codeep 3.3.3 → 3.4.1

package/dist/utils/gitHookInstaller.d.ts

@@ -14,7 +14,38 @@ export declare function parseHookArgs(argv: string[]): HookArgs;
 export declare function buildHookScript(hookType: HookType, failOn: FailOn): string;
 /** True when a hook file was created by Codeep (safe to overwrite/remove). */
 export declare function isCodeepHook(content: string): boolean;
-/** Resolve the git hooks directory (honors worktrees + core.hooksPath). Null if not a repo. */
+/**
+ * Where this repository keeps its hooks — as a three-way answer, because two
+ * of the three used to come back as the same `null`.
+ *
+ * `none` means git answered and there is no hook directory to speak of (not a
+ * repository, no git on PATH). `unknown` means git was REFUSED: hardenedGitEnv
+ * would not build an environment for this repository, so nobody can say where
+ * its hooks live or whether a path is one.
+ *
+ * Folding `unknown` into `none` is a fail-OPEN, and it is a live hole rather
+ * than a theoretical one: the write gate in utils/toolExecution.ts reads a
+ * null hook directory as "this repository has no hook directory" and stops
+ * gating, so the one repository whose config Codeep refuses to scan is
+ * exactly the one whose `.githooks/pre-commit` an agent could write
+ * unprompted. A caller that has to decide something must branch on `kind`.
+ */
+export type HooksDirResult = {
+    kind: 'hooks';
+    dir: string;
+} | {
+    kind: 'none';
+} | {
+    kind: 'unknown';
+    reason: string;
+};
+export declare function resolveHooksDirResult(cwd: string): HooksDirResult;
+/**
+ * Resolve the git hooks directory (honors worktrees + core.hooksPath). Null if
+ * not a repo — and THROWS `GitHardeningError` when git was refused, so a
+ * refusal can never be mistaken for "no hooks here". Callers that must not
+ * throw (the write gate) use resolveHooksDirResult() above instead.
+ */
 export declare function resolveHooksDir(cwd: string): string | null;
 export interface HookDeps {
     resolveHooksDir: (cwd: string) => string | null;

