gitroots 0.5.0 → 0.6.0

package/src/commands/audit.js

@@ -1,150 +0,0 @@
-// gitroots audit · audit <ev-id> · audit follow
-import { c, h, pad, fit, state as colorState } from '../ui/ansi.js';
-import { line, write, motion, sleep } from '../ui/term.js';
-import { dot, decision, json, csv, next } from '../ui/components.js';
-import { FOLLOW_POOL } from '../data/sample.js';
-import { apiAudit } from '../connected.js';
-
-export async function run(_cmd, rest, flags, store) {
-  const [sub] = rest;
-  if (sub === 'follow' || flags.follow) return follow(flags, store);
-  if (sub && /^ev-\d+$/.test(sub)) return detail(sub, flags, store);
-  if (sub) throw new Error(`unknown: gitroots audit ${sub} · try gitroots audit, audit <ev-id>, audit follow`);
-  return list(flags, store);
-}
-
-function sinceMinutes(s) {
-  const m = /^(\d+)\s*(m|h|d)$/.exec(String(s));
-  if (!m) throw new Error(`--since takes 30m, 2h or 1d (got ${s})`);
-  return Number(m[1]) * { m: 1, h: 60, d: 1440 }[m[2]];
-}
-
-async function list(flags, store) {
-  let ev = store.api ? await apiAudit(store) : [...store.audit()];
-  if (flags.repo) ev = ev.filter((e) => e.repo === flags.repo);
-  if (flags.actor) ev = ev.filter((e) => e.actor === flags.actor);
-  if (flags.action) ev = ev.filter((e) => e.action === flags.action);
-  if (flags.decision) ev = ev.filter((e) => e.decision === flags.decision);
-  if (flags.pr) ev = ev.filter((e) => String(e.pr) === String(flags.pr).replace('#', ''));
-  if (flags.since) {
-    const mins = sinceMinutes(flags.since);
-    ev = ev.filter((e) => {
-      if (e.at) return (Date.now() - Date.parse(e.at)) / 60000 <= mins;
-      // sample events carry only a clock time, as seen from the sample's 14:21
-      const [hh, mm] = e.time.split(':').map(Number);
-      return 14 * 60 + 21 - (hh * 60 + mm) <= mins;
-    });
-  }
-  ev.sort((a, b) => (b.at || '').localeCompare(a.at || '') || b.time.localeCompare(a.time) || b.id.localeCompare(a.id));
-  const total = ev.length;
-  if (flags.json) { json(ev); return 0; }
-  if (flags.csv) { csv(ev, ['id', 'time', 'at', 'actor', 'action', 'target', 'decision', 'note', 'repo', 'pr']); return 0; }
-  const limit = flags.all ? ev.length : Number(flags.limit || 7);
-  const shown = ev.slice(0, limit);
-  line(`  ${h(`${pad('TIME', 8)}${pad('ACTOR', 13)}${pad('ACTION', 16)}${pad('TARGET', 40)}${pad('DECISION', 35)}ID`)}`);
-  for (const e of shown) {
-    line(`  ${c.m(pad(e.time, 8))}${fit(e.actor, 12)} ${fit(e.action, 15)} ${fit(e.target, 39)} ${pad(decision(e.decision), 12)}${c.m(pad(e.note || '', 23))}${c.m(e.id)}`);
-  }
-  if (!shown.length) line(c.m('  no events match'));
-  line(`    ${c.m(`${shown.length} of ${total} events · --actor · --action · --decision blocked · --json · --csv for compliance exports`)}`);
-  const blocked = shown.find((e) => e.decision === 'blocked');
-  line();
-  line(next(blocked ? `gitroots audit ${blocked.id}` : 'gitroots audit follow'));
-  return 0;
-}
-
-async function detail(id, flags, store) {
-  let e;
-  if (store.api) {
-    e = (await apiAudit(store)).find((x) => x.id === id);
-    if (!e) throw new Error(`no audit event ${id}`);
-  } else e = store.event(id);
-  if (flags.json) { json(e); return 0; }
-  line(`  ${c.b(e.id)}   ${decision(e.decision)}   ${c.m(`${e.time}${e.at ? ` · ${e.at}` : ''}`)}`);
-  line();
-  const row = (k, v) => v && line(`    ${c.s(pad(k, 10))}${v}`);
