cawdev-cli 1.0.3-beta → 1.0.5-beta

package/runner/auto-workspaces.mjs

@@ -0,0 +1,106 @@
+// Checkouts made on demand — a second coding session on a project starts at
+// once instead of waiting for the first one's checkout.
+//
+// R47 made a project's concurrency the number of its checkouts, and every one
+// had to be written into the config by hand. With `autoWorkspaces: N` in the
+// machine's config, the daemon makes up to N more itself when a coding run
+// would otherwise wait for "no free workspace": a CLONE beside the first
+// checkout, named `<first>-auto-<n>`. A clone and not a `git worktree`, on
+// purpose: the daemon resets a never-pushed branch by checking the default
+// branch out, and git refuses to check out a branch another worktree has —
+// two clones share nothing and cannot refuse each other anything.
+//
+// The clone is LOCAL — from the first checkout, which needs no credential and
+// copies objects instead of downloading them — and its `origin` is then put
+// back to the first checkout's own remote, so it pushes and fetches where
+// every checkout of the project does.
+//
+// Nothing here writes the config. The clones are found again by their NAME
+// (`discoverAutoWorkspaces`), at boot and on SIGHUP, so deleting one — the
+// attached terminal's `/drop`, or `rm -rf` — is the whole of removing it.
+// Configured checkouts are never touched: only a `-auto-<n>` directory is one
+// of these.
+
+import { spawn } from 'node:child_process';
+import { readdir, stat } from 'node:fs/promises';
+import { basename, dirname, join } from 'node:path';
+
+/** `<first>-auto-<n>`, and nothing else, is a checkout this module made. */
+export function autoNumberOf(first, path) {
+  const match = new RegExp(`^${escape(basename(first))}-auto-(\\d+)$`).exec(basename(path));
+  return match && dirname(path) === dirname(first) ? Number(match[1]) : null;
+}
+
+/** Whether `path` is a checkout made on demand for the project whose first checkout is `first`. */
+export function isAutoWorkspace(first, path) {
+  return autoNumberOf(first, path) !== null;
+}
+
+/** The next free `-auto-<n>` beside `first`, numbered from 2 — the first checkout is 1. */
+export function nextAutoWorkspace(first, existing) {
+  const taken = new Set(existing.map((path) => autoNumberOf(first, path)).filter((n) => n !== null));
+  let n = 2;
+  while (taken.has(n)) n += 1;
+  return join(dirname(first), `${basename(first)}-auto-${n}`);
+}
+
+function escape(text) {
+  return text.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+
+/** The on-demand checkouts that exist beside `first` right now, in number order. */
+export async function discoverAutoWorkspaces(first) {
+  let names;
+  try {
+    names = await readdir(dirname(first));
+  } catch {
+    return [];
+  }
+  const found = [];
+  for (const name of names) {
+    const path = join(dirname(first), name);
+    if (autoNumberOf(first, path) === null) continue;
+    const git = await stat(join(path, '.git')).catch(() => null);
+    if (git) found.push(path);
+  }
+  return found.sort((a, b) => autoNumberOf(first, a) - autoNumberOf(first, b));
+}
+
+function run(cwd, args) {
+  return new Promise((done, fail) => {
+    const child = spawn('git', args, {
+      cwd,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      env: { ...process.env, GIT_TERMINAL_PROMPT: '0' },
+    });
+    let out = '';
+    let err = '';
+    child.stdout.on('data', (chunk) => (out += chunk));
+    child.stderr.on('data', (chunk) => (err += chunk));
+    child.on('error', fail);
+    child.on('close', (code) => (code === 0
+      ? done(out.trim())
+      : fail(new Error(`git ${args.join(' ')} failed: ${err.trim() || `exit ${code}`}`))));
+  });
+}
+
+/**
+ * Makes one more checkout of the project whose first checkout is `first`.
+ *
+ * @returns the new path. Throws with git's own words when it cannot, and
+ *   leaves nothing half-made behind that `discoverAutoWorkspaces` would take
+ *   for a checkout: a failed clone has no `.git`.
+ */
+export async function createAutoWorkspace(first, existing) {
+  const path = nextAutoWorkspace(first, existing);
+  const origin = await run(first, ['remote', 'get-url', 'origin']).catch(() => null);
+  await run(dirname(first), ['clone', '--quiet', first, path]);
+  if (origin) {
+    await run(path, ['remote', 'set-url', 'origin', origin]);
+    // Best effort: the run about to use this checkout fetches before it
+    // branches anyway, and a remote that wants a passphrase only a person can
+    // type must not stop the checkout from existing.
+    await run(path, ['fetch', '--quiet', '--prune', 'origin']).catch(() => null);
+  }
+  return path;
+}