package/dist/utils/gitHookInstaller.js

@@ -7,6 +7,7 @@
 import { readFileSync, writeFileSync, mkdirSync, chmodSync, rmSync } from 'fs';
 import { join, dirname, isAbsolute } from 'path';
 import { execSync } from 'child_process';
+import { hardenedGitEnv, GitHardeningError } from './git.js';
 const FAIL_ON_VALUES = ['error', 'warning', 'info', 'none'];
 const MARKER_START = '# >>> codeep hook >>>';
 const MARKER_END = '# <<< codeep hook <<<';
@@ -91,16 +92,71 @@ export function buildHookScript(hookType, failOn) {
 export function isCodeepHook(content) {
     return content.includes(MARKER_START);
 }
-/** Resolve the git hooks directory (honors worktrees + core.hooksPath). Null if not a repo. */
-export function resolveHooksDir(cwd) {
+export function resolveHooksDirResult(cwd) {
+    let env;
     try {
-        execSync('git rev-parse --is-inside-work-tree', { cwd, stdio: 'ignore' });
-        const hooks = execSync('git rev-parse --git-path hooks', { cwd, encoding: 'utf8' }).trim();
-        return isAbsolute(hooks) ? hooks : join(cwd, hooks);
+        // noHooks stays off: answering where the hooks live is this function's
+        // entire job, and an override would have git report the no-hooks path and
+        // send `codeep hook install` there.
+        env = hardenedGitEnv({ cwd });
+    }
+    catch (error) {
+        if (error instanceof GitHardeningError)
+            return { kind: 'unknown', reason: error.message };
+        throw error;
     }
-    catch {
-        return null;
+    try {
+        // stderr is piped rather than ignored so the catch below can tell git's
+        // own answer apart from everything else. Ignoring it is what made the two
+        // indistinguishable in the first place.
+        execSync('git rev-parse --is-inside-work-tree', { cwd, stdio: ['ignore', 'ignore', 'pipe'], env });
+        const hooks = execSync('git rev-parse --git-path hooks', {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+            env,
+        }).trim();
+        return { kind: 'hooks', dir: isAbsolute(hooks) ? hooks : join(cwd, hooks) };
     }
+    catch (error) {
+        // Only git's own "there is no repository here" is `none`. The bare
+        // `catch { kind: 'none' }` this replaces folded a timeout, an EACCES on
+        // `cwd` and a git that died mid-answer into the same result — and `none`
+        // is what the write gate in utils/toolExecution.ts reads as "this
+        // repository has no hook directory, stop gating", so every one of those
+        // failures turned the gate off. `unknown` keeps it on, which is the only
+        // safe way round to be wrong.
+        const err = error;
+        const stderr = String(err.stderr ?? '');
+        // git's own answer for "there is no repository here". A BARE repository
+        // is deliberately not in this branch: `--is-inside-work-tree` prints
+        // `false` and exits 0 there (verified, git 2.54), so it comes back as a
+        // hooks directory, which is what it has.
+        if (/not a git repository/i.test(stderr))
+            return { kind: 'none' };
+        // git never started: not on PATH, or `cwd` is gone. The caller's own git
+        // calls cannot run either, so there is no hook directory to speak of.
+        if (err.code === 'ENOENT' || err.code === 'EACCES' || err.code === 'ENOTDIR')
+            return { kind: 'none' };
+        const detail = stderr.trim() || err.code || `exit ${err.status ?? '?'}`;
+        return {
+            kind: 'unknown',
+            reason: `Cannot tell where ${cwd} keeps its git hooks: git failed to answer (${detail}). ` +
+                'Codeep treats that as "there may be hooks here" rather than as "there are none".',
+        };
+    }
+}
+/**
+ * Resolve the git hooks directory (honors worktrees + core.hooksPath). Null if
+ * not a repo — and THROWS `GitHardeningError` when git was refused, so a
+ * refusal can never be mistaken for "no hooks here". Callers that must not
+ * throw (the write gate) use resolveHooksDirResult() above instead.
+ */
+export function resolveHooksDir(cwd) {
+    const result = resolveHooksDirResult(cwd);
+    if (result.kind === 'unknown')
+        throw new GitHardeningError(result.reason);
+    return result.kind === 'hooks' ? result.dir : null;
 }
 export function runHookCommand(argv, deps = defaultHookDeps()) {
     const args = parseHookArgs(argv);
@@ -108,7 +164,19 @@ export function runHookCommand(argv, deps = defaultHookDeps()) {
         deps.write(HOOK_HELP);
         return 0;
     }
-    const hooksDir = deps.resolveHooksDir(process.cwd());
+    // `resolveHooksDir` throws rather than answer null when git was refused, so
+    // the two failures get the two different messages they need: "you are not in
+    // a repo" is not a useful thing to tell someone whose `.git/config` names a
+    // program Codeep will not run through.
+    let hooksDir;
+    try {
+        hooksDir = deps.resolveHooksDir(process.cwd());
+    }
+    catch (error) {
+        deps.write(`${error instanceof Error ? error.message : String(error)}\n` +
+            'Fix that config (or run the hook installer yourself) and try again.');
+        return 1;
+    }
     if (!hooksDir) {
         deps.write('Not a git repository — run `codeep hook` inside a repo.');
         return 1;

package/dist/utils/gitignore.d.ts

@@ -21,4 +21,12 @@ export declare function loadIgnoreRules(projectRoot: string): IgnoreRules;
  * @returns true if the path should be ignored
  */
 export declare function isIgnored(filePath: string, rules: IgnoreRules): boolean;
+/**
+ * The rules that still apply beneath a directory the user named on purpose
+ * (`@dir dist`). Drops every pattern that ignores the directory itself
+ * (`dist/`, `/dist`) or all of its children at once (`dist/*`, `dist/**`),
+ * and keeps the rest (`*.log`, `secrets.json`, negations), so naming a
+ * directory never hides its whole contents.
+ */
+export declare function rulesBelow(dir: string, rules: IgnoreRules): IgnoreRules;
 export {};