-  row('actor', e.actor);
-  row('action', e.action);
-  row('repo', e.repo);
-  row('target', e.target);
-  row('rule', e.rule);
-  if (e.note !== e.rule) row('note', e.note);
-  if (e.pr) row('pr', `#${e.pr}`);
-  if (e.metadata && Object.keys(e.metadata).length) row('metadata', c.m(JSON.stringify(e.metadata)));
-  line();
-  if (e.decision === 'blocked' && e.action === 'push') {
-    line(`    ${c.m('nothing left the machine · the attempt is kept for review')}`);
-    if (!e.ack && !store.api) { e.ack = true; store.save(); }
-    line();
-    line(next(e.repo ? `gitroots branch rules ${e.repo} ${e.target.split(' · ')[0]}` : 'gitroots audit'));
-  } else if (e.pr) line(next(`gitroots pr view ${e.pr}`));
-  else line(next('gitroots audit'));
-  return 0;
-}
-
-function hms(d) { return d.toTimeString().slice(0, 8); }
-
-// Signed in: poll the API and print events as they arrive.
-async function followApi(flags, store) {
-  if (!flags.json) {
-    line(`${c.g('● live')}  ${c.s(`${store.org.name} · ${store.api.server}`)} ${dot()} ${c.m('ctrl-c to stop')}`);
-    line();
-  }
-  let stop = false;
-  process.on('SIGINT', () => { stop = true; });
-  const seen = new Set((await apiAudit(store)).map((e) => e.id));
-  const every = Number(flags.interval || 3) * 1000;
-  let shown = 0;
-  while (!stop) {
-    const t0 = Date.now();
-    while (!stop && Date.now() - t0 < every) await sleep(100);
-    if (stop) break;
-    let events;
-    try { events = await apiAudit(store); } catch (e) { if (!flags.json) line(c.w(`◐ ${e.message} · retrying`)); continue; }
-    const fresh = events.filter((e) => !seen.has(e.id)).sort((a, b) => a.at.localeCompare(b.at));
-    for (const e of fresh) {
-      seen.add(e.id);
-      shown++;
-      if (flags.json) process.stdout.write(`${JSON.stringify(e)}\n`);
-      else line(`${c.m(new Date(e.at).toTimeString().slice(0, 8))}   ${pad(e.actor, 13)}${pad(e.action, 16)}${pad(e.target, 40)}${pad(decision(e.decision), 11)}  ${c.m(e.note || '')}`);
-    }
-  }
-  if (!flags.json) { line(); line(c.m(`  stopped · ${shown} new events`)); }
-  return 0;
-}
-
-async function follow(flags, store) {
-  if (store.api) return followApi(flags, store);
-  const anim = motion();
-  if (!flags.json) {
-    line(`${c.g('● live')}  ${c.s('all repos · all actors')} ${dot()} ${c.m('ctrl-c to stop')}`);
-    line();
-  }
-  let i = 0;
-  let stop = false;
-  process.on('SIGINT', () => { stop = true; });
-  const max = flags.count ? Number(flags.count) : anim ? Infinity : 10;
-  while (!stop && i < max) {
-    const e = FOLLOW_POOL[i % FOLLOW_POOL.length];
-    // sample stream: shown live, not written to your audit log
-    const ev = { id: `ev-${store.d.counters.ev + i}`, at: new Date().toISOString(), time: hms(new Date()), ...e, sample: true };
-    if (flags.json) process.stdout.write(`${JSON.stringify(ev)}\n`);
-    else {
-      const row = `${c.m(hms(new Date()))}   ${pad(e.actor, 13)}${pad(e.action, 16)}${pad(e.target, 40)}${pad(decision(e.decision), 11)}  ${c.m(e.note || '')}`;
-      if (anim && colorState.color) {
-        // new rows flash with a soft green background, then settle
-        write(`${c.bg('attach')(row)}\n`);
-        await sleep(450);
-        write(`\x1b[1A\r\x1b[2K${row}\n`);
-      } else line(row);
-    }
-    i++;
-    if (anim) {
-      const wait = 1400 + Math.random() * 1800;
-      const t0 = Date.now();