package/runner/bootstrap.mjs

@@ -32,6 +32,7 @@ import { createInterface } from 'node:readline/promises';
 import { homedir, hostname } from 'node:os';
 import { dirname, join } from 'node:path';
 import { painter } from '../lib/ansi.mjs';
+import { agentLabel } from '../lib/agents.mjs';
 import { absolute } from './paths.mjs';
 import { Select, pickFromLine, pickManyFromLine, plainLines } from './select.mjs';
 import { signInThroughBrowser, storedSession } from './sign-in.mjs';
@@ -193,7 +194,7 @@ export function cloneInto(gitUrl, path) {
 }
 
 /** Whether the agent is on the PATH at all — a cheaper question than "is it signed in". */
-export async function findAgents(commands = ['agy', 'claude']) {
+export async function findAgents(commands = ['agy', 'codex', 'claude']) {
   const found = [];
   for (const command of Array.isArray(commands) ? commands : [commands]) {
     const where = await new Promise((done) => {
@@ -227,9 +228,40 @@ export function asker(input = process.stdin, output = process.stdout) {
   return {
     line: (prompt) => rl.question(prompt),
     close: () => rl.close(),
+    /**
+     * Hands the terminal to somebody else while `work` runs — a `git clone`
+     * whose ssh asks for a key's passphrase.
+     *
+     * ssh reads that from `/dev/tty` itself, and an open readline is reading
+     * the SAME terminal in raw mode, echoing what it gets: the keys were
+     * shared between the two, the passphrase arrived with letters missing, and
+     * one of them was printed on the screen. So the interface stops reading and
+     * the terminal goes back to cooked mode — echo off is then ssh's to decide —
+     * and both are put back afterwards, whatever `work` did.
+     */
+    async aside(work) {
+      const wasRaw = Boolean(input.isTTY && input.isRaw);
+      rl.pause();
+      if (wasRaw) input.setRawMode(false);
+      try {
+        return await work();
+      } finally {
+        if (wasRaw) input.setRawMode(true);
+        rl.resume();
+      }
+    },
   };
 }
 
+/**
+ * `clone` with the terminal handed over for its duration, when the asker can —
+ * see `asker().aside`. An asker without it (a test's, the attached screen's)
+ * is not reading the terminal, so there is nothing to hand over.
+ */
+export function cloneAside(ask, clone, gitUrl, path) {
+  return typeof ask?.aside === 'function' ? ask.aside(() => clone(gitUrl, path)) : clone(gitUrl, path);
+}
+
 /**
  * One choice, drawn the way a terminal that cannot be drawn on gets one.
  *
@@ -380,7 +412,7 @@ export async function setUpThisMachine({
     say('');
     say(`  ${ink.muted('Cloning')} ${ink.accent(project.gitUrl)} ${ink.muted('into')} ${ink.text(path)}`);
     await mkdir(dirname(path), { recursive: true });
-    await clone(project.gitUrl, path);
+    await cloneAside(ask, clone, project.gitUrl, path);
     entries.push({ slug: project.slug, path });
   }
 
@@ -393,7 +425,7 @@ export async function setUpThisMachine({
   // credential behind them.
   const agentInfos = await agent();
   if (agentInfos.length === 0) {
-    say(`  ${ink.warn('!')} ${ink.muted('Neither Claude Code nor Antigravity CLI found on PATH. Install at least one before a run can start.')}`);
+    say(`  ${ink.warn('!')} ${ink.muted('None of Claude Code, Antigravity CLI or Codex CLI is on PATH. Install at least one before a run can start.')}`);
     throw new Error('No supported coding agent found.');
   }
 