package/dist/utils/gitignore.js

@@ -1,7 +1,7 @@
 /**
  * .gitignore parser — loads ignore patterns and tests file paths against them.
  */
-import { existsSync, readFileSync } from 'fs';
+import { existsSync, readFileSync, statSync } from 'fs';
 import { join, relative, sep } from 'path';
 /**
  * Always-ignored directories (even without a .gitignore)
@@ -26,6 +26,8 @@ const BUILTIN_IGNORES = [
     'out',
     '.output',
 ];
+/** Largest .gitignore we'll parse (1 MB). */
+const MAX_GITIGNORE_BYTES = 1024 * 1024;
 /**
  * Load .gitignore rules from a project root.
  * Falls back to built-in ignores if no .gitignore exists.
@@ -40,9 +42,16 @@ export function loadIgnoreRules(projectRoot) {
     const gitignorePath = join(projectRoot, '.gitignore');
     if (existsSync(gitignorePath)) {
         try {
-            const content = readFileSync(gitignorePath, 'utf-8');
-            const parsed = parseGitignore(content);
-            patterns.push(...parsed);
+            // statSync follows symlinks: a cloned repo can commit `.gitignore ->
+            // /dev/zero` (or a FIFO), and readFileSync on either never returns.
+            // Every agent run and every @dir walk loads these rules, so check the
+            // kind and size before reading.
+            const stat = statSync(gitignorePath);
+            if (stat.isFile() && stat.size <= MAX_GITIGNORE_BYTES) {
+                const content = readFileSync(gitignorePath, 'utf-8');
+                const parsed = parseGitignore(content);
+                patterns.push(...parsed);
+            }
         }
         catch {
             // Ignore read errors
@@ -57,12 +66,7 @@ export function loadIgnoreRules(projectRoot) {
  * @returns true if the path should be ignored
  */
 export function isIgnored(filePath, rules) {
-    // Normalize to forward-slash relative path
-    let rel = filePath;
-    if (filePath.startsWith(rules.projectRoot)) {
-        rel = relative(rules.projectRoot, filePath);
-    }
-    rel = rel.split(sep).join('/');
+    const rel = toRulePath(filePath, rules);
     // Empty path is never ignored
     if (!rel)
         return false;
@@ -74,6 +78,33 @@ export function isIgnored(filePath, rules) {
     }
     return ignored;
 }
+/**
+ * The rules that still apply beneath a directory the user named on purpose
+ * (`@dir dist`). Drops every pattern that ignores the directory itself
+ * (`dist/`, `/dist`) or all of its children at once (`dist/*`, `dist/**`),
+ * and keeps the rest (`*.log`, `secrets.json`, negations), so naming a
+ * directory never hides its whole contents.
+ */
+export function rulesBelow(dir, rules) {
+    const rel = toRulePath(dir, rules);
+    if (!rel)
+        return rules;
+    // No real file name holds a NUL, so a pattern matches this child only when
+    // it matches every child.
+    const anyChild = `${rel}/\0`;
+    return {
+        projectRoot: rules.projectRoot,
+        patterns: rules.patterns.filter((p) => p.negated || !(p.regex.test(rel) || p.regex.test(anyChild))),
+    };
+}
+/** Normalize to the forward-slash, root-relative form the patterns expect. */
+function toRulePath(filePath, rules) {
+    let rel = filePath;
+    if (filePath.startsWith(rules.projectRoot)) {
+        rel = relative(rules.projectRoot, filePath);
+    }
+    return rel.split(sep).join('/');
+}
 /**
  * Parse .gitignore content into patterns.
  */