-      while (!stop && Date.now() - t0 < wait) await sleep(100);
-    }
-  }
-  if (!flags.json) { line(); line(c.m(`  stopped · ${i} events`)); }
-  return 0;
-}

package/src/commands/auth.js

@@ -1,99 +0,0 @@
-// gitroots login · logout · whoami
-import fs from 'node:fs';
-import { c, pad } from '../ui/ansi.js';
-import { line, ask, select, interactive, spinner } from '../ui/term.js';
-import { brand, dot, json, next } from '../ui/components.js';
-import { Api, DEFAULT_SERVER, readConfig, writeConfig, savePassword, forgetPassword } from '../api.js';
-
-export async function run(cmd, rest, flags) {
-  if (cmd === 'logout') return logout(flags);
-  if (cmd === 'whoami') return whoami(flags);
-  return login(flags);
-}
-
-async function login(flags) {
-  const prev = readConfig();
-  const server = String(flags.server || prev.server || DEFAULT_SERVER).replace(/\/+$/, '');
-  const username = flags.username || flags.u || (interactive() ? await ask('Username or email', { def: prev.username }) : null);
-  if (!username) throw new Error('pass --username');
-  let password;
-  if (flags['password-stdin']) password = fs.readFileSync(0, 'utf8').replace(/\r?\n$/, '');
-  else if (process.env.GITROOTS_PASSWORD) password = process.env.GITROOTS_PASSWORD;
-  else password = await ask('Password', { hidden: true });
-  if (!password) throw new Error('no password given');
-
-  const api = new Api({ server, username, password });
-  const sp = spinner((f) => `${c.i(f)} ${c.s(`Signing in to ${server}…`)}`);
-  let me;
-  let orgs;
-  let memberships;
-  try {
-    me = await api.me();
-    [orgs, memberships] = await Promise.all([api.orgs(), api.memberships().catch(() => [])]);
-  } catch (e) {
-    sp.stop(`${c.r('✕')} ${e.message}`);
-    return 1;
-  }
-  sp.stop();
-  if (!me) { line(`${c.r('✕')} signed in, but the API did not return a user named ${username}`); return 1; }
-
-  const mine = memberships.filter((m) => m.user === me.id && m.is_active !== false);
-  const roleOf = (o) => (mine.find((m) => m.organization === o.id) || {}).role || (me.is_staff ? 'staff' : 'member');
-  let org = null;
-  if (flags.org) org = orgs.find((o) => o.slug === flags.org || o.name === flags.org || String(o.id) === String(flags.org));
-  else if (orgs.length === 1) org = orgs[0];
-  else if (orgs.length > 1) {
-    if (!interactive()) org = orgs[0];
-    else {
-      line(`${c.i(c.b('?'))} Which organisation?`);
-      const res = await select({
-        count: orgs.length,
-        render: (idx) => orgs.map((o, i) => `${i === idx ? c.g('❯') : ' '} ${pad(o.name, 30)}${c.m(`${o.slug} · ${roleOf(o)}`)}`).join('\n'),
-      });
-      if (res.action === 'cancel') return 1;
-      org = orgs[res.index];
-    }
-  }
-
-  const store = savePassword(server, username, password);
-  writeConfig({
-    server, username, userId: me.id, email: me.email,
-    org: org ? { id: org.id, name: org.name, slug: org.slug, role: roleOf(org), plan: org.subscription_plan } : null,
-    signedInAt: new Date().toISOString(),
-  });
-  if (flags.json) { json({ server, user: me.username, org: org?.slug || null, credentials: store }); return 0; }
-  line(`${c.g('✓')} Signed in as ${c.b(me.username)}  ${c.m(`${server}${org ? ` · org ${org.name} · ${roleOf(org)}` : ' · no organisation yet'}`)}`);
-  line(`  ${c.m(`password kept in ${store === 'keychain' ? 'the macOS Keychain' : 'credentials.json (mode 600)'}`)}`);
