@searls/turbocommit 0.16.0 → 0.16.1

package/README.md

@@ -29,10 +29,13 @@ turbocommit registers hooks with the harnesses you use:
 - **PostToolUse** attributes paths that became dirty during a shell command or
   MCP tool call, so files a tool rewrites without naming them (an Xcode project
   file, for example) belong to the session that changed them. A shell command
-  that names a path inside another enabled checkout (absolute, `~`-relative, or
-  relative to a directory the command mentions) is snapshotted in that checkout
-  too, so a pin bump made with `sed` in a sibling repository is attributed and
-  committed there.
+  that names a path inside another enabled checkout (absolute, `~`-relative,
+  or relative to the working directory or to a directory the command mentions)
+  is snapshotted in that checkout too, so a pin bump made with `sed` in a
+  sibling repository is attributed and committed there. Only changes under the
+  named paths are attributed, bare words never count as paths, and a checkout
+  with a merge, rebase, or similar operation in progress is left untouched. A
+  tool the pre hook denies leaves no claim behind.
   Concurrent commands in one session share ownership. Commands from different
   sessions retain hashed overlap evidence instead of claiming each other's
   paths. Once every involved turn stops and no shell remains active in that

package/lib/shell.js

@@ -1,17 +1,23 @@
 const fs = require('fs')
 const os = require('os')
 const path = require('path')
-const { canonicalRoot, gitRootForPath } = require('./git')
+const { canonicalRoot, gitRootForPath, hasRepositoryOperation } = require('./git')
 const { activeConfig } = require('./config')
 
 /**
- * Enabled checkouts other than the anchor that a shell command names.
+ * Enabled checkouts other than the anchor that a shell command names, each
+ * with the paths inside it the command named. Only changes under those paths
+ * are attributed, since a command that merely mentions a repository is not
+ * evidence that it wrote anywhere else in it.
  *
- * A command can `cd` anywhere before it edits, so every word that resolves to
- * an existing path is probed for the repository containing it. Relative words
- * are resolved against the command's working directory and against every
- * absolute directory the command mentions, which is how a loop such as
- * `cd ~/code && for r in app/Core lib/Core; do ...` reaches each checkout.
+ * A command can `cd` anywhere before it edits, so every path-shaped word that
+ * resolves to an existing path is probed for the repository containing it.
+ * Relative words are resolved against the command's working directory and
+ * against every absolute directory the command mentions, which is how a loop
+ * such as `cd ~/code && for r in app/Core lib/Core; do ...` reaches each
+ * checkout. A checkout with a merge, rebase, or similar operation in progress
+ * is left alone: its commits cannot be path-scoped, so nothing there may be
+ * attributed on the strength of a mention.
  */
 function shellCheckouts (command, cwd, anchor) {
   if (typeof command !== 'string' || !command) return []
@@ -19,7 +25,7 @@ function shellCheckouts (command, cwd, anchor) {
   const words = shellWords(command)
   const bases = [cwd, ...words.filter(word => path.isAbsolute(word) && isDirectory(word))]
 
-  const candidates = new Set()
+  const named = new Set()
   for (const word of words) {
     const resolved = path.isAbsolute(word)
       ? [word]
@@ -28,18 +34,24 @@ function shellCheckouts (command, cwd, anchor) {
       if (!fs.existsSync(candidate)) continue
       const canonical = canonicalRoot(candidate)
       if (isInside(canonical, anchorRoot) || canonical.startsWith('/dev/')) continue
-      candidates.add(isDirectory(canonical) ? canonical : path.dirname(canonical))
+      named.add(canonical)
     }
   }
 
   const rootsByDir = new Map()
   const checkouts = []
-  for (const dir of candidates) {
+  for (const file of named) {
+    const dir = isDirectory(file) ? file : path.dirname(file)
     if (!rootsByDir.has(dir)) rootsByDir.set(dir, gitRootForPath(dir))
     const root = rootsByDir.get(dir)
-    if (!root || root === anchorRoot || checkouts.includes(root)) continue
-    if (activeConfig(root).config.enabled !== true) continue
-    checkouts.push(root)
+    if (!root || root === anchorRoot) continue
+    let checkout = checkouts.find(candidate => candidate.root === root)
+    if (!checkout) {
+      if (activeConfig(root).config.enabled !== true || hasRepositoryOperation(root)) continue
+      checkout = { root, paths: [] }
+      checkouts.push(checkout)
+    }
+    if (!checkout.paths.includes(file)) checkout.paths.push(file)
   }
   return checkouts
 }
@@ -51,6 +63,9 @@ function shellWords (command) {
     if (word === '~' || word.startsWith('~/')) word = home + word.slice(1)
     if (!word || word.startsWith('-') || word.length > 1024) return []
     if (/[$*?{}[\]\\]/.test(word)) return []
+    // A bare word is an argument or prose, not a path, unless it exists
+    // relative to the working directory itself.
+    if (!path.isAbsolute(word) && !word.includes('/')) return []
     return [word]
   })
 }

