@searls/turbocommit 0.15.3 → 0.16.1

package/README.md

@@ -28,7 +28,14 @@ turbocommit registers hooks with the harnesses you use:
   snapshots the repository before shell commands and MCP tool calls.
 - **PostToolUse** attributes paths that became dirty during a shell command or
   MCP tool call, so files a tool rewrites without naming them (an Xcode project
-  file, for example) belong to the session that changed them.
+  file, for example) belong to the session that changed them. A shell command
+  that names a path inside another enabled checkout (absolute, `~`-relative,
+  or relative to the working directory or to a directory the command mentions)
+  is snapshotted in that checkout too, so a pin bump made with `sed` in a
+  sibling repository is attributed and committed there. Only changes under the
+  named paths are attributed, bare words never count as paths, and a checkout
+  with a merge, rebase, or similar operation in progress is left untouched. A
+  tool the pre hook denies leaves no claim behind.
   Concurrent commands in one session share ownership. Commands from different
   sessions retain hashed overlap evidence instead of claiming each other's
   paths. Once every involved turn stops and no shell remains active in that
@@ -61,8 +68,8 @@ turbocommit registers hooks with the harnesses you use:
 A session that starts in an enabled repository can commit changes in other
 enabled local checkouts during the same turn. Turbocommit discovers each
 checkout from explicit file paths supplied to Claude Code tools, Codex
-`apply_patch`, and path-bearing MCP tools. Shell commands alone do not discover
-additional repositories.
+`apply_patch`, and path-bearing MCP tools, and from paths named in shell
+commands that resolve inside another enabled checkout.
 
 Each touched checkout:
 

package/lib/run.js

@@ -21,7 +21,8 @@ const {
   hasActiveBashSnapshot,
   acquireBashOverlapRecoveryLock,
   fingerprintTrackedPath,
-  claimedPathsBySessions
+  claimedPathsBySessions,
+  trackedShellCheckouts
 } = require('./track')
 const { redact, buildRedactions } = require('./redact')
 const { handleSessionEnd, getAncestors, savePending, collectPending, cleanupConsumed, cleanupStale, readWatermark, saveWatermark, resolveParentCommit } = require('./session')
@@ -128,6 +129,7 @@ function run (input, opts = {}) {
   if (config.enabled !== true) return
   const recoveryDeadline = opts.recoveryDeadline ?? recoveryDeadlineFromWait(opts.recoveryWaitMs ?? 5000)
 
+  const checkouts = hookInput.sessionId ? trackedShellCheckouts(root, hookInput.sessionId) : []
   if (hookInput.sessionId) {
     const finalized = finalizeBashSnapshots(root, hookInput.sessionId, Date.now(), remainingRecoveryWait(recoveryDeadline))
     if (finalized == null) return
@@ -139,6 +141,9 @@ function run (input, opts = {}) {
   } finally {
     const recoveryConfig = opts.deferPush ? { ...config, push: false } : config
     recoverBashOverlaps(root, hookInput, recoveryConfig, remainingRecoveryWait(recoveryDeadline))
+    for (const checkout of checkouts) {
+      recoverBashOverlaps(checkout, hookInput, undefined, remainingRecoveryWait(recoveryDeadline))
+    }
   }
 }
 

