@starci/hfs 4.11.22 → 4.12.2

package/runtime/scripts/hfs/secret-edit.mjs

@@ -5,166 +5,146 @@
 // publishes it atomically under the writer claim. Output names environments, members and keys only.
 import fs from "node:fs";
 import { isSopsEnvelope } from "../lib/sops-envelope.mjs";
-import { envelopeOf, plaintextOf, validateKey, validateMap } from "./secret-document.mjs";
+import { envelopeOf, plaintextOf, validateKey, validateMap, } from "./secret-document.mjs";
 import { deleteSealed, fileOf, replaceSealed } from "./secret-store.mjs";
 import { SecretError } from "./secret-errors.mjs";
-
 const BINARY_PROPERTY = "data";
 const NOT_PRESERVED = /\r|\\n/u;
-
-const sameNames = (left, right) =>
-  left.length === right.length && left.every((name) => right.includes(name));
-
+const sameNames = (left, right) => left.length === right.length && left.every((name) => right.includes(name));
 /** True for the sops binary store: a JSON envelope whose only property is `data` (the ssh key and known_hosts members). */
-const isBinaryEnvelope = (envelope) =>
-  envelope.format === "json" &&
-  envelope.keys.length === 1 &&
-  envelope.keys[0] === BINARY_PROPERTY;
-
+const isBinaryEnvelope = (envelope) => envelope.format === "json" &&
+    envelope.keys.length === 1 &&
+    envelope.keys[0] === BINARY_PROPERTY;
 function inspectMember(file, label) {
-  let stat;
-  try {
-    stat = fs.lstatSync(file);
-  } catch {
-    throw new SecretError(`${label} is not a sealed member of this environment`);
-  }
-  if (!stat.isFile() || stat.isSymbolicLink())
-    throw new SecretError(`${label} must be an ordinary sealed file`);
-  const text = fs.readFileSync(file, "utf8");
-  if (!isSopsEnvelope(text))
-    throw new SecretError(`${label} is not a sops envelope`);
-  return envelopeOf(text);
+    let stat;
+    try {
+        stat = fs.lstatSync(file);
+    }
+    catch {
+        throw new SecretError(`${label} is not a sealed member of this environment`);
+    }
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new SecretError(`${label} must be an ordinary sealed file`);
+    const text = fs.readFileSync(file, "utf8");
+    if (!isSopsEnvelope(text))
+        throw new SecretError(`${label} is not a sops envelope`);
+    return envelopeOf(text);
 }
-
 function requireKey(envelope, key, label) {
-  if (!envelope.keys.includes(key))
-    throw new SecretError(`${label} has no KEY ${key}`);
+    if (!envelope.keys.includes(key))
+        throw new SecretError(`${label} has no KEY ${key}`);
 }
-
 /** Decrypt the member in memory and check that it holds exactly the keys its envelope declares. */
 function openMap(file, envelope, sops) {
-  const map = sops.decrypt(file, envelope.format);
-  validateMap(map);
-  if (!sameNames(Object.keys(map), envelope.keys))
-    throw new SecretError("sops returned keys that differ from the envelope");
-  if (
-    envelope.format !== "dotenv" &&
-    Object.values(map).some((value) => NOT_PRESERVED.test(value))
-  )
-    throw new SecretError(
-      "a value holds a carriage return or literal backslash-n that this edit cannot preserve losslessly",
-    );
-  return map;
+    const map = sops.decrypt(file, envelope.format);
+    validateMap(map);
+    if (!sameNames(Object.keys(map), envelope.keys))
+        throw new SecretError("sops returned keys that differ from the envelope");
+    if (envelope.format !== "dotenv" &&
+        Object.values(map).some((value) => NOT_PRESERVED.test(value)))
+        throw new SecretError("a value holds a carriage return or literal backslash-n that this edit cannot preserve losslessly");
+    return map;
 }
-
 /** Seal the replacement map to the original recipients and prove the result before anything is published. */
-function sealReplacement({ file, format, map, envelope, sops }) {
-  const sealed = sops.seal({
-    inputType: format,
-    plaintext: plaintextOf(format, map),
-    recipients: envelope.recipients,
-    filenameOverride: file,
-  });
-  let parsed;
-  try {
-    parsed = envelopeOf(sealed);
-  } catch {
-    throw new SecretError("sops returned an invalid sealed document");
-  }
-  const recipientsKept =
-    !envelope.recipients.length ||
-    sameNames(parsed.recipients, envelope.recipients);
-  if (
-    !isSopsEnvelope(sealed) ||
-    parsed.format !== format ||
-    !sameNames(parsed.keys, Object.keys(map))
-  )
-    throw new SecretError("sops returned an invalid sealed document");
-  if (!recipientsKept)
