knodin 0.10.8 → 0.12.0

package/dist/bin/cli.js

@@ -35,7 +35,7 @@ import { diagnoseFailure, } from "../src/failure-diagnosis.js";
 import { gitExecutable } from "../src/git-executable.js";
 import { decorateGraphQueryResult, inspectGraphQueryHealth } from "../src/graph-query-health.js";
 import { createIndexActivityReporter } from "../src/index-activity.js";
-import { InitializationHealthError, initializeRepository, inspectRepositoryIntegrationStatus, readRepositoryIntegrationConfig, refreshFromGitEvent, } from "../src/init.js";
+import { InitializationHealthError, initializeRepository, inspectRepositoryIntegrationStatus, readRepositoryIntegrationConfig, refreshFromGitEvent, repairLifecycleRouting, } from "../src/init.js";
 import { createInitProgressRenderer } from "../src/init-progress.js";
 import { attachLifecycleHealth, attachRepairLifecycle } from "../src/lifecycle-health.js";
 import { acknowledgeUpdateFailure, queryOwnerAvailability, readManagerUpdateState, readUpdateJournal, resolveManagerOwnership, setManualPin, unpinUpdate, updateAttention, writeManagerUpdateState, } from "../src/manager-update.js";
@@ -60,7 +60,7 @@ import { KNODIN_VERSION } from "../src/version.js";
 import { writeVisualization, } from "../src/visualization.js";
 import { waitForFresh } from "../src/wait-for-fresh.js";
 import { inspectWorktrees, reconcileWorktrees, removeManagedWorktree, } from "../src/worktree-lifecycle.js";
-import { indexOrSeed } from "../src/worktree-seed.js";
+import { indexOrSeed, seedWorktreeIndex } from "../src/worktree-seed.js";
 function explicitScope(args) {
     const index = args.indexOf("--scope");
     if (index >= 0) {
@@ -138,7 +138,7 @@ function formatRepairHuman(result) {
     }
     if (result.verified) {
         if (result.lifecycle?.status === "degraded")
-            return `Repair verified: graph is healthy (${coverage.indexedFiles} indexed files, ${coverage.filesWithSymbols} files with symbols), but lifecycle routing is degraded. Run \`knodin init\`, then \`knodin status\`.\n`;
+            return `Repair verified: graph is healthy (${coverage.indexedFiles} indexed files, ${coverage.filesWithSymbols} files with symbols), but lifecycle routing is degraded. Run \`knodin repair --lifecycle\`, then \`knodin status\`.\n`;
         return `Repair verified: graph is healthy (${coverage.indexedFiles} indexed files, ${coverage.filesWithSymbols} files with symbols).\n`;
     }
     const outstanding = result.outstandingIssues?.total ??
@@ -198,7 +198,7 @@ function formatLifecycleLine(lifecycle, isMirror) {
     if (lifecycle.status === "healthy")
         return "Hooks: installed and executable.\n";
     const issue = lifecycle.issues[0] ?? "refresh capability is not verified";
-    return `Lifecycle refresh: ${lifecycle.status}; ${issue}. Run \`knodin init\`.\n`;
+    return `Lifecycle refresh: ${lifecycle.status}; ${issue}. Run \`knodin repair --lifecycle\`.\n`;
 }
 /** Renders the top extensions of a tally as `.md 180, .yml 74, +3 more`. */
 function formatTally(counts, limit = 4) {
@@ -1522,6 +1522,7 @@ async function main() {
     let result;
     let repairOutput;
     let repairWasPlan = false;
+    let repairWasLifecycle = false;
     let repairExitCode = 0;
     let statusWasWatched = false;
     let agentEventOutput = false;
@@ -2381,6 +2382,27 @@ async function main() {
                 repairWasPlan = true;
                 break;
             }
+            if (options.lifecycle) {
+                result = await repairLifecycleRouting(repo, { command: runtimeCommand });
+                repairOutput = options.output;
+                repairWasLifecycle = true;
+                break;
+            }
+            // Cold start only. With no database at all there is nothing to rebuild
+            // *from*, so repair would index the whole corpus while a sibling
+            // worktree already holds a reusable baseline — reflink-copying it and
+            // reconciling the differing paths is seconds against minutes
+            // (KNODIN-14). Repair's contract is untouched: it still rebuilds from
+            // this working tree, it just starts from a baseline instead of zero.
+            //
+            // A database that exists but is damaged is deliberately excluded. That
+            // is the case repair exists for, and seeding it would replace a
+            // verifiable local rebuild with another checkout's state.
+            if (!fs.existsSync(resolveDbPath(repo))) {
+                const seed = await seedWorktreeIndex(repo, engine, KNODIN_SCHEMA_VERSION);
+                if (seed.seeded)
+                    process.stderr.write("[repair:seed] Seeded baseline from an indexed sibling worktree\n");
+            }
             const progressMode = resolveRepairProgressMode(options, process.env, process.stderr.isTTY);
             const renderer = progressMode === "tty"
                 ? createProgressWorkerRenderer("repair-progress-worker", {
@@ -2787,6 +2809,12 @@ async function main() {
                 }
                 result = decorateGraphQueryResult(result, verifiedQueryHealth.state, verifiedQueryHealth.graph.freshness);
             }
+            // A target that does not exist is operator error, not a negative
+            // answer, so it exits non-zero like an unavailable graph rather than
+            // like real dead code (KNODIN-28). `resolved` with zero rows keeps
+            // exit 0: the symbol exists and genuinely has no callers.
+            if (result?.targetResolution === "not-found")
+                process.exitCode = 1;
             break;
         }
         case "rename": {
@@ -2999,6 +3027,15 @@ async function main() {
         process.stdout.write(formatConfigureStatusHuman(boundedResult));
         return;
     }
+    if (cmd === "repair" && repairOutput === "human" && repairWasLifecycle) {
+        // A lifecycle repair carries no graph coverage, so it cannot go through
+        // the graph-repair renderer, and saying nothing about what it left alone
+        // would omit the only reason to reach for it (KNODIN-31).
+        const lifecycle = boundedResult;
+        process.stdout.write(`Lifecycle routing rewritten: ${lifecycle.gitHooks.length} managed Git hook(s) and the background indexer, in ${lifecycle.hooksDirectory}. Agent configuration untouched. Run \`knodin status\` to confirm.\n`);
+        process.exitCode = finalExitCode;
+        return;
+    }
     if (cmd === "repair" && repairOutput === "human" && !repairWasPlan) {
         process.stdout.write(formatRepairHuman(boundedResult));
         process.exitCode = finalExitCode;

