gitroots 0.0.0-stage → 0.5.0

package/src/data/sample.js

@@ -0,0 +1,163 @@
+// Sample organisation used in demo mode. Mirrors the gitroots CLI Terminal design canvas.
+export function sampleData() {
+  return {
+    org: {
+      name: 'acme-erp',
+      user: 'shawki',
+      role: 'tech lead',
+      relay: { name: 'fra-1', latencyMs: 18, connected: true },
+    },
+    repos: [
+      { name: 'erp', provider: 'GitHub', remote: 'github.com:acme/erp.git', default: 'main', protected: ['main', 'staging', '17.0'], branches: 22, openPrs: 5, role: 'tech lead', lastPush: '2m ago', lastBranch: 'feature/inventory' },
+      { name: 'portal', provider: 'GitLab', remote: 'gitlab.com:acme/portal.git', default: 'main', protected: ['main'], branches: 11, openPrs: 2, role: 'tech lead', lastPush: '40m ago', lastBranch: 'fix/login-redirect' },
+      { name: 'ml-forecast', provider: 'GitHub', remote: 'github.com:acme/ml-forecast.git', default: 'main', protected: ['main'], branches: 8, openPrs: 0, role: 'reviewer', lastPush: '3h ago', lastBranch: 'exp/lstm' },
+    ],
+    branches: {
+      erp: [
+        { name: 'main', rule: 'protected', ruleText: 'no direct push · PR only', approvals: 3, commit: 'a77d1e0', by: 'lead', age: '1d', aheadBehind: '' },
+        { name: 'staging', rule: 'protected', ruleText: 'PR only · checks required', approvals: 2, commit: 'c12f9a4', by: 'lead', age: '32m', aheadBehind: '4 ↑  0 ↓  vs main' },
+        { name: '17.0', rule: 'protected', ruleText: 'release · read only', approvals: 3, commit: '9e0b311', by: 'lead', age: '9d', aheadBehind: '' },
+        { name: 'feature/inventory', rule: 'open', ruleText: 'developers push', commit: 'a91c2e5', by: 's-7f3a', age: '2m', aheadBehind: '6 ↑  2 ↓  vs staging' },
+        { name: 'feature/pos-refund', rule: 'open', ruleText: 'developers push', commit: '5d20b7c', by: 'dev-01', age: '1h', aheadBehind: '3 ↑  0 ↓  · PR #412' },
+        { name: 'feature/hr-payroll', rule: 'open', ruleText: 'developers push', commit: '0f61a2d', by: 's-a017', age: '4s', aheadBehind: '1 ↑  0 ↓' },
+        ...['fix/stock-picking-batch', 'fix/invoice-rounding', 'feature/mrp-routing', 'feature/crm-scoring', 'feature/website-b2b', 'fix/payroll-timezone',
+          'feature/purchase-approval', 'fix/pos-session-close', 'feature/helpdesk-sla', 'chore/upgrade-deps', 'feature/fleet-costs', 'fix/report-margins',
+          'feature/l10n-sa-vat', 'exp/forecast-hook', 'fix/multicompany-rules', 'feature/subscription-renewal']
+          .map((name, i) => ({ name, rule: 'open', ruleText: 'developers push', commit: (0x1a2b3c0 + i * 7919).toString(16).slice(0, 7), by: ['dev-01', 'dev-02', 'dev-03', 'ahmed', 'nora'][i % 5], age: `${i + 2}d`, aheadBehind: `${(i % 4) + 1} ↑  ${i % 3} ↓` })),
+      ],
+      portal: [
+        { name: 'main', rule: 'protected', ruleText: 'no direct push · PR only', approvals: 2, commit: 'b3e1f70', by: 'lead', age: '2d', aheadBehind: '' },
+        { name: 'fix/login-redirect', rule: 'open', ruleText: 'developers push', commit: '7aa0c19', by: 'dev-03', age: '40m', aheadBehind: '2 ↑  0 ↓  · PR #405' },
+      ],
+      'ml-forecast': [
+        { name: 'main', rule: 'protected', ruleText: 'no direct push · PR only', approvals: 1, commit: '44c09de', by: 'lead', age: '5d', aheadBehind: '' },
+        { name: 'exp/lstm', rule: 'open', ruleText: 'developers push', commit: 'e10fa33', by: 's-c3f8', age: '3h', aheadBehind: '9 ↑  1 ↓' },
+      ],
+    },
+    // Branch rules used by `branch rules` and by the real pre-push checks.
