@wenrwa/marketplace-cli 0.6.6 → 0.7.0

package/dist/__tests__/bridge-park-remove-frame.test.js

@@ -349,4 +349,65 @@ describe('relay client — park-remove frame (hcs-06)', () => {
             await closeRelay(relay.wss);
         }
     });
+    it('park-save backs up and KEEPS the checkout: committing, pushing, then a saved result — no remove', async () => {
+        const relay = await startFakeRelay();
+        const sessions = new sessionManager_1.SessionManager(makeFactory());
+        const gitFixture = makeGitFixture();
+        const reclaimFs = makeReclaimFsFixture([`${REPOS}/ws-1`]);
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions,
+            enableReclaim: true,
+            reposBaseDir: REPOS,
+            checkoutReclaimDeps: reclaimFs,
+            enableParkAndRemove: true,
+            checkoutParkAndRemoveDeps: { exists: reclaimFs.exists, run: gitFixture.run },
+        });
+        try {
+            const ws = await relay.nextConnection();
+            const q = frameQueue(ws);
+            await q.next(); // auth
+            ws.send(JSON.stringify({ t: 'park-save', workspaceId: 'ws-1' }));
+            expect(await q.next()).toMatchObject({ t: 'park-remove-progress', phase: 'committing' });
+            expect(await q.next()).toMatchObject({ t: 'park-remove-progress', phase: 'pushing' });
+            expect(await q.next()).toMatchObject({ t: 'park-remove-result', workspaceId: 'ws-1', outcome: 'saved', branch: 'park/ws-1' });
+            expect(reclaimFs.removed).toEqual([]);
+        }
+        finally {
+            handle.close();
+            await closeRelay(relay.wss);
+        }
+    });
+    it('inventory-scan re-scans and sends a fresh checkout-inventory frame', async () => {
+        const relay = await startFakeRelay();
+        const sessions = new sessionManager_1.SessionManager(makeFactory());
+        let lists = 0;
+        const handle = (0, relayClient_1.startRelayClient)({
+            relayUrl: `ws://127.0.0.1:${relay.port}`,
+            relayToken: 'tok',
+            sessions,
+            reportCheckoutInventory: true,
+            reposBaseDir: REPOS,
+            checkoutInventoryDeps: {
+                listCheckouts: () => { lists += 1; return []; },
+                statMtimeMs: () => 1,
+                sizeBytes: async () => 0,
+                run: async () => ({ stdout: '', code: 0 }),
+            },
+        });
+        try {
+            const ws = await relay.nextConnection();
+            const q = frameQueue(ws);
+            await q.next(); // auth
+            expect(await q.next()).toMatchObject({ t: 'checkout-inventory' }); // on-connect scan
+            ws.send(JSON.stringify({ t: 'inventory-scan' }));
+            expect(await q.next()).toEqual({ t: 'checkout-inventory', checkouts: [] });
+            expect(lists).toBe(2);
+        }
+        finally {
+            handle.close();
+            await closeRelay(relay.wss);
+        }
+    });
 });

package/dist/__tests__/bridge-relay-client-checkout-inventory.test.js

@@ -127,7 +127,7 @@ describe('relay client — checkout inventory scan never blocks connect (hcs-02
         const inventory = await q.next();
         expect(inventory).toEqual({
             t: 'checkout-inventory',
-            checkouts: [{ workspaceId: 'ws-a', unparseable: false, bytes: 4096, dirty: false, mtimeMs: 100 }],
+            checkouts: [{ workspaceId: 'ws-a', unparseable: false, bytes: 4096, dirty: false, mtimeMs: 100, dirtyKinds: [], noUpstream: false, scanVersion: 2 }],
         });
         handle.close();
         await closeRelay(relay.wss);

package/dist/__tests__/bridge-relay-mode.test.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const bridge_1 = require("../commands/bridge");
-describe('resolveRelayMode — CLI/env wiring for `wen-market bridge --relay`', () => {
+describe('resolveRelayMode — CLI/env wiring for `hiveop bridge --relay`', () => {
     it('no --relay flag and no RELAY_URL env → local mode', () => {
         expect((0, bridge_1.resolveRelayMode)({}, {})).toEqual({ mode: 'local' });
     });