-    throw new SecretError("sops returned a document sealed to different recipients");
-  return sealed;
+function sealReplacement({ file, format, map, envelope, sops, }) {
+    const sealed = sops.seal({
+        inputType: format,
+        plaintext: plaintextOf(format, map),
+        recipients: envelope.recipients,
+        filenameOverride: file,
+    });
+    let parsed;
+    try {
+        parsed = envelopeOf(sealed);
+    }
+    catch {
+        throw new SecretError("sops returned an invalid sealed document");
+    }
+    const recipientsKept = !envelope.recipients.length ||
+        sameNames(parsed.recipients, envelope.recipients);
+    if (!isSopsEnvelope(sealed) ||
+        parsed.format !== format ||
+        !sameNames(parsed.keys, Object.keys(map)))
+        throw new SecretError("sops returned an invalid sealed document");
+    if (!recipientsKept)
+        throw new SecretError("sops returned a document sealed to different recipients");
+    return sealed;
 }
-
 const keyCount = (count) => `${count} key${count === 1 ? "" : "s"}`;
-
-function unsetKey({ file, label, key, execute, sops, stdout }) {
-  const envelope = inspectMember(file, label);
-  requireKey(envelope, key, label);
-  if (envelope.keys.length === 1)
-    throw new SecretError(
-      `${key} is the last KEY of ${label}; a sealed member cannot be empty, use remove ${label.replace("/", " ")} --force-nonempty to delete it`,
-    );
-  const remaining = envelope.keys.length - 1;
-  if (!execute) {
-    stdout(`dry run: would unset ${key} from ${label} (${keyCount(remaining)} remain); add --execute\n`);
+function unsetKey({ file, label, key, execute, sops, stdout, }) {
+    const envelope = inspectMember(file, label);
+    requireKey(envelope, key, label);
+    if (envelope.keys.length === 1)
+        throw new SecretError(`${key} is the last KEY of ${label}; a sealed member cannot be empty, use remove ${label.replace("/", " ")} --force-nonempty to delete it`);
+    const remaining = envelope.keys.length - 1;
+    if (!execute) {
+        stdout(`dry run: would unset ${key} from ${label} (${keyCount(remaining)} remain); add --execute\n`);
+        return 0;
+    }
+    const seam = sops();
+    const map = openMap(file, envelope, seam);
+    delete map[key];
+    replaceSealed(file, sealReplacement({ file, format: envelope.format, map, envelope, sops: seam }));
+    stdout(`unset ${label} (${key}); ${keyCount(remaining)} remain\n`);
     return 0;
-  }
-  const seam = sops();
-  const map = openMap(file, envelope, seam);
-  delete map[key];
-  replaceSealed(file, sealReplacement({ file, format: envelope.format, map, envelope, sops: seam }));
-  stdout(`unset ${label} (${key}); ${keyCount(remaining)} remain\n`);
-  return 0;
 }
-
 /** The replacement map and format of a rename: the key keeps its position and value; a binary envelope becomes a JSON one. */
-function renamedMap({ file, envelope, from, to, sops }) {
-  if (isBinaryEnvelope(envelope)) {
-    const value = sops.decryptBinary(file);
-    if (typeof value !== "string" || value === "")
-      throw new SecretError("the binary envelope holds no content");
-    return { format: "json", map: { [to]: value } };
-  }
-  const map = openMap(file, envelope, sops);
-  const entries = Object.entries(map).map(([name, value]) => [name === from ? to : name, value]);
-  return { format: envelope.format, map: Object.fromEntries(entries) };
+function renamedMap({ file, envelope, from, to, sops, }) {
+    if (isBinaryEnvelope(envelope)) {
+        const value = sops.decryptBinary(file);
+        if (typeof value !== "string" || value === "")
+            throw new SecretError("the binary envelope holds no content");
+        return { format: "json", map: { [to]: value } };
+    }
+    const map = openMap(file, envelope, sops);
+    const entries = Object.entries(map).map(([name, value]) => [name === from ? to : name, value]);
+    return { format: envelope.format, map: Object.fromEntries(entries) };
 }
-
-function renameKey({ file, label, key, to, execute, sops, stdout }) {
-  const envelope = inspectMember(file, label);
-  requireKey(envelope, key, label);
-  if (key === to) throw new SecretError("the new KEY equals the old KEY");
-  if (envelope.keys.includes(to))
-    throw new SecretError(`${label} already has KEY ${to}`);
-  const binary = isBinaryEnvelope(envelope);
-  if (!execute) {
-    const note = binary ? "; the binary envelope is re-sealed as a JSON envelope" : "";
