dotmd-cli 0.80.0 → 0.81.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dotmd-cli",
-  "version": "0.80.0",
+  "version": "0.81.0",
   "description": "CLI for managing markdown documents with YAML frontmatter — index, query, validate, graph, export, lifecycle, and AI summaries.",
   "type": "module",
   "license": "MIT",

package/src/baton.mjs

@@ -161,6 +161,7 @@ export async function runBaton(argv, config, opts = {}) {
   let repoPath = null;
   let oldStatus = null;
   let ownershipPath = null;
+  let planGuard = null;
   if (planPath) {
     planPath = authorizeManagedSource(planPath, config, { kind: 'Baton plan source' }).path;
     repoPath = toRepoPath(planPath, config.repoRoot);
@@ -183,7 +184,29 @@ export async function runBaton(argv, config, opts = {}) {
     if (status === 'in-session') {
       die('`runlist baton --status in-session` contradicts baton release semantics. Choose active/paused/awaiting/partial/blocked.');
     }
-    assertPlanMutationAuthorized(repoPath, config, { sessionId: authoritativeSessionId(), force });
+    const sessionId = authoritativeSessionId();
+    const ownership = assertPlanMutationAuthorized(repoPath, config, { sessionId, force });
+    const ownedHere = ownership?.state === 'owned' && ownership.sessionId === sessionId;
+    // Baton's release only means something when there is a claim to release. A
+    // plan that is neither in-session nor owned here carries a status someone
+    // chose on purpose (`awaiting`, `blocked`, a repo's own `awaiting-testing`),
+    // and flipping it to the default `active` as a side effect of saving a
+    // prompt overwrites that reason — silently, since baton's headline is the
+    // prompt it saved. That is not hypothetical: a prompt-refresh pass named a
+    // plan slug, got a status flip it never asked for, and had to notice and
+    // undo it. So the prompt still lands with its `plan:` link, and the plan's
+    // status stays put unless the caller states the transition with --status.
+    const currentStatus = asString(fm.status);
+    if (!statusFlag && oldStatus !== 'in-session' && !ownedHere) {
+      if (!currentStatus || (validStatuses?.size > 0 && !validStatuses.has(currentStatus))) {
+        die(`${repoPath} is not in-session and its status (\`${oldStatus}\`) is not one baton can leave in place.\n`
+          + `Say what it should become: runlist baton ${repoPath} @<draft-file> --status <status>\n`
+          + `Or save the prompt without touching the plan: runlist baton ${path.basename(planPath, '.md')} @<draft-file>`);
+      }
+      status = currentStatus;
+      planGuard = { path: planPath, expectedContent: raw };
+      if (note) warn('--note ignored — the plan\'s status is unchanged, so there is no transition to record.');
+    }
     // Before the plan-completion step: a refusal must leave nothing changed.
     refuseIfPending();
     ownershipPath = readPlanOwnership(repoPath, config)?.recordPath ?? null;
@@ -221,7 +244,7 @@ export async function runBaton(argv, config, opts = {}) {
     const prepared = preparePromptDocument(slugBase, body, config, { plan: repoPath, dryRun });
     const setArgs = [status, planPath];
     if (force) setArgs.push('--force');
-    if (note) setArgs.push('--note', note);
+    if (note && !planGuard) setArgs.push('--note', note);
     try {
       if (dryRun) process.stdout.write(`${dim('[dry-run]')} Would create: ${prepared.repoPath}\n`);
       archiveResult = await runSet(setArgs, config, {
@@ -229,6 +252,7 @@ export async function runBaton(argv, config, opts = {}) {
         viaBaton: true,
         testHooks: opts.testHooks,
         creations: dryRun ? [] : [{ path: prepared.filePath, content: prepared.content }],
+        guards: planGuard && !dryRun ? [planGuard] : [],
         deferIndex: true,
       });
     } catch (err) {
@@ -297,6 +321,10 @@ export async function runBaton(argv, config, opts = {}) {
     return operationResult;
   }
   process.stderr.write(`\n${prefix}${green('✓ Baton passed')}: ${createdSlug} (the next session's hud surfaces it — nothing to paste into chat)\n`);
+  if (planGuard) {
+    process.stderr.write(dim(`${repoPath} left at \`${oldStatus}\` — it was not in-session, so there was no claim to release.\n`));
+    process.stderr.write(dim(`Meant to change it? runlist set <status> ${repoPath}\n`));
+  }
   if (statusChanged) {
     const pathspec = operationResult.repositoryFiles.join(' ');
     let gitignored = false;

