@thegitai/cli 1.0.0-beta.9 → 1.0.0-preview.2

package/dist/src/executor.js

@@ -1,11 +1,25 @@
-import chalk from 'chalk';
-import * as pty from '@homebridge/node-pty-prebuilt-multiarch';
+import chalk from './colors.js';
 import { execFileSync, spawn } from 'child_process';
 import { existsSync, statSync } from 'fs';
+import { createRequire } from 'node:module';
 import os from 'os';
 import path from 'path';
 import { ARTIFACT_INSPECT_BLOCK_DIRS, getBlockedArtifactInspectDir, relativeProjectPath, } from './artifact-policy.js';
 import { emitCommandOutput, isTuiMode } from './runtime-mode.js';
+import { ensureSessionScratchDir, isInsideTheGitAiScratch, sessionScratchDir, } from './scratch-dir.js';
+const requireFromHere = createRequire(import.meta.url);
+let nodePtyCache;
+function loadNodePty() {
+    if (nodePtyCache !== undefined)
+        return nodePtyCache;
+    try {
+        nodePtyCache = requireFromHere('@lydell/node-pty');
+    }
+    catch {
+        nodePtyCache = null;
+    }
+    return nodePtyCache;
+}
 const COMMON_TOOLCHAIN_BIN_DIRS = ['/usr/local/go/bin'];
 function detectVenvBin(dir) {
     for (const name of ['.venv', 'venv', 'env']) {
@@ -204,6 +218,7 @@ function isExistingDirectory(absPath) {
         return false;
     }
 }
+const OS_TEMP_BLOCK_MARKER = 'os-temp:';
 function getBlockedOsTempInspection(rawToken, rootDir) {
     const token = normalizeToken(rawToken);
     if (!token || !path.isAbsolute(token))
@@ -211,6 +226,8 @@ function getBlockedOsTempInspection(rawToken, rootDir) {
     const resolved = path.resolve(token);
     if (!isInsideOsTemp(resolved))
         return null;
+    if (isInsideTheGitAiScratch(resolved))
+        return null;
     if (rootDir) {
         const resolvedRoot = path.resolve(rootDir);
         if (resolved === resolvedRoot ||
@@ -221,7 +238,7 @@ function getBlockedOsTempInspection(rawToken, rootDir) {
     if (resolved === path.resolve(os.tmpdir()) ||
         hasPathGlob(token) ||
         isExistingDirectory(resolved)) {
-        return path.basename(os.tmpdir()) || os.tmpdir();
+        return `${OS_TEMP_BLOCK_MARKER}${path.basename(os.tmpdir()) || os.tmpdir()}`;
     }
     return null;
 }
@@ -237,6 +254,9 @@ function findBlockedDirForToken(rawToken, rootDir, baseDir, allowBareDirMatch =
         const resolved = path.isAbsolute(token)
             ? path.resolve(token)
             : path.resolve(baseDir ?? rootDir, token);
+        const osTempResolved = getBlockedOsTempInspection(resolved, rootDir);
+        if (osTempResolved)
+            return osTempResolved;
         return getBlockedProjectPathDir(resolved, rootDir);
     }
     if (!allowBareDirMatch || !BLOCKED_PATH_INSPECT_DIRS.has(token)) {
@@ -373,11 +393,16 @@ function findBlockedDirInCommandTokens(command, rootDir, baseDir) {
     }
     return null;
 }
+function expandTempEnvRefs(command) {
+    return command
+        .replace(/\$\{THEGITAI_SCRATCH_DIR[^}]*\}|\$THEGITAI_SCRATCH_DIR\b/g, sessionScratchDir())
+        .replace(/\$\{TMPDIR[^}]*\}|\$TMPDIR\b/g, process.env.TMPDIR || os.tmpdir());
+}
 function findIgnoredPathInspection(command, rootDir) {
     if (!FILE_INSPECTION_COMMAND_PATTERN.test(command)) {
         return null;
     }
-    const haystack = maskNonPathIgnoreDirTokens(maskHereDocumentBodies(command));
+    const haystack = maskNonPathIgnoreDirTokens(maskHereDocumentBodies(expandTempEnvRefs(command)));
     const baseDir = getCommandBaseDir(haystack, rootDir);
     const blockedDir = findBlockedDirInCommandTokens(haystack, rootDir, baseDir);
     if (blockedDir) {
@@ -434,7 +459,7 @@ function shouldDropOutputLine(line, rootDir, baseDir) {
 function isLsDirectoryHeader(line) {
     return /^\.?\/?.+:$/.test(line) && !line.includes(' ');
 }
-function sanitizeCommandText(command, text, rootDir) {
