gigarag-cursor 0.1.2 → 0.2.1

package/cli/commands/gitHooks.js

@@ -0,0 +1,367 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, join, relative, resolve, sep } from 'node:path';
+import { parseArgs } from 'node:util';
+import { resolveLauncher } from '../clients/launcher.js';
+import { git, gitInfoExcludeFile, hooksDir, isGitRepo } from '../git/git.js';
+import { HOOKS, classify, hasBlock, renderBlock, withBlock, withoutBlock } from '../git/hookScript.js';
+import { findRepoRoot } from '../scan/repo.js';
+import { State } from '../state.js';
+import { err, out, table } from '../ui.js';
+/**
+ * The hooks directory git reports resolves outside both `.git` and the work tree: usually a
+ * global `core.hooksPath` shared by every repository on the machine. Installing there would start
+ * a worker for all of them, and uninstalling here would remove it for all of them too, so `target`
+ * refuses instead.
+ */
+export class HooksOutsideRepoError extends Error {
+}
+const HELP = `Usage: gigarag hooks install|uninstall|status [path]
+
+Git hooks that keep GigaRAG in step with this repository. After a commit, merge, checkout or
+rebase on the branch GigaRAG syncs, they start gigarag sync in the background. They never slow
+or fail git. /gigaindex installs them.
+
+  install     Add our lines to post-commit, post-merge, post-checkout and post-rewrite
+  uninstall   Remove only our lines, and any hook file that held nothing else
+  status      Which hooks carry our lines`;
+/** The argv prefix the hook runs, or undefined when only a gigarag on PATH will do (npx is too slow for a hook). */
+function command() {
+    const launcher = resolveLauncher();
+    if (launcher.kind === 'npx')
+        return undefined;
+    return [launcher.command, ...launcher.args.filter(a => a !== 'mcp')];
+}
+function read(file) {
+    try {
+        return readFileSync(file, 'utf8');
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Temporary name then rename, like every config write here, so a crash never leaves half a hook. */
+function writeHook(file, text) {
+    const tmpFile = `${file}.gigarag-tmp`;
+    writeFileSync(tmpFile, text, { mode: 0o755 });
+    try {
+        chmodSync(tmpFile, 0o755);
+    }
+    catch {
+        /* Windows */
+    }
+    renameSync(tmpFile, file);
+}
+function target(root) {
+    const found = hooksDir(root);
+    if (!found)
+        throw new Error('unreachable: isGitRepo was checked');
+    if (!found.insideGitDir && !found.insideWorkTree) {
+        throw new HooksOutsideRepoError(`This repository's hooks directory (${found.dir}) is outside both .git and the work tree, which is what a global core.hooksPath looks like: it is shared by every repository on this machine, so installing here would start GigaRAG's background sync for all of them, and gigarag hooks uninstall here would remove it for all of them too. Give this repository its own hooks path first, for example git config --local core.hooksPath .githooks (or git config --unset core.hooksPath to fall back to .git/hooks), then run gigarag hooks install again.`);
+    }
+    mkdirSync(found.dir, { recursive: true });
+    return { dir: found.dir, insideWorkTree: found.insideWorkTree };
+}
+/**
+ * Whether a hook file is already committed. Only meaningful inside the work tree (`.husky` or a
+ * repo-relative `core.hooksPath`): `.git/hooks` is never tracked. A team that already committed
+ * its own copy of the file, husky's included, is common, and editing it in place would put this
+ * machine's absolute launcher path into whatever a plain `git commit -a` ships next, to every
+ * teammate who pulls it, none of whom ran `gigarag hooks install` themselves.
+ */
+function isTracked(root, file) {
+    const rel = relative(root, file).split(sep).join('/');
+    return git(root, ['ls-files', '--error-unmatch', '--', rel]).ok;
+}
+/**
+ * The repository's top level, canonicalised so install, uninstall and the hook-mode check all
+ * land on the same key regardless of which of the repository's directories each was given:
+ * `realpathSync` follows symlinks the way git itself would, and the result is lowercased on