@@ -403,7 +435,7 @@ export async function setUpThisMachine({
       title: 'Which coding agents do you want to use on this machine?',
       rows: agentInfos.map((a) => ({
         id: a.command,
-        label: a.command === 'agy' ? 'Antigravity CLI' : 'Claude Code',
+        label: agentLabel(a.command),
         hint: a.where,
       })),
     }))).map((row) => agentInfos.find((a) => a.command === row.id));
@@ -414,7 +446,7 @@ export async function setUpThisMachine({
 
   say('');
   for (const a of chosenAgents) {
-    const agentDisplayName = a.command === 'agy' ? 'Antigravity CLI' : 'Claude Code';
+    const agentDisplayName = agentLabel(a.command);
     say(`  ${ink.muted('This machine spawns')} ${ink.text(a.command)} ${ink.muted(`(${a.where}) for every run.`)}`);
     if (!await confirm(ask, `Is ${agentDisplayName} signed in on this machine?`)) {
       throw new Error(

package/runner/cawdev.mjs

@@ -29,7 +29,7 @@ import { attach, urlFrom, valueOf } from './attach.mjs';
 import { asker, askOne, mintForThisMachine, setUpThisMachine } from './bootstrap.mjs';
 import { liveSockets, probeSocket, socketPathFor } from './control.mjs';
 import {
-  addProject, addWorkspace, readConfigFile, reloadIfRunning, setAcceptsRulesFromConsole,
+  addProject, addWorkspace, readConfigFile, reloadIfRunning, setAcceptsRulesFromConsole, setQuality,
   setAgentEnabled,
 } from './configure.mjs';
 import { restartNeededFor } from '../lib/runner-config.mjs';
@@ -37,6 +37,7 @@ import { Select } from './select.mjs';
 import { storedSession } from './sign-in.mjs';
 import { loadToken } from './token-store.mjs';
 import { painter } from '../lib/ansi.mjs';
+import { KNOWN_AGENTS } from '../lib/agents.mjs';
 import { mark } from './brand.mjs';
 import { cliVersion, isBelow } from '../lib/version.mjs';
 
@@ -62,8 +63,10 @@ const USAGE = `
   cawdev config add-project              serve one more project you can write to
   cawdev config add-workspace            another checkout for a project you
                                           already serve — R47's concurrency
-  cawdev config agent enable|disable <claude|agy>
+  cawdev config agent enable|disable <claude|agy|codex>
   cawdev config rules on|off             accept permission rules from the console
+  cawdev config quality on|off <slug>    scan that project's branches with
+                                         SonarQube after a run's TEST stage
   cawdev config show                     this machine's config, token redacted
 
   On a machine with no config, cawdev sets one up: it signs you in through the
@@ -286,6 +289,21 @@ export function signInUrl(file, argv, env = process.env) {
   return String(typed ?? file?.url ?? urlFrom(argv)).replace(/\/+$/, '');
 }
 
+/**
+ * Where THIS launch signs in: `signInUrl` over the config the launch would use.
+ *
+ * The banner, the version check and the person's own session all asked
+ * `urlFrom(argv)`, which knows `--url` and `CAWDEV_URL` and never the config —
+ * so `cawdev --config local.config.json` minted the machine's token at the
+ * config's localhost and then opened the browser on app.cawdev.com for the
+ * person. One reading, taken once, so the three cannot disagree with the mint.
+ */
+export async function launchUrl(argv, env = process.env, cwd = process.cwd()) {
+  const configPath = await findConfig(argv, env, cwd);
+  const file = configPath ? await readConfigFile(configPath) : null;
+  return signInUrl(file, argv, env);
+}
+
 /**
  * What `readConfig` will call this machine — and therefore the storage key.
  *
@@ -379,10 +397,9 @@ async function warnIfVersionMismatched(url, ink) {
  * Works with no config and no sign-in — `/api/health` needs neither — so it
  * answers on a machine that has not been set up at all yet.
  */
-async function runVersion(argv, ink) {
+async function runVersion(url, ink) {
   const mine = await cliVersion();
   console.log(`  ${ink.muted('cawdev')} ${ink.text(mine)}`);
-  const url = urlFrom(argv);
   try {
     const response = await fetch(`${url}/api/health`);
     const health = response.ok ? await response.json() : null;
@@ -405,7 +422,8 @@ async function runVersion(argv, ink) {
 /**
  * `cawdev config` — R283's granular half of the setup walk, on a machine
  * already configured. A direct subcommand (`add-project`, `add-workspace`,
- * `agent enable|disable <command>`, `rules on|off`, `show`) or, with none, a
+ * `agent enable|disable <command>`, `rules on|off`, `quality on|off <slug>`,
+ * `show`) or, with none, a
  * menu — the same `Select` widget everything that offers a choice uses.
  */
 async function runConfig(args, ink) {
@@ -445,20 +463,26 @@ export async function pickAction(ask, say, pick = askOne) {
     rows: [
       { id: 'add-project', label: 'Add a project' },
       { id: 'add-workspace', label: 'Add a workspace to a project' },
-      { id: 'agent-enable', label: 'Enable an agent (claude / agy)' },
+      { id: 'agent-enable', label: `Enable an agent (${KNOWN_AGENTS.join(' / ')})` },
       { id: 'agent-disable', label: 'Disable an agent' },
       { id: 'rules-on', label: 'Accept permission rules from the console' },
       { id: 'rules-off', label: 'Stop accepting rules from the console' },
+      { id: 'quality-on', label: 'Scan a project\'s branches with SonarQube after TEST' },
+      { id: 'quality-off', label: 'Stop scanning a project\'s branches' },
       { id: 'show', label: 'Show this machine\'s config' },
     ],
   }));
   const id = picked.row.id;
   if (id === 'agent-enable' || id === 'agent-disable') {
-    const command = (await ask.line('  Which agent — claude or agy? ')).trim();
+    const command = (await ask.line(`  Which agent — ${KNOWN_AGENTS.join(', ')}? `)).trim();
     return ['agent', id === 'agent-enable' ? 'enable' : 'disable', command];
   }
   if (id === 'rules-on') return ['rules', 'on'];
   if (id === 'rules-off') return ['rules', 'off'];
+  if (id === 'quality-on' || id === 'quality-off') {
+    const slug = (await ask.line('  Which project (slug)? ')).trim();
+    return ['quality', id === 'quality-on' ? 'on' : 'off', slug];
+  }
   return [id];
 }
 