+export function sanitizeCommandText(command, text, rootDir) {
     if (!text)
         return '';
     const lines = text.split('\n');
@@ -509,7 +534,7 @@ export function cancelActiveCommand() {
         cancelled: true,
     });
 }
-function terminateChild(child, signal) {
+export function terminateChild(child, signal) {
     if (!child?.pid)
         return;
     if (process.platform === 'win32') {
@@ -537,10 +562,17 @@ function terminateChild(child, signal) {
     }
 }
 export function getBlockedPathInspectDir(command, rootDir) {
-    return findIgnoredPathInspection(command, rootDir);
+    const blocked = findIgnoredPathInspection(command, rootDir);
+    return blocked?.startsWith(OS_TEMP_BLOCK_MARKER)
+        ? blocked.slice(OS_TEMP_BLOCK_MARKER.length)
+        : blocked;
 }
 export function getBlockedCommandReason(command, hasTimeout, rootDir) {
     const ignoredDir = findIgnoredPathInspection(command, rootDir);
+    if (ignoredDir?.startsWith(OS_TEMP_BLOCK_MARKER)) {
+        const tempName = ignoredDir.slice(OS_TEMP_BLOCK_MARKER.length);
+        return `Listing or scanning the shared OS temp directory (${tempName}) is blocked because it can contain other users' and processes' files. Use the session scratch directory ${ensureSessionScratchDir()} for temporary scripts and files — creating, running, and listing are all allowed there — or reference an exact file path.`;
+    }
     if (ignoredDir) {
         return `Command inspects an off-limits generated or dependency directory (${ignoredDir}). Avoid that path.`;
     }
@@ -559,7 +591,7 @@ export function getBlockedCommandReason(command, hasTimeout, rootDir) {
     }
     return null;
 }
-function commandUsesSudo(command) {
+export function commandUsesSudo(command) {
     return /\bsudo\b/.test(getUnquotedShellText(command));
 }
 export function sudoPromptFromTail(text) {
@@ -587,7 +619,7 @@ function redactSecrets(text, secrets) {
     }
     return redacted;
 }
-function buildCommandEnv(cwd) {
+export function buildCommandEnv(cwd) {
     const venvBin = detectVenvBin(cwd);
     const envPath = buildCommandPath(process.env.PATH, venvBin ? [venvBin] : []);
     return {
@@ -602,12 +634,13 @@ function buildCommandEnv(cwd) {
         npm_config_fund: 'false',
         npm_config_audit: 'false',
         NUXI_INIT_SKIP_PROMPT: 'true',
+        THEGITAI_SCRATCH_DIR: ensureSessionScratchDir(),
     };
 }
 function sanitizePtyOutput(command, output, cwd, secrets) {
     return sanitizeCommandText(command, stripSudoPromptText(redactSecrets(output, secrets)), cwd);
 }
-async function runPtyCommand(command, cwd, effectiveTimeout, exploratory, requestSudoPassword) {
+async function runPtyCommand(command, cwd, effectiveTimeout, exploratory, requestSudoPassword, nodePty) {
     return new Promise((resolve) => {
         let output = '';
         let timedOut = false;
@@ -623,7 +656,7 @@ async function runPtyCommand(command, cwd, effectiveTimeout, exploratory, reques
         const args = process.platform === 'win32'
             ? ['/d', '/s', '/c', command]
             : ['-lc', command];
-        const child = pty.spawn(shell, args, {
+        const child = nodePty.spawn(shell, args, {
             cols: 120,
             rows: 30,
             cwd,
@@ -776,7 +809,10 @@ export async function runCommand(command, cwd, { requestSudoPassword, timeout, }
     }
     const exploratory = isExploratoryCommand(command);
     if (requestSudoPassword && commandUsesSudo(command)) {
-        return runPtyCommand(command, cwd, effectiveTimeout, exploratory, requestSudoPassword);
+        const nodePty = loadNodePty();
+        if (nodePty) {
+            return runPtyCommand(command, cwd, effectiveTimeout, exploratory, requestSudoPassword, nodePty);
+        }
     }
     return new Promise((resolve) => {
         let stdout = '';