package/dist/utils/headlessReview.d.ts

@@ -1,5 +1,6 @@
 import { type FixPlan } from './reviewFix.js';
 import { ReviewResult } from './codeReview.js';
+import { ProjectContext } from './project.js';
 export type FailOn = 'error' | 'warning' | 'info' | 'none';
 export interface ReviewArgs {
     files: string[];
@@ -44,3 +45,13 @@ export interface ReviewDeps {
  * unit-testable. The exit code is ALWAYS deterministic — `--ai` is advisory.
  */
 export declare function runHeadlessReview(argv: string[], deps?: ReviewDeps): Promise<number>;
+/**
+ * Run a fix plan through the agent.
+ *
+ * The plan's personality is passed as the active one, so the same enforcement
+ * any custom bot gets applies here: the model is offered `files` and `tests`
+ * and nothing else. It edits the working tree and stops — branching, committing
+ * and opening a pull request belong to whatever called this, which in CI is the
+ * action that holds the token.
+ */
+export declare function runFixPlan(plan: FixPlan, context: ProjectContext): Promise<string | null>;

package/dist/utils/headlessReview.js

@@ -212,7 +212,7 @@ function defaultDeps() {
  * and opening a pull request belong to whatever called this, which in CI is the
  * action that holds the token.
  */
-async function runFixPlan(plan, context) {
+export async function runFixPlan(plan, context) {
     try {
         // Populate the key cache before anything asks for it. `getApiKey` is
         // synchronous and reads the cache alone — it does not consult the
@@ -227,6 +227,7 @@ async function runFixPlan(plan, context) {
             return `${summariseFixPlan(plan)} No API key is configured for the current provider, so the fix agent could not start.`;
         }
         const { runAgent } = await import('./agent.js');
+        const { NO_CONFIRMER_REFUSAL } = await import('./toolExecution.js');
         // No cast here. `as never` on this call once hid the fact that
         // personalityOverride did not exist, which would have run the CI fix with
         // no boundary at all while the tests happily asserted otherwise.
@@ -239,17 +240,44 @@ async function runFixPlan(plan, context) {
             // the plan, which buildFixPlan caps, and the action's wall-clock.
             maxIterations: 25,
         });
+        // `result === 'success'` matters: a write the agent ATTEMPTED is logged
+        // whether or not it happened, so a refused `.git/config` was being
+        // reported to CI as a file this run edited — the exact opposite of the
+        // truth, and the file is not in the diff for anyone to check against.
         const edited = new Set(result.actions
-            .filter(a => a.type === 'write' || a.type === 'edit')
+            .filter(a => (a.type === 'write' || a.type === 'edit') && a.result === 'success')
             .map(a => a.target));
         const activity = describeAgentActivity(result.actions);
+        // A headless run passes no permission callback, so a write to a file that
+        // decides what runs later — `.git/config`, a hook, an MCP server list —
+        // is refused rather than done unasked. That is the right answer for CI:
+        // an unattended run must not be the thing that installs a hook. But the
+        // refusal only ever reached the model, so the run looked like it had
+        // simply chosen not to fix that finding, and the one action a human has
+        // to take was in nobody's log. Name it in the summary, which is what the
+        // action prints. An opt-in flag was the alternative and is worse: it
+        // would exist to be set in a YAML file once and then never read again.
+        const refused = [...new Set(result.actions
+                .filter(a => a.result === 'error' && a.details?.includes(NO_CONFIRMER_REFUSAL))
+                .map(a => a.target))];
+        const refusalNote = refused.length
+            ? ` It was refused ${refused.length} write${refused.length === 1 ? '' : 's'} to ${refused.join(', ')}: ` +
+                'those files decide what runs later, and a headless run has nobody to confirm them. Edit them yourself.'
+            : '';
+        const editedList = `Edited ${edited.size} file${edited.size === 1 ? '' : 's'}: ${[...edited].join(', ')}.`;
         if (!result.success) {
-            return `${summariseFixPlan(plan)} The run did not finish: ${result.error ?? 'unknown error'}. ${activity}`;
+            // The run did its work and the checks after it failed. The edits are in
+            // the working tree all the same, so name them next to the checks.
+            if (result.failedChecks?.length) {
+                const changed = edited.size > 0 ? editedList : activity;
+                return `${summariseFixPlan(plan)} ${changed}${refusalNote} These checks still fail afterwards: ${result.failedChecks.join(', ')}.`;
+            }
+            return `${summariseFixPlan(plan)} The run did not finish: ${result.error ?? 'unknown error'}. ${activity}${refusalNote}`;
         }
         if (edited.size === 0) {
-            return `${summariseFixPlan(plan)} Nothing was changed. ${activity}`;
+            return `${summariseFixPlan(plan)} Nothing was changed. ${activity}${refusalNote}`;
         }
-        return `${summariseFixPlan(plan)} Edited ${edited.size} file${edited.size === 1 ? '' : 's'}: ${[...edited].join(', ')}.`;
+        return `${summariseFixPlan(plan)} ${editedList}${refusalNote}`;
     }
     catch (error) {
         // A missing key or an unreachable provider must not fail the review. The

