
+  })
+}
+
+function isDirectory (file) {
+  try {
+    return fs.statSync(file).isDirectory()
+  } catch {
+    return false
+  }
+}
+
+function isInside (file, root) {
+  return file === root || file.startsWith(root + path.sep)
+}
+
+module.exports = { shellCheckouts }

package/lib/track.js

@@ -6,6 +6,7 @@ const { fileURLToPath } = require('url')
 const { ensureDir } = require('./io')
 const { turbocommitDir } = require('./session')
 const { canonicalRoot, canonicalTrackedPath, changedPathsInRepository, gitCommonDir } = require('./git')
+const { shellCheckouts } = require('./shell')
 
 const BASH_SNAPSHOT_TTL_MS = 60 * 60 * 1000
 // A session's tracking file is rewritten on every tool call and deleted when
@@ -45,6 +46,8 @@ const FILE_PATH_KEYS = [
   'notebook_path',
   'relative_path',
   'relativePath',
+  'sourcePath',
+  'destinationPath',
   'uri'
 ]
 const FILE_PATH_ARRAY_KEYS = ['file_paths', 'filePaths', 'paths', 'files']
@@ -124,6 +127,15 @@ function extractFilePaths (toolName, toolInput, cwd) {
   })
 }
 
+/**
+ * Bash and MCP tools change paths they never name (a shell script, an Xcode
+ * project file rewritten as a side effect), so both are attributed by
+ * snapshotting the checkout before and after the call.
+ */
+function snapshotsRepository (toolName) {
+  return toolName === 'Bash' || (typeof toolName === 'string' && toolName.startsWith('mcp__'))
+}
+
 /**
  * PreToolUse handler. Persists ownership before waiting for overlap recovery.
  * Returns false when the caller must deny the tool rather than let it run
@@ -155,38 +167,45 @@ function handleTrack (input, root, opts = {}) {
   if (files.length > 0) entry.files = files
 
   const toolUseId = hookInput.toolUseId || hookInput.tool_use_id
+  // A shell command can edit any checkout it names, so each of those is
+  // snapshotted alongside the anchor and attributed back to this session.
+  const checkouts = toolName === 'Bash' ? shellCheckouts(toolInput.command, cwd, root) : []
+  const snapshotRoots = [root, ...checkouts]
+  const removeSnapshots = () => {
+    for (const checkout of snapshotRoots) removeBashSnapshot(checkout, sessionId, toolUseId)
+  }
   let pendingSnapshot = false
   let preclaim = null
   try {
-    if (toolName === 'Bash') {
-      entry.command = toolInput.command
-      savePendingBashSnapshot(root, sessionId, toolUseId, cwd)
+    if (snapshotsRepository(toolName)) {
+      if (toolName === 'Bash') entry.command = toolInput.command
+      if (checkouts.length > 0) entry.checkouts = checkouts
       pendingSnapshot = true
+      for (const checkout of snapshotRoots) {
+        savePendingBashSnapshot(checkout, sessionId, toolUseId, cwd, toolName, checkout === root ? checkouts : [])
+      }
       appendTracking(root, sessionId, entry)
     } else {
       preclaim = savePreclaim(root, sessionId, entry)
     }
   } catch (error) {
-    if (pendingSnapshot) removeBashSnapshot(root, sessionId, toolUseId)
+    if (pendingSnapshot) removeSnapshots()
     if (preclaim) removePreclaim(preclaim)
     throw error
   }
 
   const recoveryWaitMs = opts.recoveryWaitMs ?? 5000
   if (pendingSnapshot) {
-    const release = acquireBashOverlapRecoveryLock(root, recoveryWaitMs)
-    if (!release) {
-      removeBashSnapshot(root, sessionId, toolUseId)
-      return false
-    }
     try {
-      pruneBashSnapshots(root)
-      initializeBashSnapshot(root, sessionId, toolUseId, cwd)
+      for (const checkout of snapshotRoots) {
+        if (!startBashSnapshot(checkout, sessionId, toolUseId, cwd, recoveryWaitMs)) {
+          removeSnapshots()
+          return false
+        }
+      }
     } catch (error) {
-      removeBashSnapshot(root, sessionId, toolUseId)
+      removeSnapshots()
       throw error
-    } finally {
-      release()
     }
     return true
   }
@@ -210,24 +229,52 @@ function handlePostTrack (input, root) {
 
