kodingo-cli 1.3.3 → 1.3.5

package/dist/__tests__/inference.test.js

@@ -0,0 +1,78 @@
+"use strict";
+/**
+ * Real tests for adapters/ai/inference.ts's auth fix — build brief "Item 8
+ * — the temporal lobe", 2026-10-01.
+ *
+ * FINDING this closes: inferDecisionSummary (the git-commit-triggered
+ * capture surface, via cloud-event-port.ts/db-event-port.ts) was calling
+ * POST /infer with no auth header at all — every real call would 401 and
+ * silently fall back to the non-LLM template text, meaning this surface
+ * never actually reached the shared, semantically-reasoning-enriched
+ * prompt built into routes/infer.ts (kodingo-api). These tests prove the
+ * real fix: a real token now reaches the request as X-Kodingo-Token, and
+ * the existing, honest fallback behavior is completely unchanged when no
+ * token is available.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const inference_1 = require("../adapters/ai/inference");
+(0, node_test_1.describe)("inferDecisionSummary — real auth fix", () => {
+    const originalFetch = globalThis.fetch;
+    (0, node_test_1.afterEach)(() => {
+        globalThis.fetch = originalFetch;
+    });
+    (0, node_test_1.it)("sends the real X-Kodingo-Token header when a real token is available", async () => {
+        let capturedHeaders;
+        let capturedUrl;
+        globalThis.fetch = (async (url, init) => {
+            capturedUrl = String(url);
+            capturedHeaders = init.headers;
+            return new Response(JSON.stringify({ title: "t", content: "A real, LLM-authored decision summary.", type: "decision", tags: [] }), { status: 200 });
+        });
+        const result = await (0, inference_1.inferDecisionSummary)({
+            diff: "commit abc1234\n+ real change",
+            changedFiles: ["src/real.ts"],
+            symbol: "realFunction",
+            commitMessage: "real commit",
+            repoName: "real-repo",
+            token: "real-project-token",
+            apiUrl: "https://example.invalid",
+        });
+        strict_1.default.equal(result, "A real, LLM-authored decision summary.");
+        strict_1.default.equal(capturedUrl, "https://example.invalid/infer");
+        strict_1.default.equal(capturedHeaders?.["X-Kodingo-Token"], "real-project-token");
+    });
+    (0, node_test_1.it)("falls back to the honest template — never calls the network at all — when no real token is available (the pre-existing, unchanged behavior)", async () => {
+        let fetchCalled = false;
+        globalThis.fetch = (async () => {
+            fetchCalled = true;
+            throw new Error("should never be called without a real token");
+        });
+        const result = await (0, inference_1.inferDecisionSummary)({
+            diff: "commit abc1234ff\n+ real change",
+            changedFiles: ["src/a.ts", "src/b.ts"],
+            symbol: "realFunction",
+            commitMessage: "a real commit message",
+            repoName: "real-repo",
+        });
+        strict_1.default.equal(fetchCalled, false);
+        strict_1.default.match(result, /Changes to realFunction across 2 file\(s\) in commit abc1234f/);
+        strict_1.default.match(result, /a real commit message/);
+    });
+    (0, node_test_1.it)("falls back honestly when the real request itself fails (e.g. a genuine 401)", async () => {
+        globalThis.fetch = (async () => new Response("", { status: 401 }));
+        const result = await (0, inference_1.inferDecisionSummary)({
+            diff: "commit def5678\n+ change",
+            changedFiles: ["src/x.ts"],
+            symbol: "x",
+            commitMessage: "msg",
+            repoName: "real-repo",
+            token: "a-token-the-server-happens-to-reject",
+        });
+        strict_1.default.match(result, /Changes to x across 1 file\(s\)/);
+    });
+});