package/src/git.mjs

@@ -122,8 +122,7 @@ export function getGitLastModifiedBatch(repoRoot, relPaths, options = {}) {
   assertSafeGitPaths(paths);
   if (paths.length === 0) return { dates: new Map(), commits: new Map(), history: new Map(), complete: true, reason: null };
   // Full-tree callers can supply a small set of configured root pathspecs for
-  // diff extraction. Revision selection still uses the exact requested paths,
-  // so excluded or unrelated documents cannot consume the commit bound.
+  // diff extraction.
   const scanPaths = options.pathspecs?.length ? [...new Set(options.pathspecs)] : paths;
   assertSafeGitPaths(scanPaths);
   const expectedPaths = new Set(paths);
@@ -133,10 +132,23 @@ export function getGitLastModifiedBatch(repoRoot, relPaths, options = {}) {
   const commitsByPath = new Map();
   const history = new Map();
   let reason = null;
+  // Revision selection uses the root pathspecs when the caller supplied them,
+  // not the full requested list: Git matches every pathspec against every
+  // commit's diff, so a full-tree scan of a ~5k-doc corpus spent ~14s here
+  // walking history 5k pathspecs at a time (the same walk costs ~0.25s against
+  // one root). The window can only widen, never narrow, per requested path —
+  // every requested path lives under a root, so a commit touching one matches
+  // the root too, and the window stays a newest-first prefix of history. What
+  // it costs is depth: commits touching only non-requested docs now consume the
+  // bound, so a path whose latest commit falls outside the window resolves to
+  // no date at all rather than to a stale one. That case is already accounted
+  // for below — an unresolved TRACKED path keeps `commit-limit`, which callers
+  // surface as "Git metadata is incomplete".
+  const revisionPathspecs = scanPaths.length < paths.length ? scanPaths : paths;
   const revisions = spawnSync('git', ['rev-list', '--stdin', `--max-count=${maxCommits + 1}`, revision], {
     cwd: repoRoot,
     encoding: 'utf8',
-    input: `--\n${paths.map(literalGitPathspec).join('\n')}\n`,
+    input: `--\n${revisionPathspecs.map(literalGitPathspec).join('\n')}\n`,
     maxBuffer,
   });
   if (revisions.error?.code === 'ENOBUFS') {

package/src/lifecycle.mjs

@@ -417,7 +417,15 @@ export async function runStatus(argv, config, opts = {}) {
 
   if (oldStatus === newStatus) {
     if (!dryRun && (opts.additionalUpdates?.length || opts.creations?.length)) {
-      mutateFileSet({ updates: opts.additionalUpdates ?? [], creations: opts.creations ?? [] }, {
+      // Guards belong here as much as on the mutating paths below: a caller that
+      // asked for the status it already has (baton's prompt-only handoff) decided
+      // that from this file's status and then writes only its creations, so the
+      // read and the write need something holding the gap.
+      mutateFileSet({
+        updates: opts.additionalUpdates ?? [],
+        creations: opts.creations ?? [],
+        guards: opts.guards ?? [],
+      }, {
         repoRoot: config.repoRoot,
         testHooks: opts.testHooks,
       });

package/src/prompts.mjs

@@ -56,7 +56,13 @@ export async function runPrompts(argv, config, opts = {}) {
 }
 
 function runPromptsList(argv, config, opts = {}) {
-  const index = buildIndex(config);
+  // Listing prompts renders slug / status / updated / target — nothing any
+  // validating pass produces, and `runQuery` never reads warnings either. A
+  // full `buildIndex` here parsed every body in the repo through the ref,
+  // git-staleness and hub passes (~25s on a 5k-doc corpus) to print ten lines,
+  // and then `pendingPromptsOldestFirst` scanned the tree a second time. One
+  // fast index, shared, on the same terms hud reads on.
+  const index = buildIndex(config, { fast: true, invokeHooks: false });
   const hasStatusFlag = argv.includes('--status');
   const includeArchived = argv.includes('--include-archived');
   const sub = argv[0];
@@ -87,7 +93,7 @@ function runPromptsList(argv, config, opts = {}) {
 }
 
 function renderPromptQueueList(index, config) {
-  const queue = pendingPromptsOldestFirst(config);
+  const queue = pendingPromptsOldestFirst(config, index);
   const queuedPaths = new Set(queue.map(q => q.doc.path));
   const others = index.docs
     .filter(d => d.type === 'prompt' && !queuedPaths.has(d.path) && !isArchivedPath(d.path, config) && d.status !== 'archived')
@@ -175,8 +181,12 @@ function renderPromptsVerbose(index, config, { hasStatusFlag, includeArchived })
   }
 }
 
-export function pendingPromptsOldestFirst(config) {
-  const index = buildIndex(config, { fast: true, invokeHooks: false });
+// `index` lets a caller that already has a fast index (the prompt listings)
+// share it rather than re-walking the tree. It must be a full index of the
+// repo: the filter below narrows it, so a pre-filtered one would drop prompts
+// from the queue.
+export function pendingPromptsOldestFirst(config, index = null) {
+  index = index ?? buildIndex(config, { fast: true, invokeHooks: false });
   const actionable = actionablePromptStatuses(config);
   const prompts = index.docs.filter(d =>
     d.type === 'prompt'

package/src/util.mjs

@@ -221,6 +221,48 @@ export function levenshtein(a, b) {
   return matrix[b.length][a.length];
 }
 