-    stdout(`dry run: would rename ${key} to ${to} in ${label}${note}; add --execute\n`);
+function renameKey({ file, label, key, to, execute, sops, stdout, }) {
+    const envelope = inspectMember(file, label);
+    requireKey(envelope, key, label);
+    if (key === to)
+        throw new SecretError("the new KEY equals the old KEY");
+    if (envelope.keys.includes(to))
+        throw new SecretError(`${label} already has KEY ${to}`);
+    const binary = isBinaryEnvelope(envelope);
+    if (!execute) {
+        const note = binary ? "; the binary envelope is re-sealed as a JSON envelope" : "";
+        stdout(`dry run: would rename ${key} to ${to} in ${label}${note}; add --execute\n`);
+        return 0;
+    }
+    const seam = sops();
+    const { format, map } = renamedMap({ file, envelope, from: key, to, sops: seam });
+    replaceSealed(file, sealReplacement({ file, format, map, envelope, sops: seam }));
+    stdout(`renamed ${key} to ${to} in ${label}${binary ? " (re-sealed as a JSON envelope)" : ""}\n`);
     return 0;
-  }
-  const seam = sops();
-  const { format, map } = renamedMap({ file, envelope, from: key, to, sops: seam });
-  replaceSealed(file, sealReplacement({ file, format, map, envelope, sops: seam }));
-  stdout(`renamed ${key} to ${to} in ${label}${binary ? " (re-sealed as a JSON envelope)" : ""}\n`);
-  return 0;
 }
-
-function removeMember({ file, label, execute, force, stdout }) {
-  const envelope = inspectMember(file, label);
-  if (envelope.keys.length && !force)
-    throw new SecretError(
-      `${label} still holds ${keyCount(envelope.keys.length)} (${envelope.keys.join(", ")}); unset them first, or pass --force-nonempty to delete the whole member`,
-    );
-  if (!execute) {
-    stdout(`dry run: would remove ${label}.enc (${keyCount(envelope.keys.length)}); add --execute\n`);
+function removeMember({ file, label, execute, force, stdout, }) {
+    const envelope = inspectMember(file, label);
+    if (envelope.keys.length && !force)
+        throw new SecretError(`${label} still holds ${keyCount(envelope.keys.length)} (${envelope.keys.join(", ")}); unset them first, or pass --force-nonempty to delete the whole member`);
+    if (!execute) {
+        stdout(`dry run: would remove ${label}.enc (${keyCount(envelope.keys.length)}); add --execute\n`);
+        return 0;
+    }
+    deleteSealed(file);
+    stdout(`removed ${label}.enc (${keyCount(envelope.keys.length)})\n`);
     return 0;
-  }
-  deleteSealed(file);
-  stdout(`removed ${label}.enc (${keyCount(envelope.keys.length)})\n`);
-  return 0;
 }
-
 /** Validate every name of an edit verb before anything touches the file system. */
 export function validateEditNames(verb, names) {
-  for (const name of names) validateKey(name);
-  if (verb === "remove" && names.length) throw new SecretError("remove takes no KEY");
+    for (const name of names)
+        validateKey(name);
+    if (verb === "remove" && names.length)
+        throw new SecretError("remove takes no KEY");
 }
-
 /** unset, rename and remove; `sops` is a thunk so a dry run never needs the sops tool or an age identity. */
-export function editSecret(verb, { directory, environment, slug, names, execute, force, sops, stdout }) {
-  const file = fileOf(directory, slug);
-  const common = { file, label: `${environment}/${slug}`, execute, sops, stdout };
-  if (verb === "unset") return unsetKey({ ...common, key: names[0] });
-  if (verb === "rename") return renameKey({ ...common, key: names[0], to: names[1] });
-  return removeMember({ ...common, force });
+export function editSecret(verb, { directory, environment, slug, names, execute, force, sops, stdout, }) {
+    const file = fileOf(directory, slug);
+    const common = { file, label: `${environment}/${slug}`, execute, sops, stdout };
+    if (verb === "unset")
+        return unsetKey({ ...common, key: names[0] });
+    if (verb === "rename")
+        return renameKey({ ...common, key: names[0], to: names[1] });
+    return removeMember({ ...common, force });
 }

package/runtime/scripts/hfs/secret-errors.d.mts

@@ -0,0 +1,4 @@
+export declare class SecretError extends Error {
+}
+export declare const publicStorage: <T>(action: () => T) => T;
+export declare function secretErrorMessage(caught: unknown): string;

package/runtime/scripts/hfs/secret-errors.mjs

@@ -1,20 +1,23 @@
 // secret-errors.mjs - sanitized public errors shared by app secret operations.