package/dist/__tests__/repo-identity.test.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * Real tests for repo-identity.ts — build brief "Fix repo-label
+ * contamination at the source, platform-wide" (2026-09-30).
+ *
+ * Uses real temporary git repos (real `git remote add`, real .git dirs)
+ * rather than mocking simple-git, matching this repo's own testing style
+ * (see vendoredCodeDetector.test.ts). Only the network call to the API is
+ * mocked, since there's no real server to hit in a unit test — the
+ * server-side resolve/register logic itself is covered in kodingo-api's
+ * repoIdentityResolve.test.ts.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_test_1 = require("node:test");
+const strict_1 = __importDefault(require("node:assert/strict"));
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const repo_identity_1 = require("../utils/repo-identity");
+function makeTempDir() {
+    return node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), "kodingo-repo-identity-"));
+}
+(0, node_test_1.describe)("parseRepoNameFromRemote", () => {
+    for (const [url, expected] of [
+        ["git@github.com:abokidev/kodingo-cli.git", "kodingo-cli"],
+        ["https://github.com/abokidev/kodingo-cli.git", "kodingo-cli"],
+        ["https://github.com/abokidev/kodingo-cli", "kodingo-cli"],
+        ["ssh://git@github.com/abokidev/veriport.git", "veriport"],
+        ["https://github.com/abokidev/NDDC-BoardRoom.git/", "NDDC-BoardRoom"],
+    ]) {
+        (0, node_test_1.it)(`extracts "${expected}" from ${url}`, () => {
+            strict_1.default.equal((0, repo_identity_1.parseRepoNameFromRemote)(url), expected);
+        });
+    }
+});
+(0, node_test_1.describe)("getRemoteUrl — against real temporary git repos", () => {
+    let dir;
+    (0, node_test_1.beforeEach)(() => {
+        dir = makeTempDir();
+        (0, node_child_process_1.execSync)("git init -q", { cwd: dir });
+    });
+    (0, node_test_1.afterEach)(() => {
+        node_fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    (0, node_test_1.it)("returns the real origin fetch URL when one is configured", async () => {
+        (0, node_child_process_1.execSync)("git remote add origin git@github.com:abokidev/achieva.git", { cwd: dir });
+        const url = await (0, repo_identity_1.getRemoteUrl)(dir);
+        strict_1.default.equal(url, "git@github.com:abokidev/achieva.git");
+    });
+    (0, node_test_1.it)("returns null when the repo has no remote at all", async () => {
+        const url = await (0, repo_identity_1.getRemoteUrl)(dir);
+        strict_1.default.equal(url, null);
+    });
+    (0, node_test_1.it)("returns null for a path that isn't a git repo", async () => {
+        const bare = makeTempDir();
+        try {
+            const url = await (0, repo_identity_1.getRemoteUrl)(bare);
+            strict_1.default.equal(url, null);
+        }
+        finally {
+            node_fs_1.default.rmSync(bare, { recursive: true, force: true });
+        }
+    });
+});
+(0, node_test_1.describe)("deriveCandidateRepoName", () => {
+    let dir;
+    (0, node_test_1.beforeEach)(() => {
+        dir = makeTempDir();
+        (0, node_child_process_1.execSync)("git init -q", { cwd: dir });
+    });
+    (0, node_test_1.afterEach)(() => {
+        node_fs_1.default.rmSync(dir, { recursive: true, force: true });
+    });
+    (0, node_test_1.it)("prefers the git-remote-derived name over the local folder name — this is the whole fix", async () => {
+        (0, node_child_process_1.execSync)("git remote add origin https://github.com/abokidev/veriport.git", { cwd: dir });
+        // The local folder name is deliberately unrelated to the real repo name —
+        // this is exactly the VeriPort/"mac" shape of the original bug.
+        const { candidateName, hasRemote } = await (0, repo_identity_1.deriveCandidateRepoName)(dir);
+        strict_1.default.equal(candidateName, "veriport");
+        strict_1.default.equal(hasRemote, true);
+        strict_1.default.notEqual(candidateName, node_path_1.default.basename(dir));
+    });
+    (0, node_test_1.it)("falls back to the local folder name only when there's truly no remote", async () => {
+        const { candidateName, hasRemote } = await (0, repo_identity_1.deriveCandidateRepoName)(dir);
+        strict_1.default.equal(candidateName, node_path_1.default.basename(dir));
+        strict_1.default.equal(hasRemote, false);
+    });
+});
+(0, node_test_1.describe)("resolveCanonicalRepoName", () => {
+    let dir;
+    const originalFetch = globalThis.fetch;
+    (0, node_test_1.beforeEach)(() => {
+        dir = makeTempDir();
+        (0, node_child_process_1.execSync)("git init -q", { cwd: dir });
+        (0, node_child_process_1.execSync)("git remote add origin https://github.com/abokidev/fot.git", { cwd: dir });
+    });
+    (0, node_test_1.afterEach)(() => {
+        node_fs_1.default.rmSync(dir, { recursive: true, force: true });
+        globalThis.fetch = originalFetch;
+    });
+    (0, node_test_1.it)("returns the server's resolved canonical name", async () => {
+        globalThis.fetch = (async () => new Response(JSON.stringify({ repoName: "fot", registered: false, matched: "single-registered" }), { status: 200 }));
+        const result = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot: dir, apiUrl: "https://example.invalid", token: "t" });
+        strict_1.default.equal(result, "fot");
+    });
+    (0, node_test_1.it)("fails open to the local candidate when the server errors", async () => {
+        globalThis.fetch = (async () => new Response("", { status: 500 }));
+        const result = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot: dir, apiUrl: "https://example.invalid", token: "t" });
+        strict_1.default.equal(result, "fot"); // git-remote-derived candidate, still better than the old folder-name behaviour
+    });
+    (0, node_test_1.it)("fails open to the local candidate when the server is unreachable", async () => {
+        globalThis.fetch = (async () => { throw new Error("network down"); });
+        const result = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot: dir, apiUrl: "https://example.invalid", token: "t" });
+        strict_1.default.equal(result, "fot");
+    });
+});