package/lib/shell.js

@@ -0,0 +1,85 @@
+const fs = require('fs')
+const os = require('os')
+const path = require('path')
+const { canonicalRoot, gitRootForPath, hasRepositoryOperation } = require('./git')
+const { activeConfig } = require('./config')
+
+/**
+ * Enabled checkouts other than the anchor that a shell command names, each
+ * with the paths inside it the command named. Only changes under those paths
+ * are attributed, since a command that merely mentions a repository is not
+ * evidence that it wrote anywhere else in it.
+ *
+ * A command can `cd` anywhere before it edits, so every path-shaped word that
+ * resolves to an existing path is probed for the repository containing it.
+ * Relative words are resolved against the command's working directory and
+ * against every absolute directory the command mentions, which is how a loop
+ * such as `cd ~/code && for r in app/Core lib/Core; do ...` reaches each
+ * checkout. A checkout with a merge, rebase, or similar operation in progress
+ * is left alone: its commits cannot be path-scoped, so nothing there may be
+ * attributed on the strength of a mention.
+ */
+function shellCheckouts (command, cwd, anchor) {
+  if (typeof command !== 'string' || !command) return []
+  const anchorRoot = canonicalRoot(anchor)
+  const words = shellWords(command)
+  const bases = [cwd, ...words.filter(word => path.isAbsolute(word) && isDirectory(word))]
+
+  const named = new Set()
+  for (const word of words) {
+    const resolved = path.isAbsolute(word)
+      ? [word]
+      : bases.map(base => path.resolve(base, word))
+    for (const candidate of resolved) {
+      if (!fs.existsSync(candidate)) continue
+      const canonical = canonicalRoot(candidate)
+      if (isInside(canonical, anchorRoot) || canonical.startsWith('/dev/')) continue
+      named.add(canonical)
+    }
+  }
+
+  const rootsByDir = new Map()
+  const checkouts = []
+  for (const file of named) {
+    const dir = isDirectory(file) ? file : path.dirname(file)
+    if (!rootsByDir.has(dir)) rootsByDir.set(dir, gitRootForPath(dir))
+    const root = rootsByDir.get(dir)
+    if (!root || root === anchorRoot) continue
+    let checkout = checkouts.find(candidate => candidate.root === root)
+    if (!checkout) {
+      if (activeConfig(root).config.enabled !== true || hasRepositoryOperation(root)) continue
+      checkout = { root, paths: [] }
+      checkouts.push(checkout)
+    }
+    if (!checkout.paths.includes(file)) checkout.paths.push(file)
+  }
+  return checkouts
+}
+
+function shellWords (command) {
+  const home = os.homedir()
+  return command.split(/[\s;|&()<>`"'=]+/).flatMap(word => {
+    word = word.replace(/[,:.]+$/, '')
+    if (word === '~' || word.startsWith('~/')) word = home + word.slice(1)
+    if (!word || word.startsWith('-') || word.length > 1024) return []
+    if (/[$*?{}[\]\\]/.test(word)) return []
+    // A bare word is an argument or prose, not a path, unless it exists
+    // relative to the working directory itself.
+    if (!path.isAbsolute(word) && !word.includes('/')) return []
+    return [word]
+  })
+}
+
+function isDirectory (file) {
+  try {
+    return fs.statSync(file).isDirectory()
+  } catch {
+    return false
+  }
+}
+
+function isInside (file, root) {
+  return file === root || file.startsWith(root + path.sep)
+}
+
+module.exports = { shellCheckouts }

package/lib/track.js

@@ -6,6 +6,7 @@ const { fileURLToPath } = require('url')
 const { ensureDir } = require('./io')
 const { turbocommitDir } = require('./session')
 const { canonicalRoot, canonicalTrackedPath, changedPathsInRepository, gitCommonDir } = require('./git')
+const { shellCheckouts } = require('./shell')
 
 const BASH_SNAPSHOT_TTL_MS = 60 * 60 * 1000
 // A session's tracking file is rewritten on every tool call and deleted when
@@ -166,38 +167,49 @@ function handleTrack (input, root, opts = {}) {
   if (files.length > 0) entry.files = files
 
   const toolUseId = hookInput.toolUseId || hookInput.tool_use_id
+  // A shell command can edit any checkout it names, so each of those is
+  // snapshotted alongside the anchor and attributed back to this session.
+  const checkouts = toolName === 'Bash' ? shellCheckouts(toolInput.command, cwd, root) : []
+  const snapshotRoots = [root, ...checkouts.map(checkout => checkout.root)]
+  const removeSnapshots = () => {
+    for (const checkout of snapshotRoots) removeBashSnapshot(checkout, sessionId, toolUseId)
+  }
   let pendingSnapshot = false
   let preclaim = null
   try {
     if (snapshotsRepository(toolName)) {
       if (toolName === 'Bash') entry.command = toolInput.command
-      savePendingBashSnapshot(root, sessionId, toolUseId, cwd, toolName)
+      if (checkouts.length > 0) entry.checkouts = snapshotRoots.slice(1)
       pendingSnapshot = true
-      appendTracking(root, sessionId, entry)
+      savePendingBashSnapshot(root, sessionId, toolUseId, cwd, toolName, { checkouts: snapshotRoots.slice(1) })
+      for (const checkout of checkouts) {
+        savePendingBashSnapshot(checkout.root, sessionId, toolUseId, cwd, toolName, { scope: checkout.paths })
+      }
     } else {
       preclaim = savePreclaim(root, sessionId, entry)
     }
   } catch (error) {
-    if (pendingSnapshot) removeBashSnapshot(root, sessionId, toolUseId)
+    if (pendingSnapshot) removeSnapshots()
     if (preclaim) removePreclaim(preclaim)
     throw error
   }
 