-  line(next('gitroots status'));
-  return 0;
-}
-
-function logout(flags) {
-  const cfg = readConfig();
-  if (!cfg.username) { line(c.m('○ not signed in')); return 0; }
-  forgetPassword(cfg.server, cfg.username);
-  writeConfig({ server: cfg.server });
-  if (flags.json) { json({ signedOut: cfg.username }); return 0; }
-  line(`${c.g('✓')} Signed out ${c.b(cfg.username)} ${c.m(`· ${cfg.server}`)}`);
-  return 0;
-}
-
-async function whoami(flags) {
-  const cfg = readConfig();
-  const api = Api.fromConfig();
-  if (!api) {
-    if (flags.json) { json({ signedIn: false }); return 1; }
-    line(`${c.m('○ not signed in')} ${dot()} sample org in use`);
-    line(next('gitroots login'));
-    return 1;
-  }
-  let me = null;
-  let err = null;
-  try { me = await api.me(); } catch (e) { err = e.message; }
-  if (flags.json) { json({ signedIn: Boolean(me), server: cfg.server, user: me, org: cfg.org, error: err }); return me ? 0 : 1; }
-  if (!me) { line(`${c.r('✕')} ${err || 'user not found'}`); return 1; }
-  line(`${brand()} ${dot()} ${c.b(me.username)} ${c.m(`<${me.email}>`)}${me.is_staff ? c.m(' · staff') : ''}`);
-  line(`  ${c.s(pad('server', 8))}${cfg.server}`);
-  line(`  ${c.s(pad('org', 8))}${cfg.org ? `${cfg.org.name} ${c.m(`(${cfg.org.slug} · ${cfg.org.role}${cfg.org.plan ? ` · ${cfg.org.plan}` : ''})`)}` : c.m('none')}`);
-  return 0;
-}

package/src/commands/backup.js

@@ -1,106 +0,0 @@
-// gitroots backup <session> · backups · backup policy
-import { c, h, pad } from '../ui/ansi.js';
-import { line, runSteps } from '../ui/term.js';
-import { dot, json, next } from '../ui/components.js';
-
-export async function run(cmd, rest, flags, store) {
-  if (cmd === 'backups' || rest[0] === 'list' || rest[0] === 'ls') return list(flags, store);
-  if (rest[0] === 'policy' && rest[1] === 'set') return policySet(flags, store);
-  if (rest[0] === 'policy') return policy(flags, store);
-  const id = rest[0];
-  if (!id) throw new Error('which session? gitroots backup <session> [--label "…"]');
-  const s = store.session(id);
-  if (flags.json) { const b = createBackup(store, s, flags.label); store.save(); json(b); return 0; }
-  const b = await backupWithSteps(store, s, flags.label || 'manual');
-  line(`    ${next(`gitroots restore ${b.id}`)}`);
-  return 0;
-}
-
-export function createBackup(store, s, label = 'manual') {
-  const sizeMb = Math.round((0.3 + s.turns * 0.0135 + s.changed * 0.05) * 10) / 10;
-  const b = {
-    id: store.nextBackupId(), session: s.id, agent: s.agent, machine: s.machine, label, turn: s.turns, sizeMb,
-    created: 'just now', at: new Date().toISOString(), head: s.head, files: s.changed, prompt: s.lastPrompt || '', repo: s.repo,
-  };
-  store.d.backups.push(b);
-  s.backup = 'just now';
-  return b;
-}
-
-export async function backupWithSteps(store, s, label, { indent = '  ' } = {}) {
-  const convoMb = Math.round(s.turns * 0.0127 * 10) / 10;
-  let b;
-  await runSteps([
-    { name: 'Conversation', live: `reading ${s.turns} turns…`, ms: 500, ok: `${s.turns} turns · ${convoMb} MB` },
-    { name: 'Workspace', live: 'git stash · diff · untracked files…', ms: 700, ok: `HEAD ${s.head} · ${s.changed} file${s.changed === 1 ? '' : 's'} changed${s.stash ? ` · ${s.stash} stash` : ''}` },
-    { name: 'Environment', live: 'sealing secrets…', ms: 300, ok: '12 vars · 2 secrets sealed' },
-  ], { nameWidth: 15, indent });