package/dist/__tests__/bridge-server.test.js

@@ -182,7 +182,7 @@ describe('bridge WebSocket server', () => {
         });
         const before = await (await fetch(`http://127.0.0.1:${handle.port}/discovery`, { headers: { origin: ORIGIN } })).json();
         expect(before.localWorkspaces).toEqual([]);
-        // Simulate `wen-market local add` mutating the registry mid-run.
+        // Simulate `hiveop local add` mutating the registry mid-run.
         entries = [{ workspaceId: 'ws-1', name: 'my-app', path: 'my-app' }];
         const after = await (await fetch(`http://127.0.0.1:${handle.port}/discovery`, { headers: { origin: ORIGIN } })).json();
         expect(after.localWorkspaces).toEqual([{ workspaceId: 'ws-1', name: 'my-app', path: 'my-app' }]);

package/dist/__tests__/config.test.js

@@ -98,7 +98,7 @@ describe('requireConfig()', () => {
         (0, config_1.requireConfig)();
         expect(exitSpy).toHaveBeenCalledWith(1);
         const messages = errSpy.mock.calls.map(c => c.join(' ')).join('\n');
-        expect(messages).toContain('wen-market auth login');
+        expect(messages).toContain('hiveop auth login');
         exitSpy.mockRestore();
         errSpy.mockRestore();
     });

package/dist/__tests__/devices.test.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 /**
- * TDD — lws-03: `wen-market devices` list/revoke. Uses this machine's own
+ * TDD — lws-03: `hiveop devices` list/revoke. Uses this machine's own
  * Connect Token (bridge-config.json) — no interactive login required.
  */
 const chalk_1 = __importDefault(require("chalk"));

package/dist/__tests__/local.test.js

@@ -4,7 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 /**
- * TDD — lws-03: `wen-market local add/list/remove`. Folder→workspace
+ * TDD — lws-03: `hiveop local add/list/remove`. Folder→workspace
  * registry commands. Mocks the bridge config/apiClient/folderRegistry
  * modules — no real network, no real fs (prior art: workspace.test.ts).
  */

package/dist/__tests__/openBrowser.test.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 /**
- * TDD — wha-08: `wen-market auth login` tries to open the approval URL in a
+ * TDD — wha-08: `hiveop auth login` tries to open the approval URL in a
  * browser as best-effort convenience. The code + URL are always printed
  * regardless (works over SSH), so any failure here must be swallowed, never
  * surfaced. spawnFn is injectable so this never touches a real process.

package/dist/__tests__/websocket.test.js

@@ -117,7 +117,7 @@ describe('connectWebSocket() handshake (sio-07)', () => {
         err.data = { code: 'CREDENTIAL_INVALID' };
         fake.emit('connect_error', err);
         const printed = errorSpy.mock.calls.map((c) => c.join(' ')).join('\n');
-        expect(printed).toMatch(/wen-market auth login/);
+        expect(printed).toMatch(/hiveop auth login/);
         errorSpy.mockRestore();
     });
     it('shows a clear message and tells the user to log in again on SESSION_REVOKED', () => {
@@ -129,7 +129,7 @@ describe('connectWebSocket() handshake (sio-07)', () => {
         err.data = { code: 'SESSION_REVOKED' };
         fake.emit('connect_error', err);
         const printed = errorSpy.mock.calls.map((c) => c.join(' ')).join('\n');
-        expect(printed).toMatch(/wen-market auth login/);
+        expect(printed).toMatch(/hiveop auth login/);
         errorSpy.mockRestore();
     });
     it('falls back to a generic message for other connect errors', () => {
@@ -140,7 +140,7 @@ describe('connectWebSocket() handshake (sio-07)', () => {
         fake.emit('connect_error', new Error('ECONNREFUSED'));
         const printed = errorSpy.mock.calls.map((c) => c.join(' ')).join('\n');
         expect(printed).toContain('ECONNREFUSED');
-        expect(printed).not.toMatch(/wen-market auth login/);
+        expect(printed).not.toMatch(/hiveop auth login/);
         errorSpy.mockRestore();
     });
     it('subscribes to the requested channel on connect, unaffected by the auth change', () => {