+    rules: {
+      erp: {
+        main: { protected: true, directPush: false, approvals: 3, checks: true, push: 'direct pushes blocked for everyone', mergeText: '3 approvals · checks green · release manager', label: 'main: no direct push, PR only', suggest: 'push to a feature branch, then open a PR into staging' },
+        staging: { protected: true, directPush: false, approvals: 2, checks: true, push: 'direct pushes blocked for everyone', mergeText: '2 approvals · checks green · no unresolved comments', label: 'staging: PR only', suggest: 'push to a feature branch, then open a PR into staging' },
+        '17.0': { protected: true, directPush: false, approvals: 3, checks: true, push: 'release branch · read only', mergeText: 'release managers only', label: '17.0: release, read only', suggest: 'cherry-pick fixes through a PR into staging' },
+        'feature/*': { protected: false, directPush: true, label: 'feature/* · developers can push' },
+        'fix/*': { protected: false, directPush: true, label: 'fix/* · developers can push' },
+        '*': { protected: false, directPush: true, label: 'developers can push' },
+        paths: [{ pattern: 'addons/*/security/**', needs: 'a tech lead approval' }],
+        agents: 'agent commits allowed on feature/* only, tagged in audit',
+      },
+      portal: {
+        main: { protected: true, directPush: false, approvals: 2, checks: true, push: 'direct pushes blocked for everyone', mergeText: '2 approvals · checks green', label: 'main: no direct push, PR only', suggest: 'push to a fix/ or feature/ branch, then open a PR into main' },
+        '*': { protected: false, directPush: true, label: 'developers can push' },
+        paths: [],
+        agents: 'agent commits allowed on feature/* only, tagged in audit',
+      },
+      'ml-forecast': {
+        main: { protected: true, directPush: false, approvals: 1, checks: true, push: 'direct pushes blocked for everyone', mergeText: '1 approval · checks green', label: 'main: no direct push, PR only', suggest: 'push to an exp/ branch, then open a PR into main' },
+        '*': { protected: false, directPush: true, label: 'developers can push' },
+        paths: [],
+        agents: 'agent commits allowed on exp/* and feature/*',
+      },
+    },
+    prs: [
+      {
+        number: 412, repo: 'erp', title: 'Partial refunds in POS', from: 'feature/pos-refund', into: 'staging', author: 'dev-01', opened: '54m ago',
+        required: 2, approvals: [{ by: 'nora', ago: '20m ago' }], checks: { state: 'pass', tests: '24 / 24' }, state: 'open', commits: 3,
+        needs: { who: 'shawki', why: 'tech lead for migrations' },
+        files: [
+          { path: 'addons/pos_refund/models/pos_order.py', add: 168, del: 22 },
+          { path: 'addons/pos_refund/wizard/refund_wizard.py', add: 96, del: 0 },
+          { path: 'migrations/17.0.1.3/post-migrate.py', add: 31, del: 0, flag: 'changes data' },
+          { path: 'addons/pos_refund/views/refund_wizard_views.xml', add: 4, del: 20 },
+          { path: 'addons/pos_refund/tests/test_partial_refund.py', add: 6, del: 3 },
+          { path: 'addons/pos_refund/__manifest__.py', add: 2, del: 1 },
+          { path: 'addons/pos_refund/static/src/js/refund_button.js', add: 5, del: 2 },
+        ],
+        notes: ['migration backfills about 18,000 orders on staging · review the SQL first'],
+      },
+      { number: 410, repo: 'erp', title: 'Inventory valuation rounding', from: 'feature/inventory', into: 'staging', author: 's-7f3a', agent: 'Claude Code', opened: '25m ago', required: 2, approvals: [], checks: { state: 'running' }, state: 'open', commits: 6, files: [], notes: [] },
+      { number: 409, repo: 'erp', title: 'Payroll export to bank format', from: 'feature/hr-payroll', into: 'staging', author: 'dev-02', opened: '3h ago', required: 2, approvals: [{ by: 'nora', ago: '1h ago' }, { by: 'lead', ago: '12m ago' }], checks: { state: 'pass', tests: '31 / 31' }, state: 'merged', mergedAt: '14:12', commits: 4, files: [], notes: [] },
+      { number: 407, repo: 'erp', title: 'Release 17.0.1.3', from: 'staging', into: 'main', author: 'lead', opened: '1d ago', required: 3, approvals: [{ by: 'nora', ago: '3h ago' }], checks: { state: 'pass', tests: '212 / 212' }, state: 'open', commits: 14, files: [], notes: [] },
+      { number: 405, repo: 'portal', title: 'Login redirect after SSO', from: 'fix/login-redirect', into: 'staging', author: 'dev-03', opened: '2h ago', required: 2, approvals: [], checks: { state: 'fail', failed: 'secrets scan · AWS key in config.py' }, state: 'open', commits: 2, files: [], notes: [] },
+    ],
+    audit: [
+      { id: 'ev-8790', time: '13:22', actor: 's-a017', action: 'push', target: 'addons/hr/security/ir.model.access.csv', decision: 'held', note: 'needs tech lead', repo: 'erp' },
+      { id: 'ev-8797', time: '13:40', actor: 'dev-03', action: 'push', target: 'fix/login-redirect · secrets scan', decision: 'blocked', note: 'AWS key in config.py', repo: 'portal' },
+      { id: 'ev-8801', time: '13:51', actor: 'dev-01', action: 'open pr', target: 'PR #412 feature/pos-refund → staging', decision: 'allowed', note: '', repo: 'erp', pr: 412 },