-  b = createBackup(store, s, label);
-  store.record({ actor: store.org.user, action: 'backup', target: `${s.id} · ${b.id}`, decision: 'allowed', note: label, repo: s.repo });
-  store.save();
-  const pol = store.d.backupPolicy;
-  line(`${indent}${c.g('✓')} Backup ${c.b(b.id)} saved   ${c.m(`${b.sizeMb} MB · encrypted · ${pol.storage}, ${pol.region}`)}`);
-  return b;
-}
-
-function list(flags, store) {
-  let rows = [...store.backups()];
-  if (flags.repo) rows = rows.filter((b) => b.repo === flags.repo);
-  if (flags.session) rows = rows.filter((b) => b.session === flags.session);
-  rows.sort((a, b) => b.id.localeCompare(a.id));
-  if (flags.json) { json(rows); return 0; }
-  const shown = flags.all ? rows : rows.slice(0, 7);
-  line(`  ${h(`${pad('ID', 9)}${pad('SESSION', 10)}${pad('AGENT', 14)}${pad('MACHINE', 13)}${pad('LABEL', 22)}${pad('TURN', 8)}${pad('SIZE', 10)}CREATED`)}`);
-  for (const b of shown) {
-    const fresh = b.created === 'just now';
-    line(`  ${fresh ? c.b(pad(b.id, 9)) : pad(b.id, 9)}${pad(b.session, 10)}${pad(b.agent, 14)}${pad(b.machine, 13)}${pad(b.label, 22)}${pad(String(b.turn), 8)}${pad(`${b.sizeMb} MB`, 10)}${fresh ? c.g(b.created) : c.m(b.created)}`);
-  }
-  line();
-  line(`  ${c.m(`${shown.length} of ${rows.length} backups${rows.length > shown.length ? ' · gitroots backups --all for more' : ''}`)}`);
-  line();
-  policy({}, store, true);
-  return 0;
-}
-
-function policy(flags, store, embedded = false) {
-  const p = store.d.backupPolicy;
-  if (flags.json) { json(p); return 0; }
-  const on = (v) => (v ? c.g('on') : c.m('off'));
-  line(`${h('Policy')}  ${c.m('(gitroots backup policy)')}`);
-  line(`  ${pad('every', 13)}${pad(p.every, 34)}${pad('before risky commands', 24)}${on(p.beforeRisky)}`);
-  line(`  ${pad('every turn', 13)}${pad(p.everyTurn ? c.g('on') : c.m('off'), 34)}${pad('before transfer', 24)}${on(p.beforeTransfer)}`);
-  line(`  ${pad('keep', 13)}${pad(p.keep, 34)}${pad('storage', 24)}${p.storage}${p.storage === 'gitroots cloud' ? ` ${dot()} ${c.m('or --store s3://your-bucket')}` : ''}`);
-  if (!embedded) { line(); line(next('gitroots backups')); }
-  return 0;
-}
-
-// gitroots backup policy set --every 10m --every-turn on --before-risky on --before-transfer on --keep "30 days" --store s3://bucket
-function policySet(flags, store) {
-  const p = store.d.backupPolicy;
-  const onoff = (v, name) => {
-    if (v === true || v === 'on' || v === 'true' || v === 'yes') return true;
-    if (v === false || v === 'off' || v === 'false' || v === 'no') return false;
-    throw new Error(`--${name} takes on or off`);
-  };
-  const changed = [];
-  if (flags.every !== undefined) {
-    const m = /^(\d+)\s*(m|min|h)$/.exec(String(flags.every));
-    if (!m) throw new Error('--every takes a time like 10m or 1h');
-    p.every = `${m[1]} ${m[2] === 'h' ? 'h' : 'min'} while running`; changed.push('every');
-  }
-  if (flags['every-turn'] !== undefined) { p.everyTurn = onoff(flags['every-turn'], 'every-turn'); changed.push('every turn'); }
-  if (flags['before-risky'] !== undefined) { p.beforeRisky = onoff(flags['before-risky'], 'before-risky'); changed.push('before risky commands'); }
-  if (flags['before-transfer'] !== undefined) { p.beforeTransfer = onoff(flags['before-transfer'], 'before-transfer'); changed.push('before transfer'); }
-  if (flags.keep !== undefined) { p.keep = String(flags.keep); changed.push('keep'); }