-
-export class SecretError extends Error {}
-
+export class SecretError extends Error {
+}
 export const publicStorage = (action) => {
-  try {
-    return action();
-  } catch (error) {
-    throw new SecretError(
-      error.code ? `private storage failed (${error.code})` : error.message,
-    );
-  }
+    try {
+        return action();
+    }
+    catch (caught) {
+        // reason: a thrown value is untyped; storage failures are Node errors carrying an optional code.
+        const error = caught;
+        throw new SecretError(error.code ? `private storage failed (${error.code})` : error.message);
+    }
 };
-
-export function secretErrorMessage(error) {
-  if (error instanceof SecretError) return error.message;
-  if (error instanceof SyntaxError) return "invalid secret document";
-  const code = error.code ? ` (${error.code})` : "";
-  return `operation failed${code}; no secret values were printed`;
+export function secretErrorMessage(caught) {
+    if (caught instanceof SecretError)
+        return caught.message;
+    if (caught instanceof SyntaxError)
+        return "invalid secret document";
+    // reason: a thrown value is untyped; read its optional Node error code exactly as the JavaScript did.
+    const error = caught;
+    const code = error.code ? ` (${error.code})` : "";
+    return `operation failed${code}; no secret values were printed`;
 }

package/runtime/scripts/hfs/secret-files.d.mts

@@ -0,0 +1,20 @@
+/** The platform's SOPS age identity file and StarCi local secrets root. */
+export interface SecretRoots {
+    identity: string;
+    local: string;
+}
+/** The platform's SOPS age identity and StarCi local data roots. */
+export declare function secretRoots(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): SecretRoots;
+/** Reject repository custody, including a path spelled through a symlink or junction. */
+export declare function outsideRepository(repoRoot: string, target: string): void;
+/** Create private directories without following a symlink at any storage component. */
+export declare function privateDirectory(repoRoot: string, directory: string): void;
+/** The declared project owns a separate environment directory on the local machine. */
+export declare function materializedDirectory(repoRoot: string, environment: string, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string;
+/** Atomically publish one KEY file; an existing link or hard link is never overwritten. */
+export declare function writeSecretFile(directory: string, key: string, value: string | Uint8Array): string;
+/**
+ * The main checkout of a git worktree (its `.git` file names `<main>/.git/worktrees/<name>`), else `root` itself: a worktree
+ * keeps no git-ignored `.claude/secret.env` of its own, so the app's age identity is read from the checkout it was cut from.