+ * Windows, where two paths differing only in a drive letter's or a directory's case name the same
+ * checkout. Falls back to a plain `resolve` when the path doesn't exist (nothing to realpath) or
+ * isn't inside a repository at all, so this never throws.
+ */
+function repoTopLevel(root) {
+    const { root: top } = findRepoRoot(resolve(root));
+    let real;
+    try {
+        real = realpathSync.native(top);
+    }
+    catch {
+        real = top;
+    }
+    return process.platform === 'win32' ? real.toLowerCase() : real;
+}
+/**
+ * The key under which this machine records that a person ran `gigarag hooks install` in this
+ * repository. Hook mode reads it through `hooksOptedIn` before doing anything, instead of
+ * trusting the bucket's shared `initialised` flag, because that flag is the same for every
+ * teammate: a hook file that reaches a machine without this person ever running install here (
+ * checked into git, or copied from a teammate) must not start a background sync on their behalf.
+ * Keyed on the repository's top level (see `repoTopLevel`), never on whatever directory install,
+ * uninstall or the hook itself happened to run from: installing from a subfolder, and a hook that
+ * always runs at the root, must agree on one opt-in, not keep two.
+ */
+export function hooksOptInKey(root) {
+    return `hooks_opt_in:${repoTopLevel(root)}`;
+}
+/**
+ * The pre-fix key: the raw, unresolved-to-the-top-level `resolve(root)`, with no realpath and no
+ * case-folding. `hooksOptedIn` still reads it for a machine that opted in before this fix, and
+ * both it and `setHooksOptIn` clear it once it's no longer needed, so it can't migrate an opt-in
+ * back after an uninstall has cleared the normalised key.
+ */
+function legacyHooksOptInKey(root) {
+    return `hooks_opt_in:${resolve(root)}`;
+}
+function withState(state, fn) {
+    if (state)
+        return fn(state);
+    const s = new State();
+    try {
+        return fn(s);
+    }
+    finally {
+        s.close();
+    }
+}
+/** Whether this machine ran `gigarag hooks install` (directly, or through `sync end --init`) in
+ * this checkout. See `hooksOptInKey`.
+ *
+ * Also accepts the key a pre-fix install left behind (`legacyHooksOptInKey`). From the repository
+ * root, which is where install overwhelmingly ran, that legacy key is identical to today's for a
+ * plain `.git/hooks` checkout on a case-preserving path, so a machine that opted in before this
+ * fix keeps working without re-running install. Found once, it's copied onto the new key and then
+ * deleted, so every check after this one is a single read, and so a later `uninstall`, which only
+ * clears the normalised key, can't have this migration bring the opt-in straight back afterwards. */
+export function hooksOptedIn(root, state) {
+    try {
+        return withState(state, s => {
+            const key = hooksOptInKey(root);
+            if (s.getMeta(key) === '1')
+                return true;
+            const legacyKey = legacyHooksOptInKey(root);
+            if (legacyKey !== key && s.getMeta(legacyKey) === '1') {
+                s.setMeta(key, '1');
+                s.setMeta(legacyKey, '');
+                return true;
+            }
+            return false;
+        });
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Clearing must reach the legacy key too, or `hooksOptedIn` migrates a pre-fix opt-in straight
+ * back the next time anything checks it: a machine that opted in before this fix, and never wrote
+ * the normalised key any other way, would otherwise survive `uninstall`.
+ */
+function setHooksOptIn(root, value, state) {
+    try {
+        withState(state, s => {
+            s.setMeta(hooksOptInKey(root), value ? '1' : '');
+            if (!value) {
+                const legacyKey = legacyHooksOptInKey(root);
+                if (legacyKey !== hooksOptInKey(root))
+                    s.setMeta(legacyKey, '');
+            }
+        });
+    }
+    catch {
+        /* a machine-local convenience; never a reason to fail install or uninstall */