-  if (flags.store !== undefined) {
-    if (!/^(s3|gs|az):\/\/[^/]+/.test(flags.store) && flags.store !== 'gitroots') throw new Error('--store takes gitroots or s3://bucket, gs://bucket, az://container');
-    p.storage = flags.store === 'gitroots' ? 'gitroots cloud' : flags.store; changed.push('storage');
-  }
-  if (!changed.length) throw new Error('nothing to change · --every, --every-turn, --before-risky, --before-transfer, --keep, --store');
-  store.record({ actor: store.org.user, action: 'backup policy', target: changed.join(', '), decision: 'allowed' });
-  store.save();
-  if (flags.json) { json(p); return 0; }
-  line(`  ${c.g('✓')} Backup policy updated ${c.m(`· ${changed.join(', ')}`)}`);
-  line();
-  return policy({}, store);
-}

package/src/commands/demo.js

@@ -1,12 +0,0 @@
-// gitroots demo reset
-import { c } from '../ui/ansi.js';
-import { line } from '../ui/term.js';
-import { Store, home } from '../data/store.js';
-
-export async function run(_cmd, rest) {
-  const [sub] = rest;
-  if (sub !== 'reset') throw new Error('usage: gitroots demo reset');
-  Store.reset();
-  line(`  ${c.g('✓')} Demo org reset ${c.m(`· ${home()}/state.json removed`)}`);
-  return 0;
-}

package/src/commands/doctor.js

@@ -1,81 +0,0 @@
-// gitroots doctor
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { c, pad, state as colorState } from '../ui/ansi.js';
-import { line, motion, imageProtocol } from '../ui/term.js';
-import { json } from '../ui/components.js';
-import { VERSION, DOWNLOAD_BASE, installMethod, nativePaths, platformKey, isBinary } from '../runtime.js';
-import { latestVersion, newer, onPath } from '../installer.js';
-import { home } from '../data/store.js';
-import { readConfig } from '../api.js';
-import { tryGit } from '../git/checks.js';
-
-export async function run(_cmd, _rest, flags, store) {
-  const checks = [];
-  const add = (group, name, status, detail, fix) => checks.push({ group, name, status, detail, fix });
-
-  const method = installMethod();
-  add('install', 'gitroots', 'ok', `${VERSION} · ${method}${isBinary ? ` · ${process.execPath}` : ''}`);
-  add('install', 'platform', 'ok', platformKey());
-  if (!isBinary) {
-    const major = Number(process.versions.node.split('.')[0]);
-    add('install', 'node', major >= 18 ? 'ok' : 'fail', process.version, major >= 18 ? null : 'install Node 18 or newer, or the standalone build: curl -fsSL ' + DOWNLOAD_BASE + '/install.sh | bash');
-  }
-  if (method === 'native') {
-    const { bin } = nativePaths();
-    add('install', 'PATH', onPath(bin) ? 'ok' : 'warn', onPath(bin) ? `${bin} is on PATH` : `${bin} is not on PATH`, onPath(bin) ? null : `add  export PATH="${bin}:$PATH"  to your shell profile`);
-  }
-  const which = spawnSync(process.platform === 'win32' ? 'where' : 'sh', process.platform === 'win32' ? ['gitroots'] : ['-c', 'command -v gitroots'], { encoding: 'utf8' });
-  const found = (which.stdout || '').split('\n')[0].trim();
-  add('install', 'on PATH', found ? 'ok' : 'warn', found || 'gitroots is not on PATH in this shell', found ? null : method === 'npm' ? 'check npm prefix -g is on PATH' : null);
-
-  try {
-    const latest = await latestVersion(DOWNLOAD_BASE, 4000);
-    add('install', 'updates', newer(latest, VERSION) ? 'warn' : 'ok', newer(latest, VERSION) ? `${latest} is available` : 'up to date', newer(latest, VERSION) ? 'gitroots update' : null);