package/dist/adapters/ai/inference.js

@@ -6,9 +6,12 @@ const KODINGO_API_URL = process.env.KODINGO_API_URL ?? "https://kodingo-api.onre
 async function inferDecisionSummary(input) {
     try {
         const code = input.diff.slice(0, 2000);
-        const res = await fetch(`${KODINGO_API_URL}/infer`, {
+        if (!input.token)
+            return buildFallback(input);
+        const apiUrl = input.apiUrl ?? KODINGO_API_URL;
+        const res = await fetch(`${apiUrl}/infer`, {
             method: "POST",
-            headers: { "Content-Type": "application/json" },
+            headers: { "Content-Type": "application/json", "X-Kodingo-Token": input.token },
             body: JSON.stringify({ symbol: input.symbol, code }),
         });
         if (!res.ok) {

package/dist/commands/init.js

@@ -49,6 +49,7 @@ const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 // open is imported dynamically to avoid ESM/CJS compatibility issues on Windows
 const persistence_config_1 = require("../utils/persistence-config");
+const repo_identity_1 = require("../utils/repo-identity");
 const API_BASE = "https://kodingo-api.onrender.com";
 const APP_URL = "https://kodingo.xyz";
 const CONFIG_DIR = path.join(os.homedir(), ".kodingo");
@@ -271,17 +272,17 @@ function registerInitCommand(program) {
             (0, persistence_config_1.writeConfig)({ ...existingConfig, mode: "cloud", apiUrl, machineId });
             (0, persistence_config_1.writeWorkspaceConfig)(repoRoot, { mode: "cloud", apiUrl, token: selectedProject.token });
             ensureGitignoreEntry(repoRoot, ".kortex/");
-            // Register this repo with the project on the API
-            // This is the authoritative binding that prevents cross-project contamination
+            // Register this repo with the project on the API.
+            // This is the authoritative binding that prevents cross-project
+            // contamination — resolved from the git remote (stable across
+            // machines and folder names), not the local folder name itself,
+            // so the registration this creates is trustworthy for every future
+            // scan to resolve against.
             try {
-                const repoName = path.basename(repoRoot);
-                await fetch(`${apiUrl}/org/projects/${selectedProject.id}/repos`, {
-                    method: "POST",
-                    headers: {
-                        "Content-Type": "application/json",
-                        "Authorization": `Bearer ${authToken}`,
-                    },
-                    body: JSON.stringify({ repoName }),
+                await (0, repo_identity_1.resolveCanonicalRepoName)({
+                    repoRoot,
+                    apiUrl,
+                    token: selectedProject.token,
                 });
             }
             catch { }