+ */
+export declare function mainCheckout(root: string): string;

package/runtime/scripts/hfs/secret-files.mjs

@@ -3,138 +3,129 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
-
 /** The platform's SOPS age identity and StarCi local data roots. */
 export function secretRoots(env = process.env, platform = process.platform) {
-  const home = env.USERPROFILE || env.HOME || os.homedir();
-  const support = path.join(home, "Library", "Application Support");
-  let config;
-  if (platform === "win32")
-    config = env.APPDATA || path.join(home, "AppData", "Roaming");
-  else if (platform === "darwin") config = support;
-  else config = env.XDG_CONFIG_HOME || path.join(home, ".config");
-  let local;
-  if (platform === "win32")
-    local = env.LOCALAPPDATA || path.join(home, "AppData", "Local");
-  else if (platform === "darwin") local = support;
-  else local = env.XDG_DATA_HOME || path.join(home, ".local", "share");
-  return {
-    identity: path.resolve(config, "sops", "age", "keys.txt"),
-    local: path.resolve(local, "StarCi", "secrets"),
-  };
+    const home = env.USERPROFILE || env.HOME || os.homedir();
+    const support = path.join(home, "Library", "Application Support");
+    let config;
+    if (platform === "win32")
+        config = env.APPDATA || path.join(home, "AppData", "Roaming");
+    else if (platform === "darwin")
+        config = support;
+    else
+        config = env.XDG_CONFIG_HOME || path.join(home, ".config");
+    let local;
+    if (platform === "win32")
+        local = env.LOCALAPPDATA || path.join(home, "AppData", "Local");
+    else if (platform === "darwin")
+        local = support;
+    else
+        local = env.XDG_DATA_HOME || path.join(home, ".local", "share");
+    return {
+        identity: path.resolve(config, "sops", "age", "keys.txt"),
+        local: path.resolve(local, "StarCi", "secrets"),
+    };
 }
-
 const inside = (root, target) => {
-  const relative = path.relative(root, target);
-  return (
-    relative === "" ||
-    (!relative.startsWith(`..${path.sep}`) &&
-      relative !== ".." &&
-      !path.isAbsolute(relative))
-  );
+    const relative = path.relative(root, target);
+    return (relative === "" ||
+        (!relative.startsWith(`..${path.sep}`) &&
+            relative !== ".." &&
+            !path.isAbsolute(relative)));
 };
-
 /** Reject repository custody, including a path spelled through a symlink or junction. */
 export function outsideRepository(repoRoot, target) {
-  const root = fs.realpathSync(repoRoot);
-  let ancestor = path.resolve(target);
-  while (!fs.existsSync(ancestor)) {
-    const parent = path.dirname(ancestor);
-    if (parent === ancestor)
-      throw new Error("cannot resolve the private storage root");
-    ancestor = parent;
-  }
-  const resolved = path.resolve(
-    fs.realpathSync(ancestor),
-    path.relative(ancestor, path.resolve(target)),
-  );
-  if (
-    inside(root, resolved) ||
-    inside(path.resolve(repoRoot), path.resolve(target))
-  )
-    throw new Error("private storage must be outside the repository");
+    const root = fs.realpathSync(repoRoot);
+    let ancestor = path.resolve(target);
+    while (!fs.existsSync(ancestor)) {
+        const parent = path.dirname(ancestor);
+        if (parent === ancestor)
+            throw new Error("cannot resolve the private storage root");
+        ancestor = parent;
+    }
+    const resolved = path.resolve(fs.realpathSync(ancestor), path.relative(ancestor, path.resolve(target)));
+    if (inside(root, resolved) ||
+        inside(path.resolve(repoRoot), path.resolve(target)))
+        throw new Error("private storage must be outside the repository");
 }
-
 /** Create private directories without following a symlink at any storage component. */
 export function privateDirectory(repoRoot, directory) {
-  outsideRepository(repoRoot, directory);
-  const missing = [];
-  for (let at = directory; !fs.existsSync(at); at = path.dirname(at))
-    missing.push(at);
-  for (const at of missing.toReversed()) fs.mkdirSync(at, { mode: 0o700 });
-  for (let at = directory; ; at = path.dirname(at)) {
-    const stat = fs.lstatSync(at);
-    if (!stat.isDirectory() || stat.isSymbolicLink())
-      throw new Error("private storage must use ordinary directories");
-    if (path.dirname(at) === at) break;
-  }
-  outsideRepository(repoRoot, directory);
-  if (process.platform !== "win32") fs.chmodSync(directory, 0o700);
+    outsideRepository(repoRoot, directory);
+    const missing = [];
+    for (let at = directory; !fs.existsSync(at); at = path.dirname(at))
+        missing.push(at);
+    for (const at of missing.toReversed())
+        fs.mkdirSync(at, { mode: 0o700 });
+    for (let at = directory;; at = path.dirname(at)) {
+        const stat = fs.lstatSync(at);
+        if (!stat.isDirectory() || stat.isSymbolicLink())
+            throw new Error("private storage must use ordinary directories");
+        if (path.dirname(at) === at)
+            break;
+    }
+    outsideRepository(repoRoot, directory);
+    if (process.platform !== "win32")
+        fs.chmodSync(directory, 0o700);
 }
-
 /** The declared project owns a separate environment directory on the local machine. */
 export function materializedDirectory(repoRoot, environment, env, platform) {
-  let project;
-  const declaration = path.join(repoRoot, "hfs.json");
-  if (fs.existsSync(declaration))
-    project = JSON.parse(fs.readFileSync(declaration, "utf8")).project;
-  if (!project && fs.existsSync(path.join(repoRoot, "package.json")))
-    project = JSON.parse(
-      fs.readFileSync(path.join(repoRoot, "package.json"), "utf8"),
-    ).name;
-  project ||= path.basename(repoRoot);
-  if (
-    typeof project !== "string" ||
-    !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(project) ||
-    project === ".."