+      { id: 'ev-8806', time: '13:58', actor: 'nora', action: 'approve', target: 'PR #412', decision: 'recorded', note: '', repo: 'erp', pr: 412 },
+      { id: 'ev-8809', time: '14:05', actor: 's-7f3a', action: 'push', target: 'feature/inventory · 3 commits', decision: 'allowed', note: 'Claude Code on vps-1', repo: 'erp' },
+      { id: 'ev-8812', time: '14:03', actor: 'ahmed', action: 'push', target: 'main · 1 commit', decision: 'blocked', note: 'main: no direct push', repo: 'erp', rule: 'main: no direct push' },
+      { id: 'ev-8811', time: '14:12', actor: 'lead', action: 'merge', target: 'PR #409 → staging', decision: 'allowed', note: '2 approvals', repo: 'erp', pr: 409 },
+    ],
+    machines: [
+      { name: 'mbp-shawki', os: 'macOS', online: true, cpu: 22, self: true },
+      { name: 'vps-1', os: 'Linux', online: true, cpu: 61 },
+      { name: 'gpu-a100', os: 'Linux', online: true, cpu: 12 },
+      { name: 'win-qa', os: 'Windows', online: false, offlineFor: '2h' },
+    ],
+    sessions: [
+      { id: 's-7f3a', agent: 'Claude Code', resume: 'claude --resume', machine: 'vps-1', repo: 'erp', branch: 'feature/inventory', state: 'running', turns: 142, cpu: 38, updated: '12s ago', head: 'a91c2e4', changed: 3, stash: 1, backup: '4m ago' },
+      { id: 's-2c91', agent: 'Codex', resume: 'codex resume', machine: 'vps-1', repo: 'erp', branch: 'feature/pos-refund', state: 'waiting', turns: 37, cpu: 0, updated: '1m ago', head: '5d20b7c', changed: 7, stash: 0, backup: '2m ago',
+        ask: { question: 'Apply the migration to the staging database?', short: 'apply the migration to staging?', options: ['Yes, run it on staging', 'Run it on erp_test first', 'No, show me the SQL'] } },
+      { id: 's-a017', agent: 'Codex', resume: 'codex resume', machine: 'vps-1', repo: 'erp', branch: 'feature/hr-payroll', state: 'running', turns: 9, cpu: 21, updated: '4s ago', head: '0f61a2d', changed: 1, stash: 0, backup: '12m ago' },
+      { id: 's-91be', agent: 'Claude Code', resume: 'claude --resume', machine: 'mbp-shawki', repo: 'portal', branch: 'fix/login-redirect', state: 'running', turns: 23, cpu: 14, updated: '30s ago', head: '7aa0c19', changed: 2, stash: 0, backup: '8m ago' },
+      { id: 's-d402', agent: 'Claude Code', resume: 'claude --resume', machine: 'mbp-shawki', repo: 'erp', branch: 'feature/mrp-routing', state: 'idle', turns: 58, cpu: 0, updated: '25m ago', head: '3c8e2a1', changed: 0, stash: 0, backup: '25m ago' },
+      { id: 's-c3f8', agent: 'Claude Code', resume: 'claude --resume', machine: 'gpu-a100', repo: 'ml-forecast', branch: 'exp/lstm', state: 'running', turns: 77, cpu: 12, updated: '9s ago', head: 'e10fa33', changed: 4, stash: 0, backup: '6m ago' },
+      { id: 's-e55b', agent: 'OpenCode', resume: 'opencode --continue', machine: 'win-qa', repo: 'portal', branch: 'main', state: 'suspended', turns: 44, cpu: 0, updated: '2h ago', head: 'b3e1f70', changed: 0, stash: 0, backup: '2h ago' },
+    ],
+    backups: [
+      { id: 'b-0098', session: 's-7f3a', agent: 'Claude Code', machine: 'mbp-shawki', label: 'moved to vps-1', turn: 61, sizeMb: 0.8, created: 'yesterday', head: '1be03c7', files: 1, prompt: 'first pass on inventory valuation', repo: 'erp' },
+      { id: 'b-0120', session: 's-e55b', agent: 'OpenCode', machine: 'win-qa', label: 'before offline', turn: 44, sizeMb: 1.1, created: '2h ago', head: 'b3e1f70', files: 0, prompt: 'check SSO callback on Edge', repo: 'portal' },
+      { id: 'b-0133', session: 's-7f3a', agent: 'Claude Code', machine: 'vps-1', label: 'auto', turn: 114, sizeMb: 1.7, created: '20m ago', head: '52f9e80', files: 4, prompt: 'move quant logic into stock_ext', repo: 'erp' },
+      { id: 'b-0137', session: 's-a017', agent: 'Codex', machine: 'vps-1', label: 'auto', turn: 6, sizeMb: 0.4, created: '12m ago', head: '0f61a2d', files: 1, prompt: 'add bank export format for payroll', repo: 'erp' },
+      { id: 'b-0139', session: 's-7f3a', agent: 'Claude Code', machine: 'vps-1', label: 'auto', turn: 128, sizeMb: 1.9, created: '10m ago', head: '7c04b19', files: 2, prompt: 'refactor _compute_qty_available', repo: 'erp',
+        diff: [{ path: 'models/stock_move.py', add: 48, del: 12 }, { path: 'models/stock_quant.py', add: 9, del: 3 }] },
+      { id: 'b-0141', session: 's-2c91', agent: 'Codex', machine: 'vps-1', label: 'auto · before risky', turn: 36, sizeMb: 0.9, created: '2m ago', head: '5d20b7c', files: 7, prompt: 'write the migration for refunded_amount', repo: 'erp' },
+      { id: 'b-0142', session: 's-7f3a', agent: 'Claude Code', machine: 'vps-1', label: 'before refactor', turn: 142, sizeMb: 2.1, created: 'just now', head: 'a91c2e4', files: 3, prompt: 'add tests for stock.move.line rounding', repo: 'erp' },
+    ],
+    backupPolicy: { every: '10 min while running', everyTurn: false, beforeRisky: true, beforeTransfer: true, keep: '30 days · last 20 per session', storage: 'gitroots cloud', region: 'eu-central' },
+    tunnels: [
+      { id: 't-27', session: 's-c3f8', machine: 'gpu-a100', target: ':8888 Jupyter', access: 'only you', viewers: 0, traffic: '41 MB', openFor: '1h 12m' },
+    ],
+    // What an attached agent said recently (attach + watch live view).
