kodingo-cli 1.3.3 → 1.3.4

package/dist/__tests__/repo-identity.test.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * Real tests for repo-identity.ts — build brief "Fix repo-label
+ * contamination at the source, platform-wide" (2026-09-30).
+ *
+ * Uses real temporary git repos (real `git remote add`, real .git dirs)
+ * rather than mocking simple-git, matching this repo's own testing style
+ * (see vendoredCodeDetector.test.ts). Only the network call to the API is
+ * mocked, since there's no real server to hit in a unit test — the
+ * server-side resolve/register logic itself is covered in kodingo-api's
+ * repoIdentityResolve.test.ts.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const repo_identity_1 = require("../utils/repo-identity");
+function makeTempDir() {
+    return node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), "kodingo-repo-identity-"));
+}
+(0, node_test_1.describe)("parseRepoNameFromRemote", () => {
+    for (const [url, expected] of [
+        ["git@github.com:abokidev/kodingo-cli.git", "kodingo-cli"],
+        ["https://github.com/abokidev/kodingo-cli.git", "kodingo-cli"],
+        ["https://github.com/abokidev/kodingo-cli", "kodingo-cli"],
+        ["ssh://git@github.com/abokidev/veriport.git", "veriport"],
+        ["https://github.com/abokidev/NDDC-BoardRoom.git/", "NDDC-BoardRoom"],
+    ]) {
+        (0, node_test_1.it)(`extracts "${expected}" from ${url}`, () => {
+            strict_1.default.equal((0, repo_identity_1.parseRepoNameFromRemote)(url), expected);
+        });
+    }
+});
+(0, node_test_1.describe)("getRemoteUrl — against real temporary git repos", () => {
+    let dir;
+    (0, node_test_1.beforeEach)(() => {
+        dir = makeTempDir();
+        (0, node_child_process_1.execSync)("git init -q", { cwd: dir });
+    });
+    (0, node_test_1.afterEach)(() => {
+        node_fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    (0, node_test_1.it)("returns the real origin fetch URL when one is configured", async () => {
+        (0, node_child_process_1.execSync)("git remote add origin git@github.com:abokidev/achieva.git", { cwd: dir });
+        const url = await (0, repo_identity_1.getRemoteUrl)(dir);
+        strict_1.default.equal(url, "git@github.com:abokidev/achieva.git");
+    });
+    (0, node_test_1.it)("returns null when the repo has no remote at all", async () => {
+        const url = await (0, repo_identity_1.getRemoteUrl)(dir);
+        strict_1.default.equal(url, null);
+    });
+    (0, node_test_1.it)("returns null for a path that isn't a git repo", async () => {
+        const bare = makeTempDir();
+        try {
+            const url = await (0, repo_identity_1.getRemoteUrl)(bare);
+            strict_1.default.equal(url, null);
+        }
+        finally {
+            node_fs_1.default.rmSync(bare, { recursive: true, force: true });
+        }
+    });
+});
+(0, node_test_1.describe)("deriveCandidateRepoName", () => {
+    let dir;
+    (0, node_test_1.beforeEach)(() => {
+        dir = makeTempDir();
+        (0, node_child_process_1.execSync)("git init -q", { cwd: dir });
+    });
+    (0, node_test_1.afterEach)(() => {
+        node_fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    (0, node_test_1.it)("prefers the git-remote-derived name over the local folder name — this is the whole fix", async () => {
+        (0, node_child_process_1.execSync)("git remote add origin https://github.com/abokidev/veriport.git", { cwd: dir });
+        // The local folder name is deliberately unrelated to the real repo name —
+        // this is exactly the VeriPort/"mac" shape of the original bug.
+        const { candidateName, hasRemote } = await (0, repo_identity_1.deriveCandidateRepoName)(dir);
+        strict_1.default.equal(candidateName, "veriport");
+        strict_1.default.equal(hasRemote, true);
+        strict_1.default.notEqual(candidateName, node_path_1.default.basename(dir));
+    });
+    (0, node_test_1.it)("falls back to the local folder name only when there's truly no remote", async () => {
+        const { candidateName, hasRemote } = await (0, repo_identity_1.deriveCandidateRepoName)(dir);
+        strict_1.default.equal(candidateName, node_path_1.default.basename(dir));
+        strict_1.default.equal(hasRemote, false);
+    });
+});
+(0, node_test_1.describe)("resolveCanonicalRepoName", () => {
+    let dir;
+    const originalFetch = globalThis.fetch;
+    (0, node_test_1.beforeEach)(() => {
+        dir = makeTempDir();
+        (0, node_child_process_1.execSync)("git init -q", { cwd: dir });
+        (0, node_child_process_1.execSync)("git remote add origin https://github.com/abokidev/fot.git", { cwd: dir });
+    });
+    (0, node_test_1.afterEach)(() => {
+        node_fs_1.default.rmSync(dir, { recursive: true, force: true });
+        globalThis.fetch = originalFetch;
+    });
+    (0, node_test_1.it)("returns the server's resolved canonical name", async () => {
+        globalThis.fetch = (async () => new Response(JSON.stringify({ repoName: "fot", registered: false, matched: "single-registered" }), { status: 200 }));
+        const result = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot: dir, apiUrl: "https://example.invalid", token: "t" });
+        strict_1.default.equal(result, "fot");
+    });
+    (0, node_test_1.it)("fails open to the local candidate when the server errors", async () => {
+        globalThis.fetch = (async () => new Response("", { status: 500 }));
+        const result = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot: dir, apiUrl: "https://example.invalid", token: "t" });
+        strict_1.default.equal(result, "fot"); // git-remote-derived candidate, still better than the old folder-name behaviour
+    });
+    (0, node_test_1.it)("fails open to the local candidate when the server is unreachable", async () => {
+        globalThis.fetch = (async () => { throw new Error("network down"); });
+        const result = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot: dir, apiUrl: "https://example.invalid", token: "t" });
+        strict_1.default.equal(result, "fot");
+    });
+});