package/dist/auth/identity.d.ts

@@ -1,5 +1,5 @@
 /**
- * wha-08 — the one authenticated call `wen-market auth login` (device flow,
+ * wha-08 — the one authenticated call `hiveop auth login` (device flow,
  * to print "Signed in as <name>") and `auth login --api-key` (CI, to verify
  * the key before saving it) both need. Sends the key as X-API-Key — never
  * X-Wallet-Pubkey, the retired header this whole PRD exists to remove.

package/dist/auth/login.d.ts

@@ -1,11 +1,11 @@
 /**
- * wha-08 — `wen-market auth login`: CLI browser login. Device-code pairing
+ * wha-08 — `hiveop auth login`: CLI browser login. Device-code pairing
  * (purpose=cli_login on the shared lws-14 mechanism), same GitHub-CLI /
  * Apple-TV pattern as bridge pairing (bridge/pairing.ts) — a code is minted,
  * printed with the approval URL, and polled until a human decides in the
  * browser.
  *
- * Deliberately NOT shared with bridge/pairing.ts: `wen-market pair` (bridge
+ * Deliberately NOT shared with bridge/pairing.ts: `hiveop pair` (bridge
  * pairing) must keep working byte-for-byte unchanged, and cli_login has an
  * outcome bridge pairing's loop never handles — the approval screen lets the
  * human DENY a CLI login, and this CLI needs to say so plainly rather than

package/dist/bridge/apiClient.js

@@ -27,12 +27,12 @@ exports.BridgeApiError = BridgeApiError;
  * machines) comes back PAT_FORBIDDEN with a route-allowlist message that
  * means nothing to an end user. Map it here, at the one place every bridge
  * API error is constructed, so EVERY call site (registerDevice, MCP
- * registration, local workspace create/delete, `wen-market devices`, ...)
+ * registration, local workspace create/delete, `hiveop devices`, ...)
  * gets the same actionable hint with no per-call-site plumbing.
  */
 function errorMessageFor(code, rawMessage, status) {
     if (code === 'PAT_FORBIDDEN') {
-        return 'your pairing is out of date — run `wen-market pair` again';
+        return 'your pairing is out of date — run `hiveop pair` again';
     }
     return rawMessage || `HTTP ${status}`;
 }

package/dist/bridge/autostart.d.ts

@@ -1,6 +1,6 @@
 /**
  * Bridge autostart (bct follow-up, 2026-07-30; PATH/pin fix, 2026-08-13) —
- * `wen-market bridge install`.
+ * `hiveop bridge install`.
  *
  * Turns the one-liner into one-time-EVER setup: a macOS LaunchAgent starts
  * the bridge at login and keeps it alive, so the Terminal pane always finds

package/dist/bridge/autostart.js

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Bridge autostart (bct follow-up, 2026-07-30; PATH/pin fix, 2026-08-13) —
- * `wen-market bridge install`.
+ * `hiveop bridge install`.
  *
  * Turns the one-liner into one-time-EVER setup: a macOS LaunchAgent starts
  * the bridge at login and keeps it alive, so the Terminal pane always finds