+    transcripts: {
+      's-2c91': [
+        { who: 'you', text: 'Add partial refunds to the POS order flow, then write the migration.' },
+        { who: 'agent', text: 'Added refund_line_ids to pos.order and a wizard for partial amounts.\nTests pass locally (24 / 24).\n\nNext step needs a database change:\n§migrations/17.0.1.3/post-migrate.py§  adds column pos_order.refunded_amount\nand backfills 18,402 orders on *staging*.' },
+      ],
+    },
+    hiddenTurns: { 's-2c91': 34 },
+    counters: { ev: 8813, backup: 143, tunnel: 31, session: 0 },
+  };
+}
+
+// Live log pool for the watch screen (cycled in demo mode).
+export const LIVE_POOL = (file = 'addons/stock_ext/models/stock_move.py') => [
+  { verb: 'read', body: file },
+  { verb: 'edit', body: `${file}   `, add: '+24', del: ' −6' },
+  { verb: 'run', body: 'odoo-bin -d erp_test --test-tags /stock_ext -u stock_ext --stop-after-init', running: true },
+  { verb: 'output', body: 'Ran 18 tests in 7.42s' },
+  { verb: 'output', body: '', fail: 'FAIL: test_move_line_qty_rounding  expected 2.0, got 1.999' },
+  { verb: 'think', body: 'Rounding should use the product UoM precision, not the company one.' },
+  { verb: 'edit', body: `${file}   `, add: '+3', del: ' −1' },
+  { verb: 'run', body: 'odoo-bin -d erp_test --test-tags /stock_ext --stop-after-init', running: true },
+  { verb: 'output', body: 'Ran 18 tests in 7.38s · ', add: 'OK' },
+  { verb: 'git', body: 'commit -m "fix: round move line qty with product UoM"  ', add: 'a91c2e5' },
+  { verb: 'backup', body: 'auto · b-0144 · 2.1 MB', add: '  ✓' },
+  { verb: 'read', body: 'addons/stock_ext/models/stock_quant.py' },
+  { verb: 'think', body: 'Quant reservation has the same rounding issue; checking callers.' },
+  { verb: 'edit', body: 'addons/stock_ext/models/stock_quant.py   ', add: '+7', del: ' −2' },
+];
+
+export const FOLLOW_POOL = [
+  { actor: 'shawki', action: 'approve', target: 'PR #412', decision: 'recorded' },
+  { actor: 'shawki', action: 'merge', target: 'PR #412 → staging', decision: 'allowed', note: '2 approvals · checks green' },
+  { actor: 's-7f3a', action: 'push', target: 'feature/inventory · 1 commit', decision: 'allowed', note: 'Claude Code on gpu-a100' },
+  { actor: 'dev-02', action: 'push', target: 'staging · 1 commit', decision: 'blocked', note: 'staging: PR only' },
+  { actor: 'portal', action: 'rule change', target: 'main · approvals 1 → 2', decision: 'held', note: 'needs a second admin' },
+  { actor: 'dev-03', action: 'push', target: 'fix/login-redirect · 2 commits', decision: 'allowed', note: 'secrets scan clean' },
+  { actor: 's-c3f8', action: 'push', target: 'ml-forecast exp/lstm', decision: 'allowed', note: 'Claude Code on gpu-a100' },
+  { actor: 'nora', action: 'approve', target: 'PR #410', decision: 'recorded' },
+  { actor: 'ahmed', action: 'clone', target: 'erp', decision: 'allowed', note: 'mbp-ahmed · macOS' },
+  { actor: 's-2c91', action: 'push', target: 'migrations/17.0.1.3', decision: 'held', note: 'data migration · needs review' },
+];

package/src/data/store.js

@@ -0,0 +1,145 @@
+// Local store. In demo mode the org starts from the sample data and every change
+// (approvals, merges, backups, transfers, tunnels, audit events) is kept in
+// $GITROOTS_HOME/state.json (default ~/.gitroots) so commands build on each other.
