codehost 0.16.0 → 0.18.0

package/src/cli/plugins/agent-yes.ts

@@ -0,0 +1,116 @@
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { toPosixPath } from "../../shared/repo";
+import type { AgentInfo } from "../../shared/signaling";
+import type { DaemonPlugin } from "./types";
+
+// agent-yes plugin: advertises the machine's live agent CLI sessions (read
+// straight from agent-yes's registry, so it works even when `ay serve` is
+// down) and proxies /__codehost/agent-yes/* to the local `ay serve` API with
+// its bearer token injected. Granting room members agent control is not new
+// trust: the room token already grants code execution (the editor is a
+// terminal) — same boundary as provisioning (see shared/provision.ts).
+
+const AY_DIR = join(homedir(), ".agent-yes");
+const AY_PORT = Number(process.env.CODEHOST_AY_PORT) || 7432;
+/** Cap the advertised list (meta rides the signaling room broadcast). */
+const MAX_AGENTS = 50;
+
+interface AyRecord {
+  pid: number;
+  cli?: string;
+  prompt?: string | null;
+  cwd?: string;
+  status?: "active" | "idle" | "exited";
+  started_at?: number;
+}
+
+/** agent-yes's global registry: JSONL, last line per pid wins. */
+export function readAgents(dir: string = AY_DIR): AgentInfo[] {
+  let raw: string;
+  try {
+    raw = readFileSync(join(dir, "pids.jsonl"), "utf8");
+  } catch {
+    return [];
+  }
+  const byPid = new Map<number, AyRecord>();
+  for (const line of raw.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const rec = JSON.parse(line) as AyRecord;
+      if (typeof rec.pid === "number") byPid.set(rec.pid, { ...byPid.get(rec.pid), ...rec });
+    } catch {
+      // skip malformed lines
+    }
+  }
+  const out: AgentInfo[] = [];
+  for (const rec of [...byPid.values()].sort((a, b) => (b.started_at ?? 0) - (a.started_at ?? 0))) {
+    if (out.length >= MAX_AGENTS) break;
+    if (rec.status === "exited" || !alive(rec.pid)) continue;
+    out.push({
+      pid: rec.pid,
+      tool: rec.cli || "agent",
+      ...(rec.prompt ? { title: rec.prompt.slice(0, 120) } : {}),
+      cwd: toPosixPath(rec.cwd ?? ""),
+      state: rec.status === "active" ? "active" : "idle",
+      ...(rec.started_at ? { startedAt: rec.started_at } : {}),
+    });
+  }
+  return out;
+}
+
+function alive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function serveToken(dir: string): string | null {
+  try {
+    const t = readFileSync(join(dir, ".serve-token"), "utf8").trim();
+    return t || null;
+  } catch {
+    return null;
+  }
+}
+
+/** The plugin, or null when this machine has never run agent-yes. */
+export function agentYesPlugin(dir: string = AY_DIR): DaemonPlugin | null {
+  if (!existsSync(dir)) return null;
+  return {
+    name: "agent-yes",
+    meta: () => {
+      const agents = readAgents(dir);
+      return agents.length > 0 ? { agents } : {};
+    },
+    route: async (path, req) => {
+      const token = serveToken(dir);
+      if (!token) {
+        return new Response(JSON.stringify({ error: "ay serve has no token (is agent-yes installed?)" }), {
+          status: 503,
+          headers: { "content-type": "application/json" },
+        });
+      }
+      const headers = new Headers(req.headers);
+      headers.set("authorization", `Bearer ${token}`);
+      headers.set("host", `127.0.0.1:${AY_PORT}`);
+      try {
+        return await fetch(`http://127.0.0.1:${AY_PORT}${path}`, {
+          method: req.method,
+          headers,
+          body: req.body as BodyInit | undefined,
+          redirect: "manual",
+        });
+      } catch {
+        return new Response(JSON.stringify({ error: "ay serve is not running (start it with `ay serve install`)" }), {
+          status: 502,
+          headers: { "content-type": "application/json" },
+        });
+      }
+    },
+  };
+}