package/dist/bridge/checkoutInventory.d.ts

@@ -38,9 +38,6 @@
  * (Promise.all) per checkout, and why the whole scan is fire-and-forget from
  * relayClient's point of view.
  */
-/** `cmd args...` runner — same shape used across repoCheckout.ts /
- *  changesReport.ts's injected `run` (git invoked as `git -C <path> ...`,
- *  never via a shell cwd option, so this stays a flat argv runner). */
 export type InventoryRun = (cmd: string, args: string[]) => Promise<{
     stdout: string;
     code: number;
@@ -63,37 +60,71 @@ export interface CheckoutInventoryDeps {
     /** git runner, invoked as `run('git', ['-C', path, ...])` — see the module
      *  doc comment. */
     run: InventoryRun;
+    /** Reads a checkout file (CLAUDE.md, for the managed-region check).
+     *  Defaults to the real filesystem. */
+    readText?: ReadText;
 }
+/**
+ * Inventory format version. 2 (cli 0.6.9) adds `dirtyKinds`/`noUpstream`, a
+ * dirty check that ignores the bridge's own CLAUDE.md region, and the
+ * `park-save` / `inventory-scan` frames. Stamped on EVERY entry so the arena
+ * and backend can tell a box that understands Save from one that does not —
+ * an old bridge would treat an unknown frame as an error, never as a park.
+ */
+export declare const INVENTORY_SCAN_VERSION = 2;
+export type DirtyKind = 'uncommitted' | 'unpushed' | 'stashed';
 export interface ParsedCheckoutEntry {
     workspaceId: string;
     unparseable: false;
     bytes: number;
     dirty: boolean;
     mtimeMs: number;
+    /** Which of the three conditions made it dirty (empty when clean). */
+    dirtyKinds: DirtyKind[];
+    /** The branch tracks nothing (never pushed, or its remote branch is gone). */
+    noUpstream: boolean;
+    scanVersion: number;
 }
 export interface UnparseableCheckoutEntry {
     workspaceId: string;
     unparseable: true;
     reason: string;
+    scanVersion: number;
 }
 export type CheckoutInventoryEntry = ParsedCheckoutEntry | UnparseableCheckoutEntry;
+/** Reads a text file, or null when it cannot. Injected in tests. */
+export type ReadText = (absPath: string) => string | null;
+/** CLAUDE.md with the bridge's managed region (contextWriter.ts) cut out. */
+export declare function stripManagedRegion(text: string): string;
+export interface DirtyReport {
+    dirty: boolean;
+    kinds: DirtyKind[];
+    noUpstream: boolean;
+}
 /**
- * PRD "Dirty means" section: uncommitted changes (`git status --porcelain`
- * non-empty), unpushed commits (`git rev-list @{u}..HEAD --count` > 0), OR
- * stashes (`git stash list` non-empty) — any ONE independently marks the
- * checkout dirty. `status`/`stash` failing outright (non-zero exit) means the
- * directory isn't a usable git checkout at all — 'unparseable', not clean.
- * `rev-list @{u}..HEAD` failing is the ordinary "no upstream configured"
- * case (a branch with nothing to compare against) and is treated as simply
- * "not unpushed" rather than a parse failure — every real checkout has a
- * working `status`/`stash`, so those two staying reliable is what actually
- * distinguishes a healthy checkout from a broken one.
+ * PRD "Dirty means" section: uncommitted changes, unpushed commits, OR
+ * stashes — any ONE independently marks the checkout dirty.
  *
- * Exported (hcs-05) — checkoutReclaim.ts reuses this EXACT function for its
- * immediate-pre-delete dirty re-check, rather than reimplementing the three
- * conditions a second time. One dirty definition, two callers.
+ *   uncommitted — `git status --porcelain`, minus the bridge's own writes
+ *                 (isBridgeManagedChange).
+ *   unpushed    — commits on HEAD that no remote-tracking ref contains
+ *                 (`rev-list HEAD --not --remotes`). NOT `@{u}..HEAD`: that
+ *                 failed outright with no upstream, and counted work pushed
+ *                 to any other branch (a park branch included) as unpushed —
+ *                 so park-and-remove's own pre-delete re-check aborted every
+ *                 park that had committed something.
+ *   stashed     — `git stash list` non-empty.
+ *
+ * `status`/`stash` failing means the directory isn't a usable git checkout —
+ * 'unparseable', not clean.
+ */
+export declare function inspectDirty(path: string, run: InventoryRun, readText?: ReadText): Promise<DirtyReport | 'unparseable'>;
+/**
+ * The boolean form — checkoutReclaim.ts's immediate-pre-delete re-check uses
+ * this EXACT definition rather than reimplementing it. One dirty definition,
+ * every caller.
  */
-export declare function checkDirty(path: string, run: InventoryRun): Promise<boolean | 'unparseable'>;
+export declare function checkDirty(path: string, run: InventoryRun, readText?: ReadText): Promise<boolean | 'unparseable'>;
 /**
  * PURE full-inventory scan. One record per checkout under `reposBaseDir`; a
  * checkout that can't be read/parsed is reported as `unparseable: true`