package/dist/utils/history.d.ts

@@ -10,6 +10,9 @@ export interface ActionRecord {
     previousExisted?: boolean;
     wasDirectory?: boolean;
     deletedContent?: string;
+    /** Hash of what the agent left in the file (write/edit). Undo only puts
+     *  the old content back while the file still holds exactly that. */
+    resultHash?: string;
     command?: string;
     args?: string[];
     undone?: boolean;
@@ -51,13 +54,25 @@ export declare function recordMkdir(path: string): ActionRecord | null;
  */
 export declare function recordCommand(command: string, args: string[]): ActionRecord | null;
 /**
- * Get current session
+ * Note what a write or edit left in the file, once it happened.
  */
-export declare function getCurrentSession(): ActionSession | null;
+export declare function recordResult(record: ActionRecord | null | undefined, content: string): void;
 /**
- * Undo the last action in current session
+ * Drop a record whose change never happened (the write failed or the
+ * editor refused it). Left in place, undo would write its saved content
+ * over whatever the file holds by then.
  */
-export declare function undoLastAction(): {
+export declare function discardAction(record: ActionRecord | null | undefined): void;
+/**
+ * Get the run in progress, or else the last finished run that changed
+ * something. Pass the workspace to leave out runs from another one.
+ */
+export declare function getCurrentSession(projectRoot?: string): ActionSession | null;
+/**
+ * Undo the most recent file change of the run undo acts on. Pass the
+ * workspace the user is in so a run in another one is left alone.
+ */
+export declare function undoLastAction(projectRoot?: string): {
     success: boolean;
     message: string;
 };
@@ -69,9 +84,10 @@ export declare function undoAction(action: ActionRecord): {
     message: string;
 };
 /**
- * Undo all actions in current session
+ * Undo every action of the run undo acts on. Pass the workspace the user is
+ * in so a run in another one is left alone.
  */
-export declare function undoAllActions(): {
+export declare function undoAllActions(projectRoot?: string): {
     success: boolean;
     results: string[];
 };