package/dist/commands/scan-git.js

@@ -14,26 +14,11 @@ const git_listener_1 = require("../adapters/git-adapter/git-listener");
 const db_event_port_1 = require("../ports/db-event-port");
 const cloud_event_port_1 = require("../ports/cloud-event-port");
 const persistence_config_2 = require("../utils/persistence-config");
-const API_BASE_DEFAULT = "https://kodingo-api.onrender.com";
-function getCredentials(repoRoot) {
-    const config = (0, persistence_config_1.readConfig)();
-    const normRoot = repoRoot.replace(/\/+$/, "");
-    let wsEntry = config.workspaces?.[normRoot] ?? config.workspaces?.[normRoot + "/"];
-    // Walk parent directories
-    let current = normRoot;
-    while (!wsEntry && current !== path_1.default.dirname(current)) {
-        current = path_1.default.dirname(current);
-        wsEntry = config.workspaces?.[current] ?? config.workspaces?.[current + "/"];
-    }
-    const token = wsEntry?.token ?? "";
-    const apiUrl = wsEntry?.apiUrl ?? config.apiUrl ?? API_BASE_DEFAULT;
-    return { token, apiUrl };
-}
-async function detectContextDecay(repoRoot, changedFiles) {
-    const { token, apiUrl } = getCredentials(repoRoot);
+const repo_identity_1 = require("../utils/repo-identity");
+async function detectContextDecay(repoRoot, changedFiles, repoName) {
+    const { token, apiUrl } = (0, persistence_config_1.getCredentials)(repoRoot);
     if (!token)
         return;
-    const repoName = path_1.default.basename(repoRoot);
     for (const filePath of changedFiles) {
         if (!fs_1.default.existsSync(filePath))
             continue;
@@ -106,11 +91,11 @@ async function scanGitCommand(options) {
     console.log(`Git scan complete (latest commit) for repo: ${repoRoot} commit: ${commitHash.slice(0, 8)}`);
     // Send code_change signals for functions touched in this commit that already have memory
     try {
-        const { token, apiUrl } = getCredentials(repoRoot);
+        const { token, apiUrl } = (0, persistence_config_1.getCredentials)(repoRoot);
         const diffOutput = await git.diff([`${commitHash}^`, commitHash, '--name-only']).catch(() => '');
         const commitChangedFiles = diffOutput.split('\n').filter(Boolean).map((f) => path_1.default.join(repoRoot, f)).filter((f) => /\.(ts|tsx|js|jsx|py|go|rs|php|java|kt|rb)$/.test(f));
         if (token && commitChangedFiles.length > 0) {
-            const repoName = path_1.default.basename(repoRoot);
+            const repoName = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot, apiUrl, token });
             for (const filePath of commitChangedFiles) {
                 if (!fs_1.default.existsSync(filePath))
                     continue;