+    }
+}
+/**
+ * Keeps our own hook files, once they live inside the work tree (`.husky` or a repo-relative
+ * core.hooksPath), out of `git status` for everyone who runs it directly, not only our own
+ * isClean check. Best effort: a courtesy, never a reason to fail an install.
+ */
+function excludeFromGitStatus(root, dir, hooks) {
+    if (hooks.length === 0)
+        return;
+    try {
+        const file = gitInfoExcludeFile(root);
+        if (!file)
+            return;
+        const existing = read(file) ?? '';
+        const already = new Set(existing.split(/\r?\n/).filter(Boolean));
+        const rels = hooks.map(h => relative(root, join(dir, h)).split(sep).join('/'));
+        const missing = rels.filter(r => !already.has(r));
+        if (missing.length === 0)
+            return;
+        mkdirSync(dirname(file), { recursive: true });
+        const spacer = existing.length > 0 && !existing.endsWith('\n') ? '\n' : '';
+        writeFileSync(file, `${existing}${spacer}# added by gigarag hooks install\n${missing.join('\n')}\n`);
+    }
+    catch {
+        /* a courtesy for a plain `git status`; never a reason to fail install */
+    }
+}
+export function installHooks(root, onlyWhereInstalled = false, state) {
+    const { dir, insideWorkTree } = target(root);
+    const argv = command();
+    const reports = HOOKS.map(hook => {
+        const file = join(dir, hook);
+        if (insideWorkTree && isTracked(root, file))
+            return { hook, file, result: 'tracked' };
+        const existing = read(file);
+        if (onlyWhereInstalled && !(existing && hasBlock(existing)))
+            return { hook, file, result: 'absent' };
+        const kind = classify(existing);
+        if (kind === 'foreign')
+            return { hook, file, result: 'foreign' };
+        const next = withBlock(existing, renderBlock(hook, argv));
+        if (next === existing)
+            return { hook, file, result: 'unchanged' };
+        writeHook(file, next);
+        return { hook, file, result: kind === 'missing' ? 'written' : 'updated' };
+    });
+    if (insideWorkTree) {
+        excludeFromGitStatus(root, dir, reports.filter(r => r.result === 'written' || r.result === 'updated' || r.result === 'unchanged').map(r => r.hook));
+    }
+    // Recorded only when install actually put our block in a file it controls, never merely for
+    // having been run: an interactive `sync begin` calls this (through refreshHooks) before every
+    // /gigasync, and a virgin machine where nothing is installed yet must not opt itself in that way.
+    if (reports.some(r => r.result === 'written' || r.result === 'updated' || r.result === 'unchanged')) {
+        setHooksOptIn(root, true, state);
+    }
+    return reports;
+}
+/** Rewrites our block where it already is, so a moved CLI path heals. Never installs where it was removed. */
+export function refreshHooks(root, state) {
+    try {
+        if (isGitRepo(root))
+            installHooks(root, true, state);
+    }
+    catch {
+        /* a refresh is a courtesy, never a reason to stop a sync */
+    }
+}
+/**
+ * The reverse of `excludeFromGitStatus`: drops the line for each hook file uninstall removed, but
+ * only the lines that sit under our own `# added by gigarag hooks install` marker, so anything a
+ * person or another tool put in this file, before or after that marker, is left exactly as it was.
+ * A courtesy, like the install side: never a reason to fail uninstall.
+ */
+function unexcludeFromGitStatus(root, dir, hooks) {
+    if (hooks.length === 0)
+        return;
+    try {
+        const file = gitInfoExcludeFile(root);
+        if (!file)
+            return;
+        const existing = read(file);
+        if (!existing)
+            return;
+        const rels = new Set(hooks.map(h => relative(root, join(dir, h)).split(sep).join('/')));
+        const lines = existing.split(/\r?\n/);
+        const markerAt = lines.findIndex(l => l.trim() === '# added by gigarag hooks install');
+        if (markerAt === -1)
+            return;