+//
+// A connected backend would implement the same methods against the gitroots API.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { sampleData } from './sample.js';
+
+export function home() {
+  return process.env.GITROOTS_HOME || path.join(os.homedir(), '.gitroots');
+}
+
+function stateFile() { return path.join(home(), 'state.json'); }
+
+function globMatch(pattern, value) {
+  const re = new RegExp(`^${pattern
+    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*\*/g, '\u0000')
+    .replace(/\*/g, '[^/]*')
+    .replace(/\u0000/g, '.*')
+    .replace(/\?/g, '.')}$`);
+  return re.test(value);
+}
+
+export class Store {
+  constructor(data, { persist = true } = {}) {
+    this.d = data;
+    this.persist = persist;
+    this.mode = 'demo';
+  }
+
+  static open() {
+    let data;
+    try { data = JSON.parse(fs.readFileSync(stateFile(), 'utf8')); } catch { data = null; }
+    if (!data || data.version !== 1) data = { version: 1, ...sampleData() };
+    return new Store(data);
+  }
+
+  static reset() {
+    try { fs.rmSync(stateFile()); } catch { /* none */ }
+  }
+
+  save() {
+    if (!this.persist) return;
+    try {
+      fs.mkdirSync(home(), { recursive: true });
+      fs.writeFileSync(stateFile(), JSON.stringify(this.d, null, 1));
+    } catch { /* read-only home: keep going in memory */ }
+  }
+
+  get org() { return this.orgOverlay || this.d.org; }
+
+  // ---- repos & rules
+  repos() { return this.d.repos; }
+  repo(name) {
+    const r = this.d.repos.find((x) => x.name === name);
+    if (!r) throw new Error(`no repository "${name}" · see gitroots repo list`);
+    return r;
+  }
+  repoByRemote(url) {
+    if (!url) return null;
+    const base = url.replace(/\/+$/, '').split(/[/:]/).pop().replace(/\.git$/, '');
+    return this.d.repos.find((r) => r.name === base || (r.remote && url.includes(r.remote.replace(/^.*?:/, '').replace(/\.git$/, '')))) || null;
+  }
+  branches(repo) { this.repo(repo); return this.d.branches[repo] || []; }
+  rules(repo) { return this.d.rules[repo] || { '*': { protected: false, directPush: true, label: 'developers can push' }, paths: [] }; }
+  ruleFor(repo, branch) {
+    const rules = this.rules(repo);
+    if (rules[branch]) return { name: branch, ...rules[branch] };
+    const keys = Object.keys(rules).filter((k) => k.includes('*') && k !== '*' && globMatch(k, branch));
+    if (keys.length) return { name: keys[0], ...rules[keys[0]] };
+    return { name: '*', ...(rules['*'] || { protected: false, directPush: true, label: 'developers can push' }) };
+  }
+  protectedPaths(repo) { return (this.rules(repo).paths || []); }
+  matchPath(pattern, file) { return globMatch(pattern, file); }
+
+  // ---- PRs
+  prs(repo) { return this.d.prs.filter((p) => !repo || p.repo === repo); }
+  pr(n) {
+    const num = Number(String(n).replace(/^#/, ''));
+    const p = this.d.prs.find((x) => x.number === num);
+    if (!p) throw new Error(`no pull request #${n} · see gitroots pr list`);
+    return p;
+  }
+
+  // ---- audit
+  audit() { return this.d.audit; }
+  event(id) {
+    const e = this.d.audit.find((x) => x.id === id);
+    if (!e) throw new Error(`no audit event ${id}`);
+    return e;
+  }
+  nextEventId() { return `ev-${this.d.counters.ev++}`; }
+  record(ev) {
+    const now = new Date();
+    const e = { id: this.nextEventId(), time: `${String(now.getHours()).padStart(2, '0')}:${String(now.getMinutes()).padStart(2, '0')}`, at: now.toISOString(), note: '', ...ev };
+    this.d.audit.push(e);
+    return e;
+  }
+
+  // ---- agents
+  machines() { return this.d.machines; }
+  machine(name) {
+    const m = this.d.machines.find((x) => x.name === name);
+    if (!m) throw new Error(`no machine "${name}" · machines: ${this.d.machines.map((x) => x.name).join(', ')}`);
+    return m;
+  }
+  sessions() { return this.d.sessions; }
+  session(id) {
+    const s = this.d.sessions.find((x) => x.id === id || x.id === `s-${id}`);
+    if (!s) throw new Error(`no agent session "${id}" · see gitroots watch`);
+    return s;
+  }
+  transcript(id) { return this.d.transcripts[id] || []; }
+
+  backups() { return this.d.backups; }
+  backup(id) {
+    const b = this.d.backups.find((x) => x.id === id);
+    if (!b) throw new Error(`no backup ${id} · see gitroots backups`);
+    return b;
+  }
+  nextBackupId() { return `b-${String(this.d.counters.backup++).padStart(4, '0')}`; }
+
+  tunnels() { return this.d.tunnels; }
+  nextTunnelId() { return `t-${this.d.counters.tunnel++}`; }
+  nextSessionId() {
+    this.d.counters.session++;
+    return `s-${Math.floor(Math.random() * 0xffff).toString(16).padStart(4, '0')}`;
+  }
+
+  // What needs the signed-in user.