package/dist/src/help-text.js

@@ -1,9 +1,5 @@
-import chalk from 'chalk';
+import chalk from './colors.js';
 import { getCliVersion, getPlatformTag } from './version.js';
-// The bound keys (Enter/Esc/Ctrl+C/Tab/arrows) are identical across platforms in
-// a terminal. The one thing that genuinely differs is the terminal's paste
-// shortcut, so surface the one for the host OS (right-click paste works
-// everywhere regardless).
 function pasteShortcutForPlatform() {
     switch (process.platform) {
         case 'darwin':
@@ -77,6 +73,10 @@ const HELP_MARKDOWN = [
     '- `/model` — list supported models and pick one',
     '- `/model <id>` — switch the active model without clearing history',
     '- `/resume` — resume a saved session for this repo',
+    '- `/jobs` — manage long-running commands like dev servers and watchers:',
+    '  browse them, press Enter to expand one and read its output, k to stop it',
+    '- `/jobs output <id>` — print one job\'s full captured output',
+    '- `/jobs kill <id>` — stop one background job',
     '- `/clear` — clear the current conversation history',
     '- `/exit` — quit the session',
     '',
@@ -89,6 +89,12 @@ const HELP_MARKDOWN = [
     '  command and keeps the password masked and local.',
     '- `-y` / `--yes` at startup auto-approves every shell command and file',
     '  edit for the whole session — use with care.',
+    '- Long-running commands (e.g. dev servers) can run as managed background',
+    '  jobs after the same approval as any other command. Background output',
+    '  stays quiet once the model has responded; the footer shows only a compact',
+    '  shell-running indicator, `/jobs` lists, inspects, and kills jobs, and',
+    '  killed jobs disappear immediately. Every job is killed when the session',
+    '  ends.',
     '- File and shell operations are confined to the target repo root.',
     '- Sensitive directories (`.git`, `node_modules`, build output) are',
     '  never indexed.',
@@ -104,7 +110,6 @@ const HELP_MARKDOWN = [
     '  message — there is no client-side debug mode by design.',
 ].join('\n');
 export function formatAboutCard() {
-    // Fenced so the column alignment survives terminal markdown rendering.
     return [
         '```',
         'TheGitAI',

package/dist/src/markdown-renderer.js

@@ -1,4 +1,4 @@
-import chalk from 'chalk';
+import chalk from './colors.js';
 function renderInline(text) {
     const parts = String(text ?? '').split(/(`[^`]+`)/g);
     return parts