+// Edit distance, but only as far as the caller cares. Returns the distance when
+// it is <= limit and null when it provably exceeds it. The suggester asks
+// "within 3 edits?" of every candidate in the index, and the full matrix
+// computes an exact answer it then throws away: ~900 cells and two allocations
+// per pair, several hundred thousand pairs per unresolved reference on a large
+// corpus. Only cells within `limit` of the diagonal can hold a value <= limit,
+// so this walks that band in two flat rows and abandons a row whose cheapest
+// cell is already past the limit. Distances <= limit are identical to
+// `levenshtein`'s — test/util.test.mjs checks that against it directly.
+export function levenshteinWithin(a, b, limit) {
+  if (Math.abs(a.length - b.length) > limit) return null;
+  if (a.length === 0) return b.length;
+  if (b.length === 0) return a.length;
+  const over = limit + 1;
+  let prev = new Int32Array(a.length + 2).fill(over);
+  let cur = new Int32Array(a.length + 2).fill(over);
+  for (let j = 0; j <= Math.min(a.length, limit); j++) prev[j] = j;
+  for (let i = 1; i <= b.length; i++) {
+    const lo = Math.max(1, i - limit);
+    const hi = Math.min(a.length, i + limit);
+    // Reset the cells this row will write plus the two the next row reads as
+    // band neighbours, so nothing stale survives the row swap.
+    cur.fill(over, Math.max(0, lo - 1), hi + 2);
+    cur[0] = i <= limit ? i : over;
+    let rowMin = over;
+    for (let j = lo; j <= hi; j++) {
+      const substitution = prev[j - 1] + (b.charCodeAt(i - 1) === a.charCodeAt(j - 1) ? 0 : 1);
+      const deletion = prev[j] + 1;
+      const insertion = cur[j - 1] + 1;
+      let best = substitution < deletion ? substitution : deletion;
+      if (insertion < best) best = insertion;
+      if (best > limit) best = over;
+      cur[j] = best;
+      if (best < rowMin) rowMin = best;
+    }
+    if (rowMin > limit) return null;
+    const swap = prev; prev = cur; cur = swap;
+  }
+  const distance = prev[a.length];
+  return distance <= limit ? distance : null;
+}
+
 // Top-N candidates from a list, ranked for "did you mean" hints. Substring
 // match wins (cheap and intent-revealing for typos that share a prefix or
 // stem); Levenshtein distance ≤3 catches transpositions and small edits.
@@ -246,8 +288,12 @@ export function suggestCandidates(query, candidates, max = 3) {
       if (!cand || scored.has(cand)) continue;
       const candLower = String(cand).toLowerCase();
       if (candLower === lower) continue;
-      const dist = levenshtein(lower, candLower);
-      if (dist <= 3) scored.set(cand, 1000 + dist);
+      // The candidate list here is every basename AND every repo path in the
+      // index, so on a large corpus this loop ran hundreds of thousands of
+      // distance computations per unresolved reference. Only "within 3 edits"
+      // matters, so it asks for exactly that.
+      const dist = levenshteinWithin(lower, candLower, 3);
+      if (dist !== null) scored.set(cand, 1000 + dist);
     }
   }
 

package/src/validate.mjs

@@ -338,14 +338,25 @@ function candidatePathsForType(docs, type) {
 // can't see siblings). Filters candidates by ref-field type when the field
 // name implies one (e.g. `related_plans` → plans only).
 export function enrichRefErrorSuggestions(docs, config) {
+  // One candidate list per inferred type, not per broken ref. The list is a
+  // filter plus a ~2-per-doc Set build over the whole index, and it does not
+  // depend on the entry — rebuilding it for each entry made this pass quadratic
+  // in (docs × broken refs), which on a 4.8k-doc corpus with a couple hundred
+  // unresolved refs was ~9s of every `check`, `briefing` and `plans` run.
+  const candidateCache = new Map();
+  const candidatesFor = (type) => {
+    const key = type ?? '';
+    if (!candidateCache.has(key)) candidateCache.set(key, candidatePathsForType(docs, type));
+    return candidateCache.get(key);
+  };
+
   const enrich = (entry) => {
     if (!entry?.meta || !['ref-resolution', 'body-link-resolution'].includes(entry.meta.kind)) return;
     if (entry.meta.kind === 'body-link-resolution'
       && (entry.meta.targetKind !== 'document' || entry.meta.reason !== 'missing')) return;
     if (entry._suggested) return;
     const inferred = inferRefFieldType(entry.meta.field);
-    const candidates = candidatePathsForType(docs, inferred);
-    const suggestions = suggestCandidates(path.basename(entry.meta.relPath), candidates);
+    const suggestions = suggestCandidates(path.basename(entry.meta.relPath), candidatesFor(inferred));
     entry._suggested = true;
     if (suggestions.length === 0) return;
     entry.message = `${entry.message} Did you mean: ${suggestions.join(', ')}?`;