+  needsYou() {
+    const me = this.org.user;
+    const items = [];
+    for (const p of this.d.prs) {
+      if (p.state === 'open' && p.needs && p.needs.who === me && !p.approvals.some((a) => a.by === me)) items.push({ kind: 'review', pr: p });
+    }
+    for (const s of this.d.sessions) if (s.state === 'waiting' && s.ask) items.push({ kind: 'agent', session: s });
+    // signed in, blocked pushes come from the real audit log instead
+    if (!this.api) for (const e of this.d.audit.filter((x) => x.decision === 'blocked' && x.action === 'push' && x.rule && !x.ack)) items.push({ kind: 'blocked', event: e });
+    return items;
+  }
+}

package/src/git/checks.js

@@ -0,0 +1,96 @@
+// Real checks gitroots runs on commits before they leave the machine.
+import { spawnSync } from 'node:child_process';
+
+export const ZERO = /^0+$/;
+
+export function git(args, cwd = process.cwd()) {
+  const r = spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
+  if (r.error) throw r.error;
+  if (r.status !== 0) {
+    const err = new Error((r.stderr || '').trim() || `git ${args[0]} failed`);
+    err.status = r.status;
+    throw err;
+  }
+  return r.stdout;
+}
+
+export function tryGit(args, cwd) { try { return git(args, cwd).trim(); } catch { return ''; } }
+
+const MAX_COMMITS = 500;
+
+// Commits that would be sent: local..remote, or everything not on any remote for a new branch.
+export function commitsToPush(localSha, remoteSha, cwd) {
+  const args = remoteSha && !ZERO.test(remoteSha) && objectExists(remoteSha, cwd)
+    ? ['rev-list', `--max-count=${MAX_COMMITS}`, `${remoteSha}..${localSha}`]
+    : ['rev-list', `--max-count=${MAX_COMMITS}`, localSha, '--not', '--remotes'];
+  return git(args, cwd).split('\n').filter(Boolean);
+}
+
+function objectExists(sha, cwd) {
+  const r = spawnSync('git', ['cat-file', '-e', `${sha}^{commit}`], { cwd });
+  return r.status === 0;
+}
+
+export function changedFiles(commits, cwd) {
+  const files = new Set();
+  for (const sha of commits) {
+    for (const f of git(['diff-tree', '--no-commit-id', '--name-only', '-r', '-m', '--root', sha], cwd).split('\n')) if (f) files.add(f);
+  }
+  return [...files];
+}
+
+// Added lines with file and line number, from each commit's patch.
+export function addedLines(commits, cwd) {
+  const outLines = [];
+  for (const sha of commits) {
+    const patch = git(['show', '--format=', '--unified=0', '--no-color', '--no-ext-diff', '-m', '--first-parent', sha], cwd);
+    let file = null;
+    let ln = 0;
+    for (const l of patch.split('\n')) {
+      if (l.startsWith('+++ ')) { file = l.slice(4).replace(/^b\//, ''); continue; }
+      if (l.startsWith('@@')) { const m = /\+(\d+)/.exec(l); ln = m ? Number(m[1]) : 0; continue; }
+      if (l.startsWith('+') && file && file !== '/dev/null') { outLines.push({ sha, file, line: ln, text: l.slice(1) }); ln++; continue; }
+      if (!l.startsWith('-') && !l.startsWith('\\')) ln++;
+    }
+  }
+  return outLines;
+}
+
+export const SECRET_PATTERNS = [
+  { name: 'AWS access key', re: /\b(AKIA|ASIA)[0-9A-Z]{16}\b/ },
+  { name: 'AWS secret key', re: /aws_secret_access_key\s*[:=]\s*['"]?[A-Za-z0-9/+=]{40}/i },
+  { name: 'private key', re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY( BLOCK)?-----/ },
+  { name: 'GitHub token', re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{60,}\b/ },
+  { name: 'GitLab token', re: /\bglpat-[A-Za-z0-9_-]{20}\b/ },
+  { name: 'Slack token', re: /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/ },
+  { name: 'Stripe live key', re: /\b[sr]k_live_[A-Za-z0-9]{20,}\b/ },
+  { name: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { name: 'Anthropic API key', re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/ },
+  { name: 'OpenAI API key', re: /\bsk-(?:proj-)?[A-Za-z0-9]{32,}\b/ },
+  { name: 'password', re: /(?:password|passwd|pwd|secret|api_key|apikey|token)\w*['"]?\s*[:=]\s*['"][^'"\s]{8,}['"]/i, skip: /(example|changeme|placeholder|your[_-]|xxx|\*\*\*|<|\$\{|os\.environ|getenv|process\.env)/i },
+];
+
+export function scanSecrets(lines) {
+  const hits = [];
+  for (const l of lines) {
+    for (const p of SECRET_PATTERNS) {
+      if (p.re.test(l.text) && !(p.skip && p.skip.test(l.text))) { hits.push({ ...l, kind: p.name }); break; }
+    }
+  }
+  return hits;
+}
+
+export function authors(commits, cwd) {