package/dist/bridge/checkoutInventory.js

@@ -39,41 +39,178 @@
  * (Promise.all) per checkout, and why the whole scan is fire-and-forget from
  * relayClient's point of view.
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.INVENTORY_SCAN_VERSION = void 0;
+exports.stripManagedRegion = stripManagedRegion;
+exports.inspectDirty = inspectDirty;
 exports.checkDirty = checkDirty;
 exports.scanCheckoutInventory = scanCheckoutInventory;
 exports.createCheckoutInventoryReporter = createCheckoutInventoryReporter;
+/** `cmd args...` runner — same shape used across repoCheckout.ts /
+ *  changesReport.ts's injected `run` (git invoked as `git -C <path> ...`,
+ *  never via a shell cwd option, so this stays a flat argv runner). */
+const fs = __importStar(require("fs"));
+const contextWriter_1 = require("./contextWriter");
+/**
+ * Inventory format version. 2 (cli 0.6.9) adds `dirtyKinds`/`noUpstream`, a
+ * dirty check that ignores the bridge's own CLAUDE.md region, and the
+ * `park-save` / `inventory-scan` frames. Stamped on EVERY entry so the arena
+ * and backend can tell a box that understands Save from one that does not —
+ * an old bridge would treat an unknown frame as an error, never as a park.
+ */
+exports.INVENTORY_SCAN_VERSION = 2;
+const defaultReadText = (absPath) => {
+    try {
+        return fs.readFileSync(absPath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+};
+/** `run`, with a rejection folded into a non-zero exit. The production
+ *  runner (commands/bridge.ts execRunner) REJECTS on a failed command with no
+ *  stdout — the old dirty check let that escape, so a branch with no upstream
+ *  surfaced as "Could not read this checkout: Command failed: git … rev-list
+ *  @{u}..HEAD" instead of as a checkout with unpushed work. */
+async function tryRun(run, args) {
+    try {
+        return await run('git', args);
+    }
+    catch (err) {
+        return { stdout: err instanceof Error ? err.message : String(err), code: 1 };
+    }
+}
+/** CLAUDE.md with the bridge's managed region (contextWriter.ts) cut out. */
+function stripManagedRegion(text) {
+    const start = text.indexOf(contextWriter_1.CONTEXT_START_MARKER);
+    const end = text.indexOf(contextWriter_1.CONTEXT_END_MARKER);
+    if (start === -1 || end === -1 || end < start)
+        return text.trim();
+    return (text.slice(0, start) + text.slice(end + contextWriter_1.CONTEXT_END_MARKER.length)).trim();
+}
+/**
+ * Is this porcelain line the bridge's OWN write, not the user's work?
+ *
+ * The bridge rewrites a fenced region of `CLAUDE.md` every time a session
+ * opens (wmr-07) and keeps `.hiveop/` for itself. Counting either as "unsaved
+ * work" marked nearly every checkout dirty — owner report 2026-10-02: finished
+ * Practice match copies, all pushed, all "Unsaved work". Only the managed
+ * region is forgiven: any user text in CLAUDE.md still counts.
+ */
+async function isBridgeManagedChange(path, line, run, readText) {
+    const code = line.slice(0, 2);
+    const file = line.slice(3).trim().replace(/^"|"$/g, '');
+    if (file === '.hiveop' || file.startsWith('.hiveop/'))
+        return true;
+    if (file !== 'CLAUDE.md')
+        return false;
+    const working = readText(`${path}/CLAUDE.md`);
+    if (working === null)
+        return false;
+    const rest = stripManagedRegion(working);
+    if (code === '??')
+        return rest === '';
+    if (!/^[ M][ M]$/.test(code))
+        return false; // added/deleted/renamed — the user's
+    const head = await tryRun(run, ['-C', path, 'show', 'HEAD:CLAUDE.md']);
+    if (head.code !== 0)
+        return false;
+    return stripManagedRegion(head.stdout) === rest;
+}
 /**
- * PRD "Dirty means" section: uncommitted changes (`git status --porcelain`
- * non-empty), unpushed commits (`git rev-list @{u}..HEAD --count` > 0), OR