package/dist/commands/init.js

@@ -49,6 +49,7 @@ const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 // open is imported dynamically to avoid ESM/CJS compatibility issues on Windows
 const persistence_config_1 = require("../utils/persistence-config");
+const repo_identity_1 = require("../utils/repo-identity");
 const API_BASE = "https://kodingo-api.onrender.com";
 const APP_URL = "https://kodingo.xyz";
 const CONFIG_DIR = path.join(os.homedir(), ".kodingo");
@@ -271,17 +272,17 @@ function registerInitCommand(program) {
             (0, persistence_config_1.writeConfig)({ ...existingConfig, mode: "cloud", apiUrl, machineId });
             (0, persistence_config_1.writeWorkspaceConfig)(repoRoot, { mode: "cloud", apiUrl, token: selectedProject.token });
             ensureGitignoreEntry(repoRoot, ".kortex/");
-            // Register this repo with the project on the API
-            // This is the authoritative binding that prevents cross-project contamination
+            // Register this repo with the project on the API.
+            // This is the authoritative binding that prevents cross-project
+            // contamination — resolved from the git remote (stable across
+            // machines and folder names), not the local folder name itself,
+            // so the registration this creates is trustworthy for every future
+            // scan to resolve against.
             try {
-                const repoName = path.basename(repoRoot);
-                await fetch(`${apiUrl}/org/projects/${selectedProject.id}/repos`, {
-                    method: "POST",
-                    headers: {
-                        "Content-Type": "application/json",
-                        "Authorization": `Bearer ${authToken}`,
-                    },
-                    body: JSON.stringify({ repoName }),
+                await (0, repo_identity_1.resolveCanonicalRepoName)({
+                    repoRoot,
+                    apiUrl,
+                    token: selectedProject.token,
                 });
             }
             catch { }