   const sessionId = hookInput.sessionId || hookInput.session_id
   const toolName = hookInput.toolName || hookInput.tool_name
-  if (!sessionId || toolName !== 'Bash') return
+  if (!sessionId || !snapshotsRepository(toolName)) return
 
   const toolUseId = hookInput.toolUseId || hookInput.tool_use_id
-  const release = acquireBashOverlapRecoveryLock(root, 5000)
-  if (!release) return
+  const cwd = hookInput.cwd || hookInput.raw?.cwd
+  const snapshot = completeBashSnapshot(root, root, sessionId, toolUseId, cwd)
+  if (!snapshot) return
+  for (const checkout of Array.isArray(snapshot.checkouts) ? snapshot.checkouts : []) {
+    completeBashSnapshot(checkout, root, sessionId, toolUseId, cwd)
+  }
+}
+
+function startBashSnapshot (root, sessionId, toolUseId, cwd, waitMs) {
+  const release = acquireBashOverlapRecoveryLock(root, waitMs)
+  if (!release) return false
+  try {
+    pruneBashSnapshots(root)
+    initializeBashSnapshot(root, sessionId, toolUseId, cwd)
+    return true
+  } finally {
+    release()
+  }
+}
+
+function completeBashSnapshot (root, trackingRoot, sessionId, toolUseId, cwd, waitMs = 5000) {
+  const release = acquireBashOverlapRecoveryLock(root, waitMs)
+  if (!release) return null
   try {
     const snapshot = loadBashSnapshot(root, sessionId, toolUseId)
-    if (!snapshot || Number.isFinite(snapshot.endedAt)) return
+    if (!snapshot || Number.isFinite(snapshot.endedAt)) return null
     finishBashSnapshot(root, snapshot, {
-      cwd: hookInput.cwd || hookInput.raw?.cwd || snapshot.cwd || root,
-      endedAt: Date.now()
+      cwd: cwd || snapshot.cwd || root,
+      endedAt: Date.now(),
+      trackingRoot
     })
+    return snapshot
   } finally {
     release()
   }
 }
 
-function finishBashSnapshot (root, snapshot, { cwd, endedAt }) {
+/**
+ * Attributes the paths a finished shell snapshot made dirty in `root` to the
+ * session's tracking file in `trackingRoot`, which is the session's anchor
+ * checkout when the command reached into another repository.
+ */
+function finishBashSnapshot (root, snapshot, { cwd, endedAt, trackingRoot = root }) {
   if (snapshot.pending === true || !Array.isArray(snapshot.before) || !Number.isFinite(snapshot.startedAt)) return false
   const overlaps = overlappingBashSnapshots(root, snapshot, endedAt)
   const before = new Set(snapshot.before.map(canonicalTrackedPath))
@@ -239,7 +286,7 @@ function finishBashSnapshot (root, snapshot, { cwd, endedAt }) {
   const candidates = changed.filter(file => !before.has(file) && !claimed.has(file))
   const files = overlapping ? [] : candidates
 
-  const entry = { tool: 'Bash', phase: 'post', t: endedAt, cwd }
+  const entry = { tool: snapshot.toolName || 'Bash', phase: 'post', t: endedAt, cwd }
   if (overlapping) {
     entry.overlapping = true
     entry.overlapEventId = recordBashOverlap(root, snapshot, overlaps, candidates, endedAt)
@@ -248,7 +295,7 @@ function finishBashSnapshot (root, snapshot, { cwd, endedAt }) {
     entry.rawFiles = files
     entry.files = files
   }
-  appendTracking(root, snapshot.sessionId, entry)
+  appendTracking(trackingRoot, snapshot.sessionId, entry)
   snapshot.endedAt = endedAt
   writeBashSnapshot(root, snapshot.sessionId, snapshot.toolUseId, snapshot)
   return true
@@ -268,15 +315,17 @@ function bashSnapshotPath (root, sessionId, toolUseId) {
   return path.join(dir, key + '.json')
 }
 
-function savePendingBashSnapshot (root, sessionId, toolUseId, cwd) {
+function savePendingBashSnapshot (root, sessionId, toolUseId, cwd, toolName = 'Bash', checkouts = []) {
   const checkout = canonicalRoot(root)
   writeBashSnapshot(root, sessionId, toolUseId, {
     root: checkout,
     cwd: cwd || checkout,
     sessionId,
+    toolName,
     toolUseId: toolUseId || null,
     createdAt: Date.now(),
-    pending: true
+    pending: true,
+    ...(checkouts.length > 0 ? { checkouts } : {})
   })
 }
 