package/src/cli/plugins/types.ts

@@ -0,0 +1,39 @@
+import type { PeerMeta } from "../../shared/signaling";
+
+// Daemon plugin surface: a plugin contributes (a) fields merged into the
+// advertised PeerMeta on every refresh, and (b) an HTTP route mounted under the
+// tunnel at /__codehost/<name>/*. codehost stays the transport + registry;
+// plugins (agent-yes first) own their domain.
+
+export interface DaemonPlugin {
+  /** Identifier; also the tunnel mount: requests to /__codehost/<name>/* land
+   *  in `route`. */
+  name: string;
+  /** Resource contribution, merged into PeerMeta by the daemon's meta builder
+   *  (startup + every refresh). Keep it small — it rides room broadcasts. */
+  meta?: () => Partial<PeerMeta>;
+  /** Serve a tunneled request. `path` is the remainder after the mount, always
+   *  starting with "/" and keeping the query string. */
+  route?: (path: string, req: { method: string; headers: Headers; body?: Uint8Array }) => Promise<Response>;
+}
+
+/** Route a local tunnel request to the owning plugin, or null to fall through. */
+export function routePlugins(
+  plugins: DaemonPlugin[],
+  req: { method: string; path: string; headers: Headers; body?: Uint8Array },
+): Promise<Response> | null {
+  for (const p of plugins) {
+    if (!p.route) continue;
+    const mount = `/__codehost/${p.name}`;
+    if (req.path === mount || req.path.startsWith(`${mount}/`) || req.path.startsWith(`${mount}?`)) {
+      const rest = req.path.slice(mount.length) || "/";
+      return p.route(rest.startsWith("/") ? rest : `/${rest}`, req);
+    }
+  }
+  return null;
+}
+
+/** Merge every plugin's meta contribution into a base meta. */
+export function withPluginMeta(base: PeerMeta, plugins: DaemonPlugin[]): PeerMeta {
+  return Object.assign({}, base, ...plugins.map((p) => p.meta?.() ?? {}));
+}

package/src/cli/provision-server.ts

@@ -18,9 +18,12 @@ export interface ProvisionDeps {
   homeDir: string;
   /** Git host advertised by this daemon (default github.com). */
   host: string;
+  /** Called after a setup script finishes (any exit code) — lets the daemon
+   *  re-enumerate + re-advertise its workspaces. */
+  onProvisioned?: () => void;
 }
 
-interface CodehostConfig {
+export interface CodehostConfig {
   workspace?: string; // layout template, e.g. "ws/{owner}/{repo}/tree/{branch}"
   allowlist?: string[];
 }
@@ -30,7 +33,7 @@ export function isProvisionPath(path: string): boolean {
   return path.split("?")[0] === PROVISION_PATH;
 }
 
-function readConfig(homeDir: string): CodehostConfig {
+export function readCodehostConfig(homeDir: string): CodehostConfig {
   try {
     const raw = readFileSync(join(homeDir, ".codehost", "config.yaml"), "utf8");
     const c = (parseYaml(raw) ?? {}) as Record<string, unknown>;
@@ -74,7 +77,7 @@ export async function handleProvision(rawPath: string, deps: ProvisionDeps): Pro
   if (!v.ok) return json(400, { error: v.reason });
 
   const host = (url.searchParams.get("host") ?? deps.host).toLowerCase();
-  const cfg = readConfig(deps.homeDir);
+  const cfg = readCodehostConfig(deps.homeDir);
   const key = repoKey({ host, owner: v.target.owner, name: v.target.repo });
   if (!repoAllowed(key, cfg.allowlist)) return json(403, { error: `repo not allowlisted: ${key}` });
 
@@ -152,6 +155,11 @@ function freshBody(
         resolveDone(code);
         say(`\n::codehost:exit=${code}\n`);
         controller.close();
+        try {
+          deps.onProvisioned?.();
+        } catch {
+          // advertising is best-effort; never fail the provision response
+        }
       }
     },
   });