package/dist/src/patcher.js

@@ -1,8 +1,9 @@
-import chalk from 'chalk';
-import { existsSync, lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from 'fs';
+import chalk from './colors.js';
+import { chmodSync, closeSync, constants, existsSync, fchmodSync, fstatSync, ftruncateSync, lstatSync, mkdirSync, openSync, readFileSync, realpathSync, unlinkSync, writeFileSync, } from 'fs';
 import path from 'path';
 import { createInterface } from 'readline';
 import { runCommand } from './executor.js';
+import { ensureSessionScratchDir, isInsideTheGitAiScratch, isWithinSessionScratchDir, } from './scratch-dir.js';
 import { isTuiMode } from './runtime-mode.js';
 import { truncate } from './utils.js';
 function parseUnifiedDiff(patchText) {
@@ -143,17 +144,92 @@ export function renderDiffPreview(filePath, patchText) {
 function normalizeRoot(rootDir) {
     return path.resolve(rootDir);
 }
-export function resolveProjectPath(rootDir, filePath) {
+function expandScratchPath(filePath) {
+    const match = filePath.match(/^(?:\$THEGITAI_SCRATCH_DIR|\$\{THEGITAI_SCRATCH_DIR\})(?:[\\/](.*))?$/);
+    if (!match)
+        return filePath;
+    const root = ensureSessionScratchDir();
+    return match[1] ? path.join(root, match[1]) : root;
+}
+export function classifyProjectPath(rootDir, filePath) {
     const absRoot = normalizeRoot(rootDir);
-    const absPath = path.resolve(absRoot, filePath);
+    const absPath = path.resolve(absRoot, expandScratchPath(filePath));
+    if (isWithinSessionScratchDir(absPath)) {
+        return absPath !== path.resolve(ensureSessionScratchDir()) &&
+            isInsideTheGitAiScratch(absPath)
+            ? 'scratch'
+            : 'outside';
+    }
     const relative = path.relative(absRoot, absPath);
-    if (relative.startsWith('..') || path.isAbsolute(relative)) {
-        throw new Error(`Refusing to access path outside the project root: ${filePath}`);
+    if (!relative.startsWith('..') && !path.isAbsolute(relative)) {
+        return 'project';
+    }
+    return 'outside';
+}
+export function resolveProjectPath(rootDir, filePath) {
+    const absRoot = normalizeRoot(rootDir);
+    const absPath = path.resolve(absRoot, expandScratchPath(filePath));
+    if (classifyProjectPath(rootDir, filePath) === 'outside') {
+        throw new Error(`Refusing to access path outside the project root: ${filePath}. Allowed locations are the project root and the session scratch directory ($THEGITAI_SCRATCH_DIR).`);
     }
     return absPath;
 }
+function mkdirForWrite(absPath, scratchPath) {
+    const parent = path.dirname(absPath);
+    if (!scratchPath) {
+        mkdirSync(parent, { recursive: true });
+        return;
+    }
+    const scratchRoot = path.resolve(ensureSessionScratchDir());
+    const relative = path.relative(scratchRoot, parent);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+        throw new Error(`Refusing to create a directory outside the session scratch root: ${parent}`);
+    }
+    let current = scratchRoot;
+    for (const segment of relative.split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        try {
+            mkdirSync(current, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error?.code !== 'EEXIST')
+                throw error;
+        }
+        const stat = lstatSync(current);
+        if (stat.isSymbolicLink() || !stat.isDirectory()) {
+            throw new Error(`Refusing to traverse unsafe scratch directory: ${current}`);
+        }
+        if (process.platform !== 'win32')
+            chmodSync(current, 0o700);
+    }
+}
+function writeScratchFile(absPath, content) {
+    const scratchRoot = realpathSync(ensureSessionScratchDir());
+    const parent = realpathSync(path.dirname(absPath));
+    const relativeParent = path.relative(scratchRoot, parent);
+    if (relativeParent.startsWith('..') || path.isAbsolute(relativeParent)) {
+        throw new Error(`Refusing to write through an unsafe scratch directory: ${absPath}`);
+    }
+    const verifiedPath = path.join(parent, path.basename(absPath));
+    const noFollow = typeof constants.O_NOFOLLOW === 'number' ? constants.O_NOFOLLOW : 0;
+    const fd = openSync(verifiedPath, constants.O_WRONLY | constants.O_CREAT | noFollow, 0o600);
+    try {
+        const stat = fstatSync(fd);
+        if (!stat.isFile() || stat.nlink > 1) {
+            throw new Error(`Refusing to write an unsafe scratch file: ${absPath}`);
+        }
+        ftruncateSync(fd, 0);
+        if (process.platform !== 'win32')
+            fchmodSync(fd, 0o600);
+        writeFileSync(fd, content);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
 export function writeProjectFile(rootDir, filePath, content) {
     const absPath = resolveProjectPath(rootDir, filePath);
+    const scratchPath = classifyProjectPath(rootDir, filePath) === 'scratch';
     if (existsSync(absPath)) {
         try {
             const existingContent = readFileSync(absPath, 'utf-8');
@@ -162,15 +238,20 @@ export function writeProjectFile(rootDir, filePath, content) {
             }
         }
         catch {
-            // If we can't read it for some reason, proceed with write
         }
     }
-    mkdirSync(path.dirname(absPath), { recursive: true });
-    writeFileSync(absPath, content, 'utf-8');
+    mkdirForWrite(absPath, scratchPath);
+    if (scratchPath) {
+        writeScratchFile(absPath, content);
+    }
+    else {
+        writeFileSync(absPath, content, 'utf-8');
+    }
     return { absPath, changed: true };
 }
 export function writeProjectFileBuffer(rootDir, filePath, content) {
     const absPath = resolveProjectPath(rootDir, filePath);
+    const scratchPath = classifyProjectPath(rootDir, filePath) === 'scratch';
     if (existsSync(absPath)) {
         try {
             const existingContent = readFileSync(absPath);
@@ -179,11 +260,15 @@ export function writeProjectFileBuffer(rootDir, filePath, content) {
             }
         }
         catch {
-            // If we can't read it for some reason, proceed with write
         }
     }
-    mkdirSync(path.dirname(absPath), { recursive: true });
-    writeFileSync(absPath, content);
+    mkdirForWrite(absPath, scratchPath);
+    if (scratchPath) {
+        writeScratchFile(absPath, content);
+    }
+    else {
+        writeFileSync(absPath, content);
+    }
     return { absPath, changed: true };
 }
 export function deleteProjectFile(rootDir, filePath) {