-  } catch (e) {
-    add('install', 'updates', 'warn', `couldn't check (${e.message})`);
-  }
-
-  const git = spawnSync('git', ['--version'], { encoding: 'utf8' });
-  add('git', 'git', git.status === 0 ? 'ok' : 'fail', git.status === 0 ? git.stdout.trim() : 'not found', git.status === 0 ? null : 'install git');
-  const top = tryGit(['rev-parse', '--show-toplevel']);
-  if (top) {
-    const hooks = path.resolve(tryGit(['rev-parse', '--git-path', 'hooks']) || '.git/hooks');
-    const hook = path.join(hooks, 'pre-push');
-    const ours = fs.existsSync(hook) && fs.readFileSync(hook, 'utf8').includes('# gitroots push checks');
-    add('git', 'push checks', ours ? 'ok' : 'warn', ours ? `installed in ${path.basename(top)}` : `not installed in ${path.basename(top)}`, ours ? null : 'gitroots hooks install');
-    const url = tryGit(['remote', 'get-url', 'origin']);
-    const repo = store.repoByRemote(url);
-    const cfg = fs.existsSync(path.join(top, '.gitroots.json'));
-    add('git', 'rules', repo || cfg ? 'ok' : 'warn', repo ? `gitroots repo ${repo.name}` : cfg ? '.gitroots.json' : 'no rules for this repo · only the secrets scan applies', repo || cfg ? null : 'add a .gitroots.json with "protected": ["main"]');
-  } else add('git', 'repository', 'ok', 'not inside a git repo (skipped hook checks)');
-
-  const cfg = readConfig();
-  if (store.api) {
-    try {
-      const me = await store.api.me();
-      add('account', 'signed in', me ? 'ok' : 'fail', me ? `${me.username} · ${cfg.server} · org ${cfg.org ? cfg.org.slug : 'none'}` : 'user not found', me ? null : 'gitroots login');
-    } catch (e) { add('account', 'signed in', 'fail', e.message, 'gitroots login'); }
-  } else add('account', 'signed in', 'warn', 'no · using the sample org', 'gitroots login');
-
-  try { fs.mkdirSync(home(), { recursive: true }); fs.accessSync(home(), fs.constants.W_OK); add('account', 'state', 'ok', home()); } catch { add('account', 'state', 'fail', `${home()} is not writable`, 'set GITROOTS_HOME to a writable folder'); }
-
-  const img = imageProtocol();
-  add('terminal', 'colors', colorState.color ? 'ok' : 'warn', colorState.color ? (colorState.truecolor ? 'truecolor' : '256 colors') : 'off (piped or NO_COLOR)');
-  add('terminal', 'motion', 'ok', motion() ? 'on' : 'off (piped, NO_COLOR, CI or reduced motion)');
-  add('terminal', 'logo image', 'ok', img ? `${img} graphics` : 'plain text logo (Kitty, Ghostty, WezTerm or iTerm2 show the image)');
-
-  if (flags.json) { json(checks); return checks.some((x) => x.status === 'fail') ? 1 : 0; }
-  let group = '';
-  for (const x of checks) {
-    if (x.group !== group) { if (group) line(); line(c.m(x.group.toUpperCase())); group = x.group; }
-    const mark = x.status === 'ok' ? c.g('✓') : x.status === 'warn' ? c.w('◐') : c.r('✕');
-    line(`  ${mark} ${pad(x.name, 13)}${x.status === 'fail' ? c.r(x.detail) : x.status === 'warn' ? c.w(x.detail) : c.s(x.detail)}${x.fix ? `   ${c.g(`→ ${x.fix}`)}` : ''}`);
-  }
-  const fails = checks.filter((x) => x.status === 'fail').length;
-  const warns = checks.filter((x) => x.status === 'warn').length;
-  line();
-  line(fails ? c.r(`✕ ${fails} problem${fails > 1 ? 's' : ''}`) + (warns ? c.w(` · ◐ ${warns} to look at`) : '') : warns ? c.w(`◐ ${warns} thing${warns > 1 ? 's' : ''} to look at`) : c.g('✓ all good'));
-  return fails ? 1 : 0;
-}