package/src/cli/registry.test.ts

@@ -0,0 +1,51 @@
+import { describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  clearDaemonPresence,
+  liveDaemon,
+  readRegisteredWorkspaces,
+  registerWorkspace,
+  writeDaemonPresence,
+} from "./registry";
+
+const tmp = () => mkdtempSync(join(tmpdir(), "codehost-registry-"));
+
+describe("daemon presence", () => {
+  test("round-trips while the pid is alive; cleared file -> null", () => {
+    const file = join(tmp(), "daemon.json");
+    const p = { pid: process.pid, root: "/Users/x", token: "Str0ng-Token-99", startedAt: 1 };
+    writeDaemonPresence(p, file);
+    expect(liveDaemon(file)).toEqual(p);
+    clearDaemonPresence(file);
+    expect(liveDaemon(file)).toBeNull();
+  });
+
+  test("a dead pid (stale kill -9 leftover) reads as no daemon", () => {
+    const file = join(tmp(), "daemon.json");
+    writeDaemonPresence({ pid: 99999999, root: "/x", token: "t0k-En-Stronk", startedAt: 1 }, file);
+    expect(liveDaemon(file)).toBeNull();
+  });
+
+  test("garbage file reads as no daemon", () => {
+    const file = join(tmp(), "daemon.json");
+    writeFileSync(file, "not json");
+    expect(liveDaemon(file)).toBeNull();
+  });
+});
+
+describe("workspace registry", () => {
+  test("register is idempotent; missing dirs are filtered on read", () => {
+    const dir = tmp();
+    const file = join(dir, "workspaces.json");
+    const ws = join(dir, "proj");
+    mkdirSync(ws);
+    registerWorkspace(ws, file);
+    registerWorkspace(ws, file);
+    registerWorkspace(join(dir, "gone"), file); // never created on disk
+    const got = readRegisteredWorkspaces(file);
+    expect(got).toHaveLength(1);
+    expect(got[0].path).toBe(ws);
+  });
+});

package/src/cli/registry.ts

@@ -0,0 +1,93 @@
+import { existsSync, readFileSync, rmSync, statSync, writeFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+
+// One-daemon-per-host coordination (Phase 5 of the resource-model redesign).
+// A single VS Code serve-web opens ANY local path via ?folder=, so one root
+// daemon can carry every workspace on the machine: a later `codehost dev`
+// REGISTERS its directory here and exits instead of spawning a second peer +
+// VS Code. The daemon advertises registered dirs in meta.workspaces and
+// re-reads this registry on fs.watch + the slow refresh tick.
+
+export const CODEHOST_DIR = join(homedir(), ".codehost");
+const DAEMON_FILE = join(CODEHOST_DIR, "daemon.json");
+const WORKSPACES_FILE = join(CODEHOST_DIR, "workspaces.json");
+
+/** Written by a foreground root daemon while it runs; staleness is detected by
+ *  pid liveness, so a kill -9 leftover never blocks anything. */
+export interface DaemonPresence {
+  pid: number;
+  /** Real OS path of the served root. */
+  root: string;
+  /** Room token the daemon registered with — later `dev` runs print a link
+   *  into THIS room, since that's where the workspace will appear. */
+  token: string;
+  startedAt: number;
+}
+
+export interface RegisteredWorkspace {
+  /** Real OS path. */
+  path: string;
+  addedAt: number;
+}
+
+export function writeDaemonPresence(p: DaemonPresence, file: string = DAEMON_FILE): void {
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, JSON.stringify(p, null, 2));
+}
+
+export function clearDaemonPresence(file: string = DAEMON_FILE): void {
+  try {
+    rmSync(file);
+  } catch {
+    // already gone
+  }
+}
+
+/** The live host daemon, or null (no file, unparsable, or its pid is dead). */
+export function liveDaemon(file: string = DAEMON_FILE): DaemonPresence | null {
+  try {
+    const p = JSON.parse(readFileSync(file, "utf8")) as DaemonPresence;
+    if (typeof p.pid !== "number" || !p.root || !p.token) return null;
+    process.kill(p.pid, 0);
+    return p;
+  } catch {
+    return null;
+  }
+}
+
+/** Add a directory to the host's workspace registry (idempotent). */
+export function registerWorkspace(path: string, file: string = WORKSPACES_FILE): void {
+  const dir = resolve(path);
+  const all = readRegistry(file);
+  if (all.some((w) => w.path === dir)) return;
+  all.push({ path: dir, addedAt: Date.now() });
+  mkdirSync(dirname(file), { recursive: true });
+  writeFileSync(file, JSON.stringify(all, null, 2));
+}
+
+/** Registered workspaces whose directories still exist. */
+export function readRegisteredWorkspaces(file: string = WORKSPACES_FILE): RegisteredWorkspace[] {
+  return readRegistry(file).filter((w) => {
+    try {
+      return statSync(w.path).isDirectory();
+    } catch {
+      return false;
+    }
+  });
+}
+
+/** The registry path — daemons fs.watch its directory for instant re-advertise. */
+export function workspacesFile(): string {
+  return WORKSPACES_FILE;
+}
+
+function readRegistry(file: string): RegisteredWorkspace[] {
+  try {
+    if (!existsSync(file)) return [];
+    const arr = JSON.parse(readFileSync(file, "utf8"));
+    return Array.isArray(arr) ? arr.filter((w) => w && typeof w.path === "string") : [];
+  } catch {
+    return [];
+  }
+}

