cursedops 0.2.4 → 0.2.5

package/README.md

@@ -88,6 +88,12 @@ A generation is defined by a `forge.env` above the checkout — the same rule it
 `null` rather than guessing, because a function that invented a root would write files
 into a stranger's tree.
 
+🔴 **A git worktree counts** (0.2.5). Worktrees live outside every generation by
+construction, so the walk up alone answered `null` there and a repo whose gate asks for
+the root was red in every worktree — the runner's subset gate included. When the walk
+fails, `git rev-parse --git-common-dir` leads back to the primary checkout and the walk
+runs from there. A clone is its own primary and still gets `null`.
+
 🔴 The state root is **read out of `forge.env`**, never spelled here. A published
 library that hardcoded `$HOME/.<name>` would be correct for exactly one generation and
 silently wrong for its successor — which is the defect this replaced.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedops",
-	"version": "0.2.4",
+	"version": "0.2.5",
 	"description": "The build-and-ops answers this generation's apps wrote independently and identically: finding a generation's roots without knowing a path, macOS launchd agent install/replace/remove, the scaffolding of a deployed smoke, and the static-serving helpers eight apps copied — the path-traversal guard among them — and the API floor that keeps an unmatched /api/... from ever being answered with the app shell. Mechanism only — no app knows its name from here. Bun, zero dependencies, ships source.",
 	"type": "module",
 	"scripts": {

package/src/roots.ts

@@ -31,6 +31,20 @@
  * doing nothing and saying so; {@link requireForgeState} is the one-line way to do
  * that with a message worth reading.
  *
+ * 🔴 **A git worktree of a generation's repo IS inside that generation**, even though no
+ * `forge.env` sits above it: the working agreement puts every worktree under the
+ * machine-wide worktrees root, outside every generation by construction. Walking up
+ * from one finds nothing, so until 0.2.5 every caller here answered `null` in the
+ * one place agents are told to work — and the runner's subset gate, which proves a
+ * pathspec commit in a throwaway worktree, found `desk`'s gate red on EVERY change
+ * (`test/build/advisories-queue.test.ts` asks for the root; 2026-09-21, the
+ * `cursedauth` bump stranded for a day and blamed on the work). A worktree's `.git`
+ * is a file pointing at the primary checkout's git directory, so
+ * {@link findForgeRootViaWorktree} follows it back with no environment variable and
+ * no guess — the same rule every repo's `scripts/paths.ts` already used. A clone,
+ * an archive or a `node_modules` copy is not a worktree of anything in a generation
+ * and still gets `null`.
+ *
  * 🔴 **This library is published, so it may not know a generation's NAME either.**
  * `apps/flix/scripts/forgeRoot.ts` fell back to `$HOME/.cursedforge` when the
  * environment carried no `FORGE_STATE`, which is correct for exactly one
@@ -39,6 +53,7 @@
  * generation being called something else.
  */
 
+import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -71,9 +86,40 @@ function walkUp(from: string, marker: string): string | null {
 	return null;
 }
 
-/** The directory holding `forge.env`, or `null` when `from` is not inside a generation. */
+/**
+ * The generation above the checkout a git WORKTREE at `from` was cut from, or `null`.
+ *
+ * `git rev-parse --git-common-dir` names the primary checkout's git directory; the
+ * ordinary walk runs from the directory holding it. For a primary checkout, a clone
+ * or a plain repo that is its own `.git`, so the answer is exactly what the walk up
+ * from `from` already said. `null` on anything unexpected — no git, not a repo, a
+ * directory that is not there — because inventing a root is the failure this module
+ * is against.
+ */
+export function findForgeRootViaWorktree(from: string): string | null {
+	try {
+		const git = spawnSync("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], {
+			cwd: from,
+			encoding: "utf8",
+			timeout: 5_000,
+		});
+		if (git.status !== 0) return null;
+		const common = (git.stdout ?? "").trim();
+		if (!common.startsWith("/")) return null;
+		return walkUp(dirname(common), MARKER);
+	} catch {
+		return null;
+	}
+}
+
+/**
+ * The directory holding `forge.env`, or `null` when `from` is not inside a generation.
+ *
+ * The walk up first — the only answer for a launchd job, and git is never asked when
+ * it succeeds — then a worktree followed back to its primary checkout.
+ */
 export function findForgeRoot(from: string): string | null {
-	return walkUp(from, MARKER);
+	return walkUp(from, MARKER) ?? findForgeRootViaWorktree(from);
 }
 
 /** {@link findForgeRoot} from a module's own location. Pass `import.meta.url`. */