package/dist/src/project-orientation.js

@@ -0,0 +1,99 @@
+import { closeSync, constants, fstatSync, lstatSync, openSync, readdirSync, readFileSync, } from 'node:fs';
+import path from 'node:path';
+import { shouldIgnoreArtifactPath } from './artifact-policy.js';
+const MAX_TOP_LEVEL_ENTRIES = 80;
+const MAX_DECLARED_TASKS = 40;
+const MAX_NAME_CHARS = 120;
+const MAX_PACKAGE_JSON_BYTES = 1024 * 1024;
+function normalizeName(value) {
+    if (typeof value !== 'string')
+        return null;
+    const normalized = value
+        .replace(/[\u0000-\u001f\u007f]/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim()
+        .slice(0, MAX_NAME_CHARS);
+    return normalized || null;
+}
+function normalizeNames(value, limit) {
+    if (!Array.isArray(value))
+        return [];
+    const names = [];
+    const seen = new Set();
+    for (const item of value) {
+        const name = normalizeName(item);
+        if (!name || seen.has(name))
+            continue;
+        seen.add(name);
+        names.push(name);
+        if (names.length >= limit)
+            break;
+    }
+    return names;
+}
+function readPackageTasks(rootDir) {
+    const packagePath = path.join(rootDir, 'package.json');
+    let fd = null;
+    try {
+        const pathStat = lstatSync(packagePath);
+        if (pathStat.isSymbolicLink() ||
+            !pathStat.isFile() ||
+            pathStat.nlink > 1 ||
+            pathStat.size > MAX_PACKAGE_JSON_BYTES) {
+            return [];
+        }
+        const noFollow = typeof constants.O_NOFOLLOW === 'number' ? constants.O_NOFOLLOW : 0;
+        fd = openSync(packagePath, constants.O_RDONLY | noFollow);
+        const fileStat = fstatSync(fd);
+        if (!fileStat.isFile() ||
+            fileStat.nlink > 1 ||
+            fileStat.size > MAX_PACKAGE_JSON_BYTES ||
+            fileStat.dev !== pathStat.dev ||
+            fileStat.ino !== pathStat.ino) {
+            return [];
+        }
+        const parsed = JSON.parse(readFileSync(fd, 'utf8'));
+        if (!parsed?.scripts || typeof parsed.scripts !== 'object')
+            return [];
+        return normalizeNames(Object.keys(parsed.scripts), MAX_DECLARED_TASKS);
+    }
+    catch {
+        return [];
+    }
+    finally {
+        if (fd !== null)
+            closeSync(fd);
+    }
+}
+export function normalizeProjectOrientation(value) {
+    if (!value || typeof value !== 'object')
+        return null;
+    const record = value;
+    const topLevelEntries = normalizeNames(record.topLevelEntries, MAX_TOP_LEVEL_ENTRIES);
+    const packageScripts = normalizeNames(record.packageScripts, MAX_DECLARED_TASKS);
+    if (topLevelEntries.length === 0 && packageScripts.length === 0)
+        return null;
+    return {
+        topLevelEntries,
+        packageScripts,
+        truncated: record.truncated === true,
+    };
+}
+export function collectProjectOrientation(rootDir) {
+    try {
+        const entries = readdirSync(rootDir, { withFileTypes: true })
+            .filter((entry) => !shouldIgnoreArtifactPath(entry.name))
+            .sort((a, b) => a.name.localeCompare(b.name));
+        const topLevelEntries = entries
+            .slice(0, MAX_TOP_LEVEL_ENTRIES)
+            .map((entry) => `${entry.name}${entry.isDirectory() ? '/' : ''}`);
+        return normalizeProjectOrientation({
+            topLevelEntries,
+            packageScripts: readPackageTasks(rootDir),
+            truncated: entries.length > MAX_TOP_LEVEL_ENTRIES,
+        });
+    }
+    catch {
+        return null;
+    }
+}