package/dist/utils/history.js

@@ -1,11 +1,15 @@
 /**
  * Agent action history for undo/rollback functionality
  */
-import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, rmSync, statSync, readdirSync } from 'fs';
-import { dirname, join } from 'path';
+import { existsSync, readFileSync, writeFileSync, unlinkSync, mkdirSync, rmdirSync, statSync, readdirSync } from 'fs';
+import { dirname, join, resolve } from 'path';
 import { homedir } from 'os';
+import { createHash } from 'crypto';
 // In-memory current session
 let currentSession = null;
+// The last finished run that changed something. Every run ends before the
+// user can type /undo, so undo has to reach back to it.
+let lastSession = null;
 // History storage path
 const HISTORY_DIR = join(homedir(), '.codeep', 'history');
 /**
@@ -16,6 +20,47 @@ function ensureHistoryDir() {
         mkdirSync(HISTORY_DIR, { recursive: true });
     }
 }
+function writeSessionFile(session) {
+    ensureHistoryDir();
+    writeFileSync(join(HISTORY_DIR, `${session.id}.json`), JSON.stringify(session, null, 2));
+}
+/** Whether a run recorded anything undo can put back. Commands never can. */
+function hasFileActions(session) {
+    return session.actions.some(a => a.type !== 'command');
+}
+/**
+ * The session undo and the change listings act on: the run in progress, or
+ * else the last finished run that changed something.
+ *
+ * A run in progress that has not touched a file yet does not hide the
+ * finished one: /undo typed while a run is still winding down would
+ * otherwise find nothing. `projectRoot` keeps one workspace's /undo away
+ * from a run in another; without it any run is in reach.
+ */
+function undoableSession(projectRoot) {
+    const inScope = (session) => session && (projectRoot === undefined || resolve(session.projectRoot) === resolve(projectRoot))
+        ? session
+        : null;
+    const current = inScope(currentSession);
+    if (current && hasFileActions(current))
+        return current;
+    return inScope(lastSession) ?? current;
+}
+/**
+ * Keep a finished run's saved record in step with what has been undone.
+ * The run in progress is written when it ends.
+ */
+function saveUndone(session) {
+    if (session === currentSession)
+        return;
+    try {
+        writeSessionFile(session);
+    }
+    catch {
+        // The files are already restored. A record that could not be updated
+        // must not turn that into a reported failure.
+    }
+}
 /**
  * Generate unique ID
  */
@@ -45,10 +90,12 @@ export function endSession() {
     currentSession.endTime = Date.now();
     // Only save if there were actions
     if (currentSession.actions.length > 0) {
-        ensureHistoryDir();
-        const filename = `${currentSession.id}.json`;
-        const filepath = join(HISTORY_DIR, filename);
-        writeFileSync(filepath, JSON.stringify(currentSession, null, 2));
+        writeSessionFile(currentSession);
+    }
+    // Only a run that changed a file replaces the one to undo: a read-only or
+    // command-only follow-up must not put the previous edits out of reach.
+    if (hasFileActions(currentSession)) {
+        lastSession = currentSession;
     }
     currentSession = null;
 }
@@ -160,31 +207,90 @@ export function recordCommand(command, args) {
     currentSession.actions.push(record);
     return record;
 }
+function contentHash(content) {
+    return createHash('sha256').update(content).digest('hex');
+}
+/**
+ * Note what a write or edit left in the file, once it happened.
+ */
+export function recordResult(record, content) {
+    if (record)
+        record.resultHash = contentHash(content);
+}
+/**
+ * Why putting a file back would lose someone else's change, or null. The
+ * user (or a later command) may have edited the file since the run; undo
+ * must not overwrite that, or delete a file that has become theirs.
+ */
+function changedSince(action) {
+    const path = action.path;
+    if ((action.type === 'write' || action.type === 'edit') && action.resultHash !== undefined && existsSync(path)) {
+        let now = null;
+        try {
+            now = readFileSync(path, 'utf-8');
+        }
+        catch { /* unreadable: treat as changed */ }
+        if (now === null || contentHash(now) !== action.resultHash) {
+            return `Not undone: ${path} has changed since the agent wrote it. Use git to restore it if you need to.`;
+        }
+    }
+    if (action.type === 'delete' && !action.wasDirectory && existsSync(path)) {
+        return `Not undone: ${path} exists again, and restoring the deleted copy would overwrite it.`;
+    }
+    return null;
+}
+/**
+ * Drop a record whose change never happened (the write failed or the
+ * editor refused it). Left in place, undo would write its saved content