package/dist/commands/scan-repo.js

@@ -60,6 +60,7 @@ const ast_parser_1 = require("../utils/ast-parser");
 const graph_builder_1 = require("../utils/graph-builder");
 const context_assembler_1 = require("../utils/context-assembler");
 const vendoredCodeDetector_1 = require("../utils/vendoredCodeDetector");
+const repo_identity_1 = require("../utils/repo-identity");
 const API_BASE = "https://kodingo-api.onrender.com";
 const SUPPORTED_EXTENSIONS = [
     ".ts", ".tsx", ".js", ".jsx",
@@ -253,7 +254,7 @@ async function scanRepoCommand(options = {}) {
     const repoRoot = options.repo
         ? path_1.default.resolve(options.repo)
         : findRepoRoot(process.cwd());
-    const repoName = path_1.default.basename(repoRoot);
+    const repoName = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot, apiUrl, token });
     if (!options.silent) {
         console.log(`\n🔍 Kortex — scanning ${repoName} for existing functions...\n`);
     }

package/dist/commands/security-scan.js

@@ -18,6 +18,7 @@ const graph_builder_1 = require("../utils/graph-builder");
 const security_code_analyzer_1 = require("../utils/security-code-analyzer");
 const context_assembler_1 = require("../utils/context-assembler");
 const ast_parser_1 = require("../utils/ast-parser");
+const repo_identity_1 = require("../utils/repo-identity");
 const IGNORED_DIRS = new Set(["node_modules", ".git", ".kortex", "dist", "build", "vendor", "out", ".next", ".venv", "venv", "env", "site-packages", "virtualenv", ".tox", "target", ".gradle", ".idea", ".vscode", "bin", "obj"]);
 const SUPPORTED_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs", ".php", ".java", ".kt", ".rb", ".c", ".cpp", ".html", ".phtml", ".twig", ".blade.php"];
 function walkFiles(dir) {
@@ -53,7 +54,7 @@ async function securityScanCommand(options = {}) {
             console.error("✖ This repo is not connected to Kodingo. Run `kodingo init` first.");
         return false;
     }
-    const repoName = path_1.default.basename(repoRoot);
+    const repoName = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot, apiUrl, token });
     if (!options.silent)
         console.log(`\n🔒 Kortex Security — scanning ${repoName} for known vulnerabilities...\n`);
     try {

package/dist/commands/sync-dependencies.js

@@ -7,15 +7,12 @@
  * Run this before 'kodingo security-scan' — the scan works off whatever was
  * last synced here.
  */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.syncDependenciesCommand = syncDependenciesCommand;
-const path_1 = __importDefault(require("path"));
 const persistence_config_1 = require("../utils/persistence-config");
 const repo_scope_1 = require("../utils/repo-scope");
 const dependency_parser_1 = require("../utils/dependency-parser");
+const repo_identity_1 = require("../utils/repo-identity");
 async function syncDependenciesCommand(options = {}) {
     const repoRoot = (0, repo_scope_1.resolveRepoScope)(options.repo ? { repo: options.repo } : {}) ?? process.cwd();
     const config = (0, persistence_config_1.readConfig)();
@@ -27,7 +24,7 @@ async function syncDependenciesCommand(options = {}) {
             console.error("✖ This repo is not connected to Kodingo. Run `kodingo init` first.");
         return false;
     }
-    const repoName = path_1.default.basename(repoRoot);
+    const repoName = await (0, repo_identity_1.resolveCanonicalRepoName)({ repoRoot, apiUrl, token });
     if (!options.silent)
         console.log(`\n🔒 Kortex Security — scanning dependencies for ${repoName}...\n`);
     const deps = (0, dependency_parser_1.extractDependencies)(repoRoot);