package/dist/src/scanner.js

@@ -1,14 +1,12 @@
 import { execSync } from 'child_process';
-import { readFileSync, statSync } from 'fs';
-import { glob } from 'glob';
+import { readdirSync, readFileSync, statSync } from 'fs';
 import path from 'path';
 import { getNodePrimarySignature, getStructuralChildren, parseRepoSource, } from './tree-sitter-runtime.js';
-import { ARTIFACT_FALLBACK_IGNORE_GLOBS, ARTIFACT_IGNORE_DIRS, ARTIFACT_IGNORE_FILES, ARTIFACT_INSPECT_BLOCK_DIRS, BINARY_ARTIFACT_EXTENSIONS, isSensitiveProjectPath, shouldIgnoreArtifactPath, } from './artifact-policy.js';
+import { ARTIFACT_IGNORE_DIRS, ARTIFACT_IGNORE_FILES, ARTIFACT_INSPECT_BLOCK_DIRS, BINARY_ARTIFACT_EXTENSIONS, isSensitiveProjectPath, shouldIgnoreArtifactPath, } from './artifact-policy.js';
 const BINARY_EXTENSIONS = BINARY_ARTIFACT_EXTENSIONS;
 const ALWAYS_IGNORE_FILES = ARTIFACT_IGNORE_FILES;
 export const ALWAYS_IGNORE_DIRS = ARTIFACT_IGNORE_DIRS;
 export const BLOCKED_PATH_INSPECT_DIRS = ARTIFACT_INSPECT_BLOCK_DIRS;
-const FALLBACK_IGNORE = ARTIFACT_FALLBACK_IGNORE_GLOBS;
 export const SCANNER_MAX_SOURCE_FILE_BYTES = 100 * 1024;
 const MAX_FILE_SIZE = SCANNER_MAX_SOURCE_FILE_BYTES;
 const MAX_CHUNKS = 2000;
@@ -29,16 +27,56 @@ function getFiles(rootDir, { limit = Infinity } = {}) {
         return Number.isFinite(limit) ? files.slice(0, limit) : files;
     }
     catch {
-        return glob
-            .sync('**/*', {
-            cwd: rootDir,
-            nodir: true,
-            dot: false,
-            ignore: FALLBACK_IGNORE,
-        })
-            .slice(0, Number.isFinite(limit) ? limit : undefined);
+        return walkProjectFilesFallback(rootDir, Number.isFinite(limit) ? limit : Infinity);
     }
 }
+const FALLBACK_LOCKFILES = new Set([
+    'package-lock.json',
+    'yarn.lock',
+    'pnpm-lock.yaml',
+]);
+function isFallbackIgnoredFile(relPath, fileName) {
+    if (shouldIgnorePath(relPath))
+        return true;
+    if (fileName.endsWith('.lock'))
+        return true;
+    return FALLBACK_LOCKFILES.has(fileName);
+}
+function walkProjectFilesFallback(rootDir, limit) {
+    const results = [];
+    const visit = (relDir) => {
+        if (results.length >= limit)
+            return;
+        let entries;
+        try {
+            entries = readdirSync(path.join(rootDir, relDir), {
+                withFileTypes: true,
+            });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (results.length >= limit)
+                return;
+            const name = entry.name;
+            if (name.startsWith('.'))
+                continue;
+            const relPath = relDir ? `${relDir}/${name}` : name;
+            if (entry.isDirectory()) {
+                if (ALWAYS_IGNORE_DIRS.has(name) || shouldIgnoreArtifactPath(relPath)) {
+                    continue;
+                }
+                visit(relPath);
+            }
+            else if (entry.isFile() && !isFallbackIgnoredFile(relPath, name)) {
+                results.push(relPath);
+            }
+        }
+    };
+    visit('');
+    return results;
+}
 function shouldSkipFile(relPath, stat) {
     if (shouldIgnorePath(relPath))
         return true;