package/lib/track.js

@@ -170,7 +170,7 @@ function handleTrack (input, root, opts = {}) {
   // A shell command can edit any checkout it names, so each of those is
   // snapshotted alongside the anchor and attributed back to this session.
   const checkouts = toolName === 'Bash' ? shellCheckouts(toolInput.command, cwd, root) : []
-  const snapshotRoots = [root, ...checkouts]
+  const snapshotRoots = [root, ...checkouts.map(checkout => checkout.root)]
   const removeSnapshots = () => {
     for (const checkout of snapshotRoots) removeBashSnapshot(checkout, sessionId, toolUseId)
   }
@@ -179,12 +179,12 @@ function handleTrack (input, root, opts = {}) {
   try {
     if (snapshotsRepository(toolName)) {
       if (toolName === 'Bash') entry.command = toolInput.command
-      if (checkouts.length > 0) entry.checkouts = checkouts
+      if (checkouts.length > 0) entry.checkouts = snapshotRoots.slice(1)
       pendingSnapshot = true
-      for (const checkout of snapshotRoots) {
-        savePendingBashSnapshot(checkout, sessionId, toolUseId, cwd, toolName, checkout === root ? checkouts : [])
+      savePendingBashSnapshot(root, sessionId, toolUseId, cwd, toolName, { checkouts: snapshotRoots.slice(1) })
+      for (const checkout of checkouts) {
+        savePendingBashSnapshot(checkout.root, sessionId, toolUseId, cwd, toolName, { scope: checkout.paths })
       }
-      appendTracking(root, sessionId, entry)
     } else {
       preclaim = savePreclaim(root, sessionId, entry)
     }
@@ -196,6 +196,9 @@ function handleTrack (input, root, opts = {}) {
 
   const recoveryWaitMs = opts.recoveryWaitMs ?? 5000
   if (pendingSnapshot) {
+    // The pending snapshots already keep recovery out of every checkout, so
+    // the claim is recorded only once the tool is certain to run. A denied
+    // tool must leave nothing behind for another session to honor.
     try {
       for (const checkout of snapshotRoots) {
         if (!startBashSnapshot(checkout, sessionId, toolUseId, cwd, recoveryWaitMs)) {
@@ -203,6 +206,7 @@ function handleTrack (input, root, opts = {}) {
           return false
         }
       }
+      appendTracking(root, sessionId, entry)
     } catch (error) {
       removeSnapshots()
       throw error
@@ -283,7 +287,7 @@ function finishBashSnapshot (root, snapshot, { cwd, endedAt, trackingRoot = root
   const claimed = overlapping
     ? claimedPathsBySessions(root)
     : claimedPathsBySessions(root, snapshot.sessionId)
-  const candidates = changed.filter(file => !before.has(file) && !claimed.has(file))
+  const candidates = changed.filter(file => !before.has(file) && !claimed.has(file) && withinScope(snapshot, file))
   const files = overlapping ? [] : candidates
 
   const entry = { tool: snapshot.toolName || 'Bash', phase: 'post', t: endedAt, cwd }
@@ -301,6 +305,15 @@ function finishBashSnapshot (root, snapshot, { cwd, endedAt, trackingRoot = root
   return true
 }
 
+/**
+ * A snapshot taken in a checkout the command merely named only attributes
+ * paths under what it named; the anchor snapshot has no scope.
+ */
+function withinScope (snapshot, file) {
+  if (!Array.isArray(snapshot.scope)) return true
+  return snapshot.scope.some(named => file === named || file.startsWith(named + path.sep))
+}
+
 function bashSnapshotDir (root) {
   const base = turbocommitDir(root)
   return base && path.join(base, 'bash-snapshots')
@@ -315,7 +328,7 @@ function bashSnapshotPath (root, sessionId, toolUseId) {
   return path.join(dir, key + '.json')
 }
 
-function savePendingBashSnapshot (root, sessionId, toolUseId, cwd, toolName = 'Bash', checkouts = []) {
+function savePendingBashSnapshot (root, sessionId, toolUseId, cwd, toolName = 'Bash', { checkouts = [], scope } = {}) {
   const checkout = canonicalRoot(root)
   writeBashSnapshot(root, sessionId, toolUseId, {
     root: checkout,
@@ -325,7 +338,8 @@ function savePendingBashSnapshot (root, sessionId, toolUseId, cwd, toolName = 'B
     toolUseId: toolUseId || null,
     createdAt: Date.now(),
     pending: true,
-    ...(checkouts.length > 0 ? { checkouts } : {})
+    ...(checkouts.length > 0 ? { checkouts } : {}),
+    ...(Array.isArray(scope) ? { scope } : {})
   })
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@searls/turbocommit",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "description": "Auto-commit after every AI coding agent turn",
   "bin": {
     "turbocommit": "./cli.js"