@@ -485,8 +509,8 @@ export async function runAction([verb, ...rest], { configPath, file, url, sessio
   }
   if (verb === 'agent') {
     const [sub, command] = rest;
-    if (!['claude', 'agy'].includes(command)) {
-      throw new Error('Name an agent: cawdev config agent enable|disable claude|agy');
+    if (!KNOWN_AGENTS.includes(command)) {
+      throw new Error(`Name an agent: cawdev config agent enable|disable ${KNOWN_AGENTS.join('|')}`);
     }
     await reload(await setAgentEnabled({
       file, configPath, ask, say, ink, command, enabled: sub === 'enable',
@@ -498,6 +522,16 @@ export async function runAction([verb, ...rest], { configPath, file, url, sessio
     await reload(await setAcceptsRulesFromConsole({ file, configPath, ask, say, ink, enabled: sub === 'on' }));
     return;
   }
+  if (verb === 'quality') {
+    // R300. The block is captured per project at boot, so the daemon's own
+    // verdict here is always "restart" — and it is the daemon that says so.
+    const [sub, slug] = rest;
+    if (!['on', 'off'].includes(sub) || !slug) {
+      throw new Error('Name a project: cawdev config quality on|off <slug>');
+    }
+    await reload(await setQuality({ file, configPath, ask, say, ink, slug, enabled: sub === 'on' }));
+    return;
+  }
   throw new Error(`Not a cawdev config command: ${verb}. See cawdev --help.`);
 }
 
@@ -525,21 +559,23 @@ async function main() {
     return;
   }
 
+  const url = await launchUrl(argv);
+
   if (argv.includes('--version')) {
-    await runVersion(argv, ink);
+    await runVersion(url, ink);
     return;
   }
 
   // The mark, once, before anything else happens. It is the only decoration in
   // the program and it is here because this is the moment somebody is waiting:
   // a browser about to open, or a daemon about to boot.
-  for (const line of mark(ink, { tagline: urlFrom(argv) })) {
+  for (const line of mark(ink, { tagline: url })) {
     console.log(`\n${line}\n`);
   }
 
   // R283. Best-effort, silent when the two agree — see the function's own
   // comment for why this never throws.
-  await warnIfVersionMismatched(urlFrom(argv), ink);
+  await warnIfVersionMismatched(url, ink);
 
   // Asked for by name, the walk runs even where one has been done before —
   // that is what "again" means, and adding a project to this machine is the
@@ -556,7 +592,7 @@ async function main() {
   }
 
   const socketPath = await socketToAttach(argv, ink);
-  await attach(argv, { socketPath });
+  await attach(argv, { socketPath, url });
 }
 