+        const kept = lines.filter((line, i) => i <= markerAt || !rels.has(line));
+        const next = kept.join('\n');
+        if (next !== existing)
+            writeFileSync(file, next);
+    }
+    catch {
+        /* a courtesy for a plain `git status`; never a reason to fail uninstall */
+    }
+}
+export function uninstallHooks(root, state) {
+    const { dir, insideWorkTree } = target(root);
+    const reports = HOOKS.map(hook => {
+        const file = join(dir, hook);
+        if (insideWorkTree && isTracked(root, file))
+            return { hook, file, result: 'tracked' };
+        const existing = read(file);
+        if (!existing || !hasBlock(existing))
+            return { hook, file, result: 'absent' };
+        const next = withoutBlock(existing);
+        if (next === undefined)
+            unlinkSync(file);
+        else
+            writeHook(file, next);
+        return { hook, file, result: 'removed' };
+    });
+    unexcludeFromGitStatus(root, dir, reports.filter(r => r.result === 'removed').map(r => r.hook));
+    setHooksOptIn(root, false, state);
+    return reports;
+}
+export function hookStatus(root) {
+    const { dir } = target(root);
+    return HOOKS.map(hook => {
+        const file = join(dir, hook);
+        const existing = read(file);
+        if (existing && hasBlock(existing))
+            return { hook, file, result: 'installed' };
+        return { hook, file, result: classify(existing) === 'foreign' ? 'foreign' : 'absent' };
+    });
+}
+const LABEL = {
+    written: 'written',
+    updated: 'updated',
+    unchanged: 'unchanged',
+    foreign: 'not ours',
+    tracked: 'tracked',
+    removed: 'removed',
+    absent: 'absent',
+    installed: 'installed',
+};
+export async function hooks(argv) {
+    const { values, positionals } = parseArgs({ args: argv, allowPositionals: true, options: { help: { type: 'boolean', short: 'h' } } });
+    const [action, path] = positionals;
+    if (values.help || !action || !['install', 'uninstall', 'status'].includes(action)) {
+        out(HELP);
+        return action ? 2 : 0;
+    }
+    const root = resolve(path ?? '.');
+    if (!isGitRepo(root)) {
+        err(`${root} is not inside a git repository, so there is nothing to hook. Run this from the repository you indexed.`);
+        return 1;
+    }
+    let reports;
+    const state = new State();
+    try {
+        try {
+            reports = action === 'install' ? installHooks(root, false, state) : action === 'uninstall' ? uninstallHooks(root, state) : hookStatus(root);
+        }
+        catch (e) {
+            if (e instanceof HooksOutsideRepoError) {
+                err(e.message);
+                return 1;
+            }
+            throw e;
+        }
+    }
+    finally {
+        state.close();
+    }
+    for (const line of table(reports.map(r => [r.hook, LABEL[r.result], r.file])))
+        out(line);
+    const foreign = reports.filter(r => r.result === 'foreign');
+    if (action === 'install' && foreign.length > 0) {
+        out('');
+        out('These hooks are not shell scripts, so they were left as they are. To sync after them too, add the');
+        out('matching lines below to each one yourself, or call them from it:');
+        for (const r of foreign) {
+            out('');
+            out(`${r.file}:`);
+            out(renderBlock(r.hook, command()));
+        }
+    }
+    const tracked = reports.filter(r => r.result === 'tracked');
+    if (tracked.length > 0) {
+        out('');
+        out('These hook files are already tracked by git, so editing them was left alone: a plain git commit -a would');
+        out('ship this machine\'s own path into a file every teammate who pulls it gets, whether or not they run');
+        out('gigarag hooks install themselves. Add the lines below by hand if this repository wants that, and commit');
+        out('them once everyone who pulls this branch has agreed to it:');
+        for (const r of tracked) {
+            out('');
+            out(`${r.file}:`);
+            out(renderBlock(r.hook, command()));
+        }
+    }
+    return 0;
+}