package/dist/commands/scan-git.js

@@ -14,6 +14,7 @@ const git_listener_1 = require("../adapters/git-adapter/git-listener");
 const db_event_port_1 = require("../ports/db-event-port");
 const cloud_event_port_1 = require("../ports/cloud-event-port");
 const persistence_config_2 = require("../utils/persistence-config");
+const repo_identity_1 = require("../utils/repo-identity");
 const API_BASE_DEFAULT = "https://kodingo-api.onrender.com";
 function getCredentials(repoRoot) {
     const config = (0, persistence_config_1.readConfig)();
@@ -29,11 +30,10 @@ function getCredentials(repoRoot) {
     const apiUrl = wsEntry?.apiUrl ?? config.apiUrl ?? API_BASE_DEFAULT;
     return { token, apiUrl };
 }
-async function detectContextDecay(repoRoot, changedFiles) {
+async function detectContextDecay(repoRoot, changedFiles, repoName) {
     const { token, apiUrl } = getCredentials(repoRoot);
     if (!token)
         return;
-    const repoName = path_1.default.basename(repoRoot);
     for (const filePath of changedFiles) {
         if (!fs_1.default.existsSync(filePath))
             continue;
@@ -110,7 +110,7 @@ async function scanGitCommand(options) {
         const diffOutput = await git.diff([`${commitHash}^`, commitHash, '--name-only']).catch(() => '');
         const commitChangedFiles = diffOutput.split('\n').filter(Boolean).map((f) => path_1.default.join(repoRoot, f)).filter((f) => /\.(ts|tsx|js|jsx|py|go|rs|php|java|kt|rb)$/.test(f));
         if (token && commitChangedFiles.length > 0) {
-            const repoName = path_1.default.basename(repoRoot);
+            const repoName = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot, apiUrl, token });
             for (const filePath of commitChangedFiles) {
                 if (!fs_1.default.existsSync(filePath))
                     continue;

package/dist/commands/scan-repo.js

@@ -60,6 +60,7 @@ const ast_parser_1 = require("../utils/ast-parser");
 const graph_builder_1 = require("../utils/graph-builder");
 const context_assembler_1 = require("../utils/context-assembler");
 const vendoredCodeDetector_1 = require("../utils/vendoredCodeDetector");
+const repo_identity_1 = require("../utils/repo-identity");
 const API_BASE = "https://kodingo-api.onrender.com";
 const SUPPORTED_EXTENSIONS = [
     ".ts", ".tsx", ".js", ".jsx",
@@ -253,7 +254,7 @@ async function scanRepoCommand(options = {}) {
     const repoRoot = options.repo
         ? path_1.default.resolve(options.repo)
         : findRepoRoot(process.cwd());
-    const repoName = path_1.default.basename(repoRoot);
+    const repoName = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot, apiUrl, token });
     if (!options.silent) {
         console.log(`\n🔍 Kortex — scanning ${repoName} for existing functions...\n`);
     }

package/dist/commands/security-scan.js

@@ -18,6 +18,7 @@ const graph_builder_1 = require("../utils/graph-builder");
 const security_code_analyzer_1 = require("../utils/security-code-analyzer");
 const context_assembler_1 = require("../utils/context-assembler");
 const ast_parser_1 = require("../utils/ast-parser");
+const repo_identity_1 = require("../utils/repo-identity");
 const IGNORED_DIRS = new Set(["node_modules", ".git", ".kortex", "dist", "build", "vendor", "out", ".next", ".venv", "venv", "env", "site-packages", "virtualenv", ".tox", "target", ".gradle", ".idea", ".vscode", "bin", "obj"]);
 const SUPPORTED_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs", ".php", ".java", ".kt", ".rb", ".c", ".cpp", ".html", ".phtml", ".twig", ".blade.php"];
 function walkFiles(dir) {
@@ -53,7 +54,7 @@ async function securityScanCommand(options = {}) {
             console.error("✖ This repo is not connected to Kodingo. Run `kodingo init` first.");
         return false;
     }
-    const repoName = path_1.default.basename(repoRoot);
+    const repoName = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot, apiUrl, token });
     if (!options.silent)
         console.log(`\n🔒 Kortex Security — scanning ${repoName} for known vulnerabilities...\n`);
     try {

package/dist/commands/sync-dependencies.js

@@ -7,15 +7,12 @@
  * Run this before 'kodingo security-scan' — the scan works off whatever was
  * last synced here.
  */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.syncDependenciesCommand = syncDependenciesCommand;
-const path_1 = __importDefault(require("path"));
 const persistence_config_1 = require("../utils/persistence-config");
 const repo_scope_1 = require("../utils/repo-scope");
 const dependency_parser_1 = require("../utils/dependency-parser");
+const repo_identity_1 = require("../utils/repo-identity");
 async function syncDependenciesCommand(options = {}) {
     const repoRoot = (0, repo_scope_1.resolveRepoScope)(options.repo ? { repo: options.repo } : {}) ?? process.cwd();
     const config = (0, persistence_config_1.readConfig)();
@@ -27,7 +24,7 @@ async function syncDependenciesCommand(options = {}) {
             console.error("✖ This repo is not connected to Kodingo. Run `kodingo init` first.");
         return false;
     }
-    const repoName = path_1.default.basename(repoRoot);
+    const repoName = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot, apiUrl, token });
     if (!options.silent)
         console.log(`\n🔒 Kortex Security — scanning dependencies for ${repoName}...\n`);
     const deps = (0, dependency_parser_1.extractDependencies)(repoRoot);