package/src/cli/run-server.ts

@@ -1,8 +1,11 @@
+import { watch } from "node:fs";
+import { basename, dirname } from "node:path";
 import { type PeerMeta, newPeerId } from "../shared/signaling";
 import { SignalingClient } from "../shared/signaling-client";
 import { RtcDaemon } from "./rtc-daemon";
-import { Tunnel } from "./tunnel";
-import { handleProvision, type ProvisionDeps } from "./provision-server";
+import { type LocalRequest, Tunnel } from "./tunnel";
+import { handleProvision, isProvisionPath, type ProvisionDeps } from "./provision-server";
+import { type DaemonPlugin, routePlugins } from "./plugins/types";
 
 export interface LaunchResult {
   /** Local port to tunnel to. */
@@ -28,8 +31,22 @@ export interface RunServerOptions {
   /** Enables `/__codehost/provision` on the tunnel (serve only — runs the home's
    *  setup.sh). Omitted by `expose`, which has no home/workspace. */
   provision?: ProvisionDeps;
+  /** Recompute the advertised meta (e.g. re-enumerate workspaces). Polled on a
+   *  slow interval and right after each provision; pushed to the room only when
+   *  it actually changed. */
+  refreshMeta?: () => PeerMeta;
+  /** Daemon plugins: tunneled routes under /__codehost/<name>/ (their meta
+   *  contributions are the caller's job, inside `meta`/`refreshMeta`). */
+  plugins?: DaemonPlugin[];
+  /** Files whose change should trigger an immediate `refreshMeta` (e.g. the
+   *  host workspace registry). Watched via their parent directory so the file
+   *  may not exist yet. */
+  watchFiles?: string[];
 }
 
+/** How often a daemon re-enumerates its workspaces (manual clones show up). */
+const META_REFRESH_MS = 60_000;
+
 /**
  * Foreground server loop shared by `serve`, `dev`, and `expose`: register in the
  * signaling room with the given meta and bridge each viewer's data channel to a
@@ -64,20 +81,54 @@ export async function runServer(opts: RunServerOptions): Promise<never> {
     onSignal: (from, data) => rtc.handleSignal(from, data),
   });
 
+  // Re-advertise when the workspace set changes (provision, manual clone).
+  let lastMeta = JSON.stringify(opts.meta);
+  const refreshMeta = () => {
+    if (!opts.refreshMeta) return;
+    const meta = opts.refreshMeta();
+    const s = JSON.stringify(meta);
+    if (s === lastMeta) return;
+    lastMeta = s;
+    client.updateMeta(meta);
+  };
+  const provision: ProvisionDeps | undefined = opts.provision
+    ? { ...opts.provision, onProvisioned: refreshMeta }
+    : undefined;
+  const plugins = opts.plugins ?? [];
+  const onLocal =
+    provision || plugins.length > 0
+      ? (req: LocalRequest) => {
+          if (provision && isProvisionPath(req.path)) return handleProvision(req.path, provision);
+          return routePlugins(plugins, req);
+        }
+      : undefined;
+
   rtc = new RtcDaemon({
     sendSignal: (to, data) => client.sendSignal(to, data),
     onChannel: (viewerId, channel) => {
       console.log(`[codehost] viewer ${viewerId.slice(0, 8)} connected; bridging to :${target.port}`);
-      new Tunnel(
-        channel,
-        target.port,
-        target.stripBasePath,
-        opts.provision ? (rawPath) => handleProvision(rawPath, opts.provision!) : undefined,
-      );
+      new Tunnel(channel, target.port, target.stripBasePath, onLocal);
     },
   });
 