package/cli/commands/indexSync.js

@@ -1,3 +1,4 @@
+import { parseArgs } from 'node:util';
 import { GigaRag } from '../sdk.js';
 import { State } from '../state.js';
 const MAX_NODES = 5000;
@@ -8,7 +9,9 @@ const LOCK_MS = 2 * 60_000;
  * so it is what makes memos saved from other clients, a chat app or another
  * machine, show up in the next session. Runs detached from a hook, never in one.
  */
-export async function indexSync() {
+export async function indexSync(argv = []) {
+    const { values } = parseArgs({ args: argv, options: { workspace: { type: 'string' } } });
+    const workspace = values.workspace;
     const state = new State();
     let held = false;
     try {
@@ -16,7 +19,7 @@ export async function indexSync() {
         held = state.tryAcquire('sync_lock', LOCK_MS);
         if (!held)
             return 0;
-        const rag = new GigaRag();
+        const rag = new GigaRag(workspace ? { workspaceId: workspace } : {});
         const rows = [];
         for await (const n of rag.iterateNodes({ max: MAX_NODES })) {
             rows.push({
@@ -26,16 +29,17 @@ export async function indexSync() {
                 type: n.node_type ?? null,
                 tokens: null,
                 touched_at: Date.parse(n.updated_at ?? '') || 0,
+                stale: n.stale ? 1 : 0,
             });
         }
-        state.replaceNodes(rows);
-        state.setMeta('last_sync', String(Date.now()));
+        state.replaceNodes(rows, workspace ?? '');
+        state.setMeta(`last_sync:${workspace ?? ''}`, String(Date.now()));
         return 0;
     }
     catch {
         // Silent on purpose: nobody is watching a detached worker. The attempt is recorded so a machine
         // that cannot sync is not retried by every session start and every Stop.
-        state.setMeta('last_attempt', String(Date.now()));
+        state.setMeta(`last_attempt:${workspace ?? ''}`, String(Date.now()));
         return 1;
     }
     finally {

package/cli/commands/login.js

@@ -1,23 +1,26 @@
 import { parseArgs } from 'node:util';
 import { updateConfig, readConfig } from '../config.js';
 import { DEFAULT_ISSUER } from '../constants.js';
-import { clearCredential, envKey, looksLikeAgentKey, mask, saveCredential } from '../auth/credentials.js';
+import { ACCOUNT_SLOT, clearCredential, clearWorkspaceSlots, envKey, looksLikeAgentKey, mask, saveCredential, workspaceSlot, writeSlot } from '../auth/credentials.js';
 import { runOAuthLogin } from '../auth/oauth.js';
+import { listAccountWorkspaces } from '../auth/account.js';
 import { GigaRag, McpHttpError } from '../sdk.js';
 import { assertSecureUrl } from '../secureUrl.js';
 import { err, out, promptHidden, readStdinLine, UsageError } from '../ui.js';
-const HELP = `Usage: gigarag login [--paste] [--key <key>] [--url <mcp url>] [--no-verify]
+const HELP = `Usage: gigarag login [--paste] [--key <key>] [--workspace <id>] [--url <mcp url>] [--no-verify]
 
 Signs this machine in to GigaRAG. With no flags it opens your browser, and nothing
 holds a key afterwards: the gateway swaps your sign-in for one behind the scenes.
 