 /**

package/runner/changed-lines.mjs

@@ -0,0 +1,87 @@
+// R316: which lines a branch changed since it left its base.
+//
+// A scratch SonarQube project (scanAsScratchProject in runner.mjs) has no
+// new-code period of its own to compare against — it is overwritten on every
+// run of the branch, so SonarQube has never seen a "previous version" of it.
+// "New" is redefined here as "on a line this branch changed since the
+// merge-base", computed from git rather than from SonarQube.
+//
+// `parseUnifiedZero` is kept as its own pure function — the hunk arithmetic
+// is the part worth getting right without a repository to run it against.
+
+import { spawn } from 'node:child_process';
+
+function git(cwd, args) {
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn('git', args, { cwd, stdio: ['ignore', 'pipe', 'pipe'] });
+    let out = '';
+    let err = '';
+    child.stdout.on('data', (chunk) => (out += chunk));
+    child.stderr.on('data', (chunk) => (err += chunk));
+    child.on('error', reject);
+    child.on('close', (code) =>
+      code === 0
+        ? resolvePromise(out)
+        : reject(new Error(`git ${args.join(' ')} failed: ${
+            err.trim() || out.trim() || `exit ${code}, and it said nothing`}`)),
+    );
+  });
+}
+
+const HUNK = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/;
+
+/**
+ * `git diff -U0`'s zero-context unified output, as `Map<path, Set<line>>` of
+ * the lines each touched file gained. A deleted file (`+++ /dev/null`) is
+ * skipped — it has no lines left to be new on. `d` missing on a hunk header
+ * means one line added; `d` present as `0` means the hunk is a pure deletion
+ * and adds none.
+ */
+export function parseUnifiedZero(text) {
+  const changed = new Map();
+  let current = null;
+  for (const line of text.split('\n')) {
+    if (line.startsWith('+++ ')) {
+      const path = line.slice(4).trim();
+      current = path === '/dev/null' ? null : path.replace(/^b\//, '');
+      if (current && !changed.has(current)) {
+        changed.set(current, new Set());
+      }
+      continue;
+    }
+    if (current === null) {
+      continue;
+    }
+    const hunk = HUNK.exec(line);
+    if (hunk) {
+      const start = Number(hunk[1]);
+      const count = hunk[2] === undefined ? 1 : Number(hunk[2]);
+      const set = changed.get(current);
+      for (let offset = 0; offset < count; offset += 1) {
+        set.add(start + offset);
+      }
+    }
+  }
+  return changed;
+}
+
+/**
+ * What `branch` changed since `base`, as `Map<path, Set<line> | 'ALL'>`.
+ *
+ * Diffs the working tree rather than `HEAD` — a coding run's uncommitted
+ * edits count too, which is the point: the scratch scan runs before anything
+ * is committed. An untracked file has no diff to parse and counts whole.
+ */
+export async function changedLines(cwd, base) {
+  const diff = await git(cwd,
+    ['-c', 'core.quotePath=false', 'diff', '-U0', '--no-color', '--no-ext-diff', '--no-renames', base]);
+  const changed = parseUnifiedZero(diff);
+  const untracked = await git(cwd, ['ls-files', '--others', '--exclude-standard']);
+  for (const rawPath of untracked.split('\n')) {
+    const path = rawPath.trim();
+    if (path) {
+      changed.set(path, 'ALL');
+    }
+  }
+  return changed;
+}

package/runner/configure.mjs

@@ -32,9 +32,10 @@ import { connect as connectTo } from 'node:net';
 import { mkdir, readFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
 import { painter } from '../lib/ansi.mjs';
+import { agentLabel } from '../lib/agents.mjs';
 import { probeSocket, socketPathFor } from './control.mjs';
 import {
-  askOne, cloneInto, confirm, defaultRunnerName,
+  askOne, cloneAside, cloneInto, confirm, defaultRunnerName,
   findAgents, mintRunnerToken, servable, writeRunnerConfig,
 } from './bootstrap.mjs';
 import {
@@ -177,7 +178,7 @@ async function settleCheckout({ path, slug, gitUrl, ask, say, ink, clone, inspec
   }
   say(`  ${ink.muted('Cloning')} ${ink.accent(gitUrl)} ${ink.muted('into')} ${ink.text(path)}`);
   await mkdir(dirname(path), { recursive: true });
-  await clone(gitUrl, path);
+  await cloneAside(ask, clone, gitUrl, path);
 }
 