-  )
-    throw new Error("the project name must be a safe local directory name");
-  const directory = path.join(
-    secretRoots(env, platform).local,
-    project,
-    environment,
-  );
-  privateDirectory(repoRoot, directory);
-  return directory;
+    let project; // reason: read from parsed JSON on disk, checked to be a string below
+    const declaration = path.join(repoRoot, "hfs.json");
+    if (fs.existsSync(declaration))
+        project = JSON.parse(fs.readFileSync(declaration, "utf8")).project;
+    if (!project && fs.existsSync(path.join(repoRoot, "package.json")))
+        project = JSON.parse(fs.readFileSync(path.join(repoRoot, "package.json"), "utf8")).name;
+    project ||= path.basename(repoRoot);
+    if (typeof project !== "string" ||
+        !/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(project) ||
+        project === "..")
+        throw new Error("the project name must be a safe local directory name");
+    const directory = path.join(secretRoots(env, platform).local, project, environment);
+    privateDirectory(repoRoot, directory);
+    return directory;
 }
-
 /** Atomically publish one KEY file; an existing link or hard link is never overwritten. */
 export function writeSecretFile(directory, key, value) {
-  const file = path.join(directory, key);
-  try {
-    const stat = fs.lstatSync(file);
-    if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1)
-      throw new Error("a private KEY file must be an ordinary file");
-  } catch (error) {
-    if (error.code !== "ENOENT") throw error;
-  }
-  const temporary = path.join(directory, `.${key}-${randomUUID()}.tmp`);
-  try {
-    fs.writeFileSync(temporary, value, {
-      flag: "wx",
-      mode: 0o600,
-      flush: true,
-    });
-    fs.renameSync(temporary, file);
-    if (process.platform !== "win32") fs.chmodSync(file, 0o600);
-  } finally {
-    if (fs.existsSync(temporary)) fs.unlinkSync(temporary);
-  }
-  return file;
+    const file = path.join(directory, key);
+    try {
+        const stat = fs.lstatSync(file);
+        if (!stat.isFile() || stat.isSymbolicLink() || stat.nlink !== 1)
+            throw new Error("a private KEY file must be an ordinary file");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    const temporary = path.join(directory, `.${key}-${randomUUID()}.tmp`);
+    try {
+        fs.writeFileSync(temporary, value, {
+            flag: "wx",
+            mode: 0o600,
+            flush: true,
+        });
+        fs.renameSync(temporary, file);
+        if (process.platform !== "win32")
+            fs.chmodSync(file, 0o600);
+    }
+    finally {
+        if (fs.existsSync(temporary))
+            fs.unlinkSync(temporary);
+    }
+    return file;
 }
-
 /**
  * The main checkout of a git worktree (its `.git` file names `<main>/.git/worktrees/<name>`), else `root` itself: a worktree
  * keeps no git-ignored `.claude/secret.env` of its own, so the app's age identity is read from the checkout it was cut from.
  */
 export function mainCheckout(root) {
-  const dotGit = path.join(root, ".git");
-  const stat = fs.lstatSync(dotGit, { throwIfNoEntry: false });
-  if (!stat?.isFile()) return root;
-  const gitdir = /^gitdir:\s*(.+)$/mu
-    .exec(fs.readFileSync(dotGit, "utf8"))?.[1]
-    ?.trim()
-    .replaceAll("\\", "/");
-  const main = gitdir && /^(.*)\/\.git\/worktrees\/[^/]+$/u.exec(gitdir)?.[1];
-  return main && fs.existsSync(main) ? path.resolve(main) : root;
+    const dotGit = path.join(root, ".git");
+    const stat = fs.lstatSync(dotGit, { throwIfNoEntry: false });
+    if (!stat?.isFile())
+        return root;
+    const gitdir = /^gitdir:\s*(.+)$/mu
+        .exec(fs.readFileSync(dotGit, "utf8"))?.[1]
+        ?.trim()
+        .replaceAll("\\", "/");
+    const main = gitdir && /^(.*)\/\.git\/worktrees\/[^/]+$/u.exec(gitdir)?.[1];
+    return main && fs.existsSync(main) ? path.resolve(main) : root;
 }