 Piped input still takes a key, so scripts keep working: echo $KEY | gigarag login
 
-  --paste       Paste an agent key instead of opening a browser
-  --browser     Open the browser. The default, accepted so older scripts still run
-  --key <key>   Give the key on the command line (it will sit in your shell history)
-  --url <url>   Use a different MCP endpoint
-  --no-verify   Store the key without checking it against GigaRAG first`;
+  --paste           Paste an agent key instead of opening a browser
+  --browser         Open the browser. The default, accepted so older scripts still run
+  --key <key>       Give the key on the command line (it will sit in your shell history)
+  --workspace <id>  Store the key for that workspace (with --key or --paste)
+  --url <url>       Use a different MCP endpoint
+  --no-verify       Store the key without checking it against GigaRAG first`;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 export async function login(argv) {
     const { values } = parseArgs({
         args: argv,
@@ -25,6 +28,7 @@ export async function login(argv) {
             browser: { type: 'boolean' },
             paste: { type: 'boolean' },
             key: { type: 'string' },
+            workspace: { type: 'string' },
             url: { type: 'string' },
             issuer: { type: 'string' },
             'no-verify': { type: 'boolean' },
@@ -98,7 +102,12 @@ export async function login(argv) {
             return 1;
         }
     }
-    const where = saveCredential({ type: 'key', key });
+    if (values.workspace && !UUID.test(values.workspace)) {
+        throw new UsageError(`--workspace wants a workspace id, not "${values.workspace}". Find it with: gigarag workspaces`);
+    }
+    const where = values.workspace
+        ? writeSlot(workspaceSlot(values.workspace.toLowerCase()), { type: 'key', key })
+        : saveCredential({ type: 'key', key });
     updateConfig(c => void (c.auth = 'key'));
     out(`Connected. ${mask(key)} is stored in ${where}.`);
     out('Next: gigarag connect');
@@ -107,19 +116,42 @@ export async function login(argv) {
 async function browserLogin(issuer, mcpUrl) {
     try {
         const config = readConfig();
+        // The account scope: one sign-in that lists every workspace and is traded
+        // for a token per workspace, instead of a grant tied to one workspace. Its
+        // tokens are for /api/cli, and the app refuses them at /mcp.
         const result = await runOAuthLogin({
             issuer,
-            resource: mcpUrl,
+            scope: 'account offline_access',
+            resource: `${issuer.replace(/\/$/, '')}/api/cli`,
             clientId: config.issuer === issuer ? config.oauthClientId : undefined,
             log: line => out(line),
         });
-        const where = saveCredential(result.credential);
+        // A new account sign-in never keeps the previous one's workspace tokens: each
+        // slot is keyed by workspace id, and a token minted for another person's
+        // account must not be presented as this one's, or a repository bound to a
+        // workspace id the old account reached would silently work again.
+        clearWorkspaceSlots();
+        const where = writeSlot(ACCOUNT_SLOT, result.credential);
         updateConfig(c => {
             c.auth = 'oauth';
             c.issuer = issuer;
             c.oauthClientId = result.clientId;
+            if (mcpUrl)
+                c.mcpUrl = mcpUrl;
         });
-        out(`Connected through your browser. The sign-in is stored in ${where}.`);
+        out(`Signed in through your browser. The sign-in is stored in ${where}.`);
+        try {
+            const workspaces = await listAccountWorkspaces({ issuer });
+            const own = workspaces.find(w => w.access_via === 'owner' && w.is_default) ?? workspaces[0];
+            if (own && !readConfig().workspaceId)
+                updateConfig(c => void (c.workspaceId = own.id));
+            out(`You can reach ${workspaces.length} ${workspaces.length === 1 ? 'workspace' : 'workspaces'}.${own ? ` Folders with no link use ${own.name}.` : ''}`);
+            out('To link a repository to a workspace, run this in it: gigarag use <workspace>');
+            out('To see them all: gigarag workspaces');
+        }
+        catch (e) {
+            err(`Signed in, but could not list your workspaces: ${e.message}`);
+        }
         out('Next: gigarag connect');
         return 0;
     }
@@ -135,7 +167,10 @@ export async function logout(argv) {
         return 0;
     }
     clearCredential();
-    updateConfig(c => void (c.auth = undefined));
+    updateConfig(c => {
+        c.auth = undefined;
+        c.workspaceId = undefined;
+    });
     out('Signed out. The stored credential is deleted.');
     const written = Object.entries(readConfig().clients);
     if (written.length > 0) {