   const recoveryWaitMs = opts.recoveryWaitMs ?? 5000
   if (pendingSnapshot) {
-    const release = acquireBashOverlapRecoveryLock(root, recoveryWaitMs)
-    if (!release) {
-      removeBashSnapshot(root, sessionId, toolUseId)
-      return false
-    }
+    // The pending snapshots already keep recovery out of every checkout, so
+    // the claim is recorded only once the tool is certain to run. A denied
+    // tool must leave nothing behind for another session to honor.
     try {
-      pruneBashSnapshots(root)
-      initializeBashSnapshot(root, sessionId, toolUseId, cwd)
+      for (const checkout of snapshotRoots) {
+        if (!startBashSnapshot(checkout, sessionId, toolUseId, cwd, recoveryWaitMs)) {
+          removeSnapshots()
+          return false
+        }
+      }
+      appendTracking(root, sessionId, entry)
     } catch (error) {
-      removeBashSnapshot(root, sessionId, toolUseId)
+      removeSnapshots()
       throw error
-    } finally {
-      release()
     }
     return true
   }
@@ -224,21 +236,49 @@ function handlePostTrack (input, root) {
   if (!sessionId || !snapshotsRepository(toolName)) return
 
   const toolUseId = hookInput.toolUseId || hookInput.tool_use_id
-  const release = acquireBashOverlapRecoveryLock(root, 5000)
-  if (!release) return
+  const cwd = hookInput.cwd || hookInput.raw?.cwd
+  const snapshot = completeBashSnapshot(root, root, sessionId, toolUseId, cwd)
+  if (!snapshot) return
+  for (const checkout of Array.isArray(snapshot.checkouts) ? snapshot.checkouts : []) {
+    completeBashSnapshot(checkout, root, sessionId, toolUseId, cwd)
+  }
+}
+
+function startBashSnapshot (root, sessionId, toolUseId, cwd, waitMs) {
+  const release = acquireBashOverlapRecoveryLock(root, waitMs)
+  if (!release) return false
+  try {
+    pruneBashSnapshots(root)
+    initializeBashSnapshot(root, sessionId, toolUseId, cwd)
+    return true
+  } finally {
+    release()
+  }
+}
+
+function completeBashSnapshot (root, trackingRoot, sessionId, toolUseId, cwd, waitMs = 5000) {
+  const release = acquireBashOverlapRecoveryLock(root, waitMs)
+  if (!release) return null
   try {
     const snapshot = loadBashSnapshot(root, sessionId, toolUseId)
-    if (!snapshot || Number.isFinite(snapshot.endedAt)) return
+    if (!snapshot || Number.isFinite(snapshot.endedAt)) return null
     finishBashSnapshot(root, snapshot, {
-      cwd: hookInput.cwd || hookInput.raw?.cwd || snapshot.cwd || root,
-      endedAt: Date.now()
+      cwd: cwd || snapshot.cwd || root,
+      endedAt: Date.now(),
+      trackingRoot
     })
+    return snapshot
   } finally {
     release()
   }
 }
 
-function finishBashSnapshot (root, snapshot, { cwd, endedAt }) {
+/**
+ * Attributes the paths a finished shell snapshot made dirty in `root` to the
+ * session's tracking file in `trackingRoot`, which is the session's anchor
+ * checkout when the command reached into another repository.
+ */
+function finishBashSnapshot (root, snapshot, { cwd, endedAt, trackingRoot = root }) {
   if (snapshot.pending === true || !Array.isArray(snapshot.before) || !Number.isFinite(snapshot.startedAt)) return false
   const overlaps = overlappingBashSnapshots(root, snapshot, endedAt)
   const before = new Set(snapshot.before.map(canonicalTrackedPath))
@@ -247,7 +287,7 @@ function finishBashSnapshot (root, snapshot, { cwd, endedAt }) {
   const claimed = overlapping
     ? claimedPathsBySessions(root)
     : claimedPathsBySessions(root, snapshot.sessionId)
-  const candidates = changed.filter(file => !before.has(file) && !claimed.has(file))
+  const candidates = changed.filter(file => !before.has(file) && !claimed.has(file) && withinScope(snapshot, file))
   const files = overlapping ? [] : candidates
 
   const entry = { tool: snapshot.toolName || 'Bash', phase: 'post', t: endedAt, cwd }
@@ -259,12 +299,21 @@ function finishBashSnapshot (root, snapshot, { cwd, endedAt }) {
     entry.rawFiles = files
     entry.files = files
   }
-  appendTracking(root, snapshot.sessionId, entry)
+  appendTracking(trackingRoot, snapshot.sessionId, entry)
   snapshot.endedAt = endedAt
   writeBashSnapshot(root, snapshot.sessionId, snapshot.toolUseId, snapshot)
   return true
 }
 