+ * over whatever the file holds by then.
+ */
+export function discardAction(record) {
+    if (!record || !currentSession)
+        return;
+    const i = currentSession.actions.indexOf(record);
+    if (i !== -1)
+        currentSession.actions.splice(i, 1);
+}
 /**
- * Get current session
+ * Get the run in progress, or else the last finished run that changed
+ * something. Pass the workspace to leave out runs from another one.
  */
-export function getCurrentSession() {
-    return currentSession;
+export function getCurrentSession(projectRoot) {
+    return undoableSession(projectRoot);
 }
 /**
- * Undo the last action in current session
+ * Undo the most recent file change of the run undo acts on. Pass the
+ * workspace the user is in so a run in another one is left alone.
  */
-export function undoLastAction() {
-    if (!currentSession || currentSession.actions.length === 0) {
+export function undoLastAction(projectRoot) {
+    const session = undoableSession(projectRoot);
+    if (!session || session.actions.length === 0) {
         return { success: false, message: 'No actions to undo' };
     }
-    // Find last non-undone action
-    const action = [...currentSession.actions].reverse().find(a => !a.undone);
+    // Commands cannot be undone, so they are passed over: a run that edits and
+    // then runs the tests must still have its edits undoable.
+    const pending = [...session.actions].reverse().filter(a => !a.undone);
+    const action = pending.find(a => a.type !== 'command');
     if (!action) {
-        return { success: false, message: 'All actions already undone' };
+        // Only commands are left. Once the file changes are undone that is
+        // "all undone"; a run that only ran commands says why nothing happens.
+        return hasFileActions(session) || pending.length === 0
+            ? { success: false, message: 'All actions already undone' }
+            : undoAction(pending[0]);
     }
-    return undoAction(action);
+    const result = undoAction(action);
+    if (result.success)
+        saveUndone(session);
+    return result;
 }
 /**
  * Undo a specific action
  */
 export function undoAction(action) {
     try {
+        const conflict = action.path ? changedSince(action) : null;
+        if (conflict)
+            return { success: false, message: conflict };
         switch (action.type) {
             case 'write':
                 if (action.previousExisted && action.previousContent !== undefined) {
@@ -226,9 +332,9 @@ export function undoAction(action) {
                 break;
             case 'mkdir':
                 if (!action.previousExisted && existsSync(action.path)) {
-                    // Only remove if empty
+                    // Only remove if empty (rmdirSync refuses anything else)
                     try {
-                        rmSync(action.path, { recursive: false });
+                        rmdirSync(action.path);
                         action.undone = true;
                         return { success: true, message: `Removed directory: ${action.path}` };
                     }
@@ -248,25 +354,31 @@ export function undoAction(action) {
     }
 }
 /**
- * Undo all actions in current session
+ * Undo every action of the run undo acts on. Pass the workspace the user is
+ * in so a run in another one is left alone.
  */
-export function undoAllActions() {
-    if (!currentSession || currentSession.actions.length === 0) {
+export function undoAllActions(projectRoot) {
+    const session = undoableSession(projectRoot);
+    if (!session || session.actions.length === 0) {
         return { success: false, results: ['No actions to undo'] };
     }
     const results = [];
-    let allSuccess = true;
+    let restored = 0;
     // Undo in reverse order
-    const actions = [...currentSession.actions].reverse();
+    const actions = [...session.actions].reverse();
     for (const action of actions) {
         if (action.undone)
             continue;
         const result = undoAction(action);
         results.push(result.message);
-        if (!result.success)
-            allSuccess = false;
+        if (result.success)
+            restored++;
     }
-    return { success: allSuccess, results };
+    if (restored > 0)
+        saveUndone(session);
+    // Success means something was put back. A command in the run can never be
+    // undone, and must not make restored files read as "Nothing to undo".
+    return { success: restored > 0, results };
 }
 /**
  * Get list of recent sessions
@@ -335,6 +447,8 @@ export function formatSession(session) {
  * Clear all history
  */
 export function clearHistory() {
+    // The finished run's record goes with the files.
+    lastSession = null;
     ensureHistoryDir();
     try {
         const files = readdirSync(HISTORY_DIR);