package/cli/commands/mcp.js

@@ -1,6 +1,7 @@
 import { parseArgs } from 'node:util';
+import { resolveWorkspace, untrustedBinding, untrustedBindingNotice } from '../binding.js';
 import { runBridge } from '../mcp/bridge.js';
-import { createClient } from '../mcp/session.js';
+import { createClient, workspaceNotice } from '../mcp/session.js';
 import { err } from '../ui.js';
 /**
  * The stdio bridge. A client's config file runs this, so stdout belongs to the
@@ -13,6 +14,14 @@ export async function mcp(argv) {
         url: values.url,
         onRetry: (wait, attempt) => err(`gigarag: rate limited, waiting ${wait}s (retry ${attempt})`),
     });
+    // An untrusted binding is never used silently: resolveWorkspace already
+    // skipped it in favour of the machine default, and this names why.
+    const untrusted = untrustedBinding();
+    if (untrusted)
+        err(`gigarag: ${untrustedBindingNotice(untrusted)}`);
+    const notice = workspaceNotice(resolveWorkspace());
+    if (notice && !untrusted)
+        err(`gigarag: ${notice}`);
     await runBridge(client, {
         input: process.stdin,
         output: process.stdout,

package/cli/commands/repo.js

@@ -10,6 +10,7 @@ const HELP = `Usage: gigarag repo [path] [--slug]
 Prints which GigaRAG bucket a directory belongs to: {slug, root, remote, indexedAt, dirty}.
 The slug comes from the git remote when there is one, so two checkouts of one repository share
 a bucket, and from the directory name plus a short hash of its path when there is not. It walks no files and costs nothing.
+When .gigarag.json names a bucket, that is the slug, and "bound" is true.
 
   --slug   Print only the slug`;
 export async function repo(argv) {

package/cli/commands/scan.js

@@ -1,8 +1,22 @@
 import { resolve } from 'node:path';
 import { parseArgs } from 'node:util';
+import { untrustedBinding } from '../binding.js';
 import { scanTree } from '../scan/scan.js';
 import { State } from '../state.js';
 import { out, table, UsageError } from '../ui.js';
+/** Exit status that tells /gigaindex to stop and relay stdout, the same convention as `gigarag sync`. */
+const STOP = 3;
+/**
+ * The instructive refusal for a repository whose `.gigarag.json` has not been trusted. `scan`
+ * checks this itself, rather than silently falling back to the local slug or the default
+ * workspace: a binding an attacker committed can name another of the person's own buckets, and a
+ * scan that ran anyway (see `repo.ts`) is what let it report that bucket's files as deleted and
+ * offer to delete their memos. Refusing here means /gigaindex never gets that far.
+ */
+function untrustedScanMessage(untrusted) {
+    return (`${untrusted.root}'s .gigarag.json links this repository to workspace ${untrusted.workspace}, which has not been trusted, so the scan did not run. ` +
+        'Retrying will not help. If you placed or reviewed this file yourself, run: gigarag trust. To use a different workspace instead: gigarag use <workspace>.');
+}
 /** A whole number of at least 1. Number('abc') is NaN, which would have meant no limit at all. */
 function parseLimit(raw) {
     if (raw === undefined || raw === '')
@@ -37,9 +51,15 @@ export async function scan(argv) {
         out(HELP);
         return 0;
     }
+    const start = resolve(positionals[0] ?? '.');
+    const untrusted = untrustedBinding(start);
+    if (untrusted) {
+        out(untrustedScanMessage(untrusted));
+        return STOP;
+    }
     const state = new State();
     try {
-        const manifest = scanTree(resolve(positionals[0] ?? '.'), {
+        const manifest = scanTree(start, {
             state,
             all: values.all,
             verbose: values.verbose,