package/dist/ports/cloud-event-port.js

@@ -7,6 +7,7 @@ exports.CloudEventPort = void 0;
 const kodingo_core_1 = require("kodingo-core");
 const persistence_config_1 = require("../utils/persistence-config");
 const inference_1 = require("../adapters/ai/inference");
+const persistence_config_2 = require("../utils/persistence-config");
 const path_1 = __importDefault(require("path"));
 /**
  * EventPort implementation that persists via getPersistence().
@@ -152,6 +153,7 @@ class CloudEventPort {
         const filePaths = extractFilePaths(filesChanged);
         const repoName = path_1.default.basename(this.repoPath);
         const shortHash = String(commitHash).slice(0, 8);
+        const { token, apiUrl } = (0, persistence_config_2.getCredentials)(this.repoPath);
         const content = await (0, inference_1.inferDecisionSummary)({
             diff: typeof summary?.rawDiff === "string"
                 ? summary.rawDiff
@@ -160,6 +162,8 @@ class CloudEventPort {
             symbol: symbol ?? "unknown",
             commitMessage: decision.rationale ?? "",
             repoName,
+            token,
+            apiUrl,
         });
         const title = symbol
             ? `Decision: changes to ${symbol}`

package/dist/ports/db-event-port.js

@@ -7,6 +7,7 @@ exports.DbEventPort = void 0;
 const kodingo_core_1 = require("kodingo-core");
 const memory_persistence_1 = require("../adapters/db-adapter/memory-persistence");
 const inference_1 = require("../adapters/ai/inference");
+const persistence_config_1 = require("../utils/persistence-config");
 const path_1 = __importDefault(require("path"));
 /**
  * Minimal EventPort implementation for the CLI.
@@ -113,6 +114,7 @@ class DbEventPort {
         const filePaths = extractFilePaths(filesChanged);
         const repoName = path_1.default.basename(this.repoPath);
         const shortHash = String(commitHash).slice(0, 8);
+        const { token, apiUrl } = (0, persistence_config_1.getCredentials)(this.repoPath);
         const content = await (0, inference_1.inferDecisionSummary)({
             diff: typeof summary?.rawDiff === "string"
                 ? summary.rawDiff
@@ -121,6 +123,8 @@ class DbEventPort {
             symbol: symbol ?? "unknown",
             commitMessage: decision.rationale ?? "",
             repoName,
+            token,
+            apiUrl,
         });
         const title = symbol
             ? `Decision: changes to ${symbol}`

package/dist/utils/persistence-config.js

@@ -9,6 +9,7 @@ exports.writeConfig = writeConfig;
 exports.writeWorkspaceConfig = writeWorkspaceConfig;
 exports.readWorkspaceConfig = readWorkspaceConfig;
 exports.isCloudMode = isCloudMode;
+exports.getCredentials = getCredentials;
 exports.getPersistence = getPersistence;
 /**
  * Persistence config switcher.
@@ -66,6 +67,32 @@ function readWorkspaceConfig(repoPath) {
 function isCloudMode() {
     return readConfig().mode === "cloud";
 }
+const API_BASE_DEFAULT = "https://kodingo-api.onrender.com";
+/**
+ * Real, workspace-scoped project credentials, walking up to parent
+ * directories when the exact repoRoot isn't a registered workspace key.
+ * Moved here from scan-git.ts (build brief "Item 8 — the temporal lobe",
+ * 2026-10-01) — it originally lived there as a private helper, but
+ * cloud-event-port.ts/db-event-port.ts now need this SAME real lookup too
+ * (see those files' own doc comments — inferDecisionSummary was calling
+ * POST /infer with no auth header at all). Importing it back from
+ * scan-git.ts would create a real circular dependency (scan-git.ts already
+ * imports both event-port classes); this lower-level module has no such
+ * cycle. Zero behavior change from the original — a pure relocation.
+ */
+function getCredentials(repoRoot) {
+    const config = readConfig();
+    const normRoot = repoRoot.replace(/\/+$/, "");
+    let wsEntry = config.workspaces?.[normRoot] ?? config.workspaces?.[normRoot + "/"];
+    let current = normRoot;
+    while (!wsEntry && current !== node_path_1.default.dirname(current)) {
+        current = node_path_1.default.dirname(current);
+        wsEntry = config.workspaces?.[current] ?? config.workspaces?.[current + "/"];
+    }
+    const token = wsEntry?.token ?? "";
+    const apiUrl = wsEntry?.apiUrl ?? config.apiUrl ?? API_BASE_DEFAULT;
+    return { token, apiUrl };
+}
 /**
  * Returns the correct persistence adapter based on config.
  * Import this in commands instead of importing the adapters directly.