+  if (!commits.length) return [];
+  return git(['show', '-s', '--format=%H%x09%an%x09%ae%x09%G?', ...commits], cwd)
+    .split('\n').filter(Boolean)
+    .map((l) => { const [sha, name, email, sig] = l.split('\t'); return { sha, name, email, signed: sig === 'G' || sig === 'U', sig }; });
+}
+
+export const MIGRATION_RE = /(^|\/)(migrations?|migrate|alembic\/versions|db\/migrate)\/|(^|\/)[^/]*migrat[^/]*\.(py|sql|rb|js|ts)$|\.sql$/i;
+
+export function lastSubjectSlug(sha, cwd) {
+  const subj = tryGit(['log', '-1', '--format=%s', sha], cwd);
+  const slug = subj.toLowerCase().replace(/^[a-z]+(\([^)]*\))?:\s*/, '').replace(/[^a-z0-9]+/g, '-').split('-').filter(Boolean).slice(0, 4).join('-');
+  return slug || 'my-change';
+}

package/src/installer.js

@@ -0,0 +1,96 @@
+// Native install / update, mirroring install.sh:
+//   <base>/latest                         "0.5.0"
+//   <base>/<version>/manifest.json        { version, platforms: { "darwin-arm64": { file, checksum, size } } }
+//   <base>/<version>/<file>               gitroots-<version>-<platform>.tar.gz (.zip on Windows)
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { DOWNLOAD_BASE, nativePaths, platformKey } from './runtime.js';
+
+async function fetchOk(url, timeout = 30000) {
+  let res;
+  try { res = await fetch(url, { signal: AbortSignal.timeout(timeout), headers: { 'User-Agent': 'gitroots-cli' } }); } catch (e) {
+    throw new Error(`can't reach ${url} (${e.cause?.code || e.name})`);
+  }
+  if (!res.ok) throw new Error(`${res.status} from ${url}`);
+  return res;
+}
+
+export async function latestVersion(base = DOWNLOAD_BASE, timeout) {
+  const v = (await (await fetchOk(`${base}/latest`, timeout)).text()).trim();
+  if (!/^\d+\.\d+\.\d+([-+][\w.]+)?$/.test(v)) throw new Error(`${base}/latest is not a version (${v.slice(0, 40)})`);
+  return v;
+}
+
+export async function manifest(version, base = DOWNLOAD_BASE) {
+  return (await fetchOk(`${base}/${version}/manifest.json`)).json();
+}
+
+export function newer(a, b) {
+  const pa = a.split(/[.-]/).map(Number);
+  const pb = b.split(/[.-]/).map(Number);
+  for (let i = 0; i < 3; i++) if ((pa[i] || 0) !== (pb[i] || 0)) return (pa[i] || 0) > (pb[i] || 0);
+  return false;
+}
+
+// Download, verify and install one version. Returns the installed binary path.
+export async function installNative(version, { base = DOWNLOAD_BASE, onProgress = () => {} } = {}) {
+  const key = platformKey();
+  const man = await manifest(version, base);
+  const entry = man.platforms && man.platforms[key];
+  if (!entry) throw new Error(`no gitroots ${version} build for ${key} · available: ${Object.keys(man.platforms || {}).join(', ')}`);
+
+  const res = await fetchOk(`${base}/${version}/${entry.file}`, 600000);
+  const total = Number(res.headers.get('content-length')) || entry.size || 0;
+  const chunks = [];
+  let got = 0;
+  for await (const chunk of res.body) { chunks.push(chunk); got += chunk.length; if (total) onProgress(got / total); }
+  const buf = Buffer.concat(chunks);
+  const sum = crypto.createHash('sha256').update(buf).digest('hex');
+  if (sum !== entry.checksum) throw new Error(`checksum mismatch for ${entry.file} · expected ${entry.checksum.slice(0, 12)}…, got ${sum.slice(0, 12)}… · nothing was installed`);
+
+  const { data, bin, launcher } = nativePaths();
+  const dir = path.join(data, 'versions', version);
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gitroots-'));
+  const archive = path.join(tmp, entry.file);
+  fs.writeFileSync(archive, buf);
+  fs.mkdirSync(dir, { recursive: true });
+  const ok = entry.file.endsWith('.zip')
+    ? spawnSync('powershell', ['-NoProfile', '-Command', `Expand-Archive -Force -Path '${archive}' -DestinationPath '${dir}'`], { stdio: 'ignore' }).status === 0
+    : spawnSync('tar', ['-xzf', archive, '-C', dir], { stdio: 'ignore' }).status === 0;
+  fs.rmSync(tmp, { recursive: true, force: true });
+  if (!ok) throw new Error(`could not unpack ${entry.file}`);
+  const exe = path.join(dir, process.platform === 'win32' ? 'gitroots.exe' : 'gitroots');
+  if (!fs.existsSync(exe)) throw new Error(`${entry.file} has no gitroots binary`);
+  if (process.platform !== 'win32') fs.chmodSync(exe, 0o755);
+
+  fs.mkdirSync(bin, { recursive: true });
+  if (process.platform === 'win32') {
+    // A running .exe can be renamed but not overwritten.