package/dist/src/scratch-dir.js

@@ -0,0 +1,75 @@
+import { chmodSync, lstatSync, mkdtempSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+const scratchDirs = new Map();
+let activeSessionId = 'default';
+export function setScratchSession(sessionId) {
+    activeSessionId = String(sessionId ?? '').trim() || 'default';
+}
+function allocateSessionScratchDir() {
+    const dir = mkdtempSync(path.join(os.tmpdir(), 'thegitai-'));
+    scratchDirs.set(activeSessionId, dir);
+    return dir;
+}
+export function sessionScratchDir() {
+    return scratchDirs.get(activeSessionId) ?? allocateSessionScratchDir();
+}
+function isOwnedDirectory(dir) {
+    try {
+        const st = lstatSync(dir);
+        if (st.isSymbolicLink() || !st.isDirectory())
+            return false;
+        if (process.platform !== 'win32' &&
+            typeof process.getuid === 'function' &&
+            st.uid !== process.getuid()) {
+            return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function ensureSessionScratchDir() {
+    let dir = sessionScratchDir();
+    if (!isOwnedDirectory(dir)) {
+        dir = allocateSessionScratchDir();
+    }
+    if (process.platform !== 'win32') {
+        chmodSync(dir, 0o700);
+    }
+    return dir;
+}
+function hasUnsafeScratchComponent(root, relativePath) {
+    let current = root;
+    for (const segment of relativePath.split(path.sep).filter(Boolean)) {
+        current = path.join(current, segment);
+        try {
+            const stat = lstatSync(current);
+            if (stat.isSymbolicLink())
+                return true;
+            if (stat.isDirectory())
+                continue;
+            if (!stat.isFile() || stat.nlink > 1)
+                return true;
+        }
+        catch (error) {
+            return error?.code !== 'ENOENT';
+        }
+    }
+    return false;
+}
+export function isWithinSessionScratchDir(absPath) {
+    const root = path.resolve(ensureSessionScratchDir());
+    const resolved = path.resolve(absPath);
+    const relative = path.relative(root, resolved);
+    return !relative.startsWith('..') && !path.isAbsolute(relative);
+}
+export function isInsideTheGitAiScratch(absPath) {
+    const root = path.resolve(ensureSessionScratchDir());
+    const resolved = path.resolve(absPath);
+    const relative = path.relative(root, resolved);
+    if (!isWithinSessionScratchDir(resolved))
+        return false;
+    return !hasUnsafeScratchComponent(root, relative);
+}

package/dist/src/secret-preview.js

@@ -6,11 +6,7 @@ const PRIVATE_KEY_REDACTION = '[REDACTED: private key]';
 const SENSITIVE_JSON_KEY_PATTERN = /^(?:private[_-]?key|secret|api[_-]?key|password|client_secret|refresh_token|access_token|id_token|auth_provider_x509_cert_url)$/i;
 const PEM_BLOCK_PATTERN = /-----BEGIN [^-]*(?:PRIVATE KEY|SECRET KEY|OPENSSH PRIVATE KEY)[\s\S]*?-----END [^-]*(?:PRIVATE KEY|SECRET KEY|OPENSSH PRIVATE KEY)-----/gi;
 const PEM_SECRET_PATH_PATTERN = /\.(?:pem|key)$/i;
-// Password embedded in a connection-string URL, e.g.
-// `postgresql://user:PASS@host`. Redacted from shell output so secrets in
-// commands like `cat .env` do not leak into history or telemetry.
 const URL_CREDENTIALS_PATTERN = /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)([^\s/@]+)(@)/gi;
-/** Redact only userinfo passwords in connection-string URLs (zero false positives). */
 export function redactConnectionStringCredentials(text) {
     return text.replace(URL_CREDENTIALS_PATTERN, (_match, prefix, _password, at) => `${prefix}${VALUE_REDACTION}${at}`);
 }
@@ -72,12 +68,6 @@ export function isDotenvLikePath(value) {
     const base = path.posix.basename(text.replace(/\\/g, '/'));
     return DOTENV_BASENAME_PATTERN.test(base);
 }
-/**
- * True only for a clean dotenv file we can safely show with keys visible and
- * values tokenized: no PEM block, not JSON, and every non-blank/non-comment line
- * is a `KEY=VALUE` assignment. Anything ambiguous (a stray line that might be a
- * raw secret) returns false so the caller keeps the opaque blackout instead.
- */
 export function looksLikeEditableDotenv(content) {
     PEM_BLOCK_PATTERN.lastIndex = 0;
     if (PEM_BLOCK_PATTERN.test(content))