- * stashes (`git stash list` non-empty) — any ONE independently marks the
- * checkout dirty. `status`/`stash` failing outright (non-zero exit) means the
- * directory isn't a usable git checkout at all — 'unparseable', not clean.
- * `rev-list @{u}..HEAD` failing is the ordinary "no upstream configured"
- * case (a branch with nothing to compare against) and is treated as simply
- * "not unpushed" rather than a parse failure — every real checkout has a
- * working `status`/`stash`, so those two staying reliable is what actually
- * distinguishes a healthy checkout from a broken one.
+ * PRD "Dirty means" section: uncommitted changes, unpushed commits, OR
+ * stashes — any ONE independently marks the checkout dirty.
+ *
+ *   uncommitted — `git status --porcelain`, minus the bridge's own writes
+ *                 (isBridgeManagedChange).
+ *   unpushed    — commits on HEAD that no remote-tracking ref contains
+ *                 (`rev-list HEAD --not --remotes`). NOT `@{u}..HEAD`: that
+ *                 failed outright with no upstream, and counted work pushed
+ *                 to any other branch (a park branch included) as unpushed —
+ *                 so park-and-remove's own pre-delete re-check aborted every
+ *                 park that had committed something.
+ *   stashed     — `git stash list` non-empty.
  *
- * Exported (hcs-05) — checkoutReclaim.ts reuses this EXACT function for its
- * immediate-pre-delete dirty re-check, rather than reimplementing the three
- * conditions a second time. One dirty definition, two callers.
+ * `status`/`stash` failing means the directory isn't a usable git checkout —
+ * 'unparseable', not clean.
  */
-async function checkDirty(path, run) {
-    const status = await run('git', ['-C', path, 'status', '--porcelain']);
+async function inspectDirty(path, run, readText = defaultReadText) {
+    const status = await tryRun(run, ['-C', path, 'status', '--porcelain']);
     if (status.code !== 0)
         return 'unparseable';
-    const stash = await run('git', ['-C', path, 'stash', 'list']);
+    const stash = await tryRun(run, ['-C', path, 'stash', 'list']);
     if (stash.code !== 0)
         return 'unparseable';
-    const ahead = await run('git', ['-C', path, 'rev-list', '@{u}..HEAD', '--count']);
+    const lines = status.stdout.split('\n').filter((l) => l.trim().length > 0);
+    let uncommitted = false;
+    for (const line of lines) {
+        if (!(await isBridgeManagedChange(path, line, run, readText))) {
+            uncommitted = true;
+            break;
+        }
+    }
+    const ahead = await tryRun(run, ['-C', path, 'rev-list', 'HEAD', '--not', '--remotes', '--count']);
+    // A repo with no commits at all has no HEAD — nothing to push.
     const unpushed = ahead.code === 0 && parseInt(ahead.stdout.trim(), 10) > 0;
-    const uncommitted = status.stdout.trim().length > 0;
+    const upstream = await tryRun(run, ['-C', path, 'rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}']);
     const stashed = stash.stdout.trim().length > 0;
-    return uncommitted || unpushed || stashed;
+    const kinds = [];
+    if (uncommitted)
+        kinds.push('uncommitted');
+    if (unpushed)
+        kinds.push('unpushed');
+    if (stashed)
+        kinds.push('stashed');
+    return { dirty: kinds.length > 0, kinds, noUpstream: upstream.code !== 0 };
+}
+/**
+ * The boolean form — checkoutReclaim.ts's immediate-pre-delete re-check uses
+ * this EXACT definition rather than reimplementing it. One dirty definition,
+ * every caller.
+ */
+async function checkDirty(path, run, readText) {
+    const r = await inspectDirty(path, run, readText);
+    return r === 'unparseable' ? r : r.dirty;
 }
 async function scanOne(reposBaseDir, workspaceId, deps, cache) {
     const path = `${reposBaseDir}/${workspaceId}`;
+    const unparseable = (reason) => {