+    if (fs.existsSync(launcher)) { try { fs.rmSync(`${launcher}.old`, { force: true }); } catch { /* in use */ } fs.renameSync(launcher, `${launcher}.old`); }
+    fs.copyFileSync(exe, launcher);
+  } else {
+    const link = `${launcher}.new`;
+    try { fs.rmSync(link, { force: true }); } catch { /* none */ }
+    fs.symlinkSync(exe, link);
+    fs.renameSync(link, launcher);
+  }
+  pruneVersions(data, version);
+  return { exe, launcher, version, platform: key };
+}
+
+// Keep the current and the previous version.
+function pruneVersions(data, current) {
+  const vdir = path.join(data, 'versions');
+  let all = [];
+  try { all = fs.readdirSync(vdir); } catch { return; }
+  const sorted = all.filter((v) => /^\d/.test(v)).sort((a, b) => (newer(a, b) ? -1 : 1));
+  const keep = new Set([current, sorted.find((v) => v !== current)]);
+  for (const v of sorted) if (!keep.has(v)) fs.rmSync(path.join(vdir, v), { recursive: true, force: true });
+}
+
+export function onPath(dir) {
+  return (process.env.PATH || '').split(path.delimiter).some((p) => path.resolve(p) === path.resolve(dir));
+}

package/src/runtime.js

@@ -0,0 +1,63 @@
+// Where gitroots is running from: an npm/source install (node + bin/gitroots.js)
+// or a standalone binary (Node single executable application) from install.sh.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const VERSION = '0.5.0';
+
+// Default download location for install.sh / gitroots update. Override with GITROOTS_DOWNLOAD_BASE.
+export const DOWNLOAD_BASE = process.env.GITROOTS_DOWNLOAD_BASE || 'https://gitroots.com/cli';
+export const NPM_PACKAGE = 'gitroots';
+
+let sea = null;
+try { sea = typeof process.getBuiltinModule === 'function' ? process.getBuiltinModule('node:sea') : null; } catch { sea = null; }
+
+export const isBinary = Boolean(sea && typeof sea.isSea === 'function' && sea.isSea());
+
+function here(rel) { return fileURLToPath(new URL(rel, import.meta.url)); }
+
+export function asset(name) {
+  if (isBinary) return Buffer.from(sea.getAsset(name));
+  return fs.readFileSync(here(`../assets/${name}`));
+}
+
+// Native install layout (same idea as Claude Code's native installer):
+//   ~/.local/share/gitroots/versions/<version>/gitroots   the binaries
+//   ~/.local/bin/gitroots                                 symlink to the current one
+export function nativePaths() {
+  const home = os.homedir();
+  if (process.platform === 'win32') {
+    const base = path.join(home, '.local');
+    return { data: path.join(base, 'share', 'gitroots'), bin: path.join(base, 'bin'), launcher: path.join(base, 'bin', 'gitroots.exe') };
+  }
+  const data = process.env.XDG_DATA_HOME ? path.join(process.env.XDG_DATA_HOME, 'gitroots') : path.join(home, '.local', 'share', 'gitroots');
+  return { data, bin: path.join(home, '.local', 'bin'), launcher: path.join(home, '.local', 'bin', 'gitroots') };
+}
+
+export function installMethod() {
+  if (isBinary) return 'native';
+  const bin = here('../bin/gitroots.js');
+  if (/[\\/]node_modules[\\/]/.test(bin)) return 'npm';
+  return 'source';
+}
+
+// The command that runs this gitroots, for hooks: [executable, ...args]
+export function selfCommand() {
+  if (isBinary) {
+    const { launcher } = nativePaths();
+    return [fs.existsSync(launcher) ? launcher : process.execPath];
+  }
+  return [process.execPath, here('../bin/gitroots.js')];
+}
+
+export function platformKey() {
+  const os_ = process.platform === 'win32' ? 'win32' : process.platform;
+  const arch = process.arch === 'x64' ? 'x64' : process.arch === 'arm64' ? 'arm64' : process.arch;
+  let musl = false;
+  if (os_ === 'linux') {
+    try { musl = !process.report.getReport().header.glibcVersionRuntime; } catch { musl = false; }
+  }
+  return `${os_}-${arch}${musl ? '-musl' : ''}`;
+}