   client.connect();
+  if (opts.refreshMeta) {
+    setInterval(refreshMeta, META_REFRESH_MS);
+    // Instant re-advertise when a watched file changes (debounced — editors
+    // and fs.watch both fire in bursts).
+    let pending: ReturnType<typeof setTimeout> | null = null;
+    for (const file of opts.watchFiles ?? []) {
+      try {
+        watch(dirname(file), (_event, filename) => {
+          if (filename && filename !== basename(file)) return;
+          if (pending) clearTimeout(pending);
+          pending = setTimeout(refreshMeta, 300);
+        });
+      } catch {
+        // missing dir / unsupported platform — the interval still covers it
+      }
+    }
+  }
 
   const shutdown = () => {
     console.log("\n[codehost] shutting down");

package/src/cli/tunnel.ts

@@ -1,5 +1,4 @@
 import type { DataChannel } from "node-datachannel";
-import { isProvisionPath } from "./provision-server";
 import {
   type HttpReqHead,
   Op,
@@ -9,7 +8,6 @@ import {
   encodeFrame,
   encodeJson,
   payloadJson,
-  payloadText,
   wsMessageFrames,
 } from "../shared/protocol";
 
@@ -34,6 +32,19 @@ interface HttpStream {
   body: Uint8Array[];
 }
 
+/** A tunneled request offered to the daemon's local routes before proxying. */
+export interface LocalRequest {
+  method: string;
+  /** Raw tunneled path incl. query (no /vs/<peerId> stripping applied). */
+  path: string;
+  headers: Headers;
+  body?: Uint8Array;
+}
+
+/** Serve `/__codehost/*` requests in-daemon (provisioning, plugins). Return
+ *  null/undefined to fall through to the local-server proxy. */
+export type LocalHandler = (req: LocalRequest) => Promise<Response> | null | undefined;
+
 /**
  * Bridges one WebRTC data channel to a local `code serve-web` instance.
  * Multiplexes concurrent HTTP requests and WebSocket connections by streamId.
@@ -55,9 +66,9 @@ export class Tunnel {
      * doesn't know it, so we strip `/vs/<peerId>` before proxying.
      */
     private stripPrefix?: string,
-    /** Handles `/__codehost/*` requests locally (provisioning) instead of
-     *  forwarding to the local server. Wired only for `serve` (not `expose`). */
-    private onProvision?: (rawPath: string) => Promise<Response>,
+    /** Serves `/__codehost/*` requests locally (provisioning, plugins) instead
+     *  of forwarding to the local server. Wired only for `serve` (not `expose`). */
+    private onLocal?: LocalHandler,
   ) {
     this.origin = `http://127.0.0.1:${vscodePort}`;
     this.wsOrigin = `ws://127.0.0.1:${vscodePort}`;
@@ -138,15 +149,15 @@ export class Tunnel {
     const body = hasBody ? concat(stream.body) : undefined;
 
     try {
-      const res =
-        this.onProvision && isProvisionPath(path)
-          ? await this.onProvision(path)
-          : await fetch(this.origin + this.localPath(path), {
-              method,
-              headers: reqHeaders,
-              body: body as BodyInit | undefined,
-              redirect: "manual",
-            });
+      const local = this.onLocal?.({ method, path, headers: reqHeaders, body });
+      const res = local
+        ? await local
+        : await fetch(this.origin + this.localPath(path), {
+            method,
+            headers: reqHeaders,
+            body: body as BodyInit | undefined,
+            redirect: "manual",
+          });
 
       const resHeaders: Record<string, string> = {};
       res.headers.forEach((v, k) => {

package/src/cli/vscode-install.ts

@@ -49,10 +49,17 @@ export async function resolveCodeBinary(opts: { force?: boolean } = {}): Promise
     return override;
   }
 