package/dist/src/cli-model.js

@@ -309,6 +309,7 @@ function createCliProgram(capture = () => { }) {
         .addOption(option("--timeout <seconds>", "deadline", "number"));
     leaf(program, "repair", "audit and reconcile graph state", capture)
         .option("--plan", "report the repair plan without mutation")
+        .option("--lifecycle", "rewrite lifecycle hooks only, leaving agent configuration untouched")
         .option("--jsonl", "stream JSONL progress")
         .option("--progress <mode>", "tty, jsonl, plain, or none")
         .option("--progress-interval <duration>", "progress interval such as 750ms, 30s, or 2m");

package/dist/src/compact-structural.js

@@ -12,12 +12,17 @@ export function compactIdentity(identity) {
 export function expandCompactIdentity(identity) {
     return identity?.startsWith("~") ? `${IDENTITY_PREFIX}${identity.slice(1)}*` : identity;
 }
+// Missing evidence is "unknown", never "fresh" — the same default the engine's
+// own `stalenessFor()` uses. Search stamps staleness per row and `SearchPage`
+// carries no page-level field, so a zero-row page has no row to read it from:
+// defaulting to "fresh" rendered an empty result on a stale or unprobed graph as
+// `fresh 0/0`, an authoritative-looking negative (KNODIN-22).
 function freshness(value) {
     if (value === "reconciled")
         return "reconciled";
-    if (value === "unknown")
-        return "unknown";
-    return "fresh";
+    if (value === "fresh")
+        return "fresh";
+    return "unknown";
 }
 function terseSignature(row) {
     const signature = row.signature?.replace(/\s+/g, " ").trim() ?? "";

package/dist/src/credential-patterns.js

@@ -25,8 +25,21 @@ export function credentialPatterns() {
             // consumed BEFORE the value, because `authorization: Bearer <token>`
             // otherwise matches only the word "Bearer" — redacting the label and
             // preserving the credential, exactly inverted (KNODIN-10).
+            //
+            // The keyword is surrounded by `[\w-]*` rather than anchored with `\b`,
+            // because `\b` does not exist between `_` and a letter: a leading `\b`
+            // could never match inside `AWS_SECRET_ACCESS_KEY`, and a trailing one
+            // stopped the name short of the `=`. That excluded the dominant spelling
+            // of every real secret — `AWS_SECRET_ACCESS_KEY=`, `DB_PASSWORD=`,
+            // `NPM_TOKEN=`, any `*_SECRET=` — while `password=` alone was redacted
+            // (KNODIN-19).
+            //
+            // The trailing half is `[_-]`-led rather than a bare `[\w-]*` so the
+            // keyword has to be a whole segment of the name. knodin echoes source
+            // into diagnostics and compressed output, and an unanchored tail
+            // redacted the value of a plain `const tokenCount = 5`.
             label: "credential",
-            pattern: /\b(authorization|password|passwd|secret|token|api[_-]?key)(\s*[:=]\s*)(?:(?:bearer|basic|digest|token)\s+)?[^\s,;]+/gi,
+            pattern: /(?<![\w-])([\w-]*(?:authorization|password|passwd|secret|token|api[_-]?key)(?:[_-][\w-]*)?)(\s*[:=]\s*)(?:(?:bearer|basic|digest|token)\s+)?[^\s,;]+/gi,
             preservedGroups: 2,
         },
         {