+/**
+ * A snapshot taken in a checkout the command merely named only attributes
+ * paths under what it named; the anchor snapshot has no scope.
+ */
+function withinScope (snapshot, file) {
+  if (!Array.isArray(snapshot.scope)) return true
+  return snapshot.scope.some(named => file === named || file.startsWith(named + path.sep))
+}
+
 function bashSnapshotDir (root) {
   const base = turbocommitDir(root)
   return base && path.join(base, 'bash-snapshots')
@@ -279,7 +328,7 @@ function bashSnapshotPath (root, sessionId, toolUseId) {
   return path.join(dir, key + '.json')
 }
 
-function savePendingBashSnapshot (root, sessionId, toolUseId, cwd, toolName = 'Bash') {
+function savePendingBashSnapshot (root, sessionId, toolUseId, cwd, toolName = 'Bash', { checkouts = [], scope } = {}) {
   const checkout = canonicalRoot(root)
   writeBashSnapshot(root, sessionId, toolUseId, {
     root: checkout,
@@ -288,7 +337,9 @@ function savePendingBashSnapshot (root, sessionId, toolUseId, cwd, toolName = 'B
     toolName,
     toolUseId: toolUseId || null,
     createdAt: Date.now(),
-    pending: true
+    pending: true,
+    ...(checkouts.length > 0 ? { checkouts } : {}),
+    ...(Array.isArray(scope) ? { scope } : {})
   })
 }
 
@@ -355,7 +406,22 @@ function overlappingBashSnapshots (root, current, now) {
   })
 }
 
+/**
+ * Finishes every shell snapshot the session left unfinished in its anchor and
+ * in each checkout its shell commands named. Returns null when a recovery lock
+ * could not be acquired in time.
+ */
 function finalizeBashSnapshots (root, sessionId, endedAt = Date.now(), waitMs = 5000) {
+  let finalized = 0
+  for (const checkout of [root, ...trackedShellCheckouts(root, sessionId)]) {
+    const count = finalizeBashSnapshotsIn(checkout, root, sessionId, endedAt, waitMs)
+    if (count == null) return null
+    finalized += count
+  }
+  return finalized
+}
+
+function finalizeBashSnapshotsIn (root, trackingRoot, sessionId, endedAt, waitMs) {
   const files = unfinishedBashSnapshotFiles(root, sessionId)
   if (files.length === 0) return 0
   const release = acquireBashOverlapRecoveryLock(root, waitMs)
@@ -369,7 +435,8 @@ function finalizeBashSnapshots (root, sessionId, endedAt = Date.now(), waitMs =
         if (canonicalRoot(snapshot.root) !== canonicalRoot(root)) continue
         if (finishBashSnapshot(root, snapshot, {
           cwd: snapshot.cwd || snapshot.root || root,
-          endedAt
+          endedAt,
+          trackingRoot
         })) finalized++
       } catch {}
     }
@@ -379,6 +446,22 @@ function finalizeBashSnapshots (root, sessionId, endedAt = Date.now(), waitMs =
   }
 }
 
+/**
+ * Other checkouts the session's shell commands named, read from its tracking
+ * file in the anchor checkout.
+ */
+function trackedShellCheckouts (root, sessionId) {
+  const anchor = canonicalRoot(root)
+  const checkouts = []
+  for (const entry of readTracking(root, sessionId)) {
+    for (const checkout of Array.isArray(entry.checkouts) ? entry.checkouts : []) {
+      const canonical = canonicalRoot(checkout)
+      if (canonical !== anchor && !checkouts.includes(canonical)) checkouts.push(canonical)
+    }
+  }
+  return checkouts
+}
+
 function unfinishedBashSnapshotFiles (root, sessionId) {
   const dir = bashSnapshotDir(root)
   let files
@@ -546,6 +629,13 @@ function fingerprintTrackedPath (file) {
 }
 
 function recordBashSessionStop (root, sessionId, at = Date.now()) {
+  recordBashSessionStopIn(root, sessionId, at)
+  for (const checkout of trackedShellCheckouts(root, sessionId)) {
+    recordBashSessionStopIn(checkout, sessionId, at)
+  }
+}
+
+function recordBashSessionStopIn (root, sessionId, at) {
   const overlapFile = bashOverlapPath(root)
   if (!overlapFile || !fs.existsSync(overlapFile)) return
   const file = sessionId && bashSessionStopPath(root, sessionId)
@@ -1007,6 +1097,7 @@ module.exports = {
   extractFilePaths,
   extractRawFilePaths,
   readTracking,
+  trackedShellCheckouts,
   trackingDir,
   trackingPath
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@searls/turbocommit",
-  "version": "0.15.3",
+  "version": "0.16.1",
   "description": "Auto-commit after every AI coding agent turn",
   "bin": {
     "turbocommit": "./cli.js"