-  // Prefer a user-owned `code` on PATH — but only if it actually runs. A broken
-  // or stub `code` should fall through to a managed install/upgrade.
+  // Prefer a user-owned `code` on PATH — but only if it actually runs AND can
+  // `serve-web`. The desktop app's bin/code wrapper passes --version yet treats
+  // `serve-web` as a file path ("Ignoring option 'host': not supported") and
+  // exits 0 without ever listening — so probe the subcommand, not just the
+  // binary (observed on macOS VS Code 1.123: serve started, then "VS Code
+  // server exited (code 0) before becoming ready").
   const system = Bun.which("code");
-  if (system && runsOk(system)) return system;
+  if (system && runsOk(system)) {
+    if (supportsServeWeb(system)) return system;
+    console.warn(`[codehost] system code (${system}) can't serve-web — using a managed VS Code CLI instead`);
+  }
 
   return ensureManagedBinary(opts.force ?? false);
 }
@@ -119,6 +126,16 @@ function runsOk(bin: string): boolean {
   return r.status === 0;
 }
 
+/** True if `<bin> serve-web --help` is a real subcommand: clean exit, no
+ *  desktop-wrapper "Ignoring option" complaints, and help text that actually
+ *  mentions serve-web. (Run with --help so nothing starts listening.) */
+function supportsServeWeb(bin: string): boolean {
+  const r = spawnSync(bin, ["serve-web", "--help"], { encoding: "utf8", timeout: 10_000 });
+  if (r.status !== 0) return false;
+  const out = `${r.stdout ?? ""}${r.stderr ?? ""}`;
+  return !/ignoring option/i.test(out) && /serve-web/i.test(out);
+}
+
 function isMusl(): boolean {
   if (existsSync("/etc/alpine-release")) return true;
   // `ldd --version` mentions "musl" on musl systems; ignore failures.

package/src/cli/workspaces.test.ts

@@ -0,0 +1,65 @@
+import { describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { DEFAULT_LAYOUT } from "../shared/repo";
+import { enumerateWorkspaces } from "./workspaces";
+
+function makeRoot(): string {
+  return mkdtempSync(join(tmpdir(), "codehost-ws-"));
+}
+
+/** Create a checkout dir; .git is a dir by default, a file when `worktree`. */
+function checkout(root: string, rel: string, worktree = false): void {
+  const dir = join(root, rel);
+  mkdirSync(dir, { recursive: true });
+  if (worktree) writeFileSync(join(dir, ".git"), "gitdir: elsewhere");
+  else mkdirSync(join(dir, ".git"));
+}
+
+describe("enumerateWorkspaces", () => {
+  test("walks the default layout and reports repo identity + branch", () => {
+    const root = makeRoot();
+    checkout(root, "snomiao/codehost/tree/main");
+    checkout(root, "symval/symval/tree/dev", true); // worktree-style .git file
+    mkdirSync(join(root, "snomiao/empty/tree/main"), { recursive: true }); // no .git
+
+    const found = enumerateWorkspaces(root, DEFAULT_LAYOUT);
+    expect(found).toHaveLength(2);
+    expect(found).toContainEqual({
+      path: join(root, "snomiao/codehost/tree/main"),
+      repo: "github.com/snomiao/codehost",
+      branch: "main",
+    });
+    expect(found).toContainEqual({
+      path: join(root, "symval/symval/tree/dev"),
+      repo: "github.com/symval/symval",
+      branch: "dev",
+    });
+  });
+
+  test("literal segments must exist; placeholders match one level", () => {
+    const root = makeRoot();
+    checkout(root, "ws/snomiao/codehost"); // layout ws/{owner}/{repo}
+    checkout(root, "other/snomiao/codehost"); // doesn't match the literal "ws"
+
+    const found = enumerateWorkspaces(root, "ws/{owner}/{repo}");
+    expect(found).toHaveLength(1);
+    expect(found[0].repo).toBe("github.com/snomiao/codehost");
+    expect(found[0].branch).toBeUndefined();
+  });
+
+  test("skips dot-directories and tolerates a missing root", () => {
+    const root = makeRoot();
+    checkout(root, ".hidden/codehost/tree/main");
+    expect(enumerateWorkspaces(root, DEFAULT_LAYOUT)).toHaveLength(0);
+    expect(enumerateWorkspaces(join(root, "nope"), DEFAULT_LAYOUT)).toHaveLength(0);
+  });
+
+  test("uses the given git host in repo identity", () => {
+    const root = makeRoot();
+    checkout(root, "group/proj/tree/main");
+    const found = enumerateWorkspaces(root, DEFAULT_LAYOUT, "gitlab.com");
+    expect(found[0].repo).toBe("gitlab.com/group/proj");
+  });
+});