@@ -343,7 +392,22 @@ function overlappingBashSnapshots (root, current, now) {
   })
 }
 
+/**
+ * Finishes every shell snapshot the session left unfinished in its anchor and
+ * in each checkout its shell commands named. Returns null when a recovery lock
+ * could not be acquired in time.
+ */
 function finalizeBashSnapshots (root, sessionId, endedAt = Date.now(), waitMs = 5000) {
+  let finalized = 0
+  for (const checkout of [root, ...trackedShellCheckouts(root, sessionId)]) {
+    const count = finalizeBashSnapshotsIn(checkout, root, sessionId, endedAt, waitMs)
+    if (count == null) return null
+    finalized += count
+  }
+  return finalized
+}
+
+function finalizeBashSnapshotsIn (root, trackingRoot, sessionId, endedAt, waitMs) {
   const files = unfinishedBashSnapshotFiles(root, sessionId)
   if (files.length === 0) return 0
   const release = acquireBashOverlapRecoveryLock(root, waitMs)
@@ -357,7 +421,8 @@ function finalizeBashSnapshots (root, sessionId, endedAt = Date.now(), waitMs =
         if (canonicalRoot(snapshot.root) !== canonicalRoot(root)) continue
         if (finishBashSnapshot(root, snapshot, {
           cwd: snapshot.cwd || snapshot.root || root,
-          endedAt
+          endedAt,
+          trackingRoot
         })) finalized++
       } catch {}
     }
@@ -367,6 +432,22 @@ function finalizeBashSnapshots (root, sessionId, endedAt = Date.now(), waitMs =
   }
 }
 
+/**
+ * Other checkouts the session's shell commands named, read from its tracking
+ * file in the anchor checkout.
+ */
+function trackedShellCheckouts (root, sessionId) {
+  const anchor = canonicalRoot(root)
+  const checkouts = []
+  for (const entry of readTracking(root, sessionId)) {
+    for (const checkout of Array.isArray(entry.checkouts) ? entry.checkouts : []) {
+      const canonical = canonicalRoot(checkout)
+      if (canonical !== anchor && !checkouts.includes(canonical)) checkouts.push(canonical)
+    }
+  }
+  return checkouts
+}
+
 function unfinishedBashSnapshotFiles (root, sessionId) {
   const dir = bashSnapshotDir(root)
   let files
@@ -534,6 +615,13 @@ function fingerprintTrackedPath (file) {
 }
 
 function recordBashSessionStop (root, sessionId, at = Date.now()) {
+  recordBashSessionStopIn(root, sessionId, at)
+  for (const checkout of trackedShellCheckouts(root, sessionId)) {
+    recordBashSessionStopIn(checkout, sessionId, at)
+  }
+}
+
+function recordBashSessionStopIn (root, sessionId, at) {
   const overlapFile = bashOverlapPath(root)
   if (!overlapFile || !fs.existsSync(overlapFile)) return
   const file = sessionId && bashSessionStopPath(root, sessionId)
@@ -918,12 +1006,15 @@ function parseInput (input) {
 /**
  * Check whether a session has tracked any file-modifying tool calls.
  * A Bash pre-hook alone doesn't count because shell commands may be read-only.
- * A Bash post-hook counts only when its snapshot found newly dirty paths.
+ * A snapshot post-hook counts only when it found newly dirty paths.
  */
 function hasTrackedModifications (root, sessionId) {
-  return readTracking(root, sessionId).some(entry =>
-    entry.tool !== 'Bash' || (entry.phase === 'post' && Array.isArray(entry.files) && entry.files.length > 0)
-  )
+  return readTracking(root, sessionId).some(describesModification)
+}
+
+function describesModification (entry) {
+  if (entry.phase === 'post') return Array.isArray(entry.files) && entry.files.length > 0
+  return entry.tool !== 'Bash'
 }
 
 function readTracking (root, sessionId) {
@@ -986,11 +1077,13 @@ module.exports = {
   fingerprintTrackedPath,
   claimedPathsBySessions,
   hasTrackedModifications,
+  describesModification,
   cleanupTracking,
   extractFilePath,
   extractFilePaths,
   extractRawFilePaths,
   readTracking,
+  trackedShellCheckouts,
   trackingDir,
   trackingPath
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@searls/turbocommit",
-  "version": "0.15.2",
+  "version": "0.16.0",
   "description": "Auto-commit after every AI coding agent turn",
   "bin": {
     "turbocommit": "./cli.js"