package/dist/utils/repo-identity.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseRepoNameFromRemote = parseRepoNameFromRemote;
+exports.getRemoteUrl = getRemoteUrl;
+exports.deriveCandidateRepoName = deriveCandidateRepoName;
+exports.resolveCanonicalRepoName = resolveCanonicalRepoName;
+/**
+ * Resolves the canonical `repo` identity sent to the server, instead of
+ * every scan command inventing its own label from the local checkout.
+ *
+ * Root cause (build brief "Fix repo-label contamination at the source,
+ * platform-wide", 2026-09-30): every local capture path — scan-repo,
+ * security-scan, sync-dependencies, scan-git, and `kodingo init`'s own
+ * repo-registration call — independently computed `path.basename(repoRoot)`
+ * as the repo label. That's the local folder name, never a stable
+ * identifier: two developers with two different folder names for the same
+ * clone produce two different labels for the same real repo, and `init`
+ * seeded `kodingo_project_repos` (the intended source of truth) with that
+ * same unstable value, contaminating it at the first write.
+ *
+ * Fix: derive a candidate name from the git remote URL (stable across
+ * machines and folder names) and resolve it against the server's real,
+ * registered repos for this project via POST /cli/repo/resolve — which
+ * owns the single-repo / multi-repo / first-registration disambiguation.
+ * Falls back to the local folder name only when there's truly no git
+ * remote to read (e.g. a brand-new local-only repo).
+ */
+const path_1 = __importDefault(require("path"));
+const simple_git_1 = __importDefault(require("simple-git"));
+function parseRepoNameFromRemote(remoteUrl) {
+    const cleaned = remoteUrl.trim().replace(/\/+$/, "").replace(/\.git$/, "");
+    const match = cleaned.match(/[/:]([^/:]+)$/);
+    return match?.[1] || null;
+}
+async function getRemoteUrl(repoRoot) {
+    try {
+        const git = (0, simple_git_1.default)(repoRoot);
+        const remotes = await git.getRemotes(true);
+        if (!remotes.length)
+            return null;
+        const origin = remotes.find(r => r.name === "origin") ?? remotes[0];
+        return origin?.refs?.fetch || null;
+    }
+    catch {
+        return null;
+    }
+}
+async function deriveCandidateRepoName(repoRoot) {
+    const remoteUrl = await getRemoteUrl(repoRoot);
+    const fromRemote = remoteUrl ? parseRepoNameFromRemote(remoteUrl) : null;
+    if (fromRemote)
+        return { candidateName: fromRemote, hasRemote: true };
+    return { candidateName: path_1.default.basename(repoRoot), hasRemote: false };
+}
+/**
+ * Returns the canonical repo label to send with this scan. Fails open to
+ * the locally derived candidate if the server is unreachable — a scan
+ * should never be blocked by this resolution, and the git-remote-derived
+ * candidate is already more stable than the old folder-basename behaviour
+ * even without a round-trip to the server.
+ */
+async function resolveCanonicalRepoName(params) {
+    const { candidateName, hasRemote } = await deriveCandidateRepoName(params.repoRoot);
+    try {
+        const res = await fetch(`${params.apiUrl}/cli/repo/resolve`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "X-Kodingo-Token": params.token },
+            body: JSON.stringify({ candidateName, hasRemote }),
+        });
+        if (res.ok) {
+            const data = (await res.json());
+            if (data.repoName)
+                return data.repoName;
+        }
+    }
+    catch {
+        // offline / server unreachable — fail open below
+    }
+    return candidateName;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodingo-cli",
-  "version": "1.3.3",
+  "version": "1.3.5",
   "description": "Kodingo CLI",
   "license": "MIT",
   "private": false,