package/dist/utils/repo-identity.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRepoNameFromRemote = parseRepoNameFromRemote;
+exports.getRemoteUrl = getRemoteUrl;
+exports.deriveCandidateRepoName = deriveCandidateRepoName;
+exports.resolveCanonicalRepoName = resolveCanonicalRepoName;
+/**
+ * Resolves the canonical `repo` identity sent to the server, instead of
+ * every scan command inventing its own label from the local checkout.
+ *
+ * Root cause (build brief "Fix repo-label contamination at the source,
+ * platform-wide", 2026-09-30): every local capture path — scan-repo,
+ * security-scan, sync-dependencies, scan-git, and `kodingo init`'s own
+ * repo-registration call — independently computed `path.basename(repoRoot)`
+ * as the repo label. That's the local folder name, never a stable
+ * identifier: two developers with two different folder names for the same
+ * clone produce two different labels for the same real repo, and `init`
+ * seeded `kodingo_project_repos` (the intended source of truth) with that
+ * same unstable value, contaminating it at the first write.
+ *
+ * Fix: derive a candidate name from the git remote URL (stable across
+ * machines and folder names) and resolve it against the server's real,
+ * registered repos for this project via POST /cli/repo/resolve — which
+ * owns the single-repo / multi-repo / first-registration disambiguation.
+ * Falls back to the local folder name only when there's truly no git
+ * remote to read (e.g. a brand-new local-only repo).
+ */
+const path_1 = __importDefault(require("path"));
+const simple_git_1 = __importDefault(require("simple-git"));
+function parseRepoNameFromRemote(remoteUrl) {
+    const cleaned = remoteUrl.trim().replace(/\/+$/, "").replace(/\.git$/, "");
+    const match = cleaned.match(/[/:]([^/:]+)$/);
+    return match?.[1] || null;
+}
+async function getRemoteUrl(repoRoot) {
+    try {
+        const git = (0, simple_git_1.default)(repoRoot);
+        const remotes = await git.getRemotes(true);
+        if (!remotes.length)
+            return null;
+        const origin = remotes.find(r => r.name === "origin") ?? remotes[0];
+        return origin?.refs?.fetch || null;
+    }
+    catch {
+        return null;
+    }
+}
+async function deriveCandidateRepoName(repoRoot) {
+    const remoteUrl = await getRemoteUrl(repoRoot);
+    const fromRemote = remoteUrl ? parseRepoNameFromRemote(remoteUrl) : null;
+    if (fromRemote)
+        return { candidateName: fromRemote, hasRemote: true };
+    return { candidateName: path_1.default.basename(repoRoot), hasRemote: false };
+}
+/**
+ * Returns the canonical repo label to send with this scan. Fails open to
+ * the locally derived candidate if the server is unreachable — a scan
+ * should never be blocked by this resolution, and the git-remote-derived
+ * candidate is already more stable than the old folder-basename behaviour
+ * even without a round-trip to the server.
+ */
+async function resolveCanonicalRepoName(params) {
+    const { candidateName, hasRemote } = await deriveCandidateRepoName(params.repoRoot);
+    try {
+        const res = await fetch(`${params.apiUrl}/cli/repo/resolve`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "X-Kodingo-Token": params.token },
+            body: JSON.stringify({ candidateName, hasRemote }),
+        });
+        if (res.ok) {
+            const data = (await res.json());
+            if (data.repoName)
+                return data.repoName;
+        }
+    }
+    catch {
+        // offline / server unreachable — fail open below
+    }
+    return candidateName;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodingo-cli",
-  "version": "1.3.3",
+  "version": "1.3.4",
   "description": "Kodingo CLI",
   "license": "MIT",
   "private": false,