+        cache?.delete(workspaceId);
+        return { workspaceId, unparseable: true, reason, scanVersion: exports.INVENTORY_SCAN_VERSION };
+    };
     let mtimeMs;
     try {
         mtimeMs = deps.statMtimeMs(path);
@@ -81,37 +218,35 @@ async function scanOne(reposBaseDir, workspaceId, deps, cache) {
     catch {
         mtimeMs = null;
     }
-    if (mtimeMs === null) {
-        cache?.delete(workspaceId);
-        return { workspaceId, unparseable: true, reason: 'checkout directory is missing or unreadable' };
-    }
-    // Unchanged since the last scan — reuse the cached entry rather than
-    // re-running du/git for it (PRD: "Unchanged checkouts should not be
-    // re-scanned — cache keyed on mtime").
+    if (mtimeMs === null)
+        return unparseable('checkout directory is missing or unreadable');
+    // The SIZE is reused while the directory mtime is unchanged (PRD: "cache
+    // keyed on mtime" — `du` is the expensive half). The dirty state is NOT:
+    // a commit or a push lands inside .git and never touches the top-level
+    // mtime, so a cached dirty flag outlived the push that cleared it.
     const cached = cache?.get(workspaceId);
-    if (cached && cached.mtimeMs === mtimeMs) {
-        return cached;
-    }
     try {
         const [bytes, dirty] = await Promise.all([
-            deps.sizeBytes(path),
-            checkDirty(path, deps.run),
+            cached && cached.mtimeMs === mtimeMs ? Promise.resolve(cached.bytes) : deps.sizeBytes(path),
+            inspectDirty(path, deps.run, deps.readText),
         ]);
-        if (dirty === 'unparseable') {
-            cache?.delete(workspaceId);
-            return { workspaceId, unparseable: true, reason: 'git status failed — not a usable checkout' };
-        }
-        const entry = { workspaceId, unparseable: false, bytes, dirty, mtimeMs };
+        if (dirty === 'unparseable')
+            return unparseable('git status failed — not a usable checkout');
+        const entry = {
+            workspaceId,
+            unparseable: false,
+            bytes,
+            dirty: dirty.dirty,
+            mtimeMs,
+            dirtyKinds: dirty.kinds,
+            noUpstream: dirty.noUpstream,
+            scanVersion: exports.INVENTORY_SCAN_VERSION,
+        };
         cache?.set(workspaceId, entry);
         return entry;
     }
     catch (err) {
-        cache?.delete(workspaceId);
-        return {
-            workspaceId,
-            unparseable: true,
-            reason: err instanceof Error ? err.message : String(err),
-        };
+        return unparseable(err instanceof Error ? err.message : String(err));
     }
 }
 /**
@@ -149,10 +284,17 @@ async function scanCheckoutInventory(reposBaseDir, deps, cache) {
  */
 function createCheckoutInventoryReporter(opts) {
     let inFlight = false;
+    // A trigger that lands mid-scan (a Save finishing, the arena asking for a
+    // fresh report) is remembered and run ONCE after the current pass — the
+    // pass in flight may have read the checkout before the change, and dropping
+    // the request left the Storage view showing the old state for good.
+    let again = false;
     const cache = new Map();
     function trigger() {
-        if (inFlight)
-            return; // already running — not restarted
+        if (inFlight) {
+            again = true;
+            return;
+        } // not restarted — queued once
         inFlight = true;
         scanCheckoutInventory(opts.reposBaseDir, opts.deps, cache)
             .then((checkouts) => {
@@ -163,6 +305,10 @@ function createCheckoutInventoryReporter(opts) {
         })
             .finally(() => {
             inFlight = false;
+            if (again) {
+                again = false;
+                trigger();
+            }
         });
     }
     return { trigger };