 /**
@@ -323,7 +324,7 @@ export async function setAgentEnabled({
     if (!found) {
       throw new Error(`${command} is not on this machine's PATH. Install it before enabling it here.`);
     }
-    const label = command === 'agy' ? 'Antigravity CLI' : 'Claude Code';
+    const label = agentLabel(command);
     if (!await confirm(ask, `Is ${label} signed in on this machine?`)) {
       throw new Error(`Sign in first — run \`${command}\` once in a terminal and follow it.`);
     }
@@ -361,6 +362,79 @@ export async function setAcceptsRulesFromConsole({
   return next;
 }
 
+/**
+ * Turn a project's SonarQube scan on or off — R300.
+ *
+ * On writes a `quality` block into the project's entry (`{ command, tokenEnv }`,
+ * the two things the daemon needs; `runner.mjs`'s `qualityBlockOf` fills in
+ * the rest), asking for each with its default offered — Enter keeps it. Off
+ * deletes the block and leaves every other key of the entry as it was. A bare
+ * path entry is promoted to `{workspaces}` on the way, R47's third form, the
+ * way `addWorkspace` promotes one.
+ *
+ * Nothing here checks the scanner is installed: unlike an agent, the scanner
+ * can be missing on a machine that will be told so per run — the daemon
+ * reports "not installed" as an error reading, which is the page saying it
+ * — and a check here would refuse a config somebody is about to complete.
+ * The token is NOT asked for: it is an environment variable this machine
+ * exports, never a value in a file people commit.
+ *
+ * A third question — R316 — is what this machine does when the project's
+ * server refuses branches (Community Edition): `skip` reports an error
+ * reading, `main` re-scans as the project's main analysis, `project` scans
+ * the branch as its own scratch SonarQube project instead. Defaults to
+ * whatever is already in the block, `skip` on a fresh one.
+ */
+export async function setQuality({
+  file, configPath, slug, enabled,
+  command, tokenEnv, whenBranchesRefused,
+  ask, say, ink = painter(3),
+  write = writeRunnerConfig,
+} = {}) {
+  const projects = file.projects ?? {};
+  if (!slug || !(slug in projects)) {
+    throw new Error(`This machine does not serve ${slug || 'that project'}. `
+      + `It serves: ${Object.keys(projects).join(', ') || 'nothing yet'}.`);
+  }
+  const entry = typeof projects[slug] === 'string'
+    ? { workspaces: [projects[slug]] }
+    : { ...projects[slug] };
+
+  let next;
+  if (enabled) {
+    const chosenCommand = command
+      ?? (String(await ask.line('  Scanner command [sonar-scanner]: ')).trim() || 'sonar-scanner');
+    const chosenTokenEnv = tokenEnv
+      ?? (String(await ask.line('  Environment variable holding the scanner token [SONAR_TOKEN]: ')).trim()
+        || 'SONAR_TOKEN');
+    const existingWhen = entry.quality?.whenBranchesRefused ?? 'skip';
+    const chosenWhen = whenBranchesRefused
+      ?? (String(await ask.line(`  When the server refuses branches — skip, main or project [${existingWhen}]: `))
+        .trim().toLowerCase() || existingWhen);
+    if (!['skip', 'main', 'project'].includes(chosenWhen)) {
+      throw new Error(`"whenBranchesRefused" is "skip", "main" or "project" — not "${chosenWhen}".`);
+    }
+    entry.quality = {
+      ...(entry.quality ?? {}), command: chosenCommand, tokenEnv: chosenTokenEnv, whenBranchesRefused: chosenWhen,
+    };
+    next = { ...file, projects: { ...projects, [slug]: entry } };
+    await write(configPath, next);
+    say(`  ${ink.success('✓')} ${ink.muted(`${slug} scans its branches with`)} ${ink.text(chosenCommand)}`
+      + ` ${ink.muted('after TEST, token from')} ${ink.text('$' + chosenTokenEnv)}`);
+    say(`  ${ink.muted(`Export ${chosenTokenEnv} where the daemon runs. It is never written to this file.`)}`);
+  } else {
+    if (!entry.quality) {
+      say(`  ${ink.muted(`${slug} was already not scanned here.`)}`);
+      return file;
+    }
+    delete entry.quality;
+    next = { ...file, projects: { ...projects, [slug]: entry } };
+    await write(configPath, next);
+    say(`  ${ink.success('✓')} ${ink.muted(`${slug} is no longer scanned on this machine.`)}`);
+  }
+  return next;
+}
+
 /**
  * The hello of a daemon running on this exact config, or null.
  *